Packman Build Service PMBS

Changes of Revision 6

boringssl.changes Changed

@@ -1,4 +1,133 @@
 -------------------------------------------------------------------
+Mon Aug 24 14:32:50 UTC 2026 - Fridrich Strba <fridrich.strba@bluewin.ch>
+
+- Update to version 0.20260813:
+  * Update version for Bazel Central Repository to 0.20260813.0
+  * Bump BORINGSSL_API_VERSION
+  * Fix ACVP RSA PSS.
+  * Separate serial number validity from serial number length
+  * crypto/x509: Implement Merkle Tree inclusion proof evaluation
+  * crypto/x509: Add convenience function to verify signature from byte span
+  * Defer allocating reassembly buffers in DTLS
+  * Support cSHAKE and TurboSHAKE.
+  * runner: replace ptrTo with value-based new
+  * Enable `check_prefixed_symbols` on the CI-only prefixed symbols builders.
+  * Fix benchmark names of the IOVec variants.
+  * AEAD benchmarks: add iovec variants.
+  * audit_symbols.go: Default to locating libraries in the CWD.
+  * Add a stub for SSL_get_peer_tmp_key
+  * draft-ietf-tls-ecdhe-mlkem is now RFC 10024
+  * rust: bssl-tls: Unstage the callback uninstallers
+  * Update Rust and Clang.
+  * AEAD benchmarks: declare optimization hints.
+  * Don't unnecessarily tag ssl_cipher_is_deprecated as OPENSSL_EXPORT
+  * Remove OPENSSL_EXPORT on some internal SSL_SESSION functions
+  * Add some bit math helpers
+  * runner: Remove split handshake test machinery from the handshaker
+  * Revert "Work around a NASM bug"
+  * Update nasm in CI to 3.01
+  * rust: Publish the experimental bssl-tls tokio interop crate
+  * rust: bssl-tls-tokio: Rework the tests
+  * rust: bssl-tls: Introduce hyper support
+  * rust: bssl-tls: Add ALPN support
+  * Minor include cleanup.
+  * rust: hoist FFI slice converters to bssl-crypto
+  * Discard .group sections in fips_shared.lds
+  * runner: Remove split handshake tests
+  * rust: Minor nit fixing
+  * rust: Keep future options open through non-exhaustiveness
+  * Re-enable the linux32_sde CI builder.
+  * Unwind EVP_CIPHER_CTX poisoning
+  * Document that EVP_aes_256_xts is single-shot
+  * Bump SDE version.
+  * Make BoringSSL handling of "unusable" EchConfigLists configurable
+  * Disable urandom_test while under SDE.
+  * Remove inconsistent null pointer checks in cipher_update hooks
+  * Delete unused code
+  * bssl-tls: Use more representative test data for cert parsing
+  * acvptool: seed key format for ML-DSA sigGen and ML-KEM decap
+  * Delete the mac_tmp_try_out_cas builder.
+  * Upload all mobile binaries to CAS when building.
+  * rust: bssl-tls: Clean up all slice_from_raw_parts
+  * Upload all Mac binaries to CAS when building.
+  * Upload all Windows binaries to CAS when building.
+  * Upload all Linux binaries to CAS when building.
+  * Linux: also export *.so.* files to CAS.
+  * Remove old Kyber hybrid from the TLS stack
+  * Use the correct file list of the ios64 test build archival.
+  * Improve ECC benchmarks
+  * Prepare for a new BCR release.
+  * Test the remaining "interesting" build configs for LUCI uploads.
+  * Revert "Enable symbol prefixing for the Bazel build"
+  * Run 5 more temporary test configs.
+  * When exporting build artifacts to CAS, reduce to necessary stuff.
+  * rust: bssl-tls: Introduce certificate callback
+  * rust: bssl-tls: Minor typo fix
+  * EVP_CIPHER: only poison the object on failure if it was mutated by the call.
+  * Point CMake more firmly at the `delocate` and `inject_hash` binaries.
+  * rust: bssl-tls: Allow application to get selected credential
+  * ssl: Allow retrospection of PSK identity
+  * Bump Bazel version to 0.20260730.0
+  * rust: bssl-tls: Split Methods trait into connection and context variants
+  * In `linux_tmp_try_out_cas`, explicitly provide list of files to export.
+  * Create a temporary test CQ builder for setting up CAS uploading of artifacts.
+  * Preparation for including asm code from pq-code-package.
+  * TEST_F(BNTest, ModSqrtInvalid): explain what's going on.
+  * Preserve comments in perlasm.
+  * Documentation: add proper section heading for CRYPTO ByteBuilder
+  * rust: bssl-tls: Relax `set_ca_names` to both parties
+  * third_party/fiat: mark as Static
+  * New target: `run_unit_tests`.
+  * Reset the error queue in some more typical cases where unit tests intend to fail.
+  * Enable thread safety annotations in local bazel builds.
+  * rust: bssl-tls: Fix documentation
+  * rust: bssl-tls: RPK with private key methods
+  * Add Threads dependency in exported CMake config file
+  * Add CBB_add_u48
+  * Disable the linux32_sde runner for now.
+  * Enable symbol prefixing for the Bazel build
+  * ssl: Use default ALPN handler
+  * Fix typo in doc
+  * Fix notes on the SDE version on CI
+  * Test runner: when stdout is redirected, assume -pipe.
+  * rust: bssl-tls-tokio: Remove DTLS convenience wrappers
+  * Reset the error queue in some typical cases where unit tests intend to fail.
+  * Add an ErrorsAreAndClear test helper.
+  * rust: bssl-tls: Add cipher type
+  * rust: bssl-tls: Simplify the tests
+  * rust: bssl-tls: Make building a new connection builder infallible
+  * Add EVP-level RSAPublicKey and RSAPrivateKey parsers
+  * Add some EVP APIs for low-level EC point and scalar formats
+  * rust: bssl-tls: Unstage compliance policy
+  * Revamp evp_test key import
+  * draft-ietf-tls-keylogfile is now RFC 9850
+  * Export SLHDSA_generate_key_from_seed to the public API.
+  * rust: bssl-tls: Add convenient adapters
+  * rust: bssl-tls: Refactor the stack iterator
+  * Use EVP_PKEY_generate_from_alg in tool/server.cc
+  * rust: bssl-tls: Introduce non-X.509 mode
+  * ssl: Release the names if `SSL_set0_CA_names` is called after config is shed
+  * rust: bssl-tls: Add controls for CAs
+  * rust: bssl-tls: Make getting internal handle for us easier
+  * rust: bssl-tls: Move DTLS methods into the correct typestate
+  * rust: bssl-tls: Add missing SSL error codes
+  * rust: bssl-tls: Do not provide the TlsSession example
+  * rust/bssl-tls: Expose set_tlsext_host_name to support client SNI.
+  * Use scopers in CBB_flush_asn1_set_of
+  * Use the error queue a bit more consistently in CBB functions
+  * Update version for Bazel Central Repository to 0.20260713.0
+  * bssl-sys: fix clippy warnings
+  * bssl-crypto: support ECDSA verification of already-hashed messages.
+  * Implement trust anchor groups on the certificate selection side
+  * Handle serial numbers permissively in OCSP
+  * runner: Switch to CertificatePropertyList for passing properties to the shim
+  * Expose CBS_get_asn1_oid_component
+  * rust: bssl-tls: Unstage the session support
+  * rust: bssl-tls: Fix predicate on `established`
+  * MLKEM benchmark: also add a "private key from seed" benchmark.
+  * ssl: Support ML-KEM by default.
+
+-------------------------------------------------------------------
 Mon Aug 24 05:19:42 UTC 2026 - Fridrich Strba <fstrba@suse.com>
 
 - Update to version 0.20260708:

boringssl.spec Changed

curl-impersonate.patch Changed

@@ -1,5 +1,5 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index bab3d89dd..31be174ce 100644
+index 1ca8962..8d13163 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
 @@ -442,7 +442,9 @@ if(CMAKE_COMPILER_IS_GNUCXX OR CLANG)
@@ -13,7 +13,7 @@
    else()
      list(APPEND C_CXX_WARNINGS -Wall)
    endif()
-@@ -761,8 +763,6 @@ if(FIPS)
+@@ -763,8 +765,6 @@ if(FIPS)
    target_link_libraries(entropy_modulewrapper crypto)
  endif()
  
@@ -22,7 +22,7 @@
  
  if(BUILD_TESTING)
    add_executable(generate_mldsa_certs pki/testdata/verify_unittest/generate_mldsa_certs.cc)
-@@ -864,7 +864,6 @@ endif()
+@@ -876,7 +876,6 @@ endif()
  
  if(INSTALL_ENABLED)
    install(TARGETS crypto ssl EXPORT OpenSSLTargets)
@@ -31,7 +31,7 @@
    install(EXPORT OpenSSLTargets
            FILE OpenSSLTargets.cmake
 diff --git a/crypto/cipher/e_tls.cc b/crypto/cipher/e_tls.cc
-index 0edf61a24..5a8410d34 100644
+index 0edf61a..5a8410d 100644
 --- a/crypto/cipher/e_tls.cc
 +++ b/crypto/cipher/e_tls.cc
 @@ -442,6 +442,22 @@ static int aead_aes_256_cbc_sha1_tls_implicit_iv_init(
@@ -114,7 +114,7 @@
  }
  
 diff --git a/crypto/fipsmodule/ec/p256_test.cc b/crypto/fipsmodule/ec/p256_test.cc
-index a8039c385..3dfbea8fb 100644
+index a8039c3..3dfbea8 100644
 --- a/crypto/fipsmodule/ec/p256_test.cc
 +++ b/crypto/fipsmodule/ec/p256_test.cc
 @@ -21,7 +21,7 @@ BSSL_NAMESPACE_BEGIN
@@ -127,7 +127,7 @@
  #include "../../../third_party/fiat/p256_field.c.inc"
  }
 diff --git a/crypto/rand/windows.cc b/crypto/rand/windows.cc
-index ebd0d4afd..bf9c75e26 100644
+index ebd0d4a..bf9c75e 100644
 --- a/crypto/rand/windows.cc
 +++ b/crypto/rand/windows.cc
 @@ -60,6 +60,9 @@ void bssl::CRYPTO_sysrand(uint8_t *out, size_t requested) {
@@ -183,7 +183,7 @@
  
 diff --git a/export.sh b/export.sh
 new file mode 100755
-index 000000000..1baee7908
+index 0000000..1baee79
 --- /dev/null
 +++ b/export.sh
 @@ -0,0 +1,8 @@
@@ -196,7 +196,7 @@
 +git diff $BASE_COMMIT > boringssl.patch
 +mv boringssl.patch ../curl-impersonate/patches/boringssl.patch
 diff --git a/include/openssl/aead.h b/include/openssl/aead.h
-index 6b8ad575a..bae75c629 100644
+index 6b8ad57..bae75c6 100644
 --- a/include/openssl/aead.h
 +++ b/include/openssl/aead.h
 @@ -579,6 +579,9 @@ OPENSSL_EXPORT const EVP_AEAD *EVP_aead_aes_128_cbc_sha1_tls_implicit_iv(void);
@@ -210,7 +210,7 @@
  OPENSSL_EXPORT const EVP_AEAD *EVP_aead_des_ede3_cbc_sha1_tls_implicit_iv(void);
  
 diff --git a/include/openssl/nid.h b/include/openssl/nid.h
-index 6b3bb4506..58980e765 100644
+index 6b3bb45..58980e7 100644
 --- a/include/openssl/nid.h
 +++ b/include/openssl/nid.h
 @@ -5511,6 +5511,11 @@ extern "C" {
@@ -226,10 +226,10 @@
  #if defined(__cplusplus)
  } /* extern C */
 diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
-index 5c6d17ad2..a34cd85a7 100644
+index 3b48c2a..d9c7753 100644
 --- a/include/openssl/ssl.h
 +++ b/include/openssl/ssl.h
-@@ -1732,6 +1732,17 @@ OPENSSL_EXPORT int SSL_CTX_set_strict_cipher_list(SSL_CTX *ctx,
+@@ -1734,6 +1734,17 @@ OPENSSL_EXPORT int SSL_CTX_set_strict_cipher_list(SSL_CTX *ctx,
  
  // SSL_CTX_set_cipher_list configures the cipher list for `ctx`, evaluating
  // `str` as a cipher string. It returns one on success and zero on failure.
@@ -247,16 +247,16 @@
  //
  // Prefer to use `SSL_CTX_set_strict_cipher_list`. This function tolerates
  // garbage inputs, unless an empty cipher list results.
-@@ -2618,6 +2629,8 @@ OPENSSL_EXPORT size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx);
+@@ -2619,6 +2630,8 @@ OPENSSL_EXPORT size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx);
+ #define SSL_GROUP_X25519 29
  #define SSL_GROUP_X25519_MLKEM768 0x11ec
- #define SSL_GROUP_X25519_KYBER768_DRAFT00 0x6399
  #define SSL_GROUP_MLKEM1024 0x0202
 +#define SSL_GROUP_FFDHE2048 0x0100
 +#define SSL_GROUP_FFDHE3072 0x0101
  
  // SSL_CTX_set1_group_ids sets the preferred groups for `ctx` to `group_ids`.
  // Each element of `group_ids` should be a unique one of the `SSL_GROUP_*`
-@@ -5536,6 +5549,12 @@ OPENSSL_EXPORT void SSL_CTX_set_permute_extensions(SSL_CTX *ctx, int enabled);
+@@ -5569,6 +5582,12 @@ OPENSSL_EXPORT void SSL_CTX_set_permute_extensions(SSL_CTX *ctx, int enabled);
  // permute extensions. For now, this is only implemented for the ClientHello.
  OPENSSL_EXPORT void SSL_set_permute_extensions(SSL *ssl, int enabled);
  
@@ -269,7 +269,7 @@
  // SSL_max_seal_overhead returns the maximum overhead, in bytes, of sealing a
  // record with `ssl`.
  OPENSSL_EXPORT size_t SSL_max_seal_overhead(const SSL *ssl);
-@@ -5863,6 +5882,33 @@ OPENSSL_EXPORT int SSL_CTX_set1_sigalgs_list(SSL_CTX *ctx, const char *str);
+@@ -5899,6 +5918,33 @@ OPENSSL_EXPORT int SSL_CTX_set1_sigalgs_list(SSL_CTX *ctx, const char *str);
  // more convenient to codesearch for specific algorithm values.
  OPENSSL_EXPORT int SSL_set1_sigalgs_list(SSL *ssl, const char *str);
  
@@ -303,20 +303,20 @@
  #define SSL_set_app_data(s, arg) (SSL_set_ex_data(s, 0, (char *)(arg)))
  #define SSL_get_app_data(s) (SSL_get_ex_data(s, 0))
  #define SSL_SESSION_set_app_data(s, a) \
-@@ -6238,6 +6284,8 @@ OPENSSL_EXPORT int SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg);
+@@ -6274,6 +6320,8 @@ OPENSSL_EXPORT int SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg);
  #define SSL_CURVE_SECP384R1 SSL_GROUP_SECP384R1
  #define SSL_CURVE_SECP521R1 SSL_GROUP_SECP521R1
  #define SSL_CURVE_X25519 SSL_GROUP_X25519
 +#define SSL_CURVE_FFDHE2048 SSL_GROUP_FFDHE2048
 +#define SSL_CURVE_FFDHE3072 SSL_GROUP_FFDHE3072
- #define SSL_CURVE_X25519_KYBER768_DRAFT00 SSL_GROUP_X25519_KYBER768_DRAFT00
  
  // SSL_get_curve_id calls `SSL_get_group_id`.
+ OPENSSL_EXPORT uint16_t SSL_get_curve_id(const SSL *ssl);
 diff --git a/include/openssl/target.h b/include/openssl/target.h
-index 2372a055d..f8790c3b2 100644
+index 7e5a19a..f3534df 100644
 --- a/include/openssl/target.h
 +++ b/include/openssl/target.h
-@@ -45,6 +45,9 @@
+@@ -51,6 +51,9 @@
  #define OPENSSL_RISCV64
  #elif defined(__riscv) && __SIZEOF_POINTER__ == 4
  #define OPENSSL_32_BIT
@@ -327,7 +327,7 @@
  #define OPENSSL_32_BIT
  #define OPENSSL_PNACL
 diff --git a/include/openssl/tls1.h b/include/openssl/tls1.h
-index f4b348481..afb56f59b 100644
+index f4b3484..afb56f5 100644
 --- a/include/openssl/tls1.h
 +++ b/include/openssl/tls1.h
 @@ -48,6 +48,9 @@ extern "C" {
@@ -396,10 +396,10 @@
  #define TLS1_3_RFC_AES_256_GCM_SHA384 "TLS_AES_256_GCM_SHA384"
  #define TLS1_3_RFC_CHACHA20_POLY1305_SHA256 "TLS_CHACHA20_POLY1305_SHA256"
 diff --git a/ssl/extensions.cc b/ssl/extensions.cc
-index 022714a3f..39a45b3e7 100644
+index 90238d9..6304682 100644
 --- a/ssl/extensions.cc
 +++ b/ssl/extensions.cc
-@@ -2383,6 +2383,10 @@ bool ssl_setup_key_shares(SSL_HANDSHAKE *hs, uint16_t override_group_id) {
+@@ -2414,6 +2414,10 @@ bool ssl_setup_key_shares(SSL_HANDSHAKE *hs, uint16_t override_group_id) {
    SSLImpl *const ssl = hs->ssl;
    hs->key_shares.clear();
    hs->key_share_bytes.Reset();
@@ -410,7 +410,7 @@
  
    // If offering a PAKE, do not set up key shares. We do not currently support
    // clients offering both PAKE and non-PAKE modes, including resumption.
-@@ -2427,24 +2431,30 @@ bool ssl_setup_key_shares(SSL_HANDSHAKE *hs, uint16_t override_group_id) {
+@@ -2458,24 +2462,30 @@ bool ssl_setup_key_shares(SSL_HANDSHAKE *hs, uint16_t override_group_id) {
    }
  
    // Run the default selection if we don't have anything better.
@@ -449,7 +449,7 @@
      }
      selected_key_shares.emplace(default_key_shares);
    }
-@@ -2540,6 +2550,7 @@ bool ssl_ext_key_share_parse_serverhello(SSL_HANDSHAKE *hs,
+@@ -2571,6 +2581,7 @@ bool ssl_ext_key_share_parse_serverhello(SSL_HANDSHAKE *hs,
      return false;
    }
  
@@ -457,7 +457,7 @@
    hs->new_session->group_id = group_id;
    hs->key_shares.clear();
    return true;
-@@ -3272,6 +3283,27 @@ static bool ext_quic_transport_params_add_serverhello_legacy(SSL_HANDSHAKE *hs,
+@@ -3303,6 +3314,27 @@ static bool ext_quic_transport_params_add_serverhello_legacy(SSL_HANDSHAKE *hs,
  static bool ext_delegated_credential_add_clienthello(
      const SSL_HANDSHAKE *hs, CBB *out, CBB *out_compressible,
      ssl_client_hello_type_t type) {
@@ -485,7 +485,7 @@
    return true;
  }
  
-@@ -4071,6 +4103,42 @@ static bool ext_server_cert_type_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
+@@ -4102,6 +4134,42 @@ static bool ext_server_cert_type_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
    return true;
  }
  
@@ -528,7 +528,7 @@
  // kExtensions contains all the supported extensions.
  static const struct tls_extension kExtensions = {
      {
-@@ -4244,6 +4312,13 @@ static const struct tls_extension kExtensions = {
+@@ -4275,6 +4343,13 @@ static const struct tls_extension kExtensions = {
          ignore_parse_clienthello,
          ext_alps_add_serverhello,
      },
@@ -542,7 +542,7 @@
      {
          TLSEXT_TYPE_application_settings_old,
          ext_alps_add_clienthello_old,
-@@ -4324,6 +4399,7 @@ bool ssl_setup_extension_permutation(SSL_HANDSHAKE *hs) {
+@@ -4355,6 +4430,7 @@ bool ssl_setup_extension_permutation(SSL_HANDSHAKE *hs) {
        !permutation.InitForOverwrite(kNumExtensions)) {
      return false;
    }
@@ -550,7 +550,7 @@
    for (size_t i = 0; i < kNumExtensions; i++) {
      permutationi = i;
    }
-@@ -4348,6 +4424,90 @@ static const struct tls_extension *tls_extension_find(uint32_t *out_index,
+@@ -4379,6 +4455,90 @@ static const struct tls_extension *tls_extension_find(uint32_t *out_index,
    return nullptr;
  }
  
@@ -641,7 +641,7 @@
  static bool add_padding_extension(CBB *cbb, uint16_t ext, size_t len) {
    CBB child;
    if (!CBB_add_u16(cbb, ext) ||  //
-@@ -4393,6 +4553,7 @@ static bool ssl_add_clienthello_tlsext_inner(SSL_HANDSHAKE *hs, CBB *out,
+@@ -4424,6 +4584,7 @@ static bool ssl_add_clienthello_tlsext_inner(SSL_HANDSHAKE *hs, CBB *out,
      size_t i = hs->extension_permutation.empty()
                     ? unpermuted
                     : hs->extension_permutationunpermuted;
@@ -649,7 +649,7 @@
      const size_t len_before = CBB_len(&extensions);
      const size_t len_compressed_before = CBB_len(compressed.get());
      if (!kExtensionsi.add_clienthello(hs, &extensions, compressed.get(),
-@@ -4506,6 +4667,7 @@ bool ssl_add_clienthello_tlsext(SSL_HANDSHAKE *hs, CBB *out, CBB *out_encoded,
+@@ -4537,6 +4698,7 @@ bool ssl_add_clienthello_tlsext(SSL_HANDSHAKE *hs, CBB *out, CBB *out_encoded,
      size_t i = hs->extension_permutation.empty()
                     ? unpermuted
                     : hs->extension_permutationunpermuted;
@@ -658,7 +658,7 @@
      if (!kExtensionsi.add_clienthello(hs, &extensions, &extensions, type)) {
        OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_ADDING_EXTENSION);
 diff --git a/ssl/handshake_client.cc b/ssl/handshake_client.cc
-index a4a53cda6..ec1d84bae 100644
+index a4a53cd..ec1d84b 100644
 --- a/ssl/handshake_client.cc
 +++ b/ssl/handshake_client.cc
 @@ -26,6 +26,8 @@
@@ -845,10 +845,10 @@
      CBB child;
      if (!CBB_add_u8_length_prefixed(&body, &child)) {
 diff --git a/ssl/internal.h b/ssl/internal.h
-index 30b2269ad..a6154cac3 100644
+index 96f6d3d..8fdc6c8 100644
 --- a/ssl/internal.h
 +++ b/ssl/internal.h
-@@ -217,10 +217,11 @@ BSSL_NAMESPACE_BEGIN
+@@ -218,10 +218,11 @@ BSSL_NAMESPACE_BEGIN
  
  // Bits for `algorithm_mkey` (key exchange algorithm).
  #define SSL_kRSA 0x00000001u
@@ -863,7 +863,7 @@
  
  // Bits for `algorithm_auth` (server authentication).
  #define SSL_aRSA_SIGN 0x00000001u
-@@ -245,8 +246,9 @@ BSSL_NAMESPACE_BEGIN
+@@ -246,8 +247,9 @@ BSSL_NAMESPACE_BEGIN
  // Bits for `algorithm_mac` (symmetric authentication).
  #define SSL_SHA1 0x00000001u
  #define SSL_SHA256 0x00000002u
@@ -874,16 +874,16 @@
  
  // Bits for `algorithm_prf` (handshake digest).
  #define SSL_HANDSHAKE_MAC_DEFAULT 0x1
-@@ -917,7 +919,7 @@ struct NamedGroup {
+@@ -918,7 +920,7 @@ struct NamedGroup {
  Span<const NamedGroup> NamedGroups();
  
  // kNumNamedGroups is the number of supported groups.
--constexpr size_t kNumNamedGroups = 7u;
-+constexpr size_t kNumNamedGroups = 9u;
+-constexpr size_t kNumNamedGroups = 6u;
++constexpr size_t kNumNamedGroups = 8u;
  
  // DefaultSupportedGroupIds returns the list of IDs for the default groups that
  // are supported when the caller hasn't explicitly configured supported groups.
-@@ -1910,6 +1912,9 @@ struct SSL_HANDSHAKE {
+@@ -1923,6 +1925,9 @@ struct SSL_HANDSHAKE {
    // delegated credentials.
    Array<uint16_t> peer_delegated_credential_sigalgs;
  
@@ -893,7 +893,7 @@
    // peer_key is the peer's ECDH key for a TLS 1.2 client.
    Array<uint8_t> peer_key;
  
-@@ -2225,6 +2230,14 @@ UniquePtr<SSL_SESSION> tls13_create_session_with_ticket(SSLImpl *ssl,
+@@ -2238,6 +2243,14 @@ UniquePtr<SSL_SESSION> tls13_create_session_with_ticket(SSLImpl *ssl,
  // for `hs`, if applicable. It returns true on success and false on error.
  bool ssl_setup_extension_permutation(SSL_HANDSHAKE *hs);
  
@@ -908,7 +908,7 @@
  // ssl_setup_pre_shared_keys computes the offered client PSKs and saves them in
  // `hs`. It returns true on success and false on failure.
  bool ssl_setup_pre_shared_keys(SSL_HANDSHAKE *hs);
-@@ -3373,6 +3386,15 @@ struct SSL_CONFIG {
+@@ -3421,6 +3434,15 @@ struct SSL_CONFIG {
    // crypto
    UniquePtr<SSLCipherPreferenceList> cipher_list;
  
@@ -924,7 +924,7 @@
    // This is used to hold the local certificate used (i.e. the server
    // certificate for a server or the client certificate for a client).
    UniquePtr<CERT> cert;
-@@ -3454,6 +3476,10 @@ struct SSL_CONFIG {
+@@ -3502,6 +3524,10 @@ struct SSL_CONFIG {
    // accepted from the peer in decreasing order of preference.
    Array<uint16_t> verify_sigalgs;
  
@@ -935,7 +935,7 @@
    // srtp_profiles is the list of configured SRTP protection profiles for
    // DTLS-SRTP.
    UniquePtr<STACK_OF(SRTP_PROTECTION_PROFILE)> srtp_profiles;
-@@ -3532,6 +3558,14 @@ struct SSL_CONFIG {
+@@ -3584,6 +3610,14 @@ struct SSL_CONFIG {
    // hardware support, and use the value in aes_hw_override_value instead.
    bool aes_hw_override : 1;
  
@@ -950,7 +950,7 @@
    // aes_hw_override_value is used for testing to indicate the support or lack
    // of support for AES hw. The value is only considered if `aes_hw_override` is
    // true.
-@@ -3913,6 +3947,15 @@ class SSLContext : public ssl_ctx_st, public RefCounted<SSLContext> {
+@@ -3966,6 +4000,15 @@ class SSLContext : public ssl_ctx_st, public RefCounted<SSLContext> {
  
    UniquePtr<SSLCipherPreferenceList> cipher_list;
  
@@ -966,7 +966,7 @@
    X509_STORE *cert_store = nullptr;
    LHASH_OF(SSL_SESSION) *sessions = nullptr;
    // Most session-ids that will be cached, default is
-@@ -4147,6 +4190,10 @@ class SSLContext : public ssl_ctx_st, public RefCounted<SSLContext> {
+@@ -4200,6 +4243,10 @@ class SSLContext : public ssl_ctx_st, public RefCounted<SSLContext> {
    // available_client_cert_types inherited by SSL struct.
    InplaceVector<uint8_t, kNumCertTypes> available_client_cert_types;
  
@@ -977,7 +977,7 @@
    // retain_only_sha256_of_client_certs is true if we should compute the SHA256
    // hash of the peer's certificate and then discard it to save memory and
    // session space. Only effective on the server side.
-@@ -4208,6 +4255,13 @@ class SSLContext : public ssl_ctx_st, public RefCounted<SSLContext> {
+@@ -4261,6 +4308,13 @@ class SSLContext : public ssl_ctx_st, public RefCounted<SSLContext> {
    // signal its sessions may be resumed across names in the server certificate.
    bool resumption_across_names_enabled : 1;
  
@@ -992,7 +992,7 @@
    friend RefCounted;
    ~SSLContext();
 diff --git a/ssl/ssl_cipher.cc b/ssl/ssl_cipher.cc
-index 7799d79f9..a978e66ac 100644
+index 7799d79..a978e66 100644
 --- a/ssl/ssl_cipher.cc
 +++ b/ssl/ssl_cipher.cc
 @@ -63,6 +63,18 @@ static constexpr SSL_CIPHER kCiphers = {
@@ -1260,11 +1260,11 @@
        mac = "AEAD";
        break;
 diff --git a/ssl/ssl_key_share.cc b/ssl/ssl_key_share.cc
-index 5923110e7..f50079930 100644
+index 84394b2..f0ffebf 100644
 --- a/ssl/ssl_key_share.cc
 +++ b/ssl/ssl_key_share.cc
-@@ -444,6 +444,8 @@ constexpr NamedGroup kNamedGroups = {
-      "X25519Kyber768Draft00", ""},
+@@ -352,6 +352,8 @@ constexpr NamedGroup kNamedGroups = {
+     {NID_X25519, SSL_GROUP_X25519, "X25519", "x25519"},
      {NID_X25519MLKEM768, SSL_GROUP_X25519_MLKEM768, "X25519MLKEM768", ""},
      {NID_ML_KEM_1024, SSL_GROUP_MLKEM1024, "MLKEM1024", ""},
 +    {NID_ffdhe2048, SSL_CURVE_FFDHE2048, "dhe2048", "ffdhe2048"},
@@ -1273,7 +1273,7 @@
  
  static_assert(std::size(kNamedGroups) == kNumNamedGroups,
 diff --git a/ssl/ssl_lib.cc b/ssl/ssl_lib.cc
-index e05f91bd9..ff0d1021c 100644
+index a0c746b..13bce22 100644
 --- a/ssl/ssl_lib.cc
 +++ b/ssl/ssl_lib.cc
 @@ -530,6 +530,17 @@ SSL *SSL_new(SSL_CTX *ctx) {
@@ -1304,7 +1304,7 @@
        !ssl->config->accepted_peer_cert_types.TryCopyFrom(
            ctx_impl->accepted_peer_cert_types) ||
        !ssl->config->available_client_cert_types.TryCopyFrom(
-@@ -2206,22 +2220,31 @@ const char *SSL_get_cipher_list(const SSL *ssl, int n) {
+@@ -2207,22 +2221,31 @@ const char *SSL_get_cipher_list(const SSL *ssl, int n) {
    return c->name;
  }
  
@@ -1345,7 +1345,7 @@
  }
  
  int SSL_set_cipher_list(SSL *ssl, const char *str) {
-@@ -2313,6 +2336,30 @@ void SSL_enable_ocsp_stapling(SSL *ssl) {
+@@ -2314,6 +2337,30 @@ void SSL_enable_ocsp_stapling(SSL *ssl) {
    ssl_impl->config->ocsp_stapling_enabled = true;
  }
  
@@ -1376,7 +1376,7 @@
  void SSL_get0_signed_cert_timestamp_list(const SSL *ssl, const uint8_t **out,
                                           size_t *out_len) {
    SSL_SESSION *session = SSL_get_session(ssl);
-@@ -3281,6 +3328,21 @@ void SSL_CTX_set_permute_extensions(SSL_CTX *ctx, int enabled) {
+@@ -3284,6 +3331,21 @@ void SSL_CTX_set_permute_extensions(SSL_CTX *ctx, int enabled) {
    FromOpaque(ctx)->permute_extensions = !!enabled;
  }
  
@@ -1399,7 +1399,7 @@
    auto *ssl_impl = FromOpaque(ssl);
    if (!ssl_impl->config) {
 diff --git a/ssl/ssl_privkey.cc b/ssl/ssl_privkey.cc
-index ae7c9bbd5..22c96202b 100644
+index ae7c9bb..22c9620 100644
 --- a/ssl/ssl_privkey.cc
 +++ b/ssl/ssl_privkey.cc
 @@ -573,31 +573,12 @@ int SSL_is_signature_algorithm_rsa_pss(uint16_t sigalg) {

_service Changed

_servicedata Changed

boringssl-0.20260708.tar.xz/crypto/kyber Deleted

boringssl-0.20260708.tar.xz/crypto/kyber/internal.h Deleted

@@ -1,165 +0,0 @@
-// Copyright 2023 The BoringSSL Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#ifndef OPENSSL_HEADER_CRYPTO_KYBER_INTERNAL_H
-#define OPENSSL_HEADER_CRYPTO_KYBER_INTERNAL_H
-
-#include <openssl/base.h>
-
-
-BSSL_NAMESPACE_BEGIN
-
-// Kyber is the pre-standard version of ML-KEM. This was once exported as public
-// API, but is now internal and only used by libssl. It will be removed entirely
-// in the future.
-//
-// This implements the round-3 specification of Kyber, defined at
-// https://pq-crystals.org/kyber/data/kyber-specification-round3-20210804.pdf
-
-// KYBER_public_key contains a Kyber768 public key. The contents of this
-// object should never leave the address space since the format is unstable.
-struct KYBER_public_key {
-  union {
-    uint8_t bytes512 * (3 + 9) + 32 + 32;
-    uint16_t alignment;
-  } opaque;
-};
-
-// KYBER_private_key contains a Kyber768 private key. The contents of this
-// object should never leave the address space since the format is unstable.
-struct KYBER_private_key {
-  union {
-    uint8_t bytes512 * (3 + 3 + 9) + 32 + 32 + 32;
-    uint16_t alignment;
-  } opaque;
-};
-
-// KYBER_PUBLIC_KEY_BYTES is the number of bytes in an encoded Kyber768 public
-// key.
-#define KYBER_PUBLIC_KEY_BYTES 1184
-
-// KYBER_SHARED_SECRET_BYTES is the number of bytes in the Kyber768 shared
-// secret. Although the round-3 specification has a variable-length output, the
-// final ML-KEM construction is expected to use a fixed 32-byte output. To
-// simplify the future transition, we apply the same restriction.
-#define KYBER_SHARED_SECRET_BYTES 32
-
-// KYBER_generate_key generates a random public/private key pair, writes the
-// encoded public key to `out_encoded_public_key` and sets `out_private_key` to
-// the private key.
-OPENSSL_EXPORT void KYBER_generate_key(
-    uint8_t out_encoded_public_keyKYBER_PUBLIC_KEY_BYTES,
-    struct KYBER_private_key *out_private_key);
-
-// KYBER_public_from_private sets `*out_public_key` to the public key that
-// corresponds to `private_key`. (This is faster than parsing the output of
-// `KYBER_generate_key` if, for some reason, you need to encapsulate to a key
-// that was just generated.)
-OPENSSL_EXPORT void KYBER_public_from_private(
-    struct KYBER_public_key *out_public_key,
-    const struct KYBER_private_key *private_key);
-
-// KYBER_CIPHERTEXT_BYTES is number of bytes in the Kyber768 ciphertext.
-#define KYBER_CIPHERTEXT_BYTES 1088
-
-// KYBER_encap encrypts a random shared secret for `public_key`, writes the
-// ciphertext to `out_ciphertext`, and writes the random shared secret to
-// `out_shared_secret`.
-OPENSSL_EXPORT void KYBER_encap(
-    uint8_t out_ciphertextKYBER_CIPHERTEXT_BYTES,
-    uint8_t out_shared_secretKYBER_SHARED_SECRET_BYTES,
-    const struct KYBER_public_key *public_key);
-
-// KYBER_decap decrypts a shared secret from `ciphertext` using `private_key`
-// and writes it to `out_shared_secret`. If `ciphertext` is invalid,
-// `out_shared_secret` is filled with a key that will always be the same for the
-// same `ciphertext` and `private_key`, but which appears to be random unless
-// one has access to `private_key`. These alternatives occur in constant time.
-// Any subsequent symmetric encryption using `out_shared_secret` must use an
-// authenticated encryption scheme in order to discover the decapsulation
-// failure.
-OPENSSL_EXPORT void KYBER_decap(
-    uint8_t out_shared_secretKYBER_SHARED_SECRET_BYTES,
-    const uint8_t ciphertextKYBER_CIPHERTEXT_BYTES,
-    const struct KYBER_private_key *private_key);
-
-
-// Serialisation of keys.
-
-// KYBER_marshal_public_key serializes `public_key` to `out` in the standard
-// format for Kyber public keys. It returns one on success or zero on allocation
-// error.
-OPENSSL_EXPORT int KYBER_marshal_public_key(
-    CBB *out, const struct KYBER_public_key *public_key);
-
-// KYBER_parse_public_key parses a public key, in the format generated by
-// `KYBER_marshal_public_key`, from `in` and writes the result to
-// `out_public_key`. It returns one on success or zero on parse error or if
-// there are trailing bytes in `in`.
-OPENSSL_EXPORT int KYBER_parse_public_key(
-    struct KYBER_public_key *out_public_key, CBS *in);
-
-// KYBER_marshal_private_key serializes `private_key` to `out` in the standard
-// format for Kyber private keys. It returns one on success or zero on
-// allocation error.
-OPENSSL_EXPORT int KYBER_marshal_private_key(
-    CBB *out, const struct KYBER_private_key *private_key);
-
-// KYBER_PRIVATE_KEY_BYTES is the length of the data produced by
-// `KYBER_marshal_private_key`.
-#define KYBER_PRIVATE_KEY_BYTES 2400
-
-// KYBER_parse_private_key parses a private key, in the format generated by
-// `KYBER_marshal_private_key`, from `in` and writes the result to
-// `out_private_key`. It returns one on success or zero on parse error or if
-// there are trailing bytes in `in`.
-OPENSSL_EXPORT int KYBER_parse_private_key(
-    struct KYBER_private_key *out_private_key, CBS *in);
-
-
-// Internal symbols.
-
-// KYBER_ENCAP_ENTROPY is the number of bytes of uniformly random entropy
-// necessary to encapsulate a secret. The entropy will be leaked to the
-// decapsulating party.
-#define KYBER_ENCAP_ENTROPY 32
-
-// KYBER_GENERATE_KEY_ENTROPY is the number of bytes of uniformly random entropy
-// necessary to generate a key.
-#define KYBER_GENERATE_KEY_ENTROPY 64
-
-// KYBER_generate_key_external_entropy is a deterministic function to create a
-// pair of Kyber768 keys, using the supplied entropy. The entropy needs to be
-// uniformly random generated. This function is should only be used for tests,
-// regular callers should use the non-deterministic `KYBER_generate_key`
-// directly.
-OPENSSL_EXPORT void KYBER_generate_key_external_entropy(
-    uint8_t out_encoded_public_keyKYBER_PUBLIC_KEY_BYTES,
-    struct KYBER_private_key *out_private_key,
-    const uint8_t entropyKYBER_GENERATE_KEY_ENTROPY);
-
-// KYBER_encap_external_entropy behaves like `KYBER_encap`, but uses
-// `KYBER_ENCAP_ENTROPY` bytes of `entropy` for randomization. The decapsulating
-// side will be able to recover `entropy` in full. This function should only be
-// used for tests, regular callers should use the non-deterministic
-// `KYBER_encap` directly.
-OPENSSL_EXPORT void KYBER_encap_external_entropy(
-    uint8_t out_ciphertextKYBER_CIPHERTEXT_BYTES,
-    uint8_t out_shared_secretKYBER_SHARED_SECRET_BYTES,
-    const struct KYBER_public_key *public_key,
-    const uint8_t entropyKYBER_ENCAP_ENTROPY);
-
-BSSL_NAMESPACE_END
-
-#endif  // OPENSSL_HEADER_CRYPTO_KYBER_INTERNAL_H

boringssl-0.20260708.tar.xz/crypto/kyber/kyber.cc Deleted

@@ -1,870 +0,0 @@
-// Copyright 2023 The BoringSSL Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include <assert.h>
-#include <stdlib.h>
-
-#include <openssl/bytestring.h>
-#include <openssl/rand.h>
-
-#include "../fipsmodule/keccak/internal.h"
-#include "../internal.h"
-#include "./internal.h"
-
-
-// See
-// https://pq-crystals.org/kyber/data/kyber-specification-round3-20210804.pdf
-
-using namespace bssl;
-
-static void prf(uint8_t *out, size_t out_len, const uint8_t in33) {
-  BORINGSSL_keccak(out, out_len, in, 33, boringssl_shake256);
-}
-
-static void hash_h(uint8_t out32, const uint8_t *in, size_t len) {
-  BORINGSSL_keccak(out, 32, in, len, boringssl_sha3_256);
-}
-
-static void hash_g(uint8_t out64, const uint8_t *in, size_t len) {
-  BORINGSSL_keccak(out, 64, in, len, boringssl_sha3_512);
-}
-
-static void kdf(uint8_t *out, size_t out_len, const uint8_t *in, size_t len) {
-  BORINGSSL_keccak(out, out_len, in, len, boringssl_shake256);
-}
-
-#define DEGREE 256
-#define RANK 3
-
-static const size_t kBarrettMultiplier = 5039;
-static const unsigned kBarrettShift = 24;
-static const uint16_t kPrime = 3329;
-static const int kLog2Prime = 12;
-static const uint16_t kHalfPrime = (/*kPrime=*/3329 - 1) / 2;
-static const int kDU = 10;
-static const int kDV = 4;
-// kInverseDegree is 128^-1 mod 3329; 128 because kPrime does not have a 512th
-// root of unity.
-static const uint16_t kInverseDegree = 3303;
-static const size_t kEncodedVectorSize =
-    (/*kLog2Prime=*/12 * DEGREE / 8) * RANK;
-static const size_t kCompressedVectorSize = /*kDU=*/10 * RANK * DEGREE / 8;
-
-typedef struct scalar {
-  // On every function entry and exit, 0 <= c < kPrime.
-  uint16_t cDEGREE;
-} scalar;
-
-typedef struct vector {
-  scalar vRANK;
-} vector;
-
-typedef struct matrix {
-  scalar vRANKRANK;
-} matrix;
-
-// This bit of Python will be referenced in some of the following comments:
-//
-// p = 3329
-//
-// def bitreverse(i):
-//     ret = 0
-//     for n in range(7):
-//         bit = i & 1
-//         ret <<= 1
-//         ret |= bit
-//         i >>= 1
-//     return ret
-
-// kNTTRoots = pow(17, bitreverse(i), p) for i in range(128)
-static const uint16_t kNTTRoots128 = {
-    1,    1729, 2580, 3289, 2642, 630,  1897, 848,  1062, 1919, 193,  797,
-    2786, 3260, 569,  1746, 296,  2447, 1339, 1476, 3046, 56,   2240, 1333,
-    1426, 2094, 535,  2882, 2393, 2879, 1974, 821,  289,  331,  3253, 1756,
-    1197, 2304, 2277, 2055, 650,  1977, 2513, 632,  2865, 33,   1320, 1915,
-    2319, 1435, 807,  452,  1438, 2868, 1534, 2402, 2647, 2617, 1481, 648,
-    2474, 3110, 1227, 910,  17,   2761, 583,  2649, 1637, 723,  2288, 1100,
-    1409, 2662, 3281, 233,  756,  2156, 3015, 3050, 1703, 1651, 2789, 1789,
-    1847, 952,  1461, 2687, 939,  2308, 2437, 2388, 733,  2337, 268,  641,
-    1584, 2298, 2037, 3220, 375,  2549, 2090, 1645, 1063, 319,  2773, 757,
-    2099, 561,  2466, 2594, 2804, 1092, 403,  1026, 1143, 2150, 2775, 886,
-    1722, 1212, 1874, 1029, 2110, 2935, 885,  2154,
-};
-
-// kInverseNTTRoots = pow(17, -bitreverse(i), p) for i in range(128)
-static const uint16_t kInverseNTTRoots128 = {
-    1,    1600, 40,   749,  2481, 1432, 2699, 687,  1583, 2760, 69,   543,
-    2532, 3136, 1410, 2267, 2508, 1355, 450,  936,  447,  2794, 1235, 1903,
-    1996, 1089, 3273, 283,  1853, 1990, 882,  3033, 2419, 2102, 219,  855,
-    2681, 1848, 712,  682,  927,  1795, 461,  1891, 2877, 2522, 1894, 1010,
-    1414, 2009, 3296, 464,  2697, 816,  1352, 2679, 1274, 1052, 1025, 2132,
-    1573, 76,   2998, 3040, 1175, 2444, 394,  1219, 2300, 1455, 2117, 1607,
-    2443, 554,  1179, 2186, 2303, 2926, 2237, 525,  735,  863,  2768, 1230,
-    2572, 556,  3010, 2266, 1684, 1239, 780,  2954, 109,  1292, 1031, 1745,
-    2688, 3061, 992,  2596, 941,  892,  1021, 2390, 642,  1868, 2377, 1482,
-    1540, 540,  1678, 1626, 279,  314,  1173, 2573, 3096, 48,   667,  1920,
-    2229, 1041, 2606, 1692, 680,  2746, 568,  3312,
-};
-
-// kModRoots = pow(17, 2*bitreverse(i) + 1, p) for i in range(128)
-static const uint16_t kModRoots128 = {
-    17,   3312, 2761, 568,  583,  2746, 2649, 680,  1637, 1692, 723,  2606,
-    2288, 1041, 1100, 2229, 1409, 1920, 2662, 667,  3281, 48,   233,  3096,
-    756,  2573, 2156, 1173, 3015, 314,  3050, 279,  1703, 1626, 1651, 1678,
-    2789, 540,  1789, 1540, 1847, 1482, 952,  2377, 1461, 1868, 2687, 642,
-    939,  2390, 2308, 1021, 2437, 892,  2388, 941,  733,  2596, 2337, 992,
-    268,  3061, 641,  2688, 1584, 1745, 2298, 1031, 2037, 1292, 3220, 109,
-    375,  2954, 2549, 780,  2090, 1239, 1645, 1684, 1063, 2266, 319,  3010,
-    2773, 556,  757,  2572, 2099, 1230, 561,  2768, 2466, 863,  2594, 735,
-    2804, 525,  1092, 2237, 403,  2926, 1026, 2303, 1143, 2186, 2150, 1179,
-    2775, 554,  886,  2443, 1722, 1607, 1212, 2117, 1874, 1455, 1029, 2300,
-    2110, 1219, 2935, 394,  885,  2444, 2154, 1175,
-};
-
-// reduce_once reduces 0 <= x < 2*kPrime, mod kPrime.
-static uint16_t reduce_once(uint16_t x) {
-  declassify_assert(x < 2 * kPrime);
-  const uint16_t subtracted = x - kPrime;
-  uint16_t mask = 0u - (subtracted >> 15);
-  // Although this is a constant-time select, we omit a value barrier here.
-  // Value barriers impede auto-vectorization (likely because it forces the
-  // value to transit through a general-purpose register). On AArch64, this is a
-  // difference of 2x.
-  //
-  // We usually add value barriers to selects because Clang turns consecutive
-  // selects with the same condition into a branch instead of CMOV/CSEL. This
-  // condition does not occur in Kyber, so omitting it seems to be safe so far,
-  // but see `scalar_centered_binomial_distribution_eta_2_with_prf`.
-  return (mask & x) | (~mask & subtracted);
-}
-
-// constant time reduce x mod kPrime using Barrett reduction. x must be less
-// than kPrime + 2×kPrime².
-static uint16_t reduce(uint32_t x) {
-  declassify_assert(x < kPrime + 2u * kPrime * kPrime);
-  uint64_t product = (uint64_t)x * kBarrettMultiplier;
-  uint32_t quotient = (uint32_t)(product >> kBarrettShift);
-  uint32_t remainder = x - quotient * kPrime;
-  return reduce_once(remainder);
-}
-
-static void scalar_zero(scalar *out) { OPENSSL_memset(out, 0, sizeof(*out)); }
-
-static void vector_zero(vector *out) { OPENSSL_memset(out, 0, sizeof(*out)); }
-
-// In place number theoretic transform of a given scalar.
-// Note that Kyber's kPrime 3329 does not have a 512th root of unity, so this
-// transform leaves off the last iteration of the usual FFT code, with the 128
-// relevant roots of unity being stored in `kNTTRoots`. This means the output
-// should be seen as 128 elements in GF(3329^2), with the coefficients of the
-// elements being consecutive entries in `s->c`.
-static void scalar_ntt(scalar *s) {
-  int offset = DEGREE;
-  // `int` is used here because using `size_t` throughout caused a ~5% slowdown
-  // with Clang 14 on Aarch64.
-  for (int step = 1; step < DEGREE / 2; step <<= 1) {
-    offset >>= 1;
-    int k = 0;
-    for (int i = 0; i < step; i++) {
-      const uint32_t step_root = kNTTRootsi + step;
-      for (int j = k; j < k + offset; j++) {
-        uint16_t odd = reduce(step_root * s->cj + offset);
-        uint16_t even = s->cj;
-        s->cj = reduce_once(odd + even);
-        s->cj + offset = reduce_once(even - odd + kPrime);
-      }
-      k += 2 * offset;
-    }
-  }
-}
-
-static void vector_ntt(vector *a) {
-  for (int i = 0; i < RANK; i++) {
-    scalar_ntt(&a->vi);
-  }
-}
-
-// In place inverse number theoretic transform of a given scalar, with pairs of
-// entries of s->v being interpreted as elements of GF(3329^2). Just as with the
-// number theoretic transform, this leaves off the first step of the normal iFFT
-// to account for the fact that 3329 does not have a 512th root of unity, using
-// the precomputed 128 roots of unity stored in `kInverseNTTRoots`.
-static void scalar_inverse_ntt(scalar *s) {
-  int step = DEGREE / 2;
-  // `int` is used here because using `size_t` throughout caused a ~5% slowdown
-  // with Clang 14 on Aarch64.
-  for (int offset = 2; offset < DEGREE; offset <<= 1) {
-    step >>= 1;
-    int k = 0;
-    for (int i = 0; i < step; i++) {
-      uint32_t step_root = kInverseNTTRootsi + step;
-      for (int j = k; j < k + offset; j++) {
-        uint16_t odd = s->cj + offset;
-        uint16_t even = s->cj;
-        s->cj = reduce_once(odd + even);
-        s->cj + offset = reduce(step_root * (even - odd + kPrime));
-      }
-      k += 2 * offset;
-    }
-  }
-  for (int i = 0; i < DEGREE; i++) {
-    s->ci = reduce(s->ci * kInverseDegree);
-  }
-}
-
-static void vector_inverse_ntt(vector *a) {
-  for (int i = 0; i < RANK; i++) {
-    scalar_inverse_ntt(&a->vi);
-  }
-}
-
-static void scalar_add(scalar *lhs, const scalar *rhs) {
-  for (int i = 0; i < DEGREE; i++) {
-    lhs->ci = reduce_once(lhs->ci + rhs->ci);
-  }
-}
-
-static void scalar_sub(scalar *lhs, const scalar *rhs) {
-  for (int i = 0; i < DEGREE; i++) {
-    lhs->ci = reduce_once(lhs->ci - rhs->ci + kPrime);
-  }
-}
-
-// Multiplying two scalars in the number theoretically transformed state. Since
-// 3329 does not have a 512th root of unity, this means we have to interpret
-// the 2*ith and (2*i+1)th entries of the scalar as elements of GF(3329)X/(X^2
-// - 17^(2*bitreverse(i)+1)) The value of 17^(2*bitreverse(i)+1) mod 3329 is
-// stored in the precomputed `kModRoots` table. Note that our Barrett transform
-// only allows us to multiply two reduced numbers together, so we need some
-// intermediate reduction steps, even if an uint64_t could hold 3 multiplied
-// numbers.
-static void scalar_mult(scalar *out, const scalar *lhs, const scalar *rhs) {
-  for (int i = 0; i < DEGREE / 2; i++) {
-    uint32_t real_real = (uint32_t)lhs->c2 * i * rhs->c2 * i;
-    uint32_t img_img = (uint32_t)lhs->c2 * i + 1 * rhs->c2 * i + 1;
-    uint32_t real_img = (uint32_t)lhs->c2 * i * rhs->c2 * i + 1;
-    uint32_t img_real = (uint32_t)lhs->c2 * i + 1 * rhs->c2 * i;
-    out->c2 * i =
-        reduce(real_real + (uint32_t)reduce(img_img) * kModRootsi);
-    out->c2 * i + 1 = reduce(img_real + real_img);
-  }
-}
-
-static void vector_add(vector *lhs, const vector *rhs) {
-  for (int i = 0; i < RANK; i++) {
-    scalar_add(&lhs->vi, &rhs->vi);
-  }
-}
-
-static void matrix_mult(vector *out, const matrix *m, const vector *a) {
-  vector_zero(out);
-  for (int i = 0; i < RANK; i++) {
-    for (int j = 0; j < RANK; j++) {
-      scalar product;
-      scalar_mult(&product, &m->vij, &a->vj);
-      scalar_add(&out->vi, &product);
-    }
-  }
-}
-
-static void matrix_mult_transpose(vector *out, const matrix *m,
-                                  const vector *a) {
-  vector_zero(out);
-  for (int i = 0; i < RANK; i++) {
-    for (int j = 0; j < RANK; j++) {
-      scalar product;
-      scalar_mult(&product, &m->vji, &a->vj);
-      scalar_add(&out->vi, &product);
-    }
-  }
-}
-
-static void scalar_inner_product(scalar *out, const vector *lhs,
-                                 const vector *rhs) {
-  scalar_zero(out);
-  for (int i = 0; i < RANK; i++) {
-    scalar product;
-    scalar_mult(&product, &lhs->vi, &rhs->vi);
-    scalar_add(out, &product);
-  }
-}
-
-// Algorithm 1 of the Kyber spec. Rejection samples a Keccak stream to get
-// uniformly distributed elements. This is used for matrix expansion and only
-// operates on public inputs.
-static void scalar_from_keccak_vartime(scalar *out,
-                                       struct BORINGSSL_keccak_st *keccak_ctx) {
-  assert(keccak_ctx->squeeze_offset == 0);
-  assert(keccak_ctx->rate_bytes == 168);
-  static_assert(168 % 3 == 0, "block and coefficient boundaries do not align");
-
-  int done = 0;
-  while (done < DEGREE) {
-    uint8_t block168;
-    BORINGSSL_keccak_squeeze(keccak_ctx, block, sizeof(block));
-    for (size_t i = 0; i < sizeof(block) && done < DEGREE; i += 3) {
-      uint16_t d1 = blocki + 256 * (blocki + 1 % 16);
-      uint16_t d2 = blocki + 1 / 16 + 16 * blocki + 2;
-      if (d1 < kPrime) {
-        out->cdone++ = d1;
-      }
-      if (d2 < kPrime && done < DEGREE) {
-        out->cdone++ = d2;
-      }
-    }
-  }
-}
-
-// Algorithm 2 of the Kyber spec, with eta fixed to two and the PRF call
-// included. Creates binominally distributed elements by sampling 2*`eta` bits,
-// and setting the coefficient to the count of the first bits minus the count of
-// the second bits, resulting in a centered binomial distribution. Since eta is
-// two this gives -2/2 with a probability of 1/16, -1/1 with probability 1/4,
-// and 0 with probability 3/8.
-static void scalar_centered_binomial_distribution_eta_2_with_prf(
-    scalar *out, const uint8_t input33) {
-  uint8_t entropy128;
-  static_assert(sizeof(entropy) == 2 * /*kEta=*/2 * DEGREE / 8);
-  prf(entropy, sizeof(entropy), input);
-
-  for (int i = 0; i < DEGREE; i += 2) {
-    uint8_t byte = entropyi / 2;
-
-    uint16_t value = (byte & 1) + ((byte >> 1) & 1);
-    value -= ((byte >> 2) & 1) + ((byte >> 3) & 1);
-    // Add `kPrime` if `value` underflowed. See `reduce_once` for a discussion
-    // on why the value barrier is omitted. While this could have been written
-    // reduce_once(value + kPrime), this is one extra addition and small range
-    // of `value` tempts some versions of Clang to emit a branch.
-    uint16_t mask = 0u - (value >> 15);
-    out->ci = value + (kPrime & mask);
-
-    byte >>= 4;
-    value = (byte & 1) + ((byte >> 1) & 1);
-    value -= ((byte >> 2) & 1) + ((byte >> 3) & 1);
-    // See above.
-    mask = 0u - (value >> 15);
-    out->ci + 1 = value + (kPrime & mask);
-  }
-}
-
-// Generates a secret vector by using
-// `scalar_centered_binomial_distribution_eta_2_with_prf`, using the given seed
-// appending and incrementing `counter` for entry of the vector.
-static void vector_generate_secret_eta_2(vector *out, uint8_t *counter,
-                                         const uint8_t seed32) {
-  uint8_t input33;
-  OPENSSL_memcpy(input, seed, 32);
-  for (int i = 0; i < RANK; i++) {
-    input32 = (*counter)++;
-    scalar_centered_binomial_distribution_eta_2_with_prf(&out->vi, input);
-  }
-}
-
-// Expands the matrix of a seed for key generation and for encaps-CPA.
-static void matrix_expand(matrix *out, const uint8_t rho32) {
-  uint8_t input34;
-  OPENSSL_memcpy(input, rho, 32);
-  for (int i = 0; i < RANK; i++) {
-    for (int j = 0; j < RANK; j++) {
-      input32 = i;
-      input33 = j;
-      struct BORINGSSL_keccak_st keccak_ctx;
-      BORINGSSL_keccak_init(&keccak_ctx, boringssl_shake128);
-      BORINGSSL_keccak_absorb(&keccak_ctx, input, sizeof(input));
-      scalar_from_keccak_vartime(&out->vij, &keccak_ctx);
-    }
-  }
-}
-
-static const uint8_t kMasks8 = {0x01, 0x03, 0x07, 0x0f,
-                                  0x1f, 0x3f, 0x7f, 0xff};
-
-static void scalar_encode(uint8_t *out, const scalar *s, int bits) {
-  assert(bits <= (int)sizeof(*s->c) * 8 && bits != 1);
-
-  uint8_t out_byte = 0;
-  int out_byte_bits = 0;
-
-  for (int i = 0; i < DEGREE; i++) {
-    uint16_t element = s->ci;
-    int element_bits_done = 0;
-
-    while (element_bits_done < bits) {
-      int chunk_bits = bits - element_bits_done;
-      int out_bits_remaining = 8 - out_byte_bits;
-      if (chunk_bits >= out_bits_remaining) {
-        chunk_bits = out_bits_remaining;
-        out_byte |= (element & kMaskschunk_bits - 1) << out_byte_bits;
-        *out = out_byte;
-        out++;
-        out_byte_bits = 0;
-        out_byte = 0;
-      } else {
-        out_byte |= (element & kMaskschunk_bits - 1) << out_byte_bits;
-        out_byte_bits += chunk_bits;
-      }
-
-      element_bits_done += chunk_bits;
-      element >>= chunk_bits;
-    }
-  }
-
-  if (out_byte_bits > 0) {
-    *out = out_byte;
-  }
-}
-
-// scalar_encode_1 is `scalar_encode` specialised for `bits` == 1.
-static void scalar_encode_1(uint8_t out32, const scalar *s) {
-  for (int i = 0; i < DEGREE; i += 8) {
-    uint8_t out_byte = 0;
-    for (int j = 0; j < 8; j++) {
-      out_byte |= (s->ci + j & 1) << j;
-    }
-    *out = out_byte;
-    out++;
-  }
-}
-
-// Encodes an entire vector into 32*`RANK`*`bits` bytes. Note that since 256
-// (DEGREE) is divisible by 8, the individual vector entries will always fill a
-// whole number of bytes, so we do not need to worry about bit packing here.
-static void vector_encode(uint8_t *out, const vector *a, int bits) {
-  for (int i = 0; i < RANK; i++) {
-    scalar_encode(out + i * bits * DEGREE / 8, &a->vi, bits);
-  }
-}
-
-// scalar_decode parses `DEGREE * bits` bits from `in` into `DEGREE` values in
-// `out`. It returns one on success and zero if any parsed value is >=
-// `kPrime`.
-static int scalar_decode(scalar *out, const uint8_t *in, int bits) {
-  assert(bits <= (int)sizeof(*out->c) * 8 && bits != 1);
-
-  uint8_t in_byte = 0;
-  int in_byte_bits_left = 0;
-
-  for (int i = 0; i < DEGREE; i++) {
-    uint16_t element = 0;
-    int element_bits_done = 0;
-
-    while (element_bits_done < bits) {
-      if (in_byte_bits_left == 0) {
-        in_byte = *in;
-        in++;
-        in_byte_bits_left = 8;
-      }
-
-      int chunk_bits = bits - element_bits_done;
-      if (chunk_bits > in_byte_bits_left) {
-        chunk_bits = in_byte_bits_left;
-      }
-
-      element |= (in_byte & kMaskschunk_bits - 1) << element_bits_done;
-      in_byte_bits_left -= chunk_bits;
-      in_byte >>= chunk_bits;
-
-      element_bits_done += chunk_bits;
-    }
-
-    // An element is only out of range in the case of invalid input, in which
-    // case it is okay to leak the comparison.
-    if (constant_time_declassify_int(element >= kPrime)) {
-      return 0;
-    }
-    out->ci = element;
-  }
-
-  return 1;
-}
-
-// scalar_decode_1 is `scalar_decode` specialised for `bits` == 1.
-static void scalar_decode_1(scalar *out, const uint8_t in32) {
-  for (int i = 0; i < DEGREE; i += 8) {
-    uint8_t in_byte = *in;
-    in++;
-    for (int j = 0; j < 8; j++) {
-      out->ci + j = in_byte & 1;
-      in_byte >>= 1;
-    }
-  }
-}
-
-// Decodes 32*`RANK`*`bits` bytes from `in` into `out`. It returns one on
-// success or zero if any parsed value is >= `kPrime`.
-static int vector_decode(vector *out, const uint8_t *in, int bits) {
-  for (int i = 0; i < RANK; i++) {
-    if (!scalar_decode(&out->vi, in + i * bits * DEGREE / 8, bits)) {
-      return 0;
-    }
-  }
-  return 1;
-}
-
-// Compresses (lossily) an input `x` mod 3329 into `bits` many bits by grouping
-// numbers close to each other together. The formula used is
-// round(2^`bits`/kPrime*x) mod 2^`bits`.
-// Uses Barrett reduction to achieve constant time. Since we need both the
-// remainder (for rounding) and the quotient (as the result), we cannot use
-// `reduce` here, but need to do the Barrett reduction directly.
-static uint16_t compress(uint16_t x, int bits) {
-  uint32_t shifted = (uint32_t)x << bits;
-  uint64_t product = (uint64_t)shifted * kBarrettMultiplier;
-  uint32_t quotient = (uint32_t)(product >> kBarrettShift);
-  uint32_t remainder = shifted - quotient * kPrime;
-
-  // Adjust the quotient to round correctly:
-  //   0 <= remainder <= kHalfPrime round to 0
-  //   kHalfPrime < remainder <= kPrime + kHalfPrime round to 1
-  //   kPrime + kHalfPrime < remainder < 2 * kPrime round to 2
-  declassify_assert(remainder < 2u * kPrime);
-  quotient += 1 & constant_time_lt_w(kHalfPrime, remainder);
-  quotient += 1 & constant_time_lt_w(kPrime + kHalfPrime, remainder);
-  return quotient & ((1 << bits) - 1);
-}
-
-// Decompresses `x` by using an equi-distant representative. The formula is
-// round(kPrime/2^`bits`*x). Note that 2^`bits` being the divisor allows us to
-// implement this logic using only bit operations.
-static uint16_t decompress(uint16_t x, int bits) {
-  uint32_t product = (uint32_t)x * kPrime;
-  uint32_t power = 1 << bits;
-  // This is `product` % power, since `power` is a power of 2.
-  uint32_t remainder = product & (power - 1);
-  // This is `product` / power, since `power` is a power of 2.
-  uint32_t lower = product >> bits;
-  // The rounding logic works since the first half of numbers mod `power` have a
-  // 0 as first bit, and the second half has a 1 as first bit, since `power` is
-  // a power of 2. As a 12 bit number, `remainder` is always positive, so we
-  // will shift in 0s for a right shift.
-  return lower + (remainder >> (bits - 1));
-}
-
-static void scalar_compress(scalar *s, int bits) {
-  for (int i = 0; i < DEGREE; i++) {
-    s->ci = compress(s->ci, bits);
-  }
-}
-
-static void scalar_decompress(scalar *s, int bits) {
-  for (int i = 0; i < DEGREE; i++) {
-    s->ci = decompress(s->ci, bits);
-  }
-}
-
-static void vector_compress(vector *a, int bits) {
-  for (int i = 0; i < RANK; i++) {
-    scalar_compress(&a->vi, bits);
-  }
-}
-
-static void vector_decompress(vector *a, int bits) {
-  for (int i = 0; i < RANK; i++) {
-    scalar_decompress(&a->vi, bits);
-  }
-}
-
-namespace {
-
-struct public_key {
-  vector t;
-  uint8_t rho32;
-  uint8_t public_key_hash32;
-  matrix m;
-};
-
-static struct public_key *public_key_from_external(
-    const struct KYBER_public_key *external) {
-  static_assert(sizeof(struct KYBER_public_key) >= sizeof(struct public_key),
-                "Kyber public key is too small");
-  static_assert(alignof(struct KYBER_public_key) >= alignof(struct public_key),
-                "Kyber public key align incorrect");
-  return (struct public_key *)external;
-}
-
-struct private_key {
-  struct public_key pub;
-  vector s;
-  uint8_t fo_failure_secret32;
-};
-
-static struct private_key *private_key_from_external(
-    const struct KYBER_private_key *external) {
-  static_assert(sizeof(struct KYBER_private_key) >= sizeof(struct private_key),
-                "Kyber private key too small");
-  static_assert(
-      alignof(struct KYBER_private_key) >= alignof(struct private_key),
-      "Kyber private key align incorrect");
-  return (struct private_key *)external;
-}
-
-}  // namespace
-
-// Calls `KYBER_generate_key_external_entropy` with random bytes from
-// `RAND_bytes`.
-void bssl::KYBER_generate_key(
-    uint8_t out_encoded_public_keyKYBER_PUBLIC_KEY_BYTES,
-    struct KYBER_private_key *out_private_key) {
-  uint8_t entropyKYBER_GENERATE_KEY_ENTROPY;
-  RAND_bytes(entropy, sizeof(entropy));
-  CONSTTIME_SECRET(entropy, sizeof(entropy));
-  KYBER_generate_key_external_entropy(out_encoded_public_key, out_private_key,
-                                      entropy);
-}
-
-static int kyber_marshal_public_key(CBB *out, const struct public_key *pub) {
-  uint8_t *vector_output;
-  if (!CBB_add_space(out, &vector_output, kEncodedVectorSize)) {
-    return 0;
-  }
-  vector_encode(vector_output, &pub->t, kLog2Prime);
-  if (!CBB_add_bytes(out, pub->rho, sizeof(pub->rho))) {
-    return 0;
-  }
-  return 1;
-}
-
-// Algorithms 4 and 7 of the Kyber spec. Algorithms are combined since key
-// generation is not part of the FO transform, and the spec uses Algorithm 7 to
-// specify the actual key format.
-void bssl::KYBER_generate_key_external_entropy(
-    uint8_t out_encoded_public_keyKYBER_PUBLIC_KEY_BYTES,
-    struct KYBER_private_key *out_private_key,
-    const uint8_t entropyKYBER_GENERATE_KEY_ENTROPY) {
-  struct private_key *priv = private_key_from_external(out_private_key);
-  uint8_t hashed64;
-  hash_g(hashed, entropy, 32);
-  const uint8_t *const rho = hashed;
-  const uint8_t *const sigma = hashed + 32;
-  // rho is public.
-  CONSTTIME_DECLASSIFY(rho, 32);
-  OPENSSL_memcpy(priv->pub.rho, hashed, sizeof(priv->pub.rho));
-  matrix_expand(&priv->pub.m, rho);
-  uint8_t counter = 0;
-  vector_generate_secret_eta_2(&priv->s, &counter, sigma);
-  vector_ntt(&priv->s);
-  vector error;
-  vector_generate_secret_eta_2(&error, &counter, sigma);
-  vector_ntt(&error);
-  matrix_mult_transpose(&priv->pub.t, &priv->pub.m, &priv->s);
-  vector_add(&priv->pub.t, &error);
-  // t is part of the public key and thus is public.
-  CONSTTIME_DECLASSIFY(&priv->pub.t, sizeof(priv->pub.t));
-
-  CBB cbb;
-  CBB_init_fixed(&cbb, out_encoded_public_key, KYBER_PUBLIC_KEY_BYTES);
-  if (!kyber_marshal_public_key(&cbb, &priv->pub)) {
-    abort();
-  }
-
-  hash_h(priv->pub.public_key_hash, out_encoded_public_key,
-         KYBER_PUBLIC_KEY_BYTES);
-  OPENSSL_memcpy(priv->fo_failure_secret, entropy + 32, 32);
-}
-
-void bssl::KYBER_public_from_private(
-    struct KYBER_public_key *out_public_key,
-    const struct KYBER_private_key *private_key) {
-  struct public_key *const pub = public_key_from_external(out_public_key);
-  const struct private_key *const priv = private_key_from_external(private_key);
-  *pub = priv->pub;
-}
-
-// Algorithm 5 of the Kyber spec. Encrypts a message with given randomness to
-// the ciphertext in `out`. Without applying the Fujisaki-Okamoto transform this
-// would not result in a CCA secure scheme, since lattice schemes are vulnerable
-// to decryption failure oracles.
-static void encrypt_cpa(uint8_t outKYBER_CIPHERTEXT_BYTES,
-                        const struct public_key *pub, const uint8_t message32,
-                        const uint8_t randomness32) {
-  uint8_t counter = 0;
-  vector secret;
-  vector_generate_secret_eta_2(&secret, &counter, randomness);
-  vector_ntt(&secret);
-  vector error;
-  vector_generate_secret_eta_2(&error, &counter, randomness);
-  uint8_t input33;
-  OPENSSL_memcpy(input, randomness, 32);
-  input32 = counter;
-  scalar scalar_error;
-  scalar_centered_binomial_distribution_eta_2_with_prf(&scalar_error, input);
-  vector u;
-  matrix_mult(&u, &pub->m, &secret);
-  vector_inverse_ntt(&u);
-  vector_add(&u, &error);
-  scalar v;
-  scalar_inner_product(&v, &pub->t, &secret);
-  scalar_inverse_ntt(&v);
-  scalar_add(&v, &scalar_error);
-  scalar expanded_message;
-  scalar_decode_1(&expanded_message, message);
-  scalar_decompress(&expanded_message, 1);
-  scalar_add(&v, &expanded_message);
-  vector_compress(&u, kDU);
-  vector_encode(out, &u, kDU);
-  scalar_compress(&v, kDV);
-  scalar_encode(out + kCompressedVectorSize, &v, kDV);
-}
-
-// Calls `KYBER_encap_external_entropy` with random bytes from `RAND_bytes`
-void bssl::KYBER_encap(uint8_t out_ciphertextKYBER_CIPHERTEXT_BYTES,
-                       uint8_t out_shared_secretKYBER_SHARED_SECRET_BYTES,
-                       const struct KYBER_public_key *public_key) {
-  uint8_t entropyKYBER_ENCAP_ENTROPY;
-  RAND_bytes(entropy, KYBER_ENCAP_ENTROPY);
-  CONSTTIME_SECRET(entropy, KYBER_ENCAP_ENTROPY);
-  KYBER_encap_external_entropy(out_ciphertext, out_shared_secret, public_key,
-                               entropy);
-}
-
-// Algorithm 8 of the Kyber spec, safe for line 2 of the spec. The spec there
-// hashes the output of the system's random number generator, since the FO
-// transform will reveal it to the decrypting party. There is no reason to do
-// this when a secure random number generator is used. When an insecure random
-// number generator is used, the caller should switch to a secure one before
-// calling this method.
-void bssl::KYBER_encap_external_entropy(
-    uint8_t out_ciphertextKYBER_CIPHERTEXT_BYTES,
-    uint8_t out_shared_secretKYBER_SHARED_SECRET_BYTES,
-    const struct KYBER_public_key *public_key,
-    const uint8_t entropyKYBER_ENCAP_ENTROPY) {
-  const struct public_key *pub = public_key_from_external(public_key);
-  uint8_t input64;
-  OPENSSL_memcpy(input, entropy, KYBER_ENCAP_ENTROPY);
-  OPENSSL_memcpy(input + KYBER_ENCAP_ENTROPY, pub->public_key_hash,
-                 sizeof(input) - KYBER_ENCAP_ENTROPY);
-  uint8_t prekey_and_randomness64;
-  hash_g(prekey_and_randomness, input, sizeof(input));
-  encrypt_cpa(out_ciphertext, pub, entropy, prekey_and_randomness + 32);
-  // The ciphertext is public.
-  CONSTTIME_DECLASSIFY(out_ciphertext, KYBER_CIPHERTEXT_BYTES);
-  hash_h(prekey_and_randomness + 32, out_ciphertext, KYBER_CIPHERTEXT_BYTES);
-  kdf(out_shared_secret, KYBER_SHARED_SECRET_BYTES, prekey_and_randomness,
-      sizeof(prekey_and_randomness));
-}
-
-// Algorithm 6 of the Kyber spec.
-static void decrypt_cpa(uint8_t out32, const struct private_key *priv,
-                        const uint8_t ciphertextKYBER_CIPHERTEXT_BYTES) {
-  vector u;
-  vector_decode(&u, ciphertext, kDU);
-  vector_decompress(&u, kDU);
-  vector_ntt(&u);
-  scalar v;
-  scalar_decode(&v, ciphertext + kCompressedVectorSize, kDV);
-  scalar_decompress(&v, kDV);
-  scalar mask;
-  scalar_inner_product(&mask, &priv->s, &u);
-  scalar_inverse_ntt(&mask);
-  scalar_sub(&v, &mask);
-  scalar_compress(&v, 1);
-  scalar_encode_1(out, &v);
-}
-
-// Algorithm 9 of the Kyber spec, performing the FO transform by running
-// encrypt_cpa on the decrypted message. The spec does not allow the decryption
-// failure to be passed on to the caller, and instead returns a result that is
-// deterministic but unpredictable to anyone without knowledge of the private
-// key.
-void bssl::KYBER_decap(uint8_t out_shared_secretKYBER_SHARED_SECRET_BYTES,
-                       const uint8_t ciphertextKYBER_CIPHERTEXT_BYTES,
-                       const struct KYBER_private_key *private_key) {
-  const struct private_key *priv = private_key_from_external(private_key);
-  uint8_t decrypted64;
-  decrypt_cpa(decrypted, priv, ciphertext);
-  OPENSSL_memcpy(decrypted + 32, priv->pub.public_key_hash,
-                 sizeof(decrypted) - 32);
-  uint8_t prekey_and_randomness64;
-  hash_g(prekey_and_randomness, decrypted, sizeof(decrypted));
-  uint8_t expected_ciphertextKYBER_CIPHERTEXT_BYTES;
-  encrypt_cpa(expected_ciphertext, &priv->pub, decrypted,
-              prekey_and_randomness + 32);
-  uint8_t mask =
-      constant_time_eq_int_8(CRYPTO_memcmp(ciphertext, expected_ciphertext,
-                                           sizeof(expected_ciphertext)),
-                             0);
-  uint8_t input64;
-  for (int i = 0; i < 32; i++) {
-    inputi = constant_time_select_8(mask, prekey_and_randomnessi,
-                                      priv->fo_failure_secreti);
-  }
-  hash_h(input + 32, ciphertext, KYBER_CIPHERTEXT_BYTES);
-  kdf(out_shared_secret, KYBER_SHARED_SECRET_BYTES, input, sizeof(input));
-}
-
-int bssl::KYBER_marshal_public_key(CBB *out,
-                                   const struct KYBER_public_key *public_key) {
-  return kyber_marshal_public_key(out, public_key_from_external(public_key));
-}
-
-// kyber_parse_public_key_no_hash parses `in` into `pub` but doesn't calculate
-// the value of `pub->public_key_hash`.
-static int kyber_parse_public_key_no_hash(struct public_key *pub, CBS *in) {
-  CBS t_bytes;
-  if (!CBS_get_bytes(in, &t_bytes, kEncodedVectorSize) ||
-      !vector_decode(&pub->t, CBS_data(&t_bytes), kLog2Prime) ||
-      !CBS_copy_bytes(in, pub->rho, sizeof(pub->rho))) {
-    return 0;
-  }
-  matrix_expand(&pub->m, pub->rho);
-  return 1;
-}
-
-int bssl::KYBER_parse_public_key(struct KYBER_public_key *public_key, CBS *in) {
-  struct public_key *pub = public_key_from_external(public_key);
-  CBS orig_in = *in;
-  if (!kyber_parse_public_key_no_hash(pub, in) ||  //
-      CBS_len(in) != 0) {
-    return 0;
-  }
-  hash_h(pub->public_key_hash, CBS_data(&orig_in), CBS_len(&orig_in));
-  return 1;
-}
-
-int bssl::KYBER_marshal_private_key(
-    CBB *out, const struct KYBER_private_key *private_key) {
-  const struct private_key *const priv = private_key_from_external(private_key);
-  uint8_t *s_output;
-  if (!CBB_add_space(out, &s_output, kEncodedVectorSize)) {
-    return 0;
-  }
-  vector_encode(s_output, &priv->s, kLog2Prime);
-  if (!kyber_marshal_public_key(out, &priv->pub) ||
-      !CBB_add_bytes(out, priv->pub.public_key_hash,
-                     sizeof(priv->pub.public_key_hash)) ||
-      !CBB_add_bytes(out, priv->fo_failure_secret,
-                     sizeof(priv->fo_failure_secret))) {
-    return 0;
-  }
-  return 1;
-}
-
-int bssl::KYBER_parse_private_key(struct KYBER_private_key *out_private_key,
-                                  CBS *in) {
-  struct private_key *const priv = private_key_from_external(out_private_key);
-
-  CBS s_bytes;
-  if (!CBS_get_bytes(in, &s_bytes, kEncodedVectorSize) ||
-      !vector_decode(&priv->s, CBS_data(&s_bytes), kLog2Prime) ||
-      !kyber_parse_public_key_no_hash(&priv->pub, in) ||
-      !CBS_copy_bytes(in, priv->pub.public_key_hash,
-                      sizeof(priv->pub.public_key_hash)) ||
-      !CBS_copy_bytes(in, priv->fo_failure_secret,
-                      sizeof(priv->fo_failure_secret)) ||
-      CBS_len(in) != 0) {
-    return 0;
-  }
-  return 1;
-}

boringssl-0.20260708.tar.xz/crypto/kyber/kyber_test.cc Deleted

@@ -1,179 +0,0 @@
-// Copyright 2023 The BoringSSL Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include <vector>
-
-#include <string.h>
-
-#include <gtest/gtest.h>
-
-#include <openssl/bytestring.h>
-#include <openssl/ctrdrbg.h>
-
-#include "../fipsmodule/keccak/internal.h"
-#include "../test/file_test.h"
-#include "../test/test_util.h"
-#include "./internal.h"
-
-
-BSSL_NAMESPACE_BEGIN
-namespace {
-
-template <typename T>
-static std::vector<uint8_t> Marshal(int (*marshal_func)(CBB *, const T *),
-                                    const T *t) {
-  ScopedCBB cbb;
-  uint8_t *encoded;
-  size_t encoded_len;
-  if (!CBB_init(cbb.get(), 1) ||      //
-      !marshal_func(cbb.get(), t) ||  //
-      !CBB_finish(cbb.get(), &encoded, &encoded_len)) {
-    abort();
-  }
-
-  std::vector<uint8_t> ret(encoded, encoded + encoded_len);
-  OPENSSL_free(encoded);
-  return ret;
-}
-
-TEST(KyberTest, Basic) {
-  // This function makes several Kyber keys, which runs up against stack limits.
-  // Heap-allocate them instead.
-
-  uint8_t encoded_public_keyKYBER_PUBLIC_KEY_BYTES;
-  auto priv = std::make_unique<KYBER_private_key>();
-  KYBER_generate_key(encoded_public_key, priv.get());
-
-  uint8_t first_two_bytes2;
-  OPENSSL_memcpy(first_two_bytes, encoded_public_key, sizeof(first_two_bytes));
-  OPENSSL_memset(encoded_public_key, 0xff, sizeof(first_two_bytes));
-  CBS encoded_public_key_cbs;
-  CBS_init(&encoded_public_key_cbs, encoded_public_key,
-           sizeof(encoded_public_key));
-  auto pub = std::make_unique<KYBER_public_key>();
-  // Parsing should fail because the first coefficient is >= kPrime;
-  ASSERT_FALSE(KYBER_parse_public_key(pub.get(), &encoded_public_key_cbs));
-
-  OPENSSL_memcpy(encoded_public_key, first_two_bytes, sizeof(first_two_bytes));
-  CBS_init(&encoded_public_key_cbs, encoded_public_key,
-           sizeof(encoded_public_key));
-  ASSERT_TRUE(KYBER_parse_public_key(pub.get(), &encoded_public_key_cbs));
-  EXPECT_EQ(CBS_len(&encoded_public_key_cbs), 0u);
-
-  EXPECT_EQ(Bytes(encoded_public_key),
-            Bytes(Marshal(KYBER_marshal_public_key, pub.get())));
-
-  auto pub2 = std::make_unique<KYBER_public_key>();
-  KYBER_public_from_private(pub2.get(), priv.get());
-  EXPECT_EQ(Bytes(encoded_public_key),
-            Bytes(Marshal(KYBER_marshal_public_key, pub2.get())));
-
-  std::vector<uint8_t> encoded_private_key(
-      Marshal(KYBER_marshal_private_key, priv.get()));
-  EXPECT_EQ(encoded_private_key.size(), size_t{KYBER_PRIVATE_KEY_BYTES});
-
-  OPENSSL_memcpy(first_two_bytes, encoded_private_key.data(),
-                 sizeof(first_two_bytes));
-  OPENSSL_memset(encoded_private_key.data(), 0xff, sizeof(first_two_bytes));
-  CBS cbs;
-  CBS_init(&cbs, encoded_private_key.data(), encoded_private_key.size());
-  auto priv2 = std::make_unique<KYBER_private_key>();
-  // Parsing should fail because the first coefficient is >= kPrime.
-  ASSERT_FALSE(KYBER_parse_private_key(priv2.get(), &cbs));
-
-  OPENSSL_memcpy(encoded_private_key.data(), first_two_bytes,
-                 sizeof(first_two_bytes));
-  CBS_init(&cbs, encoded_private_key.data(), encoded_private_key.size());
-  ASSERT_TRUE(KYBER_parse_private_key(priv2.get(), &cbs));
-  EXPECT_EQ(
-      Bytes(Declassified(encoded_private_key)),
-      Bytes(Declassified((Marshal(KYBER_marshal_private_key, priv2.get())))));
-
-  uint8_t ciphertextKYBER_CIPHERTEXT_BYTES;
-  uint8_t shared_secret1KYBER_SHARED_SECRET_BYTES;
-  uint8_t shared_secret2KYBER_SHARED_SECRET_BYTES;
-  KYBER_encap(ciphertext, shared_secret1, pub.get());
-  KYBER_decap(shared_secret2, ciphertext, priv.get());
-  EXPECT_EQ(Bytes(Declassified(shared_secret1)),
-            Bytes(Declassified(shared_secret2)));
-  KYBER_decap(shared_secret2, ciphertext, priv2.get());
-  EXPECT_EQ(Bytes(Declassified(shared_secret1)),
-            Bytes(Declassified(shared_secret2)));
-}
-
-static void KyberFileTest(FileTest *t) {
-  std::vector<uint8_t> public_key_expected, private_key_expected,
-      ciphertext_expected, shared_secret_expected, generate_entropy,
-      encap_entropy_pre_hash;
-  t->IgnoreAttribute("count");
-  ASSERT_TRUE(t->GetBytes(&public_key_expected, "pk"));
-  ASSERT_TRUE(t->GetBytes(&private_key_expected, "sk"));
-  ASSERT_TRUE(t->GetBytes(&ciphertext_expected, "ct"));
-  ASSERT_TRUE(t->GetBytes(&shared_secret_expected, "ss"));
-  ASSERT_TRUE(t->GetBytes(&generate_entropy, "generateEntropy"));
-  ASSERT_TRUE(t->GetBytes(&encap_entropy_pre_hash, "encapEntropyPreHash"));
-
-  KYBER_private_key priv;
-  uint8_t encoded_private_keyKYBER_PRIVATE_KEY_BYTES;
-  KYBER_public_key pub;
-  uint8_t encoded_public_keyKYBER_PUBLIC_KEY_BYTES;
-  uint8_t ciphertextKYBER_CIPHERTEXT_BYTES;
-  uint8_t encap_entropyKYBER_ENCAP_ENTROPY;
-  uint8_t encapsulated_keyKYBER_SHARED_SECRET_BYTES;
-  uint8_t decapsulated_keyKYBER_SHARED_SECRET_BYTES;
-
-  BORINGSSL_keccak(encap_entropy, sizeof(encap_entropy),
-                   encap_entropy_pre_hash.data(), encap_entropy_pre_hash.size(),
-                   boringssl_sha3_256);
-
-  KYBER_generate_key_external_entropy(encoded_public_key, &priv,
-                                      generate_entropy.data());
-  CBB cbb;
-  CBB_init_fixed(&cbb, encoded_private_key, sizeof(encoded_private_key));
-  ASSERT_TRUE(KYBER_marshal_private_key(&cbb, &priv));
-  CBS encoded_public_key_cbs;
-  CBS_init(&encoded_public_key_cbs, encoded_public_key,
-           sizeof(encoded_public_key));
-  ASSERT_TRUE(KYBER_parse_public_key(&pub, &encoded_public_key_cbs));
-  KYBER_encap_external_entropy(ciphertext, encapsulated_key, &pub,
-                               encap_entropy);
-  KYBER_decap(decapsulated_key, ciphertext, &priv);
-
-  EXPECT_EQ(Bytes(Declassified(encapsulated_key)),
-            Bytes(Declassified(decapsulated_key)));
-  EXPECT_EQ(Bytes(private_key_expected),
-            Bytes(Declassified(encoded_private_key)));
-  EXPECT_EQ(Bytes(public_key_expected), Bytes(encoded_public_key));
-  EXPECT_EQ(Bytes(ciphertext_expected), Bytes(ciphertext));
-  EXPECT_EQ(Bytes(shared_secret_expected),
-            Bytes(Declassified(encapsulated_key)));
-
-  uint8_t corrupted_ciphertextKYBER_CIPHERTEXT_BYTES;
-  OPENSSL_memcpy(corrupted_ciphertext, ciphertext, KYBER_CIPHERTEXT_BYTES);
-  corrupted_ciphertext3 ^= 0x40;
-  uint8_t corrupted_decapsulated_keyKYBER_SHARED_SECRET_BYTES;
-  KYBER_decap(corrupted_decapsulated_key, corrupted_ciphertext, &priv);
-  // It would be nice to have actual test vectors for the failure case, but the
-  // NIST submission currently does not include those, so we are just testing
-  // for inequality.
-  EXPECT_NE(Bytes(Declassified(encapsulated_key)),
-            Bytes(Declassified(corrupted_decapsulated_key)));
-}
-
-TEST(KyberTest, TestVectors) {
-  FileTestGTest("crypto/kyber/kyber_tests.txt", KyberFileTest);
-}
-
-}  // namespace
-BSSL_NAMESPACE_END

boringssl-0.20260708.tar.xz/crypto/kyber/kyber_tests.txt Deleted

@@ -1,805 +0,0 @@
-# Kyber768
-# From the NIST round three submission package.
-#
-# https://pq-crystals.org/kyber/data/kyber-submission-nist-round3.zip
-# NIST-PQ-Submission-Kyber-20201001/KAT/kyber768/PQCkemKAT_2400.rsp
-
-count = 0
-generateEntropy = 7c9935a0b07694aa0c6d10e4db6b1add2fd81a25ccb148032dcd739936737f2d8626ed79d451140800e03b59b956f8210e556067407d13dc90fa9e8b872bfb8f
-encapEntropyPreHash = 147c03f7a5bebba406c8fae1874d7f13c80efe79a3a9a874cc09fe76f6997615
-pk = A72C2D9C843EE9F8313ECC7F86D6294D59159D9A879A542E260922ADF999051CC45200C9FFDB60449C49465979272367C083A7D6267A3ED7A7FD47957C219327F7CA73A4007E1627F00B11CC80573C15AEE6640FB8562DFA6B240CA0AD351AC4AC155B96C14C8AB13DD262CDFD51C4BB5572FD616553D17BDD430ACBEA3E95F0B698D66990AB51E5D03783A8B3D278A5720454CF9695CFDCA08485BA099C51CD92A7EA7587C1D15C28E609A81852601B0604010679AA482D51261EC36E36B8719676217FD74C54786488F4B4969C05A8BA27CA3A77CCE73B965923CA554E422B9B61F4754641608AC16C9B8587A32C1C5DD788F88B36B717A46965635DEB67F45B129B99070909C93EB80B42C2B3F3F70343A7CF37E8520E7BCFC416ACA4F18C7981262BA2BFC756AE03278F0EC66DC2057696824BA6769865A601D7148EF6F54E5AF5686AA2906F994CE38A5E0B938F239007003022C03392DF3401B1E4A3A7EBC6161449F73374C8B0140369343D9295FDF511845C4A46EBAAB6CA5492F6800B98C0CC803653A4B1D6E6AAED1932BACC5FEFAA818BA502859BA5494C5F5402C8536A9C4C1888150617F80098F6B2A99C39BC5DC7CF3B5900A21329AB59053ABAA64ED163E859A8B3B3CA3359B750CCC3E710C7AC43C8191CB5D68870C06391C0CB8AEC72B897AC6BE7FBAACC676ED66314C83630E89448C88A1DF04ACEB23ABF2E409EF333C622289C18A2134E650C45257E47475FA33AA537A5A8F7680214716C50D470E3284963CA64F54677AEC54B5272162BF52BC8142E1D4183FC017454A6B5A496831759064024745978CBD51A6CEDC8955DE4CC6D363670A47466E82BE5C23603A17BF22ACDB7CC984AF08C87E14E27753CF587A8EC3447E62C649E887A67C36C9CE98721B697213275646B194F36758673A8ED11284455AFC7A8529F69C97A3C2D7B8C636C0BA55614B768E624E712930F776169B01715725351BC74B47395ED52B25A1313C95164814C34C979CBDFAB85954662CAB485E75087A98CC74BB82CA2D1B5BF2803238480638C40E90B43C7460E7AA917F010151FAB1169987B372ABB59271F7006C24E60236B84B9DDD600623704254617FB498D89E58B0368BCB2103E79353EB587860C1422E476162E425BC2381DB82C6592737E1DD602864B0167A71EC1F223305C02FE25052AF2B3B5A55A0D7A2022D9A798DC0C5874A98702AAF4054C5D80338A5248B5B7BD09C53B5E2A084B047D277A861B1A73BB51488DE04EF573C85230A0470B73175C9FA50594F66A5F50B4150054C93B68186F8B5CBC49316C8548A642B2B36A1D454C7489AC33B2D2CE6668096782A2C1E0866D21A65E16B585E7AF8618BDF3184C1986878508917277B93E10706B1614972B2A94C7310FE9C708C231A1A8AC8D9314A529A97F469BF64962D820648443099A076D55D4CEA824A58304844F99497C10A25148618A315D72CA857D1B04D575B94F85C01D19BEF211BF0AA3362E7041FD16596D808E867B44C4C00D1CDA3418967717F147D0EB21B42AAEE74AC35D0B92414B958531AADF463EC6305AE5ECAF79174002F26DDECC813BF32672E8529D95A4E730A7AB4A3E8F8A8AF979A665EAFD465FC64A0C5F8F3F9003489415899D59A543D8208C54A3166529B53922
-sk = 07638FB69868F3D320E5862BD96933FEB311B362093C9B5D50170BCED43F1B536D9A204BB1F22695950BA1F2A9E8EB828B284488760B3FC84FABA04275D5628E39C5B2471374283C503299C0AB49B66B8BBB56A4186624F919A2BA59BB08D8551880C2BEFC4F87F25F59AB587A79C327D792D54C974A69262FF8A78938289E9A87B688B083E0595FE218B6BB1505941CE2E81A5A64C5AAC60417256985349EE47A52420A5F97477B7236AC76BC70E8288729287EE3E34A3DBC3683C0B7B10029FC203418537E7466BA6385A8FF301EE12708F82AAA1E380FC7A88F8F205AB7E88D7E95952A55BA20D09B79A47141D62BF6EB7DD307B08ECA13A5BC5F6B68581C6865B27BBCDDAB142F4B2CBFF488C8A22705FAA98A2B9EEA3530C76662335CC7EA3A00777725EBCCCD2A4636B2D9122FF3AB77123CE0883C1911115E50C9E8A94194E48DD0D09CFFB3ADCD2C1E92430903D07ADBF00532031575AA7F9E7B5A1F3362DEC936D4043C05F2476C07578BC9CBAF2AB4E382727AD41686A96B2548820BB03B32F11B2811AD62F489E951632ABA0D1DF89680CC8A8B53B481D92A68D70B4EA1C3A6A561C0692882B5CA8CC942A8D495AFCB06DE89498FB935B775908FE7A03E324D54CC19D4E1AABD3593B38B19EE1388FE492B43127E5A504253786A0D69AD32601C28E2C88504A5BA599706023A61363E17C6B9BB59BDC697452CD059451983D738CA3FD034E3F5988854CA05031DB09611498988197C6B30D258DFE26265541C89A4B31D6864E9389B03CB74F7EC4323FB9421A4B9790A26D17B0398A26767350909F84D57B6694DF830664CA8B3C3C03ED2AE67B89006868A68527CCD666459AB7F056671000C6164D3A7F266A14D97CBD7004D6C92CACA770B844A4FA9B182E7B18CA885082AC5646FCB4A14E1685FEB0C9CE3372AB95365C04FD83084F80A23FF10A05BF15F7FA5ACC6C0CB462C33CA524FA6B8BB359043BA68609EAA2536E81D08463B19653B5435BA946C9ADDEB202B04B031CC960DCC12E4518D428B32B257A4FC7313D3A7980D80082E934F9D95C32B0A0191A23604384DD9E079BBBAA266D14C3F756B9F2133107433A4E83FA7187282A809203A4FAF841851833D121AC383843A5E55BC2381425E16C7DB4CC9AB5C1B0D91A47E2B8DE0E582C86B6B0D907BB360B97F40AB5D038F6B75C814B27D9B968D419832BC8C2BEE605EF6E5059D33100D90485D378450014221736C07407CAC260408AA64926619788B8601C2A752D1A6CBF820D7C7A04716203225B3895B9342D147A8185CFC1BB65BA06B4142339903C0AC4651385B45D98A8B19D28CD6BAB088787F7EE1B12461766B43CBCCB96434427D93C065550688F6948ED1B5475A425F1B85209D061C08B56C1CC069F6C0A7C6F29358CAB911087732A649D27C9B98F9A48879387D9B00C25959A71654D6F6A946164513E47A75D005986C2363C09F6B537ECA78B9303A5FA457608A586A653A347DB04DFCC19175B3A301172536062A658A95277570C8852CA8973F4AE123A334047DD711C8927A634A03388A527B034BF7A8170FA702C1F7C23EC32D18A2374890BE9C787A9409C82D192C4BB705A2F996CE405DA72C2D9C843EE9F8313ECC7F86D6294D59159D9A879A542E260922ADF999051CC45200C9FFDB60449C49465979272367C083A7D6267A3ED7A7FD47957C219327F7CA73A4007E1627F00B11CC80573C15AEE6640FB8562DFA6B240CA0AD351AC4AC155B96C14C8AB13DD262CDFD51C4BB5572FD616553D17BDD430ACBEA3E95F0B698D66990AB51E5D03783A8B3D278A5720454CF9695CFDCA08485BA099C51CD92A7EA7587C1D15C28E609A81852601B0604010679AA482D51261EC36E36B8719676217FD74C54786488F4B4969C05A8BA27CA3A77CCE73B965923CA554E422B9B61F4754641608AC16C9B8587A32C1C5DD788F88B36B717A46965635DEB67F45B129B99070909C93EB80B42C2B3F3F70343A7CF37E8520E7BCFC416ACA4F18C7981262BA2BFC756AE03278F0EC66DC2057696824BA6769865A601D7148EF6F54E5AF5686AA2906F994CE38A5E0B938F239007003022C03392DF3401B1E4A3A7EBC6161449F73374C8B0140369343D9295FDF511845C4A46EBAAB6CA5492F6800B98C0CC803653A4B1D6E6AAED1932BACC5FEFAA818BA502859BA5494C5F5402C8536A9C4C1888150617F80098F6B2A99C39BC5DC7CF3B5900A21329AB59053ABAA64ED163E859A8B3B3CA3359B750CCC3E710C7AC43C8191CB5D68870C06391C0CB8AEC72B897AC6BE7FBAACC676ED66314C83630E89448C88A1DF04ACEB23ABF2E409EF333C622289C18A2134E650C45257E47475FA33AA537A5A8F7680214716C50D470E3284963CA64F54677AEC54B5272162BF52BC8142E1D4183FC017454A6B5A496831759064024745978CBD51A6CEDC8955DE4CC6D363670A47466E82BE5C23603A17BF22ACDB7CC984AF08C87E14E27753CF587A8EC3447E62C649E887A67C36C9CE98721B697213275646B194F36758673A8ED11284455AFC7A8529F69C97A3C2D7B8C636C0BA55614B768E624E712930F776169B01715725351BC74B47395ED52B25A1313C95164814C34C979CBDFAB85954662CAB485E75087A98CC74BB82CA2D1B5BF2803238480638C40E90B43C7460E7AA917F010151FAB1169987B372ABB59271F7006C24E60236B84B9DDD600623704254617FB498D89E58B0368BCB2103E79353EB587860C1422E476162E425BC2381DB82C6592737E1DD602864B0167A71EC1F223305C02FE25052AF2B3B5A55A0D7A2022D9A798DC0C5874A98702AAF4054C5D80338A5248B5B7BD09C53B5E2A084B047D277A861B1A73BB51488DE04EF573C85230A0470B73175C9FA50594F66A5F50B4150054C93B68186F8B5CBC49316C8548A642B2B36A1D454C7489AC33B2D2CE6668096782A2C1E0866D21A65E16B585E7AF8618BDF3184C1986878508917277B93E10706B1614972B2A94C7310FE9C708C231A1A8AC8D9314A529A97F469BF64962D820648443099A076D55D4CEA824A58304844F99497C10A25148618A315D72CA857D1B04D575B94F85C01D19BEF211BF0AA3362E7041FD16596D808E867B44C4C00D1CDA3418967717F147D0EB21B42AAEE74AC35D0B92414B958531AADF463EC6305AE5ECAF79174002F26DDECC813BF32672E8529D95A4E730A7AB4A3E8F8A8AF979A665EAFD465FC64A0C5F8F3F9003489415899D59A543D8208C54A3166529B53922D4EC143B50F01423B177895EDEE22BB739F647ECF85F50BC25EF7B5A725DEE868626ED79D451140800E03B59B956F8210E556067407D13DC90FA9E8B872BFB8F
-ct = B52C56B92A4B7CE9E4CB7C5B1B163167A8A1675B2FDEF84A5B67CA15DB694C9F11BD027C30AE22EC921A1D911599AF0585E48D20DA70DF9F39E32EF95D4C8F44BFEFDAA5DA64F1054631D04D6D3CFD0A540DD7BA3886E4B5F13E878788604C95C096EAB3919F427521419A946C26CC041475D7124CDC01D0373E5B09C7A70603CFDB4FB3405023F2264DC3F983C4FC02A2D1B268F2208A1F6E2A6209BFF12F6F465F0B069C3A7F84F606D8A94064003D6EC114C8E808D3053884C1D5A142FBF20112EB360FDA3F0F28B172AE50F5E7D83801FB3F0064B687187074BD7FE30EDDAA334CF8FC04FA8CED899CEADE4B4F28B68372BAF98FF482A415B731155B75CEB976BE0EA0285BA01A27F1857A8FB377A3AE0C23B2AA9A079BFABFF0D5B2F1CD9B718BEA03C42F343A39B4F142D01AD8ACBB50E38853CF9A50C8B44C3CF671A4A9043B26DDBB24959AD6715C08521855C79A23B9C3D6471749C40725BDD5C2776D43AED20204BAA141EFB3304917474B7F9F7A4B08B1A93DAED98C67495359D37D67F7438BEE5E43585634B26C6B3810D7CDCBC0F6EB877A6087E68ACB8480D3A8CF6900447E49B417F15A53B607A0E216B855970D37406870B4568722DA77A4084703816784E2F16BED18996532C5D8B7F5D214464E5F3F6E905867B0CE119E252A66713253544685D208E1723908A0CE97834652E08AE7BDC881A131B73C71E84D20D68FDEFF4F5D70CD1AF57B78E3491A9865942321800A203C05ED1FEEB5A28E584E19F6535E7F84E4A24F84A72DCAF5648B4A4235DD664464482F03176E888C28BFC6C1CB238CFFA35A321E71791D9EA8ED0878C61121BF8D2A4AB2C1A5E120BC40ABB1892D1715090A0EE48252CA297A99AA0E510CF26B1ADD06CA543E1C5D6BDCD3B9C585C8538045DB5C252EC3C8C3C954D9BE5907094A894E60EAB43538CFEE82E8FFC0791B0D0F43AC1627830A61D56DAD96C62958B0DE780B78BD47A604550DAB83FFF227C324049471F35248CFB849B25724FF704D5277AA352D550958BE3B237DFF473EC2ADBAEA48CA2658AEFCC77BBD4264AB374D70EAE5B964416CE8226A7E3255A0F8D7E2ADCA062BCD6D78D60D1B32E11405BE54B66EF0FDDD567702A3BCCFEDE3C584701269ED14809F06F8968356BB9267FE86E514252E88BB5C30A7ECB3D0E621021EE0FBF7871B09342BF84F55C97EAF86C48189C7FF4DF389F077E2806E5FA73B3E9458A16C7E275F4F602275580EB7B7135FB537FA0CD95D6EA58C108CD8943D70C1643111F4F01CA8A8276A902666ED81B78D168B006F16AAA3D8E4CE4F4D0FB0997E41AEFFB5B3DAA838732F357349447F387776C793C0479DE9E99498CC356FDB0075A703F23C55D47B550EC89B02ADE89329086A50843456FEDC3788AC8D97233C54560467EE1D0F024B18428F0D73B30E19F5C63B9ABF11415BEA4D0170130BAABD33C05E6524E5FB5581B22B0433342248266D0F1053B245CC2462DC44D34965102482A8ED9E4E964D5683E5D45D0C8269
-ss = 914CB67FE5C38E73BF74181C0AC50428DEDF7750A98058F7D536708774535B29
-
-count = 1
-generateEntropy = d60b93492a1d8c1c7ba6fc0b733137f3406cee8110a93f170e7a78658af326d9003271531cf27285b8721ed5cb46853043b346a66cba6cf765f1b0eaa40bf672
-encapEntropyPreHash = cde797df8ce67231f6c5d15811843e01eb2ab84c7490931240822adbddd72046
-pk = 6DD406B49B9CA035467FD26C6C0B824BEA310F435FBE8BBBD3430B5C39889E6B117E994E2F08823A33789FF858B72715323C6204A241D9835EC0DA85C5884A8A96210219099C8C383C182632280356C1B4F298405258A170E81624E861FC1082D31867A9037E3B90B0AEEAA064D27020DA7BA79398FA92A963A8A294E7720BD4CD9EA213F08063079C4D55B094BEBC4E979444F462B967972E61206FCC80337911B02C7396BC64405FFC0B77CCCD2EBC121A734037CB90B77846B2359C30A451BEB20A6D72C238284E5DF2AD1CC1A33FD5A104965C86251A596360D541240A4828231A827A0168B6D8AC7E27328173886453A9C91498765C2BD9EA9F666BB4A1D60F992538A1A746DF845574F99ADAD23B9744AFA81C7FB79A32B175706454438F46B8985132B8E1CCA10C2B0FA011EAB2428B88CFEF9378A5228E55D7463DFA5022C998ABD6354118B5116B3BC1004F0008134B85A1CF2A9F409A10E14B6D06C26D8E355864C35BC71B60D5CAC33A513EFDF6B9BB83BC880983682C8FB8A81B6927CA52E93835956795488181A8CD82B1A50DD18A25F35E2643CDD76C282E7018BB99624F031418FBC8052C4179B43A5998BE9A20CD2D8A883B313EC282598202ADD6471971C88CD9607D3A8052519930BC5BC71CA4652352B4D02620B8D983B9849CE8B8935F1A4DECC3250DE7B0CFCB49EB7B74E0B5792AE97633B092081C3C6BF58F1B242CA07610C3387098AC3F0F9043901C614590C4EBBC64CE1971E824694A999CBCC430AE923A1432B6A4911162213C429481394A27006B9D48C0AB5801823D756BFD8C6919502D613594AEC81F5669BD4E8495292606959292467CCAC7F688333B3F48A39FCE5C42C9C2653886A5ADF4747CC943B2416348F46DF5B58E4916BA64E9664A4BAAA3E0A9652408C8E5076C226C3A7932C42A846949A2A26B4E2C452F86CACFE5C201AE1321AB5C2CABDA557648A849241F077A799EDBA3582202CB27763047219F5546CF18819322B9C63974B322B949BAA491D97C70F20545886C87086721D3CA2AEAB441264B516975ED0C6044A425853528424532E4D721E85CB0BF65C26082C790765B062916FAC4A0DCECBC2E900C6F600270838E2DF20EE0A907E3613DCEE049C445640362C980A292F123C6C9B5918F21443C996016C44D2A124C5925A8E0C48E89BB167A129FCBF67ADB89903E1249F6028BC176BACC722366139858E583EB582ADA714E79B5AD1BC1A6F18754E100624620968D0702E080BEFEC425BC16B650A307802004C57590897C87E65347F32C324569051D798BEBDB421EB28B2D1A0C662444C7DB32BF97845D7225C7539F457894EB87606FA85B5E804053FB6ECDEA773566C006E540EE65101D99BF314181D666680985C78B103DD00A040DC69CFF389FEA7C18E48A363B943FF042B476DC86BE953A5925076CF749A62A77A9406165D31DACDC3A677B9114D8BF84B43F59F647FA4023535140FDE04285921184809C5F193A7DF45F62187854061A4D6754DA528F3B71A134AA487D9B5F7CFC6838108B8B95B51F5540C9EA5F29990F7BE07EFD502461033F103723093A16DD96C098977F81330249183CF35A636841BD1A9B9796F13F56BE785D942D7EAB011805CF3504FCE325B6A5EF1AAADBBB11C662B9D2
-sk = 94B49EA42526935245C45A7D580B6AEFF8BBE0F5342BB8BD2550212AD5935F45CBA7CAA6DF914007FBA79E9946C9433A86A2C4202BBDCEA008AF78975E6619D3582787530DBB7318A530B7B5A27D24258C7CCAAAF505CA92CB853A5818D4269BE812BECF169A05E71EB957557787C2F3B72315281DBA87476B157A06095A30D52B388AC22840755B43440A931DF8A709DC435B415A7BABBB04CCD93CDA00CA1FB090646B1D6514813368A794D38C907163B5917496B018C519B160C5144D6424495626E3A5AB9FFB8D8D3168D77599A88A1D12C07D86498D88DC1AF7FA7DE15073FD4B62801C1A902B215E7CC3EAC350BB63ADEAF9C7594844795A9A6274AA3ECA0CD10891F05795A77B30ADD76B6B1A35338B8156690CA2EA1C9C3B602B23324925314F726535B36DFB355225D37E7C85BE15A5976A8A6AD4E2C35D4C45ACC954368BA6DF88A47DBB8C782336F7EA507A6C2D26D952DC03B4BFB89872644084783AB493CD72D3BEFC2C803B692729638AF69B03E6DB9B82E678A42969FBE770FEF65723F77DA6437C20B203601C884A9B9E08C0B1DDBBC1A66517DCFC76B3F125F7795E5DDABEF0CB00119778575513E05AC38A7901A0E8C8794685C0F274050097BC50168818A74ABA5D71980F5C76279EC0214CD51EFA8A21391567FA052E6DC0CF9BF216CFF9287C80693645A53D71B3D7509F6A432D51B2B0AAD129B594278DA74FFACBB713357D735A744B7C65E482B7E172C67A5B4EDABAAE11222B8BB6B4564AB4FB20C28B4981614B69BB188DB6056607E089F64803D89210C7E604266B00548A2AE27996196A6D6F762C27B22731F7942543CCEF3856EDF9AD1B1B1652A33C3E038DD9B2CD9A4612CE174315E67B26DAC767E50E68508D104BBAE1A2B89B78266D27B109F90BCE1581A8B8888C90C1C4EA5FC1F009D5073780CB4545087C88026B9B9ABDDAB923DB52620713C8B5AC3301E8715AC39D13084926E841FAE41A7BBB7912E10680A78C0C363A251720B2D69467B6CAC5D894F862595072A7C9B14BFEFAA2FDCC75CC42892CEC6184B52962B9B73D663B7D76C1EA499D538BB45A4CAECEE0C8EB93BBA5EC1A8C936156382B10102E3211B2DC15663412805F60590EC33DBAB80D2A3BC05FA8AF5145644F712E004C20F799650159C40DC952C9A54C27E816C3A6A95EFBAB24A31F6C402300F9BAF88A46644B4DF8A24979E80DC30425B9E75A753A36510B87C5FA95CBF36E19A12245876003B54D4E008EF7AB9D83C5A2406014B5CC33B6167F4C452AF45084B7412EC19556D82B0A6A90C1AEA60A72312D8A7A8E5060189717094FF950AF2B503988964F0AA227C523487471D3BC905B6672BE20BC714729B7A71478B07A19F777DEC546C624723AF7B5F6C142274AC5652A7C2D7ABBF1171F2BDB12F1ECC876681A600806D6FC229E6A8F6424419187BD22E49B8F27486DB25371C169B3F61E81131B57659B1030A959790BA5D6424580B1F588326DB9CD01A260B21B8C42062B883854FB173EA7613764D41DD6B89468C7BA6C4236D1A0436B945B8B340983023139293FC48C07659B955453BBA07B0EB4E2A91F594232A47C65C66E1C5C8279F179925C55EE3A0B6DD406B49B9CA035467FD26C6C0B824BEA310F435FBE8BBBD3430B5C39889E6B117E994E2F08823A33789FF858B72715323C6204A241D9835EC0DA85C5884A8A96210219099C8C383C182632280356C1B4F298405258A170E81624E861FC1082D31867A9037E3B90B0AEEAA064D27020DA7BA79398FA92A963A8A294E7720BD4CD9EA213F08063079C4D55B094BEBC4E979444F462B967972E61206FCC80337911B02C7396BC64405FFC0B77CCCD2EBC121A734037CB90B77846B2359C30A451BEB20A6D72C238284E5DF2AD1CC1A33FD5A104965C86251A596360D541240A4828231A827A0168B6D8AC7E27328173886453A9C91498765C2BD9EA9F666BB4A1D60F992538A1A746DF845574F99ADAD23B9744AFA81C7FB79A32B175706454438F46B8985132B8E1CCA10C2B0FA011EAB2428B88CFEF9378A5228E55D7463DFA5022C998ABD6354118B5116B3BC1004F0008134B85A1CF2A9F409A10E14B6D06C26D8E355864C35BC71B60D5CAC33A513EFDF6B9BB83BC880983682C8FB8A81B6927CA52E93835956795488181A8CD82B1A50DD18A25F35E2643CDD76C282E7018BB99624F031418FBC8052C4179B43A5998BE9A20CD2D8A883B313EC282598202ADD6471971C88CD9607D3A8052519930BC5BC71CA4652352B4D02620B8D983B9849CE8B8935F1A4DECC3250DE7B0CFCB49EB7B74E0B5792AE97633B092081C3C6BF58F1B242CA07610C3387098AC3F0F9043901C614590C4EBBC64CE1971E824694A999CBCC430AE923A1432B6A4911162213C429481394A27006B9D48C0AB5801823D756BFD8C6919502D613594AEC81F5669BD4E8495292606959292467CCAC7F688333B3F48A39FCE5C42C9C2653886A5ADF4747CC943B2416348F46DF5B58E4916BA64E9664A4BAAA3E0A9652408C8E5076C226C3A7932C42A846949A2A26B4E2C452F86CACFE5C201AE1321AB5C2CABDA557648A849241F077A799EDBA3582202CB27763047219F5546CF18819322B9C63974B322B949BAA491D97C70F20545886C87086721D3CA2AEAB441264B516975ED0C6044A425853528424532E4D721E85CB0BF65C26082C790765B062916FAC4A0DCECBC2E900C6F600270838E2DF20EE0A907E3613DCEE049C445640362C980A292F123C6C9B5918F21443C996016C44D2A124C5925A8E0C48E89BB167A129FCBF67ADB89903E1249F6028BC176BACC722366139858E583EB582ADA714E79B5AD1BC1A6F18754E100624620968D0702E080BEFEC425BC16B650A307802004C57590897C87E65347F32C324569051D798BEBDB421EB28B2D1A0C662444C7DB32BF97845D7225C7539F457894EB87606FA85B5E804053FB6ECDEA773566C006E540EE65101D99BF314181D666680985C78B103DD00A040DC69CFF389FEA7C18E48A363B943FF042B476DC86BE953A5925076CF749A62A77A9406165D31DACDC3A677B9114D8BF84B43F59F647FA4023535140FDE04285921184809C5F193A7DF45F62187854061A4D6754DA528F3B71A134AA487D9B5F7CFC6838108B8B95B51F5540C9EA5F29990F7BE07EFD502461033F103723093A16DD96C098977F81330249183CF35A636841BD1A9B9796F13F56BE785D942D7EAB011805CF3504FCE325B6A5EF1AAADBBB11C662B9D22CEDAD700B675E98641BEA57B936BD8BEFCE2D5161E0EF4EF8406E70F1E2C27C003271531CF27285B8721ED5CB46853043B346A66CBA6CF765F1B0EAA40BF672
-ct = 68F11F4A8D07DBA08EAD094A93BF00141CED64E2CB3E68A59987CA3298E259ACEBB820650F861C6AF5FA565920825AE4A61A5395CEA7DDC6806E7D15D42635C8177E17A9B7110118C3FBCED5B2A73EA79B86D5B41D92C14C0302B6B1B9DB25CC2F923B32CCAA054C7B07E58EA2ECFE4F0B17C97E4E5571E04ABF67468B6DF3B64AA545B7E348E45DFB18BD186C7A17C7A3EC326E65BF7BB025D7D23B14F733698FDB79CA9CFDB85AD40F35170D98289DA8190F50A25FAC16043377736664411767C28978664444A2DA6F630D0FA54230F0DA6CCD158C5986921A356A3BF528C996A767A44FF765967A06773C4F392CE9209CBA2CE05DC63A43D1AE40C2E86DAA0F56237962B058E0D40DCE5EFF7AA165B6A9D1DFAC0D19BBC0A94466EC53DD1E28A8B01722E28C761E8AC0B97ADE7CAA0447465C40A54BA799F8A011EC1BB0E7DA7D4362215F5FAB54373791102FBCB77480A805008A5E89E6A74B15257B38BFD906841A841A475F47720AD19F34409ED6BD37C2BCD7DE06E4E04181116D0BB2050F9C60F635FEE337DCCAAEB870BA7494CB2CA590570720DE061BDD6B522EB09313EBB927BFFC920E649D98E5A4A86C2C5E3815E777F302802D98B6C616E6FCB784A16D6BF8C8AAE9BA44EC43DE816084C4C3BB1B02A603680A64FF1AB5CD8AF48774C5B5057D6682CFF3E265A63E551A20633DBF5BFEDAE646CCB99E872274C71BD61E1A518E8A2657B1FFB37701BA26B1AA36B109D75E399AF0F07D321A8E839812E6CF8EA29E95CBA3E6737F6F2113D8990ED939F86082CF5A3877144A8EF89FB5C0FD726A88DA00E986782C53D313212A9A2D20D012794E9A89866367C10EDE99EB8B03F30C376B50E7009A51F2F44082DBB62C4AC91F53399838BFBFF7ABB851C969E9003AF3FEFD138D7C5C4862F524FD97F95F9E6B5CF8CE949F748239F6DFF3535D24BB704EDF896AA06515DCA4FE776B987FE7C742CBB2DE50CDA6A2BC99455CF741F58B094BB832F2B645112F11050E1A8CB2F770709ED3D58A284012C9084CE6DE8372246CF4B4861D2E43516483E7B66F6EAB1A6AC61EA0B85F7103D9FDDA34AF13C5674ADB690EECE71CB7EDE7B02CEFDC8B052F2C8905D60D57B58576C8E9CEE41D00B7C51F8A97237716617CFC3D554D56EB2AAEB13E018C334B6D0D7A68B3294D475B910E860F17E9BAAAF7FC85FFACB18BCCA3230507AFB91620061F2FF221EA8614BFE77E64838411D7988745BF103D37F93D3E48C9B93577F1B709D58F386D110979B954B41095D58CC25E8343B1CC03C5A103B39433C844154CA9D0EF7D5E8004A44F4500BD06481DC6B8073085657AE915A3322E6CD27016B1091BA8D78EFBC32C70CCBFB8E63827D5D875302006A4554F6655D9C2104189733BF3FC5388B978304A23248D24FBCEE7BBCC9501479AA0BC19DD5C4FA6580993F4EDF4438CC7EECCD8622231C4925BE40E9FF57DAE6617BDCA8E964AAD894267DE70B45C414280F643F6F23ACC9D142CDDE71F624D69238D45B5FE54
-ss = FE8AAA6558FD8087DD7CAB54B4BCE50FC625A369ECACE58B2EC36F3BC5BB4F5A
-
-count = 2
-generateEntropy = 4b622de1350119c45a9f2e2ef3dc5df50a759d138cdfbd64c81cc7cc2f513345e82fcc97ca60ccb27bf6938c975658aeb8b4d37cffbde25d97e561f36c219ade
-encapEntropyPreHash = f43f68fbd694f0a6d307297110ecd4739876489fdf07eb9b03364e2ed0ff96e9
-pk = F5A35B4EC7538B62289DD1204DB91AC492B610538C93EB5F2637AD97DC88F0035FF3CB735CEBAC9BE7CA78A4149CF10B6D93283050167E737596B711A9F32A0F6909975055CE6632F4B42CF9A2361CF69047B5BDE1868DD745A82CF473EBB30D86A71793364F70B1255B1C2003F166683C936A7977DF156A84051E69B95E02616DD3090DD38086EF3BC12353BAD25377618965C2810FCA929DFBF46F20360FC847818CF90DBC044EED16B3B9052C5C70A5A430441E53A5527A689F49B35CE82B84D6057C5269FB60C710C5731F431A970B86431125910277FA7C310A2285117B47B95054E4174A1EB11DA3E3C26AC25619D36712B11B2EF7405BCB943DBA10D50C0436B50DE5B04D96488A38F53DF37895AC20C10D959D81A29FE1F319FF871831D93C54654172A02E65599F9D820AB037438E62714BE6C7D868B66AC03C31C8753A062318CA36B6E59D340B9696D47C38F115104765865353A05C8FBC4B0A62A96577E94C17094DE259006F169E75B8919BB4C37DF6787B59BEC8FAC999A90B73123A5CC8772AD67585C879EBE05B5C06AFDB440ADFBC4AD400D0E634822A843E9B165F2F0BB748E231C0E0CEECA8806046B5DEA7CAC614A5E2CCA3767556448785DBC739CAA9C58FAC291A0BBE96E9AD36A4A1D9C96939603BCD76A81C040FBA27A5A39A1C387CAC9D1B086E512468D378E96039AAE2622FE5483673850D411AB64B892F2C29853822EAE76FEAF5716A660B55C2020DD3323A150CEEF9AB79925D2BC09CC6FAA31727A5912A7F5E9051F8B94D8866C4DA173D3F2A388E6C44218338CB85702CBA2F602C24E1788158B0129E7C15DCF2CC6ED55C54B456CACC07D179B432A5AA63E8AC59F0B6979A833D99C13AA0C56CB65928032E2F30583FA6C038748CEB77A91C631DD09B575F13126F1447CAB00BC9C85FC7601DA44AC5FEA5ADCBB599A409BB1A67B24EF438D750BF87A8814DF22449C9256DA1286DC623E81546C283B80CC88C48F003678AB35380A6DA551AC7041CD5112D59D15A80032C28B61A1BB3B8A7267ADF4662B5963468B3BC5918418F980CD7DB3946C5A67F864DC1F3ADEA12142FB71FDA590E070007662B5C3B8B31AF169A092A2E466AA01AE879641BC4D1D62523CCAA3ED436CC089B2621456114215D1A9EEFD1016DC81D5320956FD942BDDA40F3A033E5170CA6A2C57CE17EAFC97AA0959CF37B92E789636F159FAA827DDB895553540D52A61EDC1B3DCEB22A7231C48037CC78594718902333D0BC4FE6B29352991E2BA5D31217457007057B9D3C07C39B7C7EEECC222D4415D6D9272EC50B81520BC607592947C86D2612E434C22513235536CD08F10022B97675B89F1DE58130EB6797380F6B68773DFBBA0664BB7CAAC84F7B06711587C6ECAA383505F62751C8346BDD502A58E9326E4A0D2D29226F794AD0064B2CF0A56E6A67C18B331F5537D2FC6C3AEB52A5C3313118CB7D159B8372158C1A7BFDCB65D426458EDBCF8797383E272D3B18BEE68C4D74E25751AB1CE4567D66B714CD62A8E9B886BAA812A9F50739E30F296791414727D55003BCB52AB6BB74CAB215B348AD06F974192CBD61576BAFFC815999AB8556583024CDBD1C4398F4A4AC60E8CB68627382A145F91BE9D78FD51BA5E3FCBC3155B62BC07751DD
-sk = 72408D44C2BE6E83C803DA2846D852DEC1848EE41504B5C91F774F6E512B51F71DD1520203C486F63240BAB4C1DBB212299753B8627F9BF2117CD6A83BE4075A385782AB804A420972EB25BC553EB981AAE7D7A715111338529F6116C10B10BBC20B31C3161D4BC1A5F050220B5584ABD6A546AB51A9A10120ECC131220502697E9D61BDBAD346FC43824135692204B49B5B377B870B7B28C86946077A215ACAA11ABD851ECA479988BC69CCC9975EB42A33523C525434BC594217912123957DCDC18E410A6D6A811BED8A0B4135B56F4562F343AAEC34396BB0556D7962679A76934B016B4B4BACC14650C55C3AEC9BC2E85B548B5D3EB891B6596F0C44009BD0982D98BF81AC77C8DA98264A719CD8568E48279DF9C8E9552B94AA773B43A70742C75F041915752551347F00447D72D934BEC553BF1014F4276015E0B4DB77CDF8C546AF05861804A5B7D92838744511AC6C8BE55E883ACB7775B98C4B4C9C8789AEE317F8F02B4127A6AE879D02C13772A003928041C53351D8D70CE59B14CAB5CA31D717F69129C8FABE46582CA5298ED156209C25BC57870EEA34255CE1B4C426211F957D74876DEC169C4C516C8716B3DDEC6C3E610C31F0C52E13650F0B1C70124DEE27111A76ABEF82C8FD3172D554121E6A87E9D3B58E11379CB812B7F4B95D46104934CE75C715771204D7C46AA9439836453BDA709CEF3BC1C9341994F25C48B5C80FCC8A67E316C431BD302B20904456B3283E9BA1BDDE494CE9F8A3F0B432DCA69D0BA9C43C703E1616272CD6B904D5B6279C55A539B7E46A601B28493E38A2CD9BA66D997C8C5C3B7631822C529FA48835F8A08F322615E96B9087C71C9F262B68851F00486489D25C92221C2759C89440CE733614B8C7A06F26B374CB4F8A6A7D67DA521EBA7232C0A4C066886B8450755896CFF77A369BC8FD4B3B5B0731452A908ACC68366B8EDBA66D09F212C9330C83990AB2DB7095D708B6C3589BF929FEA31534646537D2AB023887FC286F00F46F8A360476998E4FE7315F03C234929247BBA2A05297A5E01AA9CC6158458E2302513274A2E3359D66126F5FD44D348BA2B634642EA26C6CB616F64A2D2C819ABAA48BC565CA0AB67E6CFAB1129A0144C10A003B44BD3879B4E62E0AD3A58BD86A7030BE34309F3309642B017B0AA03FFAB4012B36ADC49A95DDBA67CD81306EF6BB20B546BCC55EAC2B815FB38BAE991D6AE7AA87D42ECBC740CC816A3EF42E9D204CA0177CDB30CDCB870386C320FF51B137578B029125BA518A5B887D7B9050DFF113468608F6335EA81A59B87CB753724ED0E159FA4709AC018A31194247A6A9C65443A35AC36E11BFA6A8559CF20E50116EE5FB3780FA03DCAA77846B18C04894E50486ACFC3B8FEABB8CF860D79C2734A700AB731739244580653699B51B7FC440B8CB1D6BB1360291BDA5B11AEDA3C77A25B40F96763A372512561E0D52848FD6A3A8241DEA49C4C24692CB43AA22067072FAC2DFF7898F298CBAE17F9CA68A132321932295161A1F31C178932004D17854D7D9C69F6640EE216747102280191A5695433763B6CF3B86756AAE22A37F9F6920C361C2AC68A7E11C8F5505AF2100651595BFF5A35B4EC7538B62289DD1204DB91AC492B610538C93EB5F2637AD97DC88F0035FF3CB735CEBAC9BE7CA78A4149CF10B6D93283050167E737596B711A9F32A0F6909975055CE6632F4B42CF9A2361CF69047B5BDE1868DD745A82CF473EBB30D86A71793364F70B1255B1C2003F166683C936A7977DF156A84051E69B95E02616DD3090DD38086EF3BC12353BAD25377618965C2810FCA929DFBF46F20360FC847818CF90DBC044EED16B3B9052C5C70A5A430441E53A5527A689F49B35CE82B84D6057C5269FB60C710C5731F431A970B86431125910277FA7C310A2285117B47B95054E4174A1EB11DA3E3C26AC25619D36712B11B2EF7405BCB943DBA10D50C0436B50DE5B04D96488A38F53DF37895AC20C10D959D81A29FE1F319FF871831D93C54654172A02E65599F9D820AB037438E62714BE6C7D868B66AC03C31C8753A062318CA36B6E59D340B9696D47C38F115104765865353A05C8FBC4B0A62A96577E94C17094DE259006F169E75B8919BB4C37DF6787B59BEC8FAC999A90B73123A5CC8772AD67585C879EBE05B5C06AFDB440ADFBC4AD400D0E634822A843E9B165F2F0BB748E231C0E0CEECA8806046B5DEA7CAC614A5E2CCA3767556448785DBC739CAA9C58FAC291A0BBE96E9AD36A4A1D9C96939603BCD76A81C040FBA27A5A39A1C387CAC9D1B086E512468D378E96039AAE2622FE5483673850D411AB64B892F2C29853822EAE76FEAF5716A660B55C2020DD3323A150CEEF9AB79925D2BC09CC6FAA31727A5912A7F5E9051F8B94D8866C4DA173D3F2A388E6C44218338CB85702CBA2F602C24E1788158B0129E7C15DCF2CC6ED55C54B456CACC07D179B432A5AA63E8AC59F0B6979A833D99C13AA0C56CB65928032E2F30583FA6C038748CEB77A91C631DD09B575F13126F1447CAB00BC9C85FC7601DA44AC5FEA5ADCBB599A409BB1A67B24EF438D750BF87A8814DF22449C9256DA1286DC623E81546C283B80CC88C48F003678AB35380A6DA551AC7041CD5112D59D15A80032C28B61A1BB3B8A7267ADF4662B5963468B3BC5918418F980CD7DB3946C5A67F864DC1F3ADEA12142FB71FDA590E070007662B5C3B8B31AF169A092A2E466AA01AE879641BC4D1D62523CCAA3ED436CC089B2621456114215D1A9EEFD1016DC81D5320956FD942BDDA40F3A033E5170CA6A2C57CE17EAFC97AA0959CF37B92E789636F159FAA827DDB895553540D52A61EDC1B3DCEB22A7231C48037CC78594718902333D0BC4FE6B29352991E2BA5D31217457007057B9D3C07C39B7C7EEECC222D4415D6D9272EC50B81520BC607592947C86D2612E434C22513235536CD08F10022B97675B89F1DE58130EB6797380F6B68773DFBBA0664BB7CAAC84F7B06711587C6ECAA383505F62751C8346BDD502A58E9326E4A0D2D29226F794AD0064B2CF0A56E6A67C18B331F5537D2FC6C3AEB52A5C3313118CB7D159B8372158C1A7BFDCB65D426458EDBCF8797383E272D3B18BEE68C4D74E25751AB1CE4567D66B714CD62A8E9B886BAA812A9F50739E30F296791414727D55003BCB52AB6BB74CAB215B348AD06F974192CBD61576BAFFC815999AB8556583024CDBD1C4398F4A4AC60E8CB68627382A145F91BE9D78FD51BA5E3FCBC3155B62BC07751DD3DBC65B722A8982D058E27D409F04F744551ECDE9015B62607CF67BB8ECECBB8E82FCC97CA60CCB27BF6938C975658AEB8B4D37CFFBDE25D97E561F36C219ADE
-ct = 972B0906D175A187EA54286F9929EAEBE5A4F147DDD71CEE94EDC0FE2672884EABE2E09DCF524EE839A08CE037E6DB27B0E232172C0B0B02784C57E13B52CF29C7F38D60CFCC0032A48C1198B02B8FBC01BEABB54378FACD94ABB9CB8BC488735CB826944AB2919CE853DA9B9B3CB99829611802EBABCC6CDBEFCD6EB5F65C9CF5871CA093214EAC807904DEB63B700CBE68D54B676B7FB489A04B050585591E4B2A921194DDE55684DDBB86AC1B52ED882DD0C93EE672C692FD94D8CFB0030201DF1D34E227A4EA150174E0FCB6A0FAFBDCA499306C752E8CE6521591F7CAC0BFE6BC77F8284BDFD36166F46526584B78FA94F645C805B7DCB561574237F2340836BFDBF367B2FFBCEDC2FBC6C974F157D99393AB842E1106F2ACBDD660EFD1082D016DA6C4D1260029DE92A37AC87E3A1CA207650644193335847BCF48A4074E6306F5FC2EA28E0379E844F6B5C00B9ED56E7E4EA35D7123254695A2670C5FC465AE5CA630BC1DBF187CFC3BF5F855ACF2855026A53790FC1EDA0195F6E32DEF74C34D0404FB51990B5AC709068BB55E1C4B3D30F8150263DBB9978C8B194A5DF5B8FBBDF4BD1E68A032ECD3F2ECD94EC3245AA702196E357BB30CED0EFC42B425E00D206817AD467EEDB156F23FA760C1B7A156E1A37A4AD95450A193DD1183BE571AAF14AE7529C534A7F6149BC8FE1567563D33CF153480A990C44383EC362276FEA37431AA3DA830EF0273591C526D9A0604E1672936E157E4E646DFDC5A13EF2AD14284BD8AC344565DAB3B45C9858EC2F3A8CCD445A4610D80C5263234D2E6F57DC7490D621566DDC0145488253E22DA3061E7645773BC2F95BBCCF7628822C3A861B8829F0F85AE2CEB1C4B4CE87A50365F9369BE6BFF74556644BC131B7A062B94D6AA662651625735689E70E19407E68F3AF50A4506A8FB345F84C81C0330516496E5940565D148975FF03FA4AEBA113080861FF63F9153200635362022418C9E28AECCED7021FB8E650D07A8639FBC0A84B5AD21914BC4C4475AD4C8F8A127C024DDDA9102FEA90187A6235E3B689A31403D0CDE12F6D7AAE4D1DFDA6CA09F9D78FE141DFF66C483C6028A22DBE6BCEFE54E07D9F58B4EED7515AE2E1032F6CC01E8C2AB9E417FFB3123ECA3EB0665935CEDA2426BCBD93F8386EB0B7457DDE5834483BE7BE3F25B133D76B2FA823BBD4A0356AE6AB87BDA1F807A00EBDDCFF68FED900A3145C3EB368EFE091BF271FC7488166F34EB62961FD9806AB91F15C726BF7B436B47047A5A6DFAD40451C59FBCFB45BDB2C25569A4C58AA277AD195F6A2A16DE0A11454BEDB867A93F53F8A0B8E395A37EABDF045B5665E7998D4477D4F611F3BCCB1F5C289EA5E1AFDA0DDFCF620B782FB019DC29BC376C2AAE914B721D5F6D6E32FFACBE67FFE15F2796FD95110EF9A46B358799B6E53869D6E326DF9AA607FDCB657F060B6ED8703E928F03BFE658A8105D7114D941A7CF108072E97CC1BE3345E43A541F7D5B7113804F5075B033475DB3AF0684
-ss = 86435AB2AFF9CEA1DC653CE819721A56933841F29330869B63E36604A6CEAFF2
-
-count = 3
-generateEntropy = 050d58f9f757edc1e8180e3808b806f5bbb3586db3470b069826d1bb9a4efc2cde950541fd53a8a47aaa8cdfe80d928262a5ef7f8129ec3ef92f78d7cc32ef60
-encapEntropyPreHash = ea74fbc3c546500ed684bed6fe3c496d3b86d2d6dfaf223969b942e9a8c95e85
-pk = 25949FAEA67E908040A25908A7E33199D586F22A3CF5A7AC49EA41BF83452528C7F12118E0685B09D30947AC76F4F72E89BBB7579BBA13D3CD4E262FCD385EECA8B780D7B6D3343CA7EC1958569C49808B97586C263903989928AB9B63EFAC00B27037637897556B8AAB33198C144D226AB9284541400138E03A31F10CBF1CC4BF633C3AD70C65218C1B18770C91D139971574DD90317A421B8BDC56C02C2564B2496793A27A12009ECCA141AA337E911F0B448D913394EC1ABBB46A568BA749F0FB0A2C4562637A220225A0AFAC0E9A53CA4F506391D7483932814DEA886C89879237A95C03684CC0C2D2701B40E5B3A340316159CBC56BAE84130F2FA830501257F8A8948F482AD194CCD4F6BA6C01BACC4C1B9C3188C3D002F8F18F62393B373396F6C510308B6754B8CA81F53D5A1512FFC3428A6C2A543A61FE1193A86B97B260339FB43A9F0375B1C2C62DDB4C1F6629DB701B2D2A50577CC7D5D55A30766400842938D83A6818A128310D16648614A6B6DF6B5D8D9A8D0EA4A127F4233B9A50BA539F5F01B62513A5C7BB8EAD8463C0A346252C94F753A34751B078A06DD785AC6532C2730CAEF7249515514F8E18713C2A72D8949DE781C698E708DEB35448CA1DF99B8E09AC4FAF694CA71B7BD41BB7024C0435424831424F680A77F13506A56C97B6966AFAC4B90FE60BF5E7507E6A7093C47B5F8CA47D86C767455D645C502D82CF5B1CCD8880758BEA855DC71B1C98494862030202C06B935125654EE498A7E7F37254084AA1795484FA77926C8B438592F4D7BAAB58978329CF12F461B1F93AACC7117980774E12355AF27E506A2AC63C4ABFE585B2123E2404B9EA9753FA101604663D07E153C07B743B23C56B86A91CA34111803A1F5865E47807C012A81885104495499884B495EA3F457A2AE1363221B2A94BE84E27CC9E8BCA44F8FBB92746821782B3B92B1BFE87127F34076BD4ACABF60E4F9B97A8F63008B584D0221AF927C67D616BB9933BE9486E38D7BEFDA11A27175F670600041A6DBF0C9A4364B3FFD28ECEEB0C8077C3ABA19C6123A20CA72C0776AA8E21A582168591C7C1EB146BA820C9EA1AA3374625C8744612BCAB37250FFB34A89D305C35169660DC9B09F7C960A4C4450B1A2E56088E8605FD75A35EB620C3C90B93FB001E03C006A15B67136EC1C354D405A61014821FA9590DD212CC6095DD011BD8801A10F08F15DA21C14CACFDE606CA02B7E2E1483E3514CC6BC88C2987587458D77851E476AEA14A94C176A4EAF865D58C033BA2280EC0521BC53DCC3772D48258593A5A1F9974228652B8CB4A08296EEAE869C733A316D926D400CBB09A2DAF532DA06522DA9694CEC2A29CD4C87F6A6C837C6EF6182A30548AFDB807BF447953A3827DB3122BCC7E33576A33A943492A61F3625DCF412793996C664A4664B3666C154F90B40C3EC514C4B1A2D265A23B897177342B76C69637D52E356620F468480472923313A658683566DC8F8FC1079F248F9D8AC67D4CA703339AE28A86EDB4BC21DB231DFA970249AEB1E2138BD4791352151520A73B0792A0E77D4967BC8B46740CF5599D4056F382C9006B79938825DFE2806CB6AFE7523D940792782D978970256C691434F939B02C14F42B1874087EA68917C2F3E31315E22581
-sk = 548A01803A231CA63843872ABF16B2C4B9AB7407A093B354F8882C6775BACF2931DE0A501C5A7EA7EA5C3BAA067290B9FCA059D69CC6DE9B772CC058470544B64B11ABB77F490746384B83283740F0702E17D046759B61E75030F187C2283045B22B4F9E222CA44980DCD0A42E5704504BB3E097CDF93A99F057AB21E3AC305666710C3B4C1B750AA3AC0F00A6F592770D8082F6157ADDB170A956456C7616C856657835970578B35FA87D8F79C2AE54AD36823C6A13A4207453FF324F17D13D43A400A2102B6F6224E6F2132BB14A32FA3F10A446D7944428B66E0E0A04B204C5993C03C294927C60540F836572793C8825376332B64D109BB7273147A878FF0B0BD2808B62104515D0824C90A4E249B4EC8C0F6B572BB621B7A74089DE4B49EAC5A3CFB61A5D6B420779A29E1C5AE98AB30E01A0B45538C9A14CE61C4DFFA27A4E462757A3BDF00C0206C5BF5233132C47B7111771DAAC633E22132AE82CBD616EC92B4E9D1C88E7285B84D9A12E14897A020C06832E9CAB42102AB999838A93A77141D12FF068AC13DC4C685328C7036CCFC2087BD92CA5A675CFE40AE4C32B28EB770DA04234A456EB889EF92A93A0D3ADA8061599D99CD8A96880A2B5E440766A9C81E7A24F14C295283C333A0576B49C569C99450F8714160C4CC49828090BC2CA390094E14BD6A3011A5C038F0927FB4BAD38440EA9F96FEE99141C564A91F9C86DC72498F89D05B047461699FBBA62EC28698E273E2B8436A6EB8C9C094D3404853A45137881C691352F6240ABD2298488299331CC03B1A3106F242D2871525587888E448D0F45A61480BD7E377DD5B63E143093FCC8BDAA563264BAA458649CE7FA5826E4B9B49159E7541D432143C5093A2A5BC5B835535FE7395EC556BD467A10975CE26304BB892D056A6EA4C5CE08D033E9334CF7F6750CB62209BA21F6B147AC875C3F1195D9D991E333C7C25465176B8A566A71451B8305F35D831A36C57C64B664C707F3BF08B54FF3847F1EF0AC4B32BA7D563AF40228B2957B8A95063A65BAFAF86609B4BFE1127C029C2EB224465E1C178C74CB5DB4C0C2AA46456761EC4A528AB2BB8F92C120A1B78A9517A29C8EE408AE7FAB4FDFB1941CBBAE4C3630F407A2C23C4D10A58A8E64546727153D61766D0242C5132236F637B7323905F4A7811C1B8019A808946C11A54F8CA6C16E06AD9A685EDB094616A80383A79E482C611760C249988547194266000722743346D13C80F72117C25CBB48490E05789C6A5E85ECBFBC73669F249C10A12ECA037DFD15994CBC450EB40868ABC2FEA05B5058429B6B04DCE2C4E2630A13DBA2BEC9BE9C30B9F90B45A97040A1F227200CCB4A4413C8B0C5B169830D451BC7993EB3D5B4D914A02C3183B7423D61101B0E3AC0A2A18673126F69511F27EC55E28B975E22A8CE800C37473CAC71788A42CD39C26C176C9C255C4355A62C0B84CDA33819A1AB6C07BBC4F2847AA23A600829CD516485DFF565DE9C392791B84BDB4580326F5128556D160100622AFFA2756E1CBD0A0A1F217A0C198A6DC043B1C50813BCFB3C2488A5C02C79393B65F39990B610274FA77B814BA93784562E0794C179549EA0927D9B4A25949FAEA67E908040A25908A7E33199D586F22A3CF5A7AC49EA41BF83452528C7F12118E0685B09D30947AC76F4F72E89BBB7579BBA13D3CD4E262FCD385EECA8B780D7B6D3343CA7EC1958569C49808B97586C263903989928AB9B63EFAC00B27037637897556B8AAB33198C144D226AB9284541400138E03A31F10CBF1CC4BF633C3AD70C65218C1B18770C91D139971574DD90317A421B8BDC56C02C2564B2496793A27A12009ECCA141AA337E911F0B448D913394EC1ABBB46A568BA749F0FB0A2C4562637A220225A0AFAC0E9A53CA4F506391D7483932814DEA886C89879237A95C03684CC0C2D2701B40E5B3A340316159CBC56BAE84130F2FA830501257F8A8948F482AD194CCD4F6BA6C01BACC4C1B9C3188C3D002F8F18F62393B373396F6C510308B6754B8CA81F53D5A1512FFC3428A6C2A543A61FE1193A86B97B260339FB43A9F0375B1C2C62DDB4C1F6629DB701B2D2A50577CC7D5D55A30766400842938D83A6818A128310D16648614A6B6DF6B5D8D9A8D0EA4A127F4233B9A50BA539F5F01B62513A5C7BB8EAD8463C0A346252C94F753A34751B078A06DD785AC6532C2730CAEF7249515514F8E18713C2A72D8949DE781C698E708DEB35448CA1DF99B8E09AC4FAF694CA71B7BD41BB7024C0435424831424F680A77F13506A56C97B6966AFAC4B90FE60BF5E7507E6A7093C47B5F8CA47D86C767455D645C502D82CF5B1CCD8880758BEA855DC71B1C98494862030202C06B935125654EE498A7E7F37254084AA1795484FA77926C8B438592F4D7BAAB58978329CF12F461B1F93AACC7117980774E12355AF27E506A2AC63C4ABFE585B2123E2404B9EA9753FA101604663D07E153C07B743B23C56B86A91CA34111803A1F5865E47807C012A81885104495499884B495EA3F457A2AE1363221B2A94BE84E27CC9E8BCA44F8FBB92746821782B3B92B1BFE87127F34076BD4ACABF60E4F9B97A8F63008B584D0221AF927C67D616BB9933BE9486E38D7BEFDA11A27175F670600041A6DBF0C9A4364B3FFD28ECEEB0C8077C3ABA19C6123A20CA72C0776AA8E21A582168591C7C1EB146BA820C9EA1AA3374625C8744612BCAB37250FFB34A89D305C35169660DC9B09F7C960A4C4450B1A2E56088E8605FD75A35EB620C3C90B93FB001E03C006A15B67136EC1C354D405A61014821FA9590DD212CC6095DD011BD8801A10F08F15DA21C14CACFDE606CA02B7E2E1483E3514CC6BC88C2987587458D77851E476AEA14A94C176A4EAF865D58C033BA2280EC0521BC53DCC3772D48258593A5A1F9974228652B8CB4A08296EEAE869C733A316D926D400CBB09A2DAF532DA06522DA9694CEC2A29CD4C87F6A6C837C6EF6182A30548AFDB807BF447953A3827DB3122BCC7E33576A33A943492A61F3625DCF412793996C664A4664B3666C154F90B40C3EC514C4B1A2D265A23B897177342B76C69637D52E356620F468480472923313A658683566DC8F8FC1079F248F9D8AC67D4CA703339AE28A86EDB4BC21DB231DFA970249AEB1E2138BD4791352151520A73B0792A0E77D4967BC8B46740CF5599D4056F382C9006B79938825DFE2806CB6AFE7523D940792782D978970256C691434F939B02C14F42B1874087EA68917C2F3E31315E2258194391B7A41175A41C15CD995EBC69C83B29E4BCEA6C186611DC4A79578E37F4CDE950541FD53A8A47AAA8CDFE80D928262A5EF7F8129EC3EF92F78D7CC32EF60
-ct = 82A0E7AFF4A571BCADC4F8379F16660071EA01B9DB2E2F8B4792A099532461E924BE531A9334D56A47380A66DCF49A91B7CCA99B6522CD273326FBA64569CD2543C488E95CCF27E9CCAE17B14ECF68C13A94DD7901F7AE15A92E1C7B499DD79DAD5DF3B789CEC56581B33A190C6EA00964BD9812EC9B06DDFF1FEEC5797320D98EEBD856A42B87FA94C0971B62A79AE6CD1900A706417CE9F47B8DF31E055ACD1D852E6305E607DDFF39092864D9D39D456ABA08A104ECFDB3E5ABC9A75A3072D72C59625984F38C63ADF8E617CAA5E4E45CADEA8339A9F8FA6C8302FBA5F20B51CEF477B56F537C0FC750526A1EAFB2A424A727945DCBE1809D14544856A28702046E319F5F8159694EC2FB9BC545BA1DD6CBFA514A196F556C4884030AA2E7C5445987073A882BB053DDD48FA3A4C7EE0787F15A3E175976688E75358460BAF148118336E54C34052CEAB04C1CDE9A177C655777E403AF016A147A4236E2715F8D03639EE81F57B318D458DF85DE4DA2F8DEF589A7691220593692C12EE7CEECAD2AA996845889978C7BF0475F72BFD8A8DBEBBE2702AC7F60AF6C40ABEB30DE0ADAA583F62978E085954362A98CA1D905C7C8BBAE08346C6B5EAD4DC3E37146C75C8F546B14F52EA0CBCB26E3945F4925C54EEC227F8DC4F1DBB1A3332C47FE9CC04F7BF87F0971193B12325B72F8ADF3246C3AB847C2F2F84161B773B5600CAE25A4B624BCCDF9F889FEA70142880B15047674EBD974C6442C13CF0CBDD9868F8EF0AF7C0DE183EDBEB49D56ECC26620E6F100068F303F949A8280E370BB81F5A31E3141D3005E67BDBE3AF409B898039CA038EA1478ADB3C95ECF88ADC1F9FE9251AC07BA4214EF8E6B25312D7267FCD612C893CA8D32C0F07D6BD929815D399E13CBFED2745D31D2C783019CABCAE85CA659F68498E4D0BCFF75804958C1BE7C86F102D12C0F05C56F59646DD1C0DBEDFC65BBF8900ACE1861D98AD20E87A2E1599F6CD768385C85ED30867A43F44DDED91F2593E25AA9D8481318C3546875C8E95EBC8DD29E3112293127D02D2921F30FD2C377BE89087E4222EEE4D793D1D9925BF28981EF52AD688516251A2EF7AA3DDF34B6AFDCF2C92BBB197FC7C4882015F836E99C9BBA1E310E25009C1FAB7137312DEAE24EE1609D59B46DDC4FE5C13202AABFAFC92B8BD5AAFD6EE9FF7BFC6A5E36F0AC30E5884A84B6DCF601B4BFAB2948EFEEEBC9DE0C90FFCE407923ABF2407643D6C1B1860B796986BAB3759E08A42208E96F179555FC97B933C4F759F38F2B648276A31BCDB7FF698CA966B5B182CA6C29C2EF20DAEC7B510EB8C79FD20E33770E6192941B6084B7A7A7FB254C332F3337BBBD6979B5DAA682D36F707EFA44785098B775F38F1DA67686EAD81EE659F211C4D547DB678729B223CFF0F487F7042BA788F9ADD7DAA2122A939D76203472AF237F81BD047D6D9449E57A5AB8C3CD62FF88DAB360D8B2B3813FA36DE70F69129E112DB46CE8CE8A59241CCA8F207C4686EB27DBAA22B901
-ss = F9A2D73F0A81B5829E7C7CAD8FCF5F1AD55B384B2427C288BFBF4C29540F1DB6
-
-count = 4
-generateEntropy = 66b79b844e0c2adad694e0478661ac46fe6b6001f6a71ff8e2f034b1fd8833d3be2d3c64d38269a1ee8660b9a2beaeb9f5ac022e8f0a357feebfd13b06813854
-encapEntropyPreHash = 64efa87a12cb96f98b9b81a7e5128a959c74e5332aaab0444fca7b4a5e5e0216
-pk = EB14CBCB226951857BE4B3BC2A1B578B148E824A2414412A3D57C8213793C418BF2E0803DE4A16EB9C8B5D53718D38AE40299B89793F14741792BB10D9C21D5F06633AA3CF1CC78D0DC99983076F8756B2F96B2095E0B812160FBB9494038A88057671DC692F14A956D5E6565FF752D28237C70B8F8528CB1A04CFE5E6495BD3B46A3264FD7364E0D54F2AD27DD27B022EFB3D3A632A7F99551BC3317250207F2658F363164A9631A34B468E9B3C9B34B27A3A02FCBACC516469F69B3A51554B93E05FD6DCB098E8AF8A3681CE89548CA311E2F5421CA1496A532366435CFD56A26A245BA68655DB99CD113C1AD1170BAB16A22BB3399E45C6A9BA45B5DC5DA04A426C635C844744C557AF7E49CA12437CF455B302C037BAB4954627A2363020C4AB5CEEF5AAF2E352DED62FD6A52ACB70C84723A527BA34F179204B26AC10692822AC66CC56BFECEBA65C33295FB805C596A48A0C59477405C21AC3EDD2C27E56C19BC84D710584ADE48647C681746038AC74AB73591FDE872CCDFBC3CB1218FE12ACBFEC9248C00E19424B1FBCA70FC5193151AAE1415416BA2D7FAA6A2C745CDEDB94295438BB182DADB77182B2BE5BD1CE0CC028B7EB71BA8CAC8585CBA3CA01620B63FC91BF3C210F67C65C92F893FC616158C104A5799720AB0FD907798F0678746475C8502029865DD653209A39C0C362258A266B1B244A4F42B4ADC1C6BF602FE61125C3B989C018C0A0E0C73E35ABC97C9EE695CD265909AF82548B865EB4238376A6AB53A6BAEF185799489F64E200FB542EC3D1B42E8B3960E02730936D620360FF4570B4079B369A83629B599E7B27FF48C37F727A4F93BBB2D4B7E1C73FC0D6668E53C1EFE0A0B547B1F38C51F4001654F45BF0E5766CA1C662F2CB99A6BD42A17F89C80A4DB03C990A81AE9487E1A52C13720266083E152061AA08C03A7A703DE58251F129546A42282515A3E27195CA97CEB39B00566CF4ACADAF320D5C88C75FF310F10BB5AD738D38AA47C945235E1730B6CC227A194DCB04CE046A22C37319D910060B594BF8A64F2C4B8F26000031948046721E6546893A341ED2C32804149954E3788EA5054C51A43DA89F9C789EDA6727BDD4BE32B15D47B9C327EC68422813B00950BD73C96C7175274A5EA8BC128A7C0993031B4E8A5D3C074D2D1ABDE8239D5AF58C06509B24109C84297E3FEB447FB3926DC19F39211119C4597711A222B341CDECB0698580E422A951DB2305D4A7A871967DB945A60439DE206955C371EA52452F865DA438130D2B8EAB3669A97911258B08931A2E36C6C390B6845E8076A0D621D7692971BA71BDA0B8AAF7BA0AD3C4F05AC23621A146C68BBC501854062B924C3A64916A1B9B19CE5B466F8672EDE621EA987F83495106DAC22FFAB6F4A5CCA797587126CE50589F68A2084875BBB505C7FF46922EB496DA260E3719CDB2F23950455DC8D36E3932518BC11BFCC067AC533360B86550B6AD09E93DBB092BE410721D48BF56B3594B93CBECFC785A5852B598425E4C4CDCC7CAE1907ADEA5772276B2929B9507DB5C06041E5F9846506055417C6FA091652A4A424BF6396D46365BB40601E3A55801B93A1CCF39126BA7F025A2467F6D44DE229C527F6E4E7071CB826CFE76FEA483D9163EAA84F6AFAC495A
-sk = 944AB695C2345BB67894D451EA2A5C92561A5467C769352379950879899C9CAC9D05E89CB2729B2BB47724923FCA357623C69643569D66912B2F9B3249908090D4C5F68388A6141163C931DF430D70290950B07DE410AF913C0E5A215C3059785EF05B824545ABA0B95E7279D1C5726B59890B82131D5C62E8B3BE33B8016BA0C321C248A5293C71ECA570C9536F958B84663B1DD5BB6F272C3E201F014AA3AE05640ED92200274D45D9BF4410CE8EA72D680ACE1EEB04CD8B002DE72795DB60681BC9ECD387FCEA796FF7726FB29877F895E6832EB7EB179A5956499CA3BCF3283FC8489D494A88668E6614B1F49824F12A448B31A42861190CE3A9F73C6FFA25622D7A504E0694BB7C75EE71CC8E718CE9D57AC86A11721721E6181F157C333AE098F8A6823F765B60F0300F4733CF65240C779569620213B8A331731A7B31937104BECC0995EF57255261AD9B246009F855CA82AF2001B256760C1543074D70B3C578279B35137E16AC2089A4C60038B8671D308964B68A2211187154746C27F59C8105981C8C7D0AD58717978C01A66B5EE1697188BFAAC9B927822C940C5380409F38459F5B302CF7DC9D6BD823A0308B0DA45C35D541D2346BAE4173FB0C677EEC26A94C4158B28D4D7B4B0F62A4AB06BAE0B42208B099A174BB4C482C7C321AACA49C4A517114A5CF408750E8588545134F83A67769CC6E0B413BB800C04093184625A7EE24134A721D5FB1571CD82DD1D7C5F9103E0C2C4416CB775AA28DF48643084B391DD2CAF39278E9A31D2254871B170AE1B60A4E39B1F5A8473F580C7153CAA1369D8E9CA381660A57CA8D2523202816767CA8CAC0914C16F1CEC8EA4EA5DA930E0403E7A876C390BA31FA250D946A2EEAA479888011DB7942F7676A120338357BCA38C4C95088A4A0884B8B4C14E9C09E831F8AA658ED77CC164124CB281F61856BD6C965B6B6CD60B1B1034888F3970555443F0F5CC29C800F578806BEEB4730AB9AF4B9BEB89502AB48761E188CB9AA95BA06B28CF4B89C200B2145A4339A53406B6790A518F54902EBA0230A8C2A45447125B7330F12645D935E00651CB4996E395543B7E643137ABF3DF59E042ABD6FA11927062D73D0A107BA6FEA0908FF6759A972C11E864EE7393254051BDA558D4B272E6CB2C337747A7EF46F5AC872D5D5238521C09E21495EF98B59C22961E5A4967370EFC4865F06A72A41464D37CE4DD1803BC117888B681D35195C857A47B764C6799A86E27327EB0403931E29F90FEE8628AA43B333615BC0F251707024AD41A24E3C4F15B99E72F536DD989C0325225DC682E3611640D99C1552506E687E18A883F90882056C14385BC08BE82616D811A4FB2DC93670945B7EFA17593C4B7BFFB76F9A805F5230C50B065DC77B409CA8CC0B7190AA61614C528AF2D1AC130C19E4362E85A40693A87C00935A887B9B58699777453D8278C445BBC8D225412BDA6FDF026207E3B207613D2ED74C085707EDD555FE4C00B40B2A83AA219CD643F1D83EC0FC21BCF94FBA6A8262D959C9FB345F2221082C40A1501C46C55082DB2709230B04090558CB6D6815173525725D8CC0BC93C881C99A16041757D6A05AC71A15E887EB14CBCB226951857BE4B3BC2A1B578B148E824A2414412A3D57C8213793C418BF2E0803DE4A16EB9C8B5D53718D38AE40299B89793F14741792BB10D9C21D5F06633AA3CF1CC78D0DC99983076F8756B2F96B2095E0B812160FBB9494038A88057671DC692F14A956D5E6565FF752D28237C70B8F8528CB1A04CFE5E6495BD3B46A3264FD7364E0D54F2AD27DD27B022EFB3D3A632A7F99551BC3317250207F2658F363164A9631A34B468E9B3C9B34B27A3A02FCBACC516469F69B3A51554B93E05FD6DCB098E8AF8A3681CE89548CA311E2F5421CA1496A532366435CFD56A26A245BA68655DB99CD113C1AD1170BAB16A22BB3399E45C6A9BA45B5DC5DA04A426C635C844744C557AF7E49CA12437CF455B302C037BAB4954627A2363020C4AB5CEEF5AAF2E352DED62FD6A52ACB70C84723A527BA34F179204B26AC10692822AC66CC56BFECEBA65C33295FB805C596A48A0C59477405C21AC3EDD2C27E56C19BC84D710584ADE48647C681746038AC74AB73591FDE872CCDFBC3CB1218FE12ACBFEC9248C00E19424B1FBCA70FC5193151AAE1415416BA2D7FAA6A2C745CDEDB94295438BB182DADB77182B2BE5BD1CE0CC028B7EB71BA8CAC8585CBA3CA01620B63FC91BF3C210F67C65C92F893FC616158C104A5799720AB0FD907798F0678746475C8502029865DD653209A39C0C362258A266B1B244A4F42B4ADC1C6BF602FE61125C3B989C018C0A0E0C73E35ABC97C9EE695CD265909AF82548B865EB4238376A6AB53A6BAEF185799489F64E200FB542EC3D1B42E8B3960E02730936D620360FF4570B4079B369A83629B599E7B27FF48C37F727A4F93BBB2D4B7E1C73FC0D6668E53C1EFE0A0B547B1F38C51F4001654F45BF0E5766CA1C662F2CB99A6BD42A17F89C80A4DB03C990A81AE9487E1A52C13720266083E152061AA08C03A7A703DE58251F129546A42282515A3E27195CA97CEB39B00566CF4ACADAF320D5C88C75FF310F10BB5AD738D38AA47C945235E1730B6CC227A194DCB04CE046A22C37319D910060B594BF8A64F2C4B8F26000031948046721E6546893A341ED2C32804149954E3788EA5054C51A43DA89F9C789EDA6727BDD4BE32B15D47B9C327EC68422813B00950BD73C96C7175274A5EA8BC128A7C0993031B4E8A5D3C074D2D1ABDE8239D5AF58C06509B24109C84297E3FEB447FB3926DC19F39211119C4597711A222B341CDECB0698580E422A951DB2305D4A7A871967DB945A60439DE206955C371EA52452F865DA438130D2B8EAB3669A97911258B08931A2E36C6C390B6845E8076A0D621D7692971BA71BDA0B8AAF7BA0AD3C4F05AC23621A146C68BBC501854062B924C3A64916A1B9B19CE5B466F8672EDE621EA987F83495106DAC22FFAB6F4A5CCA797587126CE50589F68A2084875BBB505C7FF46922EB496DA260E3719CDB2F23950455DC8D36E3932518BC11BFCC067AC533360B86550B6AD09E93DBB092BE410721D48BF56B3594B93CBECFC785A5852B598425E4C4CDCC7CAE1907ADEA5772276B2929B9507DB5C06041E5F9846506055417C6FA091652A4A424BF6396D46365BB40601E3A55801B93A1CCF39126BA7F025A2467F6D44DE229C527F6E4E7071CB826CFE76FEA483D9163EAA84F6AFAC495AC5DBD68B3A8C148B2E7AC049BB986E14DD1CEBFA1CBF3EDD6BAE85A4D2DDA082BE2D3C64D38269A1EE8660B9A2BEAEB9F5AC022E8F0A357FEEBFD13B06813854
-ct = 99CAF6EAD87C4258D41204468930F6669BE4D28877F95B4E4E7F15F975E3F8F7CBFCD8D24FE79C7CC43154878BB576F31C5E59077DA847B648FA8EA91A309CC32508B3D6A2A7FFE37B38901D15B489689D71EF0E5ADFB052AABE970525ACDBC79DC95AC0A62B7B151AE209BC92FFB4CD40002CD061E9EC8CC7B6D82B0340D798BEEE0C4FF22888A5E7F90D2782FBB07F4D980CC0126D7CCCA78358C86D9E399625AA7E67CF6E9935D3B02948AF9D4E02422985E5F067218B0682F576C3DBCF7143AC7452391C899C31F7BC2369CD4158AF829A6F8ADE7BC59C727244FE9EEB85FC20ABC87B82B1A8233CDCAE93D51BF7DD544F8324BACFDE234DDC364909AA9451B8452A2F959DDEFD14E055D3F09E8B9B34F43CF5F61227896C85EBCB76C25F66D78F2C9BD9A1B9ECC209030EC7A494C909337D3196B11E0FF8EC06AF26F82B8FE3D95CC5EFCD7A620C410358896D7AE138C5A35E4A7F56C2E1766D9CEE5E3A883217DFB6AC66B014354384BE3B8B36B29945755418558DF46BBF07172F778128668449D0D42092E24CB530F77BCCDBF9A732EA3D68623847A1A377B2D0CF9AB3E61440453516C76B7F8477EED10CE40F0C10D5FDE3BE9E20CF629D232F85D6744B76F8801E691BA9CDE389BEDB87C5683F47C031DF57D17A0241707650BD78A753570A1DF4FB30E952B000239A0ECCBF75954FB6053E509AA61FF4607204175BF10F500735611053633A2E77E1E073C5B5DA9C41C56DB9A368A6F9B2FCBFAAC2B899A487FB9653FEF223A24D788DAB079C88B47B08C7B300EEFE66BA4A95CE44FB719B495C3F1530BB1B4D8EF0E940603D142A6DF06DA11C9CD06A983BCF834A1253D472BD5A344694CF01CB3A7A75A3954B6DA6AA69F700FBB5A9C6D21C29D9DA5622640E730D44DAE3CBA7269C9F7B5A822069FACF10EC7710C89D56D92C56DD9E5048C898CD1A1AE0658DB7530A27C9AF44E55030EADB9B1CE92EB8129E5CCFB5AE7E3A3ABBEF6F441ADC3BBA1FB94AFFBD154B4E6FE014EEF5863DBB3C0764D0F4808EB19F2E6249B809E1BB558EB8A7DB7EF4CABF353B331F8F1A85160BE83D34DCA53FBF0C654D2BF2FB594BB2B26F9E6BC875542306CDD623638D8F36CCD98A4357C84C06CB8594FFF92ECDBBA23BC3FFB3743344C347B29106FF5014354011062CA7A1F7B2F0B4229AE5857A769B6C83E3423C6EA10605A168DBCE3F5FF5ACC77A17CD0C91E50787290AE26BC68F4C9F9DCC961AFBB3F875A77F5DCC7393B818859FD9F41F1BC1C1AFB814B0EB7BAC59EA36A9BEEEA70524795CCF733A315618818C165EE31D93C198257DD17D36F7F5531F58EBBD0D195068F0BC0E559BB658A49572FD0F0D6E587D9D8D3D5B838C11019D7D306A1A6BD88C1155DB8498FE0E7262FE683448C6C44B83A416E9FB99149674F93663B119076CBD2EF018A485084676DF141E7373E3F96BA2D4FC23D175FEBD6AC4A63BD910ACB190EA203F9408DF92413FBA0CFBEF9AC0098A0B40FADC42531EBDDFD3B8E5095D2C
-ss = 83E562482FCF5157C75D3D2F0A35DA861689A1009104A071A7BFB10BC4D8CD02
-
-count = 5
-generateEntropy = 7ec408f52c9aa723d0c41d9987682a5f4ce6c9da7cd0215af60bbaf5484ab353a08ccf451b049fd51d7a9ad77ae14a81569df8c9bd3a8f1ebea86fdcfb823082
-encapEntropyPreHash = 8a95d71228acaa5f9ae6f9d9ca8ae55fde296463b41083a39e833e37c4c90f88
-pk = 86B5C9A75157E73CCC2E138518EA98A246145DFB6BAC9B2FFC333C0BA5806047CA9BA8AB797937000270E773C9863709E59786F8EC948ED27660AA3758E33F59140E527787FA74A2CE22A4A8F3037A26903665CBFE8A0677EC273F590D64C97F69F396DB78448535746B43296BFA2BF0A251BF986A524074C1F96077F5219CFA9124D1458520993F627AA8B7B6A0F191683233E0BA6BDE24561A666FD10151B0C52C9982C301E0970C3363DE27825A5BAB078848AA5CB75A90C1CBD24CF67A68F3417780CCA947131E4573934F9959787B6320A4B47BB311048289E2C915E35344E3A144E2708893138A15A03FCE3816945464C229C587093B5CBBB519767FC65C078D6C684B8B81C1F9CC2B3BA749FB3074623E3C9124A8E1A513510357656B37087BFD02773FB59157EB885E1501740483F3EC070BD492DFC217D7DB99CD7C9D57B937297634C3494DEB585B8C93CD4EAB1865F8A9C8BB15DFE583C7DC0427274F8DF3C693FC351289964A89A3C745967231261D949552E0809BA9B7C5D258AF579A4515981E991D93154BCAA170491B06752415B1D52BC2A98B7F39C5B91A87EB759A9A4537218156746930A347A5026911ADC0412F10A7A7C200A1514D500805C10A276C327E4899AA3F9B95D1BA2347E0140184B1235A719E6C4A3011576235215D77084034771129C33199B70774B2130898A0C69D8F39C3A50B273C665DCD8031B4454D144A4356B9C2B16641311856CB65466991B06D1A8A74A5AAD6B5B935B65DBA8374EE690CD1C701A5A28B41732B5F88A9AD919A7FA563BAFB529885488F544E1240B3CD673F94EBBC91B4757444A302578AA953161993CC918216BC56BA53EA17664BC5B543A38C3516D4063C35695791D8821240BB749CAF98896C4718A9DB33C1A7E9B91B9B6D06FBAA58E507F8A105E2F71F6095621E354B3DEC1F9C979ED7B3AAB56B4741110FDA601FAC78C2EDC386669118A425C634157875F61ADF10C43D2184D3252EDEB11A61EB67A349405EC74B9FD307558A887EFBBB46C904F9469DB491605A3582BE433BED57363426055CC4852ACC0317F24D89903A918875C949556A6A458FA3CFB5797D6A3A68EE9991D97A38E16B9A727C5B2E7B5E5A0029C1513D5A1A98EAE78713785BD4322261D90109A0806E565EBD9308849CC6708B536C83A2FA35995C819D99B850251C1D50EA902A053C7CA31FAAC37BCB1B40D6123CC4D52002909D0AC566F7D75DC89998036AABB267C5AA70184AB4CFFEAB018F195F62879BE0A51B42B843CAF7C494C181C2F06866CB2287A00349EBB136747DA52A3C4A3C581798C413929CE3E698FA594F019579AE329A22D4AF66F27B46453F22E61AA6EC5D7D854FF6D3C3D4117BE2145B5C2BA7A57AC968A5CA43B461F808167FB5A76A942C95145098B95CD46439669C00366960E2162AB613C5ECB151359B093C27C04AB230FA7C0074684996F44939C81FC31373C8231BD0B6679991A32A031002B257B2F31101317B3E2B6B28B8911E3991479444C6086110B7A70125CA71C6659C970F94D0942124C17CE3AD50D5A7019146BF51B012D1CFA0F59B220A795DC6B3D7896AAC680ADAD383EC46762B669D35909A47C12DC8EE619E1A0C8915822D574A243F67E14104D4F021CF95BF33271C9BC9
-sk = AC65AF9FC8B905D09638374E58C551DA08AC4EF86A8FF04489BA462841A85D907ED0C70E1A790297AB2DF7D6CDFC5C6AF513144DA105DDA2C75F00736DD91564A79668E335FBDCA1C9D31592E73D60066B959A2FCBF55474F9C21BF058F021457586766FDA4FAD521F64940D4932B07AD8CA7E1A06662730EA6C15AA1C2F9662552313176AF04FA4A98962101492566ADB8BBC3EC04F9CAB9EBFE5860F886D57A2C73FA050A3607A8C0998754B417C9C5AE2FC3F829CC3A2EBB1E927AE87B68C6DB355F4C661CD000D10D6BC31CA1C249A9B3931A4D1C57904DC6DF923839D9A90AA2B93A87C44B5F82E6A925D22E679428064FFCB9621067B75477FB7D51A1D3B9D9DE4051CF874CCEC12976562752CBFCFC59F56C2C60B8B4610A9BB36E9019B974502407D57289726AB8A38D7A6C880074A5686619ABFFFA5757DC79E1449408851502BEB8196F493F4A724B9D681645A07B193586C5C05D8D10E2C968BD251B88691C368DC18CF8270DAD3C22BF5093DB4CF05668F8C6315C0EA3F55495E784CCD6055AC451363FD77A91686AD77C5AF53141EB5E7534FAC4DE481741E48B414302E4743789E250C39C45C0A15CF42E7B3631B6A8C0971C8A34B8200BBFE11004AB06BFC5949C3615B02947C73E7A0717C6B60F2679DAA21AFE4C55768A08E70105868AA6AB4AAA848C79BF125883907B9DAABE367AFCE273E2C168AAB02ACD27855E2944B67B938170A9258F67397770136E466758C260CCB7DA226B5A95692514727FD48953C62959C88C8784A8A52131C4BA5A6D757B4311048B602B554E8AD509B0C12B0A64553CD4270CA92F36CEC227E16A217C769A2BC1AA6C356A5A39C69F4963BA6273DB9232F1D8A28CE65B5B9058F1B8A164AB0380C42A8EDDB6C2B8B19F26B557C387E4DB9AEB92C4D7D0A2CA1E35F97E05CF590BC511AC5EFB2357E70525BD027B36C6781C4B86B0069E7B89C8CA643FB9990ECAB2CC5A8A5A5B2B0441076CE934D96BCA9FFC10EB6E7BB093675E97B68894BB030581D89123642C1118364115A76AD1C181EED4B691BBC15DF182DCDE00C71F8685B71883A184396D3475CBBCB674360DC14C42DD6461514479C85557194A97A654C4BE7620FA84C59DB5057A0886D760460CC4A3A713F4FD4BDEBAA93B943C48E6348053703ED818FDD9CBD62E246C0B69A265AA381822D6A474C5AA530AA5306A0C8572C413718A278194367405789E1F749AB4A02AF87B362067F3DA12EC01A83ACEC26A390CB5419B351BC95E08C7338FB933B81476EA950881275A186C9E9F99DAB63634E6B7314188BFD686D74EC203B71542B62B1C0C7712745940F7B9237551467470E5B1BA2F8E34CF585ADBAF980317C9DB1147382946C12223C3A45973B879A523855BEF121151BCE620216DEDC6C3457CA03951FF45B662F79A1A7A5CEFE9A846DD5774C7C2A22F842E4E465A94314E036BB55A2787A1A0F0F111143872DAE74AF706A369CA54259B80578BACD497700871842B98CAE2AC3B572F98F145CBAAF54569779B616242060B30B2A482DAF335C9A502CD318296958C696F7080C7A3926C7B62F36A5DBFB87EA0518358155E8E94390B6C0F808B91C166577037D86B5C9A75157E73CCC2E138518EA98A246145DFB6BAC9B2FFC333C0BA5806047CA9BA8AB797937000270E773C9863709E59786F8EC948ED27660AA3758E33F59140E527787FA74A2CE22A4A8F3037A26903665CBFE8A0677EC273F590D64C97F69F396DB78448535746B43296BFA2BF0A251BF986A524074C1F96077F5219CFA9124D1458520993F627AA8B7B6A0F191683233E0BA6BDE24561A666FD10151B0C52C9982C301E0970C3363DE27825A5BAB078848AA5CB75A90C1CBD24CF67A68F3417780CCA947131E4573934F9959787B6320A4B47BB311048289E2C915E35344E3A144E2708893138A15A03FCE3816945464C229C587093B5CBBB519767FC65C078D6C684B8B81C1F9CC2B3BA749FB3074623E3C9124A8E1A513510357656B37087BFD02773FB59157EB885E1501740483F3EC070BD492DFC217D7DB99CD7C9D57B937297634C3494DEB585B8C93CD4EAB1865F8A9C8BB15DFE583C7DC0427274F8DF3C693FC351289964A89A3C745967231261D949552E0809BA9B7C5D258AF579A4515981E991D93154BCAA170491B06752415B1D52BC2A98B7F39C5B91A87EB759A9A4537218156746930A347A5026911ADC0412F10A7A7C200A1514D500805C10A276C327E4899AA3F9B95D1BA2347E0140184B1235A719E6C4A3011576235215D77084034771129C33199B70774B2130898A0C69D8F39C3A50B273C665DCD8031B4454D144A4356B9C2B16641311856CB65466991B06D1A8A74A5AAD6B5B935B65DBA8374EE690CD1C701A5A28B41732B5F88A9AD919A7FA563BAFB529885488F544E1240B3CD673F94EBBC91B4757444A302578AA953161993CC918216BC56BA53EA17664BC5B543A38C3516D4063C35695791D8821240BB749CAF98896C4718A9DB33C1A7E9B91B9B6D06FBAA58E507F8A105E2F71F6095621E354B3DEC1F9C979ED7B3AAB56B4741110FDA601FAC78C2EDC386669118A425C634157875F61ADF10C43D2184D3252EDEB11A61EB67A349405EC74B9FD307558A887EFBBB46C904F9469DB491605A3582BE433BED57363426055CC4852ACC0317F24D89903A918875C949556A6A458FA3CFB5797D6A3A68EE9991D97A38E16B9A727C5B2E7B5E5A0029C1513D5A1A98EAE78713785BD4322261D90109A0806E565EBD9308849CC6708B536C83A2FA35995C819D99B850251C1D50EA902A053C7CA31FAAC37BCB1B40D6123CC4D52002909D0AC566F7D75DC89998036AABB267C5AA70184AB4CFFEAB018F195F62879BE0A51B42B843CAF7C494C181C2F06866CB2287A00349EBB136747DA52A3C4A3C581798C413929CE3E698FA594F019579AE329A22D4AF66F27B46453F22E61AA6EC5D7D854FF6D3C3D4117BE2145B5C2BA7A57AC968A5CA43B461F808167FB5A76A942C95145098B95CD46439669C00366960E2162AB613C5ECB151359B093C27C04AB230FA7C0074684996F44939C81FC31373C8231BD0B6679991A32A031002B257B2F31101317B3E2B6B28B8911E3991479444C6086110B7A70125CA71C6659C970F94D0942124C17CE3AD50D5A7019146BF51B012D1CFA0F59B220A795DC6B3D7896AAC680ADAD383EC46762B669D35909A47C12DC8EE619E1A0C8915822D574A243F67E14104D4F021CF95BF33271C9BC962E0447F7B5AE8A806B741CA5C302230B555C3786C11F3EB43894A8F45E3F7B1A08CCF451B049FD51D7A9AD77AE14A81569DF8C9BD3A8F1EBEA86FDCFB823082
-ct = D4BCE18C62FB15E635B2061B99A2D1BFF919EE09A76A8598F64C8F52272CE533DA3180B71A5F1A710EE5D924B1725834D24EC3166E3A2D6C0EBEF6B4AA2DCB9AA3CF2BC0E3AD19590AB3520B3145CBD5F36E207AD97C9AA2276F0FAB6A5918F9C0D67616FD45B4F8BE0C461488F17F57ACDE6432D8B36541ED62783DD590B6AC71FCF01805EEE76EDC2583CF0A0626CA4B0D6AB6535E2251CA533992336ECAE5B26B0E06525F08D53D04A9E0CAA603381E6C033F26661427063E3B6C84A4F82B9120BF58A3560D7B7234F1C6E7A5A4E320C8C8DF4F6433F646951F7A719A79B9D22A663A2E33A39CBDD054D870F447C9F3053795F96134DF95B277CD95B6D7580225F919E5119FB5C2C75704DF380CBECF276D28FFED759C8BB7252E24A39A1A9AB3FE42204727A50508ADF6C274B6D4976DBD6B7DDE7753A9E58CF8FFC6E31BD3DCACF9CA083B3C482F561CAB1C0DE32293D35DBB69368E8A62765AC4E6945D8D982435545F2DA7DA1875350BBC242611DFA2BB9F36B407E70C27A7A0AE0EE2371C33BBD7B958F4A233ED13BCFA73161DD89E559EDF03845A0F8513A865ACEF4DC5EE33E40793284DCB5226FCEC925A4F1195884A72993F34457073365E35A1346F6453DA6262B137EBFD7EF78711CD1319D23493888BE93C75522F3645E5F83E10843C4F688BDE241537249926FC901E9BE192A126FBD910194D0B3B26325D59831BB82D9A2F357ADD6C823D46E3DB51646E09C22F750F95237CDA8A00071BFDEB8CED9863B89019155EFFBD27337099E08CB72293CEF964F28FA1DCC644B7D022050900524B2A1F7AFB0347FCC6E8402011217FA77E3A6EEFE5C4A63F775EE2DFA5EFA3F9CCC2E70366B88F5AD9C0B73CF81616B32D38D30B2741A04DC6AC179B90FE61CB66EF31024EC35093BC140EE79BCCFA149FC69B846EEB3717BF18A2358FC9C56EE28A7E384A82EA0D830123A49698E63A17D70C1C9F1169F1B62A409C5A64FF6D73372F419E12201D8AAE01D09BE2C3D26E8D651884A31F6B2456410DCFCB79684B00A163ACACC2E247476CF53DD66DFDF3646322971E918C0B9096F86A8EAD17558D6736F4C52B1684F952CD93BD39CE4A4D67EE2D7470C710F86D1688AC90BB1CE23C6E500B6EF99FFF1102BB23FCA16D96D30DE29B4AC4BA252063DFD14F7834234274A49BBC5E78B01914272F1A84BE414AA871A7B5072183CEC33EFD9C3FC702FBFEC2CA3762D22722B98575CB874219FBF0F82C3F768878AE2AEB9D3FCA8A8877CB3B78B9A9E34DDBCEB6659E3D632B37F6402D734E545BDA4027562089993DA8D4E8F388243E1D8EF9504F52DFC668E69BE634797EEE05C6C2CBCA705FA1A088E9A8A2CBFF0C9F8827310FFA1DA6E75B0BD776B4437A6CDE2A9683374910FD5E5218353AF004F1D1060B6BAA31B3460D01B3E7675261DF6C409009100E70A4391F146F04839F0C175837DFB4E6B9DFD402032380236627093C9BE3F8EAD7F81BEBB8F8853C549C875AB0EE4BAAAC49B73FA3D410EA646E
-ss = 445B60A142D4853702A102F9CC37FDFB1D0B14A9A7E210C7D290F9402F0A2F40
-
-count = 6
-generateEntropy = c121915bfef6abdfc177dae2f5a24218f9abda2559afc6741b08e0e61ab433eb84ef52db5eaa6df8ec3a0bc5ffa730db0dde8c5f38f266d5c680a78d264a7b96
-encapEntropyPreHash = 90d79d75d0bbb8921cf70d46bab497022a8e750efdc99e5f1bae653275441c7b
-pk = 05EB362461C4A2E81885084505C3862C3B647D181805205EF3E4CA5C30C46A0C21EB97700B70C2BEE78D862B3E19DC1E0CEC0AE6998A7B3C4FDAC39A950027FB2A3BEE027A8E54B4A5B981BBA01BADC0B5BA6A36A2913F1C1A046036960790CE2CF2583E6C62A778290F242B49606ECF24B3A0DC023B22AD8945A0B8DBCCC9356475B36B2A990D7435B12E1536A21079FB7802B998488E690F763646C3B66ADFBC8161855B20EA18AFD87229D05E60372694E4C4C6215344DA04173559D7954B029555E6CA4356F6CBE325A39431A64DF06E75C63ED0E40BB0CBA6ED68BC7211B02F1165C370ADA1E0ACF4AB61C87CC32F7017B4A26FF8CC0784F76047316AF6398DDECC0C62E9A37FC4CA685017B33AACF597767312192CD330B2F3A84E0BB858480A63A607295A39F61510DC2C6998614013F45D319858DA8228FE5BB6EAF3B03AA60F4B721A3F046D3088671930672C61C92D6005254372D8081BE322CCEAD06CDD472CC5A481EE385096A5B8CE64B57781CBFC4457E917162DA007BD7BAD8E3803E05B08876842D9E6A0A545407A5067EDE3510CCC4478C040310AAF46051454D855D1A5521E2514AF676846650E0043BEBF453E7488B6DB8AAEFCC16E26A75C52BC0EF3C80DA3BB39F73B9852B54D9C606363438C45DAC4FF1A1913D81B9A80544177BA7DB6503A04A5405299F80A83FB7135FDE04F8CECC0962461C0E80298D219531C9CBF00A3BB5B84908B5A807739A63485128512C0478084C8964F9064CD4514CE92C30454AC25B48919B719C5A853010A2EB712B80975660456562C4C448C39162CA63AED14AF7F28875149857F9B8965BC1D04CB8EE2E67C14A493A3822FCD0A2DBA2677E719B8F2C8BD09431B82BA56007584BEEACAA1F081D244B0D771BDB0C8033B18CA9597443FF8CDF754569DCC2DC4D4C212E2BBEE88925CE73034E19167CC7AC46059CD3B9EBBF6BC3A476F08438C61971AF139A248821002480F42C2B9C0979AD3BC6868565CA3FCBC124A7548D53F56B51C9F8AA387B59B07638C7AA45704420B3C24642035A7884CB42F877260C29697809AA7482E3FC356D8CA061C1C443CF24C4535BDECCB02C3E3B8B1D90E5B47BD11615CAF849DA5811AA743B9BD7810C470187E81AF9BDB4D1307303F615ACE2A58E7ECB3BE260E9F7C1E10EB3A84F207D2E75A30C7C741EA45FB04A9473C1425F80A9186A7F2625EA6ABB4AAEA3BB50602DF23ACF8E452CC01A909EC9034ACB47B969D904213F0A79EDB7766D0290005C954A1DA0155F7318BE854FDB038D019C1904B714F0514AC331C3813BD703B45076365BE4B47EC510A9F585907BC0F461A6BEFE13A2667593E12134A86AC139777A50CCDAD16B6891A0871621B387684B5226368400164B29109328F672CADADF7648377CD11C9232094165BB1CF12F694F940C3CD784C84925BA74C8A49DC27CDA4C553C85334A860A8A55D8A75969977AD1F505B9B20CEECEB24A262C707843310F39434390EA5315A67491F0592BF722A1C2658C8A720991B26561E14B178C3A1028003CAB8B69F60828F47B876D43D3F193C3820804068A5CAE76DC3F27F5F1323E6A2797B9A13C86713A83BA9C161899CF295CFB4A4AA443F32D16B72616A0DB4D3849FC41A7A6BA87F4AF757A0AB1956518F
-sk = 67A93BB27ACD00C9B95AA03552809C38A08480DBAA67A9584A460345E20E5F381C9A82710EF1709CA51393F916345719BD3144B3121A8608C0A48017963387F7A31C5FEBC6B6749E6BD9BE3C58A9A77B53D7762F5854A3467A85941CA2C03873C0458B940275E5AB85B83A5C2027894B92246DD8632D68A310FBC6D214381128528B375FBB8C3C7923AC6A8C7F9E37C2EA4C6B72E3451922761AC274B5CC8569CCB93917A748E93C190320E3F1381E08CCCCA70903975AE25689C12709C8E9096B16A26E4439C2552A088194368B36EFE3871A6A1CD54CA0C70974AC936E45DCA01DE296A14C7D20652999E61841DCBA6C0171FCB406E14A95B0C02517447BB9370996176BFDC5BEB4316C0ED34A13431E34AB27D9DCCD3DDAA49D314659BB8D89325099D0B06931796CE65C0628C817393BB1870F19A10CFE3546D8BBC2509058327626F490A1BBCA6FBB653EE1C3555203353509AB14B64CF8A29C32B17096805B8D751848DC4494279266F2CC474228B2B703CFF81F0F29152F4570151517995262D705AFFFC08DD413C12F37B605BC32ECC1292B9AC99E4A34F911C8DB990ECC9A3DFB37517446908B91B1172A3D4F547B3AA642709BA40C3939734545DDB6B45C66A1A3E58C6D1929E5721BFC6A6021A635D86C8378D4A0BA68CE385B6B7FB983EC4A95C8B20B3EC750B082BF2CEC89A6F8C2881650E5B71A0135C865BB3FB12A4C2C3C917D655A2997984C8557ECF1943436A9FECC5C84808E38701CC26A251F458334F59BD40BB0D8F82E74071A5AE3C9439541AEE59C6E46A5852834CE5712B3665018154C5339467D606AF189CCF20C68C583C96D969815109CD3ECAD4F5AB0A8BB8A7B68359B0319078A7405821C2709A615864422BA0A3970C8EA138FFC1522B1A53ED1C71D396A0ED6B782C6552C70216679BB4761A600634276D553CD703897C6943A859112CAF9A7AC99517C23CE6457AA069B6FD2775EFB262DBC27B02FE6923D14B047A25CDC6B86D20A55D85108FF276F121A352E098E5D4CC3EF92B3A1C4A38244621B055D5F812189F6941B492330FB1AB0A442A656655455B38B522DED5640CC4136DF6CBF4C4B0651531CD8C95280E2AF13FC57C977BBD1A8BDD253096EA98C3AB33A516448A8301A4B141AE213BAD2F640B2D5846C99A25884360F604333197816BA9DD1D0C427C5B8D3A6B434207B8539CE5092CCDA67A755D6A6D7E8BB6BB02AF1CA7283E797F24A1042D29B64262F29B0482B840BD70A3D6D54205DF412DD6490E3DC38C1236758F65E461B11CA480B476875C692508E7BB90C430797E1917041642D88506C07255AA92EA32508462C2F4A1661C05114C9361F651B7C5FF70B42659FFEE71F58CB79E445536B8948142CB4EC16CFE5B21DA659C2DCE452346323F1632C37F128A6525F40E03D6C073E05476252B2B0483C4B87C1C1FD8C972CF651EB9684FAFBA3F862C8619C089F01277C14BE7CF7790712CA1E8877A48909EFA31D814C1C21F4A151B886076840546419A1C8B6CA4466389A3F6DBB69E8494D7B25A4E9B234A8D928A26B946FF305B8A33B0BF8B3EB992D68C312B4074788E69D1A5A211C3B55F8C654AE778FBADA1D75FB2305EB362461C4A2E81885084505C3862C3B647D181805205EF3E4CA5C30C46A0C21EB97700B70C2BEE78D862B3E19DC1E0CEC0AE6998A7B3C4FDAC39A950027FB2A3BEE027A8E54B4A5B981BBA01BADC0B5BA6A36A2913F1C1A046036960790CE2CF2583E6C62A778290F242B49606ECF24B3A0DC023B22AD8945A0B8DBCCC9356475B36B2A990D7435B12E1536A21079FB7802B998488E690F763646C3B66ADFBC8161855B20EA18AFD87229D05E60372694E4C4C6215344DA04173559D7954B029555E6CA4356F6CBE325A39431A64DF06E75C63ED0E40BB0CBA6ED68BC7211B02F1165C370ADA1E0ACF4AB61C87CC32F7017B4A26FF8CC0784F76047316AF6398DDECC0C62E9A37FC4CA685017B33AACF597767312192CD330B2F3A84E0BB858480A63A607295A39F61510DC2C6998614013F45D319858DA8228FE5BB6EAF3B03AA60F4B721A3F046D3088671930672C61C92D6005254372D8081BE322CCEAD06CDD472CC5A481EE385096A5B8CE64B57781CBFC4457E917162DA007BD7BAD8E3803E05B08876842D9E6A0A545407A5067EDE3510CCC4478C040310AAF46051454D855D1A5521E2514AF676846650E0043BEBF453E7488B6DB8AAEFCC16E26A75C52BC0EF3C80DA3BB39F73B9852B54D9C606363438C45DAC4FF1A1913D81B9A80544177BA7DB6503A04A5405299F80A83FB7135FDE04F8CECC0962461C0E80298D219531C9CBF00A3BB5B84908B5A807739A63485128512C0478084C8964F9064CD4514CE92C30454AC25B48919B719C5A853010A2EB712B80975660456562C4C448C39162CA63AED14AF7F28875149857F9B8965BC1D04CB8EE2E67C14A493A3822FCD0A2DBA2677E719B8F2C8BD09431B82BA56007584BEEACAA1F081D244B0D771BDB0C8033B18CA9597443FF8CDF754569DCC2DC4D4C212E2BBEE88925CE73034E19167CC7AC46059CD3B9EBBF6BC3A476F08438C61971AF139A248821002480F42C2B9C0979AD3BC6868565CA3FCBC124A7548D53F56B51C9F8AA387B59B07638C7AA45704420B3C24642035A7884CB42F877260C29697809AA7482E3FC356D8CA061C1C443CF24C4535BDECCB02C3E3B8B1D90E5B47BD11615CAF849DA5811AA743B9BD7810C470187E81AF9BDB4D1307303F615ACE2A58E7ECB3BE260E9F7C1E10EB3A84F207D2E75A30C7C741EA45FB04A9473C1425F80A9186A7F2625EA6ABB4AAEA3BB50602DF23ACF8E452CC01A909EC9034ACB47B969D904213F0A79EDB7766D0290005C954A1DA0155F7318BE854FDB038D019C1904B714F0514AC331C3813BD703B45076365BE4B47EC510A9F585907BC0F461A6BEFE13A2667593E12134A86AC139777A50CCDAD16B6891A0871621B387684B5226368400164B29109328F672CADADF7648377CD11C9232094165BB1CF12F694F940C3CD784C84925BA74C8A49DC27CDA4C553C85334A860A8A55D8A75969977AD1F505B9B20CEECEB24A262C707843310F39434390EA5315A67491F0592BF722A1C2658C8A720991B26561E14B178C3A1028003CAB8B69F60828F47B876D43D3F193C3820804068A5CAE76DC3F27F5F1323E6A2797B9A13C86713A83BA9C161899CF295CFB4A4AA443F32D16B72616A0DB4D3849FC41A7A6BA87F4AF757A0AB1956518F0C1D832AF7B7282D8BD81A2237107EE60D81E28EB64D6A153AE0EAA1A25797C284EF52DB5EAA6DF8EC3A0BC5FFA730DB0DDE8C5F38F266D5C680A78D264A7B96
-ct = 7E2B3F001C83AFB604595634A841E0D71327502B46D289E4D5DD27ABBD0400206BC1CC315DAE0F8F9BB8C69676B5FD0DFAD5DD4D05609B5AC327F77EECED6D72139E4529574CBE4EFC1A796033DCE9DFF2436E18A627FF4B30748002AA858BF6B9F12ACCCA22088B727D74C1C3EF565956ED029B661FFAC19F00C54CDDE3D86EB59725EF82FAA2AB55BF3ABF0789E037CB95F233E93C7B73471EDCAC5CA8D5D94968EEC87E0D9CEA8F2ED79C3BFD8456FBB1727E576371264B22334CA4492D0EAE431AD6AEA4524F22C08F8C3928B703D7D7C23481622968AD7CC52D10E38F0B164C45F3742238555806283C1D781E8714030BF60D3CF414D00FA1C46F5528DB038618E918E98A6A36D7C092575E1EC5A6961485368147A38F52BEA70089244EE06DA2A814F0478299AE34896089EE6A7A2701512443E492E9FCFDE204B45965CCE878355E23A670779B140DEB556DBAC7448CAE69A90BF2359F8D6A8023233BFF39C195B16754CD1A43567B449742E643F16BADD4907922F9C7E3B333AE55F2B28D3FF896E83AD412ACE77AA18D76A50FFD417BBF2F5CAB1E23AE417E855F697E4937E988C0040DEA224BF0F99D3521252A4F8EA00F1311ADF4A61706610BB2A84D761A294806B03DE026096681A0D249BFFF4226F1CEE5164C3D54180E7123D2069663505014B0B445CC0ABF27AB73209E89A1FDE1BFC0229A6D2E9FCD9562B7BDC5D4E63A7955EA8CC5BB8FC0C2AA23E1D576269E4CC0696DF1A404BB9E6821BF0B541E1BC2EB643691EE390E662A8A8AF177DA61720336183CFE8B5963EFFBFB97CF9A12DF2B6FE59A613E693D25A672FFE633575D5A2E5B6F97C122D7E1823A299DC87956C0CC6E35F055BA9F08916E163D3D0609EF7225C9C507B8C3021A6FEDE3E48DF94B21E235A38A6A506C9436EB83B19B33EAD5649012CC3EB866493965E55B09024910DF0E45962E46C33DBFC7E1F7B854BB30197BEBE2956108F67243D52DAAEDF84AA65AF71373B8BFE221C70EF833ED27B2CAA2FA744B322A4AA7EDC1854ECB932BC4008A284F4C06EB87592068123E6A137F4D5FC216DE6B17C5C6F9819928C9ACB9E9054B101C320DF769B12D9ED4E0D1579781B91F9C97D2D55C34CF4309C33E26D7D616A3B52E3D3C59938BCF11F6BCD70FB420A6590A4BE120630ECD6C2368BCFD7632B522854947C0251ED4906BA4BDA3292019F1730A17003802A43562469E6EAA1C23E41CF88D2FE7AE803E4FBE44968EEBD1B714E25DA525349E941EB7B651AA391596E47AD9F3E298D1A748348FB6A322716DF3A027050501E5ADFAF41FCAC0D5F22AC5360A049F3638B0C90FF249FF1A6A1208BAA375DD19E79A6DCFC33BD9920D854C8EB12AD4C8806E3DE032A3751F005F59377D51D5E70012D318D553AF10162674DDCB19F11C1A9C07DFB948C700EC50F87802A9A18C8FCD5239CA762350CF436AC84CF467003035638D9D8B9B145F2D7F35BEE3BD00C59D6119B634111E1896DE86F5FBF359E9C86BACD73F9F432ABBBA
-ss = 71156980B8970FED7F2213594630CA825EA8EADE58CC8225DF8111460412B762
-
-count = 7
-generateEntropy = d86634ecf96cc2603761e284c0e36734cedec64e7ff486469e38539c71141c5a99daf37400cfe59841afc412ec97f2929dc84a6f3c36f378ee84ce3e46cd1209
-encapEntropyPreHash = be8a32f97b9a8d596382c02fa2a0eeebc15c083e970ddaa4f2622b91d6718663
-pk = 89C28969078E11664CA1554ECA81B9542BAE2EA8CC12B44E81B3354818141AF0B494543D4674160A086F7E8755A87258E7E6A6AEB96955286924B42636E04583F74184133D8ACB9067925F4969642F274085F70FC12361FF96C3130B143E23797F2A3A6CC757C97454CC8AA5D9C062F9254F4CC7335B44CB66DC712B4677C290CCBBA08CFC3948C535BE29F44736A23B4C8CCB3978404E419A08A67AA555BECB48BCC161CBC5492B55E3498E74BB515C28A7A44A3AFA0148EC3411D82A1AE103513074A13938A5FC17DFABAD006D90455B4B5E45079D7BBE956C7A18A8BEC9A64C1DB72544CB00C6997D545AC7E3BC5C6565885536AF486417E728CC99C78CFA12A1F7697F1AD26EFEB7262800AC4E0121E766AA9BF0A74AE635074C62FB6CA79975761419B12A985ED7A2C8788C9020462FB5764C087681BE1595A5EA4EE7234AA2D22F4119B559A536E0DA0E8D0B2E493C2B5BD576459994ACD684A81A0955684818E1B88E348446A22C9143A4EEFC7D8EC678624763D4548FE2451F078582C93C986B0417E1AABABDD76DC0532E252B59E47370E81951EF75AD48C223316A40237152E3508EC164C7375594F73B5F0483C560F52F250AAEF28431E9D1B2B9DC650D2371BBB7C8360C72369755BD8696FC5C83FCA76A7FC02EFF54CA60579CAEF6341385AEEE34C7182445BFDB549BC59F70B76368DA88D47386F75968ABA093E8F42DD3C7CD68C8028A90CB0C93CB44D42EF9D15E6CA978ED5B88914C4E20768028F2C927A33433D33C5E6A45A6C5AE8C252A83E68EC121347B025865F26912B89A9DA7472B75B9ABA75581852B97D27EA7C9C5C7E8BEBC0094C01947F43A2C6501C97E43231310167ECCBC4C3A2022839584A12AD5B51B4CD308C94302E58C70EFF7B24FAA051CF548B5A73AB4254179EAA038EC95D4D4182D2971084CB33A6CA1106076DFA76EC0C4B3BB5C7266A481001CAD07D12051A77E31603BF47C62DBF959C89774587111DB1B038AE834E0A08C27F2B772A967179A9BADA1AC12BCB8FD3B06CA44B3F11A6762AB51A9A0B67FB83DEF8C9A712A1469B719F2557E5A03C6BAC808D0E0AA304955A3E961618920D0BC2347C74AD6725A9A855D1D8456D2C26ADDD849E59B7CE7C85765064ED6D63039E368E9F18D4FA11E16F8CC88BB3FFB40B4C6269996DA8A6B5586365292B5B1C78BF4161C171E2FC7A6A8293A96D61D683275EAFCADFED74473E30A1026809076A1025398B745BE723A78E008C85B558D2B76392F5015D1024C171C0FC6C7C0C0E631BEF57166E660269231C3216FB08B6CFF0A420AA413EC1285B7B5AE9FBB15F9FA6B8AF29EC061996A7612DE524C7E0724766BB51E1264AB50C3A095815645B1D1021060B90C96555E8A001044D16CFFD7719858065EFCA6C2654EA25506F0541FAE242DBB154E420C0DD4E13A79053B431B7C00768BF0F781810A0832A2B814C5517AA1A0949523E12AA35893912256A7370BCD9FAA30788B631B87731CC5C831A26E8F48AD7CF9C935301AA8CB006AC59FD2EA5BDC1736B2A5523FF3C4D8F429DC037292E863A087BB29CC2732BA30BF11490DBB1F3ADB3448D6110A774B25D242602C250999CE69D1B32AD3702602E6D28FDACDBD2A03546764C4FC1C62C0EFB3462C7C88AB8D94E20B
-sk = 0FCBAC2FD83A9EEACE0215C784E20260F0991B225897E94ECF93368B79565B478731537EAC74550CD599D5268E03A25CF327606686AB8864677907A3C3555018B478FBE125498652D5259A31C2B4649C14C89BBC5758A9B53C64E95BC9CE30C306372D431CBC642C0D60E25136C3919F3BB48B280B9D5CA0B21BB4E1510AC49AABDF02C9FD66420B475D0731918A4A5D3C7A963A468FB7A86C128988EC36C34F475F2B87791F5604863BA6DCA297EE29238BA79EEEC5096E9B336CF0B24DBCC9FEB8BFD77AC888554472D7732E7492C231302A073680C684870B86A05592355BAF2620B51DDC7B17C9328D7A74DA6367D9EC2B87E9221C297B5398CFB55C10E8A68323AABBED806C2272C192FB180E7A5B958A02DCA5C55654A43C74216B192522BC2A2DC05BF865062CF56839831EBB837A3ED8C7368C15933730667B7463AB7026848BC9BA14616B2E88E17ACA4109B5DB56510B408465523307619FCA752919B947EB40E5E8C19A7B4A9099734D648DAAC8C81C1C628C895400E245DF8A324899273EFB441B564305EC48AB305C69D37E846AC9B77A2917915E82286DDB397936769BE7E37FA7F27A003090C7F2B9B395A41370B5A38C07C2D8314627267FA06BFC416D8AC1155DF645C6150BEE70C4CAD8C6A5C564BA2571C9BC9BFAF0C2D12578C8198D49E1414CBA5749D712556A537A4131F3F085F9047735482E23342B218101AD30122113060CCA4196F778C77CAD2EE58B6F23071A85B79C1215F0A7C8745ABCDB768C3C26042D09A9A0355A5C45745D1ACF52C205B949ACF581AB75CAC74F2364406A43A74269645166FE167642900D169A1E84929DA4CB361E80C42DC702A79364F1D664528B6CEC667BF230078AF06A0B48466DC90B34EA7101512E37D8BA3A351D7023AEE652351AE514B8D217FAF09A07654B0CBA1850041D7206CECB05C8F6703F762C97DBF82255DAAFCC3608E8891E3AD8B3D4E18DBCF6A1C2E74CDEB87D15236D70943DAA722481692890A548D7C69A14FCC1155202CA4941C3900B57A452F281091A94781C64A9583C8D302C21484CC6159B88A931AEDC4291E097982EEB0528C152A43B97DEA2A0B36922FC60C226B61068C792F377B9F655940D73702D41BC515086E8F9266C53A4C15A35907CB2FC2A2F19BC5F974034677A33B648322CC9BFCC6B947B5346DF2044249623E53430895295327C9B35F59ECD4A9521F4B93A4C031A624C12F40BA17B9F36908E462B928AD452EC74B84F9B5C1C69660038C85D6743F8A5A65B3787B5640D683B7A45009A1EFCB5E50A35244C9431F21F1B6826311673832CCBC1794FEA917268F5323726698F67BDB41BCC012218929649C972149393845DCBAC7FB58582964405D4ADEB814037A39E512C3FCF72A22AB70E21FBA3822B493DF9983866412F0439E1A613914042C982739031949B2780D8133E13E632FC4281DE567A333C5D8AD458B848CCD65BC87A8B6B29134556A6780EB7B02E4437AE69C09E304210D5CCE3CA3DFEF261A809BC5DC44787A20AFFF49F3E0156E7B428AE1CBD3292C9D818844D4767342708E4016EB9BB0F7099876C26729F443E7CB3B9666441DBA01C8397953F586E3DA45789C28969078E11664CA1554ECA81B9542BAE2EA8CC12B44E81B3354818141AF0B494543D4674160A086F7E8755A87258E7E6A6AEB96955286924B42636E04583F74184133D8ACB9067925F4969642F274085F70FC12361FF96C3130B143E23797F2A3A6CC757C97454CC8AA5D9C062F9254F4CC7335B44CB66DC712B4677C290CCBBA08CFC3948C535BE29F44736A23B4C8CCB3978404E419A08A67AA555BECB48BCC161CBC5492B55E3498E74BB515C28A7A44A3AFA0148EC3411D82A1AE103513074A13938A5FC17DFABAD006D90455B4B5E45079D7BBE956C7A18A8BEC9A64C1DB72544CB00C6997D545AC7E3BC5C6565885536AF486417E728CC99C78CFA12A1F7697F1AD26EFEB7262800AC4E0121E766AA9BF0A74AE635074C62FB6CA79975761419B12A985ED7A2C8788C9020462FB5764C087681BE1595A5EA4EE7234AA2D22F4119B559A536E0DA0E8D0B2E493C2B5BD576459994ACD684A81A0955684818E1B88E348446A22C9143A4EEFC7D8EC678624763D4548FE2451F078582C93C986B0417E1AABABDD76DC0532E252B59E47370E81951EF75AD48C223316A40237152E3508EC164C7375594F73B5F0483C560F52F250AAEF28431E9D1B2B9DC650D2371BBB7C8360C72369755BD8696FC5C83FCA76A7FC02EFF54CA60579CAEF6341385AEEE34C7182445BFDB549BC59F70B76368DA88D47386F75968ABA093E8F42DD3C7CD68C8028A90CB0C93CB44D42EF9D15E6CA978ED5B88914C4E20768028F2C927A33433D33C5E6A45A6C5AE8C252A83E68EC121347B025865F26912B89A9DA7472B75B9ABA75581852B97D27EA7C9C5C7E8BEBC0094C01947F43A2C6501C97E43231310167ECCBC4C3A2022839584A12AD5B51B4CD308C94302E58C70EFF7B24FAA051CF548B5A73AB4254179EAA038EC95D4D4182D2971084CB33A6CA1106076DFA76EC0C4B3BB5C7266A481001CAD07D12051A77E31603BF47C62DBF959C89774587111DB1B038AE834E0A08C27F2B772A967179A9BADA1AC12BCB8FD3B06CA44B3F11A6762AB51A9A0B67FB83DEF8C9A712A1469B719F2557E5A03C6BAC808D0E0AA304955A3E961618920D0BC2347C74AD6725A9A855D1D8456D2C26ADDD849E59B7CE7C85765064ED6D63039E368E9F18D4FA11E16F8CC88BB3FFB40B4C6269996DA8A6B5586365292B5B1C78BF4161C171E2FC7A6A8293A96D61D683275EAFCADFED74473E30A1026809076A1025398B745BE723A78E008C85B558D2B76392F5015D1024C171C0FC6C7C0C0E631BEF57166E660269231C3216FB08B6CFF0A420AA413EC1285B7B5AE9FBB15F9FA6B8AF29EC061996A7612DE524C7E0724766BB51E1264AB50C3A095815645B1D1021060B90C96555E8A001044D16CFFD7719858065EFCA6C2654EA25506F0541FAE242DBB154E420C0DD4E13A79053B431B7C00768BF0F781810A0832A2B814C5517AA1A0949523E12AA35893912256A7370BCD9FAA30788B631B87731CC5C831A26E8F48AD7CF9C935301AA8CB006AC59FD2EA5BDC1736B2A5523FF3C4D8F429DC037292E863A087BB29CC2732BA30BF11490DBB1F3ADB3448D6110A774B25D242602C250999CE69D1B32AD3702602E6D28FDACDBD2A03546764C4FC1C62C0EFB3462C7C88AB8D94E20B2B757AC0425152BEF72ED852AB1EB44F4359499407BB6A020FF843A31657C5FE99DAF37400CFE59841AFC412EC97F2929DC84A6F3C36F378EE84CE3E46CD1209
-ct = 269412479F44C884A094A5B259F76D28CDCA0361BA64C402491F98789F0D46B7E31E7E93B17E8931AA3F83E3D6B6DF59B1DEC49C1532EFACC9718247529E38856FC982E92AF949AE1BDEDA805E8C43E05D2D8C305E2A753F322098483616C9D48568BB341C3818A7316EE7D19145238C38CD3E04DC1CC6E7934783D3979C0827D0BFA69E5BF8F8A8F3B0299090F7468E1094DDDB0A231E5A516AE2F38275D2F125F850D7B3C6137F0DA50BF680F13BD7F001E978A54C06BFECE1401039215753BEBCCF7B1B99F219E4D562E235BF48976CC59F3A3AB470ECC89B426787AD39C326CFC2E53DDD55FE02D0863C0F9BF1B1E1EF0D397990F9C13A6993D63E140A7F936B8048DECC487576DF2722A00335ED4C620452188C5FE9356169D8C48EAB7E2AC66471A7E35BED338DEA11333B190DA230D8A8063CE734D208141C9EF622F30E5CBC1424488B708F955B5FD1A0E613580BBA1866C1A027CFB83DEF2CC92063693EAAF7C087ADCBAED63F891E2A9CB295659E2B72B0C3CE8C6DB44B9DEC84A0AE491D07DBEBF355C4C05FD2940B30774DDAB5E0E448245D39E13634C1B49450B0E77F9F22F76C053884882C4F32B34748140A4A3DC3A296E6577F84CD047563067ACBB315961278D667E6FB67325F3987A37149F463F2F43416DADC28679A0EB3F1D20C36AF04DA09384DA537AAD03BDD880AD06A606CA720A42C4034801E5DCA8E250140B3C09B9F7EE28E242915E8B23C936529CEBE9C887095B5AD25798C10B474E4D2D682E3C5E7C83CB2B4ADE983AF27636A9C2882DE397DBAF486EFB4464D19F72AA8C6436EC561F9387E4B44B9831405B2462D8293A954688804E2BC620BF767CA7468F5A0431C4A871D521C416A36C8C0039D02CAA91A633838B83B6AE7879E2E9EACA55C1792D9DC0C098B243406A773B79BD7AE46A377341766A1FB173D38A32AF97C75F395248402899ECB0AE883A6E96EC34677E8B14293E8E5F67CF4ED94D4A7EF45B7C3DF12647D3D9DF00A6FCEF8221050E861D539A86438D7694474449DA409589205A7B513C434B95563AEE108FFACDCCD8CD54505F55E086BC615D15328BA7E72C81737E1A2E8B6DC14746B21CAD2273818CCFAA1C9B01B22D347554533FAF1524BCB2AE638DFDE9955F74CCA13A9FF82FD9EADC556704626214E2C928DB464CE895819A4A12D4C4317FB840E8444EABA4C412805D63AD74EDDE6F7A9770FE679FBB028485F210725D0DB99EB221AB67F60EDE0C6EFF26B914B7D887A97F80C752C0035D632D903D2D7351EBFD0B07B50935AC4054787D83B2B98E23C1C8E03E6284B83569C177194FC2B85E9A2FF15FCCB4CCB66D7AA53DE89167036DF23E4DCEB6113407E6C14DF4847ADFAC1628464327F59A37DD26D60E433D4DAA8BFE4124F225E339D91CB9D2A57FCB5968488C29514CCED169E8DABB400B26EC2377D0EA71C1FB3958E4927EDE45DFCB024AD7C16550C69187FBF6DFD055322725160F8C32D8F48DE48E0A52872058A7C6B380510E028260CAE
-ss = EFF5E4CE44FE0D0B77CF8109D46C8A888399D1608AD9E2248181BD205A0B23D9
-
-count = 8
-generateEntropy = 0610678ff4dc3128e1619f915dc192c220f8fad94da1943b90aaec401683a492da1804ddb5aa9b1c6a47a98f8505a49bae2affde5fe75e69e828e546a6771004
-encapEntropyPreHash = da2cfaf69e25b2a89ff2557bbb6f69e01d8e2e7bb27a7a1ce7e40fead16f33b2
-pk = 764B51D1DABF923518DE898C5E7CB5E0066FD69522F5889DC05C41A472C983583333132052A1C93A464120B325764B8665CA42555B98D8D6A93C88A0A383AB51280F52873F2BE26E12C131677027C616711D478342CB424B0463C88161ED84BF6E869ABE9CB915D13534D2756DD72343359E9911624DC7C6E828B19D6CB178C43A5CEB9360D2939DF2744ACCB4DFE8AA5ECA35BF87C6BA265FB4AB7C4888516EC91E52C4030F5453E6BC9103B9C19CD83E69048272855B11B8AF3EDC09B04AB31179BEE59ABC76726FBE9612D271B7010844F62535F2F30D8417C35F17C1619B055FAB6A0F5458568C753310299FCB335A7697E7CBC9B9EB1B14AC2D0DDB765B266B6D68BDB5B0236895328540B20F91BBD2910625E674B33A4F8B6C1B4F66C4130C2E973AB72D809282CA63EDAB71268C02A9D020BFC805410AAE2DD4B699448A56049D1E9A58C5FC2ABE159DEC69C5027099A3B57D3A2560CE24A6F5017D32E00F3078B792309384421878CCA555B7065D57537C804E10BAC052788769B7C1121A78911A153FB56A365A2F97B070D7B61724D0C4D14C295D78BE57A8AADB873D3AF6B74D020B8654CF48543DE8CA22371A48DED585B7073ECEE0C44EEC27C85B5A68F6B454B0CB10692039CC68EC2C2BF892804520C71BE5B7BADB807B4059A3D87D32548BA3E4B698CA150D784A8C2C35A67A8C92C68AC0037888B65A4C9800BA7A1EC050627AF648FB61C87CC55B8243545AA514CBC550A8804C8598CD35786EB8C6B06077A1E2D4344E4A6BAA789C305B6326E0BBD4402DBE26CEC08A7C1A19457BC2677F15B984A74FBC52CDCE48618D50C47400011B392908AC2CF08A579783A80FB2990CEA90EEE90B7DD81E6CC9C961372D8C720D7EB223D5A6A16D4571C1A93213B32289934F7B30A63527C6399920086940B7696503E623E63A050F4B69810B6E6F6729E5782B572221F596A09A1879BBB46A62A955043A30A2AA3E62E02CE1AB6F3D03693A8CB653E361D8783FFA37274AE06A3F2292F1A6557182006E493FF2653437A64DBEA950BF6A8CA8836407FB489D42A6F6257770310F28715BC6411C81486CEF3CB9AB500558F070F4A15817F8C177D63CAFB176CAF3B2B1CB7B7254C18FE15111FCAB9E9A9682F41C9FD247EC532CCEF514860A3FED330255323DAFE46EED198041D732538C9424D43FE2F5481650470F08906791B2BFE65A445BB26AC87D9BD04AA648A54DC13A137B60E5C2779FE4B5A866620DC2829D42384AEA9AB1552FCA920F8929B7BAA059DEA53E6A5B3E492A6E45B5AE11F6AD24D035D4246A0CD53436687A0204A1DE29AAD2C8B53AD4B938A57C2E29555219544FF64115CBA2668B54C6EA8779146980B58A2E669124A81ED4420C87B0601DE23E3CCBA915FAAD0C2B47EF6238DBA9449274C64CCCCD85E91712470E8F9A2866720059A8501C7762C0883CF9827BFD62BDC0882EE03B457BE2B2794B8BECF74EC0DA4684282200A294C13C8A9FF376C1187911121BDD886F27514846F740B72AAD5544CBD97A7E208635480ACDDF404FC067C82A45B5C97829F06ABCA5201429E9A516F66E65D07075CBC0C60C2A9734BAADD68F421617FBF9515B569FD08BF3AEF948095DE1AFE74BBC3BDBB45FD8F92EDDBF0C682C81A98F930F6165
-sk = A5C7981510819EA27D27A945A0F6619D730DD196B6F3A158A4C48ACFB82D1C348540160B0CC665C43C4C0E4567B46867CED06D2CF228D0B64706227593DB7392395B7EA95360105C1BB05472787430654AA03B6E894C2ADD2A0467EA51B9486F3DF18274C0A2079459DF3B9AEAB15D203B466EA426911572251B0C8FB51A31AA142BDC4142E393D3C527C841A03F796E0CF7CC71DACB47456FDD386527BCCF6E43013EEB755924A22E3A55F74A8974B38E06908349FB3DA5887D1A041C8ACC6F07A75198462353942267D7600D5243095BB012D2A70BE0A3FB2BB599832F8AA68652846BA501BAB3AA574AD08BC991C8B86717B87A45041657D0264F35F0C2B70324EAC43D591202CFDB9A7D357489F70F86D6308D3382CF9139106CB28D947AE3BC389EF18B728C1568436B3EF80644009A80F01EF550C794011E44F2812EF507BD55820A872B90E797626B8EF2D94012B4CF639BC5C8A7B87306753F93CB12E46A66C4B2053C037B87C51436CC83B884F7634A6950C419684AF3B78D41006467105F753194144539DF45AC7FA46E71815F53D2304B474A434B02517B083B058AED078DCF86746313BD8108148EA34658613560CA722A126DDA147AF8C5733705BC8343331BACC5B5B80E424CCF6114955056329A68A2A6403D65197C21DA02A390C41EF713A814A798A434145B9E3A5C31A9614CDAC8A8BCAB6B5274490F5C45B2A307F492C28FF40EE39C2068A5826E8466542559E9409FF11B463E9A4EBA0A2172EC8EA6332D3A5BB66531B670C52CC2F8B651B513E60A9E64795369E0C2CF56A9921669299B6B5399537E112AC358112810ABC6945BDE69AADA92552A10219A630E26E4AC7D9B5C7469A960AC64A6D127971296C53A15DF4C847D061E69CC030B9CABC6E58903C5ADC88882CAC147F2888263ECB6AE97A9B2AA245F131E2E2939F5C8BB8FFC012CB578B9BABF90DB062502B1923CA88B35C424FC6524128FD1D7B5CA719F5A9A538A51A97ABABCE07B006EB701AD8490B74462F93648FC39A2004DB6E951B4C8219CE49395891594353B92B6B496D09376FB28711D87221851A5FDAB80CC52A6352C062F06C80F891DA2A07573B42BF0F6CD5D6B63FD4B1C5BF2572FC8460385A642E6290FB79A9B1CB18CBCB34BD87F7EB595F0598C67709D72011FBDD07A0EB6616A88B8E33571BFA7597BE4CBD6976B93E32C2C088DE3AB59DCF2234E553A5B2AB143C46DF13211E816AED6D02BF6C13FA7F8B282237F249AAEDBD3A6FE8771014C1B811C05FE86102C0B0E7E9B961C1000C82408D8A8AA381552920803418C49E1662C7ED8C3D35763C510585A78664EA0012A8A02F34B2BD7E96EE5C298DC296537C985577CAC3E310568353EC2CA8EEAB4BB1EE2393D5B3CDD25305B148FD8AB11F60B5871E9C9359A46A5DA003E98B61D82C51CD9262764301C86268DB87FA6273F9FA3C35B1C1FD822AAF2F74EDF73AB5AF9175070BDD7D5CC7600A516726C3E49348D138D19836391A54954AC4A0C029B1441C37965422019C2CA49CFCA81317A211E22EA2297B865DA163A0AE2A9DC25701E71847A05754CB733620A824F090D591C51C345420E226B8F3B846FD356E78B87764B51D1DABF923518DE898C5E7CB5E0066FD69522F5889DC05C41A472C983583333132052A1C93A464120B325764B8665CA42555B98D8D6A93C88A0A383AB51280F52873F2BE26E12C131677027C616711D478342CB424B0463C88161ED84BF6E869ABE9CB915D13534D2756DD72343359E9911624DC7C6E828B19D6CB178C43A5CEB9360D2939DF2744ACCB4DFE8AA5ECA35BF87C6BA265FB4AB7C4888516EC91E52C4030F5453E6BC9103B9C19CD83E69048272855B11B8AF3EDC09B04AB31179BEE59ABC76726FBE9612D271B7010844F62535F2F30D8417C35F17C1619B055FAB6A0F5458568C753310299FCB335A7697E7CBC9B9EB1B14AC2D0DDB765B266B6D68BDB5B0236895328540B20F91BBD2910625E674B33A4F8B6C1B4F66C4130C2E973AB72D809282CA63EDAB71268C02A9D020BFC805410AAE2DD4B699448A56049D1E9A58C5FC2ABE159DEC69C5027099A3B57D3A2560CE24A6F5017D32E00F3078B792309384421878CCA555B7065D57537C804E10BAC052788769B7C1121A78911A153FB56A365A2F97B070D7B61724D0C4D14C295D78BE57A8AADB873D3AF6B74D020B8654CF48543DE8CA22371A48DED585B7073ECEE0C44EEC27C85B5A68F6B454B0CB10692039CC68EC2C2BF892804520C71BE5B7BADB807B4059A3D87D32548BA3E4B698CA150D784A8C2C35A67A8C92C68AC0037888B65A4C9800BA7A1EC050627AF648FB61C87CC55B8243545AA514CBC550A8804C8598CD35786EB8C6B06077A1E2D4344E4A6BAA789C305B6326E0BBD4402DBE26CEC08A7C1A19457BC2677F15B984A74FBC52CDCE48618D50C47400011B392908AC2CF08A579783A80FB2990CEA90EEE90B7DD81E6CC9C961372D8C720D7EB223D5A6A16D4571C1A93213B32289934F7B30A63527C6399920086940B7696503E623E63A050F4B69810B6E6F6729E5782B572221F596A09A1879BBB46A62A955043A30A2AA3E62E02CE1AB6F3D03693A8CB653E361D8783FFA37274AE06A3F2292F1A6557182006E493FF2653437A64DBEA950BF6A8CA8836407FB489D42A6F6257770310F28715BC6411C81486CEF3CB9AB500558F070F4A15817F8C177D63CAFB176CAF3B2B1CB7B7254C18FE15111FCAB9E9A9682F41C9FD247EC532CCEF514860A3FED330255323DAFE46EED198041D732538C9424D43FE2F5481650470F08906791B2BFE65A445BB26AC87D9BD04AA648A54DC13A137B60E5C2779FE4B5A866620DC2829D42384AEA9AB1552FCA920F8929B7BAA059DEA53E6A5B3E492A6E45B5AE11F6AD24D035D4246A0CD53436687A0204A1DE29AAD2C8B53AD4B938A57C2E29555219544FF64115CBA2668B54C6EA8779146980B58A2E669124A81ED4420C87B0601DE23E3CCBA915FAAD0C2B47EF6238DBA9449274C64CCCCD85E91712470E8F9A2866720059A8501C7762C0883CF9827BFD62BDC0882EE03B457BE2B2794B8BECF74EC0DA4684282200A294C13C8A9FF376C1187911121BDD886F27514846F740B72AAD5544CBD97A7E208635480ACDDF404FC067C82A45B5C97829F06ABCA5201429E9A516F66E65D07075CBC0C60C2A9734BAADD68F421617FBF9515B569FD08BF3AEF948095DE1AFE74BBC3BDBB45FD8F92EDDBF0C682C81A98F930F616553B9D62E64F9069D9FB94EA2C0806459B201531F4FDDD708D162981CC1FB3757DA1804DDB5AA9B1C6A47A98F8505A49BAE2AFFDE5FE75E69E828E546A6771004
-ct = 106849C5DA689EF3A848336B4AB6542F621C0B9B5E8C5AC0B06D3BDD7336EFFB87DAF2DB0ABA609ACB904FB291FFF9B6CA74BCFDBF7C563B16C0553E608E8D094B8C195BCD2B2D58FE731D4A4660F4743DFF2A16267490F7F00AF42946D0981C7AC0394AC78A44EA1D4CE07751E064A27D8B223ED37A2AE3B74E831CD66855545AB08B7D28473A031A33BD606F0DEABBB62A06812CA11D9D1C33A70C5D214F42BA16C5CCF7D0E9F2B23C76F4E9ECD8D9D80CA64BD04E473A308539570D5959937D0B7670D8554D82AC97E8A0AE8497FFAE014DDBB6A138B37C08B75E8110F2F9BD372153CDAAF3379E88070C16F177D96CB115E14863C098AB2B3B207FECB96122ACDBD207FCEFDEF90AB813AC6D5E1362903875D5B6DA35276069C5C0D3BF1F0261AEF6719EE0861B3E2C5938DDE47860352D02E354C363CAC9D0CD944BAC7C61000BA976B20516998672EBA11E68785C8B8603C1BECDACC1DB883430DEB8501638959D489D8F51BA28BD299BCD46E9188031A906C06D0F54873A8D065900822372D46C9365CE129173201FF301AA423EA13D35896D8CE6491B7BE61190A803F9C53847C22205D011504E1B4C4E98EA395DAC99193B9F44273EC4E0F4CD6468371CABC76708831DE5201ACDE1C5A3A10F51BF5F986E038F26471A1FDC7803762EE240994CFA3C2E9A5C12C4954FEEDDBF49EA264645BAD8BEBC1FF536B02BB4207F2FD1B2E70B3FBB6C23CBDA0DEDACBB1F090E5CDD5210B650990E862F0A6AB2625871FF91650D09D7EA4DA7DBF6CB166AEED23AEE7ADF2379267C708FC5D22BD2C12F22B3B944E04A79C10FFF474A982B6CBF699DECE2104DEC8EA7F6B4D9E486CBD748CD9CE83E76F3F05111753F021D1629D62CD16B0FC4A39128B8B398179F1B33D94017DBDCEA084A9508AABEAE589E6365D48111E849D1656560D13844FC4AD7A2D0157E706B0BDEA00D60240DF2C5D70C223162241EEA92CCA23969CBFB3BE7BA4FD278D831EDD8DC941F74D21E7B296456303D82D4B3E6E5058220804158E23EACA8068354676B94577505D6414A27DE9FA178AE851346FE3254A5F9490917ADB080F332C2F9169D313DAAB26C034502E311685CD57EB66277685EC7AD6C5D53A02909128A348E097F5E0F7B75A7622B88818F8971C0840FA7592D245E32ED9B4A958370EAA14010A0BD92D28220E0F9CD7EFB0C0A296C46DEA9819C6AD0861164C39E7BF6F1B7AFB0DF2D290E233A30B1D6C27B74D2A4F4DD6B3953ADA3A7C0E4E3A4F4F07DDF2DB4F7460204761F717FD5C69F156C15E8206E93CEB426FE89FDEB4282BFE746F50D0B4BF9E5950CE8F03ABAB8B211BC619F580678EBBF9AEB439578BD3F9ABCB44F2C53B7B84495C876B2E1911F9F1ABFAD34122B8B7B660F5D2E84DE2AC504A59AF5E0C722A9265B83B8440B73B9CD130576F3EAE5525F757E23396A755619349E5B168EF891BD742367FF2EE5C5628245E7FC0D0D03FADCF651B4AA7C33C69C3E1F580DECDFE50263200D5085E0D8F19C2AB6
-ss = 25C35F5858D03291C0132C970E6E072D8A7B33419B984B391A12891F878D981F
-
-count = 9
-generateEntropy = d322d56d8ef067ba1f24c92492b9c56df3a6ef54a304adc1b69913766a1ce69756047447b810cc094d400ab204cf9ae71e3afa68b88586ecb6498c68ac0e51b9
-encapEntropyPreHash = 511c2ab40782322c06111e144e505328c4e5bfc890a5980a2bbc44aeda4c738b
-pk = 5A1278BF11B37FBAB1DB212359473012F3B545301DDC833C69A75AFE16744557B5E28BC0EE895DA16C2C5DD34FE6783949D555E580C1BE7994BB008DAF27A47F554932B87222E82EC670490CA5139FF49D5ED896218825056A8639B31D3AC8550356A408A01404C6AA9C2B7284E7C7C27036256B7902445DDE00630D81930F4CCC518B9EFD8AB24FC16A365B8068C90F7E09BBD23C2A6AB12792D245551A9894F704042501C8FC49EEAA0132701E29A3C97834530A7C61F1B8440822CD1BB6B11DCA2A5951B4DEB0B1268C2F5AA8CF76A6BD0BE3013A37CA1A903AC634405ECB3714BC54610BAA63BACF0A263D8CB018B03B0A286083998A7E8B2A573E570179712130A19F9EBC2337D43926F9C96460996CC03199D81A0E19259DA696FECCA7906931A787A5C264826099A3E03339295B587E7A4EFEC6A11AAAAB057AA8689473F1F211C6D85499C46746BB00BA687A17877E6650C678D13861337FAAA7045A16B8EB7173E7C08B6394B5F2B99EA3083BA175C55D350FD61B73AA790CA6F479FD4B01282B6BAEFA00A1946F6DFB855CE7BD50389D42856823301E01A228AC754CB65A0E323A0943B75741CB498CC499C8649B6BF87E991507194983AAD1B57994B7D79BBCF2EB3B5F8734CCF3CEA2662E95D486989144AEA22C94C363571AC7DCD81F577645CF19B313F849B422AFED963CDB701395020C2D18601A40A42429896AA9B0B1C10C4876928AEAC59862414E143722A0B94746ABD157343D15BB9FE500763B18C61B184407449B1B5BA8FB1554E4BB58AB99FAAAC9CDC3B698E64179B089B786204BF95EDA86474EE799440478348989C91C3462446724340CD2376C682907EDB58C85A4CE3EF46CC5D0CA345590AB14844B224735DC05E0E66EDE94258F395FE867AB9D8C1B0FA80743002A15DA197614295DC358F40758C9CC05E45BBC659B93ED611AA58845D94ACC7AA75DEBA56D4D83C640C252975BC3165254C92957B78C9583B370AD785F2C16CD5CB9913839939C7293E6B956E23CC5D14CB3AB2A2E94F179BB076355157920085236F60B84449D43AC89C2B46DAFA6B784438F3510BFC48357A5681043BA7428583BB5E912B08786562579DF58A41BDB82114344B3EA3574B997F8564248210D4E50AB2277100B9A5423178B1F138E9D427762253CFFC3CD095CB53A776F4FE015B5168B1A9759AC4ACC77F90C69B307192B7B866753872A69813B1BCAAB5CBB8126D8998E78D99F5A527992B89495A28E3FA83E75337CA2B896172AC244AB7E30761C8E3A00890046E5F599EEAB65BF1A4CDEB5791CC10ADE7197FB5BC754233F3B10C9BA2240ADFC61C05231C36A6CF71AA752AB3C95C3756EF9373B677105D11F86E68036348BDD181F27407E344BCD297CB02BC44F077976ED588D6A846C2F839BC9BC4872617BDC17A7BAA97AF9A9322FF015956678E8D622CFB1A11ED929F29BB1F094C17F49417C09C1C443369123CAF8701199C43BFF97034EFC6999424144C9395D9063BB153C0ED82B1C5659BFB23D4CD2C758A26B6C448525060F686BB14873CBF5046B3A3033C5C8081027BF5E3C51F6FB6A1D54A77C46B0EA4299A9DA4AB03B95F9D3601F553D46800F661E2C9A7E548CA42E385CC6A0678F9E9D268FFCE02C4B465A46773432109A75
-sk = B04C33B257B199352A85B55624F1A1A42B2AB72C4810B839B2BB2F51A502CD498AA258373EB3BD43E03973D129E4FCB61DF58986809EC4EA4333659F03DC0FAB236CD4E815D3F9524E90A28A3A0AF869735B362FED9837855429700CB815C43A6E650E54D6267A832DC0385696274E1E73A12B5960A8409A4B4564DE909B797771B4839782526FD69ABF516A73F9EB8130F41CD6103A6E67C6724186D1C709D3D90141B1BC1C028E28324DE4846BCC6837FC243C54DBA144C40FCC6223FD19B8F54C11BC0982FFD366530ABAD387946E1495A3C05D9CFBB62B28778905AB7D576610A74B3DAAC9767A051B153AF7C6BF0177A4074397BE410411CB33DDCB895091990DFB85AEE15E9F288D01EC5628034A4ADB01DA09283493BAFFD36D224B1EFE096289A2AFD427B82F8B04EA44319F4A16BB07BD21026F2EF550B919AD01CB3744B37103EB54E62400E03367001510776698E28B4FC367A77F1B4690CC2916E8CCF1FA55AA3495014724F1E66EF7CA8283D917B501C931274D9808A8103004176BB69783C094BBBBECD5B90EA14E7CDB9768498B22332283F6A079991988AC6A85BB591EF299BC57027B0CA9932A41C14C193467374F133BB8539C2D5164EF11B70B4A2CFCDACDF6841CD835C4F4E174BE3C26B55770ACF4137666A431D669FD5775A71749922C0B223ABE36284FC880C3AA2A41F45A4A299C647D6738585287F7A47B88EA1C6C088C6207646D99CEF5F56A2E02CD3EA85202C7725DFC99D04B2D52600F0F89366A3A83F8DC74E4A27FC58A622061A6332403AE8CBD0179149B841F5E0BA193EC237AC57A4CD5528C10545CB75E35A20C3CE63950C09A7B0810B84124F3A00C9EBB67BDA9B2AB42113E631123B4A85897160637A32EB856D55C2905F7C655D40C84E92E773056D2392D43E33C4F9256DBFC7AA0683802D04D218139F829AE362C1F48096FE47B09756C36873CADC5300CEA8094E6F8925C1B81ADE69FEE5420B7E94555286CDB596E08CAA81F758022B3A949059AE91AA9B78A825703CD53D1235800681DBC7657A777BC267637CA2954C09344110A05E2BB90A83F95990986FB559BB1282778933631701393B705A5C122EC3645C1B364367C83444D30FA438EB3A478A0BAE14270CD49556399085C566D9E6C467DCA66A3F36370693AD5F86A9932773AE5064E9BC73FF7979A5510C88198BEEA7EE2AA494EB046E4D70A3F9CA0F88B234F6918F7EB41DB97A327654836510276E0154E7A4DFA088B8ACC5F02F598D1494BFBD07C3132C5EF6C3B466606B3D93DA2E69C96744095435FCACC2D24C3016002B5C4B988877CCDB9233C490A8B121BA7821B529DE85E638168B0565D50F735D1CB54CBA91CFC1B9EFF882A643121E877C43B6147A2A8266196346859CE53340208253CA419276B884DBB3B7A30AC3DE983C75AD73995A0B62DE7563EC9A4A715BCDF376DFB6433DE691C54E660F4AAA4B184015026B6189415E66C90DD32C0B015AEE63B5D8B3CB9EA206E45AB4938BC86FC54C7598C6553C29AC34B2213B90AFD144C8B4629A560382778B28D666667CAAAD49633A8F985730318EB033374B5CBEBACC7F453CCD8E77C5A9ABC12DA1BC1733E5A1278BF11B37FBAB1DB212359473012F3B545301DDC833C69A75AFE16744557B5E28BC0EE895DA16C2C5DD34FE6783949D555E580C1BE7994BB008DAF27A47F554932B87222E82EC670490CA5139FF49D5ED896218825056A8639B31D3AC8550356A408A01404C6AA9C2B7284E7C7C27036256B7902445DDE00630D81930F4CCC518B9EFD8AB24FC16A365B8068C90F7E09BBD23C2A6AB12792D245551A9894F704042501C8FC49EEAA0132701E29A3C97834530A7C61F1B8440822CD1BB6B11DCA2A5951B4DEB0B1268C2F5AA8CF76A6BD0BE3013A37CA1A903AC634405ECB3714BC54610BAA63BACF0A263D8CB018B03B0A286083998A7E8B2A573E570179712130A19F9EBC2337D43926F9C96460996CC03199D81A0E19259DA696FECCA7906931A787A5C264826099A3E03339295B587E7A4EFEC6A11AAAAB057AA8689473F1F211C6D85499C46746BB00BA687A17877E6650C678D13861337FAAA7045A16B8EB7173E7C08B6394B5F2B99EA3083BA175C55D350FD61B73AA790CA6F479FD4B01282B6BAEFA00A1946F6DFB855CE7BD50389D42856823301E01A228AC754CB65A0E323A0943B75741CB498CC499C8649B6BF87E991507194983AAD1B57994B7D79BBCF2EB3B5F8734CCF3CEA2662E95D486989144AEA22C94C363571AC7DCD81F577645CF19B313F849B422AFED963CDB701395020C2D18601A40A42429896AA9B0B1C10C4876928AEAC59862414E143722A0B94746ABD157343D15BB9FE500763B18C61B184407449B1B5BA8FB1554E4BB58AB99FAAAC9CDC3B698E64179B089B786204BF95EDA86474EE799440478348989C91C3462446724340CD2376C682907EDB58C85A4CE3EF46CC5D0CA345590AB14844B224735DC05E0E66EDE94258F395FE867AB9D8C1B0FA80743002A15DA197614295DC358F40758C9CC05E45BBC659B93ED611AA58845D94ACC7AA75DEBA56D4D83C640C252975BC3165254C92957B78C9583B370AD785F2C16CD5CB9913839939C7293E6B956E23CC5D14CB3AB2A2E94F179BB076355157920085236F60B84449D43AC89C2B46DAFA6B784438F3510BFC48357A5681043BA7428583BB5E912B08786562579DF58A41BDB82114344B3EA3574B997F8564248210D4E50AB2277100B9A5423178B1F138E9D427762253CFFC3CD095CB53A776F4FE015B5168B1A9759AC4ACC77F90C69B307192B7B866753872A69813B1BCAAB5CBB8126D8998E78D99F5A527992B89495A28E3FA83E75337CA2B896172AC244AB7E30761C8E3A00890046E5F599EEAB65BF1A4CDEB5791CC10ADE7197FB5BC754233F3B10C9BA2240ADFC61C05231C36A6CF71AA752AB3C95C3756EF9373B677105D11F86E68036348BDD181F27407E344BCD297CB02BC44F077976ED588D6A846C2F839BC9BC4872617BDC17A7BAA97AF9A9322FF015956678E8D622CFB1A11ED929F29BB1F094C17F49417C09C1C443369123CAF8701199C43BFF97034EFC6999424144C9395D9063BB153C0ED82B1C5659BFB23D4CD2C758A26B6C448525060F686BB14873CBF5046B3A3033C5C8081027BF5E3C51F6FB6A1D54A77C46B0EA4299A9DA4AB03B95F9D3601F553D46800F661E2C9A7E548CA42E385CC6A0678F9E9D268FFCE02C4B465A46773432109A759CFECA12DFE978BF0B7AD7271487CF61B2B8F7C60F389F33FC18439A95BCBB6356047447B810CC094D400AB204CF9AE71E3AFA68B88586ECB6498C68AC0E51B9
-ct = FCA7E41C5BB5460CE12E4A40CFB3E7E7DBF18E2D9D386396586475AF17A830D3A738237C05105735E9B4DCA87D114F017B50484BD0381873A5F4DA24C420B6D56EFEC00891BABC52AB22554B68A0E3D3AADFED71D3BFD75FEDBF946C55EC3FE0C050C623636FD486192DDE50EBAA7D12DD8B80418FDD64A5F7979CD660090C05893E3CE334B1F489149012C00F8868BE07AA3FF50B2C255F43040DB1F603C00C5B3C5DD56DECED7B510B96B9A1B31CDEB0E5A73CBABFA0742631D816CFC2A701EA64DCC435578512073E3BC1C78D5EFC68772A971AACDC89448B1E0BCD2B558CF709A513866CD0609A4C314BECA92E894630822C324FC3AB177DFF0EC1C89C92C49292AC28859FEADEC5BF5BDF3FC8C806F2145D0E9B3E9981C40AAEDE9ECA94747EB32DA509D089FED91578E6F7B012F91521974D722416C5EE640DC2F8E46FF56077E1370270839FC131D89C22BCC4107A1CB65E6714A9503F46988EC651E222970372B462314183D54ED825ADDA32C1B807DAB5EEFA2CBF1F910E4B2532377DA539280C9808504EEC2D43F6A24623374D4A9DD50A1F3DD250BE40B20B23CD84B7F1EE317D7D937185528EE1ED4482DCD6F93CDEE40E2469853FECAD614627CA7410E690B3BD2F0736A5C5FE53B14C3DAA2A12B2790D41FBA12E39FA647823831979042878A70313B4CAF8AC0C4FF9005BBA914B636EA375D3259D21F8ACE9D3D5D963ED085FBA924EAADB6EDEC0488CA9E9A629FC3D46D987B8CBC473E8C1EA5B85E00F03AF99F8451DBBB5B8EC72AA7D91F8F6C9B4FA03965D04D2FC652F5F76991D95463EF0D79D5238ACE1A1D6A3452ED8E6A2B482F8B0AB3C9FAB41929B104B18E23F5F49616B704EE79E8B893C998A88D88BBB3A22305EFE28A9BC526D2A8DC6B4D820130F2288469D9D8DFF20673492C6C5F3AE967BFC74162DE3502BFDF498F038F34309FF4FDBFE5DF00B0E568F49562051E24FB2ACF1489615B00DAD14627F04E2BD5B63020A77B0901336A905F8BF20BA788898C4E6754E2788D80BD4B8CE013A3173B5E7EF84F63116833631FE8AC3AF8A0B47BA535C9A88F522AEE02FA077EB056D3AD2DC2A70B22E81A8A4CDB2DC27D3DC92F28024EDAAAF133BCBF691D7F5F28C48207302FD0CB11CF8C8A7EB862243A045D3AFC6FA9E64443A1E598FB6AB325DCD4CB7CDD6E24D0B970DC6667FCD9D448B30DD33BFF1924880C4C42A59F035E9C619EB00E3E0761F994ECA9EA469479CBFB6E1F18447AE8A6C0639774B428E642BB39ABCA7A6F1624A68A810F6482C1B6634EE4A6FFFACB99E28029340EF8AE8C2B456F5D73F79DD704645FBFAAA61897047F5C3297837BABFC16970B88BC1B73E33F17B3D3E8BC7980FD98CF7CE13C3944C8F0B4049E9C281709F990B45EE22628ED9DB89ACB02E01A058E6038F1417F83A4B295238123775D87141E2A5DAA476318015EA84445FDE78A40376486F4DE25B7925B0BD3A163D8785D7C50FBDD9C5038B9A6006ADF424426567AE19AD69F09C6825923BE7
-ss = F9EB1C87813C712CC3054109ACB5F219FC1E29DB10FF33D093A5CD67DF995015
-
-count = 10
-generateEntropy = 2f1d8a3bebb34540324b9485fdf3d5be3b858f544abc3fc641b5728cafab03ba8d6c42e7270ee2b77b6045385f3d175984a0e260363166c73b0c70c971644363
-encapEntropyPreHash = dca92dbec9b260dd97e8886f876862d6effc3b91fcf3fbc986cf56ab93ae79a2
-pk = C4A90087866B29244C3641310E94B8311A1303465975649288713E79CA67A9085C8F7449C0BB9A6AB196245B0DA028CC1765A8BA0501D5E360CB3064E11554F3FC2914F1260509073B67B4A0570D7F708CA7C435EA987762F2A5A23CAE53907FC9DB26942136D72202D0A0BB10B65D422091ABAA1C21D152DAD59C25D20C016237634741DEF8CA26B9CCE3097FFD896F1BF08300282FCB7000C7E1956673223902AE5B43BC63B6806C469A4EBB8BD34B057B375E725B07EE856FCC0453379B96F89888D21A7BD5EC91F837B90A2C334A97AD70D87BDCC12892D588D06655F6103E033547CF5933EC237B21B2956E5921CF10A0C55A70E4A24A57B93F6FCAAB2A44BB079987EBA57223B4B9DEB60EC6464FAA4058283B8CBA6956C792AE8FF9184E93C2E2152823C15412C102518462C2691DB1C64412EB1EC6D75D47C82FC5A9214670B3297067E30C6D9CE0CF3EB314CC1A4CF35342AE419513EC2BD47182C4EA52626A56F7831DBDC5719F532A5A421A7BD5A115C2195D0532E7C1C0FFE40166404137A5B45D7B2CD31752E1646588021508293FB881123F61034318700EEAC429500905179B283162ED0B69590541EBA0848DECC94BD18C888170A4C030A89305FE97A2B0292390A3B1FD6AA22909CF0134A2754728B6FB5180276B7D65C2FD530B4FF48CC7C7093DFC2B418B97762C42BB0980C7F41D9651C69387173A6718038010F50B79B233187BC3A0F7C770E50ABC62E8ACBE297C58C58055387BC7711473D81CA97B6A6E6504870C0DE1D806E3603ED0B04D01DC62529434014C5068C3AB3D4A909A079947127A8A2746CC8126F0212E21A0318EF273D5E0BE16253848413C5CEA22853C6E63B675CFAC1D6590004A2BB3BB4974E79ACA0DD927607A71D4B4C9980A86E5A2B5A84BCD2E694190491060411B332AA7E7766A4C693B00EB9D68F34E5B0564DE24377D3A6D45F72D82EC24FB268537C07B81AA79B5B28EF5A657E0F8B6B2F3A4279ABCF06CA2A79401312943D1D1086D91B1AD3030D0C0BB21806CB87B56ED391E6BC6AAD974034664B4902336D6E45A7449CB656207D59367F2B142746636E44726F111603B28670F47113D28CE6BB11F464B181CB3205FEBC13CC70D3FB35924A641A1117DF5CB65FD9A69C71BB800FC22A6BC47E52756C23533A3A494733B74D9689D64A849D048A2FFAA62B24BA53CC76CE8489D7515834AD3A2EA920E4F2275F4F7BB361866647C04C573BF47E6B54CD31810C7814AB5CD27DA1905FC5976286B781787D2DB606C036A2616AF7946935713CE2C7AC3FC4972ABAA2229C4C294E7A70F97BB6D119BE54553EEBAB1C80C8DA7459258E44A234357A1C9CC46412794116123D21DB27455063672245460EBC8B6B1116B34F2401169ACE16A514534154E798AE3155809B651CA963F854BA501407920765A14F826DCFA4BC4F21766B05BCEAC55E6854F1AD080D9B2538848A8DC7857F10C4C843C46B172ADECE3707E01C03059313BB96BB144996B127A16006DB4063CA1251F550836E167ADEA545B3A0C55C0AC5DE3FCAB6E8242C2C5C09313646117A95EF46536DC74D869301335A2F9040484FB0C9CB85A3D034D55B03C66725D000C47537E0D5AE249EB884B67DADB110119F1D0A5EA38CDF9F2E0E27C75A43A
-sk = A5019E7B82405CAC3C8F45BEC4E70E20590BD7E543D465BA702CB1447C0F114CC44F404A31B091C638347CF5A464106A2F92A0B4E600A3D86AB9F57EFFF088D1887865C695C3AA29BA08356DA1B4042146E8817F2BD56BC014071B896D5B2CBA9FA124CBA45E294A0F30FA01E4EB18262059CC987C64F9185AAA12D7EA1F2780308A91A3B2F171D9C41D166872BC7B070D44AF8556A356B631A6EB2E804CC09C531EECA476ADC8143EEBA767298BF29C19FB2496E0C573938BABCD749EE2D02E9817A3EE5A687F9324E7E1082892142C04AE9715C4A6980D73C6A54C16BEEA97A659DA476E49C1DD1B8292E04321783E0A66A36267673E92C2C7463668B1742987405C1621F94B87CE88AEBAEB7BFD787116B30A5B64A7E8956321463B351A9753A0389937B7AED431A5028D309CBED2D8AE67F859CE371CD1B3CB11A8A70D3B9B92E15530A260D1874118EC505FD451897712AE4104E67B1D2BB2676589AA4E8833E03B017AEB2666464C87BA809F2BA29106B49647666FC58C712B5B8127882DF3723E74A9B9E4B0E5A96BB325144111C75E96A13B5566E8258E36D34A76096F9B013236B3036BDA5E3D431AAD3CA33E9A0916D8CEDCD3466C75C1B5603A3E724C60A796E0844CC0D79686F086C510CA0CB11C2E936ECABA446560AAF0931C6A82298BDC7FA82AA6A0B32D361B3335CB83DDA38417720E9E745BB9CA008908CF6931AB2B4A7B78036704153359DC4FDB5742AB3C39A346005374CF3107B95CB771FF1C9592D59C810A93E3593169AB26DE85077DD79A3B3AA03C332A9D177D7EF88624C285A90099D1D0209A0BB0C425CE6AE9221613B2CD596AA77BA2BB98A385D2898D504D68117ED06233E69C43B541438B3274B579C1A5C27B0D85159836AA48907F768C97B6B2B19F475655022691182B2D9C80AEC12ECA0890C9E47BF764684FF1A94D1083D85905212431AFE09342004B44A090CD71357D2431C923B3CE08BC836B3EDB82AB2FA3C508867EAE87BF2768AD61D4894B123B6F861DB52B9B3EB77A8C99839E9108704C907E258F8D8001567078037AA1AB87B03A46AD3A0A30C753B8BD790923B7454F84C67AB6BBBCC105EDC36AB6AB67C28C1D3A54BD06F9C09C12CAC8483E015301DB6650CA3228ABB8353D2B3D95FA5D99E96BCAB65B37DC8A1E958F7395391BCBB4A944AA955BC2176AA6600A0D40489D0534423776184C85057AE00E9636BFBFA76C2D329625747968F53D1EB26CF4F95D6CCA45C60B2DA0F1899A7A1FC651C12BC2C3A2CA16D8ABA4E05C0CBCBB2B72C48EF55403462AB49CF6576D8C358A865DE1F795CC0629F4B13837B6B1704250B8E97F7A116FB63A0DBC12C955B49A67094CFEEB0E8C7B23ABE4BDABB787D3E45EAD108A96D3206A4977AA128866E596DFCA9D68996D82021A4380C0991561AE40A96BF490DD5538F0718098479A5763787939453A7A87A359643885BC5D6149EA048B5EF1ADC65C78E4A9C917160BDC625352596034B3558F98637B33061F769CBE341F9C764238318882CAA978996D1C321A92838D109C187011BF84D17FEFA0271EAC7D5EC90743130234E79089F5B9A6F0267813939B5A3B22321376FB1792D8BCC4A90087866B29244C3641310E94B8311A1303465975649288713E79CA67A9085C8F7449C0BB9A6AB196245B0DA028CC1765A8BA0501D5E360CB3064E11554F3FC2914F1260509073B67B4A0570D7F708CA7C435EA987762F2A5A23CAE53907FC9DB26942136D72202D0A0BB10B65D422091ABAA1C21D152DAD59C25D20C016237634741DEF8CA26B9CCE3097FFD896F1BF08300282FCB7000C7E1956673223902AE5B43BC63B6806C469A4EBB8BD34B057B375E725B07EE856FCC0453379B96F89888D21A7BD5EC91F837B90A2C334A97AD70D87BDCC12892D588D06655F6103E033547CF5933EC237B21B2956E5921CF10A0C55A70E4A24A57B93F6FCAAB2A44BB079987EBA57223B4B9DEB60EC6464FAA4058283B8CBA6956C792AE8FF9184E93C2E2152823C15412C102518462C2691DB1C64412EB1EC6D75D47C82FC5A9214670B3297067E30C6D9CE0CF3EB314CC1A4CF35342AE419513EC2BD47182C4EA52626A56F7831DBDC5719F532A5A421A7BD5A115C2195D0532E7C1C0FFE40166404137A5B45D7B2CD31752E1646588021508293FB881123F61034318700EEAC429500905179B283162ED0B69590541EBA0848DECC94BD18C888170A4C030A89305FE97A2B0292390A3B1FD6AA22909CF0134A2754728B6FB5180276B7D65C2FD530B4FF48CC7C7093DFC2B418B97762C42BB0980C7F41D9651C69387173A6718038010F50B79B233187BC3A0F7C770E50ABC62E8ACBE297C58C58055387BC7711473D81CA97B6A6E6504870C0DE1D806E3603ED0B04D01DC62529434014C5068C3AB3D4A909A079947127A8A2746CC8126F0212E21A0318EF273D5E0BE16253848413C5CEA22853C6E63B675CFAC1D6590004A2BB3BB4974E79ACA0DD927607A71D4B4C9980A86E5A2B5A84BCD2E694190491060411B332AA7E7766A4C693B00EB9D68F34E5B0564DE24377D3A6D45F72D82EC24FB268537C07B81AA79B5B28EF5A657E0F8B6B2F3A4279ABCF06CA2A79401312943D1D1086D91B1AD3030D0C0BB21806CB87B56ED391E6BC6AAD974034664B4902336D6E45A7449CB656207D59367F2B142746636E44726F111603B28670F47113D28CE6BB11F464B181CB3205FEBC13CC70D3FB35924A641A1117DF5CB65FD9A69C71BB800FC22A6BC47E52756C23533A3A494733B74D9689D64A849D048A2FFAA62B24BA53CC76CE8489D7515834AD3A2EA920E4F2275F4F7BB361866647C04C573BF47E6B54CD31810C7814AB5CD27DA1905FC5976286B781787D2DB606C036A2616AF7946935713CE2C7AC3FC4972ABAA2229C4C294E7A70F97BB6D119BE54553EEBAB1C80C8DA7459258E44A234357A1C9CC46412794116123D21DB27455063672245460EBC8B6B1116B34F2401169ACE16A514534154E798AE3155809B651CA963F854BA501407920765A14F826DCFA4BC4F21766B05BCEAC55E6854F1AD080D9B2538848A8DC7857F10C4C843C46B172ADECE3707E01C03059313BB96BB144996B127A16006DB4063CA1251F550836E167ADEA545B3A0C55C0AC5DE3FCAB6E8242C2C5C09313646117A95EF46536DC74D869301335A2F9040484FB0C9CB85A3D034D55B03C66725D000C47537E0D5AE249EB884B67DADB110119F1D0A5EA38CDF9F2E0E27C75A43A9AA64A30BED5AA8300772066EF577F79BF4813E3315A15F2C28B2665E4DC7E2F8D6C42E7270EE2B77B6045385F3D175984A0E260363166C73B0C70C971644363
-ct = 3639A304E4F743B4E62271BDA171EFD8912E067073B2F05FC8253F82733FC36C76FF5B6C5F17C40CB86F33D033BE899B7995251F678DED9E6CDF423FBA7C5E7014854818E08378459ED5723597AE428125C299356F6621D62F204AF4C3BB80A20B80772443CBCE224A0C0AB0FA5EE004CB11908619E40DBE2772C02E03A2A6D3C7F9A0BB5FB931A6C99F2342432CD7B13DAD5263AB489AD70500F6A855FF44D89C43073BF12F6A21D92C514B0BC4A5A839870E74D83C5B20DE67A88A01E959E587F74EEB2A9F53D05F5EF61022821B554D267A44395494453EBDD237223906F6253C3998F4271D3F1CF95DB10C8EBF18A0DAA2068CB945FA42CCEB8B0C335EB6E7991B57C153CFAF9AF85F243866E44470D32010DC7680826A9B7C85439A69571550C4AC82DECCA718C069BA2D99E832BE9A36EA810F02F82DB81DF7D449DAD5C157B0F10FD01F2BD589313F7CB3042E62912800DACA907D72D967E1DE39EF7258FAFF4EF6A8744B40F2ECEF0FFC151C78C215F98B106BD9577AEC1A3E323E705A202D4A855A0979EF439F8A27320E09F7347B316A24AADA46040B3B49426413565C0A7AA8B471F5FAAF88C9AF1375A7395B006F834D9EBE9EBF178B16A115C8346D31FEAA9E6B04719E9F35ECF7621AC1EBEAEF3EAC0EE7431CEC9E06D7A65CEBE7E6297113FF1D151F02C56C83E7DE1DF7FD00DDE7F91EDC126FBE07CB6CB888C1A2F8FAA35AFDEB10AF14A2F8A8B080891E8BEE23A5AFD86A4D749F97DCC6A3B98DBFC5DF4591A16927C33B9FE08AAEAE00979D178A1882FC1AF0E65D8B6F33DFFB235DD06BCF574D55A3074F8BA607A2178E34C76C72AFC1B8E1CB9F482F0162BDD550078655B0F95B3092B132164358A72A6A48C9550553FE9BC874980404955F481C6A614923B925931337F7E2502880A443CEC707B7238AC1ED70B4B94501EA74EA9BCD989B50B360B891D97FFC786A46E53EAAD2F5D714546A80FF90070F281C16A7BA543EF9A0CEFAD3217FBD2133CDC4F7AAEEC5AE444AAF015614D6625471790F714B68E881C0D6ADEF3A6D6E8FC9E273374FB2CC1C9D6D406B4812653DF1276171BF253AD4B80D7B5F8DE0B4BBEB50E2E2607A4CACE04698D7D0EDFE5AFB900C661A5020B7CB88DF34712FF4325D362435BB45D5A9D352BC13EB66BC599C4A07677103A1D7B40F0AE8393E42315BB62D6AC8CF953B8051516807451033B5404BCB12BE7ABFCC9F6CFB8C9ECCC4998CFED0653808463188AC22961BFDDF8F1AA97AA067DF0E9E9954F79547998759FD08542D0A71CBDD32E6EDEFB11331CAD655408CE2F5DEF7AED94B37E8A4B8B75946A677030C3903A4B201C1F3D2DFA65A06BAB8982A4DCE33418D0ED98E29A94E556F0B4C3AEDB44D887DE5BAA0374EF291C8552F0AECD7DC5BB3CFBE79FC92F0A73020489474C8279CD8044BEC179C7E5A1430965B9BF130314A35F9DE2DDBA517D28ADB3D253EFDE18BADABD6512D516C8147E91BACF3CD43CE5E244767ACDAAE8C2AC56A72E1F0089100
-ss = A2B1D4028AF3777BE109A51FAB5B7014681B0BE94A7C06E8C2100565667F21A7
-
-count = 11
-generateEntropy = 31beda3462627f601cbc56f3ddf4424e1529c04737ef0ef2af6d7401f653b8a1812083bfa3b670e3eaf9b443702fb6db16ac1197656bbd61a8e25ed523b8d1e5
-encapEntropyPreHash = 57c170e691d7a914a901b9a11c62b8b569b3806427557a9dbac9faa720ec3641
-pk = E9718A491B3262D206BE72A9CEB000E81B6BE6668D14A124BB49BE524ABB09B91942A60ED38B1974E36376A7724DDC7E5A993EA9C25F40B80C766CC57E807BD5932603403458B84703CA58F8E57C451227128654DF4537FCE6A57BD1BD6FD8C5BE1135B2C82CBFA4B96D577575406F92538034D22D6198A9CD000FC8DC8988F95608C1974C4359ADA14F7DD4870C63BF79886AB2D4CAD1C89A8FE232FC1C8C515B7D2AA9CC35759EF583244EA767916478F8415FDF7B1CF85A80F4D6960298B977A7ABF380709EF904C1706EE3F51ABF415028321E4FC79FB2E15454C47B3572BC09C62C0DC466EFAA759F116E8BA4717F91220F125656BA7C52338AB1FACB0FA6A75CE61F3135911D5714FCDA7A5A271205547018CC0607C5AA7104A4A77266C0525579F054ECC6C62522068E79352AE7A1C3265413459939764A4421CAA937C8F9B2B276A2C77CE7814FE9034783B8AEC29881E2563A63780CBABBCBE72501D68F1B72C6EF3C5D84A4BD7CF4A84686682FE36A151BCB3BB76CE5FA67AE545C9621BED149BE06AA2E72F72D1B24B086836B525915B93A49D90CB3C45877C54204A605CC27F1828DE6CA1E95056938A6C9651EB3B4A9B09C5AA9FC4401215D9EA9015A996F9A7B898CEA466CA14F0065A5B1F374D422B4A277A011F3B3E8143B053507BEE829E582528DCB3C9E950F39D17AD0A849C701779D070E34CC606C84A596650B7776A468659344446BC19186B43CBF042516A7B133065393C83B85313C53B71A5BC4421A91694BEEB39760806D3B910AA8EA546F53763B656C99EA50A179986DC3786A554B819317FB58564DD69428BB1D7BC45A642A8AB9CC013F932A67222D1FD42B455930B8147D6175C66330217246C400C4B619B922182101B2D8165F93BEE58757C14CBFC958552137B904009FCF845321841F8648B8F9E58D1572119B11CBCD59480246A46E255ADCC1649817A052736ED9C18A262C36F7C37918DB789AB177ED39ADD0850A509319888073B54BC3ED81000C780FC87AC5C302235A959B1164B491001B92811D4AA76876065E841B276A27B868822FD1DA7C3FD1831D88C9F5D891FF610CAF264FBC9280B8D4085251774EE20C23576ACE6215B3EB8C1610CA2405115E89421418A7610C05BB526FFA39918E9558C6CB2618A612B6D38BF8A2569B4C3AE902A4AC744ED4BCA8ED783C4EBA450470AEF5EC5370B87DAA419145298170D64CAAFC2EDA7C989645B9285A3FBD16C16E0C1E3FE085A6BC05248426EF106E7F6012E80882682660CD05CE49520785EA66325078F9A91E5FFC3BA0833DE333326FECBCD8878F286064CD1B672F210133E30D106C61AF9A75A7FC64FB5B1E1A1649FAB356C0F26B9062C5DCEAA7CEE502C750A93187A21C11B1B7FCAA45F8B857D38E18287B1E878C7EE59E07966F3619BEE70253D77065C02926BFD9B031260B5AF95846573AD09C42573C8338609FD3E5C0B50092B17A83128A4A9F1A6A232252884504846B3B7DF82981DBB036F6A57C5C19136789AF9690A978145EA6ADB74132EC55840965083F388877A93FC01B006FE4CDE4012A1814B327A12CCA8991CD18027F4485B4025B5583747FBB37916585261ABFEA163B617347ACAF453AE235166CDD8AFBFFDAAAB9919F0CFFDC75D8796FCC28
-sk = 7EC737EBF52EB7905DA8B3C58508928DD74462E8968A1265BB3B9780649210C8202E2950AC11863BD78AF3123AE9899CEFF1992608CF5BD1B4EB0AC1C13CCAAB4CA89A869424BC1AF777CFC7D90A071273F5AA5DF310493FAB17CE5B6477C773D8CC81D995509FF3A40CE80E734A9E8968B7FBE79A9900AB85F7B442077A890688DCBA0BD5E64AE491CE5D39B554E6B82B7602A149A686C19FCEE21B8E3B1792E7529F2307505C77ED84A63A68258E832BF0F118BC05C91A6B216EBCC051B90143B9748B365EC841B6098C4EECE8AA8231BC24B03E732A0EC55AA5B0E3231EFB7C7F0AB21E2544072C22B6B4075049B63FBA05C68A936989BAA2E55AD1846FD1E335568B01D4ACC869E710357708BDC25DB545447E41727224545CA8C16BCA5458EB24D746A12E170EF191CC8DD840E26910CD9484B4E40D0C7446959A521618B9BC472C8001AD0D1C8428C43C0FB3230FA9B17694284375A0E1563FDAEAB6CAD367C9949C4723802D6931F0C212B03004675652B958518D31C8D4B06DFD99820702319E668DFFB5C88622170B0C0EABA56EE7B77EF5D7600B9C0BBBEA5B99E05A9443BB81A68C22C7904A1755D4C80A47AC148ED13C3981C6BF4122A7880FDD597429A32D6046981146743AE85CC8C0CCB715937F29C933D63AB475C2C5483CE07ACC5B8BB4C7456398A9236D02BED9B951F6D43A67EA06F7FB803ACC33E9552E7150C34003A2E2E11BFC0BADFC537EB2B69122352FFB62B285B6CB0935ADFA0385DDA074F7A63ADB76BCF4A80AA83A1C32F87BE3A786537ACAA32178B136C8BF817AC1CB1E25B44654266F4B2B14F33358B9B75A2D916D78E89D3CEC68B782734FE052449598D847B2A02C3056A64E72C5A3B34685E9FB2C0037736E0A21DF39A356310777A36FCE908C243A4A50216B6199CD63C7BDB18B95FBE4615E9799757176FA4A88C93459BC3030E09889EDE148890CC221362472586E3C026B0DC10BA5A823F07ACC1C693E9BF31518B90359B7AAEC54473552835B3590174109337B6171EAC38DE29BDEF8095DA13A8F7014B3F531FC152CA5EB19859673D52067E28C7513141245376BAF368B07627FB1B844FC033361994FFB3B39822A2A2DE17597D16601329866F42C3697A6F5132DCEA2140B871480E50523C3C5227537A5089FB6742CBFCA55BA9C307A321ABE440241E34151B2C2AAB6AD55817B115330C0B15891FA35BF344BE7D93AD44BB27962101982902427242F5B06F85204E738AEC7A333A15001252004B21B5E6FA95A41A4456F74C9522657A9A40F8C4A162F4951CD5BB8A4F334F45A3A73266E1C386CAED53AB52B9A4DFA173B96869FBA6C72987F4B328A0E56A08C96A00D78854D6762EA2394C2A102162143CD40192749CFBC5031739711F1EA8C37DB5B635BCFE9B6396E2902D56BB135EB8975E1B0A171258D39A7AE84AABD46BAF4DC2A6FF18FB6002CE232B7A45A532DD54D3DA8C580D6CEA4209098930477D207622A7CDEDC2E72C24EAF5787D4B2B461889D23AB93A4BA327C371EFF58CFF7F65738886ABD046895834AA06A6CB57973F1011353FCC1452B015A324C406515E9290AFF4356FB393B57F4066077B2152819B6A69DE9718A491B3262D206BE72A9CEB000E81B6BE6668D14A124BB49BE524ABB09B91942A60ED38B1974E36376A7724DDC7E5A993EA9C25F40B80C766CC57E807BD5932603403458B84703CA58F8E57C451227128654DF4537FCE6A57BD1BD6FD8C5BE1135B2C82CBFA4B96D577575406F92538034D22D6198A9CD000FC8DC8988F95608C1974C4359ADA14F7DD4870C63BF79886AB2D4CAD1C89A8FE232FC1C8C515B7D2AA9CC35759EF583244EA767916478F8415FDF7B1CF85A80F4D6960298B977A7ABF380709EF904C1706EE3F51ABF415028321E4FC79FB2E15454C47B3572BC09C62C0DC466EFAA759F116E8BA4717F91220F125656BA7C52338AB1FACB0FA6A75CE61F3135911D5714FCDA7A5A271205547018CC0607C5AA7104A4A77266C0525579F054ECC6C62522068E79352AE7A1C3265413459939764A4421CAA937C8F9B2B276A2C77CE7814FE9034783B8AEC29881E2563A63780CBABBCBE72501D68F1B72C6EF3C5D84A4BD7CF4A84686682FE36A151BCB3BB76CE5FA67AE545C9621BED149BE06AA2E72F72D1B24B086836B525915B93A49D90CB3C45877C54204A605CC27F1828DE6CA1E95056938A6C9651EB3B4A9B09C5AA9FC4401215D9EA9015A996F9A7B898CEA466CA14F0065A5B1F374D422B4A277A011F3B3E8143B053507BEE829E582528DCB3C9E950F39D17AD0A849C701779D070E34CC606C84A596650B7776A468659344446BC19186B43CBF042516A7B133065393C83B85313C53B71A5BC4421A91694BEEB39760806D3B910AA8EA546F53763B656C99EA50A179986DC3786A554B819317FB58564DD69428BB1D7BC45A642A8AB9CC013F932A67222D1FD42B455930B8147D6175C66330217246C400C4B619B922182101B2D8165F93BEE58757C14CBFC958552137B904009FCF845321841F8648B8F9E58D1572119B11CBCD59480246A46E255ADCC1649817A052736ED9C18A262C36F7C37918DB789AB177ED39ADD0850A509319888073B54BC3ED81000C780FC87AC5C302235A959B1164B491001B92811D4AA76876065E841B276A27B868822FD1DA7C3FD1831D88C9F5D891FF610CAF264FBC9280B8D4085251774EE20C23576ACE6215B3EB8C1610CA2405115E89421418A7610C05BB526FFA39918E9558C6CB2618A612B6D38BF8A2569B4C3AE902A4AC744ED4BCA8ED783C4EBA450470AEF5EC5370B87DAA419145298170D64CAAFC2EDA7C989645B9285A3FBD16C16E0C1E3FE085A6BC05248426EF106E7F6012E80882682660CD05CE49520785EA66325078F9A91E5FFC3BA0833DE333326FECBCD8878F286064CD1B672F210133E30D106C61AF9A75A7FC64FB5B1E1A1649FAB356C0F26B9062C5DCEAA7CEE502C750A93187A21C11B1B7FCAA45F8B857D38E18287B1E878C7EE59E07966F3619BEE70253D77065C02926BFD9B031260B5AF95846573AD09C42573C8338609FD3E5C0B50092B17A83128A4A9F1A6A232252884504846B3B7DF82981DBB036F6A57C5C19136789AF9690A978145EA6ADB74132EC55840965083F388877A93FC01B006FE4CDE4012A1814B327A12CCA8991CD18027F4485B4025B5583747FBB37916585261ABFEA163B617347ACAF453AE235166CDD8AFBFFDAAAB9919F0CFFDC75D8796FCC28241E5C7B836862D7482D507973AE3FD8DAE96EEC4ECEBCEDB68FBDA75E04B401812083BFA3B670E3EAF9B443702FB6DB16AC1197656BBD61A8E25ED523B8D1E5
-ct = 6B0D9B262990276B654A5AA1A91DDB9EF72225CB2CF1FAE1108671F4F44BE627C6285ACEDA812207FAB12B6CA0A147C2B36D08818DDFD16AF799F9873EE7DAF236F33A607744147A944790B2917D381435B626003C8DF54967B99786D3B610E449DBE49840355A179E6273FF2B3164B50A0E818AEE095807855641772B2B158B5CDA1EB09BDCB98D3E124C0AB285E105E0573A5A6C7256D3455CF59227D0B421FDBB7399F851E910CAF0FF6D96A4BE8A74C7EEB54261DA68024237EB7E561386EB4EA13C56CCDBA633CAF6CAEADE2657A50EF4E0ECF611C18D2B46AF6E993F7279ACE11439D9C8EB857ED097C9D1208757CE7898CC980DE4635988F398758681307B42F64C86867F5F3177022BAC3C4D8EBDE5960BC9095591DAB21CE23D799FDA79C97095CBADDBC43E2324B8DEB736E43374EA884055E4741508554B309D946FF719006C99DEAFB7154BFCAD158A76D8858817BB0EDD928D9C56E972C8DD3D5E806DA47A0C855D23931D1412A5B801B42121EEF3522A8FCA12575703865DC2350CA616ECC39D1E9AFAF9A87D638F72E1861FC8386ECDA284AC0C220DA5E3BB55895F82186DFE69569EFAF2F4A7346348099704B11E5EDB304C42B78853F376A4C4DFAE3E32F1BEACF3D5C2F1744E02F819EB22927013407D82D9687F83757D3D944524E5957E6AB542C83840F5A2F9B31CD9678C7A589DAB33785F06A94C1B71E4AFD3460F85C2A7C6ED7F83CFC009BD88F1241981AD098D1521C0A09348B816E1458291E58314C10371CCDABF96EF994D2C6685A4C781D4CF8263865A18BA57711269449E509BF8460EC4C1CE7C9788816A31F8F91D3FAD6F27B4F351210FF5C41C11E5B0029E66BB655ED20E8011BD16AFAF2F02CE2BC5188B2A2C34AB074515CC85477FA4B541D4C61611A1DF6AE7D1782A311BEBAC32A28DF255263E308E2B659150ABF2DFB955F7A2D7FAD7EED45E18796D9BAEA414F9F66252A4A7CD833E54F1010585865A66FB23F8B781FBF1E1BEF7771C6E73DDE8A059A0ED5837B9DCB9B5A037A3D77F6DE09F3922C5F7C715B00E1ACB1DFC91C934AE04932888192875A126AF8DF70B21D64CB22D430F64FD4CB836C3B8967063E22C647435421C4D0601A3A6D54E7051C84CBC4BCC6455D19B4CE18E79813B33A562F3780A92AC9160A1CB7A22C79A7B8B67BA7824A914E713BE0C889DC6BB420101506FDA42B2448970A11B3C482CA873EFE65856B1DC7C8FA50A6412B8DA94235488DC67AF11B0C8E988FC844B7F0E6AEB685E4B63DC7C0C0184830410C486E6BC03F87129D99CB6464EA70B6C2B01D58EA3F18DA93B4933567A95472556152FEEADB88C9DE0D5A69D6FEF8EDDA08A34B39BFC5D5138A403E3E2D5E6A15A020E8E463B71F8D90A53FB36A91A825E43CBA2433BAE0F17569D3A83EE793EE99D44EBA560C7EB57341AFF091654DC3FD0E24461962CE9D50F1B8BEEE9BC4A23F232BEBEC8B61236D78309B16DD5B4690E8BC495EE43574398D01A62B0CD0F57CD4EE0B64ACAD4
-ss = 4A2BAC4D2A30597AA5B528D0E20B1630B20A36E8D747B5EC41EEB57950375A5D
-
-count = 12
-generateEntropy = cbdff028766d558af4466ef14043a1a9cf765f7748c63cc09dceb59ab39a4e4d8e9a30597e4b52ffa87a54b83c91d12a5e9c2cd90fcac2c11b3a348240411a4c
-encapEntropyPreHash = 6b5a14e1473abf5a33d44975ca2088bd8fa6fddcb3f80e8fd5c45b9d90c24a5c
-pk = 14345D52853184AAAB60195152259D9B643D864C4EC5FC4978C657C3365EA81212EB91339AAA4BFA87A197A04D46A7B666837F55DB6F16C095DB449E9BAA879AE14016EA4F8BA975DA26CFCF59401237ACCB908EFD17146E9439B1473BAFA07703F2932D5C598276B59B419402D681D87111F70C20D2710E10A407634AB216907D7363AF0BC4647DBA208F9C6744D71A8A1C1A99082A3BD8A843E4CE581412F04877EDB1709D1A9623C3C428EB111A1189073C9A3D34AD16AA1F1551A07E6880147360E60888DDD5B0956036951021AF4699C96382CC0C16B3F0B960135391C6692B0C556A5B9AD2F8A5ED0CB0BAEA2406868AC6F7A5A44B722721535E098FE832C9AF148AE027604C47CE4D3214A1BC974675289AC7BFB9A644DB30235A664417C57A8A46A86E18A10F81B87F4B4727F7234017088F447F28680B0600AD1DD672F0EA19E38A39FCF964CCCC64528C97FA474EF3AA6777676B3DB443D0A2042C744555049C48B2BC2577738A698BC58910F55B0EDE555B171838F6086CA365AED981AA5354561411990707BD3305CF4D10161FD3124156691DAA5CF3795653E2AEE1C4BA021B0EDD0809B14905E46C2CD0BB1E165C8AA428B180EA394E6C92BD6873E12328E5E1916C94C81393172DF3815127B937B9646A783524671FBD8B5F01395178C6A9FF42C47D8B25FB37A2D1DA975F69C7A8286504FAAA6AD5B05307C2D20B4F27640FE59B1EF407110A317CD72023828192B131CB9AF96899A69B0F51125B2828F29493A997A33023661BB7811C4593E4E579F8B17D0CBB6037D9273932AF4EB235F7D01DD398B70752A925968ADBF56CF132B85680ABFFB937C35425C244345E805BDB608CB0666984775AC1852690908CF2A60214F6A888004AA41A44831537E55A5DFAE7B2A4448FE6C562EA66764DFB5FA508B6738C4F52F10D4A852D38F5354981CDFB7A851A675C5A01C2FBE886192582D1F08AB37753BBD81BA6D848949731C99BA92278A2833CC11AC3BF603512BD6557F9684EB980C7588424DB0C1E2BB2BD09196A7DA29D79208DA50C4A0C839284A44D8861706E991EDD099E0B1467B88948C89778787C26DD4436FBC4BFD12B0ACC00AB4D85B613BBA4F928BBFCB04E2EAA51B81845C3A710BBC8458027A4F055061D0B39AD28482646AEBC5458D0E70D396C99A0B456837376110488F49A83F48372327467AB87870D11B3C1E6C112AB3D6D486A99BC2B9B368A0695C6C6251D6BEA5B56FCB96FC23475719B8CC82806875CAD772E4716332FFB02189438E27097E565159E4B1790558273CA887FCA2A6E7226C53879ADBBC07AC1072E6AAFDD2A1DD89677842041F33C447204A3FB91C1E4935111AC739CDC9FD6F2BA8C0C66DFF5552F3B2BDFDB19D4F65CB3B23777292CF97CC54BFBC41ED041E53318386173D229B9288C5D68E87D0CE2032D481C46B646EF71940D97AF370732533260C6AC943272866BB2BC90EC64424C67B1C877F5D2B35C39656957BBE40C53ED88C4124764B726A5E24ABA7B0C866A52385C85C241677F75487D4156C85DB639AD741E0412438BDBCEB6092FA14501FE1C5E95D90833332DEBC0441554A8CB5A8F7826B047882B415B78A0C2E966AC7C67B03EF5106F0A751017B67CC52A3D0E1586C74513D2B5F13260
-sk = D62C6CE5E7594BE682A8167743106A44482E3A79CE257635773513F0B0BF77A161C8274A705B93D2EAA899D8C0126AC8ADB7B3BBB5891711380DA1A9DE0541E4160DCCABC13A165B5C54178DA95B919457C684B9CEF81E97637C73F22A3CE9295DE79BEDD83C3FF871087B9412301863E291B04779457807ABE4687368C84B3408E26AA30BF58BBE4BBDED32ADB03607598714464222524B3C2CD4C15F98A2E6695463257BB8FA9A84131A64D45A57B9A539094B5E957496B79008878396D3B9B2EC41CCA75B66FA6D069A51AF611D4BC03E20CB12A216072D7834D996AE99E1CC6522A42B48C54282CD0AE8CFDD1B874FBB4EC17434AD584AF5B4561BC1597AAB63390B60FE7C052E57846E1A8C4F6C6758798B70503507554946382FA6E2004A616A40DBC2B0C596C2CB2873C38E6FF82FF159BA93563D23671DFC433949D3705F398B3752680169657623937A8C357864C39D82C16DA5C1EE407FC7FAB357C0B114965E89815409964CCDC54CD8D5B17039AA9283A59E746A45A2800E4806064683C292B425C18F73AA2F720A6521A050C5196BDABC9B094895B9527759C1A7210958E11A3411B05E67097FCE2C11ED024A85A22684B51EDD652DED89C23E1440CA5616BB754361C549776222B8B297F8F4BB7F818D3B29B16C369CC8BA9D91E6012BF006999C7057AA2A44C30237314079B2A55C63990C3AB657CB80D41022651097ED680D200195BE82A9B9D08B24F039BFFC42C66459B0C8889DDA6714B63762494A5E6106F34223990772B1CC12DC660F5BE62EB0A15C16D4A0303773D768C7DDA7B749711F7C12720C150D30EC6B625624E3F94861483BE03271D8B05780AB62E0294A8CB193238530B49455718C872428BEA1D84955F54A3BB619DADC6106EA3EF27094A085634624377312648AC46559D7A7DD902497AA9F22879D131A08B9223A05E5B76A00807225B304480F6105CBEC8A11CEA18E8910A9BBA691047C95676C9E2DC7AB76537691DBBEE397738C613E1FB00A79F06698C10EC26C97DC00B82A54AF572A02801AAC20983311F42BCA18699A2684E4B5AED83C7AD89A1705F1605A87CABEFAC499A56058D8B02BD597743524A90C3686D9405E33C3D70880B6449D41A76F83E23759664F1F301D3935998D690A7167AFA11A59CF8B87624283A738C0D221B1B55453504AB64FB89824351A49EBBCC291465AF92F50D7B53874C1190A766DAC5E70706F88097BE4500942534DF5E5887C48B234C11992F32BF3F2867CC055D7D6C3A4D25D2A141BE7D706BC1203814667552888E3BB13221A10DC3A4157D811A7CA23088BA5AA1A3FD60C0C6AF29B3B52AA6DA319D8E359D842C6DC65C29ECCC0523115D15B19A7B90D1090C5949CC66A004F0A0513132640A284A87384C7ED06782607584BF5CDD8F099ACB0229CC9588B024B0F3B5BA80B962218B3BCE4C0F542BAC9E8C235362E33EA30D789094FE82FBF64569907755ED7BFD00C3F6F446DEB00A27B37BB92E454AAAACB69DC854532C718C85508AC8742C7180EA805A78999111915BD414275E92D75C1953C10968C802E4AA6429ECA0A5EF49FB4046ED2C93914400B0D882B67C275C483037E859C8C015114345D52853184AAAB60195152259D9B643D864C4EC5FC4978C657C3365EA81212EB91339AAA4BFA87A197A04D46A7B666837F55DB6F16C095DB449E9BAA879AE14016EA4F8BA975DA26CFCF59401237ACCB908EFD17146E9439B1473BAFA07703F2932D5C598276B59B419402D681D87111F70C20D2710E10A407634AB216907D7363AF0BC4647DBA208F9C6744D71A8A1C1A99082A3BD8A843E4CE581412F04877EDB1709D1A9623C3C428EB111A1189073C9A3D34AD16AA1F1551A07E6880147360E60888DDD5B0956036951021AF4699C96382CC0C16B3F0B960135391C6692B0C556A5B9AD2F8A5ED0CB0BAEA2406868AC6F7A5A44B722721535E098FE832C9AF148AE027604C47CE4D3214A1BC974675289AC7BFB9A644DB30235A664417C57A8A46A86E18A10F81B87F4B4727F7234017088F447F28680B0600AD1DD672F0EA19E38A39FCF964CCCC64528C97FA474EF3AA6777676B3DB443D0A2042C744555049C48B2BC2577738A698BC58910F55B0EDE555B171838F6086CA365AED981AA5354561411990707BD3305CF4D10161FD3124156691DAA5CF3795653E2AEE1C4BA021B0EDD0809B14905E46C2CD0BB1E165C8AA428B180EA394E6C92BD6873E12328E5E1916C94C81393172DF3815127B937B9646A783524671FBD8B5F01395178C6A9FF42C47D8B25FB37A2D1DA975F69C7A8286504FAAA6AD5B05307C2D20B4F27640FE59B1EF407110A317CD72023828192B131CB9AF96899A69B0F51125B2828F29493A997A33023661BB7811C4593E4E579F8B17D0CBB6037D9273932AF4EB235F7D01DD398B70752A925968ADBF56CF132B85680ABFFB937C35425C244345E805BDB608CB0666984775AC1852690908CF2A60214F6A888004AA41A44831537E55A5DFAE7B2A4448FE6C562EA66764DFB5FA508B6738C4F52F10D4A852D38F5354981CDFB7A851A675C5A01C2FBE886192582D1F08AB37753BBD81BA6D848949731C99BA92278A2833CC11AC3BF603512BD6557F9684EB980C7588424DB0C1E2BB2BD09196A7DA29D79208DA50C4A0C839284A44D8861706E991EDD099E0B1467B88948C89778787C26DD4436FBC4BFD12B0ACC00AB4D85B613BBA4F928BBFCB04E2EAA51B81845C3A710BBC8458027A4F055061D0B39AD28482646AEBC5458D0E70D396C99A0B456837376110488F49A83F48372327467AB87870D11B3C1E6C112AB3D6D486A99BC2B9B368A0695C6C6251D6BEA5B56FCB96FC23475719B8CC82806875CAD772E4716332FFB02189438E27097E565159E4B1790558273CA887FCA2A6E7226C53879ADBBC07AC1072E6AAFDD2A1DD89677842041F33C447204A3FB91C1E4935111AC739CDC9FD6F2BA8C0C66DFF5552F3B2BDFDB19D4F65CB3B23777292CF97CC54BFBC41ED041E53318386173D229B9288C5D68E87D0CE2032D481C46B646EF71940D97AF370732533260C6AC943272866BB2BC90EC64424C67B1C877F5D2B35C39656957BBE40C53ED88C4124764B726A5E24ABA7B0C866A52385C85C241677F75487D4156C85DB639AD741E0412438BDBCEB6092FA14501FE1C5E95D90833332DEBC0441554A8CB5A8F7826B047882B415B78A0C2E966AC7C67B03EF5106F0A751017B67CC52A3D0E1586C74513D2B5F132606AD1D739F1598A16C608A240CD13DFAF8263D74866315E2898A3431CF19E46858E9A30597E4B52FFA87A54B83C91D12A5E9C2CD90FCAC2C11B3A348240411A4C
-ct = 3ACCE62A918EBD3D80860DD2AAA93B594682527418B4DB700CFFEE66A66C30C228F2566A4F717C8505DD17CB7CC71990AAA00BF04EEEB254154BA0D20025E02D0F476B445E3ECD9E90904695236BB7D6345AA360308AF8A9698A46FF10DABBFDD4537CD96EE0054FB3E7E53DC2D72DD642E079CFA964B8EE9A7E9806A5724C4D659D24AF5EE2669AB399AFC6DF41F1E8CEEEEC0F5910C83CC40A9287F0E44C22CA0CD3ACE7BA56DA39C29402331C3DCA0F6DF27EEC203225C5F2100944516BAC3AAF3470F793966CB9B4DE1A9581A6412CFAF5E058AC21FAB447B5045804AF6D75C27E24C48B4DFAA3B48EBF59B9AFF804BD24B98DA9D29556BC95362E207E662855D927015C92C69034CF0DF2FFB8FE3052713C74843D3BF90516D8627213E1D52167D13BC9C47387D57C8843AD16A102026E9AB2E430B70BD5EDDD8898A5E62E7D6CE8650B18805996118BB95CA0AC22A43FD92D3EEC07D5BEBFE80A7ED737921061ACBB42FC009C59A409EB3327C2931C642207145B826EECF2377374973219834C3E36E31F459793D644475E207AB0DB525649F05873E811988186DEE8A0E07AC3CEA66F3635F531988D9798F0503FDFBA624A350C299C1339435811620FD6B75EA11CFF36B300E6F2C79F5F0B10FC07E1E9E6A9ACAEF599F95DC8ED5C43E95617D407120C5F9A5A7DD2A804682B8214BC5C913A4984FB69DF0CAB7C0B3146592E43FB9869A526CE58148AAAA39E70A378CAB1648F982C0C668675E3522AD1C8647F3925F7DB726B1E50F352234E5CB67F9B55954831E819BDDF6628935A807A468E9724AA2917A2FF8E84D30DF3643275897BE01A2D9B2CD296B4289A4D84C2A5EC6AC1669EA42D9A19294CFD8AD9B9E4F76DF7879D564429BC55459421026CA3ECBA1CCFB04E41546DA705D6B27D193B86A695746FD2A8DE6D39B616B04C468469F69C23E1FE2BB7A554D70086DFE50F5B9F0A12114AF80D146BBC6A6E1E745905E05443F9177C36002C26FF322DEAA7D27074ADE6860B4EEA93755F00E35BBA8A721ED9CEC554A9ECE670C9D8EFE4B31DDD0565F2C18ECEA9326D3A5F8A1D7CC208247CE5F45A75E23FD5A4FE1CA5A20B661A48E2C6E29D847DDFA12EE226310D65D10E3F461998B4A7480F6F200181E6A003FA671010B87EBEF9FC8A2C14352102E1153816ED9B10B3E2F370EC7F8FEAE82282AF5FEC46A5D2B8697A59D1FC354F3854A1344DB6F6FA91C78844B3A414D3FF02BCD1333A88AFC9D55947237A743BAF81F0AFC37A10EAAC892EAECD15B1265A6B37AC075A778FE2466E1D3A7C1D9C1677AE5FA8737DDF4040D7C3D76118540D244CDA0A7AD5C9E4D7DDC377C15E57697F6F9EC14689C085E986F16BDE6884B2978F217C51ECAA2AA9C8FCA9CF6E9ADE1E39BECAAFF2019B5691B70C06286341DCAA4F21B87B38622C1BC996A38BC0428731AD3EB3C7BB0D08EC4B4950DC5EA20095088F317C43C073D2E2CD61B361EFE2CC13B12F1BFA59A309D620F4F8FD58B3A8F32ED9DED4BE8CED
-ss = E09C8D7E5D104C0A42B47F031EFE22A79BA1008EFDFB80FFC7532F40FC9B3A94
-
-count = 13
-generateEntropy = 4c04310bea66305c6ca8ba6b8f61ca96257a67663afc11761f13fb5c7b324b6b8aec87a9a79204cee2986867a2906eb851b734b8b22b91d6749b1a5f07c44e3b
-encapEntropyPreHash = 40e593754e6eddb7f9cf176ba2d5fd1087c90ad377556d0b0f686537b1a3165e
-pk = 8BD98BE4597242C95C9641B194A093A928B8D3B30F33C10BA326943A8B704C09A6DFA55F700C488C38A3334716CCEB6585008A853162E40A544C0A16878328F47C4E67B5AAD276A2DEC4C320047E2EAB345CC14982B96D1D13566DA409E93072377A1729546117A04CE291A2090B60030A35D5B360F9F871CAD52F37E63954DA0E0A8675ABCC3717972F89469978730607293267CAC89E3C96A98576C2351D8756429722A1278A173A75114BAA4F0EEC6A12B09CAFDC99FEE2C1AF7ACDAE3C747B94B06517464F654ADAE25888A15CB4C5017076C9D3FAC3B1560DD9112D88B2BCF31B15AC420FE5A698D52AB41EF33FA6CA8D8CB9B94D58648F39A138974E8016A972308C7B040D2FA32BFD1096503A3A0E84B9941188A6720E06E6641B896D365190369766995826B72122D780477581BD69B348BB6C5C8F65B4D84AC3F0768EF6645E422B3ED7E38D0A423409C285D0E21BBCA97BE6707557BB0027E755F9A81912D04B9EBB374BD79411B2C283068670431F2DE58D346BB525D192F128C9316742115275E9214DEF7A61DA509B5848013B304216F783D77C3F57B76FB8DC984F05AB557709DAE4691B519C44D41813E4B61E6664AF5C970AE7A810714217745AF087BB00575B18081921A854B7D953E29CB1DE704E6578283292168EA73A03E2082B8B641C819649270011861A7B301DCEF74E9B116A86F717E30BA6C5398E34390072E20C82F570FCFAA2BD8847A7187052E6B9D0D9BC9FEC0217373BCC7B8D38245E40A1597077BB00A408E9EB2BB451C31A746D2AA07FD6432CF176382B6665D45343CF32731817023EE046577ABC342BBE25416DAEE417F2971A8ED4C839126E996A8DB40A55BD424C0E534CAB677FA1C6B692D2B7E322A331305F75289A1ED102ED604722737E76501C7E7ACC69842D6FFB2D31D1003C3B3BD8F4458D93B0270CBA21DB21A7D16E22E18584E68EA5B890EE839DE75B68D60B25D5452BBB91658F3220AAAB200EE7A8F070A5B5AA7FA30A768275970012324FE01910E8647945AE6F8B3A17D08E5C36AF468A7F6308751C4141439B567EAB03D72538DDF71DEBD2AEC5DB13537A2B0130B4C2F6662182BD08EB750EB681FCE77981A3012102C45642BB8A44AD5CB27CDA8369EC28190F64987EB600101ACEAE7A807158CC8100555A82644B3B513D7CB283A363C70A4EA090241C8A96AC562E7FB3C38F3515C3A68FECB271713729FB77A1A68695FCF995855749C1F0AE09F90741EC332E7602CADB69E55438B9D8CCC213119627410488145777907D280DDB7391D2EC9F27371277C266BB1B14F6EB8D46B2C8BCCB0C68F3BEB2D87B07044904D5B08E84305B0686F923985A49ACDCB1A662D1A08948C9B8D95883518D0AD3933976C464A41C18351216D84066D71164A32D41886A153703C584B747555EEFE8309F0810D49C0DF8C5512B245F637C9448C47E1456995E922460B8210C7AC1063047C3764077288A1345C23EE0C8FA6865FDD52ACB49614207285D241C14114DB55CC0C92049F3537ABFF81B8A30A02E5AB013741B36D92191691B3197CCE8D2328BBB6FF61932434899AE01412B231B0EFA18D8381555866091C77981E753F8A2B95E8095765EF7A13BD38F9FED3BF36477916CB802690A213C83F6624A067A5E2C
-sk = 212393FA68C40D1153EC29801F4472DB30B8E6516647CCCC6A160BDAC4299D515717D46BB4248673D11558D8AF5A6373720A9C96A4C51BF12AC506CBE51B560AB742EC684DDF86CB08121BDD412E2476842D051E3182C415C49B7184C9322242F70B63A960576296A8AF5451F5D474019C47E1822E2B1503D30CB8EA20B3CEC334A2114FC2381D910A98E633716EF9CA2F7939C7033BAB756371D6C2E906061DF822113C57DD5992C8826ADECBC9AE381931473558AC94FE8A19C9C4BEA3DC40DEFBCBDE234A211623F8D80BDEFC74F657A797098EBBE2B6B57438C2253F89D13BCBD5C0C4204DEF79BB37859E36E920768CA7D0651A7EC9BB63336698ACBFB6C9A384084DEFC1BF5D9C050087B691D40344E107BEF0241BD99463532A05B795F820213392CB16D668605CA86DF134C03C4A7DF581F8CA7DAF732F5AA75146457163C3ABFA9C655F966A607A69AA1234FD1CA2A97213F280A10E84C4AAD26C0EA2CBA6773D63B39EF7350F6D284830EC3275E5BB9A318B03F87CD3F3BBA41632C0F9A1E65989B74B91B23A82BCC22D617AAF8B14C10D0037AB970B8CEBBEC0CB866BE5057964B7CAE6C9B3084A696602A25961DC53558C065D6D8B25248ABA262B1B635322BB82165A8CBEDE60BBF6B72459D47B64A964B3C32CA563BA5AEABA8ED912D81B2E733B4B4587A99AE5037DD21DFC9ACA5D869596E36547C0336AE774B8BA637622A597C05DCD43B092D938429886C708448B24A45A701CE9FB9DB54C67BB531BCFB82EBC15C127409B02A3350D6168F1296784B86F7310B9160681F0133A66356843401B9C0414D7F687AAE41A36857CCD3B26BF8C11DEF30769E30630169365AA3C3B53CC89D9CF47C2CC6C166F197C9E5C5B2408B03C41B0613703CC4872BE78DCC4B28089D7118CA1186BAEAC1355D5B9D4E45515897AE233A26810356A373DCBF6CD5F02CDDE8C468BE006DBC67E60A69908D1171D4A5EC1643B87059CAC80C259788EAF195F4FBCCFC4C0284BE822F94C2978FA119371291657B927F8B332124D61D17E21A36485D2C3F2893865F305589A8D048B06FBA7BB9F087F96D5785678A7F2D16C892CBB2273677ED0CB70F5729AF0A0403B0BF0608ACEC1CE32F2924535C16E8423BE0C8854E439EA395DD792399DC98AEEB7493B64965858BE35977DC053B3C0B3788FB4244CD3B49E40934F90B454C983DA38B2B5C88521347788F832E9C64A6CD012511234275C9F6C251442A87B496743333A161D8C04E3D78BE3097942AACCEDE09B9CB673E1FA261BE71DBEB5C4E1049B2B2A00311ACAD4470F8AFC85172476B949AEFBC0110A261461291B5FF7A74697C88AD40C82770FCCF68B9AD5382125879E637B7CEBC1AAE95B03219CF2488B2E3B2E51480C8CD8022C2092470236FE6042DCEBCA24CB9EE9379386D80E54C232DEC93B99B694E99AB5E41CC8CFB8928D5C08EDC7A707044B49B8A131986A3F37BCDBCAB5255B64B4905A93A719D01A32384A87543B6BA1A22DB75C9BAAD257BC8B9D8B78641B394C7AE064087454CFB17B307BC35A97CCCB842602990747D60F30D220ED3171FFD7A2B77049DC210E2377607B817F24C011DD736D7918874AEA4B8BD98BE4597242C95C9641B194A093A928B8D3B30F33C10BA326943A8B704C09A6DFA55F700C488C38A3334716CCEB6585008A853162E40A544C0A16878328F47C4E67B5AAD276A2DEC4C320047E2EAB345CC14982B96D1D13566DA409E93072377A1729546117A04CE291A2090B60030A35D5B360F9F871CAD52F37E63954DA0E0A8675ABCC3717972F89469978730607293267CAC89E3C96A98576C2351D8756429722A1278A173A75114BAA4F0EEC6A12B09CAFDC99FEE2C1AF7ACDAE3C747B94B06517464F654ADAE25888A15CB4C5017076C9D3FAC3B1560DD9112D88B2BCF31B15AC420FE5A698D52AB41EF33FA6CA8D8CB9B94D58648F39A138974E8016A972308C7B040D2FA32BFD1096503A3A0E84B9941188A6720E06E6641B896D365190369766995826B72122D780477581BD69B348BB6C5C8F65B4D84AC3F0768EF6645E422B3ED7E38D0A423409C285D0E21BBCA97BE6707557BB0027E755F9A81912D04B9EBB374BD79411B2C283068670431F2DE58D346BB525D192F128C9316742115275E9214DEF7A61DA509B5848013B304216F783D77C3F57B76FB8DC984F05AB557709DAE4691B519C44D41813E4B61E6664AF5C970AE7A810714217745AF087BB00575B18081921A854B7D953E29CB1DE704E6578283292168EA73A03E2082B8B641C819649270011861A7B301DCEF74E9B116A86F717E30BA6C5398E34390072E20C82F570FCFAA2BD8847A7187052E6B9D0D9BC9FEC0217373BCC7B8D38245E40A1597077BB00A408E9EB2BB451C31A746D2AA07FD6432CF176382B6665D45343CF32731817023EE046577ABC342BBE25416DAEE417F2971A8ED4C839126E996A8DB40A55BD424C0E534CAB677FA1C6B692D2B7E322A331305F75289A1ED102ED604722737E76501C7E7ACC69842D6FFB2D31D1003C3B3BD8F4458D93B0270CBA21DB21A7D16E22E18584E68EA5B890EE839DE75B68D60B25D5452BBB91658F3220AAAB200EE7A8F070A5B5AA7FA30A768275970012324FE01910E8647945AE6F8B3A17D08E5C36AF468A7F6308751C4141439B567EAB03D72538DDF71DEBD2AEC5DB13537A2B0130B4C2F6662182BD08EB750EB681FCE77981A3012102C45642BB8A44AD5CB27CDA8369EC28190F64987EB600101ACEAE7A807158CC8100555A82644B3B513D7CB283A363C70A4EA090241C8A96AC562E7FB3C38F3515C3A68FECB271713729FB77A1A68695FCF995855749C1F0AE09F90741EC332E7602CADB69E55438B9D8CCC213119627410488145777907D280DDB7391D2EC9F27371277C266BB1B14F6EB8D46B2C8BCCB0C68F3BEB2D87B07044904D5B08E84305B0686F923985A49ACDCB1A662D1A08948C9B8D95883518D0AD3933976C464A41C18351216D84066D71164A32D41886A153703C584B747555EEFE8309F0810D49C0DF8C5512B245F637C9448C47E1456995E922460B8210C7AC1063047C3764077288A1345C23EE0C8FA6865FDD52ACB49614207285D241C14114DB55CC0C92049F3537ABFF81B8A30A02E5AB013741B36D92191691B3197CCE8D2328BBB6FF61932434899AE01412B231B0EFA18D8381555866091C77981E753F8A2B95E8095765EF7A13BD38F9FED3BF36477916CB802690A213C83F6624A067A5E2C9510A2A0B4FCBD414FC61AFF04A8DF579660D14B13C40EC0470C45F639B65A588AEC87A9A79204CEE2986867A2906EB851B734B8B22B91D6749B1A5F07C44E3B
-ct = 9DC66C77C56800C40A5E71DC3CF139A83AC4308527DF4ADFBD930307EF72D020AEE3E44C3D548C67CAD24E04C21FDCFB69EF121985A565CC897A06CD2C7F4CDD767A5FF8F9353FFAED3363CF5F315ED386AF41BB5A3B0E395DBF12DD24FDAD29FBCD6056FBBC6D354739710EF74B1F4F7C212785F1451D3FA18443EA1F8E4357B7D0368C086C395B4FE548240F7F085DB4A361490412D034363F3514ACDA224E4F72FD7AC410FEC9D7E194FC9F074E8435D4A2049F9FA8663773D1087AC0721AF6665C1057AF23C2B5F3C478F16DAF711BFD0FA253DC1185F008FB8604568EE21C8B93CD1C0BE2CF4D7869C9DFBB94F4B7A1C038F834EF1B45144E8C1C4F3A7587CC0F9BFE3C6A2CF22AE9B835EE38B6D6CF89AB32316D307DE771DF9444B6B23E7054182CCF799CA0D0D0D3034DF22AB6FC27C507782E8196CEA3550A76B3246DDD1B9EB68AA110955C3F3FE19EF762CE5EBDA48A0B59DCE90550293AA4D550CBE5AC94E5FD79901D11B7C5BB261C598CF0C49AEEF25ED8ADB9042791B7377035C41638BB4D06551D80472D159A33854BCFA31555D95506466D118E6B2051E900EB7BA9B6DF3CB9E7D51BA93271DF965F274C4370266F8D0E1EE346D046250486173F96FFE819C231AE3E08EA12BDB2EE3B47434E6F68E19DF6043465D145AB978860DB6918995DC8E995069773ABB5F033EBC58DE26E6C4214177F1CEAAD65FF523FEED2761BDA7ACBA7340077FC0CDE9A938D3B333333FD32B9618459A180D55A34892E6B569810ACE45421980D9A1A2489BADC1E617F4E5A8B3B628DB737AB8668BF047598FC79FC74DD21FC783DF41833E033688CF3915F8328D557C1F482FC78EDE767EC705EE6767D25691DFAEF3A1EF7D076480CA1621888C6282FFD037FFA0128769A30530D92EB7FF4C4E1C86C0D5EA911C7AA2F2B37F1019B061CD6D6BF0F70E76E8139131EE149AA4197D2F2F284CAE33B96B5FE8C5F846D277C59F04DABA036DA670B821A4E5FB0532D0FE03F90AB8E223F06EE5FE9D982047DEEBFB69A02B145E703DC60AB95918971CA3A25DF7C32DCCEA0019F19D83E245F532F5207F8ED19D9A2F7F94F22FA60B1FB666DC21CCDEF046215C50095301D2902FC0D4882908A16B810FB44409B9A23D8228D7CCD0D510051256E4879395FAABECC95542C07E8A07458FCE35D1D882606B41794BC69481E22C53F7BAE8B5BF6492BA14AC16F8E80918360C3C7BE0F2E6985A2C32CDFD36EEEA99B2C5C140CD56E1AC51ACA07DFB53D58D8DB395A28057AB62EB16DE9DA139DA54D4934DD7E5E0997F35FA77FCF0E9C6387E854DE1D9DF06950FE039719B5F278FAB8BB81882EDAD67369D0D0FB1ED57BF36B00D961D87BDE080787729753A9ECF0A48F5B92A369FD71F8347E97170CD0F0A9CED646A120F73A414D6CB8217583BE56255628CBBB91F088C2CA1B1C0E0A302D573CE50D13F22D76AD4DD03908B9A84F4EDC74A234C16CD210E4A7D4880F96A43AC6C003D011CAA39CE78EFB2F8731FDEF17B6B4
-ss = 1F8D087B541B57A9D85F0737C39E73FDE01DB5BBE539834D8F918426A57DF9E5
-
-count = 14
-generateEntropy = 38a0d5f41d7dc1896efd1b45b0485634cef149828751b96087a0a6dd81b4d58aa2acf359556df4a2abaeb9dcee945829beb71185b4d6bd18b76e5668f253383a
-encapEntropyPreHash = c152523abd8248bed40c3827bcf0f8e8127037a55c780695e2c28ea3e041a44c
-pk = A6BB3B93C181B651918A25235E22779CF052E1D30E6852557CA32AAF841834B423A9E61CC24B5231D7590F863E814AA19F123C0CBA97CB3773740871AC23868731748355A85F03B275B3273486142153BE4920BC9EE77AB5C05D2B96228906586EC831EBE8CF6F9BAC3631B7CC904DFC768B1A717274B33F70D08B6A79C4AEC3597E1C9664C9472B6C100C1601F27BC0AED37152E20B327B5D32646F2980BD780C8F476715AC04BF1E03C2D4A31DA23B14DC0233C1A2C2D983627BBC845F023E349CA59626A99EEBA5DCC12E8B82076EF2295238667308451C2052C6F9B127778A3C656213A23DC7E25660443183298753475BCAF667A9483192C6BF553B7E50B44A84A4B881B0365FE513FC661A03689581E045D2F921444C6A76E6344ED8A335B6681CCBC7B42B50B9B03558C64DA65088F60B136882012135A8A659355503918BA25DA1C167B9FB9F771B5727493C921338C1ACCCEFA80201039D28C968AA3A40C2A28835F63BDE23B9722A245EE3C859997F45E10A11F1906C1485B0B51093F51819963393A692ECDB1DDA2C88A6133F69F401B124CAD796217C818152A528F7D073BFCB9EACCC6CC8825AC4612533126C1CCC736DB53F648201FF29A6C3F77B41E01DE2087986F237200014E5FA540735513400004B5925CF64B0FFE9575E27AC19AC5644F355231BCDD70348C4507C80780F1D51ABF6AC4C5E2957A94325A3F64E83A0A192516F6CBB40B8ABBA5F8B85BF2AA60E44B46585BF009A723FE1A44FC97543F269F670C593935BDF87A52A1A31CD2B9AD92807407B5851B49EB1A2318611CACAA7710B6764A7E57F8962BC3FC483A8393640E602CA55526EB1BE56F2C61CE802B9592F24C14AAA75AA4B002AC9B81FC1327B2A93AA889C9EB178BEBDC91579CA7BD30796CC324447892558D2C052308946A451CA49816C06AAD39603DD3841EF03CCC1075DF164739FEB342ADCCE87AA12F550200CE94765EB4F291A5152941B4EEABA91C3A59257C03017C0B7E0003B07657BA60B4256A8A4B205D7646813246385B348EC157DC6EB3BE4546D7EB85C29512840018968743D2CE147F071C8F96C7436596337D69F5074485BF4A288833F2855787F8A18D874C5A2A41422157F65B62B5E581C2181A7023698FDC1AC60A8340A34B29F81B03DC35DA2B453FA61293070B1C6DB57F3040C3AF7766C69B84D624DBA1163FEB0C71FAB6582473F93C8753D67B0259A2EEE1C847B1B8A73455A74FA10C3A4C21A35AD20FC36D563BE9BC55350F565E4076670F0C77B3C4AA2A06F7BF2AD1BFC4FC8721618454D640189A6F8B3D6C71086DBA68B213F4C51100A6037E717147893CDAE20A97759204B2C684D8206FDCB10DF575799AAA3DE388CEAD4446DCBA8E14368F7202520C71E453B41CCE426BE6C1E29AC475C45742DDACF7C520DA15780A9056183900559129E5E3CBB3FEAA288B25B6FC69BB8B164C1DB8E24391172A8C23859545E98A13725130E45C3D1CBB5D6F5C0DC275608163916013E6E466C29502902C97D3BC33DD006ABAAF2AACC40C046E55951D744E31887155A3FA880058A8767B35684445982767C697540CE339A0F4C29C2AE42B5DAC5047C12C22BCC155A63A8610DB945708CB5425CE0C3C651532A43D32473F236519D54FDFE0A815D
-sk = 69E774DB244D05192A2E064257F3A7B9B08941A2018ACA28C610B8BFAB59176BAD88B9A7781222CB03AABE6A4C2937BE24645A28C3A7931240503769EDD1865F72B44C4842114980BA64A59A647438C5476A700D0DC4A63277C4DC73A3DC9B59BFEB0DDF0817612AB73AB14378E93FA4982D15131C5016B36A639E4F689E9B6B2D2BB2501E130EEDF72AFE4861AE7CBE7E717B4C4001B78BAC719C6AFD40969392CFB1D918794B4988A7C03A23C8C5A751ED2C39D3E18474B43CF8B7814A5932224141FD543871AC102BB0A349153EB4A13AD57AC06602BFC6C1B4425284EAD058572A1C7C0CAFDC6756555B2033D2CE67F9155B16726625928EA26D13E2C0C0A66988EAB99643B4CF23AC68724CE635188DD8B3F2F421E8E8A9F838B707A16FBF27445A7555CFC052982CB002130CA3500CC428AEF14281564997D5F37D0A1C411CF73D3D2082E4C26C3BB7BEB9FBA2D9EC631F8953B3D03075318B4B720B4FB5B177D43C11E8979C640639136FA20B718C0846404B2F0604C55CA82F519241D811A697000DBCE1C743410E92922E83446410A93150178A4A2B52123174DB128B2EB97DF4E8A617D5876AB9977DAA8B7845537DB0A2B6E0599C0CC165438329D1251D6AA09D5B30F27040082A135C2B831B7722C416072C655C4D511E1FDC0284932849126D49B5A03B3593894BCA250B0D198601A02900C9406D8F5B69BEDA735A3512BD355DAD587BCA7330364031573B44EB9C2BD103BAFB7283C1B923AC3A41F0607D4B7B7E1E681AAC9B4090538B6B7975B9C5C64C6196577B7861CC88ED6C3365AABCC9B97A6A318A39A2BA8B17376509A563B58DFBF4584E6B00D56BBBEC309164982D1B906635A146C04BAD613C02C8E2C2D0597FC285779C628F3E290A84D8710745C444410F129A140358991D601FDC787FAF4506C6003E2130C2E03B3FFED39CA3B9BBAAA34ABAE794D4266E59A80EFB44528B2B234D70025767A5DEA09032767722C61E53423417458DE9E809A42257A27001E9C8AD43B775BC853D8475ABDAC86811D568E9E38747618AFF0B0901283A3913B6595CB2A85B6D42101DCBC90146AB85EA5449850BC9D8B1356F820EF365731F176EC0A0A5B7F35D9848C426F32D6A37046574A93CFCC043614E8708026621A06AC00582DA7B64421D4F50AAAC1BB10D6BBAEA31808712B891344B7B865243614CD706C2DC098B0A069FCEDB89ECD67DE8319C92F3AA0A9B92A1FA256302587A5859408B5CAB563EF1814CEA386BECD756DB669FDF87A003EA1E7654CAB281220B21CB234AC1C4B459EE48517BC838082191DE35B265D5264119C05CB500A05307C806AE8246128A8194F61024F5B2B7C410689150C0A8F68E1B3A51DFAA834B7C8ED989B351E683AF7BA73DD91E9733282FA2559AC53AA2819811190B5827000D98433241A3DA2B77F4E588B0088E3D3318CFD049C4777F7B08678144618E2406B9B6B72698888C4529B7E3B272E92620BB36792266C3DA4C9C403D1D49650B5530BE017C3B99C068890F2705702440AA0BFCA823059822C18981A03B16670E127386265487665ACA4C171E023621A853965A629757148E37833D31E453DC9B20191C94230833A6BB3B93C181B651918A25235E22779CF052E1D30E6852557CA32AAF841834B423A9E61CC24B5231D7590F863E814AA19F123C0CBA97CB3773740871AC23868731748355A85F03B275B3273486142153BE4920BC9EE77AB5C05D2B96228906586EC831EBE8CF6F9BAC3631B7CC904DFC768B1A717274B33F70D08B6A79C4AEC3597E1C9664C9472B6C100C1601F27BC0AED37152E20B327B5D32646F2980BD780C8F476715AC04BF1E03C2D4A31DA23B14DC0233C1A2C2D983627BBC845F023E349CA59626A99EEBA5DCC12E8B82076EF2295238667308451C2052C6F9B127778A3C656213A23DC7E25660443183298753475BCAF667A9483192C6BF553B7E50B44A84A4B881B0365FE513FC661A03689581E045D2F921444C6A76E6344ED8A335B6681CCBC7B42B50B9B03558C64DA65088F60B136882012135A8A659355503918BA25DA1C167B9FB9F771B5727493C921338C1ACCCEFA80201039D28C968AA3A40C2A28835F63BDE23B9722A245EE3C859997F45E10A11F1906C1485B0B51093F51819963393A692ECDB1DDA2C88A6133F69F401B124CAD796217C818152A528F7D073BFCB9EACCC6CC8825AC4612533126C1CCC736DB53F648201FF29A6C3F77B41E01DE2087986F237200014E5FA540735513400004B5925CF64B0FFE9575E27AC19AC5644F355231BCDD70348C4507C80780F1D51ABF6AC4C5E2957A94325A3F64E83A0A192516F6CBB40B8ABBA5F8B85BF2AA60E44B46585BF009A723FE1A44FC97543F269F670C593935BDF87A52A1A31CD2B9AD92807407B5851B49EB1A2318611CACAA7710B6764A7E57F8962BC3FC483A8393640E602CA55526EB1BE56F2C61CE802B9592F24C14AAA75AA4B002AC9B81FC1327B2A93AA889C9EB178BEBDC91579CA7BD30796CC324447892558D2C052308946A451CA49816C06AAD39603DD3841EF03CCC1075DF164739FEB342ADCCE87AA12F550200CE94765EB4F291A5152941B4EEABA91C3A59257C03017C0B7E0003B07657BA60B4256A8A4B205D7646813246385B348EC157DC6EB3BE4546D7EB85C29512840018968743D2CE147F071C8F96C7436596337D69F5074485BF4A288833F2855787F8A18D874C5A2A41422157F65B62B5E581C2181A7023698FDC1AC60A8340A34B29F81B03DC35DA2B453FA61293070B1C6DB57F3040C3AF7766C69B84D624DBA1163FEB0C71FAB6582473F93C8753D67B0259A2EEE1C847B1B8A73455A74FA10C3A4C21A35AD20FC36D563BE9BC55350F565E4076670F0C77B3C4AA2A06F7BF2AD1BFC4FC8721618454D640189A6F8B3D6C71086DBA68B213F4C51100A6037E717147893CDAE20A97759204B2C684D8206FDCB10DF575799AAA3DE388CEAD4446DCBA8E14368F7202520C71E453B41CCE426BE6C1E29AC475C45742DDACF7C520DA15780A9056183900559129E5E3CBB3FEAA288B25B6FC69BB8B164C1DB8E24391172A8C23859545E98A13725130E45C3D1CBB5D6F5C0DC275608163916013E6E466C29502902C97D3BC33DD006ABAAF2AACC40C046E55951D744E31887155A3FA880058A8767B35684445982767C697540CE339A0F4C29C2AE42B5DAC5047C12C22BCC155A63A8610DB945708CB5425CE0C3C651532A43D32473F236519D54FDFE0A815DCFBE9649D9D1C384BAAD67B91B2F3E21F2FADD6BB582A0B9CB016051DD82C75AA2ACF359556DF4A2ABAEB9DCEE945829BEB71185B4D6BD18B76E5668F253383A
-ct = 438BD56B10F4813575D7CB4D4F502AF16B0CB43BABB8B636088AB627CADAFAC7FA8A3B3AC3E8903C6F72A6A060ECFB81F2F86974E324BFC5A6EECA115AC1F632BD83BE1741204499997E1255C547E3F6F4D2B4C92D8671FB3342C1DF8C0B1B927E33477D589F74732BD047DD9898CFE6293D1F6108F74924D68215CA691552AC1CA07487FC7099DB19BD26B16B4474873D352384ADC22AAFA0C36CDFE4A5A486372398E2117A894C3FF3DF86F724553A419362BD1AADBA1730A85EFE908BEEBC4AEA15C83A02E0C5424CB39261697E3BD534652DA23B6E64118DB7A355438BDEB1D3D895D281F0B095871EC4B108354DDA84D252C819019FD3C0469014EDE38B16FAF69F12688FC7A17FF074414A6157E4FE4C9F92699D3B57D00D31232FC8BA2A05B4253CAF6E9F550FF9DDD063B4D2939A5431021450DE80538614DF20CD2C21C644DAE73C1621B6B7DE5CD08EA474383A9F842E69EC29C37BDBAB43012313C984D8EBDB386DDAD5429467F6E3CA94D1EEE89F77783724ADE7D1D375C6DFF1F483D6849BA5CD09C6EB8740CB1BC463F0D4C9441B6F248C029D8E94F994DB46E892C2B546C1DD3C1B71C78BB5B4C4D15F3F3382DC075E8CF29AA3D4700DDCEC71BF6C836CF84FDFBC60C145DBDCCC49929CC989A206E104A72A6967ADC2B1CF682BB4AEDA52475851DFC72EF76A33231DE8F44266C13CF3323FE8142D73FA5A6D021D31C15FB95DC3998BA113154ADB6CA2370B9627F7C15A8E858C15BA769AFC33339DC55F783322C41FDCE25EFD438879EEAB6293A1E47C5089C1CFECE5F194740567B2488998F7B10D0C63B5212F556B2C0B1F300A22A54185AA8431FA20F2C59B898339C6A9A2462EF5330C9CA2CCABD333666689753440882152E7CD74F965111BD75AB4A1B9D50F8F09C8E63268CCE09BE63C293E875C3CCD5518C2B9665226825FA269D8D5C078F50ED5FA2B0278E75E7AB2444FBF4C4B33E3C2E9FF7EA7D720208A582399D0A381CB3EB087BEC172F99F76948ACD97D7CABEEA2D2EF4859C087DF9F8216B904CA595993D81CB21FADB7E5DD1BA854DFE16B4E4818A2A4C7BFEF3FF1F499D30CF53ADF2E9DFAA03147931760A359213F58A8ACE9BE58E50B888F85CA6F022F7D1C152743E341B68BD6DF17CA099FF891A5F702E8AD845F092C8DA5A5F584FEBEFBCD0280473A7F4AEEDF0701D7F69BF8B94311D87F1C03222EA9698ADEFC602D7C4FB8ACD59008AF4FDD75B5A930323B742887A0D91CA209063754E55E21E8894FCAF8944675002244D0134A41E43270A9E918753C1224D2992B34CD5E0B8C1E79EAAEB74B70A215C7B75E9298C7AFD0F4B26CEC3EBD13D7462FE0569BE3145AEB4393B3BB1F5D13281C7FC4214168E062F76D7EB2A7B7D16A1EFBE155025CB0085DFC4A706E79C0670CBFAE9BC7A8390C6DDDDF1FD4E83D56D242AF36DED7B0C38BF82081C631A3905EE477F70165BCBE327658768EDAAA49548CF446AA574B7C97071EE2D0063A8D8D2FEE0092D2687F60E005BF0
-ss = 0DA3B9B56FA25F4CA356D3206B99AC83FE84A09CF7FD55A33268C122A8FB51AB
-
-count = 15
-generateEntropy = 97b5665676e59e3538ebadaa8cd50df1f9fda1502d9894c616a946078e56b621df05318b5f655efe36f1b678cf4b875108a18db2fa312261caf839f84bd956c5
-encapEntropyPreHash = ad6466dd59f26b762fb02b19eedf5f79964da68bce0459b91c3a6ee5a7e01183
-pk = 8452A77401C4E343BDCBDC985B70189EA976E3D65C47649593C9CFC112A4292238302253118CAB8EC52060305392E6A131F0445A0BB4E11A1A8D7465E704B3134C3807D9BE9F8B2ABD57A00758685392592FA0B01E116410706A669A0EC5ACB524D1561A265E307C24068B12897568490458121C572C2CC43B2464F2703212641202A40B27A41FAFC4B24BEA9F26711F28B1050645A38757708AD607FF6763F14C15A2CAADFC2BC4D23C576E5CAE6A20B10CC9CF610A5931AB4C59ECBE67EA079BC3911A96B24B86A0D6B99CF85AA44094B0F6C55924776C4E1BC9CFC88A127B8195145DA3515288F933DA602F1A2747A6856657B2102774BC1946163B534D02A1CE2E641CD9FC7F7D48B6F643AB53045BC690A249433553845B34A5953C873C1C686C83BA46ACEC4E91046F9E7590196C9C24A747C6D986B4B414C223A52A6C88475405232C78AB3AAE8861A45A817EBB16C3A3070B8E842527E965013244FE50907BAC3883122393340B1E06728FA0400791B1DC3BA103C8AADB6CB0328B5EFBC85694164D0934C207B63614CCA28ECA71E5F63A58604599EB6D1D248A37EBCB17335713C4C9A0500FBF893DF475CF7C19792FD56FE0A7505DE0158F34603E0071B2AA0BDC8A12376A1313F571D33686D505660C4BACE8EA40820918E05BC15B381B90D9B31BF52E1B18C422C3935D04140170542829CDCFC883BC344606E75A2EE7AF469C5A81DAA1071771FFF275F2358472B409B1EC31EC887FD6E76CEEC6812D40BA4469B3EEB028A0A6875A19B7ACA51465CC3FE78566A3EB1B98C621EB3BBDA4E7BEB5F2344B64013EC233FB5714BC68B767DA8B60A6B0FFC8565369C19877C16D7C70F17B85F7A228D28A5936968915D026CF683C762714830C1742AB4DFF789F1F43782622A070A4AB52633EFC52693B695DAB939BC24944733905AE86801C4577324C625159B141C5A1014A6E458B71A959001839C461E17A3AC46DA47AB687D2342FF63B83D3331510C98AC484F44B7FB6A31F6926CF047982C400008BB3B0D1EBBA3CB2345613680531B0708A64B937C88B2985C01A10EEA22FE5022912F9AD2BC667CEA16B0A091F3FA9BBB9B8C30160717B21CEF9D74458241BEEDC215D44900CF40709F6671F221D39C804EB6756C812364DF0503355B8B01102574AC3F07234BBB1B658EA822D52A452545DA3544C041C3A3F89BA30005A992B432178BFBA078686A07971601F8B12C22B23B69C05A89ADC2469287F052A6D4F58798E10A464DB4AA71AB30A94854D1B8C16893B432A8DC2859C66A168C8C5AD4D04559056C4588B0A8755013E378545B47EFBE90CA97552C9B8711D3281CC7B9057F78A68A59D5AA642D1E9233DE093DF5705D8639D702097F0DBC98451A46905AE72D876E1243546590599FC5923B37B4CF0A3F7CB47DFE8AF00F6A999127A256681A5705BF5100D7096713C49149C7C561C0783E048CC3444776BF8997671970535C2CAC5360C9B53E0D952AF348A28E4826DB9810F07110A48771C2C9B21DA3CA719C7A5407B92020AAA0180B4D6B3AE42A1C09CA38FA59D1ED02A3A0079F2E922D0B36D9795C1FA42354CA51DDC11A315515A45BC7E1E21BCD3287E18BB0AC3F8119A88D1FBCE1D3419BEF67B6694D9FA1BB309CC61C819176964DC
-sk = 48C78CB714B9CF88A8B317A6FBB681B8F47D56524122156503823B600236D3726EDD9087504705CB4698A1515DC0D80B3F87C63D575170F45D121A848D897C3C0063DFE9B2D616A96552384FB72D6226A193F90E15B364AE667C34BA27FDD0AC0DEBCF450578C6D182DA365D40786522C37B54E0126ED7B3C6BCCF28F40770F23736B394210B67EBFA72F6B27799FB1F6E48CB7407261A86884621C529974635B35F5B4C530E68BEE8CC213387B66A4127D01223180067A2EC24B2EBB579F74BFD5417FE995BBF816737722912B5B4DBB4C938D0686D1C2A44880FA7231944C195FBD67C67E60861D169DDC41F8150B52A68C14425190BE2ABBCF5BABB734AA03538899678D4290738CC63EEE611E4344EA73B9C41F36C712A4C6C72422000CB93E144F3C588A2299D5704CB347B90B2905CBF69CF1DC5C670909C478094E88C01BB3B3E4FE246F8DC3C62DA37BB13B6E2046911D85D5790869FA4A54FF16794620480919C0DD74B9887BB5C125C34D76B3527A42A46B689FC4C57571AF13C44B7D30A041028E97C0A1E50621567374DE7A4207ACD4CB18417C7984645CF4F2B5A5434BE8F119798C0760229301E14431B0B652C643C0EA0CCAA13CBC6FA6DC8D348B908B78343978FD5A0EEE90CA5104184F33F107837B3EC667EB207000570DD33856939BC8BA671B3731EDB2A94596A8F2F37BBBF5048087091FD2AB164F5C6A8F92F65239F08844ED4F605E3BC1BF780877EEB3F4C85BF696C691F85A947461331AA33B15973AB4923F429C7913731BC025539232217F801EC7078E2F0AF3EC7494684BFC40B4FF31798467746F60BC9BCCB5B1E397DFC6165773A965E55034DD1094966694D7806F2F505CEBC3B3DC307405431FCA21614089C633B522510A5FCA73462B32FD69200DC614C5E88454F181D845B19B8866259A2372BB3361B9ABD5AA278B1773057E26108BB020A9610BC19AF13454DF46B4FB5A68C3E7ABA6E7197AD63439C7252CF9507E32072E437296883C93902250165A1AEE8BE0CE6ACC2029E10E97536EB958B691AE3E3AA9996986805C6D1F6356D26C1E63C550381B292FB1B95E183CA933D5BE1BAF6294C4B248B4264724712B2A2816ED3D09042287EB8A17AD6C86255AC492F53A21EBCC19B3C8BB1E78F58BA98BC8AA77F6A5CB90C0456E1CD663137E11185536B02D8708644539701B193BA52258064B289D053404BC78A397AB86895BAF1934E8B2F6CC3AE48869BE7422E581A6FF748519BC30BC96C716B0A24A02679ACD5151CB2A0FA127C81EA513C3CCC3B84A34025522486CE424BC04C860EDC5758AA990FED372DB324614FE91589D78ACC88C43C2643D540A509F090EBFA6214832C76CA982FAA1CA4465F9C14AB4E6459F072558946CEBA113B5FC7024A364970C72933331A6A4B0D4196B9E6219595E229F3E28FB2D5C6C4C041DB226AB611B04C3A80FB5A7F15E08DF3347DEF02663AA39409AC4E8C8BB0934B46B6A8816CC70C8C0B11A7EC1CCE57BF5BAA30E69207D7E59C9E386D5CF7863C133BA1B510F5E06C4876BA7849611BACC369B039EFE173DF6B8A22469E1F200F2AA53FF84390B88302D9F9915C4B8257754B3423097E7C6B8452A77401C4E343BDCBDC985B70189EA976E3D65C47649593C9CFC112A4292238302253118CAB8EC52060305392E6A131F0445A0BB4E11A1A8D7465E704B3134C3807D9BE9F8B2ABD57A00758685392592FA0B01E116410706A669A0EC5ACB524D1561A265E307C24068B12897568490458121C572C2CC43B2464F2703212641202A40B27A41FAFC4B24BEA9F26711F28B1050645A38757708AD607FF6763F14C15A2CAADFC2BC4D23C576E5CAE6A20B10CC9CF610A5931AB4C59ECBE67EA079BC3911A96B24B86A0D6B99CF85AA44094B0F6C55924776C4E1BC9CFC88A127B8195145DA3515288F933DA602F1A2747A6856657B2102774BC1946163B534D02A1CE2E641CD9FC7F7D48B6F643AB53045BC690A249433553845B34A5953C873C1C686C83BA46ACEC4E91046F9E7590196C9C24A747C6D986B4B414C223A52A6C88475405232C78AB3AAE8861A45A817EBB16C3A3070B8E842527E965013244FE50907BAC3883122393340B1E06728FA0400791B1DC3BA103C8AADB6CB0328B5EFBC85694164D0934C207B63614CCA28ECA71E5F63A58604599EB6D1D248A37EBCB17335713C4C9A0500FBF893DF475CF7C19792FD56FE0A7505DE0158F34603E0071B2AA0BDC8A12376A1313F571D33686D505660C4BACE8EA40820918E05BC15B381B90D9B31BF52E1B18C422C3935D04140170542829CDCFC883BC344606E75A2EE7AF469C5A81DAA1071771FFF275F2358472B409B1EC31EC887FD6E76CEEC6812D40BA4469B3EEB028A0A6875A19B7ACA51465CC3FE78566A3EB1B98C621EB3BBDA4E7BEB5F2344B64013EC233FB5714BC68B767DA8B60A6B0FFC8565369C19877C16D7C70F17B85F7A228D28A5936968915D026CF683C762714830C1742AB4DFF789F1F43782622A070A4AB52633EFC52693B695DAB939BC24944733905AE86801C4577324C625159B141C5A1014A6E458B71A959001839C461E17A3AC46DA47AB687D2342FF63B83D3331510C98AC484F44B7FB6A31F6926CF047982C400008BB3B0D1EBBA3CB2345613680531B0708A64B937C88B2985C01A10EEA22FE5022912F9AD2BC667CEA16B0A091F3FA9BBB9B8C30160717B21CEF9D74458241BEEDC215D44900CF40709F6671F221D39C804EB6756C812364DF0503355B8B01102574AC3F07234BBB1B658EA822D52A452545DA3544C041C3A3F89BA30005A992B432178BFBA078686A07971601F8B12C22B23B69C05A89ADC2469287F052A6D4F58798E10A464DB4AA71AB30A94854D1B8C16893B432A8DC2859C66A168C8C5AD4D04559056C4588B0A8755013E378545B47EFBE90CA97552C9B8711D3281CC7B9057F78A68A59D5AA642D1E9233DE093DF5705D8639D702097F0DBC98451A46905AE72D876E1243546590599FC5923B37B4CF0A3F7CB47DFE8AF00F6A999127A256681A5705BF5100D7096713C49149C7C561C0783E048CC3444776BF8997671970535C2CAC5360C9B53E0D952AF348A28E4826DB9810F07110A48771C2C9B21DA3CA719C7A5407B92020AAA0180B4D6B3AE42A1C09CA38FA59D1ED02A3A0079F2E922D0B36D9795C1FA42354CA51DDC11A315515A45BC7E1E21BCD3287E18BB0AC3F8119A88D1FBCE1D3419BEF67B6694D9FA1BB309CC61C819176964DCA19C2C9C907B129D01CC44A95949121C39534CC98B6D105E60FE519A000CC2AEDF05318B5F655EFE36F1B678CF4B875108A18DB2FA312261CAF839F84BD956C5
-ct = 38E00521B95D89079394AEE0B444233F135FB37AB4337A575430DAAFA341059049A49D1E7D3B6EC52EF44F73154A6827BF791A2986309C7D88A855A3E278F42880B35260C340E913FA227D0ABCA526065DECA1837ADA0ECB4D4911BDE561E6F3624AC6F4601CCBFB5851DC74A80B5C3DAC2C3B3E4FB0B1D53653C9FFC4440025F70D09EDB2EC62AE4330A85B0E1D1936E9EF2E82A7E7C3C61E74252A997F4D5B0A5C9070D3DFF6855455C94D22498583016B9C108F8EC0D80BAD19272D982A85BC2688736D50FE7BEDC3D1DB893D42331A60658A4FF202C46450D24A2F1F5BB90342D26904B0E07A3E5D23DC9CA9E8901FEA9CCC49914549A913D8CFB3F0ACE306176E377624DF734967FCBA76FE125BB1B7D9FCE809617114B0F761B4A8381F28F20B5B53DA07B0B31A644D7B11FE444B9B59E4110589CAF921488E176A830DFAE522DE3C651A0E17AE0C42CC9981E906534CF95A013653636A655EB564B89ECFA9C538CD3C6D8AE6D1DD541538CEC73669356E18F2D7D1B668C5A7BB9B9F6F96A590E31FF19EA85FA9AB51418BFE7ADDB99D627645152AEF8E518C625EB3B49F22F93E827784EB5272F9D04826A04D89589F52E16C7B1B48C4C5625E76F2DC8CE6E1F092F9CB9157766E15286149513BA24F9F64016B165E6441F97137629526343520FFC30BC48B4523FE68813885103D0289501275238B7E9F5832E5A0299804A00E3AFA2F1F3D0A247DB2AE9D58D3B8FE09763AD0C5EA658820C540026D4CC5A1528C63BAB66AB97CA8E4F1C81CAADE9491DAAACEF0940866756CBBD61047D882E3150AC1E47DFF9AB68D4B0C282887AB37E2EABE5B265B9BF3910C3C24B8125752F4006F9625918D2DF1FFBEEFEAE895C5B31D865F16EFC9FCDFEEABD6EB1A688FC45D197FE5D4CC8CAACFA1E264A203234375D8A4F141E25FB263A63EE1FAA6842BE1B935956494775B379D91D828E9981013A7E6CD049EDE515D4EE4BA74976C9D68417A27FFB03BB3E2A0FFBD8C801C4AC78C41E9CAE33EA6BC1F9A8ED736724F9EDA52E3E2BDC8BC11E67DEC594FF4AE3DEFB5B643CC5C607102270AEEFF76238D7B5FC858F7FAFF305F300D99EA7989E3141DEA159C32D622B693939F100E8F5B4A633C7BC6E3255ABFD45DD80C7AEB51896813864FFC75CEB576B681F8967C14C720E01950B6DC7AAC1C845EC01E21F378A8B4512119B3DAF1EF9DD5FAEADA667F599C953C0BA321B3C2D03987F3B169C3E5BB4ACDA824921759E557DCCDF82EBE520EFDB1D3A3F082AB063B51ABF1CAF89057B807591A977BB89C659C14A2BF12154956FB3EF13486130272BD8B8655BFAF83A304B85F38D07CA0E5D5854191F0B21B59296A9377E83972F665763D405CF4C01D03104E4855D3B8573961446FD1F5199A6DA97AFDDB8F4B0822C4A1E9F668D04DDCE81D0192F32BF8D0B94AC57895F3209E616D3449309832DF9FAD95233FDD4B3036AC0075E3DC2A25D70C1B922FC9925F20C296A93F307E5933B4C62AE1947EE2D35EAF6389
-ss = 806390146332DAF2AC2CE5499D2ABEC128137CF7DB02C27FB457663C18A0D7B0
-
-count = 16
-generateEntropy = ef99224a03a85a46ef115474ec5b5d620da6795d6efcca4c9135d19958a9de62df7d92dda83e6b2ef4cce08c9134563063068a196d7b1a1a13623e48ae12528e
-encapEntropyPreHash = 1a4d5dff5847cfb48333e33bb00ca7301b144aa89dcd412ff5a3b1081d775b7f
-pk = A16730C3D8A8484295A1D995716A3BF93C7270671AFB7886F397AF65F5BAC1B1A1A49084D1A672A1F98BCA762287E90410AB01098C74869B42479C2CAE5906AB354970C05CD256514F5C2E763230B6770884E7B700544977993DF1F57969E0265FAC4F474B76648B36F5711163638069820232B8A64F16BDE83557B0540405D7987CC39069923DFA984CA4045999A77483E04FE6EB0BE954A74C13CFCEA79ED0D8124B01B740A26ED961B2BC496CBDC539A10B8151E0078F66751FE78D2F3A5100761C8BEB514923A7B4F3AE208766FD852222DC31FC1A59A883C401459DC73468EB35AF61D28EC1DA147C882CC7F5AD5204BD8DA270E4C91DC37BAAE1811CFF4CBF8605BB48AC8585094327A8C17527BF5B3968AA268E152B6896A288A9722183E199F608CD7A412CA949113E87A956E4AD12737D53C3BE4752533BC755F7A1C4B07661E988210AC72131B4496941893A9C6F1180BA622436EEB02F3A3A090C00B1FFD310E811A7A8B87984D275D76B0F99ABBFA45CC5096A1562A375F0599D9698B18012A84A0628601C731CE1CE6824907F1B16878A75418C2FB0751202FCC988779BE2326E2E5228C9493A0E628441B13D58B3C79DF34B7B53C7BE816CC7368F2F31C380296250B33269158C4F9706D75B3B5536ADFE5B0BCF514899287B4B637BB4249DB25A0413533D628597DDD745A7F5270D136763E48A517CA62E116913350E7361580CF77BCDB5B607B38D49E1581654A61AD9602F4415F484BCCBD833255A29D2E76262B401F7FA5A1E68BB136771C41B29333B653602B79A2ABA21004E8A257DF7362163B6512EDA4E1376ABA1FACF04D1AA56C814000D718B5B504F1B9D2E627B8A678D0294C5E3B186A67C082B90ABB1C839232912C39C3E02717A65E24A185A5D96E99851EB538A4AB872148C2D7BC52EC4270F708690D0678D43C783CA194B4AAEB6F2156297355D7823E0F80890608768C65073E04E7E5B45ACBB1CB6446483E7C315A0A0C2066F080A53818A4EC0E4973F630F6822A437F6684FC9431F20A306A055F9906435172699B3CD0D46457BE26560F692864A97F80B493093270B5225980287F1F5711B355F9CCC018D670ED8BA64F10BA98B0068E7714074E14736087819EC2CBC960FE6939A4E9A4DE2045B53E81FBB845B0E546DE6B34EE9E91ECF0C9F74C569DEC949D3EA11785639126BBD45137021E9670735488E46A325342A2B4A959297816D1AC731CB501D628BC09083AB5C4DAFC09A36C7C70F2885A6622BB7162AA2C999927A1FB749BAE280237DB21418E2CEC419990288B813E80765B47E4C314171B849E570C7533CC5BB77CB9F10272926C382FC0796F39924B6971FE6B54638C4CF25318E146AA02769E64C47E4DA2D5264B282B32933D8C74242AA73C15875934E99D6C570572E03C54E47726E3B0416D3737A29624169778970E99DE64BC2B16039AE97C7472A41C9A6C6FD45BD7738CB662505BB26A307A2CFB9680F5CAC086F9BBF7799263C0B5367032196F1BD842534601094668A33BD339DB59746D63BA6007887AB750F5887453E02B22C3148BF6C48C806A94CB7BF23568789A1260C87AF0548C71881401C565268317756A211B6955ED03C49E0BEB46C4EA9FF7BE444932E61D464966BFFC96BEC0647AB34F2
-sk = 953B6E6F452FFAB6B9E27B707F600992E228F5FAC92680AAF31300154B218AE51A012A4CF53840CFD714CB63CB4C7AA0E8EA6E50803CA370BB38C7205D9365448B38308868C83348ACC365BE62B4FA763ECC5112A48558E57230D92B5869D77D99A5C0BEF49819500B333300910117E05B082D15368AE529923C6BC9D3594AB33C91B81549829A2EE55AD152493E80AA80399F770899EC05417A698E6493AA647691FEDC92854C23702CAAFC8AB3A3194CE8437B8E2A7F69454ADF3170C282972ABB93CF152DD85587F6272B0B71590C81B3A9F680D19445FFF0C395310A17F55272CC3E1364A9AEA7A67AF4561CF10043B7B7EB4AB0791A8D62814F4B6536CFA69CA0493FEC1A53D58709FBAB9C87578D83C9441D62C267E7AA4EF0AFC7106C9F834A5A13206C4B58D7378AF90B85F7E05237559D6D7819F455AA01D68BC297A8DD760A0DF971542919979218B4861A49E45AAB12BE67080D197C25CA53483D781BA27893D23BAECD393DD1643DC2A53275C84A19900B364CCC94A8BA3B5768F8DBBE08A7B08FD2746BEC62C98C5E5198695B12048BA5C98753AABA88BFBBC6C8DE490AFAA8343D334AAEB72532C63D60667079B41B6A287B04C797458ACD9104C94E96BF18137B0868737DC00A8E2164E0980B9B2135DC7C0E80E1B930C22874FC2CDBE0B5542732E8FA80E407A1A6E5AF0AA3168A963587379AA3E6A2B082A8A35604BAD827BD6AA1FEA76A608100DDC40B17283EDDAB2335B8796DC1BB57887787A4273C4185867368BE581F6E5767BBF0580F07B003556ECFFC3AE336260FA0A80A2C9E4C9914144551C89A9D68373ED9C7AFA83C75C6B8AFFB54187D3B46ABDC61D9E070B5584BE7564F932985EA4C739CC906732A7CF79A65F0F7B0682CAA5D2070B3E0699B1BB3AC0B38CAF22CA4DB9472D06B02954E36C0A3D8890473588C77E43990DA1C7103985761CA711109BEC0B805607D732A36BAF897E93C6D9A988B94C67A4592B7583126FD452FF0B45A033824983715C60478685B9C2D013D41B47EB342A05FB76232554DF30990D6F1B37EA9172020C66FAC8F415615EBE07833A2588EF622034074B214CCD9395648071821D1109DAA87C0E00CD9573254538EC3B8459CE56578C09CA66A508E88C4DBF6183A268B86FA4B7733A8CC89AC81619AF8F56D8ADB1F665A7AC413005BE730AA41CEF2B06A7FBA535552C8CEF73E90A8584A8B799C323F61FAAD4B8C25D06CB883493147069EB1C9C8FB262B699693D0601262E9CE5B383A0D27C1572C49547BC908C003490827343A690859A15B20119975C35AA991183052F117B53D06C5F4683D19CA5BA6F5595B8B269D96C1B3524CC8FC6EEC750CA33B5518603F59B50741D246642BB88EF61A8BD4C54F48AF3F573D4CDC5143ECBDDAB5A281400721544E16E35EA7A05F161003A6C3ADAF690189BCB074F546BC2033B1E8B00D56CF32E0733DC81D05EB358D148A91FACA963B814A9C5FDFDB4DE79B729DFC26C3D9B48A4730337B0BAC8C2A3628268159979F6B10AA9AB90ADAB98B9C0928FC4E3570AB01F02D5A64C5F605596E3498EA532472760F61CB2EB734C174E48237C656636645886B65C566BF95D927A16730C3D8A8484295A1D995716A3BF93C7270671AFB7886F397AF65F5BAC1B1A1A49084D1A672A1F98BCA762287E90410AB01098C74869B42479C2CAE5906AB354970C05CD256514F5C2E763230B6770884E7B700544977993DF1F57969E0265FAC4F474B76648B36F5711163638069820232B8A64F16BDE83557B0540405D7987CC39069923DFA984CA4045999A77483E04FE6EB0BE954A74C13CFCEA79ED0D8124B01B740A26ED961B2BC496CBDC539A10B8151E0078F66751FE78D2F3A5100761C8BEB514923A7B4F3AE208766FD852222DC31FC1A59A883C401459DC73468EB35AF61D28EC1DA147C882CC7F5AD5204BD8DA270E4C91DC37BAAE1811CFF4CBF8605BB48AC8585094327A8C17527BF5B3968AA268E152B6896A288A9722183E199F608CD7A412CA949113E87A956E4AD12737D53C3BE4752533BC755F7A1C4B07661E988210AC72131B4496941893A9C6F1180BA622436EEB02F3A3A090C00B1FFD310E811A7A8B87984D275D76B0F99ABBFA45CC5096A1562A375F0599D9698B18012A84A0628601C731CE1CE6824907F1B16878A75418C2FB0751202FCC988779BE2326E2E5228C9493A0E628441B13D58B3C79DF34B7B53C7BE816CC7368F2F31C380296250B33269158C4F9706D75B3B5536ADFE5B0BCF514899287B4B637BB4249DB25A0413533D628597DDD745A7F5270D136763E48A517CA62E116913350E7361580CF77BCDB5B607B38D49E1581654A61AD9602F4415F484BCCBD833255A29D2E76262B401F7FA5A1E68BB136771C41B29333B653602B79A2ABA21004E8A257DF7362163B6512EDA4E1376ABA1FACF04D1AA56C814000D718B5B504F1B9D2E627B8A678D0294C5E3B186A67C082B90ABB1C839232912C39C3E02717A65E24A185A5D96E99851EB538A4AB872148C2D7BC52EC4270F708690D0678D43C783CA194B4AAEB6F2156297355D7823E0F80890608768C65073E04E7E5B45ACBB1CB6446483E7C315A0A0C2066F080A53818A4EC0E4973F630F6822A437F6684FC9431F20A306A055F9906435172699B3CD0D46457BE26560F692864A97F80B493093270B5225980287F1F5711B355F9CCC018D670ED8BA64F10BA98B0068E7714074E14736087819EC2CBC960FE6939A4E9A4DE2045B53E81FBB845B0E546DE6B34EE9E91ECF0C9F74C569DEC949D3EA11785639126BBD45137021E9670735488E46A325342A2B4A959297816D1AC731CB501D628BC09083AB5C4DAFC09A36C7C70F2885A6622BB7162AA2C999927A1FB749BAE280237DB21418E2CEC419990288B813E80765B47E4C314171B849E570C7533CC5BB77CB9F10272926C382FC0796F39924B6971FE6B54638C4CF25318E146AA02769E64C47E4DA2D5264B282B32933D8C74242AA73C15875934E99D6C570572E03C54E47726E3B0416D3737A29624169778970E99DE64BC2B16039AE97C7472A41C9A6C6FD45BD7738CB662505BB26A307A2CFB9680F5CAC086F9BBF7799263C0B5367032196F1BD842534601094668A33BD339DB59746D63BA6007887AB750F5887453E02B22C3148BF6C48C806A94CB7BF23568789A1260C87AF0548C71881401C565268317756A211B6955ED03C49E0BEB46C4EA9FF7BE444932E61D464966BFFC96BEC0647AB34F2E4174B6E7542FBE80AB2BC06DFB802F691AFF147FF90332D5EA739216C18D872DF7D92DDA83E6B2EF4CCE08C9134563063068A196D7B1A1A13623E48AE12528E
-ct = 7678F9F69052E083A490965D779518878DF36A286624797D9A00D562D4BC7072292A63B24C01A747DBF24822CA2EBC078EC3BAAB0DB9DEAFB0F3CBD655AFF659514016EF3D93E8B52340A850089E5FB8292F72C86A879485387B190ACC8E9277AB4A8EAFC7BE2F32138504BB7B67ACDFD9B912D66E76DFC7F66F6E46231FAA4D01FEB97E1913B602477DA05EEA0158C4D33C2E701986411F9EE8B8518B8187EB0A98484800A2FF2C483CFD811A64D3A9412EA798996C87801F1227C19CE8139A53F42DA6E5BD508B429ABE96AC93147FD660B431FD2E146017C037DFEB89F8C5419DC721018B1979044A20FCAACB9D7D2F77FA0A370D469E253B89E58A1EB7DAA6BFD983642E45D746ABB642E0736D20595E8A4E67583D9366D66CC8DAE93E0F579BCA7989C97D9EC0A175194AD55E54ADB1988803B208322041A6F3CE5DA12C0279909CDD937DA9E4CB781E98DB46FC57733F8DA3DE1F86E5DB7103AE7D385F1F0980A669360D67DFA4F91E7F415B545E46D6F0D702A838BA8F248B3A86E18366B6EC489AA8F4196BE731C8FF811A079242640A5FBBD2622253525AC11E74237727BE9F94F376C81755303629D34DDA91F4C0157FE10FC7FB7D9D3E86F6B7646A0332D09EC2A8DE94F6530D3C93A85CFEFBD7BBA955BD41B433158EA148EDFE6F9441D1969DCA81E0319FA2CFDFA528C6B0846EA08C9C36D786D164C80E6938B8CC8BACF096A4E196A601DC1DFA5F85EF588752700215E4DE5A6E7D312EC9EA6704CB5E57EF64CDEC044539D536E5CDCA0F288864EEFF859A9444A078913942EA0A909B4BC3A9F4669C45C242150711DA385AFEE36C2C9B4186D74059E54C111682FD5E75B46CE6A971E9AB0263EED4BF29522E2D60F9599D594ACE2B5F528E2EBDA0C32045F2A90361AEA23733479749F168539DE860146FB9687EF7D0F2AC8C5DF48A3C4A5D44CA2F464B92BBA5756503672184A48A6CE33D5336BE21DBBF177DAC7F70230DE92EF9AC6E510537F7966FBABEC20CFE0E3A7009C8BB54E07AD7B3B4320ACB6D9425467F83D1C9C263627835685A3B2637C1D199ECB1B4C6C2094FB338D4A9BF78F599A533F0B115A4EDB9F58D5ED0FF59B8B2FFB02D1B7F44119D7F0DF89B05BC1772E85555E8CA00D38F95F62298455B6EBBC502ED3C5EC0FC7051C58317B3ECD7C1B6F1DDF9203C98F901423F337C81FB02663D06161271247F139944D6C38C5EC86EA82A542657838EFF141A1CC0BD88511D57709F751F7B2CE7CA6CCF57C9BEE805B81E553C9322348DC35D9C09AD45F167694ED753FFC8D9D0FA4DA6EEDC97BDADC4F0360687299975F9798F70F8E47D40B94039CB416A08FBEBEA26FA87D32621CC509472C19E8A7D83A00C82F00A6A1962CCBBC6612C8CA884DD88F3B0112CEEC63EF74138E53FD14DBA053B7BB39DA8B0D43313D18F75F5E6AE20895BEEA14E7FF3E94C504D5795162CAC8B168A2DBDE89F3AA874F4F9287DBD34252BCA7B3557C00E191ACDD44AB8ADF8931FAF6E6336E4441045
-ss = 5C32A0ECC8FD7E70C1B389FE25C91899C37CE4CE672E299A41C7732F4F0D03B2
-
-count = 17
-generateEntropy = b12f6fd965ea9c5b947db80fc60c83d5e232dca82e7263027c19bd62e5a6ff550f6aa3e88f7fa8a96067f8cdaeceeac90c2d0b5e277e56e9c405ec9420c30252
-encapEntropyPreHash = 34f44ec2092eeaf686f2ea170591a98527cbb03a4fa9477a7aef6b41a54feeb2
-pk = AD735E9E838DA63AC7A3E1CD3E574DB17C2601D3927CC2A9D228A05F5C1E51A63634383FF5E03151F43C66A07BE9E992AA65CA4CA17B1E021E06B261CCAA89B12A4916A5A4E39826A94C86BCBA9FC7D65FF04549DB70B300B1CB280B3A41E82B6C8B0A4A3C5E40EBA59FD18F004CA3E4C15BEDF22E099C99A3D114EB0C5988BA02873B9581107A23E54A8E51AE62375A887929F7333D4D763E23B20A246785E07700BB16C531692531433EB6A6594D1464BCA7348022C1D4219CD8AA6614862C42376C3A0C4674181983F2A2CE8B7F32659AE87ACCAB6023938592E188A3C1015E98720EACC9AA837A49C4617A850C89E1212478F3C6BBA51C30A64A8A1C225274C92EA953872342A96CA3235CA7A9467BE55250796126B30694F71B2F75B56D84AC89C4B635118145C7B8967DE515ECC719E35804194B7EA9304636283CBF72339474CE1DA00106110A596725574747DC07B3F0C7C527ACA703CB23BAA080BB7A4CFC1009B3E5AA89659121E365FD6CB6FD15AFED70779A978B3FF50F915B6C16A350141721EFD61085189C3265530C1A17491B317031B4E4667EB8314AD34CB7DAA50566A9812377CF24076FC3DC748FD58865B1B02DBB831B25B7B7383579376FDAA6C8A5323230025A4BC66977F6A458374FAEB14E47F70E654C42C94A5FC5E386A57ABDE3F29349623E4DE92F900527C165870FCC26A2F95FA1850F2C940FB7B87686E253DD54B6706A84A0C70E3AB04CA8446EFB77609E9815A261AF5A135836064D44A485B5E850F10153653838E5874B76568516E847A2A9B186E8A50C34C2D2B0839EE58024211018B0A13FC781623CC313B30C26A258106941A66B3CD9481ACA7C7E3CE3202F098746C42C58F4C7DBE52FB5F606FBF31B9B5022E691CBEF1464F6942AA503147EBA081817AE28581ECDD867A96195DB320BD2D91C36DB01ADE9AFFB6B00F86C13E2E252C988300B05AFCD007470CC3022E96AF0768DBEBBCF62B53345B213C1544491F1BC75BA96BD73BE57A2CD6874511B44BF2DD27F4FC87C167815FEC59F7A043F699BA4D23400886A7214160C23DC96056BBCC7007A0049435C534B66971E6E5C90EFFA6645C45031C0C905B9887700181565B53165BAB605A51BCACA0DD0C308A46432794C38F21E04172005F4348211C63A40CFFD7C32BCD57FDE852FEC793CB7013E74504721F6BFB7637F73319F75B08E3C25777C969C6EA000C9B79D6F16A00CC4B00AD7CA4F8704B2E54D9D27524F6B80A6D51F85447B22C29AF0036C6BA486862C8B4FB03F26042A0E195A3E91BC303770AC844E77805E41EC6ACA920FF3A1A3ABE81B598C193723B20C8685590131DA89C0ACE08A592489791911C92C7E6ED55F642CAF918173F190B2FB8CC0CB2139FB6CAA259B5A4634CFD0A532B719903E32831489A2D390B4C5A5066B4AB5A3316441B162407096A0BC0342599804752FD4F21C45923705A7A04012AE4A900C01D584F9F41676C36681994C2F4037BDFB84A69A81FA561E5BE05777B571922988EAC714FF249926FC9CC4E93666E198308A434DF74DFF3C5A440948437A7C500582124574AE225F52D322D0909B5E946A5E22AC8F774F69C48B7874417BB1C0B93CC0A90D2A9640377808CCC2673495C4839FDA0D1038B27BEFE3D22E2B727A
-sk = 87C0B4D44CC9EB48C126C5877FF87929B08485FB81E479139C3299C70C43C3FC8C238A81D4E61E62A33DB2499C866B7107D116B7FCB1B0530A7E758A8D487D11575079265B3158302A23732BD07330071BD7CB7199476C39B583A2446109E99FD5C95BE21A292CF37490906E84A82605B8455825C82ECA4B7E218644460CE581214C78AC4473688BD6A9A826217490AD791B7835A85935782847981CA97B6DFE88B63701CFBE3929A2DBAB1628155506C353639D153656B90C5AFF36BAEDF1B87DA5BCE2A108FB6C3B29E77DAE803A0DCBA48AC6882F6C1194E88387F30A47C27D02C37D988346A2A29584A55CB5D3C44C05A18619A4FD412BABC31A046221B3994C8F22CE272C9E6E948C3D043295F413349796C38911F8DCADEAE47351C15E9A1743EB65BDC7471F37FCC93CEC867CD4808ECB281FC17EFD004DD64AB432D664864B43F8A9B1E763529AE2C413ABBCF30A4A478A30A0104D802037C4A8AF01B534DD600E31A1630FF13B2F730924CB790166AF3B7322BAF4409CBBA500C1BB32894E65445F04E4B4B4933DE51267635037FAA44E2775CAA4212F4E0600E51069ABA662C86145E2117347BB1748D63E412550C004237CF02B02AABB18D8533D19B1A879A079B31D529AACBF5258483C80738B380C83119C12B23CDCBC7D027506F3705CE1316DD24594A4BD32D10382F8AB47478F23763898398D7430264203A76B0C4455237F3E765EA5516388595CE9E2BCE2DC2258B5B96C782865FB5354427A2D7806123B0CCA782B1C329411C6C133934BA4A959DA88A072BC6E2D63A007572E36B82C5643564BEC47BC8953D4AAABD146AB5EB36E33F825FB9CA01E223253C320F76C98F810CA52A2C604622F7A60378809A59B19680AA69EED2003E272B8A1F3C8A55BCA129640C5A00D187BCAF465204C73CEE66A2FEEA414F02859C9988356D26665196674D25E64CC5689965CFDB2C0E47A531CE32B3DAA9C649954342A3F62253FDF826AAFCA7DC85A7A8E15161435212D7A4A3BD4B57A2CCCA3506999D407D9B6ABCC97209FA97454B0974DC2C7CF3C3FA40306CD6239DC450536974A8AB773374504B9889CB42BCE4EF4606BDAA559346F18D087BF8B7F0D9B21B0C9B75B5903194B0744A1C47483488EB4C1CA2C83D8198CC6A523D9329F6582863CAC2951268C01770A8081C1C26587D7610088E6068E020E10472C825C395AC6783F074EFA8597FEAC3734399BFA247E4E1531EAC70FE49355E44B3BA5439EA1E65EDA94485FB710124BB968490F1C8B68E87A4C4682156FC06A33275B6B202AA0D508B3789AACA627F0F0C19026CEC38A95F7547D936B255BE7A7525C97AB4282714C32A23C4723A82298F2CE90FCB4761B9EEE869E4D3484BA2B222DC28BC612B1F41607CF57781990009F29617549C0B2179705A34916DB154AA3747867C3EF6A0693BBA5C1D42E14B3247B41059F92607A60AFCDECC1C6F3839DB943F5EBC4D340AABE21269095B3F7D9BDE9EBC21DE788794B63E1098CC2903A83CA2027E8BCB78B855FD56FCF16B45E47994AAC71FC815C521AC1A1B697A18569AC2816F52640CF9059C4EB95E6FA1B32B77BD7CBCB6AB384DE74B6A2708400E980AD735E9E838DA63AC7A3E1CD3E574DB17C2601D3927CC2A9D228A05F5C1E51A63634383FF5E03151F43C66A07BE9E992AA65CA4CA17B1E021E06B261CCAA89B12A4916A5A4E39826A94C86BCBA9FC7D65FF04549DB70B300B1CB280B3A41E82B6C8B0A4A3C5E40EBA59FD18F004CA3E4C15BEDF22E099C99A3D114EB0C5988BA02873B9581107A23E54A8E51AE62375A887929F7333D4D763E23B20A246785E07700BB16C531692531433EB6A6594D1464BCA7348022C1D4219CD8AA6614862C42376C3A0C4674181983F2A2CE8B7F32659AE87ACCAB6023938592E188A3C1015E98720EACC9AA837A49C4617A850C89E1212478F3C6BBA51C30A64A8A1C225274C92EA953872342A96CA3235CA7A9467BE55250796126B30694F71B2F75B56D84AC89C4B635118145C7B8967DE515ECC719E35804194B7EA9304636283CBF72339474CE1DA00106110A596725574747DC07B3F0C7C527ACA703CB23BAA080BB7A4CFC1009B3E5AA89659121E365FD6CB6FD15AFED70779A978B3FF50F915B6C16A350141721EFD61085189C3265530C1A17491B317031B4E4667EB8314AD34CB7DAA50566A9812377CF24076FC3DC748FD58865B1B02DBB831B25B7B7383579376FDAA6C8A5323230025A4BC66977F6A458374FAEB14E47F70E654C42C94A5FC5E386A57ABDE3F29349623E4DE92F900527C165870FCC26A2F95FA1850F2C940FB7B87686E253DD54B6706A84A0C70E3AB04CA8446EFB77609E9815A261AF5A135836064D44A485B5E850F10153653838E5874B76568516E847A2A9B186E8A50C34C2D2B0839EE58024211018B0A13FC781623CC313B30C26A258106941A66B3CD9481ACA7C7E3CE3202F098746C42C58F4C7DBE52FB5F606FBF31B9B5022E691CBEF1464F6942AA503147EBA081817AE28581ECDD867A96195DB320BD2D91C36DB01ADE9AFFB6B00F86C13E2E252C988300B05AFCD007470CC3022E96AF0768DBEBBCF62B53345B213C1544491F1BC75BA96BD73BE57A2CD6874511B44BF2DD27F4FC87C167815FEC59F7A043F699BA4D23400886A7214160C23DC96056BBCC7007A0049435C534B66971E6E5C90EFFA6645C45031C0C905B9887700181565B53165BAB605A51BCACA0DD0C308A46432794C38F21E04172005F4348211C63A40CFFD7C32BCD57FDE852FEC793CB7013E74504721F6BFB7637F73319F75B08E3C25777C969C6EA000C9B79D6F16A00CC4B00AD7CA4F8704B2E54D9D27524F6B80A6D51F85447B22C29AF0036C6BA486862C8B4FB03F26042A0E195A3E91BC303770AC844E77805E41EC6ACA920FF3A1A3ABE81B598C193723B20C8685590131DA89C0ACE08A592489791911C92C7E6ED55F642CAF918173F190B2FB8CC0CB2139FB6CAA259B5A4634CFD0A532B719903E32831489A2D390B4C5A5066B4AB5A3316441B162407096A0BC0342599804752FD4F21C45923705A7A04012AE4A900C01D584F9F41676C36681994C2F4037BDFB84A69A81FA561E5BE05777B571922988EAC714FF249926FC9CC4E93666E198308A434DF74DFF3C5A440948437A7C500582124574AE225F52D322D0909B5E946A5E22AC8F774F69C48B7874417BB1C0B93CC0A90D2A9640377808CCC2673495C4839FDA0D1038B27BEFE3D22E2B727A2006A70FA33FF4A65B00553734C5BD8CCA0A65EB3A115D96B8AA90F8FDC5F8F40F6AA3E88F7FA8A96067F8CDAECEEAC90C2D0B5E277E56E9C405EC9420C30252
-ct = 8B6066F2A728AE7D0BC110336DCCC3FE0F6357DCE815FF647B494FE508C69A7ED6E55C11453DB91AEE3BA1C211216EDC8DB6A45EE71552A75B6B168FEB3FB85EC871C7DB796DE7BAAF09511EBDB584EA318A07A7121B1F2DE7A99A08A0F9CFEF11900FC897DC8B315BC62DF134D054E053777E39436DFFCFCCC673DBF48440276467329301CAC24DB50EB48BDEA5085D50E40E7D2D34E0D193419D423DFA565B0B8278718EDC2839B764F97C796EE6C719285BF2CAEDA377845382E29B614CE12D31702D98B0BF73CE2B695D407BEFCC62B69634CB5BB3803251697C1660B1411C475C62AAB58F5AB9BC4C8DEC50921FC21452E08B27095A8D87FCD581CC81C223A5AA2DD679CD19F87127065C1368C8B29454A9351A0B17A85873BABA9132D4F905DB6A15BE3EA0E61DD4BDB7C506E7014137EEB3943794F5AC765103C9F2C596401CF443D0979557D15F930580D34DB141403E278E2B79E4E2BEE3CB69F1187326D55A584DA85C98A300931E0DEBED6CB3C200ADD1CE524CC7230AF50A93EDAD2707E452DCACF7F81CFBCFD47CD9457A6A713E1FD9B8F8DAAB5440A7BF30E10A244238D02EBCED353667C1F5EDED23E1816DFC8999E46C7E1CFB910BDC06388D12B9C7F32D3611A7F7E38AF8EDB14E2E80EA10E9DDD676FE4D921B4E24DD175CA69D82EA6896820F5311447AD8A37774AD535781AF80F98B89F982C3600EF2101C8527F0B1DC2EB39F47D21DC7112D9F6E96D6D74FFDDA89F3E1B0CC0CD09C2D1061D0E2725A30F88EC62D95633F40303811458954A0178BFA7F7F9D44FAD3607D96475B0BE47E3182216E561C2CA147298D1EE0F23884E658AE146DAE13AE35B8C4BCB6006279955088AA34E0E31284A39AFC316E5F83B05D2271FC3AA5172DC29B751AEB2E854691E5942012B87C2A5C7A0D97551D77927610C01D60CEDE43C4489650A3C4BF1817B12C61DB829386EC110431DD09CC9127EABAF96673B8795C8AE2BD97DAFBEDC4E4D726E90207D43402A761D754DC0C0FEF6403C23F0F8249E8AB153C768B1A42EA982433C45141853A4755D93B62A9DE2C29D83FE8262B1D8D0D6E7E918FF2C8E88CF20705701C8A86A9986E4BAE2C697F45D4DBCFAAC1F11F11A2A1A728F44D70D31F85CE8BBA588C095ED854DBCE17C6751BFB2EE1A86713A796D968BB0271293C9210B420CE454D329EEEA558DD60052466B051477D25152F6BEA1E04C521FAB8D00BE3B0C5CC166FEA82BA49773BBDAA958C5C7E8F50BFB5E345C29801024C39E597F66AC08FA1510FCED31E21F599097F5FCB604B88E3FF893FFFFF9F81AF2D5E1CE0FD4BDAB7A541FF7DC9B55D0EB4D54EADDE6C5A9D688A3C2851976FF51FA915DB037155BBE715F0998C17CB2539AB0300CDA62A0F84817259B2D64DF12AE065CBEF43648F5181ACDCE5B434877F4F90E95E19D5ABC106F568F1B4C48305EAD8A35EDDBD35404E2D46C8ADDD2CC4DA632F2BACF96A0529BB37EE7530739154E01F50116476333D4D0EF1CBA1A85E4338896B
-ss = 4FC71B4D0A7CD5D80824E137B93F8356AEDA6A13A55C0515AA74EEF21447CACA
-
-count = 18
-generateEntropy = 9f52af92ca165fdc38788f2b59ba02e01c8281ff7c1e60504688043a5fe814b04f3029e1be4e1c0258c3a22ff5b50b2674cc094ba7018da2a61569845c17d26f
-encapEntropyPreHash = 6250c81126572eec2da330271db36ee591f060fc7e53eeefe2e1c476c675fa33
-pk = E0B9190B548BC164BB826874C1800980DAB529866B951C01C20CB4AD363C681336B13105FC338B1788AFBFF321BD981974C33D98A35666EAABE3612E61839D6AD65490D71AE992111719AACF12A060648667E34D09343D93DB88ABC69E0E098A63749BDAD39F8C6B93D75990B0731621CC04E6E2061E93CC4B51209EC92ABB303BC638C52AB2AE40D746CFCC43B7576A240540BF410C14744F80A442D0555D474192BCD9B187A56691B63965973C7793668682852F91CFBCE70D6D4832A1855CC4B83A847734C24019C508B2D29539FD1A114F787285E197B51BC092F80B559446F1076F02E984A1B27CAE7AA1D0B50967939AAC74CF2335AD421021E3225D94FA3B09148E60C20E8454C68A8022043206B7BB1E799C9B69286509A188DB29A9EBB078420A0844C858CF4B11F9B4959934002BE0229E714350451B9C2775A5CC8C45B07E121290EEE32A73D46F8D7C55311A8C29027356139F153CB405FA14064C5C31060D7A964B33D76BCD4809D21B34A2F7806486BD2835B7F871164AE496D4264F89FB4EB15B7E5A7232B6C68B11351A41B09BB0C92C8437534D2B4C0CA2538023B29DF93D93C98136780FF6F82846CC2868664322AB28DCD7279F68994BA5A5ED406D4D717D16C14DFDDA58DB1524F7C53F3CB170D45A411B07CD64F001DAA0AD1BF63A11550C0C154D20F5096DB44D1AB0A1C9D66581891A9314C18F778330A0936E7A2F3E19C18F7BC87CF078627770DFC5A2FE71B27EB8276863C3295C11E08703EF4A4FF6B3A1871C7B42C43A6EEB6BD1526AA95B7DCD6B38EDC207C630BED1768CE9505544E9053E5C8CBF6A181A1A0F48C8A98B59C3ADEBCC3A5C99E61588834024CFC71C9DFAB1DF558711B311404A739F79B45B1A8A7633081A27A08C3C16478C9D24C1229723ADDCEA225D39BDE7851345B18B1B08254181B01623347A9A57F5D902290B10476083949556663309059815626C3CCB5302B978B2CE82AF231934FFC7732352B990B21B69210F2ACC048387B95C346974C2181148078154416E08564D664DB3045DBA82C9A7934DE51AB5C1D7346A391BACA48209C8C7235309943C1CB9CAB4771C7EAF59321B510D430C88473AB16F54AE461A5DC613C6FEC61A5E899552E835EFF57FC34B7992755D178A0365C52B3F020AB40020CE21B45717654634606DFB2917FCC266193E2E5B2C4559CC5652AAD1121CCA0711E26C23EB33C1F7D389F2D742F384725D3268F8159F8C463585998289E58369FBB883CAAE21B87139E52D7EBB92B011CBE6426390458247C45F06F2519AB35B35675BF93325351617AD3AC470F73D3D3985E10277A647C96A6C56CC2346563CC496DB232FD742AEA3ADCFBC506CA8CBADA7B040A04F6E329FCEA77BEC0683E1A87C396113639159D9CA52A5A5484D2839869A2E80557A6BF7CE2EE295A464AAF835C542457D021C65C2B2A457C771FCC47F8B1056C8B7AA61D1843A40C4C9B083269B2E89FA3BA5959F89972805FA4B46E35ABEF0C57D875C54804DE77071F1219195BC8B4F7C18A19A7953573E7F4157CA03BE2852461A784E736110157BA3F83A6947AAA09E9BCAE730B9B212BB837627293A485ED6B42CA1CF26792676C1F4BEF1609E71524B877F53FD3133BF71AB13912BF37C2CD7A359EAB035CD
-sk = 4DBA785B32456E16A8E9A20FA7536F1B4555A9B403A09738657A148361788D3C358A7BABA8B4C58AC979C4F786E588AE245CB0C12C284F848B89585F76892FD65CB906D39B385A04D2F5B2154ABD1E77AD9501ABAC73237780B33C601FAC50BA3FC07E8525819593B7D7E69FDEA46F14F1128A475E4784AF38985501DCA6D20BC8DC1C5C7740B33804358F71B6E97B2A0E7350F7608321736083DC54E0253C6E5C5665D0B7E68355D4E98DAA753C1ABC1429B397DA773B043459E5AABD093A5B0210502BC2CAB250041997861286924AA0A190307431719588CC2E6FB68711C964FC20393C73B7C967C603120A3CC11B2EFCA3DD6616D0E2C835FA92946A40C4CC2F4655301ECB09424286B3C7A07AD3C6EA37BF6132AAE2D9A335E34B6C816D93CC7EDE020AB723B272B70F494834CCD93BD7800BC39919DEA4BE4C585F827A4351E233026760DC83377329CCBFF180A562AC50833C0F861E795C00EE74B584F693222B28EEFCB445F19B06154ABD0110C6A017ED525B5FA30C64E60663573B8691BA68E2BC580157F1C66EBE388AA2747C50919AF644ACD903A801A5C04A6A2EAC686C89835CF59A791AD5642274A0F78244491670C66C9BCE24BA5CF6B86967AEFE6728DCE8973FD29045DB844DC80022297CF530C8ECA4808F603A90A840AD70A803E6A0BFB44B38616816073C5D7BA26A64048F81A3BAD3A0C9CB0672C7466E38824529298A7C0D82940540C312F429411B403F64E419CF720E1F73026184CEE538B27CFB91F16186DCD3904BA6A34254155B3CB3157937D5618568F46F283C7C0E88696324A4FD77C3E6FA5B5DC0A13116274E5792FED69EABA973730A79878103BF63934D179143DC23ED39585D40C06A99AEE0F4462F123B8A6B539DEA9E05117B08338DD6754398E7496F612B4D892CA54A13EC9B2DC7022CF779668809AD6DB97A6E8B15FF0A862E664D292C4AF549195A23C19E2B9FCDB9B4A5B9AE517873CCC644993196DE5C2716D58D50E7CF11558F44A16580C980654C8CA581671121CB2F8CC6F90529C9754CF0700B30943EEA1A7B05F0BC8FDC1CF776B0CF2C2EAB927DC83197A4071DABFC07F983BF4D2C613E087976ECCAAC031B88420CECEB6DF0350F04BA61AB39CAD4C6B2B32503D773A34514B7D5BBB9D5E7BB6DD9AB5BDB8F34A9880C49AB5C40970C435508E26CBA50705C6538686249D344BDB7C820A5C8869B371B8FE13922A5AF390BBB7B809C392266541671C75CC2B7A7248D0234FCA16DA64265E5C70257D770D2E9982D5A1C6D19BF0BA48B53AB900FC8280C754C14774939B83C63592A12F35D198194679942EC227B46CC8F353A0547E929175C3585107239AAAFCA151DF3C835E770921E5C9B134CA7E27A18C7656BFD6A4FD2431CE1743576E575DBBA8905F4CC38108E3CDCBF0155B5300A100958AA99940BCB473EF64B05BAF55E91952C46851D313B0990EBCF2148CF28130CF49C8D080841FB81384E73367C792A11099F5B898416946826714E252457B23A3A1E33A36EE2612372CB2C04030840A87F96A31913A428CCCDD2817B38372DA4637F46044F2218C28D525A57D9C0CD2864FD43AA5C9A003A09A35BA786A7520CE0B9190B548BC164BB826874C1800980DAB529866B951C01C20CB4AD363C681336B13105FC338B1788AFBFF321BD981974C33D98A35666EAABE3612E61839D6AD65490D71AE992111719AACF12A060648667E34D09343D93DB88ABC69E0E098A63749BDAD39F8C6B93D75990B0731621CC04E6E2061E93CC4B51209EC92ABB303BC638C52AB2AE40D746CFCC43B7576A240540BF410C14744F80A442D0555D474192BCD9B187A56691B63965973C7793668682852F91CFBCE70D6D4832A1855CC4B83A847734C24019C508B2D29539FD1A114F787285E197B51BC092F80B559446F1076F02E984A1B27CAE7AA1D0B50967939AAC74CF2335AD421021E3225D94FA3B09148E60C20E8454C68A8022043206B7BB1E799C9B69286509A188DB29A9EBB078420A0844C858CF4B11F9B4959934002BE0229E714350451B9C2775A5CC8C45B07E121290EEE32A73D46F8D7C55311A8C29027356139F153CB405FA14064C5C31060D7A964B33D76BCD4809D21B34A2F7806486BD2835B7F871164AE496D4264F89FB4EB15B7E5A7232B6C68B11351A41B09BB0C92C8437534D2B4C0CA2538023B29DF93D93C98136780FF6F82846CC2868664322AB28DCD7279F68994BA5A5ED406D4D717D16C14DFDDA58DB1524F7C53F3CB170D45A411B07CD64F001DAA0AD1BF63A11550C0C154D20F5096DB44D1AB0A1C9D66581891A9314C18F778330A0936E7A2F3E19C18F7BC87CF078627770DFC5A2FE71B27EB8276863C3295C11E08703EF4A4FF6B3A1871C7B42C43A6EEB6BD1526AA95B7DCD6B38EDC207C630BED1768CE9505544E9053E5C8CBF6A181A1A0F48C8A98B59C3ADEBCC3A5C99E61588834024CFC71C9DFAB1DF558711B311404A739F79B45B1A8A7633081A27A08C3C16478C9D24C1229723ADDCEA225D39BDE7851345B18B1B08254181B01623347A9A57F5D902290B10476083949556663309059815626C3CCB5302B978B2CE82AF231934FFC7732352B990B21B69210F2ACC048387B95C346974C2181148078154416E08564D664DB3045DBA82C9A7934DE51AB5C1D7346A391BACA48209C8C7235309943C1CB9CAB4771C7EAF59321B510D430C88473AB16F54AE461A5DC613C6FEC61A5E899552E835EFF57FC34B7992755D178A0365C52B3F020AB40020CE21B45717654634606DFB2917FCC266193E2E5B2C4559CC5652AAD1121CCA0711E26C23EB33C1F7D389F2D742F384725D3268F8159F8C463585998289E58369FBB883CAAE21B87139E52D7EBB92B011CBE6426390458247C45F06F2519AB35B35675BF93325351617AD3AC470F73D3D3985E10277A647C96A6C56CC2346563CC496DB232FD742AEA3ADCFBC506CA8CBADA7B040A04F6E329FCEA77BEC0683E1A87C396113639159D9CA52A5A5484D2839869A2E80557A6BF7CE2EE295A464AAF835C542457D021C65C2B2A457C771FCC47F8B1056C8B7AA61D1843A40C4C9B083269B2E89FA3BA5959F89972805FA4B46E35ABEF0C57D875C54804DE77071F1219195BC8B4F7C18A19A7953573E7F4157CA03BE2852461A784E736110157BA3F83A6947AAA09E9BCAE730B9B212BB837627293A485ED6B42CA1CF26792676C1F4BEF1609E71524B877F53FD3133BF71AB13912BF37C2CD7A359EAB035CD631E1DE2556AE65D57E600C21E8E355A4ED586D667177CA0B7545CB5A23D669F4F3029E1BE4E1C0258C3A22FF5B50B2674CC094BA7018DA2A61569845C17D26F
-ct = 35B5A9E583FD8BAA2044FC15E93BE2D0D1B199196F10BDD90D274C4C56C3DAF791A9CBAE48772EF76AF0C325C7DD84029B2D44B4676558A5A409F6E64D3538E9C7F6C39A19CD737916A1C4DB7DF79AE1850A0F3EA6DF53A956C93BBB5AB3D5384AAC5030AAA99111B17AD156A9307004AB9C3B1C7ADDB735A16699C0A7FD69CE08C244B6258CE70285F56875AC2343A18868A93061DDA2CFE9E6AA2C0CAF7FD0EFC593D9D06A4F6861E0643ABBC0A91E71CF244384F45E7D3DD88A27887AE4695572E98506DA6E32DAA744AD32F0A44A7679F3F0DC7C868207AED7BCD90F62F36CD695B6B4786C5290D74CAC91A28A0D3EC3D6CA53A7DCDD4353476E54FCDAD93E21C4F9CA58B069BF5BBD9BA268B058875FEA449E68B3F93839C1B6FFC1B095BD0AA6BCF24BC5AB14FB4C8B975E701CA0190F9381FC6D47207A53F3C281CCCC0145748222390F364F6F5444614325AB382B3F7EB659EB61CF2360270269B93EBE68825EEE071273BC880751548C281AE9D94EAA1764CE70FE1857E4315C610D776BE9DDC12E6848E09192E5A7AABE46BF12A268614D138557630737ABE83ABCFBBA6F886F5DBA7D1090854432BAFCFB1A61054A1F7DED94A9B1E6C1DA0E6ED87DA24ABFD24A61339F8241C87C7AA8927744137EAC239190267B338FEA6F3F564B0E30F0C08AC24D8D17C6A7C748695957680E775F494CA2472614E5F6B6B6C703673DD9C93FAE721292981A45C714E9E50FC0FCB173D5A92D52167695E4F659A5BBD6920F61F5FFC6B63E0608689D85A919E1544EFAEE4E2525B4A20B1B89FB4D5A20F2B2FA389196EADA7F12EC01901828EA8D726EAFC62420BBD9074E753559361A9CFB371D459AFCAA3F11D893B5907688A12A99FCCBD8F390EA00E4ACAFC5BA86BA6D735045CCE689CEB35B3DA81D6F21CD8E6BFBE2ECB870DF4B3AEA67948FE7426471D3325A39BB041A0974C8768D832398B0EE9273F1F488A0D8829454E17AEBDCA048B7B3014C5C3E93E5BC15317DEFDAA4DE18094523B0491A3537896689027F57436557F65D70A5440AC28681FA0224DE0958B60DED0A4A6846316B8DC836BFE99855AFAAFF6A4EFC9A5149610D0E1C3D8FD8AE4E7B489734444258A30F14681D5DD3179F530E9C0A5FF42100AA851707E3216FDF5B5DC42C0DE6EC2031E9DF703A6BBE7385396C711218B445CCC15B83C1FC1E19AACD8507A60034BE48C59C23C71EF836A7F4F05A07DD953B6DEFD09A7ADD8697097123A4DF8EF6ABDCFB74F9711E8F2719033585D63386F32CA50F72F833FED12EB70F2C1C34DC7F26205149D68652468B7D156C3B957F64BE1272766FD82725BD00BEEFC5AB6F52E0740F7E37FCFBF0D0988EE07435B41BB58DCDEC0D8B0C90C43DB5130A153DB8994A1E54EA218668CDB2C42380FE4AD204A910F0AD61777CA661B8A68F43808235C01187E6101131A32DFACF091021F9107B4964A55A3F19CD55218611AA5C479107A4EF33D76B68B9809D4CA773C4CE0347C64D13100B44A837AC87CFDA
-ss = 5A864018C4C8C17C01C5EF38D7154668D9099994D92ED2EF55F02CF6B3623FD1
-
-count = 19
-generateEntropy = 851ea90fd3854cbf28fe39fb81f68e4b14345cf0d6eee7ec4ce772513df8410d1c0ec046899a777655233e4e1b5ca44e9afbdc67964bfd5d5e3dbb45e60d03cf
-encapEntropyPreHash = 35d470bcc5880872754810dfb3f2796da2fd7f397537146f6488c27804072b34
-pk = F1390E49F3B488AC39D0E43292B70042C52355EB48B841887EA256055A688FCAC5A71C896414CE75F57BBA12967215C50D4B5BE692B6DCD1AD2190A3D785C19E283F87F784A03C8F52A23E150734FDD7BEA2AB6D122C928606BFB60570BD696D9676397AC3AA1D062EE1AB3922A2C9B5B02D14557164149C62E8029B139E6950B3F8ACC9E8C30274B69926C1658F7836F479C8CC70138B829848C7698B179643B7550E9193D6FA87350503C2B69136B08CC298B5C335B1AB95054D13C9260625E34C6C2FB8186E1916C137AD9907C8B2AC9D88FAAAA0375236751A47918F96477B7EC01819F8AE1D72951E21608C87532A9428BDF4CB5658440CB025CE3B271652961BD935624B9EB70047E63184B9503ADCD057B6744FE42908CFA325E401B9D0DB5ADA201F5D64350D392C4FB842823895E15720DD7785C7F5986F15CC2565A71F6CA11B854A293C9CE6C9A1F4AA3917130308F2A2ACA964790BAF960AA12DE3334D146E64DB81EF09563C9667381424C809441EE989EEC93597E7C5B558A89DFAA976F6934CD18B8EACB6F2F54E8F748E4BDB69B0764FD59352575066DC242DC0F1356FAB4467C8064FD23F8823148B77A4ACC642EB2C181FD5CA251B323561191CB15F2FF0784900A15F67014B518453C4C3663528FFB53271E195C27533FEC8C3B159AC1BF39C6FDC69DD5A5FE5872FFB6B2271A09966A5C738C48E63E141D65315051610F0F5588AC97F14100027B144AA23774F199D0D9A122953ACA8782A4136820FFBCC1F2692BB919B674AA1F4D679E8418E8597C74D60C5C287CDE6D44492411222636B03CB661AD66FB442193690A5F1D6B80A947442A46BDD239FE3989E6DA86949474E395056A5E6CB42B25343A7C73B650D843527444243852518A9034B9EFA7A6BB8505BF605EC238FFBC08CBEE35A94845D7319144B381819D0928C27023B727656EA843140649C03098FE74C717AABE91948EA7698DB0A86D34296B5E50DC0A9949C8BA07F64CE60DA2B6E62458DA229D52C08B9B696A124A8CBB791C0D255D3E4A69ED2C242000DC6476B4555552DEAB63EC19FE8783151DAAF78E561E1844886D4418E7510BD025299B1C83C7BA22F63335B9823043336DA897A44FC6A28B44C68A49B436B0DFA406BE642A5BD303BB0D633685364D80440CD7189B6B34F6535101979BA9D251474FC91BF2497670BAD0DA78AB3C13EEAAC864572A2F919546A57C719BCABC9DC8215B492D53118C2D379E879234A700638370A530577700982C4334673AA5D71DB98627384E8CA876E24B5A31575EA3C334D3C7D3ABB6D8891B4904B8F5DB93D0531CAFF25BE53E28C45C94758E309B83ABC2BA66D98D3BDBC53B7D06592F2712663C777DB60AFF496A217E82D8272C3A218AD8C8B04AE7C66BE35C08E3A955FBC18EDD07E8E68A806FC3FE218B87F87BC332B86C2625D8FF01C9FF6214B75A20CC465F847511030B47EA664A75B3D4ED9038A9C747C6872DE0A57F3B76C60585ADE64570A21CF8548A5BE4996BC22B3D16A7BBBD20149034764B820892B9394581697E39F9B35077EAAADB06702968A5E5418983110A97D4749D3160DDB2B9C587767FB56B9ED9BB3D91CBEAE141769C2128E0ACADBAFD72FCA96AED457CAAFAF51DC8C30CEAC70CB4621CD4D7B4C
-sk = ED55584416844E1CB3C75ACFB3771013D1AAF1FB3CA8A5B718A8CE02A15AE26BACC7534F8B084A665B0608780E532A161686B07FAA83884C6A0EFB490A8A3FCABB50ADD21F58AC43EF4355246B1A661C5937562FA6067E7AA66978E4B36EA1431ED41E4E4282D4003D5BBC06CDF7AF225B6560C44F43A278677ABBA8C6B79741B3CE7C0D0769AB407C9B39C032F0E42D1866ADDF2115E2F3336384C61CE9319CC92AC1350B264CBC4059B94372631C8241CA376AA6F76111537018C01D1346019D628F1F00CDF828B48C47CBF958989B846ED893BB0B6444BC2A35C6443F77D757A0CC957716373460A7A94151CC548F0C78AA5A323581C192D00B4D96219806A04B1A0AC829002B7FCBC8CBF8A8E3ABAFD3DC2164D03A24C19D50133E967C7668AA8B81977B400067FAD2CA802A76716B95E3D28BE5603E4977C33D3BA5DF2446F6265827464641204ED972286B58567BA129BEC0CD6F1644C4032EDD6239309AAA259A3D997B1ECC535F17D773AB1C5350E3C82C600175269700A56B0D4211DD02C13D4BC7C54238F40163441702613A1DE34BA9B0B42EF0A29300098667E8003588577E64B031139DD2180DB113623FC4B74E946EEF86A1A6BB52764C6C12911765E37A685400888AA9140A3ADFC48712688435258D56337FB8D8A9E1F34BD2E818AE3B7480F500FB6BB03BD50019C33BD37B060BC2C45E8A2267D18927C0AF66076619889FF6B1769FE59E5F131F5FE40DB2815BB6886B7BCA9DA659935DB493DED9A808157E4151B04C153E673333424B7AA939559E4CA973F7644A813B8D9C1DB8C87CAC6365C0E008E329403C69490976CD3F006F3138114A6B3E6B3C4F054451E5BBCB7D232F285A2EF5202B81740053512F8E4B33FDA87EA61042D1F9736ED58E9047C8744735A728B636DBA7ABC33B2DE0B1572A28B23C25A8668CEF9291990A499BC8935F955E1CF0301A65BE870B7F01F06099192431F3436AA5AA6564C4689C1D2E11540355138C91BA6E0182B6DABA0E7A177FF320C6B04977D47DA0D51672EB96CA054AD2D4A0F72930061775592AA40E9C9418CA611893044460495D8A46B242201886CB52E38D91D25D7FA8262290628D91323DD2A51F8C7A33487232F4934133117699028381751D8594FD94910EE4115389C57262BA579220567A7B5B42441A641FD6630D7BC06802878C76BB9EA576965EE45ACB90BA549A01B6E873A1D8C741662067A116E64C8897E83204170C9BF2676EF60C20F3450804C7A1B80725DA17F9DB18F715B7894CCBB53321CF01755D168D19A96356EC07EFC62D9A8C3A8FFB15500433F915137AC42A474B8E43F283BDB2B46CD62D509A5AEE8CBE23B74CD48079D82293BFC9CD931289A0AA27D8A930BEB2000ACC2019E3CCE107A18E9C4408C516FBE19E45459ED77231851B88B6B73156EC820A4C097072C2FD61C83D23413AD510662894DAEB238992138F98185042B53A637AEFA83378B026FA7BC314516B25D343F0E0AA7772CD2DA27F8B39A8BECB44923792A7D586631B2AB963AE537768E45961F5F96CB42320E75738A964168B9403D5B3591AC5679A61857C818B2A486BB299019C7B03BEB50D2D40A17E84712AAC01F1390E49F3B488AC39D0E43292B70042C52355EB48B841887EA256055A688FCAC5A71C896414CE75F57BBA12967215C50D4B5BE692B6DCD1AD2190A3D785C19E283F87F784A03C8F52A23E150734FDD7BEA2AB6D122C928606BFB60570BD696D9676397AC3AA1D062EE1AB3922A2C9B5B02D14557164149C62E8029B139E6950B3F8ACC9E8C30274B69926C1658F7836F479C8CC70138B829848C7698B179643B7550E9193D6FA87350503C2B69136B08CC298B5C335B1AB95054D13C9260625E34C6C2FB8186E1916C137AD9907C8B2AC9D88FAAAA0375236751A47918F96477B7EC01819F8AE1D72951E21608C87532A9428BDF4CB5658440CB025CE3B271652961BD935624B9EB70047E63184B9503ADCD057B6744FE42908CFA325E401B9D0DB5ADA201F5D64350D392C4FB842823895E15720DD7785C7F5986F15CC2565A71F6CA11B854A293C9CE6C9A1F4AA3917130308F2A2ACA964790BAF960AA12DE3334D146E64DB81EF09563C9667381424C809441EE989EEC93597E7C5B558A89DFAA976F6934CD18B8EACB6F2F54E8F748E4BDB69B0764FD59352575066DC242DC0F1356FAB4467C8064FD23F8823148B77A4ACC642EB2C181FD5CA251B323561191CB15F2FF0784900A15F67014B518453C4C3663528FFB53271E195C27533FEC8C3B159AC1BF39C6FDC69DD5A5FE5872FFB6B2271A09966A5C738C48E63E141D65315051610F0F5588AC97F14100027B144AA23774F199D0D9A122953ACA8782A4136820FFBCC1F2692BB919B674AA1F4D679E8418E8597C74D60C5C287CDE6D44492411222636B03CB661AD66FB442193690A5F1D6B80A947442A46BDD239FE3989E6DA86949474E395056A5E6CB42B25343A7C73B650D843527444243852518A9034B9EFA7A6BB8505BF605EC238FFBC08CBEE35A94845D7319144B381819D0928C27023B727656EA843140649C03098FE74C717AABE91948EA7698DB0A86D34296B5E50DC0A9949C8BA07F64CE60DA2B6E62458DA229D52C08B9B696A124A8CBB791C0D255D3E4A69ED2C242000DC6476B4555552DEAB63EC19FE8783151DAAF78E561E1844886D4418E7510BD025299B1C83C7BA22F63335B9823043336DA897A44FC6A28B44C68A49B436B0DFA406BE642A5BD303BB0D633685364D80440CD7189B6B34F6535101979BA9D251474FC91BF2497670BAD0DA78AB3C13EEAAC864572A2F919546A57C719BCABC9DC8215B492D53118C2D379E879234A700638370A530577700982C4334673AA5D71DB98627384E8CA876E24B5A31575EA3C334D3C7D3ABB6D8891B4904B8F5DB93D0531CAFF25BE53E28C45C94758E309B83ABC2BA66D98D3BDBC53B7D06592F2712663C777DB60AFF496A217E82D8272C3A218AD8C8B04AE7C66BE35C08E3A955FBC18EDD07E8E68A806FC3FE218B87F87BC332B86C2625D8FF01C9FF6214B75A20CC465F847511030B47EA664A75B3D4ED9038A9C747C6872DE0A57F3B76C60585ADE64570A21CF8548A5BE4996BC22B3D16A7BBBD20149034764B820892B9394581697E39F9B35077EAAADB06702968A5E5418983110A97D4749D3160DDB2B9C587767FB56B9ED9BB3D91CBEAE141769C2128E0ACADBAFD72FCA96AED457CAAFAF51DC8C30CEAC70CB4621CD4D7B4C87F3829EFF562789B3E19FAFEC92E4B5F95B45F3786F12D9C24915CA484A49CE1C0EC046899A777655233E4E1B5CA44E9AFBDC67964BFD5D5E3DBB45E60D03CF
-ct = 8AC0D6E2C157FB04C753D97F8EA4C0415FFC46D2406D65B51E3991A286A66A87FD7E7F5DF13F446F0DEBA8D783CCD9164EEC2CF4AB002DC6DE315F3F6A3BBEF9E2A0CBC833E12F1097D11158D73C579836B41DC1C0186844E2CA224855F8A2ED24F31B92827F0A3125EAF79140612ECE54F5A9DA73BF775D8112220FEDE4B590C32B08F4A7B91B7497739C3EC80E64F2165E7F032D5A583F0AD2D7AF369F903913114A2829C8DBE77B460B06ABC23D184A7ABCF6853283828623E89286CCD3E4866C57F28146203100665792E128AD7E105DF6F283ACC30A1BAAB1E84A78E86C3B49D0950F93E1B88E655DD6B3C689988EF7E2517812006D38EE0F9FFD7969A789AE2D8ABFDE2A8F1423D628737DE52AEFF8362218317968163A5A562BE757C3E9F806AC7F8A0E5B5465841016A694861AA1DF8637A345D25EF933EEA840C5CD37E67E7489F48914A07C3D6E8118ADC55CB436E8F283ECF5CD46084B41F24430A80C6FC1099FCEB3C05CBCFFAFE17F129CCE938C0DFDDA9A440E1BA6FBA8391F84020E7BC29ECEFB06AEED4272FCFD947C689EBC9FF59848EC8D5D8F69360F74DE5CC384CC547B31249D06EC288A013BA2E07C05AC634FB3BCBC284268458D441C42545F823C546AEEA8E2DB8832D683709B06B7E6BE4D68EAF8A5EC172EC63E625576E32A5865E2F124FBF6A513FAE2AE5DEF871E89BAC25AA35D026E7121D4D2DE17DCFEF4F021AAA8AFB7B5CB9B5A424652320468E658AE8AB9141F66C35EFC4C1E46D7A8145D9CA9D57D0D5BE1723E7B13585F16919988F7F4FAEFFA4E9FBFAC36968E96B3DDA7F6F922337B15BC910C25CD3ABDDFC4938B21519D914EB51479ECC5ADFAAD5E844BDC958659F38E2A31BAE0F1894FC5A39446FAE1EEDB445CB1ECE0B0FEB796AF4124F60A318E5D52F59995478AE1CA6433A1338B132DC236366CE44D63C1930CD3BCE9EAB66A911EB0E25512631C96D7B45F53BE8C0D0E9D37987167B2FEBFEC0ACCDE2D31FF4A83150674DC11863CBAFC2BDDDF72232287A7C9D05221FBC916D6AF6A9043575BE8BC086795504DF62C50B859FE9443A08322F943EC913B2C3A3CEFF992480590BA4FBA1A956301125F7F1EE6FD5A78356554E5123C4587C4CBE4D4ACE2A00B847494CE8F88C60ABF6D4F86EA6C3FD05A01678E212734911A1F1EB0FB94FBB5F10003342E8DABD2C6FDD670652B77A8CAB31ED4E15DCA52421EA6328DFEEBB387B64BC3474A53D0CE7BAD442ACD0C6C9A615B32C1795DB075D9B25AAA48D32219FFB7BCAAF2B5B53F03CF4BAC5FDC6F0045067DD9F55D8C0B4DA63A91B8C40CE5BFF3E6E6BF71943A67FF828FB69E7C1A0EC4E10099F1EB76371DD43044F0007A22AB9F9EE22F663CCFD1E0F2E5849913C89808E7609F594E14A7135C94B4088F726A0A3BDE5CEDF9BE2F7402BE553D1A5BF8A15B90E711EB5BD84454F0219BF7DB0F9E031F93175BBDEAD918BEF03C68D279368FC8DE7818811EE6D5B09F4B773BB3100B688FDD6DE7C8A5B3218D4B53
-ss = C8B9932975C3EF329424392DA29B103F367FFF38CF402B40A0299BCD2CF10FCA
-
-count = 20
-generateEntropy = d304c9389cc973477f169788abcb9d511f843219d246a9b587822f422a70c2386590a2e5c7ed86cf2c5c2a898662bc9a81418720bbb632ef9cf0b845ed052d73
-encapEntropyPreHash = 8d667921c5db401a86fe1c35dfcf164a6bb2ab7400fd6a0b67eafd4a0ed11940
-pk = 2D7B0180596BE297A4631ABE0D48A046DCC99C8912B8255FC45592A2A61230652BC7C450A674CCC3ABB27395738D177E7579AFDCC30E74E7C7B5AC5DC235176343CFC4920ED8D9472E13C9B36A6D38BB44756BC31FBAB62893656DA065901303700A14B2F785D98896AE97953BA358FD53091012B97498CD7516B0E1898E2F6803C5A13D70F5BEC346917249940BA35E3EA954F6CA13C343A09CFC02D8E66852C1AE0FF8B22E7424F53B1897EA11268A6B866C09EFE8694031754ED1A2A147C0086283284133AA6C324E0B0570469F09E0901F25213FF9B113147990B54CB241268E0B6C7A3A90C638B7C483C71AC1344BD65C988736C4756E0B71111BF5B810FB3CC4187363A94EFA020DE1C3CB9A005CF472BEC5685322FAAD5BD1CB0F240458B56FCC5A6167F22577565DAC1BA9B984C33C348BABB70506B87926540547389B805BA01E4443B5D60B9A407F8B060FCD96C4B717BAAEB72400EAAA9853B962E8A0C8D966458CC4CFF31E960C447C6B205629419478360CDC945D6B9A55504D853C1E51364E7A9AAD82B64FC37A02E4139B9E6C392DC83C04005F6D1299D990A89ED68ACC31B5D1D224F2C8B3CD5280A12C6E088CC2F9D3C59AFCB9FEE458AF5135C9B4B477D878F34723E3912189D2764F9366AB8752C9248A5684296ED46F404A1739BA72D5D652C614860D41898E45B72BF66D587089FCF49E3B94CD26999D7539C32BDBAC0139B20988CC7B578ED880048885355F193DDB1690B9092AA2A86AF03A41797120BE84334EF25C2E70BFE8E0A658F03435B65787F38BC9452DDC584162955F8B8560991C407FA0C12D770E80FA4A2CF7B853708BEF2A44F959B9D05B6FAEF83F6F41A2454257B0157C55047AE7D0CC17079E118C8A4EE3358D877251970EAF86684EC70858A94BBAA4BD2FD1895C2223320CCADCE636C2156471B76C48D53E6A6C12A1317C39C48BF3A0AA0DBC8AFC034B43398B9F1C56D407A4B7C2BAC134024DF6AE9800B230E2592F529F79F0AB048867A349684B242BC4D2284A6106DBA36DE7B3A114B6353B479D014A69E33ACF5C465CED6669B22027D6657F12379ABBD248C6967834239E2D3A0211B73A77D681B61892877B7E102A53CB4602E3DC1704EC92A9E260D9817C6393062BF520F7A845FFF19123A1662FD241090AC81EE1748EEA878D53969FEA20FB95688FCB3D235910F154BD09A75556D890409CCE0A20C6CD2A59664BC4ECCA3D4725910D210DB0C848CE7242CCA945F1568561BB90D9A4C3DFBA83074A16FB3AC934C865DCEBAF6FD90D5B458C22542DED5111E77C12D8656908557649E9155A8472D5213B46F739F095B5FD4A2418074EF7DB9385F19D6630AA29B28881AA3474B7AC352C5DFBFB20FD7B8A0B87CF3933547CD498256A9E17733AD6967D7B9C7ADC64A951EC5C8ECB75B9190064F3A862D10CB5707215F456CAA10A2C240619925A140B6CBA878A0D40283EFB9E1562C227D716D2935E8D96649C06AE9465AEBF552D68DA1E7991BF987A4DFF4371049A0DC9E56F110779D562959F278B069B3C7712AF29027AAD6109BB0C3201565C0B0892A62AA74CA7BD6B48039066A95DBCA4E76A3A323612269546B18BA1BDA19C123C24504ECDF72189DFA1CD24EBF011A3BB66D35F78633E1EE7B249FF
-sk = FFD8874D8B37C946409D69CB03529B7D1A43DDB24792D4773CC723643567671B8E0FC2B903D302679A530118AC453B0541A2389C46B38F317B43130972271D8146A66593B8FE659DB570C941F1ABB4F295493085A85277062C3D4DB168E466015EA506B5B8A805A435EF6812A6B68AFA9372776717C1042E24E7A10A842182E7C40C4CC547B98FE007A1D98804AC5BC3C31B6511425A558C73E5B1935C7A664EE224955B6D67CA54D47B04E1622716A27B21F12A2EB27C16D26A541CB0C1BA5A1A8629B7F2222B84CDFED9CB6F666B41C92FD0B074F42B5D2EE72E8C5443F34C5DC2920DA165558AF074E3CCAE84C1CBF1F70624E1A3A30A7DB045A2C4A79BB1A4B0F01187BBD8B29A8C60B07068A72264D9B305B5E391521BB945D53CE1D65436441932EC5867549408B47F28D3BF37D7AF0DF432CCFC3667F4ACE969542CD626637B570FD84210B3AB5456B23B8B339F4885E9A96BB17CCF1CA4A962C5667D0C3DFB356146C04BB8391197D54D0F4202F160824D900B27B36BF8ABC7876CA331C2C3A8A161D98523ADFC1EF9D538C9203A6729CFCF6089F7D72F57093EA3A34113749F23EC21C051AB2C836679B0210A549F2678C7187691DE949994A25769D4647FD992BE411E24E302C07569CF26C11F3942CA505391A794D42C77DA0A324B05908AEB9C70B88B38A95F371B1902E06D071457BBCB382AE4C36F14AB3A747A30CB7E9D35791879873A0333B3FAB967770465A056DE9C4420662C046AA8CA32093AE23ABD80406FE60BDCD1725DAAB0E50931C575A0C9137FA61442B1101B05686D398A6FDC0BBBBB25A073E99C3702B9268CA91420A1198B5C54501A03C878B6827E6D586AB42C2FA47258D1255711654968FC80E1364886F18E98FC10EB85645B399788DC225B1A233FE564604A86397A4483C102203188DF667961BAC9EF19B99432475C0A2C9978C81CF5314A2B2AB37479549B14C8D70ED8F0C6625938CA4A92BEE5A7AADB286E507EE8890772C3353E35C2DE8696041BCC8B81997F8C7800417C91C32E9B8B34B62A25E5C2AF2854CF902269C3C5B50A5209DC1C63F8835B3A73137D855C69F9335FC66EFB985933F4A66B084AA58909E658998A15AE8B087120F59A00426CF9A327DD48467F8C12CFBAACEA7BCA7407060C42950CF9543CAC1EDF9C296D978A2C36AAD92B665D6C9513B59278AC1CC781204E555E27F81E976A74D3055A48035203472960E596C7C4C2D0158A006D884F40681C6610F1124574EB9FF5323E10480D0E306F1E398AD1E6CF8057024D072DEF4719E3A6BE9AEAA07B56077BE495A635C67066A2945376C9836EBF4C413A05A9B1348C31329884BC7D820A6BAD7A63BD62518878A97FB525332433573973DF74A00EC02D50198A2B1306005335E6A51191505FB244999CC333BCFA4E7845B766B050CF66607982014D28548A4454F86A06E9321C82781478CB938C709EC5CC81EA1A9269543DC8EBC6D253BE1698990C81C587D7263E7445BAF53316C23EB8863D151A4E5659928AD704C1C7B2BD2A1987907A05CCBD2F0C78232A10653452E3DABB7598CA83D37166791EF11A2524F371180984BF72A6E2291301606B7351A284A1A62D7B0180596BE297A4631ABE0D48A046DCC99C8912B8255FC45592A2A61230652BC7C450A674CCC3ABB27395738D177E7579AFDCC30E74E7C7B5AC5DC235176343CFC4920ED8D9472E13C9B36A6D38BB44756BC31FBAB62893656DA065901303700A14B2F785D98896AE97953BA358FD53091012B97498CD7516B0E1898E2F6803C5A13D70F5BEC346917249940BA35E3EA954F6CA13C343A09CFC02D8E66852C1AE0FF8B22E7424F53B1897EA11268A6B866C09EFE8694031754ED1A2A147C0086283284133AA6C324E0B0570469F09E0901F25213FF9B113147990B54CB241268E0B6C7A3A90C638B7C483C71AC1344BD65C988736C4756E0B71111BF5B810FB3CC4187363A94EFA020DE1C3CB9A005CF472BEC5685322FAAD5BD1CB0F240458B56FCC5A6167F22577565DAC1BA9B984C33C348BABB70506B87926540547389B805BA01E4443B5D60B9A407F8B060FCD96C4B717BAAEB72400EAAA9853B962E8A0C8D966458CC4CFF31E960C447C6B205629419478360CDC945D6B9A55504D853C1E51364E7A9AAD82B64FC37A02E4139B9E6C392DC83C04005F6D1299D990A89ED68ACC31B5D1D224F2C8B3CD5280A12C6E088CC2F9D3C59AFCB9FEE458AF5135C9B4B477D878F34723E3912189D2764F9366AB8752C9248A5684296ED46F404A1739BA72D5D652C614860D41898E45B72BF66D587089FCF49E3B94CD26999D7539C32BDBAC0139B20988CC7B578ED880048885355F193DDB1690B9092AA2A86AF03A41797120BE84334EF25C2E70BFE8E0A658F03435B65787F38BC9452DDC584162955F8B8560991C407FA0C12D770E80FA4A2CF7B853708BEF2A44F959B9D05B6FAEF83F6F41A2454257B0157C55047AE7D0CC17079E118C8A4EE3358D877251970EAF86684EC70858A94BBAA4BD2FD1895C2223320CCADCE636C2156471B76C48D53E6A6C12A1317C39C48BF3A0AA0DBC8AFC034B43398B9F1C56D407A4B7C2BAC134024DF6AE9800B230E2592F529F79F0AB048867A349684B242BC4D2284A6106DBA36DE7B3A114B6353B479D014A69E33ACF5C465CED6669B22027D6657F12379ABBD248C6967834239E2D3A0211B73A77D681B61892877B7E102A53CB4602E3DC1704EC92A9E260D9817C6393062BF520F7A845FFF19123A1662FD241090AC81EE1748EEA878D53969FEA20FB95688FCB3D235910F154BD09A75556D890409CCE0A20C6CD2A59664BC4ECCA3D4725910D210DB0C848CE7242CCA945F1568561BB90D9A4C3DFBA83074A16FB3AC934C865DCEBAF6FD90D5B458C22542DED5111E77C12D8656908557649E9155A8472D5213B46F739F095B5FD4A2418074EF7DB9385F19D6630AA29B28881AA3474B7AC352C5DFBFB20FD7B8A0B87CF3933547CD498256A9E17733AD6967D7B9C7ADC64A951EC5C8ECB75B9190064F3A862D10CB5707215F456CAA10A2C240619925A140B6CBA878A0D40283EFB9E1562C227D716D2935E8D96649C06AE9465AEBF552D68DA1E7991BF987A4DFF4371049A0DC9E56F110779D562959F278B069B3C7712AF29027AAD6109BB0C3201565C0B0892A62AA74CA7BD6B48039066A95DBCA4E76A3A323612269546B18BA1BDA19C123C24504ECDF72189DFA1CD24EBF011A3BB66D35F78633E1EE7B249FF699FB2F061A75F111F4A7A60195D9045DC01716B6502CC107CBCEDF122E8F6196590A2E5C7ED86CF2C5C2A898662BC9A81418720BBB632EF9CF0B845ED052D73
-ct = 88BA446E3DACEFE9158DDF1619C9B1C6BC274B8E8F819342BDECCE593F705B29EDC21B69F1B65EC4674F71CEBE673D7FCB0CE2FF757F8EE5D5A5F8F5035A58E1D75713EDE33F0E7B98056F1EEFC0C692DEF07029C0EF3A857D6972723C7F49B79855703461A3F83857AC0F2331E7F8B3889FACDF6373F8CC49DFB5408B57DF0CB0484862970993C5DA712D87335F7F7D8C4B818E8B96FEDDDC435E131F47DEFF13919A470B25332F346A8317F0D3F8B13CD16A12C63FF17F7943275E2B4BC0B3F4AD52B67EED6A0F499DB79AEEF56964029E1FC686B78631FE0AC8162E2D3C3D36E2958DD95312FBD18ECE60716E398627437655603D1428771F24D2F39FE6D1B759A46E303BA9ACD68866F2729CA6FFCD91FFBA30D8DA6433383DC8755772C94975A6A1AB6B5A2105901363C8B94A20A48618311E4E59975C87E46AB0687D30A7BCA3E13EDCB560706405FD83184F98784EDB59535CC3CDFCDE98EE989DA0990BE3FAFF402220AC0070FB31CCF352E26727B06F253F8A5E47C10F95456705FEA41AA9A41AF7BB1A5E3DB02F9E1DFB406FD4F27FD78C25E86D9C04FA5B0C6B2D6A6D43D760F2D1D01D1AEEEA971A9BA64A95FD63C9A95B0EA5B4A83282C920E0E395110AB2DBC59C8FCE8307B6106AACB58AFB4C38A868B4D20D7772810E9DA53A5AAEFB991CFEEAE0D54A1A4934A22BE3F8F33D945F66F79AAF3B88A6D18963660D8F1E8EB23644E487E4EA68897C34628F30FF3EACDEE3353269D87B2FE2FD837FE2A6EC7B1EF99341E470AA67004DDE57EC6A2B334A2B1B90291D73D8C1BD43C38FA82E088893ED5D2149F568BA80A68E08131CEAB491A61FCAF07DBCFDE77C530C60BAFDCF55DC8BA1F9478B28D9C6A53BB9DDF4491026B754AC31214D5E774075DDED90B670181300190F9A5B3F47CB3CAA6AC0233E7AFC708DEEB1590266DD8FBA964B32880AF48EED81534B9D47F63A7195CF60EB827D2A0D94D84EEACE28C34711D116D011074B118C655380F6B2E3106ABEECECF7186B2D45A324452BFFF6EB37DD17C4CB034DE10D5F24963EA898B5F19641BF1177B64F6832331678EAF080B9A65F93636D2D4F5DCEEC96DDE5C1E8C7EB505D4638A6ACF4746AFF7EC6456E1DFD2035CA2CE87FE16EE3E69F5C06CDC5BAC084F9605AC9F07BE61787B1057C1CF5F7E3AF45064BF8920596522EC0A48E73F385EA60A256ADFAB1EED0E08104FE20AA1EEA2CC466E0B64E4F94AB0378605B7A2C38BE7FD606229C74B5D3A35B2BD5F46A3A4F180111E6F35594BA9A754C4D00E57B0C62BBC3D326DF497DEB7BD50401CE2E5AF6F75CCD6781BB944922329AB94BDA5557869E28133AE070669BD9818397C5E5A1229C145BDC17B95834BDFE9A2FC672F091C8F71735499E4A032D34906FFEF9D297AE68DA67C76770E2E9EC362B6DCF520B9338E170BCD1DC4BB9F94C564264D5B6439CC128AD54FDF6CFE5CA16AABBC65415B91485CEB77120E03B56C558D4899952F64CC140BEDDC8B3AF3BF805C12D21F6BA22C2
-ss = 578E4E308F2B426A7B1ED7D80C72396A914CE77A4A7A6D16B26E4AF3D59B491B
-
-count = 21
-generateEntropy = 89a6e3be304a3518fb82b18ca730f0b359cd6ba90664a493fb4f8edaf965b9c3b6591121e25d64010c25a18676033e1d7278ac5f2d0b43a31f3a4156ae710465
-encapEntropyPreHash = ec750b3939385a3f8df868119dc76f77ca845567ef068de6ada5478a56bc78b6
-pk = F3576FF861541032094855B18CF574D868B0EB783CE9011F28FC14C486B122CC80093897BFC8AC1082421F99767BC42B0FF41B22DC7B50D5556041338E6C4368AB190E92608F6CC69D8B33F1AB04DE68CF96D9C5882C97CF28C30B86924AA57849954369C5427C876A9B1CA341E8522E1357E60A4450B69F150658715403D1E1C957E5A914B9A3BC4C45489053306329C7984E76F169C8639DE4080DB1671ED01A24724A101DF89E45B5B385CA2EF663586AE58D9B33ADE9738F84482E6E28909E7641AA673AD772B125161A316166E1717FDBDC8D02B2B2B6DC21805619D4FACC40E9A21BCCA9D4DA71220A4631E95B25E960192A22A39B904BBB02F1184B79A97B3CC16B5E4B5EAF278913B7A195F3107342A77A68CAC90C1B5A3CA9B354A6095C29C09C5AC2B44C6CB28A250834D5F2A307EA3434977D0087017CA2692B79008640B770B41EE2C2C77BCC2605F1857368C8E12983AFA8633C870115A3818D6BCBCEE864A8DB694F4B77BCF63A8AEC407A45716AF6358065C30B77B68C2198B2FB558F463A7477B9FA7680F1E65706A888B8740A87CC7E7949156F896C182B53E464721E46A258820201887CE9B83D43250B63E2AB29900A115084A6E66584F767853B2E684C547D97266B36B6838AABA73298DAB79C58C88F1B51113EE752736B7566EB5759CC4DBC37551135BB3C87B1A6C83AC5A38DBD78106EC0C5E9967A6D81139CD516027C25AFBB6C47E3802D56079E6265C4F21F1315A96AB994597214B814CC53E8566330CD51FB4045F605DF1C7C9C255166651DE6041B7FD85C7E376E28076AD352051C65494A1054C30930621C53EE8947DCE3C55BD686F186CD5AA21AFC17664D36A2D7F5008AE83950B93AE510847552A5C2F761207B0F478C73C4D6313C8ACC25B13EA64A72EE3334013CBC0A855B55E88EA17466534786B6176B9053CA9D0494C6B4A940B70B68F40BF570C461F11795952E69F21EC4562DEC99448263188EF44E71A1681D626CAC69C6B56AB51AE656BE1CA028672D97D044E43577F26329D50851B0F8A4A1B6C2B673AC6418CCD58005AD400C27D274DD4732E56B5D7C0B6EE731A99E15229F7295C153AA3A873C20C23A35B6137C824F6FB021A0E28F98BB3BE8DC07A5B038DC89944952913AF7A39A9B00F1A038A628686A735DBD4C45E0B8BCDC1C1A902CC4D0571CBD589F507A0C0DCB81BD39811E723358D6320A3049BCC90D776562EB34877978C9929548286A85EFB85F7C6C76FF255F13A0CF5E70304F1CC838FA398FB34E26CA662759C8F3657125DC2AACDC4615653EF074A784500EC60980BE4AAC94B0C7A9012DBE73CDBF1687A684AC63526778926654A4AE4CC779A600A836E3273ACB95A802051F18AF32683F52363572583FDFE30287B2632874CB04832F55E0944712C86D37420137C56F6251A1352AE37A0C3FDB885CB561E63A493A15BEB5E3B123ACA6B6B7294D8002E7EC758AD2C22D336AAE3C067703821842CBA2DC0B1B7A45CC0A48202A002F927122C040F84A884C1334C1E17347108B91C055D331C0B170C6F06048B40CA0BED838AD963FB8747CA714CF1D3267B701132046699798421ACC06A3BC1ADE172FC62123235C2D8DBFE40DD56CE5DE6756CC4B6AFDF64050DA2EECD9953E893C53BF7FFB
-sk = D32CBC1116AC88219F9AF2C33BEB59BB94B372F97815278F0FAB2C690C94B8F209DD1575BD7C0BC7F48AA133BFA068CF1AF1612C3325B8D08963BBC66D938F46843FEE424357E535C2259ED958A75CA6203286190BE53A9B46373F8B41CB38C1CAE2BCB91898669A872F1A8D9CD21227E42ED655569202CC6B494CC6A6BDB08731CDE417F48B86554CCAF953B8FB70AEC727085510CDBAA7CD2A0BA853928886332FB1E3A419C49B34EC90FD31B716252ACCE7A79D05CC04074D69AB3CC9809102261A2191A086231DC70AA583E86912E5BEB2C1A22E841F39DB531D5C26CC333834A20480D6B1CCF19A654149045791D33B414696375DC3C7B0644626E8822C5325D52BA764F2361D853D244416CB9A5BC0540E1238CCB53438C90A196A45571F743894F060F6031FD623ABEBB4AFEA05190DD9452C981352A78E09579F05E24DB2033AACFB10D9335986E8542D9480BF5603FA932D2D0878C3753E6524A809324AD6F169D7FB6D9C0264423A632996ABF297707D8412A6B86160B69980E18ADD1C372FAA406F540C00ED0A75C3544811759C3B5026E6C19102B7160883ED002DE5807B5933934FA01559C4A790230EE93C215BD75AFF117D0F170B4FEB7AEF5B007ACA616E688161FC00CB037C8232CF2DCA569F01A2E1DC2AF7ECB6111181F2EBCB1DF27C6EA84251D8A2B6B6582EF915E2B8C7F8FB6BE8844478FC570B8054A067B34120B47FC6AC68125CCA8514DB4540B7796C9FD05523E7014DB34B8EC94D5EB66C9F5CAE2F838191D2234F43C72262A18DEBA17AB495B7F0529D89B8E1E407BD5A185EAA2444D20C6C9566526B8707B13BB0CC8D9589773DB90952A5CD78E43BDC68CFA4401D7912618F456EB4F97AC1B49AB948592976233F962B1916531FD1672BB69BE320A2985B38B80279572488C5F86BF3D55FB9FB90449B66FC874B94292000466786FB7E393765C7057051999711D234B4D277419320E0046EC0925B41D6B89C62133BD2734E296DCFE90BF6344219A6A22D2CB50C75BC02B07FD0DA11FE0A0A0B9AAD76001D5D7C8FEDE065DDE87D5D47821E756A926638395883879A91B94C6164A40895476269917CAEB12944DC956174B6CC5154944571A6F6553F604D3212728FB08AF6E8C0EA00265AC0C5464595B31A9131871D79298867AAB426D009480C0BEFC08ACE14991399079CB62DE9E6BC80C88C3339640FC667EC837B691C3DA4556A952B3E63C162EC911101C5A49B35475AE68634A7B0CEFCCFBEE608CD4C43C8EBA7A8F957DB595645C64ECF08B50C7438BFBB415C27A45AE940AD077E5A533825D998A9095A735B5D23887B0048AF49CA85F18395C7D3CD06BB687C92CDA9AC9C03A9333A866A9639803C76B5B189294A269F389ABB5010789D410B88215C554008CB10274F781ED6B0BE3903576CD16934C4B6B65296C477AA174043F06792F3944EFD0206E34042D827CAFFD2989B936B91694825C4BD8B10C0777B11971CC1EFB93EC1B3674AFB4FD07568FFE89C707B5785C140D51B433B7942D88A6EF9BC9D091472833004005AA803A050CE03B2BB551F62FB1FAC6649D3E14F0141B2EACA73B700489B73A8D840834A7802A96864610B10F3576FF861541032094855B18CF574D868B0EB783CE9011F28FC14C486B122CC80093897BFC8AC1082421F99767BC42B0FF41B22DC7B50D5556041338E6C4368AB190E92608F6CC69D8B33F1AB04DE68CF96D9C5882C97CF28C30B86924AA57849954369C5427C876A9B1CA341E8522E1357E60A4450B69F150658715403D1E1C957E5A914B9A3BC4C45489053306329C7984E76F169C8639DE4080DB1671ED01A24724A101DF89E45B5B385CA2EF663586AE58D9B33ADE9738F84482E6E28909E7641AA673AD772B125161A316166E1717FDBDC8D02B2B2B6DC21805619D4FACC40E9A21BCCA9D4DA71220A4631E95B25E960192A22A39B904BBB02F1184B79A97B3CC16B5E4B5EAF278913B7A195F3107342A77A68CAC90C1B5A3CA9B354A6095C29C09C5AC2B44C6CB28A250834D5F2A307EA3434977D0087017CA2692B79008640B770B41EE2C2C77BCC2605F1857368C8E12983AFA8633C870115A3818D6BCBCEE864A8DB694F4B77BCF63A8AEC407A45716AF6358065C30B77B68C2198B2FB558F463A7477B9FA7680F1E65706A888B8740A87CC7E7949156F896C182B53E464721E46A258820201887CE9B83D43250B63E2AB29900A115084A6E66584F767853B2E684C547D97266B36B6838AABA73298DAB79C58C88F1B51113EE752736B7566EB5759CC4DBC37551135BB3C87B1A6C83AC5A38DBD78106EC0C5E9967A6D81139CD516027C25AFBB6C47E3802D56079E6265C4F21F1315A96AB994597214B814CC53E8566330CD51FB4045F605DF1C7C9C255166651DE6041B7FD85C7E376E28076AD352051C65494A1054C30930621C53EE8947DCE3C55BD686F186CD5AA21AFC17664D36A2D7F5008AE83950B93AE510847552A5C2F761207B0F478C73C4D6313C8ACC25B13EA64A72EE3334013CBC0A855B55E88EA17466534786B6176B9053CA9D0494C6B4A940B70B68F40BF570C461F11795952E69F21EC4562DEC99448263188EF44E71A1681D626CAC69C6B56AB51AE656BE1CA028672D97D044E43577F26329D50851B0F8A4A1B6C2B673AC6418CCD58005AD400C27D274DD4732E56B5D7C0B6EE731A99E15229F7295C153AA3A873C20C23A35B6137C824F6FB021A0E28F98BB3BE8DC07A5B038DC89944952913AF7A39A9B00F1A038A628686A735DBD4C45E0B8BCDC1C1A902CC4D0571CBD589F507A0C0DCB81BD39811E723358D6320A3049BCC90D776562EB34877978C9929548286A85EFB85F7C6C76FF255F13A0CF5E70304F1CC838FA398FB34E26CA662759C8F3657125DC2AACDC4615653EF074A784500EC60980BE4AAC94B0C7A9012DBE73CDBF1687A684AC63526778926654A4AE4CC779A600A836E3273ACB95A802051F18AF32683F52363572583FDFE30287B2632874CB04832F55E0944712C86D37420137C56F6251A1352AE37A0C3FDB885CB561E63A493A15BEB5E3B123ACA6B6B7294D8002E7EC758AD2C22D336AAE3C067703821842CBA2DC0B1B7A45CC0A48202A002F927122C040F84A884C1334C1E17347108B91C055D331C0B170C6F06048B40CA0BED838AD963FB8747CA714CF1D3267B701132046699798421ACC06A3BC1ADE172FC62123235C2D8DBFE40DD56CE5DE6756CC4B6AFDF64050DA2EECD9953E893C53BF7FFBD3413880D082F26986FCF452A84A8DA934ED06198B290ADA1789E74D9081A9E7B6591121E25D64010C25A18676033E1D7278AC5F2D0B43A31F3A4156AE710465
-ct = F33AA44E8B475A3E664A1585C8A1058B26E2849754F17E4FECB0414D2EF214AE903CC1B8436B302A06BAFB52754F9908496F00B79C8EA49C3FF6B3CA9F7AB4FE2DAB7B915958CCE56FC53EA3F168E79898C06E99B2A5C7F39987D21084317FD5B99BD6B1121A1E2F719B64E54A40C1766A8A0487133272801A7D9B589119104886E2914356BC14C7B9A1DD2B424599A059AFFC963B5866A7EC744C20166B0CEB632ADB3722CF0DD49C85165B6FC05D5B20847A416482472A567A33B8653CC9E455291ABB5E65C83D051EAE887C946DF46D00CEFA7313406674FF748EB33C6351E3A18821801CF0379FC77DF7A3291515AAA7BD5538C7C5DC49EB8CB61463984A3BF34ECDEDFEB5FDDB630BFA20EB3AB4BDBAE85AC6A15162C6D27833F50D9B00DB134601B7D3B32A4D1A6220B98966E51CC1D59926DFACD2EA8EEBD5B9C1B0581F16E5E79389A7F716B0C07E353BCEF084778A9C61491456DE86AC155309583B512F719B6D2C74549009AE11583099812486239A69AFDD7571AD30C622AC4BE434F25A4D70A7EEBEDA51085A918B0E3BCD20C1E1421A527D62046AF8CDB6EAE295E10DC25C4DED82E9067CA0E1B0B289D1DD14866CE32F6D12EE0EAA215FDFBA68DF0B0C5808B76A2C24AA00AA92B08AC4C0ED48A573841D265FD079EE835925A224D2055639BD642ADFC9D5AAE4885B0F7C17163A53D0CE55246DFA31943BF03B6B1D90A7CD2AB06B099EBB67A3C28661789A9D7DAB10F29E1D4BC4D3C6102667018935BD9EAF14CC8501F9A84BFB0868B922C16417B227B2C149BD3D176C429147112AB1DA57ABBCB07D85D936E62053F4EC915792080BEB2CC142BDEC7AF12919CA448074A601BD3AA1235B499B96FC9FEB8C5B3108AF77BB1D0931F92E527ADA040A1FBEAE4A7AD92CABA96F5DE69C0FD78DB39DC2BE90F81F2BE00B4949BEE566B80B7881905B59A824506852BA8DD37E44C4A534A7A6A790D9A243439CC5A548B9B07AB0D4050676EDBC6DD4B84823E7B8DCF4EF8021D5F6FDFCC470DFC8FCB717C2FCD5CF26AA1EC03CB72FEB58A50B831C5E36B63E6A5AD7C8D57B6DF835F414D3B2D0A86ADE0F85E76E5F3B770345D3A2DF2370BF8E994E4A5116D5AA3E2C2BCEF9D1D268781453FB3D1E9BAE21595BAFAEBF72B1B4FCCD32C84897D712B720DD962C5ED46803DED0AD4FC417647DB85C22970EDED391F065143A7CB8BA660FFCA69327C2CCFDDAC83C0215818712332A79881ACA7321098AEE4F733D44F31F3A79BD78CA4B932B1EBCCFEF5C3C987FF95485F6239DFD607E3F68BF6A746F17CF0F4F438020BFDA627C5C01C65E0049914C822ED9463B6FE957847722F659621BAAF475014FCE9CF5B1A11D7392DD286CCC616EDABE08C80E56E77A41584261DC2F09D7E55A8BAE0B0D3354A1C00A6CE7D3C65BF61F3B45D81C75BBE8A0C3780CBEB6C5CCE34CCD76318017215ECED1C686224D322C3239A0E3ED6D007195207DB057125ABB40CCADE2ADA3C09ABA1F66AEFFC81F119EFA0828FA3D
-ss = 70080E3BAAB3FA55E8A308E84FE9ABAE780BE8C09E211651F6EBF6053F8F264E
-
-count = 22
-generateEntropy = d569b935ce015c85f792f8f7fb0d83c4f53b492959361dd4f75fb764d656450176eae84d11c4528382828f7a689a0d5cff87b8ca0bba97feacb39b935a8788cb
-encapEntropyPreHash = 74f1d52af09b12c36eb062ea7528550cb4c18a3ce8e4f4ea9fac43ae383bc925
-pk = 4C376BA98C3A0415A3BFB0AB42D0A3D68CB171109C5F83147C33ADDA2CB07C62A9025B44523B0AE4CB8A8BEA5E550B717CA6C8271997CFD6C5ED76AA44E43DA2A02D35610787F22966298FFBB45FD78A8D36EAB454675D6951A70472CAF06640BC1B97D6760E74B41C577855BC0756ABE528EB4894E8776F1E739DA45A9F84C9BF3C72B43262525B547F75176AB2E12D8EA808D3B0355766BD69D964EB3B450A96C835D7B238220FEBD62443B03985731333C54382D20200E30E4CBB2B607AC998F20DEF865BDF47CE78AC3DBC1ABE33245D6FA7583B31B6FE7B6EDE7A8EC776B20F7BBE7E376578F0933B761BB0952161123D61282CD6C80CDC8A85F9632ABA1A8EF5925E410BB80BEABC67735D07E4ABDD587827745A3220A24A7B3902416BEFAB3073C2CB1FA76FF04315B653B3E7C18343391F92015939829DABD0289B5AABC4CB5335D963AB842865BB7C38106EB1274ECCD0140B415901279E8719C0415517B5101394F78A48F565317909371A3154D291698B0BEDE17052F30786DC2D46E71EDC438C288CBD44445F993926BFF0A8CA1A033B656C2362A659EABBCF37B2CB5916940AA9B3E850E51039C08C8588347E1099A0D8380CCC4B8CD0C87218BC24F09126A82A3D530A75500254510AC765CC1DE612A4CEB14DB78A7141109F947B4329158F87E4C8B41A92AFCCC9EB749D66A71159DB90E7A36642636AF22CC0D541CE52DB7AB44BAF30560691A637C93193A11A00EFEC075289953FDC9DF3EC3390342AEE44C08D661632FB0303681E1F89CE1300B0C1A36E63E5A45886A4C76534FA78B87A75CF96AC66205C28766BA5EEF7062363C19091C61C543D5C1B8A547372515722EE515E8EF52BF8E089D93377E2C8458E626D3391953D658CDB05C7A40077F4E19DC0B132BE719014C12B0CC242466112E94809630B63FAD12C99D271DBD38E5AFA54C894542B940415354203A0C8A785AB94200EE0CB976991C642257D9AF6998B61BA27B236FDFAB86F834FB2D47CC0904B9D6ACD2F8311F0D4B8AD81A24F712D92272587220E8023A8BC13BD17572D38851778F319607752466CB0DE7C5C12103FAE4C57D953B96BE93262BA9CB05405A5D2A9E012B21A22A2EF33A385C898C80AA9663565B63241A1B206F3379ABE8262CFA49BA05C3B43E9485E60CD38D66EAED114EF81AFD66B2594BAA361D3C3B02069B1A164BC387632E24C82A91BE2CA390EB585E900173699A8B26B8916E52BD643645D3225DF38BA50A50EA013B4B2A86EE1F76278E27F5A4142F034004B567F309C52ACCA3C7530162ED744A67481CA338861CCC3E8331E1C67886023743719493CC3CAEA51438E28AC4EA06B906789A65220E3C7407C874C6322BE1F9B627386081753AD618A8DCC013395F20F5017AE2B57BA908617490460D5A67FAE2660A56C4C4D97BABDA0BAE0F494260877F7077AF2536B2CA46E297C61DD8422BBE515519210DABC02E7047B13F16607AC15E4950574C43BF8C39A2528ADDFA2782506635E5626967A1F30C02FA3442FA93250571A8173999A88DC27B43C476468A6A4739972DC1B68493413A2743B9B563283CC886916ECA5887796A4F833AAED6639B9D531EFE5CADF9225573A23664C9CEA086428DCD19FF40A06186A41FEC0723953781475F648
-sk = 818B55FA5AC30A81891F3A3643924B2B046FEB6765A61CC81C9059D1F82F6A0067A102825C88A530D15F0DD95F0B4742D29ABE7044C62D45A05BDAC46130305E3C3417D67F60B92EDEB6B2A398119AD160EE3CB0FB52144435A5BB5412C0512DC6121BF6E72D0F87A3834AB5338196FDC950A3CB1B7354C4E50369BD4364CEE9066A221DFCD580F1B914C0C335F547748BB19264B7879F206A9C610573B8676BD0BDFD777A2A0CA5EC891A1317C5289784DE114E84C53B983778BF8933805256C9A9BD05A11AF8F5AC271AC3F1E635EB9A8263C855BB230F58EA3B7E8287D76258AA57646B97560E593944C4CB3567A2C382A795C991F69BC2DF2CBA8837C9A3B58A9DAC5E4D84B50722A144737EA38B14BE51C41CC55C53340ED158AB4A0B0F0A2612962B89CC2AA8B29198F2E04B0F0CB586F271C6414F31A71A45ECCDA8C597C38415D262571BF0A7BFA17115E0C7731C70C2D01C492C85DE16C511102C5A96973C724F3B58B504EB65F56116AA7779B76B2554736D9D6176DFC6BA007A590A311D4B86A7A6251FFFE6086AB3319DB48C4DCB91FE680F45A9480241242E4AC9861B62860837CC813FADF00751C8021F7A1C4D7A1E5F13BC3E8462F372CD7498197D172EFF98B1F8BBC37974B025295A80E3525D282FBA8467F8079D78FA6068E23BDBB3349A31506E474EA228C3927A554D7747BD3621A0343CB155BC786075C3015C3692C0FC65B194A12152A14153A03D5147B0CDB423A3B50ED6461813F9AE1FD63AB7A53031DAC2D0F87CACD1CB81461C8C08BF367C4CCAE7626343469D417ACC705546293498035195240387FB1F2E7C005DE000E530B9E21CC7DBE463E7D24ADEAC1127026843B87CF6FC1BB94674399B0636506B1ACAB72F623ADEF866F883762B5B4509CBB2BE142C5C550046E10D29FA431F9B7D977253928A8D2D4C33ADD899AD736B40CB4FC656BE02D90BF8D393D632A1AB509C432511F1CA16B01139CB0627F6503BBA75440414AF97A04BC5239567C060EF94C9BA7221D4612EAA640BDBB8B72E32A4668401AA79421BA68115261A8D94878C90A0468510B247968B7463FF49A0578044C5E9147F0739F6A17B18828BDCF56966B1CAA125CDE7BA6DCE939E56D350E896CA6219A6B8947E3909361754593FB8A85E742CACB74E1D45704FA4CFC91C142453BA5C08558DE1321AD6A6A2804769A0BF69770A1264BA5148B40A3A9BE3C513A382CFA3C244C9A138EA9CB8DA7627B350CFF87AB064A079876893D893250EF59F369C41F9EA40DAA5A5984C19CE06CF9BEC2947932133A4157BB8CC3C72A1FD25715962A9C88026C018B7202885224019466540C9EB5482A87E665157BE7722BC64133C827C20B97D9E692342F23FDB1B75AB2CCB6FA5973820B92EF1BB45C2B5ED1330C1417CCFB39FC6301B8A749D3613B3803A6ABBA20990151305CB32BA6A5B558265C2E27D8D49AEF3E91819920DB20360355919D5F641922233A1C24C0045172CB10F9564A029F07578A48A4D215248F3AC7A912EF8E56E366B03C567AB978C750D85454C68A5806AC38B7B3395F19FE78A001C5867D3E90E9B54BD63954761AB7F4A57B1FA32B65F285742C1207AA0684C376BA98C3A0415A3BFB0AB42D0A3D68CB171109C5F83147C33ADDA2CB07C62A9025B44523B0AE4CB8A8BEA5E550B717CA6C8271997CFD6C5ED76AA44E43DA2A02D35610787F22966298FFBB45FD78A8D36EAB454675D6951A70472CAF06640BC1B97D6760E74B41C577855BC0756ABE528EB4894E8776F1E739DA45A9F84C9BF3C72B43262525B547F75176AB2E12D8EA808D3B0355766BD69D964EB3B450A96C835D7B238220FEBD62443B03985731333C54382D20200E30E4CBB2B607AC998F20DEF865BDF47CE78AC3DBC1ABE33245D6FA7583B31B6FE7B6EDE7A8EC776B20F7BBE7E376578F0933B761BB0952161123D61282CD6C80CDC8A85F9632ABA1A8EF5925E410BB80BEABC67735D07E4ABDD587827745A3220A24A7B3902416BEFAB3073C2CB1FA76FF04315B653B3E7C18343391F92015939829DABD0289B5AABC4CB5335D963AB842865BB7C38106EB1274ECCD0140B415901279E8719C0415517B5101394F78A48F565317909371A3154D291698B0BEDE17052F30786DC2D46E71EDC438C288CBD44445F993926BFF0A8CA1A033B656C2362A659EABBCF37B2CB5916940AA9B3E850E51039C08C8588347E1099A0D8380CCC4B8CD0C87218BC24F09126A82A3D530A75500254510AC765CC1DE612A4CEB14DB78A7141109F947B4329158F87E4C8B41A92AFCCC9EB749D66A71159DB90E7A36642636AF22CC0D541CE52DB7AB44BAF30560691A637C93193A11A00EFEC075289953FDC9DF3EC3390342AEE44C08D661632FB0303681E1F89CE1300B0C1A36E63E5A45886A4C76534FA78B87A75CF96AC66205C28766BA5EEF7062363C19091C61C543D5C1B8A547372515722EE515E8EF52BF8E089D93377E2C8458E626D3391953D658CDB05C7A40077F4E19DC0B132BE719014C12B0CC242466112E94809630B63FAD12C99D271DBD38E5AFA54C894542B940415354203A0C8A785AB94200EE0CB976991C642257D9AF6998B61BA27B236FDFAB86F834FB2D47CC0904B9D6ACD2F8311F0D4B8AD81A24F712D92272587220E8023A8BC13BD17572D38851778F319607752466CB0DE7C5C12103FAE4C57D953B96BE93262BA9CB05405A5D2A9E012B21A22A2EF33A385C898C80AA9663565B63241A1B206F3379ABE8262CFA49BA05C3B43E9485E60CD38D66EAED114EF81AFD66B2594BAA361D3C3B02069B1A164BC387632E24C82A91BE2CA390EB585E900173699A8B26B8916E52BD643645D3225DF38BA50A50EA013B4B2A86EE1F76278E27F5A4142F034004B567F309C52ACCA3C7530162ED744A67481CA338861CCC3E8331E1C67886023743719493CC3CAEA51438E28AC4EA06B906789A65220E3C7407C874C6322BE1F9B627386081753AD618A8DCC013395F20F5017AE2B57BA908617490460D5A67FAE2660A56C4C4D97BABDA0BAE0F494260877F7077AF2536B2CA46E297C61DD8422BBE515519210DABC02E7047B13F16607AC15E4950574C43BF8C39A2528ADDFA2782506635E5626967A1F30C02FA3442FA93250571A8173999A88DC27B43C476468A6A4739972DC1B68493413A2743B9B563283CC886916ECA5887796A4F833AAED6639B9D531EFE5CADF9225573A23664C9CEA086428DCD19FF40A06186A41FEC0723953781475F648E6EEC2929FEAC2A86C9DACFA6214E2E353FDA2D547C3829F5678025FF8418A1A76EAE84D11C4528382828F7A689A0D5CFF87B8CA0BBA97FEACB39B935A8788CB
-ct = A91F16FAFFAD2674D7E14B4CA55F230D862469E3FD04E9FFBAD5683615ADE14CCE1B9C911004C7B3D9B934A6C9294544D6CD1D3B97FDAC0D5BEFB7303F349FA70739A9C9017A0EBA508367B01D14733BB3C7DC8334EB2177FC553B7423BC340412E57BFBFC622E45D32E2715C37CDF1C856173CB214673A4CC53C79AFCFE81535D66F2A60F1272ADA087AEBD39E86E820CEA4D94E9271A1962127E4B9FC49FA67F9F3BD931373BF8B10B813917A339848AEE8DD118182E5C2D9CAE2C3FC1421474B78C108804AB7B3B546F46B7862D65BB28D33E260CAEDC91583EFB84B0535BD17C6CB4461E05253945700716E1C40CB829E729136E5073B0B86364934E26F25BABBE1D1F1F0D9E625DF872E6C136832E1D4CCEE3EC60126ED28841BB39A390A6F9289B4878224E3E857B1BECB231099822F337EE5A69577D3522174F7FB4E6B539CAA67734ED07BD8F73ABE46EFB903B5B9965FB414720CE5A8BB43DC13D441D4C62F10D4AFD7FC574DC802E15156C7FC4C76551C11CE3D2C7ADEFBA4ABD98586577BF0A9B54B0A433093B9AF348AF3C5F8E4FEF6C07C0A0DE1866F4BA1244DC4B815909FBD5397F0872079DEF58563D5E044066D898A9D738D8E5F4979980ADA72855E3C8994BE26C8670B8A4ECFCCCEA8809AF9B692FA184376C739A99CB46A050C825DF16039B92AFCE8D9F8894895A189BB544130A11096ABB902EA8924A13C81E00C7927C0D28B4EAD8E859CEC719FE9C914B0DDE9B36AB400135AD3A21382FCFAAD250A6609B971867A5EECAFF42A8AE051BCE111C4A154F15C3FAFCD92657A65F179E0FB050B2E4DB6E8CECAAAC4DE222FEF1B502B55F327A0E2E17059073E03C1AFB260B2242BC90BFC0ED6A035BCC5C8A56C36CAB2F12AB315F174750B6CA4FC7E9C1734B652D3FD97A1EF442B7BA7353FAF2BAA855EBFA3E329A4901D3B82A23B49513550D432D29B4098D31874E9772CEC94B208AC079ACCD959A4D71979B57A7AD48B7CA2E06545CC85293F7ED2F6CF474DBBAA31EFE9F09B2191076DB3B691E3CC790E35D249D2F37B3AA045EEE5D2D15E953BFA0A7AD6442D87C3D51F319A0E9B69F0D6C1869216348A033ED2331D9AE51E2F5BD0491EC12739BB567436F5F1D425FAA076565D868E7BA2E60C30E61C3DC9158C8245EA97CA49C5697A721FB0CC21C069D1064BAB42B1FAEB337FEC21416FA7456743A7FF7D523B3455035B590B2CB39ADAD6A290723837EC393D468721DBD5FCC116022F7DF742353863675DB7D83EB7AE2E71CDE3623B0ABE8C7BC8AA50C5E875F158802E3E3B115A3BB4728E111E09CA5226AACD911C70B737D7839C9FA2393734D06AC51E1DC80166ED17BA95A10B20E65494289598CA8EBFD57FE8290F7AB7CA8942FBEEB8D017FE52823F2BB7263C2C029E445375B0523CA565BE10EC0C7BBCC14EEB49AB97A382E315495F496672F8A8B293622AF02C74D4DB911C735EA9EAD60ED4427DC68E45E8449C0196355A593E6B84E42717F32C9ED2404E72B508F447E87
-ss = F804333E26C5981EB749E8E9FECBE8F8886E493CF8013A6760A1BF5D4A37200E
-
-count = 23
-generateEntropy = 5cbb141c2763425c274f7404fe530d9116e08c33f9f200a20b011cf563a28990fc9ebbe336dc464489861db8253606971bd0a9008a433ed17752d04023781552
-encapEntropyPreHash = 4b3a70d85f640d1a2a852fb6fe96704af56a7415a8ee4282e9207bc3a2dc116a
-pk = C8735813347C3C7C05F81A176264A5FF791D9801AF88047574008C870635457126B4069071242C24DC0977A8C13D43B889D27F08984D9EA657D241922BB12AA28A1408825B02663B970778BF669D585A975ABBA6BCF8513C11BC73A0C33897991C3428A5CB4DFED155B9A2909E6597DD8CAC1AD62F9CFBCB27088860512859761885C5B6C5D89FD6B18F9E324EE8F80B4C507626762A22F4CB7F4527527896AAA97A69B8AA4FB09B16CBAFD73A667E9CB085F7CA36067D4F740694E6C83C671071762FBBA26A640C86422197894CAF01B0AF66960651998073BA7FCCD3189148187BA22DD2661262766399A6B8BB943AEDC590FA048816D1B9D827CA80935D30E1830C8115B18B754F20ACD7A376272C119CC8210C9AA112D604B2022326F51AD674AA1579C081F12DF04A9A2B4571FC1C21A8A4AE2C701EB2EBB0CE65CD2FC22FEE530FB3DAA6D82B3D46E33E9C918F6D33ABAEC34F45391245453EF4D128C4C068227A6511800D69F6A31A1421E2D322F897145961ABEA377C9393ACBFA72AB3C3AAF7F04DDAD50077E7C36AC46E083075265C58DB4B7B47DA253B8A9361C08A1248B53098C6B797622E228939F110ECE18C02AC613E00B624C61EFF4524F92C1EA632553D9B90CD886FD2C364B25C877459BA6DE0AC8CC2A8B0F2C6D71A051F8727C2892D1934857EB995A8D728B9739872EA472E6602F2C39484D290109BA924933D6AE52C30EB4D80935F0D2C87D4DABF07582CAE3C2F21692F0825C079EA6700065A6086B197582B76CAC90A58451D7479965475AC8A6AF662C7D23055C404246264C97BD23D280B43CDEB59BE0CB31E04474CACC4A1453FA10A9E1E4050F97CA3E9AB31E561AB18CB3AF721570380023A9349ED6BBC5DF66BB243928DD3A4B5E113A0F99725C9C8BF673818B89030DB28EDC536C9620A1625C8A647BD3D7055039753E11C4B1BE3AE79EB565E6367690B5338C554CFDA9369E9B1BA75651A0234D2325ED82369BCD415089692547B325EF28189482714C80DCDC5BFF72A6152B70AC2F16707C63A42830DD6CB88EE646D882338D3DCB202408FC5210C71D1A8BA02B8C2AB7E06E43CCD85CE39A215E67914369C749C3978778592D9E34B7671283DC787446B5B70A32C4C1CA4613B01A5D0BFE55016B897130D1BCFB49BB5F08C5DF9F15B6D531B06C53A389500675AAFCA9700FBC310FFF968300360AB631AD95649F0BB47E55B90B2593D9A60BB0477BA848C0DB9F8BF6C774CF8348C65695B31B921E4439E976B4306A47069C25E4A7515866C0BD77B44C7881121025CD2F28430383600E4BA0BD28074B7BBF2A2A3BD62A73BA240D644AB1F89ACE0C8A83AE62F642237DE265765458D6744273E4372ADD9CF5215BD39FA516575BAD72034288CA3E0D3BE57DBC7ADA731F5F13FC0252BC5A9213F502C342A451B933D3060A2AD8A9C13013E3D93455327C187547809FA57FAA299A843A251F8368A715508C32AA57A42F9551520433F9675ADD0359C5997C341464264986FCF67261D16B7A6989EE33730754A2CA0F66B6C98CB421C8E4B36002561B1A5550B93B144D5552AFEE236357C8093932829F864963159A8E7CA992B8FAE006190B55C6A4FC08AD10190D2A178865ABFA35607E1A88B47EC8EA71B102D7F1567BED46A
-sk = 91C087E623025864C3C5D9049E865C6226CDD2B39F8A1578EB69A864CCB2FA155DB32702DEF5B50E973495997E18C6C21756568802A4BBB86C5018016FCB0655B09E6A4B39A8BA2D70E32BBB255BDD296C998A21F5716D49968DD02A9C4F4CB9DC72C874C232011225F8E8840F7589C2D285C1E72C8588C0A33A502A385D0527186CC6809185408E9C7FE6262725528A439332F93A5BA2943E6DD7B30D79A25939A4C0802BF57C755A5A0EBBDC8390F8AEE407A541C46CB1530FE1642215556D20AB942DDBCD1627826648ACC3FA1367DB0B45075470196B46697D9EC6974F477EDA553F80B701E853398C69A6E4970A746534928631E6B811E533A4D1E89CDD6969BFE0C861D2CEC3E16D0035BB50573ED61B5DBD45C8C5B223CEF4266C5A6DAF104949EABD27D3319BF12A7AAA4E5F636732B28E902A1098972977D98C00A267225B84AF1C8C404A52472B8D1A793E370B17A9935EE590331256620E302E390474DD6A17D17A50291B6BB940BC43F89FDD22109A72C8ECF9ACB1E67EF6A423396225E6ACBFF2880C35673135C5183BA37DF968330CE992DAE04E9455267A195A41893194BC51C67393251A11ED3C0829D99A3D23CEAA387208E00974E73178459BDA539BCBE89F5EEB05EE21BE3B1159018A3262120C21D4972ABA1A1350231D3A646BA70FA5B641EBEA1B130470A5EC7C40627035B03D15696BE1313B458CC9AC8460CF281A6976A9D2CCAEB9FB157300B4289A55ECA386D3D8A7D16C21102AACF361578010042C3A6397E2CB2EA5224141A1D451B38FAC14D7B64BD7B72DB17408B0A8906CEC108BB926DF54299261B6B5C6A636B395ACB651CE6B6018EA9C92C1525DE1624B5570F7000466CC09A909CF36F34687265B61DB6BF2882514705FB37346385CBF4DF33B98686E0189BDDEA7268F598DB1B6CC7B32792D5546E242A807E760ECE7080392823004453048C6F743B87C1670C6D10E3001008A24590294BC9AC899BD588197530FEF9C2B85AC66520A195C77A7AFF61672C8CB74C07D43A2BAB7A764E750663091A005C9AF8CC4B55D502169D4293E79B365F60085B1CC2F4900541588819B5EDCAA3B80253178639F63A3091701C7E7B04E95435BDD2114BBD3ABEFB23355591B0FF102BC94B56B338083B82328712733F2762C5B1D0845073CB3B46AA28CE2CB282A4347F2118A6E062D7E8524147545488A01378A853D489C03EB0C6527307FB0CA5F7AAB6C328438D33CEDC10733AB8A68C7AB88E0B06FC51C92C557FD59488B6245796B7DC291728121BC7643AA5D56C483186CB55086D7E8654691CD5EB97580F0A553A2613C486C0B9566A6F05F9D2B82B57345AEEC1368CC126AC53B9E794BE471C16A498B743C1848A14D53478FC341A0ADA42BC2E0717FB6965737876468515195050D64079D624DA1596F88819FDF95653B8217F9885D151821A9529420AC95DD928FC429674025882C9758226194615304F1F5CAAA456182C1BB11F0A02B6C758EEC4AB6441879A42450A024559697C4494D8AAC2F7045342234CD8081C0077C9232E66838460EA26274329988AF3A82B898C4EFB033FF4101F302A898E84BCEDCC45E369CD1BB7F3517280D6655C8735813347C3C7C05F81A176264A5FF791D9801AF88047574008C870635457126B4069071242C24DC0977A8C13D43B889D27F08984D9EA657D241922BB12AA28A1408825B02663B970778BF669D585A975ABBA6BCF8513C11BC73A0C33897991C3428A5CB4DFED155B9A2909E6597DD8CAC1AD62F9CFBCB27088860512859761885C5B6C5D89FD6B18F9E324EE8F80B4C507626762A22F4CB7F4527527896AAA97A69B8AA4FB09B16CBAFD73A667E9CB085F7CA36067D4F740694E6C83C671071762FBBA26A640C86422197894CAF01B0AF66960651998073BA7FCCD3189148187BA22DD2661262766399A6B8BB943AEDC590FA048816D1B9D827CA80935D30E1830C8115B18B754F20ACD7A376272C119CC8210C9AA112D604B2022326F51AD674AA1579C081F12DF04A9A2B4571FC1C21A8A4AE2C701EB2EBB0CE65CD2FC22FEE530FB3DAA6D82B3D46E33E9C918F6D33ABAEC34F45391245453EF4D128C4C068227A6511800D69F6A31A1421E2D322F897145961ABEA377C9393ACBFA72AB3C3AAF7F04DDAD50077E7C36AC46E083075265C58DB4B7B47DA253B8A9361C08A1248B53098C6B797622E228939F110ECE18C02AC613E00B624C61EFF4524F92C1EA632553D9B90CD886FD2C364B25C877459BA6DE0AC8CC2A8B0F2C6D71A051F8727C2892D1934857EB995A8D728B9739872EA472E6602F2C39484D290109BA924933D6AE52C30EB4D80935F0D2C87D4DABF07582CAE3C2F21692F0825C079EA6700065A6086B197582B76CAC90A58451D7479965475AC8A6AF662C7D23055C404246264C97BD23D280B43CDEB59BE0CB31E04474CACC4A1453FA10A9E1E4050F97CA3E9AB31E561AB18CB3AF721570380023A9349ED6BBC5DF66BB243928DD3A4B5E113A0F99725C9C8BF673818B89030DB28EDC536C9620A1625C8A647BD3D7055039753E11C4B1BE3AE79EB565E6367690B5338C554CFDA9369E9B1BA75651A0234D2325ED82369BCD415089692547B325EF28189482714C80DCDC5BFF72A6152B70AC2F16707C63A42830DD6CB88EE646D882338D3DCB202408FC5210C71D1A8BA02B8C2AB7E06E43CCD85CE39A215E67914369C749C3978778592D9E34B7671283DC787446B5B70A32C4C1CA4613B01A5D0BFE55016B897130D1BCFB49BB5F08C5DF9F15B6D531B06C53A389500675AAFCA9700FBC310FFF968300360AB631AD95649F0BB47E55B90B2593D9A60BB0477BA848C0DB9F8BF6C774CF8348C65695B31B921E4439E976B4306A47069C25E4A7515866C0BD77B44C7881121025CD2F28430383600E4BA0BD28074B7BBF2A2A3BD62A73BA240D644AB1F89ACE0C8A83AE62F642237DE265765458D6744273E4372ADD9CF5215BD39FA516575BAD72034288CA3E0D3BE57DBC7ADA731F5F13FC0252BC5A9213F502C342A451B933D3060A2AD8A9C13013E3D93455327C187547809FA57FAA299A843A251F8368A715508C32AA57A42F9551520433F9675ADD0359C5997C341464264986FCF67261D16B7A6989EE33730754A2CA0F66B6C98CB421C8E4B36002561B1A5550B93B144D5552AFEE236357C8093932829F864963159A8E7CA992B8FAE006190B55C6A4FC08AD10190D2A178865ABFA35607E1A88B47EC8EA71B102D7F1567BED46AC74F3B7FA6E2EF8CE99508C89CF3C71D666AB065A262581A5FB01B2C9B9444FAFC9EBBE336DC464489861DB8253606971BD0A9008A433ED17752D04023781552
-ct = EEDF2D6926813F52F9128C8EC075ED6B5D0B8B0BBEF802E11D302B47A3E53FFB33C246E79CEC593AED58A77B29C69DAC0E76B0A2B69C596ACA154034AEDF3DE6BEC9F7A0A3D1EF7B4E05EFB0789670E0575FD82A042E35EA81B9AF40546B266B42828439E1BAA4A58D3DBBEB1935578A5D6556F48A839311218F47B18E99CF20E406D968F446C575128E4AEFA43943F9804B6AAFE944AA03682F5FCA2DB078B6CFF32834828FBF0DAD0DDCB41D20AC649A65E009666644B0D3337FBF8D0CE4A95BCDB22AA816BC8037F5DD83AD82CF49E2A9089B778691EFBD5688B2F544CD67D419B6F230CC008FB0AB871C2825EA97EE31D4D72F2970D95276E5F3E156021C595CF1D522B8AB8CD3AE352519A3C733F7EB6A35564D8722725E5CAFB40CD178E3C680F6D531FDF024C0253BD0B9F2613662A35673F68BD1A9C322229C5804E594B7A5BF0EF05E10DA09DDA2AE2CAF143279A60586E9FBC920CF6ADE5B03842EB71BD4F38107C065642F0D80CD10BB866C9C2E422B6B506277C7F87E4A2957A0AF81C276A3FA84FDCAF11C50D708C798B1B136895FE50528D14DF38E74B173823750F7C1EFD787402F9C67D5CDA236AF22D2E189CCE0AFDCC1B6F96163C2C4DD65891E2E39683F5472FDADBD3D4EDF0AC320FD157C0BA236E98B6002E58B42AB9010E27028625D9DBF17EB8DE52AE9928C6390D7EAD758E62C21367AA2D24F07302C6FBA6B5E220467EF632CB331353F62D13C385CCBAE56DCD7B5C7A915855F24C41107B3E512572C31FF5CA29DD7CAC21A831EC1076D7DEBEAE0E51471DABEC57758EAA84903CFCB4710188287C07E5E87FF678D5CE229EDC40F532983FFBDFABFDB0DC4B14C74170B4A2B575C1E929C9466633FB78DD1CF72A42EE3D9BA4E0366FEEA959DD1056E38E18FA56B7B4C6AD7722048D8F3E639823BF26CE29333E60088B7C7C097229D784ABD1326B2C65DF4143CE50579BE5DF3F66FFA725346F0508EC94A4611AD088DB7C3F7825D5A8D0C7CF5E90FC9AAC1000D62F3366CE0EC54836FFBAE061A5CEFD72946D356FFEC1D2047B7F269ECE849A1473E83AC86BBC3F705C0980F380FAEDE71D5AA64A64C0F3372AA3B0F03B4850E1A1D17715D0B546A0D1959F739D520E330627BFEB52519B209255DCC60D6C7F25D0A256E15CF932FC98A392FC390CAF61FD3855F2E9D871E163E08E9D70A895BFE95EDF93432B98E330C7B228708DC2947B13FB3757A9BE1BDEDD859EFE809650D92BEE40D6C4029AC4B41C8F55188E56BFCB5EF665A11FCF62ACEDBC0AD627B46ACBB9444725AAD4A6DC8EB45AC1099F48E451CBEF50C71E10149D91467BB04582CBF7B7B3F26899E22DB449FD5C53DBFF4BCEF470F622C50F133611D7F3F9F8EEE66F1142CC8218580BB42F84AA7E6083C3EBC0DF6571A0425B2DCE8D1F83A5A2C97F055479DED547B8836B7BEDE8177818EAA65CB9286172D9C9E5AC9C7F01AAC5421F6826147DD0EFBCFD92BB4156B03D2B3AD62A0EBBD28B879FE5E6F43881000C521
-ss = EB9B44605E6B8FF3A59E567C1C16C6F96B6079F8E2C4D70F706D30DF82F09902
-
-count = 24
-generateEntropy = 293abb6d1c207927945417cf84883ef010823e11b487ed55239e466e83696d0cff8563038aad865a817cab9ce98846ba75be9363718ecf5fea538aea90b2a558
-encapEntropyPreHash = 26e38ac804fb5b4d59ddf747715e7e6041d875f99c7b638024b4af82d622da60
-pk = 04A592C364AACB2C89689106ABA29029C58DDF7050A2C78787358571AA506570288E747A4204C43E8C6020AA3E2D77B36C3440A618C55F3CAE6D43B979786E6A181D4107CB723BB6D0729CE3EB98E7A979CAEA9508563D5A0B7A7BA55B8985B71F3C489B370D37A66CE048A9DD27AD17B38C66880491985B2AF8916C547E9C6CB16B506170F29304C4393E8274EE254A3F13C6B0E31105442BF92799F21774BE9A0F64970E6AB581626115A1AA3EE4DA7936504D036B75BE6046E5778F58CABA93F8640BDB24982C17BA3445F2AB983B685644B596EF66ACF739039AD0A3CD61BB80B000F7E8BF53F60EBE235C0BF22C7873AECC6B3AE2F3B2CC3BB47D1B88423A188393C43C4999C32A886807CC4262BCD5A588C5E1BF8ED6A6EA9910C19A6042679926F314E7C7C85BF550482735E7FA088C857AC1578560A1A2F7E831223CBDE33A46632B7E24D400A82A8C7307C23D6CA25075B58E727673D7CB5554042CFB9B7F95B11A55A9FD63B1B9F0B60F6931A0BA1AD28B485753446B0005E8710D7189BF438407B8BA36A1687A48E550FA37CF4C6B591AFCB0AF6B8D2EA5A97B6C1729E7AE22E28F2082A5E653B5BABB0D147A8748F2606DDCC7847C24F0D32771B910CCBA85BEFCBD2B89C5035B2062E6B9BB40828902B82E12B752D48D52B7A6599AC014731E8DA091CB30186C849B61954DFF867899E5BF27428229376AC7D97FA03996160964ABE56D3D0278F9F91FEC6BC821FC822949AD5EC8A9D728B95B19052AD9442FA0527B3935F4697CFA3C7413CA2E81B32A57F69479E89760A46D710032EFBB662F9467F0D03C806B619B9228135076FA235D502230E56669E2354C1B412ECFD01A429B5C76B17AE2AB99C73B4110957AA38C22C8FA39C00261C78AA571B953D868690761655FF700803A477917AC8A6105CBFC220A30A0CC1466D7598B2058B3899C567A71A66D5C9DA75085686AA4AD4015100360C6102C84C336C13B229FF599DEE4CB2C90A1516682330722DA110F42F7C0A4F23A2089ADD65438DC66246671BE41E7766641B4C9139777E08CB4D5B953E602931A7DB3E1CE70D765516242AE8987454B898F19C5103BAD39207BB16771B5D4191ABBBDCA9B5BEA711081CA6521149B60975E02CC2250A355897960A8E203BA148F8BE76452420D2134B607976F7809CE97597D8CA57337FBBD6748C03227607FA082195B49753C43047B95A020C7D195B01DD3CDDC4C091916C37E447ACB606F2D232C37C9871831C1FB9A8D00717762F18E62E7995A7393E0A82617DA4674078D8F10065A28649E53377A88BB0F996D84FC83E9496564344D65B73AB96C4E887107D6C14488E604DFA15E55004FDA8B65AE19006EA7C8A7471B354A4E746703D5C79857A02EC222B78B966ECF161D97BA7CF39B37FE173485A0156C3712A6ECB14E629899DA9163709B672A243D1B87E15C0AD611419D85522252BB5A02AB725CB5EAEA5BDA73976D534A881B8C32C5328D117306FC5217AAB89CF51C6174489AD241D1CB261D449F24A235FCD46FC19A8D14A4281906236738A060061A494947BD91604431B1A2871080616EE2E915863B2BF2D9CD86743B0CC12A5D21C6C745B34247C17F9447579FCB9BD38AF3B64CC94782E299E1D98E68F8BCEFA20D1E8DB8552516
-sk = 817471E55466B5BABF92A2AD879C9C951BA60D230ADD630984B2528F9AA07FF755D7D79A2F9AB53D8986FD90895D5401DD97AD3F7A922516279B5858F2087E6491B7BC42B8A52A5952F23622D5603A0A3152990CFD6AB9CD863345D8BE5E295C06B79332B0AC89282E61E5534FE0AAC95ACA140398B64175235B94417B8799A4B6D6933A8B815BFBDCCF886664E7B8C5CB0B999BDCB2BDB288D569666C421E2A950D198158C0D36CED3A74D9032AB7A2B9F276BE025296A773266E516826480E520B844EB69710120373A94705F9030CA200A7F85A94DB1F55D46081570925A476099C3EBDB32C532A6D8F16BE4DE6416D0C30D450808CD3C08131A92551985B92255282BE6087703F182156A13CD144ACA3924FD15492DFD253EE5C9E78853590930521E843A0E37A26994197B3161EE1A60861C344720286B6566796787B05CB8FD76A419C364F1830FE2BCD3A2970E2DAC1DBBB3803F8053591B29BF64C2DC660EA9938200738E2C0C318B77FF86749C43C72F9667D80D462D549BDFEA30CB0D9641B29308A461DF72914B4B40213B62E68B161F83224C1A45472B5464F97C6D6371C69CA0D520426DB8C1E938A934D50AE0B03BE706B74CB8C674EA955A4D8AE1F6C0B56263041FCA1871A5799921C45D9BBF13C01F0A9C5D973086B33ACF923A2721C8B2FA7B058BB2E64F43BD80260B6BB19F26A4F55D53E7CCB1BFE3AA424976132C3B4B3A00908E722557A3657D285C8580EF45B76A207CB31A71402BA1EF280048378B80DC3312F78A74065B2DC873B22D37990E465E425B992722A25009A93A7A005D91B9460AB7C2336BD303883A151E829234C964265E42FBF8252CB89858D590CF0830E59C54021B83DA94884A173BE6BC454AD5A719252BEB52A4F7544A7FBC03CE9091E9ACC0568306E5BEC2ED942B39A8455FA341B84571AC3FCA43C14563F91395D117AB021C8F141A4EC7364BA4ABDD8896BC6B281C751A66C767AC960AB52058335E14E7FD8A4E1D44DE2670F9BBC67F682A0657530EBA11C31381897D989BD392FAE02D0AFBAA5AFA1748A80847AF4B326F970C6161E15B212A1C66003A4317348374E66B29FE87F36D01AF5F1C75BE11BFEA21DD8626765C46F0C153D0555B419227D50DA5232810D8517B1A5E4147A52AD07012D8DA23829F39A40C70D565937C58A11B1A25B27C8207246C4E1B40230E39E4F089D43D562EF954F332B7EA6B36EA28A9D26EB251AB562C0E44BD238874E93A4D3B900A4B2B08A0B68C2B82C0CB56325548DA3316279672913D2021D742C3619823C4391E64112B5B77E8D707F9C1A37D3464CD5F96543F720A0CC6C9631458CD9CEDEA7B6FCAA76D1E60C44F74B986A772CF593AE712214E21179519C39FA533A724FE8177EA59B1123E831E1DC561543A7E559697572157B60499C4C615D02099D34B0738581061A85B2DCAAF13556208B3E5AF388392490FC338DBC55BBF7D25F49F61BD7363CBE3841AAFAB88524B0CA3381F5B22DC84C6A112979C3C39E45157C0749C04B022F83F53733A21E1F1842E0E72F78C6AE1E337B53215AE8563B16D99EBD6225766185A0D92F9A28BBF4E2B444B7C8225148F601D014BBB8839B4B04A592C364AACB2C89689106ABA29029C58DDF7050A2C78787358571AA506570288E747A4204C43E8C6020AA3E2D77B36C3440A618C55F3CAE6D43B979786E6A181D4107CB723BB6D0729CE3EB98E7A979CAEA9508563D5A0B7A7BA55B8985B71F3C489B370D37A66CE048A9DD27AD17B38C66880491985B2AF8916C547E9C6CB16B506170F29304C4393E8274EE254A3F13C6B0E31105442BF92799F21774BE9A0F64970E6AB581626115A1AA3EE4DA7936504D036B75BE6046E5778F58CABA93F8640BDB24982C17BA3445F2AB983B685644B596EF66ACF739039AD0A3CD61BB80B000F7E8BF53F60EBE235C0BF22C7873AECC6B3AE2F3B2CC3BB47D1B88423A188393C43C4999C32A886807CC4262BCD5A588C5E1BF8ED6A6EA9910C19A6042679926F314E7C7C85BF550482735E7FA088C857AC1578560A1A2F7E831223CBDE33A46632B7E24D400A82A8C7307C23D6CA25075B58E727673D7CB5554042CFB9B7F95B11A55A9FD63B1B9F0B60F6931A0BA1AD28B485753446B0005E8710D7189BF438407B8BA36A1687A48E550FA37CF4C6B591AFCB0AF6B8D2EA5A97B6C1729E7AE22E28F2082A5E653B5BABB0D147A8748F2606DDCC7847C24F0D32771B910CCBA85BEFCBD2B89C5035B2062E6B9BB40828902B82E12B752D48D52B7A6599AC014731E8DA091CB30186C849B61954DFF867899E5BF27428229376AC7D97FA03996160964ABE56D3D0278F9F91FEC6BC821FC822949AD5EC8A9D728B95B19052AD9442FA0527B3935F4697CFA3C7413CA2E81B32A57F69479E89760A46D710032EFBB662F9467F0D03C806B619B9228135076FA235D502230E56669E2354C1B412ECFD01A429B5C76B17AE2AB99C73B4110957AA38C22C8FA39C00261C78AA571B953D868690761655FF700803A477917AC8A6105CBFC220A30A0CC1466D7598B2058B3899C567A71A66D5C9DA75085686AA4AD4015100360C6102C84C336C13B229FF599DEE4CB2C90A1516682330722DA110F42F7C0A4F23A2089ADD65438DC66246671BE41E7766641B4C9139777E08CB4D5B953E602931A7DB3E1CE70D765516242AE8987454B898F19C5103BAD39207BB16771B5D4191ABBBDCA9B5BEA711081CA6521149B60975E02CC2250A355897960A8E203BA148F8BE76452420D2134B607976F7809CE97597D8CA57337FBBD6748C03227607FA082195B49753C43047B95A020C7D195B01DD3CDDC4C091916C37E447ACB606F2D232C37C9871831C1FB9A8D00717762F18E62E7995A7393E0A82617DA4674078D8F10065A28649E53377A88BB0F996D84FC83E9496564344D65B73AB96C4E887107D6C14488E604DFA15E55004FDA8B65AE19006EA7C8A7471B354A4E746703D5C79857A02EC222B78B966ECF161D97BA7CF39B37FE173485A0156C3712A6ECB14E629899DA9163709B672A243D1B87E15C0AD611419D85522252BB5A02AB725CB5EAEA5BDA73976D534A881B8C32C5328D117306FC5217AAB89CF51C6174489AD241D1CB261D449F24A235FCD46FC19A8D14A4281906236738A060061A494947BD91604431B1A2871080616EE2E915863B2BF2D9CD86743B0CC12A5D21C6C745B34247C17F9447579FCB9BD38AF3B64CC94782E299E1D98E68F8BCEFA20D1E8DB85525167378EF967195C977D43A50D03205044006715A6A8A8263D717F40170B49E6BD0FF8563038AAD865A817CAB9CE98846BA75BE9363718ECF5FEA538AEA90B2A558
-ct = B36A4CFD44E71ACB92C3E25C36178609188A91E88AE7096874ABCA6C47E37ADF762D028541985915FFB85F3417B024C47B9C0C2BBF682E76C04F6B69EFAB7E2B4DD0B1E72E9408BBB61C0200272F02A8DE1E7ACAAF9E6A7EF4A4C54C224CB35C7782A503C0DA7577D4696C491870ED05F930E0E93C1A16441B603E76E125AAB09BF1EE9152158C9BE7AACAE8688BA2FCCB23E5932A818EE089566F8D0A3EFE3E59AB73F73972679215710E92235219692F27FCDF08699E5D1AE5CC07F9508512EFAAEBB86D86E29C6368184C7B4EDFA14901274EB3E19E0D3B542550F03D3E8CB752376FB9A23E467C4DD8062ED6FB10B53433A9A122F52621D4138AF03F48D3CCD10F701C33D0324A3341595433215E00AC76959255332DC35EE687045FF208ADD581F3AD9BDB7C7D435954CB437F995EF3BF22C0A475979D97BE46A91F9C3934170505037A79B29112A2D3F3AFBDA3188BC43E3C3B746647E8D722455D0844957557B355F424AF2909E46B9DDC68F4B287CF7CABDFB703D92DEA065623E9A3B7F4622E7C5365C04D667D04D172FC2E9E82A2A526441EA71B524DCEF1844746B06CBF7D083C09A020268F8FBEB92491B8556813781F74F32985267CD7457619FFE986AF32254F5538329904CFD8E438C248FB005A085B81448C45FF17BA45223E2B47246FB6B1B4A2444505FB372388ED77F4A8CE7AA2B9145E2CBD7DA00663E58300C919AB354C77E29A276E2D6DFF26594DACB12F56562447BADD8DEC8476F56567A65C44B791BED29E50AFDCE15FCCF57A5531D7614ECFE51AF936F6E4182B281B1B39DA59C20B3B0807A770DE434A8B72BEBA95D2FDFBF08AB29DE3E1C417DA199F98EADB3EAD1F25B40762D7E7487A3DA02E3072E0A15A33DBEDB5209C3E32CF9B19FE4825FAEABEAB1E2E63DC8E8B4E5A50575DF7103F7B58E4CC1307553ACDA05172787CA52BA594824AD90FE1CC702263C8BAB4AD690E11ACBA025BDCD9A299FCC1F801199272FFB5A39A6137F127B83B98DF5B19D940BE257FB0844804107F6D5A7D1089F17C8DAC90D59035C28297DAF136600C18515DBEF0036CDCBDCAF8BE6C4AEB1179E389AA345CB5DF024F9907342435657D5599FA424E51AAC32CDC57E025B672DDB87658DC23C3C54BD8DFC916863829E3F7DEE39B28B93B2001B8434EF90D1E5FE0BEDFF2D31B5AF01FE5F996951F31AD0D6F173F50CDCD5A7333E7B3908D8B626E3F08FB1D9EEDCC360E6ECC4B74BC33834AAABC355CD4432B09C40C011CF7AA90AD8A756340D30B3D7A3E465C9A19173B58245B1A8F42C875F96336D39CF60F1BB341680177D31724E6ADBE668AF76720C2E398A5B42C3C2C84384EADB951914398C1CB092B870449C8AE1BB844CB5DC7B32B8F661CAB9B298E8F90CD4B4ABC63B590A6D6D183DE03B3F61D5C266DA83C14847F71E5E344441CE178DB44B2CD4C644EEE4371E7B9793343F86361E13D1F8664FE439217241ECF8C68467941F48939485046BD833A3ED8582B9415F25C2C7650EA1E51
-ss = 5635FED1A43168075134D0E6DD4C9CFF6E85F3860B3E9F1CAC06B249D62892DE
-
-count = 25
-generateEntropy = 74d87c7556f2671f2d666854a4d6e073e69f35421e6e1a428cccea49c37f972ce1fb7456ac0aa1b97068f452cba64ebdc138bcf5d36b0a0fada2a3b374141eb9
-encapEntropyPreHash = a319d2b8f114f1acd866478bcdeba6fd164dc4e37b0adfa8d8034afb3e197376
-pk = BFD11FC259A2115806F9F68AB15859A763A49D169D615B4999714D550707E8A0C0A93C8DB2FB5E4DE7C93111206F052A7D7A5E0B5632D94C7A87596D24E950B361A185F065FA96435F312745164693FAB8D3A741C56C6F10D8BE52C06A5D83CB1BD327E5B28DB12291D907A2888136B6FA3A20A48990C6B6C81499DE2BB12D19B591234D55C4549A3861626167C5A17CC2A4CC9F668DF0707D26795DE7F771BC614B994B574FA309A1E1C8B4A0A4AD6240286BB78BA701ECC430269A37843149E1F1AAB731523359C735694F09298E2A1A08C6EC273B4A1D57118B20524FDA18190C2029DA4095EAD53212F609A76A343D5C68FF17CE6B92B340DBB8CC6C03AE4B29DF243B93233AF6B95EB5A7A8B8643B0CF5A8114152B8EA54F0E3668511CEFF536D888BAEF85A62299C641769023B7B92088546F338448C1977804B71781A554BCA5F13C0480B42C5A6626904516139ABAA54B429E7A0502B17A5A2727A7F230D63C5764DD497F164B24E5BA3A626785AD1B917A6B77B175E64323783C9791832A7C442B895EB338E6A29EF671D4D7C0230668C14BC794CF11340229AC905891CF1C51EF62B6A4A0553331F7F581054DA45C370BF606126B39492E4A3B8592BBE0359BC017557379471EF922367D82635D8494C88BD38A7720669A1F9145367A92090FC5DF15C034B82CDD9B7CB9CA76E74B2069C36987556012BF0746424677F60ADE29C9CB52C6D9CC2052394691D7306952C65EF498DA41279EEABCCC66B3A41747A8B447D7EE81116EABC04F4B776923C93A28FFE888652FC34415BAAEB6854D4732745A4BD5BA61C35678780063ED874C81823CEAE41B9684A05410266F7ECAFFBFCB5285472E5B02FB8C15D126410F0BA3BA8536CFDB65D23797414A55F2620BE653A98F33C95690714FBD3418C6893F8693908D41D6D69A744E63B2B0C190E3B1696A5C8B1CBBAA4719A0BD184F896C9D8F926DC933BA81B2785C05A51B22A95191F43DC23B42C050DC9133DE2B003A5B6F1A5730F490454C58AF291CD8D46ACDE69842DF79353670A54E2C88CC693745516EE64C2AFEBB95DF25EC0608AE4AA9C89215D471BBF68DC6530FC0FEE495FDFA09E98BA8D37F9636B270BD1102579EB7F1BF0B911CB79F03537168867EAF60D77D48BE27BC935B02662929DBF2263270670E0601E5E43008BCC07F06451E54755FCAB421D584BB603008C9909CAA61CF99A4B43A93EA8A3440991BA402C9A8FC51F90584C55EAA450B7A600342E98420D728A8B6344659F2A0263140E69AB86BDC6B20B3AA0920B90C70C0108358C8A92B27635154AF9A0A76080EE593CE3D37E40FA33D0C654AA77171F822E0082C95CB60B54A6A26099443F671E863889F35A0B9597B3442A71FA704F164834FC9C8E2C63847C9992CD73C1BFE7ABD3D75448D21926DA0938F92B9133A92E426DFD2634A677878EA9820F5C26A2382FDB1C4B8ED59DB74B4490B87B0DFC35F5B22112E5110D494E53C50D3FD6C64CB485BF5AB37F7A1B709122C7086D3FA56FDDC966DB2C53E09B976F986A334290DD8C3C7E6582C4EAAB182766FF70503B03B4E68261CD0303F7A83732795CBF84A04D78A541A0929691C94A094B7B8F92C5D5A3BC95122A6A7968DBB1334A712823D470766B3B9E7B55672D02AE
-sk = 60E93BEB5544294BBD612141956430CFF041E0F969E954A48298C7B5F321B9E1B70B7C796A753CC5BB93722B20380ABD6B8AAC4F0B102DDAB380B88AB9DC040FCAA8B775882A673864FB757A3453273627DF0690C90000B54112DCA50235BA14FEA59A764736A018A091B822A636AE7934A33BC5C15A7B77E1E53289C9757EC75CBBB792645325D6755D79B972AE993C9E3413AC040B3BCC85C4F98A2E185BF4EA1D19A4737DC78547847B7EF385D2A07BFE272764CC873BE8CB1286A0E7C83539D2B9BAD5A17F0893CCF41E2B5CAB8F66706955C5E168A99E9820A8402CB25A434F1A149F0148761014D32A51BC73A8CDBCB104C29BE554B2724107EF314C25D082C7252E0CE68833A47A619A611B08394960A64D8C22C25AA1121A8033605C9BF35221730B15E6269CC25FEBCB8E3336870B3C1C9D3A89DE4A9042758F517B55F85133B403C501590A0F53542239118F93874B319BE0D063AD82144ECA6156051424235D785C92AC00C412F8AC0FF5B88F056142F8A0934734B09BA14C00089BBA136279A5FE462082AB4B0709A6DB3279F8E9544F3909FF78B264399C2ED129C803B341D816EAE96BC531952D55059EF0233B0C18E1F7AEE5498FF6F11DBE801DFE193BB61B870008AE57483DAEB8CA7CCB460193C68A509E8DC738FF227FDA89B21EBA0053992A4D3A1F8767C0D3F3419838C8C7A2C0B3D68E737BA77221C68A8570948A322A143E5A03888C08A1BB7C42E9DB9111819ED94523848BC32781A881A468D26AA7FA4ACB926AB8695B24A094B8CCB0423192CEA88C1FAC818A6B0CA19E423B7AFCB51B121D48EA44037963EC1A325DC0BF7555977F468FEB49B8346338DB983E512B2FDEB35A300495F437CBA88C36D01536F7A56BC9DABD1000B77751031102CABA7182E2C440919435A14BC1AE1B354499324862885C9C301B7258FAF778CD0A4721F26EE32C5DCC7A7283DC10E3CB04713255D0044BF1D9234F5180F32483F7079B2C0558B95C622DB01BE885B2580931FC8617B6940DDFD54CB327712DA02F90A6A8DDB6BA17A31FB1D7231D94CAC2FAB88A43B0F56968FE2B724FC8A97E1A371C96A9A17A94FDA08897BA1EDF959F37029A84E707EF676B89FCB5E94B8997D95542E26CBD28A7D01B1FEF76B1C91AC327874C04F01B2D6280FDC60CEAD3587BC0AA6EC76F064B3263B2419BF3120AA7791053BFA6E089F6CB8BB020B5C5E2517D4B2F34EC3C4237AF98DAB3F4D44AE161773ED53F391A689D7B38F01155FCD080869656E15BAF9A2A6419B38C2EC39112B4216FBC5D94771FCC4369EB90AACCF3A752020E24F97C30C4C67632180E9B928A0941C23C03CE588F7D841AAB91B74B7959BFD8B5B042294EBB094B523DFC425E9EF70BD2E2BCB2937EEDBA0AD018737BA91A3691030C1A6E54C0BD4336A4BBB7C5DC79057EF5C574C04DFCF9C8407CAC999A54975B1A45519075CA167B8285B2D554EB81702E30626897413051AA546BC63A42723BB95F0DCC525944C967D7A5793C34C7638EE59608C8680F2418B648B7450B09C31BEBAABB956E1203BFB3D377373B5483C93378F15DCF2959D0E02A15E2277B7AB78CB2BA78703F13DAB307BA1B663C86BFD11FC259A2115806F9F68AB15859A763A49D169D615B4999714D550707E8A0C0A93C8DB2FB5E4DE7C93111206F052A7D7A5E0B5632D94C7A87596D24E950B361A185F065FA96435F312745164693FAB8D3A741C56C6F10D8BE52C06A5D83CB1BD327E5B28DB12291D907A2888136B6FA3A20A48990C6B6C81499DE2BB12D19B591234D55C4549A3861626167C5A17CC2A4CC9F668DF0707D26795DE7F771BC614B994B574FA309A1E1C8B4A0A4AD6240286BB78BA701ECC430269A37843149E1F1AAB731523359C735694F09298E2A1A08C6EC273B4A1D57118B20524FDA18190C2029DA4095EAD53212F609A76A343D5C68FF17CE6B92B340DBB8CC6C03AE4B29DF243B93233AF6B95EB5A7A8B8643B0CF5A8114152B8EA54F0E3668511CEFF536D888BAEF85A62299C641769023B7B92088546F338448C1977804B71781A554BCA5F13C0480B42C5A6626904516139ABAA54B429E7A0502B17A5A2727A7F230D63C5764DD497F164B24E5BA3A626785AD1B917A6B77B175E64323783C9791832A7C442B895EB338E6A29EF671D4D7C0230668C14BC794CF11340229AC905891CF1C51EF62B6A4A0553331F7F581054DA45C370BF606126B39492E4A3B8592BBE0359BC017557379471EF922367D82635D8494C88BD38A7720669A1F9145367A92090FC5DF15C034B82CDD9B7CB9CA76E74B2069C36987556012BF0746424677F60ADE29C9CB52C6D9CC2052394691D7306952C65EF498DA41279EEABCCC66B3A41747A8B447D7EE81116EABC04F4B776923C93A28FFE888652FC34415BAAEB6854D4732745A4BD5BA61C35678780063ED874C81823CEAE41B9684A05410266F7ECAFFBFCB5285472E5B02FB8C15D126410F0BA3BA8536CFDB65D23797414A55F2620BE653A98F33C95690714FBD3418C6893F8693908D41D6D69A744E63B2B0C190E3B1696A5C8B1CBBAA4719A0BD184F896C9D8F926DC933BA81B2785C05A51B22A95191F43DC23B42C050DC9133DE2B003A5B6F1A5730F490454C58AF291CD8D46ACDE69842DF79353670A54E2C88CC693745516EE64C2AFEBB95DF25EC0608AE4AA9C89215D471BBF68DC6530FC0FEE495FDFA09E98BA8D37F9636B270BD1102579EB7F1BF0B911CB79F03537168867EAF60D77D48BE27BC935B02662929DBF2263270670E0601E5E43008BCC07F06451E54755FCAB421D584BB603008C9909CAA61CF99A4B43A93EA8A3440991BA402C9A8FC51F90584C55EAA450B7A600342E98420D728A8B6344659F2A0263140E69AB86BDC6B20B3AA0920B90C70C0108358C8A92B27635154AF9A0A76080EE593CE3D37E40FA33D0C654AA77171F822E0082C95CB60B54A6A26099443F671E863889F35A0B9597B3442A71FA704F164834FC9C8E2C63847C9992CD73C1BFE7ABD3D75448D21926DA0938F92B9133A92E426DFD2634A677878EA9820F5C26A2382FDB1C4B8ED59DB74B4490B87B0DFC35F5B22112E5110D494E53C50D3FD6C64CB485BF5AB37F7A1B709122C7086D3FA56FDDC966DB2C53E09B976F986A334290DD8C3C7E6582C4EAAB182766FF70503B03B4E68261CD0303F7A83732795CBF84A04D78A541A0929691C94A094B7B8F92C5D5A3BC95122A6A7968DBB1334A712823D470766B3B9E7B55672D02AE16FE956BE4601573D72306A251F69BC2181253E2417E178341FD6553303AC189E1FB7456AC0AA1B97068F452CBA64EBDC138BCF5D36B0A0FADA2A3B374141EB9
-ct = 535A002076557FC2CA495E8000B26F513DC41524C6E04F786763FF14F915D56BD6BE3F26729E41FC2E43456CC5F70DD25EC772E9030FF80A81A16E352CE7B6FFB5BA34DE56290D1EA1578A56B8D17A0CB5AFAE7987D15CE029516D88ABB555AE84B9F626960FD8DA732BF8F1A650307030316B8623B0596DC6CD8C72354584FC806DA654B0ADF1313ED3DD6A4B8F81A5C2600E36C57F28AC00AD18A48C00C8CFF0CEA1F8A53D227E89D78D533834816ED9B2A9EF48F6C5FF4D572EEDF497342ED6EBBA80EAD83EE6764F84DD09C5F372F263CD7195A50DD5695CB9B09C8E996994D7C94A19966FE74FED01139D2658AD75AFE22E0ED321D12D271CE2DEC1099E77573A3983574A63BFDFC9EA559A220135C9D8FC22F4C7A3A0506D649BD4EDC66D67A398B4B1B6040284AB0BDC60EA62F0B67D42F5CB6F5A3C6AB38EB3B2BFF6D7385143F40EC5CBDDAE52DC941235D980E4DDD79059790897FE235C11BF88A92EBA7E6EF524A4AEB827C057B75E802539BCCFCB33B5BC5B00DA2731B8F4A5A42A7AE901EB8B7783A017128C3765AA8A3BBF92EEBADC48D983BA16FA0043499302781AE46E2F066C312DE84EF0C0A837E8B6F9F633F8D2C2190A129D9A00A18E04B2DBBA18A0590BD6B50B31E470D85C803FBD35ADE162982AB659D7A627811B76217435A104860173AED6865A3E1967939BC8465D4F3E5D3C88091D1013FE12A2110E6FA39EEAB39A9EE545DE65263E1BC956BBC5ACEB6D6EE2FC0F1C4EF945C21C36CD76DBDBEAC43D440C1128A30A0CD581F434B2E5F45AD26B4C59CB6B003D945343F8413681B590C6627B12058D671B220DF6A0270DB87F1A81F01ADF0E33AFB686E76DC414684023455EF3465E26208E66F4A4C5C4C685B415DE1182DA6782DBA4CE1370D00E411CD2709D3596B337788F40574B43691F6A13741A75C8A973C626FE6B5595DEE15F997594C873605E8DD3F0137D358A2A5B1BBA8A9AF285E1C02D05944041CD7082BA247C24810140E5E9AF32D010196EF97CC40B95F5040469FE88E7557EB30F2E638647CCA2DC1845E582416345F9DE6DBBC6A007DD368F1827E7B29E296123FDDB818D9A25FDB429D45CBC59D0D74D5380E582EA7C73EBDBA8A4CDA6582B68FC07A402FC1EF8F24C1473661C091A942E4F316602470F779067D74B1B6BC61B8133ADF1E5FBD374DB3EAF8CE169E02DFD2162AF1718E7F21CFEFB86EB5AB879615408A91B0EDF44281A5693FEBB6C229A0203E66E6746747AE342EDD2C3F7B528EA2A86140E8041F7FE6D671C999DAA5A50C5B01B3CCC35CA43ACC3DABF6A1ACADB4208D83CF49DBAA37843C51A55765E5F5AF141DAF67D3D5AE31A72F7A4756AD27BEBDA0B7B5AA204C8A8E726B42FCE4633DDE43EE434029D60938A3C4C3AAF119E2B3116D5299B6B7C80F9D49D17389101E7CBD668A038C223E7B820FB057543F8EFD37760006006F61035D41ACB177BD95AA8F44CCD4EA8DCD8309D795945ADE186EF9BC22D9921DC2843BCB627C2F865B1A56E
-ss = A920DF59AB127D563D7E7E96AFE8075D8A7242B0AD88D72F367545FAC6DAA4C5
-
-count = 26
-generateEntropy = 013bab0212d04ecd54b478daf72748003a25e2cb060ba6cc50bf95c292b8206b9da0c5da5f195b80fbb99c2e8b06926074f3f604b3f6195b5a5b9737876bba72
-encapEntropyPreHash = ff646071b2509e6b75790917e08e4f0b0d9f0116ec6291c0b59eaa4b583ad830
-pk = 12422CEA108045D2888E2C29CE0BCD454B95C09730D6C4698E779987523DE0E972332544C34350D29C7BC030BB6273B9F1C98C3A63170ABB2641C54DAD64790E83387C51AAC922814F834C4745409273AB00051B2A819EEFC9A048F222626409FA7B3F8D27A0DD754F9372AA37EB92F6454FDBE3116D406B571203DC05201C31A52BA8B2B95B191A7B7B55E743C4CCB80A710863AB741B727F176224012C539AF2BD062BA6BE7A42EAC08C5B6B420BECBB41B55454EC1F41347CCD984F11767BFC82665286A56DD31598834B37CA6EE93658999798EAD094298160B7E6C76978370DB3180273401532315168A161E087D4C6086846A3B60B80103C1AD814843BCA7AB329C7914982ED32BF16507B3024A16F231281A732D3D155FA60260064919C484C1741874BA96CFD91AEBE5C314E407A66D7CC4C846176D759618654AC2A52FE69C69A375ECF625E2889ABEBF395FA20561BA6300A72A2091356FCF197C866AB5468A3AF7BB3DE755836D9784F7C0949445D83B3358721C7DB3C09B5120F7F757BFE3366AE4365B677255EA680F27C310F768E56F1AAB8792259340BD6B984406148A254BB605A291C0946C83B1E9C5BB3F879A787B9106F98809E94BDC23C062D592318F9854DF04BCC343D64387BAF398599BB352F82B1F0A5B530E824CFD69D7A4A15CB5624F70CBEFE1C61302B8FCA337D70D1900DC817837619FA893208DA873C350F02892097708CC637093EB25BFB4B3C793331F0FC73C5446CB11276824CBE419378A224A683FA0D17C671FB8C4BDAF18C20C53A21A4BB8FBA9AB7A1B7ECCC81946BB5FCB15E1D08ADA7761A55D503DBA912B73765FF93A6AB642B5FB72ED4F16657AC448A1957413CAE547CCD76D9936C860C70C5635C28754421AF13448959D67CDEA3997EE923AA326129B5397C15AB90F95832F263E080A42460CF9F081152AA59CF17263D008ACBF146F34A7808257689A3148E58A0A0117FBB47BCA97810A42A7E0F734C0A17745AFC6ADE752080B39F3267399C20B1FDFA195437B83EF5125405ABA8D2CA42040371C541A5FC339772948A21B7EFC30C909C7938779BD012642441083150118CE431BAA72E989425210945A7C47479F4873E3C3CA6698ECB2A050415066D0BBE5E240222A2884B3CC17BACC14164BE0D21330456A279547579F8A4E9443D913A154210A3FD1A1A263186445A8E1B884BBE8B54D0196AFFDC47544C8D10A69378FA139BC8A422C44C5568555F9080F170BC6E97284F448E6C23885D603A732C469B376A762B5068E29E80B74F994588D9822F3E81BA6FFC273A9C905D0910062BBE94AA1E0C8C3424303845779F8C9B515DFA0864578A66DA8AD7B56DA2810C11E1A2888B88BB55B8C096A145B62AD9D2C98E003658C9729D7B82550527411A9C0B981F3479251C1774014749D211687DDA83626C6BFCD5B08F8075954BC10F48623838A736E38C1143B9472B4DF5D30D37F0BD7C727A2F16A3CBE0015DAB5A12E27A63F7AEDB841D6D9BB1A79A5C3E903C9E374DA62A298C549B9842B77C33AAB6B4939AEB55704CB610D084950C41B746AFD7157613618F6F1574BA51B36F7828AF0AA4F79C0840EA3D679013DF619046E935E0BD96EC59643250A0B38F9779B0142A9E546EB525E72AD204D1EB31A6
-sk = 3A756D6DD157ABA65D60721C41EB4EDBEC38834C22E9AC88F03119B472BDA0961D1F5C3268EC6492F92D5D066DCBA69CE9C20311E1C15FA81FA5014C6C956F88055FC2D35E6B295D05D6167E4375BFF23257BA72C0F97F452B609F22B57F7C27F71A4F259938B5AA18097399A0D32C3602203BB6769015495B4BB7317C9E99C966215C58D3455EFCD36003826C2C7B1BB437A66A968DCBA35DAD7098FCE9133110A109C2B91764719CA25866C98550082E88F29E78B38B40A53C4D626FE63390A290B54389624C597909D79FD6A658E2166704C386EB1C8E951B4C7619B7B79349C3F59505809B1095405949CC55C109A1108649552D5F83A970083BFFEB6550893B5C5106417B0CF1E44B6B05A9F9093E386C9D43F14D4CFBABD3B17EFB49AA2C571AE99197D2E4B7D58775962570D528B8EBB8032E8065BDCAA391837D483A27239A4A8C0B8F13013F4AAA6BAC0CA86E532523D9620BF9C2C3E2AED2365E90A1699A4CBF454C4D2E2C4273E93456142F737C8B3697B9821039142C3E25B346D020C829850D6CE2649087AB762C25BAA2639C8C7A852BC76D456EE69747FE561E267844A7E51AE05C5820F0C2B880B05CC935A3BBADE2C6A4881CAC21938A304C4CD2C1CC1BFABD932B777CC459BAE4BE75389862464367C6318A0521DD62C5F070A139A95522D10D2E4134C06522CF52834562A208B22A95431014934F51EC49F5EC087D1435DB935BB5223C3EC87BB7F7427A458232474AD9CC222B422149977C7F366F48B0B14AB260BD0A8C04623F9B12091AE049725064D0BB4A249075816AA249718F1A7768C3469AAC7182D2F01D6373038D7C4CA24802693A354C19C66DBA1C05EB180AD04C1FB095B42947D16B66139384C71206BD0BA9AD9BBB5DD7593D08616C214FD9013E792A5B4930122D1C571F1315D235562C167D7546C8EF7536A929982F6A55CE7209B0D5735F69AC6C52A824E508D2481A5BE01075C54D8743BCD76767B69B5E350989E629C97AC1982A75806126245FA692DEF22B15A29499C82EF7F993EB3472F850527D900DA2F513A9366A4FA978038B9E46752DBB8084FB12CBC591008D692544078343E9AD67909DBD77C18BF18F02607210F4A0F5DC749F8B0BF371309027968968678B0135AF65138C5544ABD57ED8A646409224D32052BB14BAB4D51DAC981CCD838B4A513A36A351B81A0785CA281D7106872583B8BABBD62A5787BAB8EC9019C7009130EC6BE4E25D9992AA1DD13DA9C1A7F1CA27FD78968741436003789B8C781C599C98D2465C7513CFE85154D7A655216E5B3B800DEAA6B9DC7C0D998B9CE2B99DA6AFC27A5EF6C152EB16184D91CD038CBA69835AB3500AC2E87368F37888BA90F219CE9DA24109F0B3E1894DB5F640A17B0E705195A350A61EC62B2C7A216231C530F557D4C5605346A6500B7C1484012FC87DD4526823C447B71A726D65753716B30C212565DAC474CA3ACEE664218285A5C4A726F681E98619E2A289D08895BEA26BD6A3BFF3A5C5C1EA894CB6440D075004F879B41A14EBB82B74AB0131D0B3348742DB7244E750AE2B7BB57F8A95379502827880F8A50ECB1394DB2553C07627C113A300078DB1BAC7B5007812422CEA108045D2888E2C29CE0BCD454B95C09730D6C4698E779987523DE0E972332544C34350D29C7BC030BB6273B9F1C98C3A63170ABB2641C54DAD64790E83387C51AAC922814F834C4745409273AB00051B2A819EEFC9A048F222626409FA7B3F8D27A0DD754F9372AA37EB92F6454FDBE3116D406B571203DC05201C31A52BA8B2B95B191A7B7B55E743C4CCB80A710863AB741B727F176224012C539AF2BD062BA6BE7A42EAC08C5B6B420BECBB41B55454EC1F41347CCD984F11767BFC82665286A56DD31598834B37CA6EE93658999798EAD094298160B7E6C76978370DB3180273401532315168A161E087D4C6086846A3B60B80103C1AD814843BCA7AB329C7914982ED32BF16507B3024A16F231281A732D3D155FA60260064919C484C1741874BA96CFD91AEBE5C314E407A66D7CC4C846176D759618654AC2A52FE69C69A375ECF625E2889ABEBF395FA20561BA6300A72A2091356FCF197C866AB5468A3AF7BB3DE755836D9784F7C0949445D83B3358721C7DB3C09B5120F7F757BFE3366AE4365B677255EA680F27C310F768E56F1AAB8792259340BD6B984406148A254BB605A291C0946C83B1E9C5BB3F879A787B9106F98809E94BDC23C062D592318F9854DF04BCC343D64387BAF398599BB352F82B1F0A5B530E824CFD69D7A4A15CB5624F70CBEFE1C61302B8FCA337D70D1900DC817837619FA893208DA873C350F02892097708CC637093EB25BFB4B3C793331F0FC73C5446CB11276824CBE419378A224A683FA0D17C671FB8C4BDAF18C20C53A21A4BB8FBA9AB7A1B7ECCC81946BB5FCB15E1D08ADA7761A55D503DBA912B73765FF93A6AB642B5FB72ED4F16657AC448A1957413CAE547CCD76D9936C860C70C5635C28754421AF13448959D67CDEA3997EE923AA326129B5397C15AB90F95832F263E080A42460CF9F081152AA59CF17263D008ACBF146F34A7808257689A3148E58A0A0117FBB47BCA97810A42A7E0F734C0A17745AFC6ADE752080B39F3267399C20B1FDFA195437B83EF5125405ABA8D2CA42040371C541A5FC339772948A21B7EFC30C909C7938779BD012642441083150118CE431BAA72E989425210945A7C47479F4873E3C3CA6698ECB2A050415066D0BBE5E240222A2884B3CC17BACC14164BE0D21330456A279547579F8A4E9443D913A154210A3FD1A1A263186445A8E1B884BBE8B54D0196AFFDC47544C8D10A69378FA139BC8A422C44C5568555F9080F170BC6E97284F448E6C23885D603A732C469B376A762B5068E29E80B74F994588D9822F3E81BA6FFC273A9C905D0910062BBE94AA1E0C8C3424303845779F8C9B515DFA0864578A66DA8AD7B56DA2810C11E1A2888B88BB55B8C096A145B62AD9D2C98E003658C9729D7B82550527411A9C0B981F3479251C1774014749D211687DDA83626C6BFCD5B08F8075954BC10F48623838A736E38C1143B9472B4DF5D30D37F0BD7C727A2F16A3CBE0015DAB5A12E27A63F7AEDB841D6D9BB1A79A5C3E903C9E374DA62A298C549B9842B77C33AAB6B4939AEB55704CB610D084950C41B746AFD7157613618F6F1574BA51B36F7828AF0AA4F79C0840EA3D679013DF619046E935E0BD96EC59643250A0B38F9779B0142A9E546EB525E72AD204D1EB31A6633BEE89571E8FC16151491EA71234AB83289426559F90C67903A36E4AFAA6F49DA0C5DA5F195B80FBB99C2E8B06926074F3F604B3F6195B5A5B9737876BBA72
-ct = 66290E0ECE573C5EE5C15E6FED6DAC0FEED44F3A2C6FDF910F5816097505979D8822228DF92F10708F9AD6C9AD71F52BF21068B9E7FC986358C5E7D9B822A359976B5C5D8DC2EA584FF47B3CD97BF8DED0318564BD8263FD6E48FA68BE689DAB249B21B7F4DD81C7B5985260689EC56179975E3CA1597A76B35423172DA506967C0017CECA7977BB31A607B6040A7C92AB6F028A6FB641A2CB4496C25630604095EBBD767465CAB5B39AB0CD296E910AD218B8114BA81EB02E19B317AF3CE56856C8C24176125FE51A0ABDE9CBC44CEB3A5F40B24B6AF0AD28C238BB6D24BEE9A584C368F916DE89F7089B80BE3582B0152E5D775195E643DE9B9947AEBA9E2626CA018476087E35299083E937CB7CEF1B4AE0D42ECCF9A65D12959AB715B0361553C124708EB86F91A986BDF98E1338B692E2B2EE1EE862E6956E6B03E6340A6DC7799A0928EAB7F34DF2F39B990D4E5B7E2E6004642A2B97B9E927AD7668A0C7E56AD51E24DA07FE4139B2876A6C9C22CCA399E2C288C6A9A72F2AEA27410CD58B6216BEEC4D0EAC3220B019CC1D9CA094B73B57C487E8852467D0F3EF354F49AEE5971000B7058F69C6D470BA6DCE6DE957004F1835DF92EAF70FD4F0B9B6C83082D24859DB13547C93B3C3C235BE12ADA95897BC6C151B2147579135B69516CACD5D65AB08726698B7BE6FCC8C0631A3BD7FBF0EA06EBB09999A33A9C6183FFBA9789318A8CCAF16DF3078AFB5CC2C2767D32ECC24A562290F9C1C803F8DA15547E59C38C10673894407930D1F6062D805CAA53DDFB271FF4D7E70DDB921261549478C97E0FE218C319377C9266C518675C53D68E7D2A8705F88A6DB7159D7E4B79BB134098539AD9746B080BBCBC89F7B95B664F3BBE078C24C4BDF833FFA4BF22261D48C4E23B08E330EB523C5E62C15713C07A52183E6D4B539FF789216D39C8C6D5CAFC1C956AEC2931AB89D852AE9C89C74DE09E4052D5955A1CABD0995E1CA0779699BF12511D822CC06CD8B6C225E2B4C8ADEE2F56F0DF582674361FC457117780D60E5A33EB00B609239AD032904A85031A1A9F493904DDFEC5DF8F7B660893650D40C103F9912FE2AF880A7C29817B5BB59A3C5378558152461936A0EFF233B3896DCDED4EB0ACB36246B0B474996C147F7DC2150C5AEEEE1D36C96D0BBA1085A0554E7A4FFC2D7BAFCE6D5353A38C312FBEEADC5D41281ADE8198062A49AAC73FB69E0F657F536418B71A16F04C33C6348025BB2CA8D2544413C6D371B3C7A87C1D8ABC6A1B4DC32C39FBEEDE611AF4F651B536E82468736AF4EC3AE521AAB2FBBE823E76A4A3CCF8853E310E644999528A8D0F4CD434A5B1559367B87FE108FABF95905D98BAE6046F29D3C7EEC102B93072EF8003F2AF04522A5C03FD0B60CCDF3AA7069BD1C6D4E05C964305F6B7065905FF650411B017634D3C0D843F0C1266E7FE6D2F4FE86851F9158936C7038BCB584B1D73F4457EE50D4C491E86BEB7F03815F86484A3A8C106C45B1F665B2ED341789D10E53070B
-ss = 462F8AE0143A9173E7FB5A0B476ADAC03F2600FFF5779CC1DF9DCAD9B1E7AB84
-
-count = 27
-generateEntropy = ccb073c4b90be0ad746e26fb093b60c70110bd1dcbcddb566a8cffb7b3caf80e71600a8982c350df524cde514431ded7aec23576530894bcbf0ec0bfef0bb64f
-encapEntropyPreHash = 0584270ec26f3b9818e4af074d17b2d51037cc8dfdcbe3b140fa4fed5deebc54
-pk = ACE2AF54375D684A6CB1FB38BD9C803A158483F91175263779E75B6D42734DC72FA02BC3B09630A0F79E2F95CB067C7DABF42F409A9635D55106E91E32341AAA4808DF6528C3BA98886184E0195E3CA09D9CC525980CB5A2E9027C6A88E9042BF77653B9DC02AD3CBB04F594BAE08DA4683DFC960708D85E39A28AD6E6A7DC81A2F0F8167633901298628B695CC1868756A97D80B1AFEBB71EBA5969A1086DE4D611F737AF56A83C7378C6E5E04E79A8967514CC668BC8FB7C7A1A671E29D55068E34D883A8320438AE7A44F01DB1D4DD07304081D684796A9257154381EC44562A8D005F3DC4C94D5CE9E36705132ACC8876142194DA54934095C2D5725A10E376432B17BF7D1B085D342CB3C633A085E950248CCC9C7FF350EFC341D07D0CA06E6BEC943353C479506691F2347A29CCB34AD09C929692ED98640E6B8560529CB17030EBFA4C769FC7707C75D86C234EDD78E7B3010FE86BF71748CC1C5B00023944774200B2163B403B8207093DFC959B6AA09FE6B98F6E83F972A50ABF113E9DA2FB9FA10D0D05789CCAF05C448854249BA8973A19C537DD69D3F39744DA89DEBB58705EC90EA56CDF428087D8333B16B1A9E59794D49A40B513B50867979230243B27F3D784932E1CAADF8B58FE11BBEA62DA4875D004A73FBCC90B566AB998A45099194D449CC60B0562570648AD588B213CB99A01283706878287930A71B68B43F87023D2F49829ABCBDE6A37A941182B78B8CC1B93982C7A24457A9E1683D2BCC97B4259518E0102760100E1C26CDD85022A04A91168486BA3413613DDD6C42CCB563379A08096B287B41A011FC9594D132E33957F2A5BC1DB4C57B4C8D9D3135476095DED35B2FDC09D8F996E332BAF7939EFB1032E529606677BB1144374C41C08807C9C0868B0C32772F18B755D7BC5C5B12F8EB9CA9DAB589185553B74408301062C90B2D68504F0718D42A1989F050F9097889AACDC175CD7E6768D626A8C9AA1B0CD6CBE91B10AF1A3E507575B47B6AC8C2B7C801A81985A81AD4AC04B32D0DD880D43B3D36857738369B7898B231B24CE6E9944526B9EF370354E21E38F6AAEFACBDA63497A85327A2112A5DB95179C5285D805698209F2A1B67A7730405B02B3507B4E4B65298734F5EB1B66BCB68F9369ABC01C7E4545568D432A685A6E038122253987EDC55EFAA3D926413DBDC43F9908DF1925031F45D28712734FBCEC3724653B019F7D5698DA7B0C3C90EECE1A1BE3567A253A143723B9550C8F7333DDAE88208667353A6184853A85A99C0C463189EB5763FE59D678349F536C56D014CD92B56ED2AA6B0518F1221A49FD6588650057FF00AA29B93F182B3437386F1F846D2A3C60CD900559425B2B7A5FF88CFABE24BEDCC825552577B5C12E4856DDCD91B0713526098B5FA555F105A0F1219110347AF9016254951C3CB5C7EBE602564242276399B0048AD8D370B544B1CB9789694C7753EF2CD4AB51513CB33F38BBB10C83C9A1A5FD1489D97476D9BB314849581D688C3DBA01662B539C50B0DB8E889A4654E6AF708A64910FC503CFA0ABC21B8ABC233AB978965059C41D1123A4BB90306AA09263B25BE885F4DB186D0E720E97524464C7F1B57E338A864D6C447ED4E29D88C30BAC7D2D0CDBAC43E9F4176F0078C715ACC
-sk = 0BAA531A985251B6B10153C8FCE6938A280E93F9ACE7A56DC7F44FA8BB2F88C09290888DA8134A0FC43CCBB75B50B6A724D6812183ACF876036DC252FC893419280314C7611750875821B2F3AC4F1C20B06365709BC07AD4161C94C41930568996F8CCA58C4A0536CD5668488715593E66621F96C87A2178A36438DD4C390CA0532D30B88DB712CD3C50D30BAA91C98CF0BACF32C60C81468307CA35B47ABFE59174E53467CF7B1D376758F1A5926FE225F0078FF288AE24D23241709E471624285C4FBD35A333088DD643CF6CB0AB6B27C8B679792ECB8BA4C28CD8B09677F0A7EBB692ECA6777922C4ED6C20402533CBB9A3F1E0C10250209EF128A626B763B30B5E49C4C4691E3A13C2C2601B6666ABA1D099987990BD1BB00AB5806390CE8088CAE30A5B20567295ACA7F0191CBDB4795E78BF150C7954F9A49880C218C23E59014620E18F18C536DA0B7807B0C9E11B1E341C2E7E5BA799653FC669C1032AA014CB79769361B01091B5E000CBE100933C6D05714481F491B2355E72638831D0C4F4DAA18C6B4AE6E825E688CB812490FA13B43D306E5BC857FBC18A61923F6B685E5FBB5BE9C1871A9822FF07CAEFF40318482144143CECC5B0C579C84FC949EF359F0B24B20FC0A9F3300A3217A8058469C78B7998744024E275CD1C70A96A75FD86019CA031FEC081DBDB796A56186D9A1DF8C098940527D34A1DF2DB50B5136B6737829F0CB1DA3B131AB238207A011F02BCD346A0A7138EBE3CA2D78646D7F98D5A886A24B83F8FE84AE81627011A2633F1C159C3870F7C69126B3C31F50D356888F9077FC207168CB075E0940FB7A0BECC556DE78089ED512A39A6ADCDA9C3C5126D874B50C163BA7B091656E52F9813CB318C87ABAB12A3F8996A4CB446D0793055CA177A1BF455CB956443E56C160F4788CDC6B008C086403BC910332D3E3274F9825E9964484D7A52C91C275E153A496801C0E6C8084B25B53C8EBA77A9412291DF78BD39895DFED82FD3C92947A1BEAB598D33DA8344C88A9E073E28549FC939CF5C6978B6F74CCB23675616899FB69C5ECA0C6B68090A338EAB57A222FBB5A482837C097BD40141659A2A71D81E3BD38D60D0A903592B768B0CE60A7044350A75FB02F19482138603A9D8CB89BA6A32D37A15549548AACE4636047D66CA4DE6CF7643C2A5939478A39873820578150172F965D4DC6CC6D7ADFC360568A53C97D268900B7B20122E50CC5E460304927333BEB7BF73446064D76C3AF1274B503203804774B00F02534772CCB83CAA8475651460B156A7238DA2A9847D445F55687A84BAA06DD69D4A637EFCC1C09F81BB97B541FD77A96883869731AC776913ED6C02EF03183B27B4655639509B1E8BBA74837375628152814448F270B6DD865C888180AA071A2AB42740E93F05B32A9C85A069420BE2ECC5335738F9D46C90C5AF1625779F3A329DD693706618AFB300B5C7099C220126C8398FBB8F32A2A35888BCAA187950365F022585C2E08243F53122B6C5EE9A95B84151AFD10B2110135C2A940BB8370565BCD8739609C44F4AAA7C5C266C6EF7CAB87B351236702E327B3E53555E24ABB670CA6E505DF0E0AECF7513F7E36374988DACE2AF54375D684A6CB1FB38BD9C803A158483F91175263779E75B6D42734DC72FA02BC3B09630A0F79E2F95CB067C7DABF42F409A9635D55106E91E32341AAA4808DF6528C3BA98886184E0195E3CA09D9CC525980CB5A2E9027C6A88E9042BF77653B9DC02AD3CBB04F594BAE08DA4683DFC960708D85E39A28AD6E6A7DC81A2F0F8167633901298628B695CC1868756A97D80B1AFEBB71EBA5969A1086DE4D611F737AF56A83C7378C6E5E04E79A8967514CC668BC8FB7C7A1A671E29D55068E34D883A8320438AE7A44F01DB1D4DD07304081D684796A9257154381EC44562A8D005F3DC4C94D5CE9E36705132ACC8876142194DA54934095C2D5725A10E376432B17BF7D1B085D342CB3C633A085E950248CCC9C7FF350EFC341D07D0CA06E6BEC943353C479506691F2347A29CCB34AD09C929692ED98640E6B8560529CB17030EBFA4C769FC7707C75D86C234EDD78E7B3010FE86BF71748CC1C5B00023944774200B2163B403B8207093DFC959B6AA09FE6B98F6E83F972A50ABF113E9DA2FB9FA10D0D05789CCAF05C448854249BA8973A19C537DD69D3F39744DA89DEBB58705EC90EA56CDF428087D8333B16B1A9E59794D49A40B513B50867979230243B27F3D784932E1CAADF8B58FE11BBEA62DA4875D004A73FBCC90B566AB998A45099194D449CC60B0562570648AD588B213CB99A01283706878287930A71B68B43F87023D2F49829ABCBDE6A37A941182B78B8CC1B93982C7A24457A9E1683D2BCC97B4259518E0102760100E1C26CDD85022A04A91168486BA3413613DDD6C42CCB563379A08096B287B41A011FC9594D132E33957F2A5BC1DB4C57B4C8D9D3135476095DED35B2FDC09D8F996E332BAF7939EFB1032E529606677BB1144374C41C08807C9C0868B0C32772F18B755D7BC5C5B12F8EB9CA9DAB589185553B74408301062C90B2D68504F0718D42A1989F050F9097889AACDC175CD7E6768D626A8C9AA1B0CD6CBE91B10AF1A3E507575B47B6AC8C2B7C801A81985A81AD4AC04B32D0DD880D43B3D36857738369B7898B231B24CE6E9944526B9EF370354E21E38F6AAEFACBDA63497A85327A2112A5DB95179C5285D805698209F2A1B67A7730405B02B3507B4E4B65298734F5EB1B66BCB68F9369ABC01C7E4545568D432A685A6E038122253987EDC55EFAA3D926413DBDC43F9908DF1925031F45D28712734FBCEC3724653B019F7D5698DA7B0C3C90EECE1A1BE3567A253A143723B9550C8F7333DDAE88208667353A6184853A85A99C0C463189EB5763FE59D678349F536C56D014CD92B56ED2AA6B0518F1221A49FD6588650057FF00AA29B93F182B3437386F1F846D2A3C60CD900559425B2B7A5FF88CFABE24BEDCC825552577B5C12E4856DDCD91B0713526098B5FA555F105A0F1219110347AF9016254951C3CB5C7EBE602564242276399B0048AD8D370B544B1CB9789694C7753EF2CD4AB51513CB33F38BBB10C83C9A1A5FD1489D97476D9BB314849581D688C3DBA01662B539C50B0DB8E889A4654E6AF708A64910FC503CFA0ABC21B8ABC233AB978965059C41D1123A4BB90306AA09263B25BE885F4DB186D0E720E97524464C7F1B57E338A864D6C447ED4E29D88C30BAC7D2D0CDBAC43E9F4176F0078C715ACC3217D034B472A846CD317681C0F36FEEA187BD40E546DC4AD69C2E67FD9D830371600A8982C350DF524CDE514431DED7AEC23576530894BCBF0EC0BFEF0BB64F
-ct = 7613DDA749B9B371C3430BA4A29B0E4BE5CA55287B1A1D0C760939DA3C998C7D88B2C8FD7D43F1F2C5B573EF16B48D339738D0D3AA0CE094D5F1077E23EDA6E6E8189C6CA76A7517FFED4C3C59184E8D96E74C0B284E8D21076426FDCE05C3A4115CD8ADFC0EC21EB5B86059D415D515287E44EE2E733EC27D6AB5945DBCA92B9BA4339DEE417428ABFE9F113D5E13C602AB11AE380E54421C4F713F0AF28C9C97B430A3B6DD7113EF98A93752F5F7FE4C763D3D7EAA53C8DEC6A796A37D97CFF28ADD820D317AC023DD3202C072303D5F172492AEEEF6B1486399E45167D8CFCB35011BFA166DAC078F10B49A776F9A00A227531E4B1390E3C9EBFA49C1C80046A093CCE478E1C91F0AABEA97BC0042330B26D01BA19C07355FF5612BCE097E351D891184725F2D1F95B544E615020DAC8691365149E5AED1E387B68B0E7914BF8E3E94267C5E1E525D8994221401A4048ACA3AB586B352FCAC09D41609012683B748661B5F60FF64C95F410D4163B07225E9D429A22B3DE3A8E391352331216C3D229DFCCA782F832DC7D0A830ACA4B9B1ED37AF42E6D9746286AB161A719F02B4A241CC65156E5A05359AEA4FEB750DB28B6799523CD42D70A1F84EFBD98D5F02229A97071D9105948C372AA52E9F132DD96D4AD3391599D155DEC585DC0C423B4175F5DB53BCC6DFBE384CE6705416C64F8D60A8704822E20AA05BF226C512B0AAD25D5D038E1D33FEB4376364CBAA41116D9B79D061DD61F8EC03E6D731574C83BB05EEA5AB730E51C31F7CAC2FD4F675824031AB5ECFD784AC57871092FC3CAD566E460856F77308424C7418FB6F9C4E9F3EAA8F3F2A5AB544C18579DEBB41B02347294E6816A873171F8C2A6E4C529205B98C1D77638FE2DB105CBCED66817051DAA83E89ABFBA25DDFD1D10620C94245645265A1094B8BBD75851925448629673BBC222B93A2DBAEF4B58A370204752CD993F3A10D6CF379A17DEC1A909DB1AD047F84BB50B244D15742543F097CA97E2597E2EF03DA5E50F054B8B439059EF9E82852A6E9A22C6DC6782333F858CD4D6B07C3BFA8ACAB2271E32D13297235934F4272969F5CFFC744CAB9BA3584AE869B52E97FDA0D77C11D255046CEC3D57E2408EB5AAEFE91E541C03247E28E96905997372D9ED7A31378351A4433F1624CE6A1AE1CA2A7B27DC2F41E126B776C3B72DB38CE2D7C1AB8E3CE8E7006D0E98EE2B9F3CFEB5697F302E5AA5B59064FB5CC2BA5C688B7056ADC0D204578EE44DFE1D113310BDB08CB49051363D8BFE16F2F782FB3BB992E3815E84F3EB3268A21A356178D09F4770AD6BB62CC8F82A29BD18A854F05E2F3135AD8BB60B752A8460DC53C869D4695E44B6BFEE3AF8920113DA5BA5747EB35BE4D5DF27DB9A77C6181143F0831410B50A487F918BA58A30FDE87ACAA561E662D31AEAE4672894E7EF8382027FDBF019893503209352FB63446C8E851AFC0DC22D62DBEEE29F43BC40E49B66DA3AE7D1E2ED93E760BC94BBA7FD1F47CF4D41C9E7A3C7AB2
-ss = BAD63432A274BEC85E9C361191A3431D6F211F1FCC69173B9FB00C0517AC3B3C
-
-count = 28
-generateEntropy = 2e889f44e28901e9ac7ca6b2fffcb124c8979401b17064d7e1d51a7e3c3adbfa0e145e44aae52cfc609e6f47fd7a6f6af877190ff52256d0ac5b05b89c3f449f
-encapEntropyPreHash = 51e05c7b4ca3079781e8293f4eccebeeb2f8c8b4c59468eddb62a21bcb4ab8a3
-pk = A9C823EFC5C946DAB44B5B2068D61F00E7B0D87CA67706343927BFE4C12D20D69C4A5BA892F97EEEAB7B5A45742CC4AC4D37219AD72AC312051D31B8385CA2293415A13BB8983B8457B8AF9DCCA9E6322094CA68399AB77DBB9F6AA7CED5F224641C3FA07507DA9A08E0D180D52585DFB3B2FC95CDC733A573A888D403CBBB71C120BAAE2A195278370BF33299B9B2684ACCC5288A3CBA1277FD3999839A6ED29BB91D71A528BB2E4F953778BA23341CBA4B9B3C17F9A8366212AF3B722397419E24874B163470B3B2B7F24AE62258983B6161C6773B5AC90969C03D01CF4669B9D1F46E05705D4F676D464264D7549E1E2C3290C9B2BF5A71132057531714BEDBC7A91BC0AD56254D298908D33D588951333B3CB7924ABF14B0D70652C45AA62CC3062D851E45C866C6200DF4E74A9E559B9E6AB738F2B0DA9693CCEC3D968A866F0220CA95B7C6E8B04EC41D39C17EAFAB77444AAD4CA3A9D6B5B5D4611A6C074FDFB01F7DF68AD2440EFC5588F3B4A5C4106EFA3B9B6BB35C327465C7B656D1C1C6409993FD91CC20172E53190DAD63CE02691AC326904CBB6424C906BD091312C1BFE6969BA6AABEF954B5C8D439DA5064A248C92988961FD2254479946DEC829C76CBA61690E3C541648228B59805D7FB2ADB6AABA70718985279452A2FB1414E4704AC3DC84D3EB767101C8F4FEB24BC8148316609BF963AFA826A9B87638424052067CE8FB393D9AC579AB1080D1C549FD5103312A1FF9988DFE7805ED906FE9228E25942D49484A4510E0FF9A4A54A22CBA6BE945126EBE461C5940A74E1517C60603B2651E8371973DA7051EB7197713F5583BA51B92A9EB3179B45A8A8A5099B40C29F59146F25A563291364F236038C79B784BF09524FC6810F91B777BAE252E5B723E8059C06157653E335549784A15553FF9A7A29407D87725AA6B7A2A2669CC776BB810672967CB5B8B9A9BA751A9E69A8DDF796B1F324348712FF0C23F49A1DEBF210C027995B8A7CC5B288C4C74218E5086112237128CC57F4BFEDDC21ED23BAD00C58D835B5A3F0C8FDF1001E0AB26C2CAD47D5CAF2252CAFD3520E36AE21119E56FB456F277132059CA18623BFD994878C794545BA4A04436D804231F430B12808FB01647FA15D94B975BB6798AB7C3F6355B9BD50BC1CA00EE76342C8609BE0BC893DEB398B65A453BA08BEF83B805B61945229D98422F59C27E86022DA5620D737867828540C20B097076BC6C03E5435AEE1B9AF19958A7DFB921DA414280429DA389EEFE23FC9578B714B4F2E5B19B792903FF45ACA045BEC0B3D83C204747A2E24971B440C10119941D9316F45A87C4AB2AC0F7C4BDE9BC8EF73A7F42513BE3420C56720DDB984CB173587462AED9996D2A848D11344EAC02351E6C5A18CC7AE813BFDC50D5B143F4D07AC72A213A0577F9802043A585D95031D017B319358A24B06B7C2EA19F22B6634146CC0A123A8051C51E6AD6A956B1A935FFE00BC65C44A60534D1375570BC036EDFBCE66255F523BB377B2256C29B870DA2C870868299828F6FBBD8E0A109386B8D743A6E7A38384D5933E64565A037B9F520ECF8466F2073EEAF03D1B606F947CA2D2CA49E4B41DE9011FFBD23920C0D2D0CB20E3A9C63BFF3E047504A8965639E8FD0DB690FFA1E791FD
-sk = E0C2121F06048FBC565FDAA305202D439AB3A81B31FA257AA6F4273547C1465610AE51C2C1C8603AA36D1575754A86C9194B1CC6A9B8C9F77CE6484C5198A193EA4369293798943F7918142F849C8D7479EB0588E6E6B4ABC4CE81A406642414EB4137C2DA905CE4AD2B750E7D966D34A3B1BFA8CA5C8070456B1F6D5B71E582C9E1E2BF9DC37AB60A09E797A43F66B27B04C13C034FA6F594264C9D7DA884C762B159D775F7750A1862216E8BC992C9B2E0D18513F409DF8B0811EA89D2A69B66D34E59BC93F5C7BDE25140A976A3195541EE22A7EDFB7F9D647616B31399B6C924022F036225AF7C34E6D221213AB5F7A20B908325835266DA1B456F5649B895BB032142FC5C700CFAC4C2A44CF1F96D57B8BA1EF2C9332A612E8BB9043559B5567090873D3F9450F37670B473A96F812CE1D71892E43C9FE61FA594601A27A98EC817DD822C625B98E0FA8F2D5A311A87A6C23B4DFDF44D7511373E64A4A18A833D654A946B0DA9694329023086013A919971CC4C8A45916901B45C25C28EB6051600644660796935E65A4700496BC32204201D5C8708FDECCBFE949D1339947C6BAABCC67EC901659D220FA4D1A3DA1A4ADC2B1B323BC4CABB6065D9032CCCA3DD3C8689C9A35810BCB30B99B3F55CF2AC8258C5B85C696A372C7AAB5B0DD62ABA06804466FA4C22B2CA0E09B7D47C4644898AACF6899C79B5321110F010CD40253E40C5920DB980A57C01B55C506A6662BE1253FF171412820272613940704F63E70340414322B69B60B50BBB4459C1D6A0F25065DA032455598EDF678505F54B51713209565FC4812AD5F8A05A926340FC3853719146D049017475A09A1FD2D47B35371D715C455DEBB3A40A8A0E83247B6B8FFC05B2E857B5D8B201E56C109DC155B720B2528301C49237F7A629234231FBA25C75D600BD360796A68991BC68CAFB5B0B7C748AB7039D8C4FD1B3B4DE76C193123E50109BA70956B9556F245CCD4330B888D43A84714E8CF17E5713B5AE5A9FC3A331718C227EF4BDCE131F31028D68529F06A218AC32317E9B7634C572513974DA2BC3DDC4C07F2C6B8D3AAF5734B5D9E691D790B0FA67CBCF36C0372C056C268E0C243132DB5DE7365310F5732151B80BC98A2BB76F9E8C616FB1C90A5B83CA5738BFA9CF1FB96242998A44D667A57B517A834834AC0F2AC00E91B32E4E7AAB452249D31575BC96C8652CA8E4C3C0D3277A60F5CA7BEB80B563391A3B8E1A1A97C85823928877954C28D052A2C116BDC325B687D26D1CCB3386CAC9BD4C10C3AC381E056F9060C89E25A910C78E677964D153B74554C8F38939F881543F820B6F11989589302EAC53111A45F7664616999D7A64AA26E4CD74539DD496A1F0FC530415B16FAA4AC86341C5400CB1BBCFFD2707BE12C31ACC9B5C94B806B71DAFAB1EAAA087EFC1419CD2978EC1B973336D27B69AF2FA85F6C33B73770C0F6B85D855938ED8758E6AA5724B8C0D457B29A9394A3528DE99CBD7A875BB5B299C8A6DFE416104A59AA9E958E3828D3C651B5A9A7E81D7738374692033C4C68254D5170204F83A9B8520016466FD9189EFBACAA23AB8F962AF7D66AEC2E27E468B9C326711673839541262A9C823EFC5C946DAB44B5B2068D61F00E7B0D87CA67706343927BFE4C12D20D69C4A5BA892F97EEEAB7B5A45742CC4AC4D37219AD72AC312051D31B8385CA2293415A13BB8983B8457B8AF9DCCA9E6322094CA68399AB77DBB9F6AA7CED5F224641C3FA07507DA9A08E0D180D52585DFB3B2FC95CDC733A573A888D403CBBB71C120BAAE2A195278370BF33299B9B2684ACCC5288A3CBA1277FD3999839A6ED29BB91D71A528BB2E4F953778BA23341CBA4B9B3C17F9A8366212AF3B722397419E24874B163470B3B2B7F24AE62258983B6161C6773B5AC90969C03D01CF4669B9D1F46E05705D4F676D464264D7549E1E2C3290C9B2BF5A71132057531714BEDBC7A91BC0AD56254D298908D33D588951333B3CB7924ABF14B0D70652C45AA62CC3062D851E45C866C6200DF4E74A9E559B9E6AB738F2B0DA9693CCEC3D968A866F0220CA95B7C6E8B04EC41D39C17EAFAB77444AAD4CA3A9D6B5B5D4611A6C074FDFB01F7DF68AD2440EFC5588F3B4A5C4106EFA3B9B6BB35C327465C7B656D1C1C6409993FD91CC20172E53190DAD63CE02691AC326904CBB6424C906BD091312C1BFE6969BA6AABEF954B5C8D439DA5064A248C92988961FD2254479946DEC829C76CBA61690E3C541648228B59805D7FB2ADB6AABA70718985279452A2FB1414E4704AC3DC84D3EB767101C8F4FEB24BC8148316609BF963AFA826A9B87638424052067CE8FB393D9AC579AB1080D1C549FD5103312A1FF9988DFE7805ED906FE9228E25942D49484A4510E0FF9A4A54A22CBA6BE945126EBE461C5940A74E1517C60603B2651E8371973DA7051EB7197713F5583BA51B92A9EB3179B45A8A8A5099B40C29F59146F25A563291364F236038C79B784BF09524FC6810F91B777BAE252E5B723E8059C06157653E335549784A15553FF9A7A29407D87725AA6B7A2A2669CC776BB810672967CB5B8B9A9BA751A9E69A8DDF796B1F324348712FF0C23F49A1DEBF210C027995B8A7CC5B288C4C74218E5086112237128CC57F4BFEDDC21ED23BAD00C58D835B5A3F0C8FDF1001E0AB26C2CAD47D5CAF2252CAFD3520E36AE21119E56FB456F277132059CA18623BFD994878C794545BA4A04436D804231F430B12808FB01647FA15D94B975BB6798AB7C3F6355B9BD50BC1CA00EE76342C8609BE0BC893DEB398B65A453BA08BEF83B805B61945229D98422F59C27E86022DA5620D737867828540C20B097076BC6C03E5435AEE1B9AF19958A7DFB921DA414280429DA389EEFE23FC9578B714B4F2E5B19B792903FF45ACA045BEC0B3D83C204747A2E24971B440C10119941D9316F45A87C4AB2AC0F7C4BDE9BC8EF73A7F42513BE3420C56720DDB984CB173587462AED9996D2A848D11344EAC02351E6C5A18CC7AE813BFDC50D5B143F4D07AC72A213A0577F9802043A585D95031D017B319358A24B06B7C2EA19F22B6634146CC0A123A8051C51E6AD6A956B1A935FFE00BC65C44A60534D1375570BC036EDFBCE66255F523BB377B2256C29B870DA2C870868299828F6FBBD8E0A109386B8D743A6E7A38384D5933E64565A037B9F520ECF8466F2073EEAF03D1B606F947CA2D2CA49E4B41DE9011FFBD23920C0D2D0CB20E3A9C63BFF3E047504A8965639E8FD0DB690FFA1E791FDD1756ECFAEB695001AC490F36C4638151BEE98D367FB7ADF0E06A470844068AF0E145E44AAE52CFC609E6F47FD7A6F6AF877190FF52256D0AC5B05B89C3F449F
-ct = 626889818F1C1732EBE9F4D16EB41D7A7BC195CF1B20D4CE5EF88D7AB66480D993C7C4D9F5538A0B6CD7789EF1483F18727C32165CC2A482D33EDA191877544F8ABD849EFF8F3F7C7032D95B34E8D8D4307FFF26CE4E02F031FE8DAE875A5CED281B114EC35BA6569FAEB5DED0A3B945E4B249154EC199732DD0C86487A3B9CC8F7867C5D10976413D5A78A8C7AC92312E1F47A33BEE8352389776ECE26A02926CC9E7992E40BEC9BCBB4206E498C27999567F421BFBC4471CC7C3C4E34521694C67465B0902910DCCC207056203790DC3D11D42BA445D0C9038B727DB8D7C0649CB7217E362020F3552071D50AA00BB05C1799841DB2D9625A6F9F2E3EEF16D5374BB46F839AB64A1314ACF5780F6E5894AB344A257894A2AB5CEDCEF54A5248040A2093639A63FE91F2FF779767270188DB6FAB919181633EE0E2D0F93EE0D5F9792BC0B73A1E3C40DC04DF30EB2B1752DC1B620E683619A0CB3C3B9620DF3FC2E517EBF7B457E5B4F331A1E5D54C107AFF06909040D1773842B44CCC74923C997F8AB0901542CA97C4C74DE7310B50F091ED8664A6DB07FADFFD1E815C3258753B0BDBF652BA5FA35D128B786804F7C7AA54DCF8A50ACA2B1924A95C8567F597934BEBDB6268EE2D4B95500203E17CE616CBDC69A379B2F26A4948899EEB69852442B2CA1F447E27FB865E64952CA9F80E7CC2A4FC734FFDBEBA2EA5D4D4BE1E36F39991F63AC0664399FFF6FE09F35BBFB6F4C15FF925FCDFB633B9D66BFFDF5EEBDE9BD1A00878E12142C3E49278B3BB6385E421E5DCF42432E5FAC086A270CEA48C475C0F9539DA658A7F4144F3B751666B93975A2E590923ABC30E02C068A3F11999626DC3DD49CFDD5CB076CD683F18880BB2651CAC442C45B4121ACE9E0AD70C3EF99C0E76ECDEA7C038A8E168B31A13D3F54710062B88BA7397DCCF6E433F463B6E9E587EDFDD1AE54EA1773496AC41CD6DF262B79F607396C9A3BC94944E8C5CA41CDEAE9CCC5B27ECD6E3FE10995AC59886B74C2C5E0B9D7C95375327B22FF6B713091E740E3B8DA20C07AAC0115A7706D753A0EC5EAA337054A63E089A0855ECC74061CE44F5D8BBB229F19A5C772C40D362A0EFBFAFFFBB9D71BC0B52AC16DDC02541086A411E45EA131AB12D6D7EBC007374D3C916FEFD01557699E7A713DADB5B4C385CE17FBE90F04844BC9F496520DC3DB1FEE0CD89D3F5C9F71342CAF8688BD0DC6860F581512AD1E7B32CE166C78430A9BB7B83F3FBA095330CA3E5CD0707C436B0A065E5208C448EFAAD85F246695039518CFB88DA79843B95DD1186CA5D71CD4B80ABA89ED704CDC93072632AD6B8075ED8F211F7F193F4A8DD4505F6FB8AFC9FD1F5F6DD086F2DBB314E1FA14DB5D7FBC4706D09688495EAD12EA3C331B4E13589CA3D4BB63499DC54B4893F838C103B01BA7C49FEB8B9202E3D86A06F80C932FD182A1CAD2615B1DF729D00E9F6C3D881A6CB6A837ECC400452C015F8E263BABA09C258B293576F2EAFD79A60D308CC0DCE6B145
-ss = 50CD9D6042E7708F347B3D187430D070F0D8712E0BF68350AB47F4B50F04962E
-
-count = 29
-generateEntropy = 174aaa36410566dc15a5e62874218d7abdde0b2c0f30d877bb80b1abd5f5a0a450a7a2354f7e5cefa6f4a4e9a1c411eb9364506e9e1204a8acb3cb77fbd2c4ed
-encapEntropyPreHash = 9eca0fe36c80fc5eba171c3ae66a5b1c923faa50b4521bb055e7bf51005c93df
-pk = E71B4FF986BEE57636F904C856AC93E0C18775864B7B932AF200251B0328F5B3CAA38116C5A187305622B4A152CA337ED7A3690C31161862447B847F5639C5851133F627B5980572023B4ACC37C32F6B70B3555E0EC4C5809C9582407A0E59A866991564CA55B21A48EE530676A435D26B749C1264F9E58C3FC619D1A23EF5F6300E96665EAB70E7350852115F5859BBF1A8308977648AE5CF5A55C9FB42801ACA4F0592254461A632A94A9C3A7CCD05C8B7C3B09666BE54F072CDC58D8CBA687D609D1F021115085C340153CE63A37750ACBDA01A6944A46CD16CAD098464A109BBB611A83346CE6B59A5F4CA3CBB4394DACA06E5708459CC777534EB80A620C308DD779B074C11F31679AE98AE569BBE79CB04BB127208E24BA008BEA28C5DB5EC18F31C50712171E27042651701C3004E057A6865D54763843D27873220C174C57154C9A9705DA162E8685A035B34E15C411FD1B7220C57265C2BA7579F4BD9AB1461650E8027C0BA79F2BA3F14093CAB6015D8CC092905A6B8F09DBFD5743818489ADA2BEDF88CE592396074A79824457F7CAEFE334FC84869FF43641821AD60E80407649EDAA8BDC2FA877ECCACCAAB8A1F35A1573546AC382222C193BDDB31275B84374CB4679A5FFD803EFF07987ED085FBD43E45752DD9A32F5EC03E7B74567ED9674E1070B026801E99CA27EBC0ED24742530507E19B97A09877A1B511DA3B9835268AC35AE44187EA14B996DD96C35686EB98A81F1B2AD90A80D0C989B12813E7DF2B34573B876289E7C79481C7247E637A60F9B2D3FC129C379A759756408636048565CBEB24C2186A875606A43D20BDDD8B9D70781B1848BE54A075FE978A3E112A567223D21BEB3395921D1A100C578E7EA0455949B7B420B6494688AEAC00697AE1914084EAB375D86243B50A948874DC973B7670C8F9173228B64647E58761442A2CC90165B188B58025F8EBA65CC654575A1BB3823A1A29633AAEA1763F24486AACAFD611C28774C98D89B3CE8A696E29F62775B5D5C50847C3AD4BB968C441086AA070097508DA888B5B202E5A3B5DB579943F0861A5B6E2D58415019182262C444FABB77679E019CCED4E0A3854507FCD0935BF81B0E8500DC6C0B3C154ECBA94D166407C5DCC67BFA6AEA8B4EF0C53859BA4416D5C1975C1FEB6BCAD8076E6B020A62B077F0141DEB5AB5986B386D51CB7E8C779654AF5E5485A969467012C572F62DAF788D1F58BF9DDB4BC6E04B00218CB671CE8B2515B072B76CF253A4006AC5437C107A077F162A3984586978CEB3752B1FA1A2B525961F96C63D7207ECC4C0268A354AFB00231B1CB6EB4E4A694524448E7A043C22A5BC1094B23D3C5D0A9641F909A778EB64BAB84FEEC3A53730405C92130F756050771999E469CF07CC8C308ECE9B827D7558BF882630556150A602D9400E3D4ABB229A9D8B8132A7F0C0C5475BB852000B63228C490472B42488AAC0ED647B1E834F248534FE2195ADF6952B83B6705593A1E53F0315613D2596AAD44E27A26D632B9C71E9C9E5A6AB733C7E81E54DB3437D894A19B4710A3CD5075602B176EC369F5116638775574C74425789154B0BDE48BAD6E52C91C451C87B48EC406674A75B0CD39D1173C3F411AD1EFDD8BF4BE2AFEA69C2327BD070CD1432C8D219
-sk = 25933617206AE881C4DE291B4F269F2E51897FF29D3C6803E1A4C58E53051E879F1AF333393C75B366CFE2E84CF9CC930D1928298897480571D7050751601BC119B1071412EFE8873AD325BC00420D13A752D33087BB6F884628DEF98F4FD21D01113219203F93419875C91CD33C7976B7A45F510F70E6002957AC49B862CD35640CE84E6B989201A74EB76422F88B31C94ACFA811605A32634199BE1639A50B709E89683C5CB0C975D627B76223EA48A2352C8BCC254ABC60812A6A5AB7747CA82073D1D31FEF708866A9801AD067A6DA0D848C409861C350DB559A0AB1D91C9BE0C149D6C241A13849D9EB2DA4B9B9B30B348217491449A43EA4544467824FF954C4869C8DC0B2BA2744C8D38BA584CB78EA6F6188BCD090267BA46882F16964AA003E2C60105415F937CF13B9CD00456D3545BC5E48B6DDF61A14ECCBAC23BB1D071BB14361B4C9ACB7B48805B7890C3676B550238391B388260CB0E2567F725B0382C7174440D82BA8A6D226D325CDD1C26ABD510ABB195B73D203F9DB7DB44ABBA87581A3C57F079B44A9455E3FA16EC87A0CC14368569B35517272220BA7760A8A0508BF0033031D42763FE89B611366B8B93D2D523D5C872BB99BBB099515A5911F1182404B7B4CCEA91462C6A5ABC16C64F55AB38A763A03BA48E0268819B6DF8BA88704AB4C7BCD8F8A150CA434AB0632ADC522A49C0E45997375D69901416792F845FCBC1A18789B22870401D6872374B15C851ABA4C3CF5A8930D34C74FD444A2C87F90D9353CD77361E26C99C8027B50504BC5B3F2BC27F3978822113E13D71E19E3915A9A4F0646AEF6D513E155B41237B2AB08BDF38322BF4C00706C0F22854D080BB8ECF58CC9B75D19A0185412A74B3C7D61A04DD8CB07BB37156C46221A7183BEB9321C58A924048AB86032F54815DA1BB33AD4312391C1A6778D9070B1A4542AAE231AAC97BB5E1A1CF42792C9921313C07ABA3A8C15DB5D1BE417C3888A2E0921A7AA1926044AB865935A2738B4378484B44471DA250E41925E976BEECA9F93D191B0C85B487BADFCEC4BE7C7683C508412E096AE888BAFB97CEBD3266EF7397004CC56741F53683034FC3160522E6BDABAD190C51F31926AA94B2F2A4506D69705623E3047176B46169AB8A715B84848BB4FB9830BE744CAD7591DD8D128C1A40F8A5B2829A92177D73CB1F319C0F45557A69AD790C87A6B8314E618444081C221C07C4BA5C1C450B8080DB278770A0C110DC386FB8411D4B983503964F7B6AFA10AC5154CCEA9E6222B4A70E5175F125B0A83010474311F8EF84FDF3AAB6D508B313A93C29675ABE12CDE50BD4B5B7E13C7228D9AC9DF569CC1BBC995EAACBC2290B0293A2BBA70AE8757C5A7CE84386093E02B3201573C56BCC368A7DD404371453C38823BA4752EDB663E5FB99C5E91CA9BA94CAEBC9D60A6318CF62168A86C0C419CAD1BC4FE514A745BB2C81701B89BA371CC1F10B50D95086D99778383108DFED849A1F74696464AA1D67F7F40BBC69C1FD907696D6227CF20750D68A3D36C600448C91A523A16E5C84B40819BBB2BFABB2CB03B658FD0656F410752F52BFC9BBA4A3A8D09D5835B1540F5DC673DF71540F560E71B4FF986BEE57636F904C856AC93E0C18775864B7B932AF200251B0328F5B3CAA38116C5A187305622B4A152CA337ED7A3690C31161862447B847F5639C5851133F627B5980572023B4ACC37C32F6B70B3555E0EC4C5809C9582407A0E59A866991564CA55B21A48EE530676A435D26B749C1264F9E58C3FC619D1A23EF5F6300E96665EAB70E7350852115F5859BBF1A8308977648AE5CF5A55C9FB42801ACA4F0592254461A632A94A9C3A7CCD05C8B7C3B09666BE54F072CDC58D8CBA687D609D1F021115085C340153CE63A37750ACBDA01A6944A46CD16CAD098464A109BBB611A83346CE6B59A5F4CA3CBB4394DACA06E5708459CC777534EB80A620C308DD779B074C11F31679AE98AE569BBE79CB04BB127208E24BA008BEA28C5DB5EC18F31C50712171E27042651701C3004E057A6865D54763843D27873220C174C57154C9A9705DA162E8685A035B34E15C411FD1B7220C57265C2BA7579F4BD9AB1461650E8027C0BA79F2BA3F14093CAB6015D8CC092905A6B8F09DBFD5743818489ADA2BEDF88CE592396074A79824457F7CAEFE334FC84869FF43641821AD60E80407649EDAA8BDC2FA877ECCACCAAB8A1F35A1573546AC382222C193BDDB31275B84374CB4679A5FFD803EFF07987ED085FBD43E45752DD9A32F5EC03E7B74567ED9674E1070B026801E99CA27EBC0ED24742530507E19B97A09877A1B511DA3B9835268AC35AE44187EA14B996DD96C35686EB98A81F1B2AD90A80D0C989B12813E7DF2B34573B876289E7C79481C7247E637A60F9B2D3FC129C379A759756408636048565CBEB24C2186A875606A43D20BDDD8B9D70781B1848BE54A075FE978A3E112A567223D21BEB3395921D1A100C578E7EA0455949B7B420B6494688AEAC00697AE1914084EAB375D86243B50A948874DC973B7670C8F9173228B64647E58761442A2CC90165B188B58025F8EBA65CC654575A1BB3823A1A29633AAEA1763F24486AACAFD611C28774C98D89B3CE8A696E29F62775B5D5C50847C3AD4BB968C441086AA070097508DA888B5B202E5A3B5DB579943F0861A5B6E2D58415019182262C444FABB77679E019CCED4E0A3854507FCD0935BF81B0E8500DC6C0B3C154ECBA94D166407C5DCC67BFA6AEA8B4EF0C53859BA4416D5C1975C1FEB6BCAD8076E6B020A62B077F0141DEB5AB5986B386D51CB7E8C779654AF5E5485A969467012C572F62DAF788D1F58BF9DDB4BC6E04B00218CB671CE8B2515B072B76CF253A4006AC5437C107A077F162A3984586978CEB3752B1FA1A2B525961F96C63D7207ECC4C0268A354AFB00231B1CB6EB4E4A694524448E7A043C22A5BC1094B23D3C5D0A9641F909A778EB64BAB84FEEC3A53730405C92130F756050771999E469CF07CC8C308ECE9B827D7558BF882630556150A602D9400E3D4ABB229A9D8B8132A7F0C0C5475BB852000B63228C490472B42488AAC0ED647B1E834F248534FE2195ADF6952B83B6705593A1E53F0315613D2596AAD44E27A26D632B9C71E9C9E5A6AB733C7E81E54DB3437D894A19B4710A3CD5075602B176EC369F5116638775574C74425789154B0BDE48BAD6E52C91C451C87B48EC406674A75B0CD39D1173C3F411AD1EFDD8BF4BE2AFEA69C2327BD070CD1432C8D2191B1B0A8682CAF72DF2E0A48513A7358EDBC77A615D6BE6FE2A7145BE66B7C50950A7A2354F7E5CEFA6F4A4E9A1C411EB9364506E9E1204A8ACB3CB77FBD2C4ED
-ct = 589B45383FD87E438A2036E96032F3FF220B23EB53244CA47E77379D46C333F3BED4F24D0582E9949DDB32AF9EDA732E6DC529FA9250D635E160316F7585A473BD3B59B0084122EC07E73CA921080AD90729565C5297B624315ABCFC027253642C6972EC426833EFA33FED5399F768B422259857F40D0A11C3C2CFA2920DE96CE3DB945DB087C39F0D97C041457C21B0E9FEF68927ADBF34195CF17871515357CE6B72BEC5D3D77D10E1D1A3CE3740600841B3E58CAF96C4C3F86E60502B8618FC918118E14699060E5E87851990EA933B0E60A7F750FE7947F449442C24F5FDA9E39B68BB51EF9AFE2D2A786388921A01F5C228783DAE97CB91CAF9C5D21C64098CD3B290C77462131BCF46DA587267354478647083BEE9110A9DCAB4EF3B2AE080E8F991C7B641DD7A0F0DCFA5F133636658853C52BA1F36F23C6EEBDF9FE230819F77B39086313F6A96FEEE877D9855D24A8582BC2D38E05384043FC23800CB0447DC2708AAC562A39889EC6C341F88EFFE499F970E0AC8BD3636EFF3DD5919C679680DF277CAA89829E03BB0D01D0D1BF2904BF8734D45AA1A5483762CF3704B1A756357179473D4D6DDD30FF0D180843C3A9C6CA2E9C8CC7BECCA7BF76663C7F0483207423F30FB219F330073787D8C6928499657B9B17208B0C4A37E5BED81E166B69E708A0388C2ED1EE4892A9B48D0CD1DE52C747ECF25694F2B909D368D5AEC537A0EFBB10F770D2C444BAF1B25AB0C1DB0EBAD0A5BA111443010393B330898B2C4251C9E682B1AD66D4E58B9C898A77AB6AA0D9E60DA99D80188580A7D50DC8EB976F3E1C75FDFB51866D7FAAECE97D56A440C96398E76BECE663FFC53D2B06EE6D11062805F7AABAAEB65568BCC6510E26DBF3C8C66C7BDB2E70264AD2B68D6D066304C15D2228ACCECC8CC0ED3FB8DE863F56930DE5DC94D80CEFA1EF24C0746FD78A5FEE6FFEB6FD1DF1E20A0F21875CD22081B12C68B73E7BE9FE7125D503D0BA57F8F4D210FA0E39668509E841F8664D52C65413E8FDD715BF34C852988C9E1857977A503A6FD5ED158BE6371CB29E4A2A13DE00006062C56F160704E1AF1B79E0EC175E11FF0F705291BAA1825FFBFFF4384D2003B726D794EFA99B8E9061C0D20381A892A67ED2B0155ED494D8FFDAD329E9B4B610FCF34183DF518C681F8CA2D7E36561C9A7271B9DD4A18A71949F9991EE0F6F43F5DD5D44DBE793FC512F13B7463BEA6682CEC42713A725E1E71F06550435963C9AE8D7D908DD9B5F99555E4A668CC9355FC2D931E1B68001A6B3E20B4594304DABFDFE9BE0EA26F92627820A849B6A1E2C68F97EAE111EE4786F1908F268A56053C739E44F7DF80EF8A85B86ED0CEEFD7B0FCA38A91DCB1CEFCCD1034097A0FAE6127A0C47F1FFD2D044F808BE041B5968291FE4BA63444CAF4DA65B7182C654F1DD45771B464302D9B0EE14FF0AD361DB76FCE8C808049C884DEAAD6D4EC8A201B99BF31CD1DC9A8C1716EFC01ACABD5965FA97371274E385DBD75E47D5A61A9E56E
-ss = 2E610015C6B440280D6F28D5E3CED35CBF65A70A171151363C4CC882D7899E0E
-
-count = 30
-generateEntropy = 351fe4313e2da7fac83d509f3103caf7b4c64a4d458fefdf636785ac361a1390f072d9b5a99f9c7a0a011e4dc10f6b600d611f40bba75071e7bee61d23fd5eda
-encapEntropyPreHash = 0c5719261caab51ae66b8c32e21c34e6d86ee4aa127d1b0195663c066497b2e9
-pk = 8518C8D8DBAB01F270C3131AC1586BB783B35DB82F3C24AE2B767E2C4A7D15C2A86EB19FDFC41113A7501367CD70D73D0F63705487AC4E0BB1C84001FE6657610C7D64FA3DF4538BB6069128C4597EC9B291938EA5D7CD46897AC2179B52F1CAC91B6C36F37A59780E454C50C5DC354B56A43040804DE2394BEA14C2D385E082C5F181228D62307F5A6A1AAA1EABB84F90F34310844DF95A4E6D423D8C993FA7F390E6984E482024C2968254B54B7D3418D6F859E295665262246E1BC8CD6C9B726581CEE69140F85C02024C5B59AA0711813D66433AA384B2A4A3447939378A1E6A98936BF04AD075981D93C53E9635B5E285F96755F8689B5CE5429142AF6FA02EDEB1A719B272F6B0A6211A5B9807CE6FF368739B51D4D9480BD884C8B456569027B08A3CB928645D450C6264C5FCE2A2DE2B241F965034A08716649A3C71020A6986FBC8BFB5B4A2CB162749264CC1E44BD66223F3DB1B9BD2C68744B52ED7BBA0B9773DF128883110D2CC4757DACAF7F4C90FE02884E1A581D89AF687AC79444C9D801D156325590A3A24441B7C2C893B777386198C16374329E640B6A439FE5BC71AB3AE195575A71CBAB773AE6F0B5AB2D750D222A5D36B86EA2AA2006C54940A5F843AB708D19D5937643309C12D522DD479C3B2D57DD5696D25615ABBB573FDB62EEE5C6A6546CB1FB188F356800FF4177C69B636CBBF9EE9A7C7D512CA156490C96B347A5BC2CB257A061452DAB5FD15BDF5026677F14967B6C825D03EB782CD0422BD1078B7781624DC318A33B0C437D6C35997A22E30496E876762BA5DCF5146C5188DDE6C684C265A8F05031904572F7554123832C78767FF4B5FF525680C773AB3BA1A93776897D57B0D507B9391712344326F090B3D964DF8C293B6638FA36815C7CB9B7962956F903F62C4CE3D7646EBC1A8EC04A815191CB4BB085EC8693F2188F490731C087C23A8BC7CFB32FC019D106934B2D17706526CC6F787BE424BCE5B26329591C47402D57548110CCB42955C422323ADDB4987FB0F3441558964BF14021A54277BA14C5773A10B81C1427F51173F5C6CBE1B7575A4B6766AC355BC443E479A2953A51F7010F7B04B23E0CA93D08836432E3AE5A1A6BB62F5476C07914F88532CECD00CEB340588AB675F93C286E7288DA1C6CA3621AD6A4AE1FC64AA15B27A7C3EABC120E7460737585B5773AB18E23EE185C900ECC3B765983CB807E2F7047E6C999C6716E26801EA938302ABC312AA797535358196B63309846675BCF1B33343BC3D4D172DB81947643A84FD2173FCB0477AB87B57B55899A308D51311C9BA6916F15947D707D88B9228D0488DDACCB25455CF782B7A18264E55C9B6798F39A53F53240C82FBAF461364CD5202C5C94CDFF23E0F731624E69310E5B47964B2BFD3A59A5B0D55A026E260731DE346F74938ABC607B4F579B8B200ECEBB633614A46983E60E442A4914C93FA62219025E4A99D71032F0B00906126365C467E0A235570A544A7640F23800CD5F2A825479A632343F20801F1774F0E8B7DB96A860FD40A43CB7ABAE76039C6BC80B94EC315AD49E9904908A20CB444BFE219452C464EEB2914EC19031152CACAA00DD541FDE81ECAF1F339E468BE45459E708BFB464D0C480A1BECDBC021A06AF7AAC4772545EB
-sk = 719950ED1960FF6C2D7D59BBECB83AABE1CCB569B76CD9B053389C552CB6BF847CF4FC1F18A03E66F02CDB284C15D656151644F78CAEEAFA8B12CB7C616256C032CE6112735A74285D66A90F3A745ED8733C195F6B1B9B272897520A02FAFCB958A9669990B73420BCCE373ACF5A1C86A555C3C48F78166C0FBB023C49608592261060884B408C9FDB1F4B023506D3516956B02637AF26FC7B1D9345F8B54B5AF96997D39FA32C01AB64A6AB7491D50303B4E8A134086110D220462395B9D89D9651205AEA9E1B88BC80C4C8BAC44AF4F1886EA788A0B259DDA78116051059853D2CD073ED8CADAD9AB04F7175D57C3224E953509588E788713D5A6714D0AA48E972F4FA55F16579D9BC6988F562CCF1286E87AA785929BF8266D7E340022C0221736C3CB372B85723042382092545A45032EB727BDC750449C786145ACF42B85D4618B0D6F009D0224A816620F1DB67F59713090B0849559A51B9589532CE2DC25DF8F09AEBDA932073A2AC2115B12C5F94C64750220D645B34C14AC1B2208565377D61426D7F2A25CBD969A2705EA330B676EA6EEFCBBC6CD40DA9C0716D147B398B7D469A919D83BAACCA80F0E41414382804B0A321362E14E766DB2450F599963CC2899E1048D839754858910D12C23F99158A9A3149362690A9C5540133E5F217A7B66B0D627321C810F7D1639CCA948D708616047F85BA41CEE9211DF72731AC0986D1C3149854B71683FAF68179799B12C031A2A84574B9A67C96A708355F7A86BFABE63DDB94B6C048359481CA7A45CBAECBCF34407D8E378733F812926599DF5C156A94945FC7911DB26BEF17074470A7BD6B60F771CC3F396E847195CE26444B641F91B468FA1670D0184942472667AA76E42976FAC48E78DA72EF0C207FC7400F92699B46345E4C9972A35DAEA31ADBE87980438DE4F211B005C8DCEC1A6EECB56D891677F9006C49385E8AB20A19B74325A9A95083BC711537480DB30719815352616B2C5721979BD4267FB134188A75B9CB303215A76A246D8F69ACBD173D069B2B99B727829AA5469A0212C006A88AA4A6B614674674FA75500AA294711C178B741B0275280BDA27813647A5DCAC3A258991DB4BF436C23F37C697115143A2755FDC199FF32B19209D7FF904FEAABFF7383884C1BAE3C0CC20D019066653B99C1CAFE366567C9238785B0F0B4D1432A9E02CA2D9A3B37D84646B157684D7AC720727AF4533749A9FF99BAD8F3877DBE5CFF9C75B38C4002178CE30773EE36A14F1497AB386CB36420F04D85C8312CE25B357D3108226925F6B85C7A3729064F81AA66336163C00506BBFC82030F4F33A5BE7330926BB3F849D1DCB09F5CB814BA8A722506D0A037E6EB26216AA3C4D4C05D5CBCF0358501936AD2BEB3563C341E2315DE6D68404ACAB0149BAFA84491AB67A2DD82972220B0DF528DA7C4D441C8CDAF508CFA2C0224932E7E5215572AA433C9212022899E43A93CC7C8F4AAC6ED5ACBD0162E4DA4B897B7BDCD72A0B2A2354F61A6C211089C11E476715F3369859C3021584B6593B5784344D53B40DA0725A90804C45D02F6EB7670071660478C53281B5E290BFC77AC46602B530B1300628A7A4F20CE227688518C8D8DBAB01F270C3131AC1586BB783B35DB82F3C24AE2B767E2C4A7D15C2A86EB19FDFC41113A7501367CD70D73D0F63705487AC4E0BB1C84001FE6657610C7D64FA3DF4538BB6069128C4597EC9B291938EA5D7CD46897AC2179B52F1CAC91B6C36F37A59780E454C50C5DC354B56A43040804DE2394BEA14C2D385E082C5F181228D62307F5A6A1AAA1EABB84F90F34310844DF95A4E6D423D8C993FA7F390E6984E482024C2968254B54B7D3418D6F859E295665262246E1BC8CD6C9B726581CEE69140F85C02024C5B59AA0711813D66433AA384B2A4A3447939378A1E6A98936BF04AD075981D93C53E9635B5E285F96755F8689B5CE5429142AF6FA02EDEB1A719B272F6B0A6211A5B9807CE6FF368739B51D4D9480BD884C8B456569027B08A3CB928645D450C6264C5FCE2A2DE2B241F965034A08716649A3C71020A6986FBC8BFB5B4A2CB162749264CC1E44BD66223F3DB1B9BD2C68744B52ED7BBA0B9773DF128883110D2CC4757DACAF7F4C90FE02884E1A581D89AF687AC79444C9D801D156325590A3A24441B7C2C893B777386198C16374329E640B6A439FE5BC71AB3AE195575A71CBAB773AE6F0B5AB2D750D222A5D36B86EA2AA2006C54940A5F843AB708D19D5937643309C12D522DD479C3B2D57DD5696D25615ABBB573FDB62EEE5C6A6546CB1FB188F356800FF4177C69B636CBBF9EE9A7C7D512CA156490C96B347A5BC2CB257A061452DAB5FD15BDF5026677F14967B6C825D03EB782CD0422BD1078B7781624DC318A33B0C437D6C35997A22E30496E876762BA5DCF5146C5188DDE6C684C265A8F05031904572F7554123832C78767FF4B5FF525680C773AB3BA1A93776897D57B0D507B9391712344326F090B3D964DF8C293B6638FA36815C7CB9B7962956F903F62C4CE3D7646EBC1A8EC04A815191CB4BB085EC8693F2188F490731C087C23A8BC7CFB32FC019D106934B2D17706526CC6F787BE424BCE5B26329591C47402D57548110CCB42955C422323ADDB4987FB0F3441558964BF14021A54277BA14C5773A10B81C1427F51173F5C6CBE1B7575A4B6766AC355BC443E479A2953A51F7010F7B04B23E0CA93D08836432E3AE5A1A6BB62F5476C07914F88532CECD00CEB340588AB675F93C286E7288DA1C6CA3621AD6A4AE1FC64AA15B27A7C3EABC120E7460737585B5773AB18E23EE185C900ECC3B765983CB807E2F7047E6C999C6716E26801EA938302ABC312AA797535358196B63309846675BCF1B33343BC3D4D172DB81947643A84FD2173FCB0477AB87B57B55899A308D51311C9BA6916F15947D707D88B9228D0488DDACCB25455CF782B7A18264E55C9B6798F39A53F53240C82FBAF461364CD5202C5C94CDFF23E0F731624E69310E5B47964B2BFD3A59A5B0D55A026E260731DE346F74938ABC607B4F579B8B200ECEBB633614A46983E60E442A4914C93FA62219025E4A99D71032F0B00906126365C467E0A235570A544A7640F23800CD5F2A825479A632343F20801F1774F0E8B7DB96A860FD40A43CB7ABAE76039C6BC80B94EC315AD49E9904908A20CB444BFE219452C464EEB2914EC19031152CACAA00DD541FDE81ECAF1F339E468BE45459E708BFB464D0C480A1BECDBC021A06AF7AAC4772545EB2C54DF6E9020E1E44B11B471DEA97A382A2FE8D1042565BCD51EF21CC0884D68F072D9B5A99F9C7A0A011E4DC10F6B600D611F40BBA75071E7BEE61D23FD5EDA
-ct = F3F451B8F76002C10A67C10AEE76209E067B1B997C3B476373F7726B3F631BAF10D274224E86AF9D333D26522A951F3FBD36C72C6A261059016FBE4B3949DA0616205FC724ACFE2946C4D694AD1999CBEFDA3F0167D1CFCBD8BBD51A630687014AE826305E48D6E3AD6E68AD5542C3358CAE7141494821DA7A3BEE623096A5128C6DE1AB616DA91BE228BE402990D81F73031BFFF794DB1F8954738115649492B630FF50DA5F06FEF7D712B3BADBD175E290FB78351C1F408B5ADABAB395BFC0A5D5D2414C2131B4014592E2D5583E81286E677FA1F858EDA8708B2BF25147887433BF56D523636605F91629FB49B1CEE98CBCE6C6C9E76C587F50FC8B56821479BF3B97ABCA13804F08DFF1EE164AA269F6DB96DF267FA32F5B2EBFB3ADB3029859B5C802B0049B05CEF0A9BA390C49D38B6E11483B255856E0B2BB23685AF3843F5A6685FAE0A3D7424DA52B061DAA81390BC1335A841990C94EE87FD4AC9F2C56136BB755460F2698822D1152E33BB2294DBDEDD3A6630699655723B99B285A3707E194F2A7E53CACE9D4B4A60D78B6A8C74DB6F47E50C3B46E589D59F7EA24A051C143884FEF1C0A1B5DB65CB2C9982B86AF978BD6416617544AEAC67220B85746C4A304DA347636A23780DDAC9A5E79BE26BE127B0D3EB11E8372561C13A998B4B2123EFC24150048E8516CF1A2C6E7FF77090E472CBA93CE350C858B5104E8440CFBACA0D765FC95D7225E37475D048F89E6245A2147207475772F65399EBEBB920569137ACEC2AB035DE7C661B25356F5AE0DD99F016EE6460D999402641503CF6DF3E6F3380719A13A76C6FF6E54DFDB33D454C8E42E0A7B482BC8FB8E12A13E2E8105E876E1AFC9B9E5F28CA61E280D714224F835D8434401979B7635996627125EBDFD40EEEF5DA6D249A7FF15FAC662C9A3044C0D95D2B5029DAFBB535EC065EE675F4B76847F54BA66135126FC0B95D69D6C484ABAA11F60441E50863C7B27306283E58BF97E43E73164CFC143673940E2E723864488E48451F891C687F33BB24E4464ECC4CCDA8813947B54E22C3C368D97670980038BD6A6CAD485CDB8DADE3856069476E6F7D54E772BE8FB2E7B4C6019AD2EBC84DB2BF3D680385A93C7802B1F7534777A8E9C5E060C5F2148A5159140DF4BB35600344863E9F1E86F70BA9815D3051D865C7E6456D624113E6C76521884B1C2B59E6C2EFE4575E125A7E22776A80A756BFE25B0C0A5942C450AEF71AB8ED5CA425A09DF67670908FBB6F3BC4C7E8F4D3B9298E796D6BE36106F22FC6FFC0C9BD4BF1761B6859377EEBFCD5646A3D4B044D3424A743DA85116521A3FFE3C39C898591E669E204DC317928A7EB77DFA7B915FF832E7D7D9F1DA40AC7926F5B8733D661A4205228F0CE968FA3AD4EB5707D184EC4E72A9D6783A3641637957A2B6B22EA8BE95414DC06685CD7DC06BFF16479F490017DC78CE2D2DAD427DCDBBED163AFA58E2539C410BD8599A2DFC66D0C14DF9255A86B928F17094BDDC4A8BE4A202B36CB4
-ss = 91961EFE34B53285433FA9F780A04B8E47261E7A6EF77D46658E7671D800E2F2
-
-count = 31
-generateEntropy = 9bc5315580207c6c16dcf3a30c48daf278de12e8c27df6733e62f799068ad23d5a4d0a8a41c4f666854e9b13673071ceb2fd61def9a850c211e7c50071b1ddad
-encapEntropyPreHash = 0e59f6f9047c784c1f00b24454aa4f1bd32c92ae7e626549972f86fab90e7e89
-pk = 5E55633267468551B3EE117792C80C1A802230AC805F769807976C06399B97B3C93FB83BDC136CB3CBA70BB4AB5F11602E977ED051115508668C244A44E09569A13507D4009AB72B16CC3BC615C12ADA7C56D50BA6307D00801BEDF8526F0A9366869A4830314D162F63AB8F51996663C1138641275E164DDF60C7708A75376BC235E16D5C22033DE1A149153D1868679E1825F638967BECAB5B9644A6E201906771A703B7844CB5CAB61748D202D38B5B8F03CC45626027895E23D0C1C1B526C6D519620436ED593B58732164A39639C813F6032EB902B05DB15C5D8825C8B11815768D29522536698A751BC1F9964DC579358ADC57EB83A0D2201B9B9354B1B39C6E7008D5F3189902964973AF9A9C694EEC1298D68D3372783D34700B0280D692998B49A9BB76293D7A95363B317670352A71822F415B1C97742934713C5995FE5CA9642C3AC18B73C43357D4D497B3905DF7F58C6566621EEB25DDA29D97B598970684C5780F665243FEB854F9F566177200F9331CE353CD1A23CCE8AA4529BB667D1B9E59B1A312A7C6FF08871CD95C6934419F475C1C08395CE1A3AFF83DD14784303B4BA7751054AA59F5710E4AC6039F3168C1B601A5278562B525ABB11E66193DC9D34446BBCC8163578CB8065F89B9F43407F79246CAD2B6B8B40F16B839A060A95B76855237BAB2FA315DB48E40842F8306125FB04145356BC50B00E3389DCCA26FF048AF5A730AC573B5B80331D2597C4188227682075BC0000186B8FD26A383E1BCE5C19F13B18CB21602F2160DAB202BB07B63D925B71708095DAA662CF25DCBECC99395400A79842F5C40E79B46B5384CE730439F537BBC8A8608F61520E120EA9843456118A0A4CF36384832B12076044C65F06C8F8CC31752469C8A1E33DC529AC05485548A6E075F46A089AA8446C0D465BD43CDF0343ACC9668FBA2A7F7191A9D29BE7E9300CEF33D13A11EDB2B409DE297F30B8A7B077FD4CA4D1AC74B31092ADED0503CCB5818D1834A734E15B74D3FE550EE49773A800D86F129B4E0250EA1C43DA3A3B802B0757C6401EA090F98A28291621341A9D98C67BB001E46E89973F40C1C4950B0E34F07772BA6379FB6A93ECB57369B48B3ACA26EF815C615B4A97AC2190FD2B15E83AA10545FB859635D084A57B0268FF085D9EA4B7EE1763B914E67B33DC46037F39815A1F8C58663C88662B91BAB0DB6758288C682372A269C64CF3AB5C46DE2C8F0F1B7780A068948B9480C6AF10251453C1FE213855D74675CACC7B162917730AE74EC7A8E7673A7D0887EDC175791309AB28E6CCC629BF79C6D69B19269A19488B7B88A45A199841916BA4A2A1C2456A108A5CB4DE1B15356CA737369668B0B5C7BC10E22377D6B5FEF7515B4F348015872E3518C2676079B8A06DE8B53BD189EC9766C04C084E74C6E747C783FF3A99B930547A72FC3A179CBD62B52D46207E79E37D65C9F3C4839D1AFC167AE4041671E2C1BF3324D875B78615067DFE11653E6BD4DD5414579AD8C942081DB4F1A10B0E1054FA3D79AF6A285F2107D4232700676B8A007057D15C923A7889F115762B4C242392CE7C4438C68C6C3FBCCCAE4A071E404C24274F5066DEAF5359EB3382EDA6D6338F166ACD09E376826299B77B781250C2224486EF23D424BDD
-sk = 4DA026F053C3EC1712C7F294DC891E26196894A1B620F97429574EDEE9568E113FEB564D89A1883D5A0329929CA57AC001925C8D616791842DCD291627D61C7C2C3F842B547F074F46F082A06BB4282323A291C3CC07904079125CD5A854168D83BA8AB6B160B5E1881D25403B297C73048E3298287F51529A8BA2DEDA6B4D7665A373171B03B1C0BAAB6482C50CA3A028D485CA8491B1B73767EC9EF8874A54D4CA414895D2E49FB2AC0CC80C9D248B97DDC51D00A10CA3324FA8A6373A99C5DC1BB7A389CD9A3C6931FC7BEE05ABCBA579251B742F46383AFB48FAA514319B8F9A0491F9212DA443ACF9B9CE5B29A6E723A4EAFBA5C1A7B3E017870FB35DBA8A69F1F7995EF2AFF817907DE5C66899824889A760CA4A38A57B3AFA880A3524E138B37487B2EE7332D2689F99A5A3748020FBCA43ED6045A5ABA65F6C67783CB74C217BA987AD381938B4A651B6908FA4F18E6D073A6992160438BA3C9547E4557E1E724192414C912648D25907BD8B069C845465616969161C483927F5D610C815638E242323465839D36A8149BAD494B71F1336A3F0A954369D4265B6CAB935F06694C482B500CB77BB32C4D805A295A692648A31611B206D06C2E86C61675577053A747BD3A748F452B480028EDCBECA8A10EB843EA8A71E21E9B822D80860764D8C5A77EF0222F8004C902C832F1A344758776EEB99C3EC8B24CCBC03F5BCBE59027FB424E6C580CC3B41C041984EA552BDD6396D52867887430A2534A44BA544A0B285C061D7D6618C76945A5C3B29BBBB09A724B1AC53E5954F66708C8C0B2D7DA57C62FC8B80E73D737741F9141F7164B4EAC08822A4C340B5B74CB5C2D407B9D63365C55C14C5E6AB43A8BC68908C34074A9BF4816E000DDB464656C379FDD829B6961C22E5345674243CA64705212D52E616664587F90947FEEB4366A7ABA98B76D9F79A1ECC4BF50571A07CC57E0CB1AF828BB26263A8A898BF3B7B0ED07988E82DBE3C0405D46B1CDC37600570FC37AD9B2237E3032BAB1A0AE420B6F011A653987305AACC8876AC4D014B7E619227B8B35BA2616C9575506870FAD2585549A2F902B185D7A61139C027912EE2A00EE460328B16CCEEB259149A0881F8152D563BC0243302D29FB98CC57A45369517640BF0BF63A555A900269878C4BA567F8D376176D6941D34957E1373B7520483394C3606089D14AEE0917059227BD848BB22E088DEF4194BFCB36EAA81D4DA713E37BE79E52F51BA2C32F05D06405947838625E49F5F6BCDA5E683D014A12FCC0C81601B52F80C39B6659606A8FEA82C62E061A939CB4451869922083268561E16381B026152170104E11F30B2399F4097B94078ADC66F23F85BA6651E861237700BCB1AE92E2BC652CBF19BC0FCA0D7F7577C9C96DBC9B8B07B917F258C15661DA17621DB1287EBAA7714A54052FA660F034F227198EA14C2467B46CF9877F4E0C29962992B560A7DB93C8EC13343F734D86BC548246A57473D1285463D0942F288245D933DDAB7A09766A9F8C178EF539F9CE9A0E97364CAC0366B5B08B4C1B081E01D198C2AA5288617A50019EB3A40A300AF538119D733F2544D18B9094F387A3F4C17BAF01523F1455E55633267468551B3EE117792C80C1A802230AC805F769807976C06399B97B3C93FB83BDC136CB3CBA70BB4AB5F11602E977ED051115508668C244A44E09569A13507D4009AB72B16CC3BC615C12ADA7C56D50BA6307D00801BEDF8526F0A9366869A4830314D162F63AB8F51996663C1138641275E164DDF60C7708A75376BC235E16D5C22033DE1A149153D1868679E1825F638967BECAB5B9644A6E201906771A703B7844CB5CAB61748D202D38B5B8F03CC45626027895E23D0C1C1B526C6D519620436ED593B58732164A39639C813F6032EB902B05DB15C5D8825C8B11815768D29522536698A751BC1F9964DC579358ADC57EB83A0D2201B9B9354B1B39C6E7008D5F3189902964973AF9A9C694EEC1298D68D3372783D34700B0280D692998B49A9BB76293D7A95363B317670352A71822F415B1C97742934713C5995FE5CA9642C3AC18B73C43357D4D497B3905DF7F58C6566621EEB25DDA29D97B598970684C5780F665243FEB854F9F566177200F9331CE353CD1A23CCE8AA4529BB667D1B9E59B1A312A7C6FF08871CD95C6934419F475C1C08395CE1A3AFF83DD14784303B4BA7751054AA59F5710E4AC6039F3168C1B601A5278562B525ABB11E66193DC9D34446BBCC8163578CB8065F89B9F43407F79246CAD2B6B8B40F16B839A060A95B76855237BAB2FA315DB48E40842F8306125FB04145356BC50B00E3389DCCA26FF048AF5A730AC573B5B80331D2597C4188227682075BC0000186B8FD26A383E1BCE5C19F13B18CB21602F2160DAB202BB07B63D925B71708095DAA662CF25DCBECC99395400A79842F5C40E79B46B5384CE730439F537BBC8A8608F61520E120EA9843456118A0A4CF36384832B12076044C65F06C8F8CC31752469C8A1E33DC529AC05485548A6E075F46A089AA8446C0D465BD43CDF0343ACC9668FBA2A7F7191A9D29BE7E9300CEF33D13A11EDB2B409DE297F30B8A7B077FD4CA4D1AC74B31092ADED0503CCB5818D1834A734E15B74D3FE550EE49773A800D86F129B4E0250EA1C43DA3A3B802B0757C6401EA090F98A28291621341A9D98C67BB001E46E89973F40C1C4950B0E34F07772BA6379FB6A93ECB57369B48B3ACA26EF815C615B4A97AC2190FD2B15E83AA10545FB859635D084A57B0268FF085D9EA4B7EE1763B914E67B33DC46037F39815A1F8C58663C88662B91BAB0DB6758288C682372A269C64CF3AB5C46DE2C8F0F1B7780A068948B9480C6AF10251453C1FE213855D74675CACC7B162917730AE74EC7A8E7673A7D0887EDC175791309AB28E6CCC629BF79C6D69B19269A19488B7B88A45A199841916BA4A2A1C2456A108A5CB4DE1B15356CA737369668B0B5C7BC10E22377D6B5FEF7515B4F348015872E3518C2676079B8A06DE8B53BD189EC9766C04C084E74C6E747C783FF3A99B930547A72FC3A179CBD62B52D46207E79E37D65C9F3C4839D1AFC167AE4041671E2C1BF3324D875B78615067DFE11653E6BD4DD5414579AD8C942081DB4F1A10B0E1054FA3D79AF6A285F2107D4232700676B8A007057D15C923A7889F115762B4C242392CE7C4438C68C6C3FBCCCAE4A071E404C24274F5066DEAF5359EB3382EDA6D6338F166ACD09E376826299B77B781250C2224486EF23D424BDDBDCAF7B417DA8B8933279B33068F6FDA313826C2EEC500B224CBE046ABEB37A75A4D0A8A41C4F666854E9B13673071CEB2FD61DEF9A850C211E7C50071B1DDAD
-ct = CC162C96F45C1BFE20D4EC4930FA6BABCC176B7B28948F6B3723F9A652AED6B8814C7C2F2BF11BE0321AE217EF12836547C0DA7CA4E7881AFA5C13B089F00249746D4EF05731B7F0A9189F6D092D267F88BD6064B820C0A995D27EFEC31FEDEFFA29BD61E16F35564627B8C07FD5100CF4512AF33689E215D92635278ED6E6135E14ACB1C167C8C3E4B843F4DBF0549468FB047C837125E8E80D453E39C44FF524119149C55AA31C7CACB5088EEFE93B7D493809A85330A67AE11F188EED63821340FAB8A7E9321F53FA389635E800BA2F6209D36F79EB7099F43B98B484730E95B58CEF65DC8A751FF3CC07B7644C99C243F6A3F314B239233E458A2BCBB6FA612B764EB5051A8DF7343267A7FDEE9EAC48E9577AC389B7ADF2653791184B69942B6191918BB3D6F88B80E208261C8D393002979026E954559634DAA1700FB328327DAAE0FDB1097837E91263AF9EC3C1864B509D98E039B666C875BD5CD390B7219ABB32ADB52EA6C3FD81C52F1A31A3A77366F7A44EBC666F912FBC898EC79B7FE554753B7EA41E0EB5EA366A329CEBB3EEBD449639EB8E2ADE3E5E92C44A587CBCA397077A4B756EA4FD425E2B780CBB3C8104D5CC5DFFC7A38318506BB8993979E0F00897F5F3319526F049470A37C9BCF52B0426332B9717D6336B4E277C363186D1A8F58B6107E382C77B5E25141EB6F5DAF19DCFA95676D2037524772E804D3BEB87E75FFF624CA9F5BB6098E3239BCEC265A88D2D7870560888CDB6805E68177489C21C8B3A2FF9949764F1A8D9D80F91F27C180245A7046717917650FD6F550296D8655F4E546E0780036FD90652C02786910F230A5E2C6467E6EC1687FB6AAC12C06451FAF6B7B2AB3C8C0C1885451E04FD54E05956D2174099E5F691D690A48BF5DE1E67BB5D84288415E429184ADCE1DD7B00EB94C33ABF63F5AE80AF202E772EAA576CD65E65B63ECB1F98FCD96DA6C58D4985021A1EB5A953AA105C73CF9391AD3633919BA794A26F2052878E4607D4489AC7E084009A582731990E8CC087A459470042ACC5BF481DEEFF132C86615A5FB41E47C8D7D18C8CE3A478EF621F965099A1554597BC32FB119367C25DC0373739B8E228DBE85F688B005C9CE688E12142D51D4D06DAC00690C1076702D8BBDF608127F7745BBCCEEDA28CF9A067CF6235742A230506C5DD4B9FB38CB9EFFDB2E97C07316131F7A47FAB847EC5BC93C88275DCE4F1781590043208A838884778A58EC5296C1935DB4F8F32F11C209A697B40726293D18AA908D4D7BFC8C4258F4535295708DC80DAA68ADABED79FC459956E1A7BC277789FA94DFB5CB69EADCA03A0B9C0A21BD5A7DE051FF255D6DF229F306E75A8095A2A511DC372EF601AE9D8A4575A4043380ADDAFD25AC1D044A73722C0255974939D9FFC2B2658C5FFD7F1E7E0F33AC809A1B1648527AB57EE858109D30FD29356D74C79087CBD2FC436DB8DE5179483CF4CCF6511C2CB58FA7C5431C25D1EF9CE8C75891449D738BAF2457E1F8753485E38
-ss = E4983D6021D6C10E71F474D76650F7B5E23E02805F755F57A1012882DAA77ABE
-
-count = 32
-generateEntropy = d8b907b34d152ff8603b73051f772daa71eb902c47b7e2f070508269d757e02e36b817736cbc5f7b1dd6eef5fe6332fb1a598f3871e5470d440fd2ea631da28a
-encapEntropyPreHash = a3963ade17d69debbc358dda82c7bebe2c39d25b36813058e7a161542e3f8c2b
-pk = 420A3005A17C7B4A08178B83F8540601145B102970B3FC29F30A4CA1A8A5BC4164051931ED68A59EFB2B50D549BDC1A65E9909F5AA690B0235D32B1C6B2886CE2959FA189E2CE24224E99255863E6D964D4F422C02646A461BB5ABF86F4B4C0975765A5B0CA01081677334AF26C3467DA771CDF40EC4293608801CAD9C61D5F80839774EAFF772B139051BEAA65632120F00171AD020276A1FBF23517582149AD2C73450B11315CA4B244E7218800350AEB5808DA774030635BC247508144740634AC4A078A5AF2816E9206A645287DE06263277242DBA12AF2A82CE13BA6787C5AC3020E5D30CBB92452985AE41027056F492BB1A5E23332698240B5038302E552C5ACC0443A8795804126E15369AE96CEBD7C9765233982458AD6520550BAAD77BC74296BADCD4CC37240D0163CAF8C806A0CCC3F4125A0874CDC1C67E4626C9C753453FA37B208CAF5F523388D6308248B7688C80F6C925895670A1397880933AF0152DA1E54F7A7B512AA87499F7A718E62A7CC5BF5687ADD09060426B0D3CD292AB9B8372083EE462182872815CD740FD69ACDD24615110BB618CA1EF662715F028864BA0872B8C199ABE40F35F91906A821B8CE0742F931C661C65AA2445371A300E68F23B767382F3701CE685CEA5F59C50E82E45234169C3BBAC814AB9D68F83842C513A8FAF475590B3BAC2E3A4685B8F71208357D221AE41310E8454D315670C3A3409A2A95258B9057B42DEF7A7C6F588F6DA61183ACFB18A7CEDF138C7984B50A940F17C687E5A2F83451D94398F4C82C93A375BE195B4B219232E9A766E77040D3B9125E70FA4097D807A6D25323342508F2490A59702575D64AF146088F59802AA2CAB3537A8B4E92A10EC447BD89F9FE738D92A5F83C2861628601E42BB427B87C2153D4BC44B19413B79BAA5EF55325BA8A42E1A88548155D03AB116E47EE0455F0E5A71BAE3A03EF476F77A9A9CC6526DF1ADBEA64930B6995F60181544356C0982E957C5E5186F321B9467D05DD5970A96E226C89673E50A056E7C0A8027ACA8A5CD93723353CA1991730DFEA1AEE943CB0D62537CB5AD88C14F52A78CB6228EF4750EB7DB0AA831A4202B178EF47446A06A17E7CAF5274F384B36832A07AE0A66069BC59FE439F7B6005F064D865B550505210768BD636C61F0E7A1BDCB3C3065908D51302EE234A3FA113A1A1A2A618750075A6EC277CBDAC535FC1524A62E3C0601AAD1C46026AB6B8495C1B7093F776F9E6B3B533267AB99801E83BD18570166387F14ECB4D279B86CFBBAF90649E5C514E432561F850497D47C2BDA1BC2C398B306751991392C399DF6F408FF836F989C41CF76234B9445D9F81F4AAA987C1721C0C726EFE44C311A589ABB5E0AFBC4ADD9BFF6F87597A52E16A53D6C3551B7E6BE0A1958A89A739E0717F0A86BE0385C5CA433B68AB9506BA3A6E00DEBEB1AD0519E228B5B2D9AA3C9B4A2BFC8B35BF0A04B5A9D0154AEF1A9478DF4C8A0354F8878331F76C8CB6851940C996109113446367497CC73D395B34A9C7DD9621C9BB277BBACA6D976C3E65FC3FB4588643AB523BB35F551F1F30D0CD1C40D14B09429215E0C5325BB2B069B85C9E0BD9FA841771AA7C9709046B442990CF89513930F122152632A3C3D7C15C8018E1C23AA33CB89AD
-sk = 1F83902BBB77A97B032277079CD0CA70D09D57385CE5C1B3C08B80ED95B2BBE70C101CC1912B71B29B87DD08254B593D616A31FF4957C7C0C325F82024F6A7B125B0FF799FFF47AFA6A9A7055382BCA08CBFBA71EA1B530BDA5A4548922C90C6DE8927494370EFA6C96780086BF585AE6534DC05344DC1941EF793EAE214312A371ECCCEA680C1A166BA97E128064748269922C9A19CEE4B8A669ABD146491ABE31A57B724F3A173740269A33309F651C934E09A564627896150ADDB8BA181CF2503256512B0DD5588F4372781F35CFC0328C0DAC842A1B3F418B6E8C567F410568F2C6BE8EAC9BAB558DEB08389BA08BBAA50E1EC5DCE044EFE5830743402402A167A9369E1D281D37713EB656662600840409C4FB971C0FA7771BA53B6C13EBFFCBB85AAB3316A3A99A9CED8BC4596932B3D052FBB13A5CBFB762AD7A08CA4AAF33862B6325BADDB0E56D395E8F92EBC7347E847956B471695C978DC2431EF7286C0E0A880F7871BB05160209900C0C403DA599B988A8EF0A716A9535B71002B3BCDADE60053F5A8BC66419FC907F1EA718B7BAD6BB76FD3F710E6778587C36BA5E4C2D7796185BB72C5FBB839B6C91119AE6C954E9B66C3EDB500D884428BE2C7CB6A6C86B807A6059739E23F70433D8A7A4AA768975AA6B0C3924CC8827CFC731A464121090A685820068019197F489315A2274A7133422B2968830271FC94B1C775C5A21E3B07BCE543B32F00B7250CABD0D04A2529347848830C975261A54717324533EBC0EC627F2064BA693A9BF9A16FCE87A8D7270759A06C00EAAB71A5CC25034120445334A39D63BAA2AB3254D77A921209750F6869E6971D05DA1E1BB29CEC9CB7B4962370E5C139BA472A75114B28BBB8E7069C5A8201B730DB571C1EE0B10E1C42B4A97FB7F7AE54670D12859D68199443157DDEA85760445895E7175EF8BB919C7213F427301C4F6561AFFFB0B03CF1AD05613C52DC5CA71A74545ABE77D239576303BC9678272873D9B28F4A4AACFDB46940F59B0A82A75642A0CD794D63D03D43F65E753A6AA2B58E0CC664A48CA3D8A3B18C7B05CF8293D3E23FDFDA93506C831455B648E2017FD866C87683AB307C6FD9CF24212509D777F34B0618776864EBAE9FA5318E739692C5AA86648D49778B67F81347B434CCFA990EE9A79DE94C94054E6E4A8A152B5F4757B89F075A27AC464CD1801D02AB64BBBA4F932C0003458FF73011282BF444961C54C5275408C4F79C3C553424AA4AA13A53D59B1B785C0FFB686FDA185D5438AF5C494D98B80381C821C493BC0E7797CD1995DB681EC9E18859A9229C497CC251AF12D9CFEBC6A19C599C9D364E587C7D32245145A60CEEB54CC7EC5B541B71DAE959C800A747EAAB53F8CD24365C91F53B7B0B9D3630361D41ADE4C82C85E04D8BA243763B3F9DD65D60921F962337A3421051D36889253A423939ABEB0AD962CE1E1A9931C960D9F4948723CA17A731ADFB4834615693F622470225CFA7B036B931A2240564CC35E59A7ACAE48707491576CC1410A304E0885534F577692C5A237344A5F674EC7C45BDA3242D70B004D5AB620CA2B1AC0A56C0CD5B942529B054E0F840E3C1837E0053539B4A420A3005A17C7B4A08178B83F8540601145B102970B3FC29F30A4CA1A8A5BC4164051931ED68A59EFB2B50D549BDC1A65E9909F5AA690B0235D32B1C6B2886CE2959FA189E2CE24224E99255863E6D964D4F422C02646A461BB5ABF86F4B4C0975765A5B0CA01081677334AF26C3467DA771CDF40EC4293608801CAD9C61D5F80839774EAFF772B139051BEAA65632120F00171AD020276A1FBF23517582149AD2C73450B11315CA4B244E7218800350AEB5808DA774030635BC247508144740634AC4A078A5AF2816E9206A645287DE06263277242DBA12AF2A82CE13BA6787C5AC3020E5D30CBB92452985AE41027056F492BB1A5E23332698240B5038302E552C5ACC0443A8795804126E15369AE96CEBD7C9765233982458AD6520550BAAD77BC74296BADCD4CC37240D0163CAF8C806A0CCC3F4125A0874CDC1C67E4626C9C753453FA37B208CAF5F523388D6308248B7688C80F6C925895670A1397880933AF0152DA1E54F7A7B512AA87499F7A718E62A7CC5BF5687ADD09060426B0D3CD292AB9B8372083EE462182872815CD740FD69ACDD24615110BB618CA1EF662715F028864BA0872B8C199ABE40F35F91906A821B8CE0742F931C661C65AA2445371A300E68F23B767382F3701CE685CEA5F59C50E82E45234169C3BBAC814AB9D68F83842C513A8FAF475590B3BAC2E3A4685B8F71208357D221AE41310E8454D315670C3A3409A2A95258B9057B42DEF7A7C6F588F6DA61183ACFB18A7CEDF138C7984B50A940F17C687E5A2F83451D94398F4C82C93A375BE195B4B219232E9A766E77040D3B9125E70FA4097D807A6D25323342508F2490A59702575D64AF146088F59802AA2CAB3537A8B4E92A10EC447BD89F9FE738D92A5F83C2861628601E42BB427B87C2153D4BC44B19413B79BAA5EF55325BA8A42E1A88548155D03AB116E47EE0455F0E5A71BAE3A03EF476F77A9A9CC6526DF1ADBEA64930B6995F60181544356C0982E957C5E5186F321B9467D05DD5970A96E226C89673E50A056E7C0A8027ACA8A5CD93723353CA1991730DFEA1AEE943CB0D62537CB5AD88C14F52A78CB6228EF4750EB7DB0AA831A4202B178EF47446A06A17E7CAF5274F384B36832A07AE0A66069BC59FE439F7B6005F064D865B550505210768BD636C61F0E7A1BDCB3C3065908D51302EE234A3FA113A1A1A2A618750075A6EC277CBDAC535FC1524A62E3C0601AAD1C46026AB6B8495C1B7093F776F9E6B3B533267AB99801E83BD18570166387F14ECB4D279B86CFBBAF90649E5C514E432561F850497D47C2BDA1BC2C398B306751991392C399DF6F408FF836F989C41CF76234B9445D9F81F4AAA987C1721C0C726EFE44C311A589ABB5E0AFBC4ADD9BFF6F87597A52E16A53D6C3551B7E6BE0A1958A89A739E0717F0A86BE0385C5CA433B68AB9506BA3A6E00DEBEB1AD0519E228B5B2D9AA3C9B4A2BFC8B35BF0A04B5A9D0154AEF1A9478DF4C8A0354F8878331F76C8CB6851940C996109113446367497CC73D395B34A9C7DD9621C9BB277BBACA6D976C3E65FC3FB4588643AB523BB35F551F1F30D0CD1C40D14B09429215E0C5325BB2B069B85C9E0BD9FA841771AA7C9709046B442990CF89513930F122152632A3C3D7C15C8018E1C23AA33CB89AD61E27E954728E2E2E230C94FF009417D7372938E2C29C38AF22184EED530FA1F36B817736CBC5F7B1DD6EEF5FE6332FB1A598F3871E5470D440FD2EA631DA28A
-ct = 6EECD129797B2891B41E176111251FC114AF2179FD711D4D4C6F0E825AF1251C686757EF29970B63D621AD3FD6087CAAE604D416E06F444465245F34272980672E099F0BE19818760FE474F0E299AAFFFAA6551A0592EEC262000456377E54AFBF5E217F39D7C8C9B19E03B472EE47947580481B451B535486C28E3C61E983BE8A5802469CC95AC9CE38BBC371BD45F9783D0DA21253A478A042427D490F0247C8542648488416970BB58F7F0849502361149DCAD935AF84987BED520EE79D3FDB1B6D478652C892ED1BE4BE91601554D092F0EA15889D4D6B3D8BC38D0A2AB98B19A2213BB688B92325236CBE248B183A6C94FBC22E89250286ECF018AAF17416196F3D1598B63A6A3A780147197895CE6A814C130984CE05A9FE30870395E4289144B529B1D1E04ED3207B0130EE490CE86C49966DC6F0B58DD651D9E650D7F6F7B6F2B6B398CB3DEC5DBCBEEDF1D448892FED8C9EF32D681608E5ADA2958C3D47B0749AAFA33B95B1DCA91E6975EF842F1702777937450157C1B7739EE03B73B7601DB13747C4762AE8245D90D706636BEC3EFAC18F88FFFF3E2068BE9E18FCCBFE34FF834D937BE6413AC20A3E49C9CAD9E7E5B7B7E64D10A99C8BD916E2F3691706A2F64592CEFBE5563B68425ABA971D80A2D7428C623D42099F1B37B679F0EF039528374FA8F7A3D6D4C0A6FE7A110F72636B6C2668ADEF2261530BAB8FB057D26551D97A491E735FA3AD4845ACB832EF4EFBA71D565962AA94E46E17849FAEF065C888912AAE678C0C3314C8A05F2007F3AE1DB1AA4AFB1DFB3F74E937530953FF48B280C389CB13A42AB31F275318885801195B92FD167D17A46FC897E4EFEE985279195889E58C88F88C9F907B9315FC66F9BCFF1D2F0B2EFB7D4ACD7EBA6AD108B5220A1EC22D7EA83E85E5280D2BC06C62FE7615635EBB5C2C25507E46FFCF32E19A3E662AFC952511B2F0AC509CE93910D995A26AC5534CF2B181D624CEC786B86AF927D4BC1BDF396EA99F6DB7F259E30059595A654B2381CE1419E75A5B175455E127E7F1AEAC0B8903CE4F0CC6F26C72A40C358AEDF833AAE85B975F1B4EFB40D7C4A1708574CF0E98A2E787B9C68E568B465A53A0CF492BE54BF76E0C804BF51A5B74981593F3088367829CA08683986EFD8C9D777816158139E8EB22B6EDD93030F3F279E80D958C5592B0E39BB831AB6826A7923D8A2208B6C2D2BD8CD32604DE47722AFC0AB9E5D7FCCA2CA1391AE4AF8E43A5A878229D54EC256A6E42BB89750E97FBF3679F9FBDE1EC3D901B82CC45330BB2CAFB861665542A4FD34317A12CF9C75F6D9ED49FA081FC31212874E74D2F6514040C69A70CB56453618A4F983E63DA0ADE52BE5840A9508EA3BDCF70313173F018485209DC8DD229E36F854C778095C2C85D3B5B2F8E23EC88608362AA183D028F8988C18EF88373DB13CED999479A325FE49E9DA01844E1CF37D5BA098AF7B8005F1F1921B850B4CFE545E7F0441F24548DCEE473BD11846F0B6EB9CC412672CDB0EE
-ss = 807703887AD9601806D0BFD5F9D9B6CB01BEE01F82500F525CF4CCA6E4B21FD6
-
-count = 33
-generateEntropy = 684a29e4e5480a5f2533e1526b5fac8cdf5927f3d85087c71f928c59690eb56575d12195ec32a8686d0600e45d4a7f54219b0d7a3826d193a51b9156ecf2edd6
-encapEntropyPreHash = 97beafabf2c8575586487c7a80e8af5fc50f94b6051c1bc66a5ae9f66be3cea7
-pk = 63992E0D6A8F811B3F0D30807456C84C8BBB008D3B126A31424954CBC6CDBCE91E25B19928F4A41B1371447BA3D173915580BBD7899E9ADCA37B4B5A21E715101717710BC7EEC56EC2E58002127D1898BC55F8A3BE385D607B3BA6561991AC6F0913617303830DA25F0CF0AC14E67ABB8097D17B0AD1EA8C6C267ADF51A15A9A363D7AA5C8EA535A89115C984AC5D6BFA922C6FC44A3B35CB667F939FA6B2676BA212C17BCD25C82E8172F6A7506E8B77D82CB21D7066DA93A7EB3CAB8E881A24C7592BC6B656E459AF33A06FC2846D71221F1DA641004B68BD65DC28A59036CA678508614B15A93E74F89B8AF58200D50E718DAB1C41C4556CD47B43F14092CA47397243983406E12E423233C90CFEB661A32CE65AB464DB58C922BB693F56553961868B064E17A11162A7F0E3AB0B0AA76B8494BA394C902C598C23721DC16C51D46B8258C635763776B922FCAC747985B94C006696F18BA49D0C5EB0525CAD1349745691320969B6BCFF69C30851B41E66AAC3353C6894AB0097B4EC49783CFE4960D61A6F94B317D488D2D04A8B42C7FB7D89D52D89B2DE30336333C50895348870BBC311611F27845C7775128A9CC831966FCCC06292D86B582A18C6AB2FB3CCE03701BA91047227A9FCBC6F16130710756C5DC288BA92402B5B7DC90C39193737C206F3F8230261852F1694258D47C469C7452156E70634384825BC52B03E90720066B609A4102862433E2621987E23AF51121BED807810501200B776F847FF615C0F594420DC29CA6573276559C1C84B0723569DC2A76728909D9D1279A8C240A3979B0B44003687A412389581B8EBF0CCB06C797F7F5815CCBB434132ED5F1340E2C669430B13A709F7D1612AF876454F06CCB7841F84C60F3806D5E423CB34B23BBA90AB630403A46783329707388A1F4232785D4723C993CC62284D0E35242E52CFD6981268B86F598B11472900F83333C48627D402ABBA59C6740B4A40ABC3200B5D9E13010FB4DD6BB503548C777256E0729905A89BB386459E0B885B6E3017C94BA93C7518F017695F5BF5B99214C8555BDA863FDD11D40053C0D652696286D2BA14D569915E4532132527CE1B88122640AD668A20964476DB20AFCA5CA663C6C17156AB3CC8E4B723B3A5209D2D10767DA52B2443764F91A7F3AABB35137EE18A1F744562E22385716892CA77D518C4BEC578E0F1145B3241C1831BF782C760F9081A1191812790531648954163B10E6A1F02B2B9E17CDD439C6707AAB0DF09236BA33D9B271196A398FF0B2C9521E57B6C8833489C5328F4866C14D2CC1CE037400DC610B28CD99150404A175662102F9617205C1CBC24B5716C7B9B0E8635BF960BE5B632A976156C64078CBB23EB86B7BE9A2D3E12F5B56406CC51796C66A6E871DEB601CC767C0B8E45744346DE60BB160808210506C5779BC275940E000314F30555677689F23009A583CD6F9779C83530E5B2A5A0A771BF1376F0091C627AFECAC104FB2BA251C074E359E5FC44DEC244CCB78423532A7EB27C8313A341DC1431035162838835C85C677A420B67C847DC6605821587C8064E0BC2F4FE6A6B22113E73519125B92B3A66F15564666023EA99273D0D5657CFE1B1B3BBF85039A8189076A3752784E23D8A802023FD0743EB03D989A6968
-sk = 8B78635AC351C94BB6B1D2B861E4914DCBA415F66CCC465B370578E136330A2C5CB0CA2857E1CB733A75E5CC4FCDF7A12580017F1C0FF484401CB23318A98000637B3D065608678103940D8BA75CCBE58206C130ED62BBC0132317B6556A9C2AE8F71A43712002D795CA52007782652D291DFE535F75034B0D624277527A6EF623168AACFBF721A9E8753195B82EB9855467322AAB0AB1701546C470AD139944B6736E1C97C9768370846B45693AAED9C80A7B53B863830DF61FE9600AD5717BFA2C8E59E30C8A20179B27B59341C855677880330AFD1A227B6C6313E17C46E87D109A4AEC4C1795908DB6046598483159907A667378F80BCB84472D5A748043B1BAC10BA5BCF61B07A2B13B12C347F3253E26C25EF0AF6A003A67B0BEE98A7C5A489C9EC9AC1F042C6F2BC7585CB01BB4B55496A93DE903EC974398E277CA7CC25E3265A879420EA0BD8451716AC21F1BB806C12B3488D408EBF18B89B79B1F8C09EACA235F1C165F9504FF987139590F9977513EE037249B4E25E51A296526BA76CD3295895A571CAC279BC65642CBA501C8F131EB52B5C7CB73B17757440B1EE4E9295D404177E542BD744AA587738BFAC0EF3C1FA0F19B0A5C5E28B53C2340C7FA061AD354C85AD26993087B61AC2002795D5ADA7A3E6747AB8110367C824988CA705B818D7A921DBA33371405AD235B18E463A8AC88180C88F071579FA5AB6D904A2F53B03F7C7EC39C473632369F984F8CC66DBD1924206A6376706CA36601BE7B16EDD17E93CB9A0437B3615374329B0712794F5058790D88182BE4863293133A83AA00E07C8E79C6F12C33FA9437ED984A1392903DA89BD43184DB6C8DACE3789AF5CBBA092010B889CA98AF99E5B0B3D4399BF61266E833A55A85E11784708B98EFAB223A27AEA1A16E76A73C2027759FD97A7DB870F9FC79AFC89435D092DB556E0A738C133B259F86C98D78A43A49744F306DA8CC6C9098A5A9CB091C9BAD94970F03B543D669A9AA4944E0C08DDFCC1D7D485FA414B0765A88F175AB6C94B12A2177DCD4998E6AA263EC3FD5BAA2466CA04568869466887F7BCF636C7A1F084277532841F51C3EDC5C1873BCE0F07A8871740C4AA82BB5AB164916082B795EB0660BE32DA9972840C927B7BB4061343D56757258BA4C91624F21DA11CB265B00B9AAFBB1665679C86EABBDA12B74F1C5917101D0EA2BB293C71AD5B556369378A8D5B7297C9731705DD4493DBB173AD01458686A93287B6DA0A6923B913989B69612A915A03A0962379BBC466A03F5517AAA0C0B030C6CA420636B2EE8821916E9C7F2BA228BB2AEABBC292F6C07AD85C6F43CA90D42629759536046394936C3AC5AB979D5CEC1A1CC19B5C17EDB47B0F47F34D616027B29A12725BF14B62FBAC4F2CC6EECE89CA0467D4868C11C17299373687B657D132C55785080F5B87F0E3C1504673825B98E8A0AA35F2C8D84F41B060AB43A930E7BE1C9D04746169BB4AB403ED8C74AACB868B4A93F1DC55144738E2736749AC64170CA7D0F0348A9550EE494466A49617B541068F2C57AD4108AB813DB58526C7647D55C1CB657CCD1143343AAA8421C23BD0C822F763B6A82B7D0041648A143BCC43163992E0D6A8F811B3F0D30807456C84C8BBB008D3B126A31424954CBC6CDBCE91E25B19928F4A41B1371447BA3D173915580BBD7899E9ADCA37B4B5A21E715101717710BC7EEC56EC2E58002127D1898BC55F8A3BE385D607B3BA6561991AC6F0913617303830DA25F0CF0AC14E67ABB8097D17B0AD1EA8C6C267ADF51A15A9A363D7AA5C8EA535A89115C984AC5D6BFA922C6FC44A3B35CB667F939FA6B2676BA212C17BCD25C82E8172F6A7506E8B77D82CB21D7066DA93A7EB3CAB8E881A24C7592BC6B656E459AF33A06FC2846D71221F1DA641004B68BD65DC28A59036CA678508614B15A93E74F89B8AF58200D50E718DAB1C41C4556CD47B43F14092CA47397243983406E12E423233C90CFEB661A32CE65AB464DB58C922BB693F56553961868B064E17A11162A7F0E3AB0B0AA76B8494BA394C902C598C23721DC16C51D46B8258C635763776B922FCAC747985B94C006696F18BA49D0C5EB0525CAD1349745691320969B6BCFF69C30851B41E66AAC3353C6894AB0097B4EC49783CFE4960D61A6F94B317D488D2D04A8B42C7FB7D89D52D89B2DE30336333C50895348870BBC311611F27845C7775128A9CC831966FCCC06292D86B582A18C6AB2FB3CCE03701BA91047227A9FCBC6F16130710756C5DC288BA92402B5B7DC90C39193737C206F3F8230261852F1694258D47C469C7452156E70634384825BC52B03E90720066B609A4102862433E2621987E23AF51121BED807810501200B776F847FF615C0F594420DC29CA6573276559C1C84B0723569DC2A76728909D9D1279A8C240A3979B0B44003687A412389581B8EBF0CCB06C797F7F5815CCBB434132ED5F1340E2C669430B13A709F7D1612AF876454F06CCB7841F84C60F3806D5E423CB34B23BBA90AB630403A46783329707388A1F4232785D4723C993CC62284D0E35242E52CFD6981268B86F598B11472900F83333C48627D402ABBA59C6740B4A40ABC3200B5D9E13010FB4DD6BB503548C777256E0729905A89BB386459E0B885B6E3017C94BA93C7518F017695F5BF5B99214C8555BDA863FDD11D40053C0D652696286D2BA14D569915E4532132527CE1B88122640AD668A20964476DB20AFCA5CA663C6C17156AB3CC8E4B723B3A5209D2D10767DA52B2443764F91A7F3AABB35137EE18A1F744562E22385716892CA77D518C4BEC578E0F1145B3241C1831BF782C760F9081A1191812790531648954163B10E6A1F02B2B9E17CDD439C6707AAB0DF09236BA33D9B271196A398FF0B2C9521E57B6C8833489C5328F4866C14D2CC1CE037400DC610B28CD99150404A175662102F9617205C1CBC24B5716C7B9B0E8635BF960BE5B632A976156C64078CBB23EB86B7BE9A2D3E12F5B56406CC51796C66A6E871DEB601CC767C0B8E45744346DE60BB160808210506C5779BC275940E000314F30555677689F23009A583CD6F9779C83530E5B2A5A0A771BF1376F0091C627AFECAC104FB2BA251C074E359E5FC44DEC244CCB78423532A7EB27C8313A341DC1431035162838835C85C677A420B67C847DC6605821587C8064E0BC2F4FE6A6B22113E73519125B92B3A66F15564666023EA99273D0D5657CFE1B1B3BBF85039A8189076A3752784E23D8A802023FD0743EB03D989A6968672E53B28D579974D268132187E7BD72238639C6F2CA154D50D98C74096EC33075D12195EC32A8686D0600E45D4A7F54219B0D7A3826D193A51B9156ECF2EDD6
-ct = F145A8D9CE4F94ED02E2693AA6A5458962997E212A3DCC11C56BAF8DE75A68F67C69EBD87B212596C90201BEEAB5E2A0DD8FB0F9C3308EA0B0797A6921E7B7A036047A78F254ED699393FFC4B904EA2E00C7CE3D149BCA5D763C2CCDDD386EFA74DE0D1E42E1F7E96B1B92C346F5610612E30E970360DCDC541435974C33976B13B069270DC5D78072E9CBC434E92D7B30CE2459812D5A25D33AAC97D3DBA1A4ADBDD08DA548DDFC83D22EDCC5015B09AB361DF9AEE747572A4229E6BB5F5FA85579BF47DF4525880A6BE4D871D38E0354DB9FDD331F8A1591566938C747F14F388395043FEBA7678FFE17D712BF651D544E6F307E30DE4AA7022ED3B758D306C8D526C29048BE699A9E5D77EE1CFA5961AFDD94C867B46D74FFD16EE258E6E8D3F4BFCA7D810796A2BBF456CB5D00ED9C736286B2E57D10633227BF7B91BE1B08361C90A57D6D4AEF79271B1AC6E2295797671B7F0C7DBB5830D2EDDB2B7AF062BB73967964C0D740F7BF562648634B40E5F2DA69260FA4DF1CB9A99247157A8911B8C2916E6307CB684CED9FD738C05179931992BD64F7541699F8DB7DCDFF73085E9BA500FC1E7130CEA36E4C67183179654913E33D9C47D76A3FC74F553BF32CC2B0167C4D3357A7C5CB26428FDA06A3BFF9CEBA276F2A412B21E04216A052BC4C201E5D36BB704DE258D30E5CE1112D9AC8E0940C4035789A1C3C2194A3FDCCEA8F4FF9CFECC01CFFAE1334013113ABDBA5D6574167D1AAA2B95257AFE1DAA39B8EA30F7F3843CCBD2B0DD373E9CBC9CE254BDBAF462A0486CF38EB7F90B5A7FA77D007636641639C7BAAC4563CD27B44D9B104C04990EB0D45B9FEFB05D987B64A5FE8916F906720628961490A91252DBB44972B7FD2BD5C11292F40B6C92317BA3641B4DA563FAAC61972FB552553CC006945311B8C79F88F7A59103306565447ED94AF5C2D1C10DF6D5BA6754932FCB98F3AD1D47D39394AAA810739E1E326AF312D94605198FE30E7174EDAB76391D4956ED0E4C2AB6954D38E00DBD02E76F2357C350F7E93C1974D2C1CBB3C638604DBCAD41790E7E402B80261405A52C2A0F9F0CE637A769CEF5BD800CFFC976598869C24FD9F8C83C55AD840BEB08EABB33877C2CAF3F8328C2DB2E575254E4F129A1E969D91EA02C77000ACDBEC1CF6B1003CA9C8AF77B22F6F9E8E831E4196585450B61E0E9AB6ED12B703C990FAF295FEB56FE39AF4B9DBCB2447B250FF4C13078FAD781A6CD5703FB4DC4A49FFA0FCC342E3638C6FC407602818E0F3C557EA1E9455272929E63B6BF746882769C5C482A413901F04623DD386186392922E0CC3B051F87C4783A90702B0FF33DD37AA924A2557E7461652444C9DFCE842DED51BBE97336FFF712974A3B60344FD9A7898FDF1F5BCF9AA6F0F28EA66FF64A76EE2D6080AA47C8829E1E8292185DB9921A4F4B3FE28786AFA28B25E87BBD63087A08A9234C6F12351B7F622A00F81E46462882936219FD8434CEE7B5EC0F18ACA21B13B5C995918B13B852121
-ss = 9D28091B20946B5507AE42BC4355A71ACD2B5EAD20D4181B22A5031EC53CA00F
-
-count = 34
-generateEntropy = d76b3573f596eb286ab5231feec7499686b13021be36cb126c7ebeb9d7030daf248c0a21ea0bb6d6f56f12300e8584d8e9a34e0e6f52227281151ae4c305fb8f
-encapEntropyPreHash = 75461decd34c50d6a094b4a64fb75e5e9479f8f9250d82bb7d729dedeb2d4b65
-pk = 192042D43A4271E44D1546306137A4427130C86A2025BCC297EB36D3C44E7CD4B0B1C22005FA702AC12569BCCCCAF6AC9256A1693C8B677C5CA243B9C8556CB3A268165596FD0470400CCF5E3B56714792F7A87B9E03019751425695AD70E4CE0B2769571901C6C2003B58152FA9757922BD28A094771B0CB1DCC73741B14B402E8AB86DC0F647525C131E9AA1A9729075EBB3CDEA4D31F6C3B23A5BCBF74A3C653D4C015CE5F65FD1042A137453462B8710704BEA463204C463273BB71056378850AD28F37EDE664E38514DD735BF9AB9B95D367C54D84FF085650AD33EBBC982A329C6FE3A516EF387BD0A0417C2655A5476F51A68CBDB4AEBC53F00C11E78E5BA6692A516C076330C20D0A09F167BBFE1C956A619825A8305D1AA9AC5736E6D24145924B2409A8688B41F33A181A9E4858325140A797F2BA81D50F21AF88650CD0BA8E662077708551A947C97C0A3355852A77576CA5B054D3B0B9FD973DADA618BD02FFF1CB59EB56B12C71B24BB1F02E27282D21281493AC7D07A20B124AAC30B7BCB8C2FF24B2C927D3D62ADE0357BBF7C1281FC94DA2B21D10A5E5EE07A3FD9CF93E34615B871C8DA7DB5441020D0522C12711E1963BE54739BD43949999083115988A09C6020CA88124B35C34EBFB0743B494B2666CCF5B5235968275FABCF9A054EF92833D8EC816D68C07FC53634A02CA192A411C87DD1F17FFEA094B6868638716CF593B33483591E4049E4E7C65C8618B242B17D6021BF0A70C7C59BC81C34F5441B063B9A1D95481E6529602B95F874BF1C649D95A072E70A52E9252E1DD1BCCDF64332345355F7CC48EB7DD1AA2F2C31AD1FD58B8B3A711D113C270A90AA2C5C79958F3907AE3BA071AA6144B88BA6C5575BDCF5331729A65D8ACF3DB97ACA4191B72A2BC1433FB3483EFFF09698C291DD868275DC5A86D06D97305BA596515E434A8D956B2B73B3C00821BA055AA7541E4F35896113ACFD9320FA91585F3212CFD5B023A77D7C5C0CEB746723C2C7D7417BFB740E4BFB2299B29F987698EDFC1B8D7B33DE2C80D0CBCB44F05B1DDBC667005B6E4335751AC281022CBCFAC0A55226FA69CFF845007B9A16D2B6BAB3135B325B12C263A81FD423120A6FA639910159B693406411A289863736557A028BBAA23E0C984F04543E61916D9BCEB4F64FD48823A4B13E4F83B43D443F62ECC72FD304F71772CCE318C1DA9A57A67502A1119313B93C4A66D03C2316C2CC5C2285B1E80C413B2F29C447DC975923D9100BEC9DB958ACD7850AB0777D82814929121BB87A6F4F07880510331EE6171797BDF23850D5FC1802E432B2F51B3CBC37631C9729892B6A09BAF6717E6EC39EC2B3489B33BAF257C35B9CBEFFDC1A1334380FC35DF386116BAA9BAD3A0A8381C4FDFC4B1B98836F23AB923175EAF72C59D9C500E10944FB0FD701BA5142B3CC358BFAF2732D643D0B135C8F991B0C73789C465A7E1B3EA6804B5AB9AB2E42CA1E91158019306855A5767893BCD17E92A41470D721F6432448FBC370C64C3E330D83987F3A9479F000C75320A296393E253A68E0E1C05969784F5612ADBAA2662459B09638202B74D8D5CBD2B01A915AB2AD06B08670546D8B76877B8B2EAA1ABB3132E55D8BD5B08678BFA4243430BB4D059B58A4B0CF0FD26E
-sk = BDDB6A1BB704F8B530860B719752402098C84AE4809B01C8EC7583A66A3F4BC290BF2173ABB41868225606D54991F5B547C2254C74391717045997A57BA534A97B3605E1AD9F7C6446AC08BBFB1999179BB8F67731A63CE1C717F30B57FD17BC00605E8E14127EB0C26E324AABD45138484A51A15DD2464440178CA7E966D4D58383F6BF9BB2A971729074781A8D978965F9A51EB2729BA8C308474D56089F2CC869B523C41C409507A671F0F3621E057662454D49C49A398343D64CCA74B7822D773373D5185426B7B3951256154A7B78CB1F5049DF0371B840AB21B83944FB383CC84AD9E24FF42B2731276C1D26B6120534438B029C4AC7C0739453C2860D32ACD75229C63A23A7201C303032BC0A410319035D38A3C9802D41A56A8C6C2496DB10441A2BCD13A81F90CDA2564CC9E4020A47595A30994888B383E996115AA282EAC3E3594447110C2D07774F9312D796C6B74A7634B6C0DA2291458A35D3022BEE048483461CFEB152E1D2CA9195AFD1F9AA82131804D35E739299C539B913C54A0C58683259B3137AA464B9C6E03B0EB751999B6C5354D6171C78CBBEF1B456EC4C88199764A5761D18C0849C1B0A263EA401B86CBA549C712E4A251830F7B6EE16B2BFABCA3CE018C3833BB881385C272DEE151AC35A2C9561B3C1266855219B0C6B485E669FCBC49B24C50C6C3237AA6B116085085405115E0422D956BEAFF9360B58BF915654B9B887AD9733F425A5C6990B3F0223D8099BC0E95C6A5702CF5667209ACE08FB4697D02DC45CACA8074185F54EC4641B35BACD2F0B770FC215FDC171C98BAA7AB6C0450BA6E47A838575A528F7BE221C3C91F02734269A9425A2EDB76CB6D077ED76040A716D39C9C87A58AD8867954C752367A905AA158E0A9019DDA50A6213C260F7BD8A0A6E8CF581FB74CB17283F3A1A8AA9A0418C79A948199365A6A1045238104280AC704B33791E156A2377BC83E9B9C86D0A3D2AA3287272BE6431BB4E598232312D10D03BCB13B4D838A9A624566C6A25FA44A0934AB6CC333E6D52AF3EC26A6FB97615CC3C77102D1A315486BC69C555A3E8271660222A406022E8D97251308A90A15F748153C1168CB133593C1641E164C8A06CC008059C55449413C2B28667B99122AC42B8BFFBC15FE395003249C676DB7589D2896E7405BEF8AC510782FF204454C8A0390C332CEB7A5A3123EB1A1AD0470096058358BA779DF70106E24990DA77AAF09705110993F16A2320A941D8865B387236CB8528BABBF2D9196C15898BF71040D3BA500CB7B1AC85DF11003A058D838C2652D4577306023C756AE9715136E91B20699FEF425E48953FECE15BAF27489D929876803EB0B5764E6338BF5970C2F35D1E815BB5B0B1BAB630138859B729923343C3D24922A8522E38E19868B8A4585ACF14B795FF3A609D93B1A5CCAB08F877C5B71EA78C2819113FB3632D5D995B02926663F2AB8E3A73DD6AB93503192E0243F2593618E3A809684BB6A31674E77802828FEFEA3A50FCAEB1088F7EDC036CB84329C988D965071E97C1311643BB1CA2B43CC57C84CD5EA9109AE36DE2801CBDCA3BB6F977959578954AC17D303841D5726631663F12816EDAB5192042D43A4271E44D1546306137A4427130C86A2025BCC297EB36D3C44E7CD4B0B1C22005FA702AC12569BCCCCAF6AC9256A1693C8B677C5CA243B9C8556CB3A268165596FD0470400CCF5E3B56714792F7A87B9E03019751425695AD70E4CE0B2769571901C6C2003B58152FA9757922BD28A094771B0CB1DCC73741B14B402E8AB86DC0F647525C131E9AA1A9729075EBB3CDEA4D31F6C3B23A5BCBF74A3C653D4C015CE5F65FD1042A137453462B8710704BEA463204C463273BB71056378850AD28F37EDE664E38514DD735BF9AB9B95D367C54D84FF085650AD33EBBC982A329C6FE3A516EF387BD0A0417C2655A5476F51A68CBDB4AEBC53F00C11E78E5BA6692A516C076330C20D0A09F167BBFE1C956A619825A8305D1AA9AC5736E6D24145924B2409A8688B41F33A181A9E4858325140A797F2BA81D50F21AF88650CD0BA8E662077708551A947C97C0A3355852A77576CA5B054D3B0B9FD973DADA618BD02FFF1CB59EB56B12C71B24BB1F02E27282D21281493AC7D07A20B124AAC30B7BCB8C2FF24B2C927D3D62ADE0357BBF7C1281FC94DA2B21D10A5E5EE07A3FD9CF93E34615B871C8DA7DB5441020D0522C12711E1963BE54739BD43949999083115988A09C6020CA88124B35C34EBFB0743B494B2666CCF5B5235968275FABCF9A054EF92833D8EC816D68C07FC53634A02CA192A411C87DD1F17FFEA094B6868638716CF593B33483591E4049E4E7C65C8618B242B17D6021BF0A70C7C59BC81C34F5441B063B9A1D95481E6529602B95F874BF1C649D95A072E70A52E9252E1DD1BCCDF64332345355F7CC48EB7DD1AA2F2C31AD1FD58B8B3A711D113C270A90AA2C5C79958F3907AE3BA071AA6144B88BA6C5575BDCF5331729A65D8ACF3DB97ACA4191B72A2BC1433FB3483EFFF09698C291DD868275DC5A86D06D97305BA596515E434A8D956B2B73B3C00821BA055AA7541E4F35896113ACFD9320FA91585F3212CFD5B023A77D7C5C0CEB746723C2C7D7417BFB740E4BFB2299B29F987698EDFC1B8D7B33DE2C80D0CBCB44F05B1DDBC667005B6E4335751AC281022CBCFAC0A55226FA69CFF845007B9A16D2B6BAB3135B325B12C263A81FD423120A6FA639910159B693406411A289863736557A028BBAA23E0C984F04543E61916D9BCEB4F64FD48823A4B13E4F83B43D443F62ECC72FD304F71772CCE318C1DA9A57A67502A1119313B93C4A66D03C2316C2CC5C2285B1E80C413B2F29C447DC975923D9100BEC9DB958ACD7850AB0777D82814929121BB87A6F4F07880510331EE6171797BDF23850D5FC1802E432B2F51B3CBC37631C9729892B6A09BAF6717E6EC39EC2B3489B33BAF257C35B9CBEFFDC1A1334380FC35DF386116BAA9BAD3A0A8381C4FDFC4B1B98836F23AB923175EAF72C59D9C500E10944FB0FD701BA5142B3CC358BFAF2732D643D0B135C8F991B0C73789C465A7E1B3EA6804B5AB9AB2E42CA1E91158019306855A5767893BCD17E92A41470D721F6432448FBC370C64C3E330D83987F3A9479F000C75320A296393E253A68E0E1C05969784F5612ADBAA2662459B09638202B74D8D5CBD2B01A915AB2AD06B08670546D8B76877B8B2EAA1ABB3132E55D8BD5B08678BFA4243430BB4D059B58A4B0CF0FD26EB86D5B13BB8B72A9FB81245AB712F0D10F0E2E09B222143C420E3F2C3ACEA27B248C0A21EA0BB6D6F56F12300E8584D8E9A34E0E6F52227281151AE4C305FB8F
-ct = 62CF02A7A2D09168AD13B88990D97D6A9B0490491EE43B8234B585382834B03FBA539DB1958800624B86051987EEAF09091C288F6564383E1AA98094850CD37C2A695D8AD8548B12FDC9FE827C63A360135EAC409C76D0A8B2390A64F012161A2DD3AE0DA8F626E2F5E053520C6DEDE4EC8D64B045B278B1E140988B3A13DA6ED4DE14513E04FF00EE7B07A05A79CE27FC8A183582F2F987B44B95770083CBA46A2E2DC384754D0ACAD94FA54EBF73568552318EE862C87D22315A7BB4126B2ED7D9E190456EDA589994EAF5991253A191FE3D7156BEE8FCB9A02213A477339507BF4A1CEEB0C64AB07D1B9F3A492437269FD8E932077C80EA7E3701F6AAE89718C2C96D6C46244A3A1E760D0E758A47A5547D403DEE7135E876345D0B725E2218A9A004C567F5BB00905A00039C3B6850CF5C8EDDE3FC1A4118118EF1EE524D312BF82C3F9A089DABAD769C4D459C414F06BA28DDD48B86E079367FC77285AD70D0ED6E46BE65DCAE0FC2A68312397B8E2771EDA4911E4C09E88D0F3055D01DB4B3B1ABC968EA78D8784CC0A0A429490E862B3A6FA629CC335873B55E88E5A0F320125BB16C621C4CA6ED3C69DC3B190D595EBF8685E7A22CC63451209D29413E7260DA471B602F9C7203877D69FB0DB331BA950F0AAF45C8697704A3A641CC04999907D70BE17EB56D316D6F196941E130AF65B0C1E4555BBA7A2C69676AB4AC7CF9FCBE9B498C46998A396A5175F06D31887DD119C92A02788909AF9997FAF43D148E4B00751249B6D569D16758503EFE6B808C5909DF65485AE901A32000D0023F034CF9A20729A7901049EE12DF1A1611F609F060DA51B0016A988054F5805D37920BB7DF00E5E7B99C19299567CF93CA8A9C13516C7B8CE59E0A71B6BDEE58290911D9B44A26D1C48400DE5C246AA5FA3159324BF31DFA3D1F223FB2472FCC0674D6FC19B0B730F2BA7DDAD33428A78E087F751061C7E21AF59F3945151DA4F97BA65064E8D4792FDB1A29D9B9ADA763A0F743CEE9A535A19A2260258BA86F21F0874A8782F5F36883369A655CB3D622C8F828EE4ACFE15B534B8D81775E0CF0C77625A2965C8820D1EAE140D940C1ACB3AC9C216DA291588C8414B91DA8E08F5B192CF007CED7F1B1110670F877B4F8132E6E53B3D47B4147129407BD14AECC4250BC5F054E3C25B255B1F15583B4DA510347A6BFCC5C0C25200D9DB9ACDF58B1E2B7EF968D1D18DE9C67D05BDF49C28D8FB4845CF634E490DE1E99D8398123C9730FE0CFC63B5E34B3E7D73A970A1AD1C963E442B9528D8530DD38A6DEE6FD64C24093BB650E1D6A9C79C05A9282025185DC4A08BBC50F1E335931490638283EFCC4618F2023F06407F70F076B30A7C3A3799967CD707E578A2EE156CFD9249852E5EDC08CC27A1AAB18A0846D066E61596B928BB6C994CEAED604C0ED5B42F9AE38756E8AEF19C47CECBBA7A56FC7EE51E394D0B8AD32DCECD50031C047C519CCDE7EB20E61D8944D5AFF66626541982FF2DA65F211D85F5E89D8BA
-ss = 98498206D1F4D3C94A054C3C3A6087760B210D2F3628C71CCF3F0ADE9694ED7A
-
-count = 35
-generateEntropy = b87439fde81c9e39eebe7cf741c685785532c1dd23e8ef868b9ce7a541010f3d1646460817a0fce5836bdfe124a7448e7adf7b8ecc2652ac6d280e986682df71
-encapEntropyPreHash = 2607dcf4fd6ca1c614c21b5e37c24981c32b91c8c3e6955777da8a3f5d9c9335
-pk = 38E84DF3C6A2DC2389897C3745183E08C1681B5B9F57C16AA2C12778528510868964122C1747662CF97D8B0353BF23693A70B3B2A7C8CD5C5508A227261CB7C3022058E318D3DC39E320770724351AD78010EB423FFBAE6714999226895AC23735A9119622BBC0811516D617353C7F769628925BBD49629FE0AA333D1909A16C5C27604B7DB0B4E602AB27987DF23C3718630BA4C2846444B83FE914D840CC8ED79A85B645A32809CA069FFBB8B3201131CB129DB9282B73174F8D4A14A37393552B109D2271EDDA8D968AC3FF67AA3374A2355C2EC895441873325DB71C91020E91F19347D965F1410F606862F69643216B869673B5A70583FD1218639B5036CC11D051A13D219F3969C817326D2B60BA5C13CD8CBC9313AAB478833D73716A2A48438FC529084C241BCB4FD67179D1F5494B4BAC2B05A5767B9647EC8829A500D1365BCA7B8CE7B75BFEA0C68F8A28EDB7BC4A3817C0D32C4E10169832B9ABE271CB0B473AAC2C3DD39CE895551A297A61F47162D97C41F051D48B62E5A8882DA62FCEE16EACFB89B98A12AB626E69D77CEB3B6B02878CE346AE5CF754C3F6097E0B5EB7AC80B9B8CCD9418F63E545D01C7D17A71E45EA3A6D927484D4976CA936FE392CF2052535C201DE9464008C932617CAD94085C5816AA41973A8D21610430AC4B3080DD480169258E65B53E340759BFB70D68B15B868C4098847901A6B255938ECD15D5EA94232B2971E3BCD56205FC6F0425F50AB880821F56C7B25F51F2412CD7FA023852CAD04F2704D4103D4362E965473ADD3563D9B36E5097C982506865454BA30AF132BC17C807309723847257C697C525E27CC570A88A1688134F4193DB67EFF018F54751E578483A77A119210106FD03066C403B3303CE54B39493323C4334D4A7A20AAE04D8EF529A15CB7D0900FBC4236C717310246C9CBA14D6874BEAC61B566593B5EC5887272B914EA655D254D595824288A666F10C7DA583F933052F43B0B0FA59248B0584F193AD548A12A845FDF14A73A0A37ADFB4D1845AFE6B56EA50B00A5503CB542C254A26F456AA3286B0126350272638EF0B4A3ABC56FC8D0AEA2F7396D97B64C56817D58C32103996DB88345D377FB7B2644FC99A24258C50730045B897AC908F7FCCB81BC2B51C286899C8C499C1757C6B0A6AC0A8482159D564CDB746037A1224CA72177F79ED19A398040426664ABFBBB7B7BA99906E7982B665A551881E0F02A97409A3E2ACD37FA96A4F9293F786A11B21E1F0BB22CF400DA06081BF68111A9BB64469487D4CBC10578106B381B8B054EE29339E1830DD613E19A9BAF9A81C2B9AD1D121A47D40234BC9D4B79C2F5F165BAB5A2DB68C59C0737E0E4786990A92476AEA44105F3C77FEEFC342B458E4310B9B110A8B2C01593B512F069944828A3F6A219354BBDBB1C344F24AA0784160CA704BFD89C4933B6123C4434CB9A6CE16D3F042F1FC571DB728119F6A33E4A9F6981193D60BE6AB916818B8E1FF9A1D1A59DE8824F808043A1949A5520B675D8834EF65C1D47AFDE2710C6B63998D43AB47A681F0A856D166C24494081E076D5FC05B541145D3155E232A5AF0AB96ECC0B09C2C41E285D350500A4F8BB32E99B4B05D558EA7918A7881BCF516457AD2C3AB72EF2E04E3A4ACB85A987C2
-sk = C6389F081CA0932AB66F658046C1278B38BC42B5C4E1A7C7A51B09D8A159773B67AAE1C2AA8666000C6E6A014B5C0369DFF147688AC6FD48C73D783E3025C92D782A479ACBDE8A7548384B763A868C46178345A773A9852016B9FE765DB0BBABA5751E8056B7564C53FEE8040D3C0125115D323C62A3F0A2B518330B6CC4ABCA84F62C792D07C1E1A0BBBD7C5B9A698CB683981F8828EE69912600311A0281DBF9C6C9E69DAA26A446D136E8B0310F236D7A5A49B2BC616FD346C3462AB09544998C8D5EF641E7B48C35BA7A68F25414F703FB02B501C69C58A9B798C8C76923272ED9BF432208BAB30F2DB45E1CDC56F6EC11792A33EC1A62B3FC992441527E63328A46003DB49B7DC07F73F705CA0220DE94BEA4967213D612B5A03B2C16A9BD4C66E0AC893263169A87AEAE67843944628E6374B5518BF40919840B8E6C64172BE3A35EE5A29777C035463380203072EA50E7DAA4F906D01C502560621137B91649C97417CC2D3E1677006226D4621073CB1AA213525199BBBFA78F1899A53CB2B8D00819869867A41B2F48C615EFE2C8DA15A4E6965BEF0C4207A499A2156EBFB611478182D85A71C9F8776D28051D1A6E4A104E54615992E0595CA9B0CB2A0AB0159575863F3145B3401498949502B2EA4392C77728215F8700C93F5846A1A8126EB6B72248BD1047BBE62AA58737268428509E53575F945735E75B42DB2BA2F21B24C990A847241D2C3533B10D50847C85D98143FBB2EB5138ACCB055A8B8BCEC8AFD7B5697306165AF982190821A14301EF0A90C3D829ED9035430725A99C67745CA415600D10D7C29B228998D7402EFC1F0D0476C4D74C34754AF9A1AA1213C9A0198065378DE2D023EB73B3A4BC5801D98213AB7040CB63318B8395DBAD6C7C604760CA679B301AB08EF1A948A5A83DEBB39651310B368C736A56977F78AF0916364F278A4E3973374213F7A28BA70296D1916FC65CAD3B33C4E1597F818CBC489BA970680999C373DBC246740C07D97C5E1EA5AA1D627757F4467E84AB9C5BAFD9BA484F1212706788CF5AC1829C7FF0A66F26C30AAE327BB7E167BDE95FB5829340B187162A5FDE3A7CC6A0A05FDB6F26902BDB0C6C4F75692E67AB1C8B1B46A40E53FC901DD892A3E612AFD1CB2CD52BC5B0C3191137E602B0A5872D3A961EF7168990B634F438B744375D75995943CAAA47E3CC5DC634432B6CF2DB29B637A5E22559A59971BE46004FE2A40F7C330610377A5B0EACF79D85F3C86223A4C90C31C2495314748601431FA1F49ABFF2575410AF33F7367C5540084B75D6736ECAA010290839EE2456EE16BBCB57C601F26AA104916254A689C24CAE98296E4BCEF8770ED7485511F55A46C75592C88D6F76005356C397EB1E61CAA04BF55A05C8409E644055759A7E60C1C8210221FB97780B92C2C8AAFB6B94C259A9CE6291E18A801A82456B93C221A625129A1720328F11574A5C35C3650A7B57619C61F47ED6319329F118F4C31358A26A7E9191CAB61012A71B27B47FA13CB0B2C959D913A2F4BBB3D106AB695A4C13D41256A0B442F0428DE78F90609A11B8CBB475083712539E1AB034903C30F6B73BB8229ED50F901B142A597E7FE48B38E84DF3C6A2DC2389897C3745183E08C1681B5B9F57C16AA2C12778528510868964122C1747662CF97D8B0353BF23693A70B3B2A7C8CD5C5508A227261CB7C3022058E318D3DC39E320770724351AD78010EB423FFBAE6714999226895AC23735A9119622BBC0811516D617353C7F769628925BBD49629FE0AA333D1909A16C5C27604B7DB0B4E602AB27987DF23C3718630BA4C2846444B83FE914D840CC8ED79A85B645A32809CA069FFBB8B3201131CB129DB9282B73174F8D4A14A37393552B109D2271EDDA8D968AC3FF67AA3374A2355C2EC895441873325DB71C91020E91F19347D965F1410F606862F69643216B869673B5A70583FD1218639B5036CC11D051A13D219F3969C817326D2B60BA5C13CD8CBC9313AAB478833D73716A2A48438FC529084C241BCB4FD67179D1F5494B4BAC2B05A5767B9647EC8829A500D1365BCA7B8CE7B75BFEA0C68F8A28EDB7BC4A3817C0D32C4E10169832B9ABE271CB0B473AAC2C3DD39CE895551A297A61F47162D97C41F051D48B62E5A8882DA62FCEE16EACFB89B98A12AB626E69D77CEB3B6B02878CE346AE5CF754C3F6097E0B5EB7AC80B9B8CCD9418F63E545D01C7D17A71E45EA3A6D927484D4976CA936FE392CF2052535C201DE9464008C932617CAD94085C5816AA41973A8D21610430AC4B3080DD480169258E65B53E340759BFB70D68B15B868C4098847901A6B255938ECD15D5EA94232B2971E3BCD56205FC6F0425F50AB880821F56C7B25F51F2412CD7FA023852CAD04F2704D4103D4362E965473ADD3563D9B36E5097C982506865454BA30AF132BC17C807309723847257C697C525E27CC570A88A1688134F4193DB67EFF018F54751E578483A77A119210106FD03066C403B3303CE54B39493323C4334D4A7A20AAE04D8EF529A15CB7D0900FBC4236C717310246C9CBA14D6874BEAC61B566593B5EC5887272B914EA655D254D595824288A666F10C7DA583F933052F43B0B0FA59248B0584F193AD548A12A845FDF14A73A0A37ADFB4D1845AFE6B56EA50B00A5503CB542C254A26F456AA3286B0126350272638EF0B4A3ABC56FC8D0AEA2F7396D97B64C56817D58C32103996DB88345D377FB7B2644FC99A24258C50730045B897AC908F7FCCB81BC2B51C286899C8C499C1757C6B0A6AC0A8482159D564CDB746037A1224CA72177F79ED19A398040426664ABFBBB7B7BA99906E7982B665A551881E0F02A97409A3E2ACD37FA96A4F9293F786A11B21E1F0BB22CF400DA06081BF68111A9BB64469487D4CBC10578106B381B8B054EE29339E1830DD613E19A9BAF9A81C2B9AD1D121A47D40234BC9D4B79C2F5F165BAB5A2DB68C59C0737E0E4786990A92476AEA44105F3C77FEEFC342B458E4310B9B110A8B2C01593B512F069944828A3F6A219354BBDBB1C344F24AA0784160CA704BFD89C4933B6123C4434CB9A6CE16D3F042F1FC571DB728119F6A33E4A9F6981193D60BE6AB916818B8E1FF9A1D1A59DE8824F808043A1949A5520B675D8834EF65C1D47AFDE2710C6B63998D43AB47A681F0A856D166C24494081E076D5FC05B541145D3155E232A5AF0AB96ECC0B09C2C41E285D350500A4F8BB32E99B4B05D558EA7918A7881BCF516457AD2C3AB72EF2E04E3A4ACB85A987C285441CBD71C18717E9DE7359B920A9A3BB7F32E619806F4E4718C585085BE6241646460817A0FCE5836BDFE124A7448E7ADF7B8ECC2652AC6D280E986682DF71
-ct = 47F3F5F8E8ADECA6F32B9692FD13D7E042FD9C7612634D5E3886871D5B18006B8BCAD0E4B8E91BF063FECEC9E54D10A2980C24369FF8ABC2753EC4E45BFB30FBE64CF5BD5B53F3101913B558DFEFC745D3C5CC96C1D71607A933E98314C340330BAA8EF4A08916E3A2A98177D4C1FF6C499BE66949A14D44361383E6A6C23A5E2A99856126BA269BF386889B8493CDB375D27AF17ED20B504E74F2A9FE4C00DE019EBEDD147591F8A53266C56A9ACE2DF3DF3CF0182596D78B07A67FDB0745CB0B6457F4467A7C9563947B2BD0B112819AD2471B8019C3AEA82ACB84954717CA91FB62099AEFF49F81226704B8D268177FC77A422CC951F1CB68D25028C94203686F3A43DC95611AE78FB30BDC987992B9BD810C362E29C8F8C4C50B94A4DD640C70BBAF28A2C77643400848B0EE5E4991CEAE312F0EFE2FA0B90205E170F44F8708CA30446F83DD743989575425F5960F30CB8A2A36EA62E9D2FBA6F13E555366191B0EBC79C0F8D0CD0E2F25EA617370675CCE484125C7B6699F3A83B265F43FFB29C72499A9BE90AD58660FC69435EFDEE5C5EA405106C09B00EA849FD9CF7AB0F4B55D12690C1E65C4F5369F32D337E319BFAC00D8D8EE8FC4697A5248C096FA4CCF6D95203D85D9E2AB4EB1F4953B761DFE76DB5D987EB0167A535C43AC756A68E3D08B99E71182F2FA3D13212671393DC33DEBCC3F080F03317128ED38CE785C3ED0772CF86FC7411BDC840AD1C754AD6E871EEB8ED6927EEF33148D31DE4B4B3EF5A7F0885B4E9792677480F518C250172D985981CECA7117B79EE38C99092BBEA8FA1B0036FC35BA1DDC545130BC23DE8EDE4EC7A2908A1C8D3FEBD0C1EB811CDC90B74BE2C0A4AB7F2D75828D0BB7F4DDDA80813D381016795F49045F31C0AEC4FCAE74134F5E799C2528DB055C1CB3C748ACD9DEA26B07A817594B902A76DF4AD66F641C65A609514BDC608103609387DD7BD80937B791EE7D14928EC937C6438D62E7C05EFC089D3FF646E8C04A03BF00094E3B04DEE0B81EFA2660392F03DF2CA7DA4231EBEC0CEA1C57599FF84617E3458D40A762BCA1DD3C777BC790B7C366980B8D2FB4183FB71B7472E448878D7F50BE104657302EA90FF27AF7CE9AEA771D7201C8AB3EE0754F77452E8056D96D4CDDCB69C1458A5117713DF0FB210E98B8270F378BA4C551CB469B10014422CF48009AA936A5E0E63847235214AC5D62FF0C4628793D7C4B9659967450ED3E1365F946A7A0445590D260FA87CFEAB8DE4F2BE784738DD534D0C6EEA04691C21396A406FFB15006D4E5A19C137D0776B63FC37AFE8618D4E10208823DABFFF3C80BDD953B758B89E81108AC146D05547C2E3139ECF4E2F3FE41125AB7D5BE50CDB427D46C2768EAD3940D3F4CB701EB41DDE06A191629A3E94082F203B2736F6DF03E206D2937860235B6E4DD1F8AAA4BD95586CFE18BF5FE4522D5F85E77C0FCB472ADAB84DF092C4CEA53D14E0FE7703F3FF8787827555697CEA6A8011E4E525B8BAF1ABB6E216DC617
-ss = C93350D1F27F771801B7C3E03A2E7672146809D37F33BA262E9E0CE7809B2187
-
-count = 36
-generateEntropy = 056661b38038da4fdd7426f32a81576c73ed84843b305168a374f934e27a4e1b79238a80dcfd7c992d84b2dffa67493e669243d4fa38c46b090bdf86bc548411
-encapEntropyPreHash = 38c89bbe7145c29e9a831c11431eb9929cb24fb4992db20737e4687d397fd732
-pk = BE390596BAB505E51B3FC147AF616E0F94506635A758964B3E7CC067B80827DB21DC87450FE1415EE41FCA8A2B56B355FFF13616622FD1A19A7CD98F5084610D1AC9F1B8A6E78CAD9281A0AFA5A7C2A9A87916710EC9C5B3544B76B4808D01399F219B745962536026C79841F11961B63C10C99074EDBCB4ED786F7E8C3826609533E5BB4CB80F3E515299EB757C217DA2806D26664F154C0CC2B4A644B224933502ADF5A66F5B54CD45A71589219AAC65BE0623CF5B4C0DF17E72CAB64B91BFBD903D75E164E2A0C9E2C997F36A0B432177DE617F5E6746BD82984BB9375B4A0A12E96D06045A3A984667D03D8C08CD980B59CB2B0983B13F9C53790FD43653E78255882F9B0C980EF6B062789332A6B67B2B78E9E370B78181531846B9980A8AF905FEF403F47B891A6B440EE71CC5D6BF3BA5C7B087A31123AB61EC9F2D0C89E1EAA7DAC36613A15F147938D32673402164B001975D9C4A8BA5CE84D20B47F26EBA5909183C6FE1343D062389B9B99CEDD21E30D5841FB68F3450A47F4C4BE5E8C413C37EA4D5AD629141D7430938158CD04492BBA8AEDF7477ED13A0B97C8217A300DFCB22DE05449547626D21409F491098162D7AB477E3EBAF0E15124F449F08E47D8EC6847A0AC839BC5D237B3D509A8B5C44C8FB6705A467A3D4D9102FF2B6ED976CA9D856E9F257D5D586C7D8A4C2617DCA73AAA65719A21538D9E6997C5637DF8C5A2AB98A169A5BA8F708BBA55F2C0A9463C9B4EF0C9822FA64ECC72C8BDA4030157BDE5073FAE6A6E6F036121125DFC5A9DCA1504A1225E6DA9DB4D0665F6413386153AE25BE78B3410369BBDBD84A86C6C7BC924DD70005BEC0C54E07B4ADFA2DAEB8265DD98BCB8968A2F683A3B07633AAA0290550665C01FDEB22398ABA31140FA7494FD6A0087194673F51AC7D759D649A2FA4D7520FC67138F445287B681F5C3D1678B497129BC6624163E3515C8381E85C173D6A4CC0038DFC2064A213C557931E2E7138FA1A6BC3EABA08965BD803BD5759332CB1BBC4C41337BCCCA153905990970C261CF63A53204B6F8CB228D4234F08837425A82F1DA9BE43775DF88A20A0381F70044C76B3524B437CF365CB131BAA14EA6F24502336762C8E126AFD009E1997B8B3BC20C246070DF7B33BC9A7BDFA8CCD576925968915F186CA4A5A4934528DC75282E246B0824EF7118D39DC1F07449A218836D47CBB7365B677EC7D6222ABAF33068B5730D9E674CC008125226CBC5382A76A9823DB1B42976C5C90C23BC02EB7B874DFF93699E6035A838B22A7126AA42D62682505F9BBC77143DCA061F5C38E99652FC2E28E30CA8D62127AF02186BD9C95602992E20BAA636AB050AB870B11C52DA19B3A68B7A07A8CFBE7BB016A2537E50464265FF6F065D7A8C30F659998A35D79032F887B4629D07BB2DC895F09AC0387CCA9C5CD1AEBC08A687798721F24CA43C2C5AD42D1B6641838EFC2A72EF210BAD10218846F25DA336A4C00C4A29EAC8A608F2261B8C76B18F10B7ABA755771376DC7B876152F9FBA5370262919511D4AD50D76AA5CD6566C29225DABB3B668608D9DE5BAC08320CFC3570A0AC8DEB4BBF3D941F9325AAF546FC368AF005CAAB7AC6A7DD70D90506DDBB5F53A83079ABA0927BD52A68E278D3F01AC19EBA6BD
-sk = F75196A57024BE817EDC544DBD552F6B42BA121C2B8EA95E55017856A10C5905A8BB2590E63B449364802C6B438FC19EEFC875017ACF652A8F0D6AB0F7F5ACA1F1833ED3551D37419D906D2B55123EC14D5F109ABCD9382E990628BB30D882CCA8665957346C3A08553C870D32F77E66348CA9DC321960B7D50B09DE64178411439C021899F2B8C583762043A4508C3160544ED2264735C600A6AB43C8515532130583298A11450AE3B7C99FF559A1D33115DC2D2489934518BD52FBA1CB9A019D918464B59CC90941599253957364DCCA9F95A08035F8BE5BD36DB6B19F1F191A6E4B7FCD493B7A41C90BC76FE882AA0F3B39B6F454785C5DD1D106C80960BBE5846D90BCDE837CD277A039DC22427B86A6658F97A60101665F3F69125445647F3BB2D3125C80D89AAE6096A01C24902321933909A8A2925FAA1E7407B3C90C8A53D958C1C83465E557AB620E53509EE8C960B3C547FEA08D4FFA215742113ED9661B57AE1B30BA5768645C632DE76B96161A9B6C34B8DA48B75D176C2C849AAD55C6680BD0863273C345C4C7379CF3F873FA5953F53B9A026A4DC120C96E279085566C7D090EBA276A0928693E639B5564A59C08AEAFD25915F5478DD86E938A11529BB9A2B0B83487C696E79F1FD034EF000FA502328184BE42B8959D9C0683F3BC20E71902423AB14A4744E162F6A2B474DBC4A6F21FC0432CA7422CFB253D0F952BE9C13125458DF8753F5D551CAA38BCCA1625B533051C5226C8768335854E7477064320CB765AB9EB311A1859B4B5A006D918BD8508A971205E6902897CF95E0B652E09030794B46FCF7A784560C0A18B8E6334A57EC177BA56A8BB9A857013C6B9998975379BB04B540015A14A76C658F856BECCA363CB37997BB85B185AA0104063696F1020BD1B443419989798826E141A24A3533494391FA233CF848451CBD609D014508FE137534C42D6F22ED2CB82363C847865AA243CA993B14992572CBF5535845CC708BB09A1E8A7834C200D8036768755AFAB53ABA85813EB859EE83EFEA7563EE4BC158599F0CB04033393C829AEDBDA289ED852E1EB1FEDA9484777051F967E048041BA3C313A1414D463CF3EC36801AAA1AA540DEAB122AB530ECACA30101A1089087311972B338B045A1637189020C3030E63F707FEEA9AF844C7E1B20B4A5348C1A432F341BB9F598B8C0C2F6F55C4D2C2C22B187430748F82842DABA92283DBC4BD20636B6754B20A7127F01FCFD4013A1155E4746DBF3CA1F34991FE7C39ED99BDF5760D39DB8E6C428F2DE8157BE0139415AEA96BCF6FAB633F2257B582312D3C7ACAF6A5F8E55AD699672160CA01246545059E58502E28199CD0F5505ADCB91900A283F0B059F33D1A8B352010A3C815717FB3A9482C946DF0C74A526353D5C9ECD2590C5050996393A02286841580AB599BFBC8838A53301BB11D5FD492AF40BA26224505969D88F6B193EA42B0348954180E17124EC2C64B962A92AA9C3FE2D72F94301531C4AAF847243702BC8F9C37D64B54F20AC003B844C52417E1436D2E75AC09C313C83B8575E791A7C95D0412CC61521A6826997561485DEC26AD7BAA8E065E9A279ADD7301C5C74C5B95C1B6915EBE390596BAB505E51B3FC147AF616E0F94506635A758964B3E7CC067B80827DB21DC87450FE1415EE41FCA8A2B56B355FFF13616622FD1A19A7CD98F5084610D1AC9F1B8A6E78CAD9281A0AFA5A7C2A9A87916710EC9C5B3544B76B4808D01399F219B745962536026C79841F11961B63C10C99074EDBCB4ED786F7E8C3826609533E5BB4CB80F3E515299EB757C217DA2806D26664F154C0CC2B4A644B224933502ADF5A66F5B54CD45A71589219AAC65BE0623CF5B4C0DF17E72CAB64B91BFBD903D75E164E2A0C9E2C997F36A0B432177DE617F5E6746BD82984BB9375B4A0A12E96D06045A3A984667D03D8C08CD980B59CB2B0983B13F9C53790FD43653E78255882F9B0C980EF6B062789332A6B67B2B78E9E370B78181531846B9980A8AF905FEF403F47B891A6B440EE71CC5D6BF3BA5C7B087A31123AB61EC9F2D0C89E1EAA7DAC36613A15F147938D32673402164B001975D9C4A8BA5CE84D20B47F26EBA5909183C6FE1343D062389B9B99CEDD21E30D5841FB68F3450A47F4C4BE5E8C413C37EA4D5AD629141D7430938158CD04492BBA8AEDF7477ED13A0B97C8217A300DFCB22DE05449547626D21409F491098162D7AB477E3EBAF0E15124F449F08E47D8EC6847A0AC839BC5D237B3D509A8B5C44C8FB6705A467A3D4D9102FF2B6ED976CA9D856E9F257D5D586C7D8A4C2617DCA73AAA65719A21538D9E6997C5637DF8C5A2AB98A169A5BA8F708BBA55F2C0A9463C9B4EF0C9822FA64ECC72C8BDA4030157BDE5073FAE6A6E6F036121125DFC5A9DCA1504A1225E6DA9DB4D0665F6413386153AE25BE78B3410369BBDBD84A86C6C7BC924DD70005BEC0C54E07B4ADFA2DAEB8265DD98BCB8968A2F683A3B07633AAA0290550665C01FDEB22398ABA31140FA7494FD6A0087194673F51AC7D759D649A2FA4D7520FC67138F445287B681F5C3D1678B497129BC6624163E3515C8381E85C173D6A4CC0038DFC2064A213C557931E2E7138FA1A6BC3EABA08965BD803BD5759332CB1BBC4C41337BCCCA153905990970C261CF63A53204B6F8CB228D4234F08837425A82F1DA9BE43775DF88A20A0381F70044C76B3524B437CF365CB131BAA14EA6F24502336762C8E126AFD009E1997B8B3BC20C246070DF7B33BC9A7BDFA8CCD576925968915F186CA4A5A4934528DC75282E246B0824EF7118D39DC1F07449A218836D47CBB7365B677EC7D6222ABAF33068B5730D9E674CC008125226CBC5382A76A9823DB1B42976C5C90C23BC02EB7B874DFF93699E6035A838B22A7126AA42D62682505F9BBC77143DCA061F5C38E99652FC2E28E30CA8D62127AF02186BD9C95602992E20BAA636AB050AB870B11C52DA19B3A68B7A07A8CFBE7BB016A2537E50464265FF6F065D7A8C30F659998A35D79032F887B4629D07BB2DC895F09AC0387CCA9C5CD1AEBC08A687798721F24CA43C2C5AD42D1B6641838EFC2A72EF210BAD10218846F25DA336A4C00C4A29EAC8A608F2261B8C76B18F10B7ABA755771376DC7B876152F9FBA5370262919511D4AD50D76AA5CD6566C29225DABB3B668608D9DE5BAC08320CFC3570A0AC8DEB4BBF3D941F9325AAF546FC368AF005CAAB7AC6A7DD70D90506DDBB5F53A83079ABA0927BD52A68E278D3F01AC19EBA6BD065FB6156ACAAC591F1BF3CE71C4A046BE8C6C55EB9A84D29569BD2B144C73E279238A80DCFD7C992D84B2DFFA67493E669243D4FA38C46B090BDF86BC548411
-ct = 8E4B06F53205ECA407728FC67D6329388825377114DA064425E780EE4F23C8CC01EB544DC02C70950C6F2193FBB7959E5459325514D1E76FEC98ADFDA3CD84A8FF0AB0AAC32A0E6C0D184D6B6AE5B020F3BCFA7612A8A8469E3B97CFDA17BFA20080B493451DBC852E9B59055381C382C12B1D8CE94AF1207408F2909E2BFF4C38F7D244182441DEF635C7B46721161597105271DEFFB3EB435F596D88D3B60BF26EEC93DAC19BB52DC05605668D9789EED2CC785112ED45B098D7CB1E26FEB3582FD505D933AF94265B100C998A7850F3A58937E6B3EC8FA19F229021C5441B93FE82B7D20B23EFACB18DB8208A141844386DAA9CE61BE318B0B410AD2C3FEE8B448C649908E282F9D172E62A507F26D1ABE910D98EDAEA3E8429CE1144522BFB938BF0509EF0454DCC4DB999AEB0F9AD283A3FDB5EC6BEC935182FAEE081F8DC6D42CF9DEF8296F2C30A691A2ED84E759A8EE4F3AC8BC3498AD3F7B96C9140647E81339107F1614E0DA2B0F53E0309F19E5FE6584C37F2931BB1BCF93B9FFBEB1A10B0835B27AB81672B2C2E65FE7D1B7F2C75B4247A8FD03F5BB18B0B45693495C5DFA4DC3C50FBCA60347AA9463333AD7CF27743FEE4E0C50D439834192E4F62CB29B3BF7C0CF222403149796916D4067F82BD26F00ACEDFF40458FA66DCBEA64A0C1F885812F505B120292487294D531C077C376D90489B70D51984E35B687C5DA6A153564A31515CFB9E484EE16F2B0EE8910AEFC2CF34E9328BA1DA84F5FA671C4E043BBBC19C032E7A871A74A9BD5F2F3A9722465861E19646E6ADCEEE098FD3356B6A7E356DA59052C2DDA1462CC1711C9B3162243E47E3BF45930D6F3313994FB1CDA44C60C0871AA424C9796AF27505D0B743D7AA1E2D5EA502301116FB607DAF2039FD6DDB1A5FE4D5A6D53A32E7AADC7C7AE0E8EE23F8F55A8643EAAC5A8FA38C1C631DC65F0EC02D3226A85092847AACB7C03A412BF89FB046606CB3B0C2AF16712286FE4EDAE49FC7A0526B2BE181C0074E62E2021A1F80651EC53A24E5B48F5FD20058EEAD3706E40FD8D9F9FE81212550425F2FBC3D2049035B267617696DE3EE56A11B4F6B7D9BC0EE61D570799F7BDA55065BDA83A15A252B1F587628F9D082D9F969A776DED5EAE9364BD9628C1FBD70CD288E515614ADF9DB015387AC8CF37DDB74C05080D993786642243B04F9DC44DEE0EC2C396478F8A6BDF08A0174DE3086A39FB0E555E159E862C997CEFBF359395D4D1EF80002EAB509144A619DE33307411919A90E35168AE2953054E0D2CB5805653BD6A9DE76CDEA4078B46BF6BB631CFAAFF55186F612F4A04B2A9884C9D15D5CE6964DDB3671F63059A5D38DD5E75DB1606057A9FA272263AA2CFD17D7D09989CDA1DCA94B94B1FDC691E6E51D7AE2DFBBAA8D82CDA242A98A78E84F4E3B5D8D9FE10D2503E25B9B3C6E0D9206310B7698EA3435B3A6AADAC0795B5302A653AEF8ABE079E412A2B2182883F4B80B76EA49402D966ADD85D72F1DEC212AA890D4CB7091
-ss = 387E023A733BBA407F35D4456A9EDEC3922B151C3B49C67BF3541BBEE5BDA18B
-
-count = 37
-generateEntropy = a1b52d871612a1c611ae0944f9e71858f35d3bd14f20e96a931720668bdf0a6b1f135cf64b6403e103afae34da038613e2853bbfc36baafa3c6a95347193f37c
-encapEntropyPreHash = b2c35e33c72d90182791f0e12a0324f5b216efcab2c8da1bee025dfbe13f4152
-pk = 99315A88D083BF5196F65CCA4541BD4CE3526E514DCCAA8ED176BA58014BD0AC486056240CE06C6C182040606DD98978D6CBA367EB0EC18401ED348743780DDBD277F2BA22E1B34208F215F8F91A048CA497EC37A7663587AC85F221810E64ACF87478A101062535287250907D0854B93A9D4BB39CD5788BE361C00FAA87BBE078B26353A51B7BDBA58D17E5496EFB263DF826A59296A13535ABD799CB931FA5886E35476DFFF97E82870653D5C4BA09C2658A9A22838BA0C6AAA4AB7B19699B8B27243C42634045506762AB1817534F419591B04622C650B828B3D4A66D9B163D09847BD172BA8FF452759184C07B11183665C0185E0A089C957135DCE64BDA52338B6492A27A1238AA567F017DFFA796DE84532FD5BEC8FA800FF4C5E34791CC5AA02901B73885557CBA188F72AB5A35B489E98AB377691033934029118A34AF7D176A436139AAB3AC127A8F510C8719936E8676CAAC2211C8292A42F274C7FA85C542B21422C5790079F34A26F0678C005818BF4981A2B4C7DB780C0BD43AD55C0ACDF1AE0E0761D7527813076F3174A1D49C74659A453E09C2B4468DE6F185D5F3C04F2B7E59E05317586E743285E6817283CA11FAAB44271A4667912DF262C0C03843730ACC24E80E2EE0251CCA86A83853E6251E3036714576B1C171A112E7A15CA215F63039AAA7632EC77880B89EF8A45CB0B3746202ACE1D7221FC98AFB73A28A6AC2AE443F16E6072D6B3DA1A3BE5FAC533A9175A5F176FE131F021795F8880D320C6096AB63F53525D01B32A2CA90E1A9138E4CA72502785976BEE4E566DC0CC1F3827733B0A7D00CB58B6B89C5E26D2DA00429A2450E269DA77C46B5C954CEE6BDC0339BA357A9B9951802A255B74A4F4CA1297D124056147A0F8123EB903071546D2C22723367308601A22F199F9588734FE1241450A45FD7395DF965F46574A030581CC714A50C08DA03A51B367B524A2EE4E56752DB9B66D9C6B07702EC23BCEF798D68300859383C5BACA9D8F08B71409AE5552209B5237E697BA55328A1693AF7FA0BA27020DE2C35F643514DB292C061C8E2085D06C101644C94D17C07560811C093AFE61C6B4FFB970382CE9FD25F76C6728108842B3841DBBAC62504185EDC32DFB817C45878189A7AC02859ECA77AB445797E030E910243B121A859A05D8CAA3C32FA54D033714D20A771C7CCA73999F6D91D4DB4683A9543D3C978F1D56816D75590642CD4AA7D9E9C709C6CB5AEA8832D7C84C576AFBC837B6615B8290078E2C0AC9A8CCFA8338B36649B9F7C41D0064DCA53B8FA1793CBDC8F7B75306F19C4127A214E5532884274646B91F49A1E36A3B42CFB90B27425D2645C5ACC2482289D0B4B84A6359007F23B9F528718E6C499590D6BB2A5BB674E89561AB1A48E3988927AC41D05BA143799214701B2F6D708D365BE84BAA60DF8BF7D969A425C93452A0277F218790C80C60B4B59FC6131E7865D1135AC84A6655507C1D98F6665C932093D61FA578E7ACBFDF49F2E15C138BAB4152C005ECC44FEC299094A285FF50B09388B6AC3972911CFB8ECC9F0EA58761741ED23CE16FC02AF5A341F65043F0802C0353D987C718FB72D3D922CDC861BB6A8AE003197C8F9C878A367C021DB7E9273FE2E03A2716683DAB6CAED5C770F6E7984
-sk = F8FB5BA9D24C8681558CD13593F0CEBB335B6F65BD5DDA6DE6D19E09F15165051F981AC6472B263CEC43883A79149707093066FC129AE148B04F860C2DF119F8A51056EAA5DFD89BFC564226E56DC391ADE1CC2A1DF58EDD4572C5A147BBE21283B97F1B213BC276A471B63A7DF1CDC86C7A69A34ED17A425B37AEF969C1CD079529BA29A2E2C3412C5615E23523F3124C00C778752BB9B3677B90885CC21B0E257BB7F335FD53928B737D19DA3B3208219E6C898E96B45F801135A09A1425A0986C597E2B4042C1A4E6D7A4D0E30E729C73F2BBBE85B579C3C13A34344A7403B95D425936486C3B602804C08EF6F5AB22C400B9523EA3345ABFE666023BCE6A1B63A872C33E3AAF0CCAC2C40A4D5A48107D0C7AB09001EA67CA6F4C1FA7137D259C860D032C396BCBCB4177F82439852463B640855CE604F91C8F2E4A0899B2102C6059DC077D5EE6054355C546C2148077B8DEFBC313C71F1A420DACE126B16C21E40064E2522F9E224CC8E3526B1A99A2F4A81EFC2DD3609043246D461C7C1AF025B56A9C7E72ADEA57584CF044C2F0BB60352C32400D1631C034572EE46B71EDBC0334031AED7BC26AF543028C3918109DA52A6ABF3217A2219C0607BA9EDAB5B4DAAD5EC7948393C4A670C340688541AA713B596843E5CCB9616B54E92610539BFD39159FAB36D4928EE9CC8B1291AC0134257E242FAEB595100AC113AC416FF517866021B550B6D063512DC37477117D025964C95C13535C2F09A96740037FE1846EFEC4446EC03F93FA6B6FD8B539F0196444A61823B08CB74B7520618C08324F0667F142BEB3A34C2C5286B3D159FCE3B046079F07E558BA28A8893A8C94F9711C227FAC6900114C8BB6AA5369B059DBBCA008482A1843B62A1B06C68C6B2F40BAC6F02B6CAC1633055A178A396EF35F59F1A76543953D3B07E2B8BE217C5D5B1A82F9C080F4119D22275958026280BB8C96626C1D0BAEA6658A29546E09418AAF85A121F8647CB4789484BEE0189B9AB10852C397A2E25B9B15B71EF17440DC3554DB740289BA05111979614AEDCCA79699021F4BC3A4C68B39D0256D88CDD7A24E3AC31DAC35388720671A12A765D705F8429D0891C3E0D8062AD45A0B882BC53016DFB007D1C550998963D7E12FA51C7361D86156EA3A8AD7018C627A9EA18F9D3787AB3B88A27B3F9443AA87AB75EB1364A4C66C50E8170892A08FD15CF2913749D0C61305C4DE45A1BA2550009726A0873C70049705009DC8327BE3610F61F9BC60A26D14DC0C3E67CDAE4B5AC0D5A0638804D6C6B4CEB351F0C19F0974324CFA28FAB704B4677AA3F2BF65686C22100B74CB9AB5F7215452CBE8D6909754304573A9314B3C8362CFC34C6302B3CBD5DC482E76576FC5900B367016C03A860A88744928CAE55413231CA8A5008D210CD2E317D1BB6BC8624ECB83002E66092D8AA77FA0C6766532178A8CFB532C70F1114E5156E91486C3C7658E2A22CF0A77873C944A5A4BD70BA1686146E18B328D30813C9850C3003698C5AFA2082B3425C785200596592FBFD7B2AD5568F9D278FA24C523251BFC966A69CA882E707426563D2E099295305FE2E2A96F968A92E9423DC4A1F6662F68299899315A88D083BF5196F65CCA4541BD4CE3526E514DCCAA8ED176BA58014BD0AC486056240CE06C6C182040606DD98978D6CBA367EB0EC18401ED348743780DDBD277F2BA22E1B34208F215F8F91A048CA497EC37A7663587AC85F221810E64ACF87478A101062535287250907D0854B93A9D4BB39CD5788BE361C00FAA87BBE078B26353A51B7BDBA58D17E5496EFB263DF826A59296A13535ABD799CB931FA5886E35476DFFF97E82870653D5C4BA09C2658A9A22838BA0C6AAA4AB7B19699B8B27243C42634045506762AB1817534F419591B04622C650B828B3D4A66D9B163D09847BD172BA8FF452759184C07B11183665C0185E0A089C957135DCE64BDA52338B6492A27A1238AA567F017DFFA796DE84532FD5BEC8FA800FF4C5E34791CC5AA02901B73885557CBA188F72AB5A35B489E98AB377691033934029118A34AF7D176A436139AAB3AC127A8F510C8719936E8676CAAC2211C8292A42F274C7FA85C542B21422C5790079F34A26F0678C005818BF4981A2B4C7DB780C0BD43AD55C0ACDF1AE0E0761D7527813076F3174A1D49C74659A453E09C2B4468DE6F185D5F3C04F2B7E59E05317586E743285E6817283CA11FAAB44271A4667912DF262C0C03843730ACC24E80E2EE0251CCA86A83853E6251E3036714576B1C171A112E7A15CA215F63039AAA7632EC77880B89EF8A45CB0B3746202ACE1D7221FC98AFB73A28A6AC2AE443F16E6072D6B3DA1A3BE5FAC533A9175A5F176FE131F021795F8880D320C6096AB63F53525D01B32A2CA90E1A9138E4CA72502785976BEE4E566DC0CC1F3827733B0A7D00CB58B6B89C5E26D2DA00429A2450E269DA77C46B5C954CEE6BDC0339BA357A9B9951802A255B74A4F4CA1297D124056147A0F8123EB903071546D2C22723367308601A22F199F9588734FE1241450A45FD7395DF965F46574A030581CC714A50C08DA03A51B367B524A2EE4E56752DB9B66D9C6B07702EC23BCEF798D68300859383C5BACA9D8F08B71409AE5552209B5237E697BA55328A1693AF7FA0BA27020DE2C35F643514DB292C061C8E2085D06C101644C94D17C07560811C093AFE61C6B4FFB970382CE9FD25F76C6728108842B3841DBBAC62504185EDC32DFB817C45878189A7AC02859ECA77AB445797E030E910243B121A859A05D8CAA3C32FA54D033714D20A771C7CCA73999F6D91D4DB4683A9543D3C978F1D56816D75590642CD4AA7D9E9C709C6CB5AEA8832D7C84C576AFBC837B6615B8290078E2C0AC9A8CCFA8338B36649B9F7C41D0064DCA53B8FA1793CBDC8F7B75306F19C4127A214E5532884274646B91F49A1E36A3B42CFB90B27425D2645C5ACC2482289D0B4B84A6359007F23B9F528718E6C499590D6BB2A5BB674E89561AB1A48E3988927AC41D05BA143799214701B2F6D708D365BE84BAA60DF8BF7D969A425C93452A0277F218790C80C60B4B59FC6131E7865D1135AC84A6655507C1D98F6665C932093D61FA578E7ACBFDF49F2E15C138BAB4152C005ECC44FEC299094A285FF50B09388B6AC3972911CFB8ECC9F0EA58761741ED23CE16FC02AF5A341F65043F0802C0353D987C718FB72D3D922CDC861BB6A8AE003197C8F9C878A367C021DB7E9273FE2E03A2716683DAB6CAED5C770F6E7984CED77D358342759291C2BD225B0BD82D659D28A24BBC5EDA8F47975B780CD1291F135CF64B6403E103AFAE34DA038613E2853BBFC36BAAFA3C6A95347193F37C
-ct = D3327E35289A936A09CDD9B5FA00BFD73B28FFCB330E1CB018EC9970FEB3CA6EC7FBA6F9F8EAECDDD84B38C52BB98519E52FD7F7B91249C091C7543C142F0898D489F811BCC6F6A8ECC355C1957FE73E8ADFAADEF10495AE5DAE171DEA5965C3F303D9B731A5579089B1C99EDB32BB02BEC73304CC2F3677571FDA0BE46A90D36CB6A2F3DCEBFD7041ACB2EE2110676ECCEEEBDF2EA834765D9984BB335AE06CAAD76DFCD95D385E91C63D18702989B8C739F59B129BBF421FBA018E04B96F5FF08E7C05498681E129A1D84C378DABBE83E9B7EEA55AE4BDD1FE7B5544F6328E82899777E2CF76A4B23B6DF71F76A8F0475B4A587D8A0B8D12FF0B76CB59BAA831F6F7901887FDE2CF58B0661016FAF6BA44CADA98AB984A7BCBE8448C86B1E7E1E21873B034E0ABBC0A9C77BEDD69FA62278C41A08C83AD8B3E3EFC601595860E6ED1A1E4EA6382CB92009CC15CEFE8095604250593032F1E4F4564FAA616191ECFD79F8DAE40E7831C7B23DB7789D9D3270ADA144CBA1938D6FDCB1EDB624D8DDE05CF82E13F422C05883B6EFD9E0EBE538E3D7D6348B205DB5D282AF9D77AAFA42152EE11F58E2773E2666CFB3582C24F86EB8B20353231F5C2A5E91FBE2E40351D48DF2C7207FF2E77AD345DF3A79371E8D5A0708967A979C9114A887D52AF199EC2445CD21478876D097A0CC4212136AA12099FC59D6E2296C4FAEC109516C8464889DE22CBA68DD230BAA33A544C8A01EE58CA60D3199E90B9E2E262C68FABB8E255CFF75DD4280AB779DED376751473DE107CD1499C85D2B5876A4E0284406140692B4F1620BC945F737557EF3ECC54CDF0833D7A7E5085FEDA3275C991B533DFB25603826C88DFB0EBA60A709D3AA4AA69B5C04D455257F9053CD2769161281D6B5C60EF7EF10D10A1D7BA229B667AA9FA7BECA9729EDB18A166D991B57B15B1139F63B25BDB1BEFF61B38ECEC8DCBDBC984CC164D92E6A418F625B59EE736B66C154F9ACDC5B30FC3105E87CB2FF8ACC4A85AAFB2042C0F34C1D04CEE54387251D89AAB11A12953BE99960A5FC9AC1D384FEE498FF315531F50A7D6D4EB58814E224569ADE954316EDA1C2EEA60A39A97361547F82D7971BF27D5EE092BA1ED514552361AE54616D1007C7688FBEAC04AD4E3B9DA9B96ABD4D3A5284E008779297A01234D8C2A51727D9C8CE9715882A948A3B93B87EFA6C9821D439ACCBE562D00EA6298B304795606DEC5AFF0590E55516C9A8BE95E5F2D9B5AB426B294D75A0F689F8CE080CF01080FA1F1712EC169508BB7C49BD8D3F65FB12028437C524C5BDB1A72062D7D4928595B55E86787469B81D4BEB8A0061150A7465D36EC838249AD80D55E6F7B5EB92C62D381093965BDFD3810050A43E7539D556FB4C835C5E4AC6156BCC5E97CA5F85617448822EB529FF1F794C8FDA9E5D222C1BE8A3B68AF5FAC61CDA9996EA1E6B4394E9F7BD74A70C7A766CDEAD893673F7C2B54D077BCBAFF31539CB9836792149C563E52B1D08EF2748515781237C8A6
-ss = 4D91655D2BD77339BB81F82916A1A77329071B3919CFB35CC1D1655C2DA5A2F7
-
-count = 38
-generateEntropy = 952b49c803d6d6fba69f4375adce8594847a00bcae2179da49af2aed0423250262d7033947ae42ca53522a65fbafe18d3bc3e0cb66164e9a094fe4b44d8977ed
-encapEntropyPreHash = afb7d6dc2b7eb6d84acc080c1be63c98afe7b07786b5801f716444a3e8e64800
-pk = 2E7240107059C16C3EACF4A1A8342B73911DB6A51D3CF12BB168229A1B29F7C334D0D1AD99932F21BABFD8153BAE937FDD2393D9748518F12689CA7627A1041D868094AA7440C6724B4430EBD20776B602940C9D1FCB5A109978573434DA891962B645002508E46992C0C148F5A039609826BAF5834BA7271C443B69DC5110C4B7089068D16202CBAB2E1E4525738A19C8315FAE806FD139BE91F4C1E192A2C04983291340DAD4018A8A83C27A57C622408F933A51B7618148B16375A80E0A901F10AAF6E7803CB2A693ABCD4CA8BAFB942086F42F6B743937098E3D2A607F212F766603C9D89ACCF7AC584491F230BB1108B1465B865F824215D79FED2525D7E95C7976946E22A9E6510AFA2A9E8AF29DDB65C47BE8820561661050B70EF3B7BB249B7FD0CEDD688C37D7A3DE667626C2B389B38BE066089405703BD51FA32199E9C83D5265BD62A2AA2CE521B69973A18777E32151D3D5BA1983C8659A79AC978FFA15CEAB733B49EA8F7A853D4B06CAFDFC64C9D00E55D814536171496037036A078D026164D7B07E3277B7ECAA770B06DD291B9AD29241C3BB43553BCCF66A1DD81FE2E2BF79F1A21E1539D0BC517A9BA8EDE2C39DEAC4CDB7C65FF96048461BA2E350017095A35C1BFA25C242B000AFFC8AF29495A2D349133C343D680EEA815CDCD89C4FC283CD5136B89ABD473B4AEFE2228F4CBA5E0C10EC7A1083833735F081034AA7BBF20C11319CA263B52262096E505C45805E73619E2CEB242E559883D20DDDD4120F0C9E49F4995376284147CC2D2A96A046BDB3F56B6DC1889976AE1ED732EBA43AF5941831B2202D6091C16B680001A82D98CCCCEC212B79B5A884756C75CB2545316FC072D903C670864D5A13534E545D836276EE594D3A7841E5F91D6B738D97E73A7274671D6470CD2719B0515FDD67C6E4969AD213254502C5AC9BA23C264A375237369B46D0C45745041A20511459D3321EE9B395978F2C575EBE1C6CAED03AFC7027BC457E03F527B0CCBAEC71850E0955F0A2B54D9BCE69B6C8FBF90850168ADAC411AD5C973B578424C55CE01B3EC2825B0085232469968B8A96FE7B9F26846F789323A15AAE6397242A712CD26B0465BC038A4AA30DAC42C0036C062C21C3A4178A0C92B8992CBD54A6044B789D943F1EABB0BB24C3D0D4C067251779374579B27C84FB435E6C745334485FBA84676750A27C520F79366D008E4BE93FE8A958E8D06B8EC323BFD5BD01E86B1F13302EB17AA3AA8FDB3445AE5775111B2124E2A35021C04945661B2C510A29264AD855836C7D8EABC069011F8814934BB4B32176C0B59B04C5FB6CDBC8BC41B0BCFEF4423635C0C7AC43E4D5286C74920EF37C951266B92074D239B2BD0A0D6C096141FB6A718A213A3387D75B927CE176169738ABE0CFA6B68D3B064157C3CB03C5793A7400C1960351B059E43A7F1B28AE5073780CC606F7E40AEB458DBE95A31C23AF7E760001B0BD601647AD1805C4329E46F490575CA928FA908B5A30FD31520C61C9F1CC5EF18578B350A929164DE33B008338180CE41C45327152090A91B8C9B3928C2629A48D78ABD1992720E841A52CA91A15A1C7953D18B4BA1F990AF34CA408BA2D449F94385651C3B4C0503726CAFA118167110E848FBED995526B458D362061A1
-sk = 5B47B61CE23572623C431A498E378C6B71A5CDCCB58E225310217F6F2B1B7140B97349B965D9C95332A66D7A9879F24C479851A0EA485254755DB347BFF9A06D00502AE3A910C06771AACC0A51ADD07A291496AC10E2899B6562DCDA7B6B9B7EB516335D222C43498859D87A44CB8AD589A06E609FC5798CA06744051533D5C6154608C790A8ABD776CBD2984B57E1CF4E0638C77915DD89249D3C0775B45CC159B44BD32F49A51A1E398763E35DBF5C6CCB100929C9B91047A1AB98A140E00F77F5076310C33179A8C80449591C4156C244EB8C8B3009328139C18F8C59E1961A2B91C840D552C2E4B3897265B16C28DE6ABB72D218EF713A1D179CEA38561663C9BF21B68166AAA45748316877A9A5BED6F5230D3015193AA5A9E1B34DC6576B57692B543FFF321B14879A24728DE3D6A297C06AC6CB28EC3482DA708ABAB28FA815272624AF6E26A879F65C6432812470C52DE01EDCE20681DB43A967069DC9BB34F9C540A21B8D7322A3675FEE059F5F655CFC480BA31255E899C48A7C25588303D67055434702ECCA24D31A9D69796DF408328912ADA084AB122C6AC53C3C349C105270C9AEAC73923614EA9129CE4C9FD8D78BD33045D8557AD3D0A698B34A7C073B93783670662F8558375647747905402A6AABD1698D1D3B430CE8B5EE8665771A34CA73B2DEE04497C997C9E74044230690354B7AF23BD94AA02CF599554391095C0D53F5C1DB19AC33189B2B9AA3C48BC4E09BCDC5029BD3B45A370C59045ABCBFB257DDF30085DA053056C17DD0B5DDC6494524875AC189E6C7A7CD483288F03ABC155BC2022EB427B7D5093F4616C124B7C29A0043181C7BDED83DE7592511E3617A75652D4568D7C7B3AB2B7464C514CE6CCF54FA8D73E61834E534966620DC59196AB44B736151A27C02E065A000611542FC296A69A24989331EF980F708142D7274EA863669A52039B59D48B90BCC75CE4B434F5751CEF621CF3A29873C003A57276128E70BB4AA5DE581834946741A8134890491D37B6051959739FA8EB81C6947141704683124136C1C382760E13F00C59AB5BCBCEF98B973831B91BA87FEC02216619F012859FAA6B01B1649786B626348182398226CF794095681D1C25800B18BF33CC71123898AD2AEE46905A8118916BA8651328A051697F8041667789C874394E96A0EFCDA8998D420684217952496AE9117C6C618513C147148979F5C8BFEF8C7CA1836430C3CFB66B17CBCA63ED1A2157961CEE600617157AAD986B5021F4F69C3BEE6AE181A076C3CABF076903BD59814352F4EE2C04A138AE0EB018A2193CED58981CAA3BB032317499E6EC4BC5CFAB8B389467EF295DBE7305BD1CD099364D7596B1801008ED734D7775C5606AF0F1A2978733DD7F55556DBC5FBAACA5A95BBC287B6D3A43AA9B78AD10A025F46AF233512B126230CF928FAC14D753160BAD961BDCC4D5E1B4EDD241609A0ADC6B3C6CC9660E5371D6C1655B4465F16D535ADCC54F8376371B758CACB81D84A7B3E6B8754B430C0753982A89D5CA8B2F4244AABE0BF05F75ED0B092F332AA83808F897BA21906AF25E68A88B61A357A10ECE1977199203E465EF9BC020E145F6421ABD11B182E7240107059C16C3EACF4A1A8342B73911DB6A51D3CF12BB168229A1B29F7C334D0D1AD99932F21BABFD8153BAE937FDD2393D9748518F12689CA7627A1041D868094AA7440C6724B4430EBD20776B602940C9D1FCB5A109978573434DA891962B645002508E46992C0C148F5A039609826BAF5834BA7271C443B69DC5110C4B7089068D16202CBAB2E1E4525738A19C8315FAE806FD139BE91F4C1E192A2C04983291340DAD4018A8A83C27A57C622408F933A51B7618148B16375A80E0A901F10AAF6E7803CB2A693ABCD4CA8BAFB942086F42F6B743937098E3D2A607F212F766603C9D89ACCF7AC584491F230BB1108B1465B865F824215D79FED2525D7E95C7976946E22A9E6510AFA2A9E8AF29DDB65C47BE8820561661050B70EF3B7BB249B7FD0CEDD688C37D7A3DE667626C2B389B38BE066089405703BD51FA32199E9C83D5265BD62A2AA2CE521B69973A18777E32151D3D5BA1983C8659A79AC978FFA15CEAB733B49EA8F7A853D4B06CAFDFC64C9D00E55D814536171496037036A078D026164D7B07E3277B7ECAA770B06DD291B9AD29241C3BB43553BCCF66A1DD81FE2E2BF79F1A21E1539D0BC517A9BA8EDE2C39DEAC4CDB7C65FF96048461BA2E350017095A35C1BFA25C242B000AFFC8AF29495A2D349133C343D680EEA815CDCD89C4FC283CD5136B89ABD473B4AEFE2228F4CBA5E0C10EC7A1083833735F081034AA7BBF20C11319CA263B52262096E505C45805E73619E2CEB242E559883D20DDDD4120F0C9E49F4995376284147CC2D2A96A046BDB3F56B6DC1889976AE1ED732EBA43AF5941831B2202D6091C16B680001A82D98CCCCEC212B79B5A884756C75CB2545316FC072D903C670864D5A13534E545D836276EE594D3A7841E5F91D6B738D97E73A7274671D6470CD2719B0515FDD67C6E4969AD213254502C5AC9BA23C264A375237369B46D0C45745041A20511459D3321EE9B395978F2C575EBE1C6CAED03AFC7027BC457E03F527B0CCBAEC71850E0955F0A2B54D9BCE69B6C8FBF90850168ADAC411AD5C973B578424C55CE01B3EC2825B0085232469968B8A96FE7B9F26846F789323A15AAE6397242A712CD26B0465BC038A4AA30DAC42C0036C062C21C3A4178A0C92B8992CBD54A6044B789D943F1EABB0BB24C3D0D4C067251779374579B27C84FB435E6C745334485FBA84676750A27C520F79366D008E4BE93FE8A958E8D06B8EC323BFD5BD01E86B1F13302EB17AA3AA8FDB3445AE5775111B2124E2A35021C04945661B2C510A29264AD855836C7D8EABC069011F8814934BB4B32176C0B59B04C5FB6CDBC8BC41B0BCFEF4423635C0C7AC43E4D5286C74920EF37C951266B92074D239B2BD0A0D6C096141FB6A718A213A3387D75B927CE176169738ABE0CFA6B68D3B064157C3CB03C5793A7400C1960351B059E43A7F1B28AE5073780CC606F7E40AEB458DBE95A31C23AF7E760001B0BD601647AD1805C4329E46F490575CA928FA908B5A30FD31520C61C9F1CC5EF18578B350A929164DE33B008338180CE41C45327152090A91B8C9B3928C2629A48D78ABD1992720E841A52CA91A15A1C7953D18B4BA1F990AF34CA408BA2D449F94385651C3B4C0503726CAFA118167110E848FBED995526B458D362061A12FDB7C7E39CE1625C20A13A1C91AA5909D8B03B064D00877DCE2415020370C7262D7033947AE42CA53522A65FBAFE18D3BC3E0CB66164E9A094FE4B44D8977ED
-ct = 1B064FBEEE1ED7023765654313B62170F23F4C7E4AA5F23C5498E7F5F82A8DB67780CA831E660289BEED5DEB0C8D6D49E8CA85AB1738EF7F0C487F61BB2535730041398D2FB4F2FEB04D4B238C3DF61784F226D31BBFD6D92FA486B344E713506F12F625653380D8CB3FBD2095E9CC32973194561D9F2B6966D17133936CA643105F9FF845760596BB95D12E7F9FBD5DFC36AAC052D64A7C08E26A641C938D83AE795977FD5D2757DFC9166B38687043CE1DE9AFDD799FA18A164269FDBAF52AC4B1DF518DEB9138D55D161018BD64B74E125943F42FF6548B2C673F647237ABB78CB3D87CC9B980C1D5F46B1E73AAAF600B628BAA2FD4D20A466DFD4B3F6EC33E91497280B782E5D4D94DC40907D0CD7A53B99948E8D39C1E059ECA344D697D009EA926E95957A10B401C436A95133A219DEED9BA76A8B87D2A9F6D0FC9CCFA183622F794A1CB29061EE4561796DA05659FCEF032A65613DAB8CFD117F5F1CEF02EEC44A13956FE83E796FC8E5F4C589B8574AE1E1E702A97C6268F34E809BE6ADA4BFA00D9EE7F890A8E54E1A6FD0F33C111BD835466EB64C1622CB349B1C15D648CE49C951391ADAE8380CAD2EF3D615DCCF177294072FFDD678F55AA814DF60B6FF875B28D2FBC3BFE3A2675A63E4CFC60634BA08E6602D449D76B29FBC7AEB54E97550A1995C6A9B47A48E6FF23CB62D35520BDC492F1AC12CCB9F18AF78C92494F22B56C684917C0A768D030426121321B1EA5B41442A791E7FD036F7010C25EB45FBC472F526C82C956F0D3AFCE7C16055FC470C61CC3CA1F05ADFDB3DF3724C5D38D9289E49D702E620ED0749D5C13376CCEC5666E8F46B60BE05D005E1F59DE58C70833172A0E0728A26C6658AADD56A9A1145E1C1FD6F3077E75DE450137166445DBC096733DFC8B8BDEDFD13F2E8FC53432F794BFDC09E9FE2070147A8EB260A4069B097CE368A7171628A6D06E5091A85CAA5D9819973ED338AD1FDF261E8A4C70DB6E78B6BE4B908D5CD3A875F321A24C4D1375AA6A97C76489D005E475ADD32524DE9B64E4468B44CD0F730B10219A0FD481800FA857C67ECDE250AF0EAFF95B43E377C32BE2F794ECA806F09E10EB4B0FB038E07535534CEE9816BB4E6EF0244043E49B2676F837079F2EE3CE9C29897202D75EB19322E6440C49D58E984DD441231A79D479851A0CA63D33E77E3191CCE8CA1C69CFBDF06D63AA52D1CEF72AB7B3F57C179B7C382F1CB7749C197C9BB0B501F97E96E893AC60336C8FA3E97631E770C3F2F544805767E3BA0FAB80020A42CF64858BC001D156ED33336F8207A439A82F07CBEA0D00F5D5942C1E9528034F60875422BA40F0AB503E32E61514ACB3D6F3F3F4AB1F9EB6AEA8BB6197E7EB0E143223532DE74B12834B889BE7DB31B93551CAA8F464E1F38F8F882A252682623459CA11DEFE125334FD0C0718974A3B6DCA46FEB0AA49D104ED96C301537A3174AB466DBB164AD68B59358F0CDF1D8A159CCFB9DAC867424F4504D3DE7BC0D686E24967A57B70
-ss = 3D0D1AD5E2825DB1F539515AF2392F0D212E8166B34F3D8CF2EBE97E51785EC0
-
-count = 39
-generateEntropy = 3c815e57e9233e975fa1630208aab206b71ae0db37a7a8789ac683d9f9b2d29801c8e376fdb140ee343106c093af7cb149b316ba79446ceb4e5e0cedb9b164f9
-encapEntropyPreHash = 28f5e9dbda122b2cf8f3754fe9e0c73a84ad4b0c093522e0b62cf815d60bbc3c
-pk = 45FC2D1BB1872A743763F12D29D937F3F2A41D257531C1172AF59C90806C7E5A15972A8CB9DCA049BC92700A72B4FA5A739033437C946EE062AA86C12103B557822A08084BE63C4C74D1B92608C3B02C6520B2991F8499470114FB659F89A937A25897FABA6C0DD142D8D4868EE3C6483128241B287CBA0AE49430DD6A28D1339605A4B750E6029F73BAA1FA8CE6219C36A40E5542AB45CC781A613FDF416502743DF8CBB3C4B864D0B448A20C0B0942A829601F2B131FB038587A99B80EF44033061B2E4B8F9A12C3C03193506B62AA1C7AB08569C7D0A88C8A098F87061EE41000FD202E2C3AF4E625B34787BCE55F74AA58EEB9124DE7089E51A581893354B36FE035CE5FECAB74018EE6209B75FC2702429C932ABF71D89B8C82C047D77725CB6ED98608F2BA0B3462C1D428352C6376F6269D9869AFF4BC821870B63F2284D296677B6145683BA6282C12C72512EF015EB19BA86B3571BE7438F17311655C118A530266BBC6D9D10636B6347C630607864949DABFA558522C100F6C7941A076109253B5FFD76328C99590F48B3FC7AE7A5847CC958FA5523F540AB54EA0A302174E6C401341759C121B355C9280D2AB6A84F9028634BF7E3CA90679ACA188667D5086DF35B88D95B262E8478561A414B627F43B0FB8731D3BDA73C6396594694A9F7024CFD55D3AB88342516CB34A922E6835EB8C067BD35CE0B3711D7BAD2D7529464C493ADC40D8EC8679C903E8984850034EF4A828D3FABCAE9474F7278CBE79C8E5C1C948B94798D4C68DA8255237AD8B0B38CD4A8DFDE5ABF6B2CFAD98A677A8C40E208206774661490C3C212D23327A46A23DD6855275B78D29830B23900B13C638E31B4745A917D4FBA95A04956C371212E475271CCF94F6295346118806316EC01D08454B0CD922D6F1A3E4A651A7A931F380042A09244BB39973EC5872C28C8D41C4BCC72CA4409A363C49995C45C7909522128C03814612214A5EB01527B67BCE4463202CC14E31225B36A7D7D10E26966BEB389877AC0062F9172C0517CA8676F5A44A10106FE75A31A4AA86688C075918A4D8A7461DCC1EA1193913C259E3B44C2D976EC67613468358886A9108ACC7D0C6A25F5A991D7C53B8638C24A585F07AA074B5A2CB514BF7178E14112C8B31727A38BDD20A5AD087746768957F837179D50D25F6697F4A88D056451A593E385B74DE8A01CF0244E70AC9AE36B2D76CB91E5419165C6507D141148869D6676F28645653BC78C96B9E7F382CB0C6768E2968C513C7AB076928781A6530CD3AE3286B0C681743A58D9C524BE5120C880605BC139F672E30174095932A000800D58A926CF40873C44AE6096940A3BDB6E7966595BB3D23C9915BC7E29AAAC9F0344C9B6BBB25CB0AA084F616332197295163989E1448784082C327075DACBB7D912025E4786710B0C7452F827ACEDA11A73ADA09C3E54B404419DBF3A8F8B6096A73528DC50FCD230155A97A614663174683D1095D97B7C0E994764DF2095AB7BC029B7DDA3799E5A88ED825CF1674AEE01BB0C17A5C84B8AC1BA061302BA9CC20CD46F769E1021C03C43AB07BAB1BB0C7F3426D252A15ED5A27854CA7B177A6F79502789842E229637FD32A677F68DABFA371062D8B8CE9DFE0D90BF06044AC3A840CEB626B16E134
-sk = 2C021F19322A908456F1677D31DC8A4A2A734A2571D19C421C47AECC507C3C53A931113290B693AFD1B7FFECA87CC90B0419C48BC4359D64146D9932BEEC78766408F59216C692228FE59B768C92F4D5A3CCFA6A35599DA2695766D754C1F682AB13C8966997F37A74985551C36828224C177D3A3ADE3C2C20A907C830BC32906DF70B021B47C38C606EF951ACF7C1512AC15FC0D761C9057A7DB1AC6C56198F9A8ED2F67A0F159A5EE6612109254D57745736CC3CDB634F5658FB684D805888FEA8582135BD4890343A545E4E0A6F0C130B8539125AB06358F8BCC0A4B44A7A4903D018C960CA45779BB564A30CF1B340B4C317CB77DA50BF899C10B4676F3C295B90E93C2540A9E17C3BDE560F351C81C58B545306449585718E9199A6302E3B0CA1E737C07A4B7E21EC154604590D415F4B82778778905360CC2E49BE4B08C94A744995F18959D4492F0B7A3F53A98F9A8D914863B9583D866712FE583FD2677E8A3B8BA5341902178824F4C41BA21CBF7A4B666ACB413C31CFA744B9A5405EFC5B53A2C64481270484134753C1B0407E23B95850A8C026843643E42B329BCBB7422DF5CBB968B04F39210A4EC959E1B5C9CB32A180588B9BAA690F7459B1282D9E9200BD1A0E910A3EFD948C3BD0AF04D866EDC61C866B48D7AA22E6FB5025C6892C66116E271B998B888E0481ABDA592C8B36F7464704FC22C51B5BA995928FE03594A8073AD790798AA304579822255E61D11557092BC9B5BD4C94068C60B2940C180831C5167487B7538C9AB47DC268215C8C7F324563D3973FA73BBAF07C771B15070D880478D2693535425FCCAE0F8272CD7224F3795A70241D480425E4A74922309906E1C11C5107E9F34FAC3536354100F911234D55769B763CF2408B9812AA6B7C2601161953CABF0733CD3AF819F5158A136621FB159DB3DC6C3F3220ADB8ACAA8CCCB7CB2EE583B9909C903FF43612D178C568AA7E9217E345CF4DAA9AAF17CCA1B5A4A5A73CE9B0581E73BCC019BCE2B68C8C273DFE588BA0861C5A73A6EDD9BBDD66935AF04E5EA81A55D62C9A8C51B3E6A402587FF4F837C16380AEF5640F333DB08A6CDDB425CB4189ED773D8ADB91E2708F12B78A0105BFFEE30873C1B6D5D5469F6464705741EC4310A8185A1553372F6091C769109F19527E95A6802C2A49127077B21126E7531A5941298BAE199309CBE00D97513BDE1AC82292CA1A76957D20A306932F83994A00F21D89519E16138F0477667F338A67450E1248A682142A79D9AB6B58B88754362A32AF3402D062A554CA8A40DA0481BA721A9B023DA71987B744C6B9AB5E80830F8B7200241007F0EB72AE3694EE92814DF4B1DB269F4404CD0C77A844D2B751F5A0BD1CB93D61A628098D0EEBC941827F77139831575B98E47B7DC3676D887B56D0AD96BCAA1F280049776339CB3FEF6489DBD26205530CB08C53FB0839B49909864AB06B2C3FE15957DDA96CCDA90C51904DF02C6A1E5846F892A1683838B9760AB900664A1A039B6A1C75F9C4B05340EDE9881F48869DC881DA0191E24BB5AEC448EA052E57E69EDF254575FCA87A1B50E6D39520630688B04328A70CA1A871FFBCB0A8823DFD4747DC859B45FC2D1BB1872A743763F12D29D937F3F2A41D257531C1172AF59C90806C7E5A15972A8CB9DCA049BC92700A72B4FA5A739033437C946EE062AA86C12103B557822A08084BE63C4C74D1B92608C3B02C6520B2991F8499470114FB659F89A937A25897FABA6C0DD142D8D4868EE3C6483128241B287CBA0AE49430DD6A28D1339605A4B750E6029F73BAA1FA8CE6219C36A40E5542AB45CC781A613FDF416502743DF8CBB3C4B864D0B448A20C0B0942A829601F2B131FB038587A99B80EF44033061B2E4B8F9A12C3C03193506B62AA1C7AB08569C7D0A88C8A098F87061EE41000FD202E2C3AF4E625B34787BCE55F74AA58EEB9124DE7089E51A581893354B36FE035CE5FECAB74018EE6209B75FC2702429C932ABF71D89B8C82C047D77725CB6ED98608F2BA0B3462C1D428352C6376F6269D9869AFF4BC821870B63F2284D296677B6145683BA6282C12C72512EF015EB19BA86B3571BE7438F17311655C118A530266BBC6D9D10636B6347C630607864949DABFA558522C100F6C7941A076109253B5FFD76328C99590F48B3FC7AE7A5847CC958FA5523F540AB54EA0A302174E6C401341759C121B355C9280D2AB6A84F9028634BF7E3CA90679ACA188667D5086DF35B88D95B262E8478561A414B627F43B0FB8731D3BDA73C6396594694A9F7024CFD55D3AB88342516CB34A922E6835EB8C067BD35CE0B3711D7BAD2D7529464C493ADC40D8EC8679C903E8984850034EF4A828D3FABCAE9474F7278CBE79C8E5C1C948B94798D4C68DA8255237AD8B0B38CD4A8DFDE5ABF6B2CFAD98A677A8C40E208206774661490C3C212D23327A46A23DD6855275B78D29830B23900B13C638E31B4745A917D4FBA95A04956C371212E475271CCF94F6295346118806316EC01D08454B0CD922D6F1A3E4A651A7A931F380042A09244BB39973EC5872C28C8D41C4BCC72CA4409A363C49995C45C7909522128C03814612214A5EB01527B67BCE4463202CC14E31225B36A7D7D10E26966BEB389877AC0062F9172C0517CA8676F5A44A10106FE75A31A4AA86688C075918A4D8A7461DCC1EA1193913C259E3B44C2D976EC67613468358886A9108ACC7D0C6A25F5A991D7C53B8638C24A585F07AA074B5A2CB514BF7178E14112C8B31727A38BDD20A5AD087746768957F837179D50D25F6697F4A88D056451A593E385B74DE8A01CF0244E70AC9AE36B2D76CB91E5419165C6507D141148869D6676F28645653BC78C96B9E7F382CB0C6768E2968C513C7AB076928781A6530CD3AE3286B0C681743A58D9C524BE5120C880605BC139F672E30174095932A000800D58A926CF40873C44AE6096940A3BDB6E7966595BB3D23C9915BC7E29AAAC9F0344C9B6BBB25CB0AA084F616332197295163989E1448784082C327075DACBB7D912025E4786710B0C7452F827ACEDA11A73ADA09C3E54B404419DBF3A8F8B6096A73528DC50FCD230155A97A614663174683D1095D97B7C0E994764DF2095AB7BC029B7DDA3799E5A88ED825CF1674AEE01BB0C17A5C84B8AC1BA061302BA9CC20CD46F769E1021C03C43AB07BAB1BB0C7F3426D252A15ED5A27854CA7B177A6F79502789842E229637FD32A677F68DABFA371062D8B8CE9DFE0D90BF06044AC3A840CEB626B16E13486BB11E7D9C1368FBBA34CE3A2F169C2464EF5FBC11F73843C456467B6CDBD4E01C8E376FDB140EE343106C093AF7CB149B316BA79446CEB4E5E0CEDB9B164F9
-ct = A2877C3D4B092D4196F99FCAC16B38EA10D653E03446CB3BBD61252A938ABB30F3F4B32127ED8936F48A28B0A5202506E7D4CAAC4A073C5CB940B89711AD903E4C43EA9C783A0082F2A831B5FAB803D97723DB32CCB3C0793B1B858E6F71A39A1BFF4700953ECD249CD244AED4FF748110910313585D19F6562F2B5AD187A2FA5383A55E6ACD134A97DEA0AB34E464299DA2C7D5C25A06DC9728FC48DE1FA9A72CB51E08AC79D09D2266831F55AC5BED2A383E8FCA1E2B402C0AFF8AA8EEAB9E277F80C474F8017F8CAEFAEC1480E8FF37EF2DD6E3A8223CBC0AC6AB488084A257BA0F65137C9F9DFB573F9302168A77A8CD7EC9DF435D0CBE0AB9EBBA107FF2FB8ED9548F816DC367777BB2254F8821F22128B9F1624A6B45CC91BC76D5C57FEFC1BB567A2CDBD66CC9970E08BABA6F8C25C3FBE1AB9703BCBAD4EE3C0316738EEAE7488AC7081EB97B2C7F9B236344DB66692B9623384CC8F6E3A6247DE3A75890CA89C3C56F0CE28CD448CB17C4F4C19E727CB2B3724E2FECBCE57AB0BC80147E6B2032E876790A15933FB3822C89C891B8034B081AC74A68A7704BC9435E085B50260480435A6E9E87E12B81F64E75AB3753DF34BE96DB9AB2E49AD18774DD4B5AE0EA2C319DEDF6E0AF04AEE38CEA0B14BD58299AEECFE63FD818055854291C0E81C97EB485592CA06D1BA83A61010E5B6786A353EC7C7C46E658BF095D34A01F486D7CA278DCAA2D92FE3D13103F9241F7E949AB007F362B54C504C4B92C9A40C980E3EF925476E5354A2FCCCD8FBAE94CE8574B7B461632C56EE33FB2D7E2F41E7E759D0945D5A9DF0CC07D6B01059C71CB05AE9553AAF3B60266D422DB11AD1A01ED8757F1931968A16E7945A6EC9DFEA453322F9ACA9639F0CCDE621E95D01CA58FD21BA030E7EA518F601AE849796CC83B5D02E6152C2B9DA2394113DBCF0BE0F2781087370AD6F581D75AF5D6C979E1D3F43105E48E62F6EDF377203815DECB1690C914FE6B5C5BBCF1C4297A253BC2ED7D3E53E90C1FCD61CBD8C1640AA60CCA213CB8E58F137D6BB6FFBC30697AE85782F0A4AB4584FDD332BFCB4A2BF45B5059F9E87EE76EA451B5F684517BBC1407B06DA076AABC83CA7532650C45CA468A07CAE1161B4AA88BCF0816F4CFB0229CD993FFB428A9E5AFC8C0C94C922333692551890FFD307D87CFD4681ABA84FD82035ED32007B4B96E963324BEBAFE589C5D65552F379F1B8C4905A5D7C9F93B0880B9EBB7073A0DCC35E77A20D358115A9C0C9C007AB49B0BD78EC1936D301F39C976176B2B8DAB9CA040ADAAF26A85CB616002834D630D2DB28A48362C15A5637A2CB45DF5AFB1DD3C632219723F55F4F65D2EAEA810DC84A4C243D30BD49E0214BD97CFBD1968275351B0D1182F316067A9F43776F923A429E6EAF29E5E620CDA06008030735A1D3AAD5C47A0F12102C0F28269D7F2CB89E3DFF8D9B73A5AEE6C395CD9D6FE209134D46BA65A4F8AA59A5C37F180A5C287D8130678EFD51406C52858EE1FE24ED2B038
-ss = FF9A0D1AE64C97E4C51512B315D044C14CA34771DF320BA0C16C8531D6A40D78
-
-count = 40
-generateEntropy = 588760826dcfbd36d9abe6ae44a669bb3ebba6a218eab69e30f18a3bd536576e0e860576285483bb5fd36e2f944d32c4317bebc1e441470c1372046a790d79d4
-encapEntropyPreHash = b0d713cbef0bb1df70cbb425d1e9373e9f7790fdc7980cc96a240dfc53f1e8e2
-pk = F6446774B30FEF5B426F563962CC29FF78ADE42B497DC3B970F1B848B1141D7A5F45A37C25B125AED61863F22732A06128BCA08EFC8CB176AB6343239B572E1C8C138D829810227AFAABB81CCA0A73131155377730A120558231E8F8A598A2B730578EDC7800B0D6C5627530EE92930EB2B40A9888CF648263B688F0A12E08F004F4BB449A25282029CFB73C32F8D31229D0A58E6AA08698517FBC5F619837AE3331CF763631D305E88C8F85413E9D5420CC282BAD24A783011184011A79A3B305DB5B3032B75C55907CA5C7F839320028305C439C39484895212B1E87925999681819416DCBC7EAD45AC2B1262154BCE16866C04561EBA2C9EC6022B07A57A67C7B901B5DA3BB8025C7585C86BDA0810C442C39374040236A82884199159729834663D3B1967DF9955DE3A387D93D50F5001924C4FE433D016BC2B6614F2D3BA72FDA226864AD6BA5B8C31681DC104348EC2B29C39FC9F567CAE17BDF1C6E215C92EFFC60E2D6A3A3106BCED0BF301B542F7987B582B0780B6D398631EB8559459B1DB01A0443100DCC731291C737499C2F86452394C0B6662401FB57A4DB232E40D1B0F2511EE1EB15DBF7B603E2A67808C064FC5103FA7C9C954FCD12BC619582F82590B323698A328CC14ACB87C217E39C309421C7E6EA15BA6C3BD8587126C5AA02C26308C9912D7262DBB91AC2C2CDBB9CB009A3AE10761771740B2E6558FAE775DEBA7A66086859270EC07B584334900C278002D8A47D01547DBA3036336616A8C12415B86A1423A6C9AAB5F085C7FABB6355B3DB4023E47C7917C10C284333110BC978B2C08E16512BA95A07237CC35C97BFA51BB1B25E30750E65664377BA49200AA6E935B4C7451E547859EDF03BCFC6904DF05220C02F5E576604A873EE82B7693B962853B5522A5B0986348DA63DF86A64671737C17201ED556E92ACB56F065EEBD31BEF43CA85DB1FEAC395E19110A2F0C5B90459838CBF779C27247709765569E5A649BF160301003169E4AC2BAAA4C4697F25869AB99179F9F792D9B19DF0C148DF7C6B9AA20E63426697D83A6E33B35F4C7E798175BFD73CE60A050146A3D893C4DC9B2FABF5960BD80FA0679433BB33BB91915E93C1EB2AA16CB13E0B9870FEF99835A674B1BB76946BC4064CAFDE3063498CA30AEB3983F5CDB3A6B9C4970459D969F4D8B6BA27755B6CA8FBCA178DEC28DFEB2AC03318BE7002A9A4CD7B1749A7FC7F09A6B560740DA89BAAB8130872510C99630F3B588069D50A9550C97F8198B7A46148FA7AC1580632DB1EF49528F9125784A5BB2757235FE44E74529A7CE88E91543B2FF81D9ED78E2647AA07033CF3422D34942E7830191B104C7ED56B8951A9C8706E4CB33CB0B918387B869084386420C13B09BE75D2A5E9276246B674E96BAC7782541E1CA441E53FF3B9C702CB95CEAB628D1617704A448EF743E8B811FE52C659CBAAE22377F28646C45642A9886628C9B73C510BBFB645D4077C1D8B954BDC8B707B7F6BC4701BB1AF0F28B88DD282B78B7EE96732521AA6180B6021AABB415839DC3A1F6F545C1320C58B965B62993ABF6A10C18A22CE6A45539685F297B1F04A130465845D189D17552E2F4917E924CC0D2DBC2DDC739F6B876472EB12CE233CCD402DDEF61523FD6FEE69A88F34A34C
-sk = 47A7741316BE87861AEC518A9B38146B43AA54A98F47E242866B8D79F731D98C754B572A2A9170A7EB4B0D73B38D6665D1E43AF0B61AB95CB54879707805BD787913EE369D231C600B76949BF86366579AB62724CAA1BEABBB02FC945BF007CF57A225AFA67393CC58804A15016A12DFB90D5A52BE41F907B1F2C4FE93712F555B0AE896E85931020089642A23E4C38581D4C40A46AA8DDB3C26DB0E29FA5F7A12B6CA32CD2AB6B50327AD0DD8139AD83DCE676AB2DC0C2774C86A2C72A5FA2D4DCAB588A66D6551C040E91AE045698AC0A1DFB95048C545D08654C1B560384561AB07BD8C61182F99C79A2267C961AE66434321E8501D474AD84AA71286A948C5AD187232CF72576F167D63992F62D3423CE75577C2052EF84019404B0E1706BA704FE3D116A518293112B8B80708C094BDE829AC38E362A404BEB67026EA6782362035CAE099302C5660931CE31B93B665059633699EC44C28C2BD230B1942421F12388900081618BB29E315BEEAA090A06AC7FEDA567FD1A12D1A41EBA931C279ACDB875D9DDB7CD9A6ADBFB32239E843012A8CB91776775408316B056FBC42758772C1E53EC0344479C2791B837A6A34AA77710D35593A55E57572FA99711BBE5A83454BCA7990E834BA285A09AA11666CB2B2F39704904354687D0524888CF6461EF302139B042540138E322453619B3DD715B617230E08C4585478F9996798E9B47C712F82BA45857551EA4C79B4A0577938666403174E84585E684783D33F3B701420F66D48473FC6BB627B399E90697E760783A3E09D6531CC524568DEF8507F0437314488AF7376BF2A6BACF783B632197D8565F9456D04A8476DA8CD6C988D26A56D29479A2DBB85AFC18DC81A8611BC4ADAAAAA440471B530053ADB874DB67102B6A64FFCA8BF8487E18B2F7582B71FD78D85F819C24B892741A83E67585B6B1AE5AB6AD1F5CC02AB78D0ECBE01087F46AC9BFCA464A4B9CA817C3A1AF5CB0A6A3F1DD3A2EC06774E805E001B44C8194660A280D0D59BFEB35EBE9C943E626B98E488F8984275401BDC4959993345C38BC801B95D56BBB47A2B23F5F1223D5A0E2A827D4578948CFC5432627C9586275679202E3C970FCC980AF56757912080072A4AF234DD030EC481A6ED8030921691D6126839635C6B270497CA4A87D4BEF47CAC60752383712636752A4AA18AF13BB36EF445FE653628704E4DC2CADD62839F9842F9B2C264AB4FF648C59D15708F55AE4A396D5F4BC75D20603C03CDEC4252FACC579A0CBD1F64A734E8350F03ACEAA2734DE2B486F6B93C36AC11803E564070ABA97D2309078FB43768F98EF5D03B09FA10FFBB0BEB3B5FE01310065508100206A640B93DE87BD94A634907730E30800803B233B95D1CC7CCE49C08AB143734347F3459A5BE0230F9481D50B4B835A91736D6A7B351C8082A4D080967B43B0553835BF52943A380051F48C27823C5AA0B20B7B733DCB004B2A7819BEBA4B3FCB1F991789C2C57CA01B50523214AF309FDF421187492C411C14128744BF4A83599A30B86194473C2BC9222FB4BA34108689AA8065AA24FF3559A76F759768C81A8CC5AA2A6792F3033B2437B05068BED096475D9280BF349F6446774B30FEF5B426F563962CC29FF78ADE42B497DC3B970F1B848B1141D7A5F45A37C25B125AED61863F22732A06128BCA08EFC8CB176AB6343239B572E1C8C138D829810227AFAABB81CCA0A73131155377730A120558231E8F8A598A2B730578EDC7800B0D6C5627530EE92930EB2B40A9888CF648263B688F0A12E08F004F4BB449A25282029CFB73C32F8D31229D0A58E6AA08698517FBC5F619837AE3331CF763631D305E88C8F85413E9D5420CC282BAD24A783011184011A79A3B305DB5B3032B75C55907CA5C7F839320028305C439C39484895212B1E87925999681819416DCBC7EAD45AC2B1262154BCE16866C04561EBA2C9EC6022B07A57A67C7B901B5DA3BB8025C7585C86BDA0810C442C39374040236A82884199159729834663D3B1967DF9955DE3A387D93D50F5001924C4FE433D016BC2B6614F2D3BA72FDA226864AD6BA5B8C31681DC104348EC2B29C39FC9F567CAE17BDF1C6E215C92EFFC60E2D6A3A3106BCED0BF301B542F7987B582B0780B6D398631EB8559459B1DB01A0443100DCC731291C737499C2F86452394C0B6662401FB57A4DB232E40D1B0F2511EE1EB15DBF7B603E2A67808C064FC5103FA7C9C954FCD12BC619582F82590B323698A328CC14ACB87C217E39C309421C7E6EA15BA6C3BD8587126C5AA02C26308C9912D7262DBB91AC2C2CDBB9CB009A3AE10761771740B2E6558FAE775DEBA7A66086859270EC07B584334900C278002D8A47D01547DBA3036336616A8C12415B86A1423A6C9AAB5F085C7FABB6355B3DB4023E47C7917C10C284333110BC978B2C08E16512BA95A07237CC35C97BFA51BB1B25E30750E65664377BA49200AA6E935B4C7451E547859EDF03BCFC6904DF05220C02F5E576604A873EE82B7693B962853B5522A5B0986348DA63DF86A64671737C17201ED556E92ACB56F065EEBD31BEF43CA85DB1FEAC395E19110A2F0C5B90459838CBF779C27247709765569E5A649BF160301003169E4AC2BAAA4C4697F25869AB99179F9F792D9B19DF0C148DF7C6B9AA20E63426697D83A6E33B35F4C7E798175BFD73CE60A050146A3D893C4DC9B2FABF5960BD80FA0679433BB33BB91915E93C1EB2AA16CB13E0B9870FEF99835A674B1BB76946BC4064CAFDE3063498CA30AEB3983F5CDB3A6B9C4970459D969F4D8B6BA27755B6CA8FBCA178DEC28DFEB2AC03318BE7002A9A4CD7B1749A7FC7F09A6B560740DA89BAAB8130872510C99630F3B588069D50A9550C97F8198B7A46148FA7AC1580632DB1EF49528F9125784A5BB2757235FE44E74529A7CE88E91543B2FF81D9ED78E2647AA07033CF3422D34942E7830191B104C7ED56B8951A9C8706E4CB33CB0B918387B869084386420C13B09BE75D2A5E9276246B674E96BAC7782541E1CA441E53FF3B9C702CB95CEAB628D1617704A448EF743E8B811FE52C659CBAAE22377F28646C45642A9886628C9B73C510BBFB645D4077C1D8B954BDC8B707B7F6BC4701BB1AF0F28B88DD282B78B7EE96732521AA6180B6021AABB415839DC3A1F6F545C1320C58B965B62993ABF6A10C18A22CE6A45539685F297B1F04A130465845D189D17552E2F4917E924CC0D2DBC2DDC739F6B876472EB12CE233CCD402DDEF61523FD6FEE69A88F34A34C29253478090CB4D580BC2A912645BC685061E5D4437B3811EDA69C865EA9923C0E860576285483BB5FD36E2F944D32C4317BEBC1E441470C1372046A790D79D4
-ct = EB55C9D3D46D32C021F0D7E61E5382C2B74BF1608E0C8F09E080C2820AB0CB10886E141A282A7C80B73CEA0272D08E16366F2C900DA1144039E5A8EF7031DC26A5CFCEE8F47C3F997C940A056D68D3507E7481E13835B911CDE8976F0E7494170D98386316AFE41F97B56FFB8B5C85C70048FF2B5E2508D19B06D8E03A91F6973DE1F903452D0A95F5E8FEC22D033669FEBCBB2E09904307FDD7BCF55BFF0C097D31B62B08D75A144E8064B7001DE832BD6AFD9FADBD00BA148A5DB0B0085FA6756AEED4E2D1CFF7E8BCDD3F8E6096FBE2EB19F10E1EE84678EC8E140CD4101D300FD0E110BB7ADFC580EC1EA5AF38CC6CF984DCBA6921230304DC19B38A1D3C9BE8C479FEAF98E097FAA5C45A957D8F33A2928C1692EA8E8B528B33D49460516DFD50FEE3F5D0590171ECC3DC287E4F63AC5FAAB29D1B6436195EE4F6F29AB15C9C3C27683554C44F0D9CFA94920E9000BFE9DA83AA15A605A6E2474D29460AFF929BA74A38C465FDC8988C7C2F02B5CFB44C16BEE8B9065B049FD6342F976CDE143BA0D48CE4AC03F2CCB0767F94FF4DE46DFF7077790B1F1FE14093034F8E021C2857A148C14FCAC87797E455F36472F3791073F5F47C5C02BC40063A6C0435958B9CE3B403051CFD6A538B05A63B924950EADA692FE82433DEE2F7BE1202B5E1DBE0D5D17E0532F09F7C3D2F815BDA7A6D6E61B6BB2E755C1A181EFD721444A928BAF9EEA4ABCFFFDE4A1053BE769077146B4487ED00B2F3CEF170FB7EB4A3B61BB19706AF4C6FD9B6A29EB698101835CB24FF1580E00C36274220FDD56200D74716053C38F7D4E3FB1D733F54DDABBB14F3CFAABE62507D50920FEDC87E5190BD84200C96C6967CAA3912C6126EE409DD4BDCF8859AEF9561E523A26B31F5632816FC9053DA5B9EFCD9CC05E6A1D81078D6ED3246A46E2CE4F0C09F11CBE1FB5994EFD758207F7B9E2AEDF2A8386F9175259325B9B7AFBC9C8B9715E973EFC1573526D6CAD3579BD57920172694C7A5A02B2CF3DA1C78CCE8C9E204A4D2605C510552836E2231841873F2153A60E77E381EA4345A0A4CB0622020CC5D3FC168D84EAFE1D38E0F2DC8B890D7843BAA29E2925D5F1BE93A9E266DCC99C00C5D6681190E07A833090AFB8575AADF55333E8B3F3D9FE2E7337A3C122DE1EC3264C61B47EEBAEFC7B1F276F8EBC1CC53DE806801A8EAE9FDA8BD5E7D2F83CEB6C072103D190ACA2AFE8313B43AE7083845B6FC26ADB1A7E3C17C0FDEE0A1590FA66127EA4423B6F7AFDFED7C7E2DAF1B7490F09DBAA9CE15E209E1405E71531D3ACEFCF6096B8B76EE28246697A41C6AC8E0CB4E0CD1CFD80997E19014F083167FA47BB4BEFCF207A369051C5F37477A2BEDEA8A65913D557F896EA0041D77182BE50BD355F7544245624F6DB4E918E1308BE489CAD3C7C430D707BF91B79763691EF5FC0DB233895B361CD85158250DCFD5BC90A3850B60118159B3EAF31B8AD3AECC555330D1E084C06033CE41EBF6A5A6928B624D308C48919BA8FBD6923E
-ss = 0E40BEF57DC97B87EF89E5308F9DB94FFF59A475DC35EAD3F2D5B6B89D24CA2D
-
-count = 41
-generateEntropy = 47550e9edacb6ddce3d9ab81f6b61080dd4f2693854acb05e0ccc7a4fb6390fbf89d7d99d5c3e0d10d6ef9af054d842375f695abb28e3b8eb495100f04306e92
-encapEntropyPreHash = 32bdcdb7059fe27f6409901980c080308951ffd90deffa8317b4d213a5f04495
-pk = 5FD557F7434FCB61B199E793C5E763764C48DF412ACB7C756E1370CD117F8C10CAFB39CBF0C8C3F5DC8DA1855203D02B39647856B55C38E944617B8348D16A8221962A42398FB61978F40328C83A0B49BC843060D1711E289434DB4B5B0838CD87949DF5AC0727D8A528B8B5BF30CCB9E37A6664050CC5880D34C13CA42C1779B8D098C5E0876627C17A79B6BAD44A9A38C56883D97CF2D2B114A1C4F1A502AB4A9B7B5398D9E73E543B860F87062E27A9FD1A2035185F0D98857B0759BF1C39A41984C8C1A1A9027944417F84CCA0DD4206E9133F6EB6A989075D004ACCD9F57CDC928CD455443F0222DCAB9A8890004C2596EFEB06903B5D0AF33A88F14FEC760FC074A3DCDC744E9864E7EBC608A56002E483E60B8202B31377DC7F5A486D5A060733FCA9836AAEEAE05909C6B6B0DB4531271FE4F3548BD5BFF1E92160321218F963081C518874C0CBB792FDA4513F7902BE6547745A0879BA6CCD7C0F73B123DC605BC7995BDD14B018D8278C8C3966AA87A24B4A4BD3ABAFE0C8173C028DF14DAAD39C288943EAC139210392BED70C38D7AF7439697BE96977D23A27CB6E7DE7B785673C9D1B33A081A9CD417129430C6C6300C496B04E1796C9C781E4211915162DE147501B7BC55F8913C66C5CBD209BA6D115F753BA739417C8EB182200113CE17C935A0622DCBC674553B9DABCDA17BDBFB4865D58143C149512CC2E74A2B508F67BE8058461252D95042F8B7641E1D85161521B81A616A02110D7EA3BCA4723D003A4DB1673D64273B34C9432AC981A0C01DC8B8C0ED5A05D20C5331831CE56014AB0732B301CA2F8569FC061DDAA95D63667B9ACC7A1EA656F821D55A31B41F32DFB3B66DDD5CD2155438DB6923069430B61C85AB309BF56B0ECD990427C1B7D93991E783A647B1DD66696659B5C926485E1642854F0839033138A3A54C349C138977275E71E0FE985493CB85E0923095804037462AE248780006D0778334F664262E88498FCBB22D46D4F4291BB90AFBBD40FBF2B302415CF195542DCF3375E78602FE1067638AB995B70E6DBAF7B75BC11701207E489F361512B590A860401A3FACC1EF1375D8B64E0E5C7F863786D3984710C2F55ECAC578C41170194D832929075671B814FABF45C6E2BCDF8C0CBE2954C5A414E3F8878AB68CA13189D97F316517ABB4C5187DBB03413DA654E650EC1CCA0BC9472BD4BCC60CA6FCDCB26E77A025EB70EC0E60E20B19D30FC261AD11D3C0C56ACE53DE82C6A38CA5D59E9C24568B7CD15A0531315DEC20D9CC957FCF8958E3747471A8D944A6678F6AC8A8763A1759B3DC83EDD18CEEDA5036C31A897B65612D2B176E9648352899BB2869F48B1E70C1FF04864487258526226A7DC64306B6838F4286B9A81A3193F5C9C711DFC5B9FE79BC6CC14C934591F93860B66511AAB061295AF186B8CEFF5772FE50DFFBA4F5256522B5C7C55A6BA9B13B615FB3B3BDC4B159A1C84C85D717824A0573CBF219FD9B2A32AB66BF8A498A04AA4E22509A5057997B74AB5A1B27B96656BC194AF08114551709A41142B715C6E167E5BA5945729BFA702C236073FDDDB4CEADA972810253D642EC094333C028B0AF40CE2E29993369EB7DDD07164969A62466B80918873A4EA56CD80A8E559FB30F6CCE44F1F8FE60A
-sk = 35E4451348CFB9A06F1836296178B6AF41A1C0196F26525831C081EA779E6B8C4B3F150AFE2963AA756968358BFCD47D76415ED4294F02A843F89B87D6803BAD504A9165B9BEDB0C946058965B64BBF953E719160B53552C100D251CC9C111837E0A7C4C043BA0777E53B39F658B41B5F8900D4721268A8AB868B15A12C3B8F41316DCBE117AB3A027B8FC2CBF3566569A130D6DB132DDCCC5EED69A392BAE8E4A7BD6C9708A48BADEBAA79FA1AC1E729EEE0399803A374D3733AE501F1A846CD2F5166DC31B4D53750BCCCF937B1CA43C3A6CD5601EEAC251F9AAB8B2489E22CEFF436F1142CCD1BB17DFC75DB6125A1A433325A5599FD23B49BBC3D1B9195B984303735F9F2646EFD050097AB23A8AA5569AB744A934C2991BA046CB012467D39C3936EBA9CFEC4268E1A0EEA559980133B4121F9D5A603E092C199818C057B7C841A7DD00AF2C0AB3637878A9EA90BF377874FA38BF290FEA6131345340857A1A53D4BDD9201B99FB628D975A91001F907A2E9AD37C9B99B8AF915070339FDF76125D9556B1716CB74A9F18092AFD887880526FD82CB002CA49E879C50E33AF2E747104674EB1F30859E3C22F3AAEBFD30FD672B6AB855928C4085130488540C8CBDB832AE25249F46B7178AF9769A4B359664BA48DA4A746C215C58AC2752E43835B5C2A9EF0A3FCA159D29038CD60CD60F5BF508521D3D59C4F083653264776501B4FC62337FC37562973A1F9BD9532B4BDB25C21597A11E17096B155CD43C76874C44F25C1AA1BBCEA897367536ECF4124FEB6CDF2360CD5A082AC03B5E94232DFB44E1F124FDF65A4BD03B16ED729884065D77135F1F730A7A91FC2EB43271C0B2BFB8E615C07DF54041917A95B0544E8513E8C6060D14C0FB802C0F2680051341960654F3594C9972C08664B7BD30B2F031827307B95FC525A2632C2456041B1286D6F175BC0B41942E8B8BE69BB364A11AB4CC199F20AEB516CED1ACC1F4B2B91B860331677290C643BB9A00B4B65644592C5CA5BB19B25D2A7080CC32B08910C137946A3FAB6C8E31A1E97A4735A5C0A239B073C6E056053CD6498117497870718D35235019B3EE6050DCAAC31A27167FE35CE57586C364C13BCC7587CA066C6E05673E2BA0186281D94843DF10BB3A93C05025C0C691A0C41B229A55B7B506724026C4F1B48313788A212B0C951783EC9447E64314E878734AB59401923ADA0586225C7A5C00A5F97BB76632DEC47C15C06C7C20090C790404B3044136C79F46181CB1123A7D3CF969B72F6CABE063A35774A60863267B1BA34B93A5D3DB25FECE84A02429A9D142ED897320BFCC114391BCC097A078B04BD9356113B3CB993C19384886DF182E37BA659D5B8BEE24445411E318CBD092B8F8E53C63BFA3896A2CDBDC66E27F25C83FA85C260A34FD6CFE6872172F1361AA125E6C5C6C902CDEC68708C14C175E910CF002AD647A317F78F52F76BAE006A3AA51780D37A00AA20C6A532281719C5AC88641A9D15549088B5A4DDA23F443335ABFC5C2F7C5BE2A142740CBFD612A83AF271AF0AACB43833B56295B51A885D798825C3A2C04B399C528530CA24117B6E762C7B6527B0509B5963B68560015DB4D4895FD557F7434FCB61B199E793C5E763764C48DF412ACB7C756E1370CD117F8C10CAFB39CBF0C8C3F5DC8DA1855203D02B39647856B55C38E944617B8348D16A8221962A42398FB61978F40328C83A0B49BC843060D1711E289434DB4B5B0838CD87949DF5AC0727D8A528B8B5BF30CCB9E37A6664050CC5880D34C13CA42C1779B8D098C5E0876627C17A79B6BAD44A9A38C56883D97CF2D2B114A1C4F1A502AB4A9B7B5398D9E73E543B860F87062E27A9FD1A2035185F0D98857B0759BF1C39A41984C8C1A1A9027944417F84CCA0DD4206E9133F6EB6A989075D004ACCD9F57CDC928CD455443F0222DCAB9A8890004C2596EFEB06903B5D0AF33A88F14FEC760FC074A3DCDC744E9864E7EBC608A56002E483E60B8202B31377DC7F5A486D5A060733FCA9836AAEEAE05909C6B6B0DB4531271FE4F3548BD5BFF1E92160321218F963081C518874C0CBB792FDA4513F7902BE6547745A0879BA6CCD7C0F73B123DC605BC7995BDD14B018D8278C8C3966AA87A24B4A4BD3ABAFE0C8173C028DF14DAAD39C288943EAC139210392BED70C38D7AF7439697BE96977D23A27CB6E7DE7B785673C9D1B33A081A9CD417129430C6C6300C496B04E1796C9C781E4211915162DE147501B7BC55F8913C66C5CBD209BA6D115F753BA739417C8EB182200113CE17C935A0622DCBC674553B9DABCDA17BDBFB4865D58143C149512CC2E74A2B508F67BE8058461252D95042F8B7641E1D85161521B81A616A02110D7EA3BCA4723D003A4DB1673D64273B34C9432AC981A0C01DC8B8C0ED5A05D20C5331831CE56014AB0732B301CA2F8569FC061DDAA95D63667B9ACC7A1EA656F821D55A31B41F32DFB3B66DDD5CD2155438DB6923069430B61C85AB309BF56B0ECD990427C1B7D93991E783A647B1DD66696659B5C926485E1642854F0839033138A3A54C349C138977275E71E0FE985493CB85E0923095804037462AE248780006D0778334F664262E88498FCBB22D46D4F4291BB90AFBBD40FBF2B302415CF195542DCF3375E78602FE1067638AB995B70E6DBAF7B75BC11701207E489F361512B590A860401A3FACC1EF1375D8B64E0E5C7F863786D3984710C2F55ECAC578C41170194D832929075671B814FABF45C6E2BCDF8C0CBE2954C5A414E3F8878AB68CA13189D97F316517ABB4C5187DBB03413DA654E650EC1CCA0BC9472BD4BCC60CA6FCDCB26E77A025EB70EC0E60E20B19D30FC261AD11D3C0C56ACE53DE82C6A38CA5D59E9C24568B7CD15A0531315DEC20D9CC957FCF8958E3747471A8D944A6678F6AC8A8763A1759B3DC83EDD18CEEDA5036C31A897B65612D2B176E9648352899BB2869F48B1E70C1FF04864487258526226A7DC64306B6838F4286B9A81A3193F5C9C711DFC5B9FE79BC6CC14C934591F93860B66511AAB061295AF186B8CEFF5772FE50DFFBA4F5256522B5C7C55A6BA9B13B615FB3B3BDC4B159A1C84C85D717824A0573CBF219FD9B2A32AB66BF8A498A04AA4E22509A5057997B74AB5A1B27B96656BC194AF08114551709A41142B715C6E167E5BA5945729BFA702C236073FDDDB4CEADA972810253D642EC094333C028B0AF40CE2E29993369EB7DDD07164969A62466B80918873A4EA56CD80A8E559FB30F6CCE44F1F8FE60A286DE7DC142EFE935E84B0AEEBBD32D050FD9D8B008A94E59454B19EA401611DF89D7D99D5C3E0D10D6EF9AF054D842375F695ABB28E3B8EB495100F04306E92
-ct = 5DC80EE57203C2A3A593240F5C226FB63EA02A9289CA40186D14AF3D9A02094554F7B14EF4453AE4F183E307BF7B9278D01E0F2C3335BD69C14642ED5FF79C29C45AFE9B515675C913AC83BBED109F7EF75BA845F6595EBAC11A0E80AD13B284F035C25E9671D7BBF6D0D2C7552DA1888B61A5F011BDBD83C63C2B03C8979D3868E08B5582152F4D3127FCD9E587B08A1860DA14AB9D078769E7114A40D559754637E0141E3163215B30587E985329A2683BAED7523E46BF08AD415E8AFF8E92AF2815A8129BD516119E54815A2A529EC01565F1A6CDCE2D60343BCCD6B705A2FFF6EEAFC75B73B7187769B0AF07879775557278F537FE44DE5D57F4854C9E0A2E7E6B55435D801C5133D133089B15064F702583F228257D9A0CAD4162230596242AEF6A26E5E8C79F9B405B2F196EEAA922C464EAA9F3D312560DDFE0DE9650F53B07464EA6F28FDED35F78A351397E23FC38BC1A790E39DA5D41D33494DEFD5A5533834A5095ADBD2B03DB0E560DF6BD4C64B41C502309B89F73C0EE40B9C6AAE58D835D95E650EE2AD57CD0D393D76D5C9BF0B90915878942DBB05D8C5780734821937C929F1BA55C487FCE1C1831524BAFAAABF4D29472C82C105798A9BB324112E1B28490965C14A402E4E855DA0F3E83A2DF80F3F3BD8807112FE74907FDAAAF6C8D4DDF5C1E57DA71B4680F81BACE717B766A38C261CEED6245B9662530DAE047872C4B7655FCB0BA1A3290A34110BD31A97A51D92443F6E6540B0516B1164D783A610A3F87BDDF21593FB5EE66617E2BB370EDA0C1DA30268A6DA145003CFE65114FFEA6AC3AD209D9B3DA1F39CBB1E564D91A9AE448C23690B77E8C9292AB6820C793E767B26CBC2EEDACAC6B04F0F1F742D147FC0E2B898052E1E56BAD108335CB72B6D6AE792794F804DB1FFCE2B40C2C97048B5E8A1C6CE5FA34966FA6445ADCED31F6921D56A24CC323A4AD2AD53EBF4CD336998D06496724C1F9805C1B3A89B3511A143DEEBCBCAA4B76C8F28D9DDE856F35CC7BE4FF03D7C147486270B6FDBEFBB08C502225AED31489ECEEECAD5626A028F7A7E4535211B2E85CDFA40F1380C91AB7D6F6B544BAA8A1E6FD69001D0D47E2215C5158BEB50BFD8CBCDC828207C5027F39CDBB75FFB878AEBFB0D713DDAABD1872BF36775457BF5C2CB50B499CC3237AA4BA7AE6E62C69E317916B7548F14684CFB0DFCB1614F2D7F344BB8CC97014ACA7787A133C59EEF7EF6D010E9BA76367E0065BD41D9CE4D38C1A98838A43296B6CEF7C1FCD671537ADBC2F00AD206D742ABC670ED2A52793971A63F2678E37426A34616C69EF57430568F3BCFA11973ABC280FD527DCFFAC2FB7E612C168AD943F0AEC1A7945DD77109B18901A3DF62CDCBED7DC4F75D6AF7A1458D0FD1ECB7CBFBF09F94AE3B593BC4F842C3B2B42934A2B62963E8BF6AFF0CAAE36C1C887C97D2E5FB89572551DFE322593B2082CF2B37B807C2A60F23CF191FDEA019D05E39A36403D595F97F46910D2AD65D812481402CE51B810
-ss = 6134219801B78F6FA5A998377643F828C19AB6FEE69E7DBA03C7B8E20915DE13
-
-count = 42
-generateEntropy = 610afb64be8cc1df288cfb016ee2f44c6c07113de7f6fee071fe0c3fe31c6215cd292e4c5f9e1a55e0489bceffb204d672a6215f4f3980a646d9f880817c52dd
-encapEntropyPreHash = 4ed7c92d83bd03b2a25b567f17ae55542e2f6a4308ec0f3fe69f8ba5ae24331b
-pk = D5F135D06AA99635C9B53244E1F898D8494B681312BFD243C8EA5B7E71CCB7A5386E477D01FCA3EF4122A63934843450A446CAFF55184D052923A393FD887DF6B045659CC282D1424B19B17CC2A2384132EFF067A0347F88C6B392AA56A3519A440438D3F90F6941112124C91FC31187AB0CE6752D9B336A1E230F97837A657599E253B7798C912A66A48314447C352B84590941355C6BD1C0951374105858A46502EF39CBB58B8E63A64E2B99C4825912155695893A62AF6745E76058D551A946161F25F1B8FC045602344A7F342FACC50E9565C1D59A459D34233C1921CEAC6E0BD936B496C8FD6A619D8B0649EB458F8943EAC97293635092666688DB559D255CE9F280227755C3605D6ED007CA718527227FA1F40DBCD88792801D8DB6B2374A23178A72276C790F902D7E969F2686C9508186788905E77132DD909397F6B6BAD3CE77E8CD4C4A3B9686CAC35ABC86D57E911CB58B0C997C1935CA64918370809D3B1B70CB09641878E7C0A141573030AA2B687761BF43AC89A81E73376793ECB32DB53368EC9E079172E9AA482FD8652583B9155683DA3467E4546F26AC98371487527C37B6646CA582017892A188FB2440CA7240C3C22577230B59AB8EC038BB95CC49C2A2F59A4A22C0C482713544FBCA9D7404B3A6AD86E8764A601B7084289858BF62A2828D3091FF015089726CA23B1CA0F87195BA1ABF80B01F101F8584C15289196744500000B431A60267174F2CC56860BC5AB4EC20D19BA8ED47535EB42FE1D33F2980BA211805A3618F2FF64D1CC634CAA6B40FD23615538366DBAF41971D8B5857298C1E406A293C1B8B7F4A499A97BE8CC51B5382020EA9C7CF809FA7323134290FA461218F4A6F495CABA2D1511EA48B7E0905B0465F7A6711F2716B17DCBB4B9A1B31933D7D3622315C79F3F11A93C8058FBC01C4839A808A5D2D45B99F7918FAF52DB1D81D669C7988BA7EB8847187AC7B76404B1A139DC4E4917C9B4E29833FD9FBC36E4BBA96E25BDE691CE0C369ACE7183C762BD04785EFCC6B614165C014A0FC4B64B24B3B46418AC5B6B7BF69CBC75090B69AAE46B4A12FEABD4E134BCAF14922367B50F17976C6705E175FF34612CF7B086ED733DEAAB0CA815A53C99B2985963DB89BDC284D251340B0E3AE20990EE93344DEA18063DB6EF4374A331244EDE00B46676475937A9472C82E124B1751A9E4203BECC77ACE092B055ABF0892637B39C3A9A011219C88139277B8BB73B9508142421939380ACFC2B81523C72E923609A0505E2979E086AB85F9663E549F3350A694458CE7B02BD8716C0F8B8946A21D99D97632952BEE898989C1ADEB710E15BB25B0A22BE598A65465BF2B899719D00F9D16367E9436803BA8C17B6B3BF62A10A017C177125396BF6745163FE24C455319CEA69393CCBAE42508156167B28A1D1050BDEFA5A789BC389031BD86E72AF5F5BC80A215260737839654998295D5ABA8C11A5417B55D67201243393B7593400D46CCA1D321C027BFB09CB08A1738C88B7D47E876EF7517F8D96CC1C93B9E93B7062227A55996FA958A684AAEDA89587B015A6B336DFB610721298AC6AB713F3A2E37B2AA7B1CCD2A876F03C72546B861E351A73036F4B363137340EFA7764C439F68D3C8E0723683AA8254A66284F447
-sk = 03A941A829C025261F44172ACF806BEA5B216B58BAB845328C36CB925A5169D6B1FF141BA44010FF2C1A446113C443C6D98CA879E673CCCB84D5519067619EDF59C23798B9B6BBCDC0D49DF5F4B21563AE54E287DCCCBE4C53C62918A6A213C460EB8C92377CB57A1B6D6467D40297FB90C6907B6BE5B03DB314C3AD5B2F46999743EC7FF0B055AF2B2753695395C6157C60115E183DDA398D136806B7017BB4FB4F36B7653BD17CABD1BFFEECBAF2EAB65B853C710820818B05AFB86388F327FEA6C3562A027C610AFD9C0BBB23A571489120C2BAA0D7AEFFD196B2DC8B40D4016FDA16062512A64462FE806D5959C49DFC0C9B2955E6480B7AF0011EDB2D44C6A43D08B5F469656CB9396C9C640BB077CC24AC0F293BAB4CBADD998ECDBA31534408B74420CB432826CB5DC8224C48159626053096063841153F723761F83315629C945778A24F826A28A90A5854BA7E80C48E44929EECA17E28304BABCD0AF4198962A045292F09AB5B7197A685A67D07EC9769B69E64EA1457FB8E1A70B23AC4A797132B021244944143E936C6E5D840494B674FDC9AEE84A091175F8E3121150B1375E028D0AB6B709A443F14C56AB67E3A8721A4B698EAC9615FA12C0E5277E4A412508446ED4999687AC5AC626CCF5468F3E944B8D099FDC319337C85E5024A0798556CFABFD47A40146691D32C0F179B5BB3C3088F2CB29E2B961B630610D1528FAB952DC75D23339C26A38F68421C12C2360F369ABCE128CD64551CA29455E02AEC7C359CF9182F5642F1BAB42814AEA8F2844AF15670421E0E113063B4B8C614487F6B6236DCB21E48613C0635E5F6A6A6E070FB665756F98156C65A6F407E1014BD6540A92E8A09EF6C944DB876250B951D16332251C5BB6B79F88928ADF6BEF819A241068B08337136B8BDC33476FDDB0292B68EDE75490DB193E267BBF2F8459FABB17D10BEF7018AE895995200453065AD45457E3E86A12C554DB3617A99613767598031C86BD5815585444DFA41CBE068034FC0A1CC2636D010230870776D2645DB640B409A292ACC909AAA11D0D05A1B1469EA2673020BB7EBC7381190C271E2CF73D37F61F12C8389843B0540117C7AB924C140D1409F701AB0C0596103A1AEF3C93A2A79BE19C7870ABE83232A7DE265A1A1280D30490FF50C414A006D8A403C50948DA4B1054B18BE35A8F9252079C5ACB2104BD42CCB51617839E07380FB3A62B3A5080295BCCA410215AB5C30A89B727363185363027BB1A6B09FE83233D79E4527371ECC8B879C81A25B3E6E088D2E786976396EF8D6C383495B52EB69BB718DD7FACF5F120303EA259FB2BC32A5269AB45E6BD8AB9F9456A68B869A4C13A0B6C98DD1BF276572EFC9A31591ACB33B9945919FD20495DB284BD4BA7C66620754E58396C0A191F20304B545AA2279CBE62D08EB4C82E60569598147F9910EF70ABF792D375420BB999E4A9CC28DB0193A124D0CC78807A54D13933B25B350A16C842E4B31337BC7734104FE564C20F27ED6AB800717BAAC4A9C954C6EC5238BCDF309C6FC497A6A9B9E4973D7D44EA53B90DB26912AC7796C327D24D3705DB5BD0266B17B145FD8CA77624C8ECCAC1C209073B2A639D5F135D06AA99635C9B53244E1F898D8494B681312BFD243C8EA5B7E71CCB7A5386E477D01FCA3EF4122A63934843450A446CAFF55184D052923A393FD887DF6B045659CC282D1424B19B17CC2A2384132EFF067A0347F88C6B392AA56A3519A440438D3F90F6941112124C91FC31187AB0CE6752D9B336A1E230F97837A657599E253B7798C912A66A48314447C352B84590941355C6BD1C0951374105858A46502EF39CBB58B8E63A64E2B99C4825912155695893A62AF6745E76058D551A946161F25F1B8FC045602344A7F342FACC50E9565C1D59A459D34233C1921CEAC6E0BD936B496C8FD6A619D8B0649EB458F8943EAC97293635092666688DB559D255CE9F280227755C3605D6ED007CA718527227FA1F40DBCD88792801D8DB6B2374A23178A72276C790F902D7E969F2686C9508186788905E77132DD909397F6B6BAD3CE77E8CD4C4A3B9686CAC35ABC86D57E911CB58B0C997C1935CA64918370809D3B1B70CB09641878E7C0A141573030AA2B687761BF43AC89A81E73376793ECB32DB53368EC9E079172E9AA482FD8652583B9155683DA3467E4546F26AC98371487527C37B6646CA582017892A188FB2440CA7240C3C22577230B59AB8EC038BB95CC49C2A2F59A4A22C0C482713544FBCA9D7404B3A6AD86E8764A601B7084289858BF62A2828D3091FF015089726CA23B1CA0F87195BA1ABF80B01F101F8584C15289196744500000B431A60267174F2CC56860BC5AB4EC20D19BA8ED47535EB42FE1D33F2980BA211805A3618F2FF64D1CC634CAA6B40FD23615538366DBAF41971D8B5857298C1E406A293C1B8B7F4A499A97BE8CC51B5382020EA9C7CF809FA7323134290FA461218F4A6F495CABA2D1511EA48B7E0905B0465F7A6711F2716B17DCBB4B9A1B31933D7D3622315C79F3F11A93C8058FBC01C4839A808A5D2D45B99F7918FAF52DB1D81D669C7988BA7EB8847187AC7B76404B1A139DC4E4917C9B4E29833FD9FBC36E4BBA96E25BDE691CE0C369ACE7183C762BD04785EFCC6B614165C014A0FC4B64B24B3B46418AC5B6B7BF69CBC75090B69AAE46B4A12FEABD4E134BCAF14922367B50F17976C6705E175FF34612CF7B086ED733DEAAB0CA815A53C99B2985963DB89BDC284D251340B0E3AE20990EE93344DEA18063DB6EF4374A331244EDE00B46676475937A9472C82E124B1751A9E4203BECC77ACE092B055ABF0892637B39C3A9A011219C88139277B8BB73B9508142421939380ACFC2B81523C72E923609A0505E2979E086AB85F9663E549F3350A694458CE7B02BD8716C0F8B8946A21D99D97632952BEE898989C1ADEB710E15BB25B0A22BE598A65465BF2B899719D00F9D16367E9436803BA8C17B6B3BF62A10A017C177125396BF6745163FE24C455319CEA69393CCBAE42508156167B28A1D1050BDEFA5A789BC389031BD86E72AF5F5BC80A215260737839654998295D5ABA8C11A5417B55D67201243393B7593400D46CCA1D321C027BFB09CB08A1738C88B7D47E876EF7517F8D96CC1C93B9E93B7062227A55996FA958A684AAEDA89587B015A6B336DFB610721298AC6AB713F3A2E37B2AA7B1CCD2A876F03C72546B861E351A73036F4B363137340EFA7764C439F68D3C8E0723683AA8254A66284F447029A2E12C3E6AA668AFB5BE8A82576813FAC7B8E61C5A88AFF94ECC2770C585ECD292E4C5F9E1A55E0489BCEFFB204D672A6215F4F3980A646D9F880817C52DD
-ct = B998B14D416FF33BFB8B90CEA80CC3B15F1B2B3904EB8BDF16AAF43944782D1158949BF229AC7DE3739AE24D00BE3C97354F87D52DB95D38DE1CCE5861C2C6B51879022ECB412C5A5F6B01968BA26073A2B4D50B3D5187EF0983EA79A5787BE6E23C148979E9AB236630819C8E115063514054590670E7FA6FF25913708DF4C7A30A193021311899BA6E7F33F749EC04679CCC6E24C23CBE59280213056D2C71F903BDB769B545CFC1BF53C9C9E825345AD6EBBC6A6086B19E160B1B11CCE7D76BE9F2E335E115A6FFBE367A3EDAB359216FA57C6DDAA927FE58D1A824EEA6BA19FB63C54BC9C25C83F24B51954E2772BCD80246776E5E5950A30F85E05664C54ECDCB55ABBEC7599ACDD9AC8FA721D6EF099C65E033D2CC319D9C6649D5491E0F7160DD4E7EB998442C45B28A6537B999952A77B908896560DE0DE523329C98E94E440814B9BCC1E3ED4103872EAC7DA049831DB43F643766B412BC417A18591AFCEF418F898B0E1CF9D7E8B3961718F3D8066C2A220F6323C68C2A208DC6503563EB2A0541CB98B50086DF84AD0807378360F0997D51C2A7F803CD3435758002F933A44D099A1D72E791D7B8753EE116D5B896A270C4D6559ABEC9EBDD1FD541073400208332D78934953F0C69C5AE9A3CF1E9855B54DD0080E1108CC38F83D6B4BFEEF37C49668B4AE5CFA7551A5FAA8C3660D92C8385CB64495E243423DADE733E03AF0A6E6513B4B272182BE4B5360673E68AE4999A25B090B063C956247AC6781A60BD0DCD72DA26186DB0597C7BD796C7676387B59148FC19280F6B125448600F19643A2B5C7B65DEEEBCE490928BB42C176D51A41650155B1A528CE6EE74B190032F7EF7D337A45ADB2E3BE9BBD0DDDAC77A1B9336B6560518D098BCC8E24C8CCC4C992B8E2ECFFC89B46794918D6AC78A29E9BCC724FA487CFE1EB6D23AF5F76CCEF6A497CE48A05548B19955174997961085133048F3CDFAF716B6097ACDD43CE2CA1CCC1ACD7FB02EBBA182837246D62C0D12195D8424BB998D093E6E578214FADC5CDEE3B41D11727677BFCB381E38F79731FBDBE585E4A5477225DF9730C5108CD0D4E199778168CA84233B35F362DC40DFDDC120C1E033C508A0673687461874F5FC402AF61A62E5DE21B4B62863557794A851DDDD094A20A59219748BF71D54D4D35A14EEE2098D90044A95B4ECE40A679CCF781214E8C85A5BBC8974206713C659A8915753434314117F9D46011C8C687A4BD867B81405E1B8C53D493FB2443514FFFAA6A11A02EE5EFB90C61F1B93BE985FCBE6189635A35F50F81B0457534FC5A76F541B67C2685BD06D9A00AC4A56DAE3AE6FD44841734F89D2E0B42C04F7CE9A4F0B5BA28BDFCCD378E60E2D6101FF560E379FDCDAA13EE79CCE316C4E4D4D4ADABCE0C1FD7D90FA81360B6DB61F8CA5192AFF6E174B227A2975EEC7CF1A01F6A4CA5488B1263C693F5208B36D21C484E205709D5569DA755E5818CE2D04A04B35063FC2A7AEA853AF1E1DB3550FC7B05BBBBEE59D94
-ss = 787ED075F818BE6A0EAE99B113DBA31002097E0B85A5480003C505A40793403F
-
-count = 43
-generateEntropy = e1953800acaa85ac02a906c72cb8e8d704e8d27820345f88f71e89c1f549afcc8c64c049c6dfc0f1476cffd520b055756162f7ec94243de6b14ac0b9e5fb366c
-encapEntropyPreHash = 060ea5d2ed1dd88144a9885e79278590821c22917b55a48920f96b53ebe0e689
-pk = 26AB73A3355199A1833A1268A37A087DDB57AB621046DB1F407C804C488E4196048CEB762B9024C2157E7DCCAA1A762881280715A1467E766DCCB159F4780A39BC4F4A59715700070318C2AE03706B639F79A8A81AF34FBF6C9ACE4843151AB5C3CC81AF08CE392335E4FA913052119904745EC68CF3502F4663BDA74522DDD61A318539E10A853BC90A5B06AA12018C6BAC4A8123719C567719CB723B420540EBCD84C2787F37A76C6C40FC983436C26F7FDB14DF17062BE752AF2C1F1CD1026856500F3831CCA75EFF7A08D4D9C819D295674550C1C951FF9A0155856C3CC143824556C09025D55B0DB7192D969926C18912BF5CA8629401B8C53E23832CEFDB369020583B360595541F48573BA1557FD0C1058A8CC5EA7CA7F092B7DC7B4B04490FA4E72A37AAC0E33B1746ACA327258D9D29ACF140C5F70B8F94A23195D60D30A498259C6F9D06BD69F82398953B4FD39ADECA972851431B59C9614B7867CB1228E2519AC130F003903D801F70BCCD776A9B916684CD89CD71723CA732A21FECBB90D547646B987155CF5425ABBB2406CDC1821AFA8DA120A540D1C3AF175032444E1FD85F43F47903665BE922636755B5E75A90931C66E89345F57CA4A032959BDB4521CB62BB1377DC5C99FBE36C71347B81A80B6B7251FAC3732475009A719F4374BD5FF01CCE4601E761A754E05756968F33FCAC4D6A540D93951D0BB4D0D838A3112872020C2DC67718888DBF408941B877EB6543432675C879AA85F102E608AEDF267E32D333CA9C3860F907F17B553580AEC75902EC304E6C7996EE34061B40A9F4F8BA2CCC55775490DC9C2A6D5C0134E809BD305D7445C9EBF7B89F9604146B2E55A1090597033BAB2A25A3886DC524F4908ADBE98DC2D74386806AD641712D9C23A19562E4AC7F57A86FC98663E455BD963C4E63D8471B504C14EB718D8BCD6475CC45687F55099F8FE2035F3812F081B6DF2A174999765CD69433E5312BE67698346FA1030A40943F8927B2CD8A1E2CF2514333BCE85A89A6A99D03C4A5C0B847550972F9D1448D1819B3582B99A50FF97C124398CFF30967013C4DC4D374379B4E8B037EB0E570AEC147A1C99CADBB651BFB576AD61BC5449C5737BC4BA4A01F24AAD80375ACBCBAAFEB564665A192211B4D6918260C1251EAA1014C6F41427465609310D8B665C6763639C71AD48019905CC0874BE438023936856017B5562A9EE79686BCB55E04A38EB9B3BBFC07ACD4865860A77AF3B5ACF7DB344F139F79D5953778124C2C92D29CBFEDC21678E54861ECA5CD350FA09B1365FB74435316F37386B9B510E2BC585DA30A71ECC7B9913921EC8D8FBA2DBC97807B693B1E306832507CAC90410E0576611BA79C1CA9C0B106D0147680790EC5051798592D3035AEF57A0174CBC70B435710C51695852841907D41A8180123A4D911787B674ACB513C84047BBD5851C3E83A8A046062C06BD84397858241C95B8D8D2A2C53038856247506065A70A5A29B701BAE1B488A68C2BF02472D86BCBFE263E7820902102C612747CD60344957A871C7774A0980B70B56F7BC45F8E2BD2085AF080CB923B55640BAB2AA2C30F206CCBAD17BC9F58C1CDA80399962268F2AE99C43BBC1FA7D8949CD772A745BD9AB018FD3F6ED02F32CD2BF845923
-sk = C842401604C8C4C78D8417C804C2723B14733044AA2755897F65987951218361A07AA84D6AF8A956454036B79E145C93B9D4B862146BD4DB824CABCB61FB91BC306F851C9E93AC266E3C9E9C939BE422B07E512D28503A6EFA9D3EA8861E39B1AD481B8AD1805A8C0D48179AA1203C2ED7BB59D5C8EF651281C77F83AC7B49EB997965B161DB025B47CE6E2C09EDD41F5EAB1C8B7B4D20783D60C90DBFE6AC387B629BE10351868186F6A0BF68905F8C1CF34303FB577C25212919533C7044697D9425BFB76BD9D367F43B2D3613351D95395F4C2BAE63B2A4608C69364F41E85D542A08F35B940FBC3B48F63360B50AA88259C7CB4634E5A34300C5957A3644F6AE381389B53210110329FC61519113C17E64782239941CFBB11A647B814372E313205844592CC3C17319B41FF21A0BDA3F5ACAC3F18BAD085C8F27B7758B7519316653BA9C253DC94CCAD37F98D00B9FE67E2A13662C77921E4A9A86C8089682811E53A60B1089A1038483E615E6EB109A3B7636E02A44C2C3A81B96D84336CF594D24172BE1BBB9C7B3685EA45E45B81D731B9B75CCADBFDB768119B20A0C346156CBCD5BB107A00A0E3C6E949B9DB0B4AE21026C915908C5F38413C648EDB20623F35B382B0CD5F4A8D7062BEBBBCC9E809BDBB5C84042BCE2E81BB0D795C6786AF95A7E7B0629F7978A03558F98709A86319570273BEA71986AA92560260D022569D4C98A85BB98AA198DEFF63DC6BCCD1E6032EBAB8CAEE5CF4717B17D89125C67A8A472C371153A4FC9045FD3304A74B983936060F42C80454A005342C1318A284BC5B9A71A39E748A94739536B517DAC1619C00DB64C81001ACBC2793F9F29B42214442FBA962F331D48C300DA2186D21A4DE61C4B5948C7EDD1B9FA5865CAF2280A81B9F7171137D6A678C92745B1AEB9DB686BA84D65F6BEABE332FF036BD113161FA068E74032CA5736D3EA3A01F1ACFE067DFE5A5B398575BB9B148EE6155BE2B4B67B348420CE758C5855102FD06A1FE8D347EF1B073F064F1F7926BE5B2343029E5B7468E93B8ABEC6BE231B6BEE714031E04ED23C6DA37032ECC00374706EFF7453DD931D80029382F17E82A85AD7A8B25EA97D1D2AA21238B25517008B0400281168328B02869889F7F142CBF1AE8DDBA5EF2713DE649AA9AC56229494DB211B90B96AE3B2829AE528C634110A3BCD355A243F3654295B0B79B9B7D43272321959B3632313AAC107C8B7AEB83172778B7B199E736307FDF5AC6AEB40CFE750B7227F46A00B9000880D405877B63FF6C616BF4A51CA11C863A79B0E099308B42CBB7997420008268A3B762B9A5E181DA14A4A92A5B55E7950268A9A83402889A98835CB9562A5A627750A5348B3398B39783009A081A058BBABCC7740AF00B8CDBB4E0842C7F14B47FF4CB424B6252CCCCEE30398023A9B50B4BB4A2C1FF0A007A0A54EAF421FC2113F0353C7A1DA6CBF3C7F5B448B86534FCE3B3B82C3B82C3420BCA7C865AA22461B3D95522E9792B37B78C5555A62A3439F3BA7646076111336079BB8352A286E542094BB58B07CB832E2B288021034ED4934469B1723E57E57E358942730196140F47658258A761EDCBDC046C08BB89726AB73A3355199A1833A1268A37A087DDB57AB621046DB1F407C804C488E4196048CEB762B9024C2157E7DCCAA1A762881280715A1467E766DCCB159F4780A39BC4F4A59715700070318C2AE03706B639F79A8A81AF34FBF6C9ACE4843151AB5C3CC81AF08CE392335E4FA913052119904745EC68CF3502F4663BDA74522DDD61A318539E10A853BC90A5B06AA12018C6BAC4A8123719C567719CB723B420540EBCD84C2787F37A76C6C40FC983436C26F7FDB14DF17062BE752AF2C1F1CD1026856500F3831CCA75EFF7A08D4D9C819D295674550C1C951FF9A0155856C3CC143824556C09025D55B0DB7192D969926C18912BF5CA8629401B8C53E23832CEFDB369020583B360595541F48573BA1557FD0C1058A8CC5EA7CA7F092B7DC7B4B04490FA4E72A37AAC0E33B1746ACA327258D9D29ACF140C5F70B8F94A23195D60D30A498259C6F9D06BD69F82398953B4FD39ADECA972851431B59C9614B7867CB1228E2519AC130F003903D801F70BCCD776A9B916684CD89CD71723CA732A21FECBB90D547646B987155CF5425ABBB2406CDC1821AFA8DA120A540D1C3AF175032444E1FD85F43F47903665BE922636755B5E75A90931C66E89345F57CA4A032959BDB4521CB62BB1377DC5C99FBE36C71347B81A80B6B7251FAC3732475009A719F4374BD5FF01CCE4601E761A754E05756968F33FCAC4D6A540D93951D0BB4D0D838A3112872020C2DC67718888DBF408941B877EB6543432675C879AA85F102E608AEDF267E32D333CA9C3860F907F17B553580AEC75902EC304E6C7996EE34061B40A9F4F8BA2CCC55775490DC9C2A6D5C0134E809BD305D7445C9EBF7B89F9604146B2E55A1090597033BAB2A25A3886DC524F4908ADBE98DC2D74386806AD641712D9C23A19562E4AC7F57A86FC98663E455BD963C4E63D8471B504C14EB718D8BCD6475CC45687F55099F8FE2035F3812F081B6DF2A174999765CD69433E5312BE67698346FA1030A40943F8927B2CD8A1E2CF2514333BCE85A89A6A99D03C4A5C0B847550972F9D1448D1819B3582B99A50FF97C124398CFF30967013C4DC4D374379B4E8B037EB0E570AEC147A1C99CADBB651BFB576AD61BC5449C5737BC4BA4A01F24AAD80375ACBCBAAFEB564665A192211B4D6918260C1251EAA1014C6F41427465609310D8B665C6763639C71AD48019905CC0874BE438023936856017B5562A9EE79686BCB55E04A38EB9B3BBFC07ACD4865860A77AF3B5ACF7DB344F139F79D5953778124C2C92D29CBFEDC21678E54861ECA5CD350FA09B1365FB74435316F37386B9B510E2BC585DA30A71ECC7B9913921EC8D8FBA2DBC97807B693B1E306832507CAC90410E0576611BA79C1CA9C0B106D0147680790EC5051798592D3035AEF57A0174CBC70B435710C51695852841907D41A8180123A4D911787B674ACB513C84047BBD5851C3E83A8A046062C06BD84397858241C95B8D8D2A2C53038856247506065A70A5A29B701BAE1B488A68C2BF02472D86BCBFE263E7820902102C612747CD60344957A871C7774A0980B70B56F7BC45F8E2BD2085AF080CB923B55640BAB2AA2C30F206CCBAD17BC9F58C1CDA80399962268F2AE99C43BBC1FA7D8949CD772A745BD9AB018FD3F6ED02F32CD2BF845923E3EC3671CC7675A321AF8584A0961101C04A432772431E77F5740BA3B2EF488D8C64C049C6DFC0F1476CFFD520B055756162F7EC94243DE6B14AC0B9E5FB366C
-ct = 2CBE4AFF154B9B03FA6B19F8A1CF698078A1876ECAD645E7BF54C76787FB3A9E0E8C80574671A194238B8E9C7C42EEC9BD0A07618D33654F392C2E9D8C2A817A4F9F95232E603B9F047A379788EF8D0C548929544E393BEBBE5733ECD4BC716B0B6ED6073E30D93A064D5F714E697446821D182968FBF5A116D7E3BFE5B941A9ED42B6C5F9EFB7252529F8264200387B846AFBFBE670D72D00708B663262EC6E80308B0DF2EE80CC1320C091F8BF309F84FA5941CDAC43906E009C29A7F7B2D3D300B6DAC7DBC0551A50D449585737D7502C37A06C0297CD0AA7F49AC1CEAB3EA844EFC57851816CC01160AA0E62D5330464EBF8DD7A52A126B4CD8DE48E449749F61FCD56E786FBF8AE843FE7E68F050778BAA5C871EDD2DA3141C59C0C92A2EF8F7ABB6FF994843B77599DAFAA571A2AFDC0D5CCAEAAD4F9E025002D06F2BAA7EC5540D81D19E37A46D1DC4BF96F0F85963ECEAA0ADECE063B2730BD51C1D46A345F25E918ABF9E056F8B8D6AE34FD0E0D06120B3D91661DA17F8E4B3E68AF6915D33ABE1ED9FE8B81D7A6ADF08043F0622F5544FC9450D340E35A27B78272F70348F122D744691F5350AF7A3FB6508FAAD9EFC859FB712EF016964CC7D07940CA8B3F2581F29265369EB6D3F52B05CC82549B325CC3F8B2A4EB0A321700EFA8D86F575EB58C73199E02D04D106E0BFF79F65CEC84995DCB55FF4726B84957B25175A47F13368DE3806B386397DF10E64C365F2821B0C4C52AF2E9FB4BF0989F97D102FD70913E0B8E1E6A540710B62006EC62CFD7F907DAEDD28A7BA49BAD94F60698FDC0E6AEC63B3379D95BC84DF7916AB5A07647A777022BDA537F7E8622C642710CE2D3B0B5024E137D46080217BFB3B28EB4E58C4A9537745C88E5504AE10059B68E1FABF5AB7D3563AE2BB167530B9F9B59ABC5D9315A80318EF928CD0C785383B397F3D0244ABD0E53CC2C8E3ACE455964A66D79742C1EE9E871DEAFF22AB04DBA95BD5A5E41BF08CB7DEF3281E4D5DF9A1FAA70CF30ABECFC907A3FBC64FC3E18E8C86F4BEF19BDF096A311F0ABC76692730FA86C39EFF9451EBA149118DE84A70CD6EA2088F52EAAEC913214C79BEBFC6189E0BFEF3F058358C069A5C1CE7F55A00E951B72221BE1F324190D03F6F2005588BCB76B2BB2D5DAD1287D5E60FAC5A4C07331AF3213EF3AA063AE15A26A983490310AE8EC1F1B9B9C1495473207F0C399D4FE27DC56BE8BB7C8AF3AAC5344CEC1BCC14BCC15CFA9A8F2D58B4BCB5A6515E8FAB65EB21731A6465465A2F16D7672AB6E7BDC3F052727A2CCBB03F76F2444CECBC52B5C79E32D757DED4BD925625E3779BF3725402480F1134D707D9EA3D6A6A30D36B3033D3019D7A537B96EB47908007A396F85B5E20D2667149A3B09A3C87899B58FC1BA0C36A1FADC5D4CA07D435798E1C15D01695C40C6497020AC8BA979E11062957416CF08871AB93BFF007F86C771E3750F7E648C37C95161DD141A80D72F7D73200859FCF81D60A321962A5068CB33A8F31C
-ss = B81E1EA69C6A6E1737C78FE18C36CFDCD26CEF62DEB805F22A92C49DF6596C0D
-
-count = 44
-generateEntropy = c719f9b2d16399b7326ce4eca30dabefe8fdaab18e9f6df888b0a134ef355570e40771856eb77e4633504899fcb86c6a3d433d0b8d60e26f07bd61f1d4ed69bd
-encapEntropyPreHash = 10ef9426f8c4a13b52325c5bb4ead4596ecf2c6b5bd2d37d8350e90d4164fdd9
-pk = BAC16E6E3C5E5D9C8CA207A5C77C7883B917FE0463D3101962B802549A87BF39B9BC7A30A5B654C9C96B14BC61506371E4768429DB8F7C0A6204903B9BC9311C66B907C5825621B7EBFB52F6C7CF75C169C17129595631A2FA95920317AAD4CB338329ADC69C6795158558638C474710C78763E012240CBDC2E586ADF93C028522321A94CB766F9E983FB5110A10476ECBA92FC0C120CC83632409940DB249EC569ED5740471C86623B06962910307781349F342C759886F7C376CE708091019FC407EEAE76409387D151C97CF7270319143471A84994BB596F9B5E1A78D33428740FCBAB415C575E478DB4B4E30771802E409B8C1AD4ECC9CEC1B7396E664645CCE83A40D512684E0B2750D8445D2180BE5B4CFC09BC9FFFC8D6E49B49D68C4D849B584512CBB55283722CED5566149811545609A4C5459F523C1C76667859760E690385F65768331B7654C30B8C0B26F2B8089A3C5B4F21EED42179C54AE61D22736512FA3AAC6EB018946A47CD79ACD545719C829B304477541EA92B10A1CCAE8B36BA83D5AD83083FCB51DF653CE899227C52581699B7150456CFA1910212F7678056A33755DDC7D0648164AA297F196057060009DEA8D87E86B6ABC0106A5536D7C83933AB12E294B4F50870FA0BEA16AB49B88A60BA7790549CCC0E6571E81875D5632DD8A5627E48E0395BB4C243ED9D53CCE7B591949408D2C87A5E295E3C3231F4132E1117B835529456A53D3D748C16280F4D597573685B04780F611094C665C66164A1323C290BA8C8B1031B142A3B53062AD5C59D8D112F9926E5AA591ABA711EE2BA1509AA09B86C60A969020D74E238B849374BCAE7788FAE61296D5AC7AD0927EE30912C4287E3981B7851D5823295076365196BFBEE4A3CC189020254F31B06FD8D70C43A94CF380C01936465A334FA59B3D39296305DC8B775269EE204639BB3A30AC437936CBD734A5C6477B2A451EAA0159E571BB12473B77698621D5247EB5012F608C6F070A67551F6F63ABE87BA12A56B2B2DBA44BF72E01C9A2C490579D2C103CE91A841C4F4B3AAFDDAA0CC3D33D31EC3FFB4A3F9AB87F93494720D386BB13CC482A4ADAC46395479D1421AA91216BBF56BCECB89F11588B4085A62BA0A47EF9A184C2C9346525CE006CA4819857FAC8B1498C9CA1222175CA5B01B6BD502F69F8977A0B3B04987A1897A8F2F20DCDDB098AD070D15C15C099A5672C17087C6B58245BC25C382ED3BFD5BA9B8E48932A27546A089113F37E8C85971FA10D465970D61446F106CCA6200F85EB2DE2947BB4EC57E58C1F7BE6B6FBC025A4A41EB05C516578AE9BA4C197B692D20976116BA35660CC5B612B616269A837012230B65F2913E5D0362D0B510F1272716A4DD2832D3BACC914929FF33354C01217D8A0745C9263B5D80A4F497D99D98A4D895B59A59A1DC173CA6945FA54C398F351C8C3AB8D66CB8971A68157CE3CE82104094FC83C7306D242F1F0497180842BEB8E126988C5A830D2A39C2711B033490FE1D53E432C7A453B4CEB05A5644253797135231228F246BC6A1445EFC16B2F2BC674327A62EC32DBC209F2C4A5C600920D2856DC34549BC4656F7953E697CEA6F2891FD65321F89BF2D90CF3DFC681C2FD81792135E1938CA482EF3C253D8976201852444E
-sk = 0C9C633FF39D1C6C29F8356AA02981DCF189D6535E2AC00750C30B111A88B21024E4823E7D543614F30112F7C78F1679DAB68B71AA992538658FD0C8E2984ABDC09647453B3FD99DD860238CF40C9112A7DCB57E06540148EA4AD6F97020474AFB65C5C67AB4FDB1515C6592941B1E38D4097155BD194B5324F464DBE678ECE9B5F8F57822F87ED7F3A6B470CA3FEA3314B4BB404CB66E3BBF8F2953F2682CDB65CFB47906B3962443775796564D75CBB4B9BB24A8A98D7723269E8204BA89782F974AE591808E97CB2468252C8539C2454041C9232F33B43ED8359DD6856C98BA4FC09E92F9A4AD497F8F1159E159B5AF795AB09C20AA753931F47764B6CBAB6968C7A779802B469ABB1E7F677A0A485FF5CAB2F028112EE8C35152703BB14127B33FB00A0CE21CC607E49A73544029BACA215A67091A9AD89A408794C4D2DA78557B1D31686C6B4C3749958EFC60891F12C9E0B7C19613823EEAB1D8F672089339E46C16DAF0C3B7D53727605C26A723518A2651D8762AC373817BBDDBEC1EBCA2CF91FA2A66896C55A4C946A791E5502FF19AA21CB132322BBFD127C10D87563028BC49B222E5401ACDC81991828E4C111A54566E5724B40A452C0F4632B7B85F0445C881938134D516113560B0065BEB409FCEB25F796C0BA0AB190FAC0214007916CA93C2ABB11BD88553AA34C3C518BFEC423728C86E529C300A1F70225F2F683911040FF9405614E1BAAC070E0E90337E134E3C93081514A937F9798EA7B57B3A3A0B829A2697B0778C802116C067A5C368576395C43D33882F97C770519C16426284E19BAC180A2A6CB85D65B1A115316B08541DC231C123C184E82C691F20749A4B92F2D1040D09519DF7678AC282FFF9CF5124ACBE04388CCAB61BF71B87AB3B830A3EF6700A68B06770012424031E89A895AE81C8ACA9169D6495CF01CD8BA0C27AE132C16AAB0EBC4B13ABB37D67CED10A0246E87BE1233FF09A6802F6371858972D21B48D410D8CF3A8A1E664F62028CF851A134037142C20E8EAAD7DE32581B39B5D93221CF72124A73DAA2B61F3D7C8F25A973A815B351206800BBCBA60AC8C2A86A7758B38339751C23EA5523D84EC982A260256C69AF739349D206CE9C9A70DBB0A950A0B63815994A6878711578BC22942914DF8489EC5A09258EBA796E8A6FF5483A71887E55783A94201E5B88898870E67D32EAAB132519624F4B28F22E80903E591331CA792C0CEF824BC62168BE6EB8F7BA299BC519B0C370509E38377F171761521F8FC882D1B8D0DB3C2109A43D1754F75529F7B071B7492B753688FEEF12FDA217CCBA484AB79192B7933781811986430BCC010B50A5621EC15DC7BB545CABC77C336892A0DF4436E732B905D70769865CDEE0A9906438E9D921F521862A3227BAB93202DA0CD19F6221BB68FDA8155AE38132CF2A30A4A5C3DC0B17DF0016FAC3BDD56CD9D06CC8F2C6B4AC41207FC1AEAD0CD87506CAF5C043941513F0A4ABF725818C7686F0745ECE93C23F2951EE263F51A3FB3630076DCA4EA80A156DC6B4248246F638024B8782C9757E076CEAF18CC27284C321BA91766454640AD32D97E65650B39C9B23FA80405F8CEC82ABF70EA4FBAC16E6E3C5E5D9C8CA207A5C77C7883B917FE0463D3101962B802549A87BF39B9BC7A30A5B654C9C96B14BC61506371E4768429DB8F7C0A6204903B9BC9311C66B907C5825621B7EBFB52F6C7CF75C169C17129595631A2FA95920317AAD4CB338329ADC69C6795158558638C474710C78763E012240CBDC2E586ADF93C028522321A94CB766F9E983FB5110A10476ECBA92FC0C120CC83632409940DB249EC569ED5740471C86623B06962910307781349F342C759886F7C376CE708091019FC407EEAE76409387D151C97CF7270319143471A84994BB596F9B5E1A78D33428740FCBAB415C575E478DB4B4E30771802E409B8C1AD4ECC9CEC1B7396E664645CCE83A40D512684E0B2750D8445D2180BE5B4CFC09BC9FFFC8D6E49B49D68C4D849B584512CBB55283722CED5566149811545609A4C5459F523C1C76667859760E690385F65768331B7654C30B8C0B26F2B8089A3C5B4F21EED42179C54AE61D22736512FA3AAC6EB018946A47CD79ACD545719C829B304477541EA92B10A1CCAE8B36BA83D5AD83083FCB51DF653CE899227C52581699B7150456CFA1910212F7678056A33755DDC7D0648164AA297F196057060009DEA8D87E86B6ABC0106A5536D7C83933AB12E294B4F50870FA0BEA16AB49B88A60BA7790549CCC0E6571E81875D5632DD8A5627E48E0395BB4C243ED9D53CCE7B591949408D2C87A5E295E3C3231F4132E1117B835529456A53D3D748C16280F4D597573685B04780F611094C665C66164A1323C290BA8C8B1031B142A3B53062AD5C59D8D112F9926E5AA591ABA711EE2BA1509AA09B86C60A969020D74E238B849374BCAE7788FAE61296D5AC7AD0927EE30912C4287E3981B7851D5823295076365196BFBEE4A3CC189020254F31B06FD8D70C43A94CF380C01936465A334FA59B3D39296305DC8B775269EE204639BB3A30AC437936CBD734A5C6477B2A451EAA0159E571BB12473B77698621D5247EB5012F608C6F070A67551F6F63ABE87BA12A56B2B2DBA44BF72E01C9A2C490579D2C103CE91A841C4F4B3AAFDDAA0CC3D33D31EC3FFB4A3F9AB87F93494720D386BB13CC482A4ADAC46395479D1421AA91216BBF56BCECB89F11588B4085A62BA0A47EF9A184C2C9346525CE006CA4819857FAC8B1498C9CA1222175CA5B01B6BD502F69F8977A0B3B04987A1897A8F2F20DCDDB098AD070D15C15C099A5672C17087C6B58245BC25C382ED3BFD5BA9B8E48932A27546A089113F37E8C85971FA10D465970D61446F106CCA6200F85EB2DE2947BB4EC57E58C1F7BE6B6FBC025A4A41EB05C516578AE9BA4C197B692D20976116BA35660CC5B612B616269A837012230B65F2913E5D0362D0B510F1272716A4DD2832D3BACC914929FF33354C01217D8A0745C9263B5D80A4F497D99D98A4D895B59A59A1DC173CA6945FA54C398F351C8C3AB8D66CB8971A68157CE3CE82104094FC83C7306D242F1F0497180842BEB8E126988C5A830D2A39C2711B033490FE1D53E432C7A453B4CEB05A5644253797135231228F246BC6A1445EFC16B2F2BC674327A62EC32DBC209F2C4A5C600920D2856DC34549BC4656F7953E697CEA6F2891FD65321F89BF2D90CF3DFC681C2FD81792135E1938CA482EF3C253D8976201852444E79836213A513BD4CFD42ED281304E3EE4560E4E0C60FA53781F83D5BD2BBEA52E40771856EB77E4633504899FCB86C6A3D433D0B8D60E26F07BD61F1D4ED69BD
-ct = EB1E2D9E00EEC89D9C0133C36834B7704FCB880E87D28F6400D5B6FA85C9585518C29C860958C2B6B1A239BC55B212796ACACBC4A2657D67DD1B61E9C36EE9682FAFD6E2231883B27587CC5CD4C36B7BF29D982D729BDEDABDA928370989F0F3FCE00A44561EFCC2A5B77F16B4C982554783D43CED6A55BAAF9FAB462813A8BB2A98CF16478AB4F1E79D0120D753EC0BCE0B4884FB27E02FDB881F7B28023D91E23340A67DC9E61B64AB16AEC77D36DCD0CE1900A7C6F3758A49D36ACA01E8E24711171F756A3A01923D896BFA63763244794BA3D01710FE2EA4064B70702ED34DB2F715B2E59683EAC0E66B6BB392DC22FC398CCFEF06764CEA27A3E2FFC329DEF35F16F357FB9A7ED25066B6A6310EF657FD348C716B468EBA86594CE6A5314CFB9BFE3FA04F849ED485459980D0FAE670A2134908C38727021AC148D041B496A97D09EFC807F2EF9A2DBE5F1C3043D3082A9E8108C020CE7B7CA6777FB3275CD0C8F8299E8CE81C1972C079BA37BF2C8BA717DA95E26225F7CE0D32A96D42045A1163A384988DFBEB1C9C68F142F1DBE10BE93F0FE5B2A2E4235ADC8300DE98A6FDC2EC76D34C4EE15DCF33DC939E80AF2DDE285E72D33E4E49A6B7DA54E5E29A072C5D19BA548D714EB4C50C9E8FFAECF92CF0B66E2D365127836E4B0B6151F29F7B8081E7DA720AAE3C66EF3D7FF2AAF0693858403AAFB7C8CFBB4104FB2F1F286DBDFCDC9A9652C724CE3F46396DA21D18A8CAC249FB2C564C638A90A3BA10295A3995557E5A171626323B1D5248798E99C8A5E0AB96EFA39BFBB2774BEFDD5939B385F881FD60CF6F86697141738307F8D9EE27863B58D83DEE565FE12308D56887AAA93DFB8DAD892792E9D2E417C4AD98E93969182BE4EEBE50102B2DF3FA72A21D271913342283F679ED232C1CB519F152EF163E3CB85D2C3F7A5E0BD44106ECE5FEC8F7CF339C4ACAEF04A1CE520EF5AEA622D63738848D7E9AC753F95267D141F4369A1E2AD2117C57523342A32716FF775F332DEAA64B6038A4099A8AD44ECF7F38C1395DD2C45ECFD9CFD7F7E3565E48EEA8C90DAF62908C402E2A421613BD321D7DC3065B6825BA8A3ADD20EAE7A9BF762446023F2DBB70AF8722C9B1CB20B4622A79F442C548502DED82CE1762DF2131BBAA0A5384B8ACC0AADC823A0042B91A8A3D32E8B003794EFAF87F28FBA18DC7D4EF29016F59D952722CCF1CB27771E5DD17F395BBD1F1FAED18BBBB579E8FB8F5A704AB587BA645EF4B51EAF09D938C30F9B79C7D67D665A9824738A547FAAE4A6C0953A3C529209C175AC946F733C5606516725A1E0626BF684A4D3AF865FB95EBC5ECA314369D5FC97B53A76FF921371E0F161F1E8D32B471906174A0B667B9C16881442FA631A169061E6B545C2BC32528AC40370884F3E9F362B2CCA5461A92605B0D7D270176B68EF60645AEEE9948FBCC1E1F26F6100E82C1FBA412F5D5BFEE5158044416CD9D4C041B17503863815CAE0ED0792052318B288B5DA1CDEA8C0A49AC381376
-ss = 5D014FDCC992FCFCBDF3AF29E8DBC9E5024F2AC41E71A3EF0EA43A063BF44E79
-
-count = 45
-generateEntropy = e9acbb774be970206c3a738e243b420805a509fa59fa902044be2f0d013650d2ded5edaec5de3bf5b4d7c2f2e18e87f499c1968993eff196753db8045e2c8ba8
-encapEntropyPreHash = a4bd30a64cbf29a4e290fa1cc1dfb99e68348713041e4409a1af23c5d80c15c4
-pk = B873B2397A7C7ADA2F4B0B589EBC97C50174E4317ED5D9CF2878C924937BD258BACBFC83283A218D443D8EE43F8CF3C64459B189E6B3AD100A6C6A3EDE9916F89B8BB67CAC332C0519F502A4C427F5C9AF1A16A59A2122521A0C624A20149765E986339ED63567CC29CFF15D7E8AC026C96F08D6AC4E057DB4E66361B18CCDC3BCFFC300A996AB7346232DB7310662C75B39AD7AA080B23763ECE54960397B8DE836071B8914D56F95A681ACCB8FCB9529E5E4CFC2EC0601F7B0B291524E180AA0A69FA74AC2F17AA88162C481F51543A5A527DA5C42B59F9A72B14DC91574B51E5806ACE3F022D1F19E3EB621560478BB70BEB8407719A01E16313D2F0C785E3B9886F679ACFA465BA974676C0689A149AC04996F4132DC4974F2FC322B56115A64B0B5DBB8DC71869CC655DD61390B032F062B024BB71505640A41CC6174B68870DA11EAEAC28AD061F3ABCCF4E12231655EAF9285B205251EA69371D90527793495835715AC005868A78B1CAE80025426848C4AE869B52034BB266E1B97480AAA7A31E384780442D9933FDB750EFAEAC0BFA802E5314D28A17D374CAA05B46121E16362E8341DD923A66872DF3C942177B58951C40AD1641F53A53D8708EBCC22AAC67EF262B6155007DC6880A1F45CAD3A5312B282055B1E0B181D9B396591FA78DFCCB9D6A92D5CF8189C14C68CF4238654716F0A1E4F2542CD35A7E4E2185814C1F5B16D8C423213C69D5958C46960B8DF589C185087EC5474DF3C5112B5BB6BBCC6AB7160ABDC2AB28801D775CAAFA049479A837CFC8847763559EA86239889385BAA43A2848B489087FB43AA20ACD7AC05606767798500F9271271E52032F21FC2A82D8D15BF774771B69C570EC488053743DC5398C4363AEB3932A5C54D16F45A033386DBE3B2D0A851116C2CD2FA4671B95CF7E60BDCB4976A2393647B714031870B1A6B2D486A5CF2A8093B7B948C9418F3A27F6296EA12336B8A6DD5A5715CE9A70DC6978038369A10332E3AB6C2971961D5C66441ABC3290113B21C46E96C509AAF09E658D9B77928935B9A122E42BBA23F920B58EA48F3F19A7924128669C09E135F772C275E55904400495153A691794A8D182EE1314446371501E87C41A944F850C9CD288CC2EA90A4E27864C79E554CC5924C4CA9A217DCA424EE8B76E49993AE4B085E9809EAE27401EB9C6C794A67A31705876243478F86D5B9F9CB3295422816526439950A412B4D1D28A70C6B9794C959BE155AADB39E00B418EFD0664B08843D20B71C547F1468C5FDD92B9D818336282F34F19B515946A7961B5A9319D9444CDC1ABA840CBB57272E4DA4AB20FACD5FE4958A57C3C812978FD772C2862DEA8B60B30A601B692DADAABA0F361CFF27C5C734A42265341641B861B7899CB311E7E0ACCE396BCE2809F24289C5361B91CBA88493991987C0ACA3B070411481E154104C15780ABAFE725DD3E1ADF00BB0EFF4A29298AC10C63FC0669DF6379294AABB4588AAD2087C9C16C9AFB654F0C9C213D79CEE1A843A84742D574DE252A4F24795E9AA631D5198F07511160300A2E02A402B4CF8AA556CE67BD341307CE5A1EB6609EFEA3F066379865489701783B2C95EE6967F0893D44D76104BF396577FD719D69EB306117F3ABD65385A87AF12D1BB6D0433
-sk = 2ECB7CAA911A2F615A13CB82E5A8BE85E1C2BCF06C71B9696682532639B57A91537E470E8514390949CFADC80B0E5C3EE3ECA869E22250560D8896B5F6EB0FC6EC0A6D01760C9108B7A26CD79039BCB3CF9EA0432FE0581626CFEDABC12F758B407C8E9DFA373F45C377FA6D41A7205A7322B737CDABC8114DF437E864C4ABBB3DD084964F971B36E24406A7A7544A260D917C0EF95CCF33B1833BB6D4232BFCE37B96004ED7779258FAAEDD9ABAEB5051D8F605EB85BE0F9599FF28B40587488FA376729685A8336C0DD213F55447E2C4895111B98E73BD783B2D08960ABCE22F6F894AE5456577A81156C66F6F1BBEBD9C04D1AC43B77936F13060D3305A3893A825781E47928FC492ADC16B31B2669882FCA10581603B400F297B7FE7525D20E82958099B2D118ED3A14A8A915731525C470B7852A9B0EF04B4A3B0B65B4C5D7D486366175540A91E752993BA979D8A446F94088C7C3A02FD5C051F900A141957E63CBD71AA012DB60A02B3872F3A623218A6B1F628FE8580E8725D9FB647F128C2519A8A0CD0649671616B462B83904CE621C95FF44697CA71CE930EAF0B28A6448A1C6B38C14800427683B71C954E49B6A3B978417B78DDB1A1B9729B89160B4C7BA49F312E23632460913D82D655D6E00B5B17A635827D8A0781E12A68C536AB40909F46A7173FA9CC9990371DCBC0B8A433436133AC123A73664A14E1409B4476AB001C17F26EBE968ED8C6A9D491B92F234499435E2DF615C849BE5F6422C8BC9DE8F148A7C0713D93642DC852B33652287010F02B1D7B77972C797ADD3A38651B4C11EA968CE53F10D38DF4160101FB0EE557BCF5B3328E12150A7C0D769812ABF2AD2C1C7661844E6B34B25E7A30EC64B6E7D4282F48344BFC6F33AB3C428C76705CB9B1E9637721C9EE60874017013374082892B4AF174749041C606B3F6690146BF1B0C8D2844F80594F265A8FB639E209C9B7FC418A230AAF340BBA34C1C66B7D570918ED6CAF8F62768620058CC7CB4FE1C762AA96A5015B82216E204C5821022CAA84AF9B12B9C9BC683747A2724C88E650539779742EDCA6A6A6C5F5D68FAAF73D4CC7AAB9B105F3A1B46CC96C915912E807AA6C841F6BE63812062ED1D07BC9164ECCEC7E6662056313CC32F63C6181CF3343ADC9073888D5756F508D65025BF6490A5F6B164A942466E60C4410C72AA69D2CA10459B890A4CB22A7613D44E70AC96ACA21169F932A6134D27A6C05582E830C0BA137DF060C6249B360831CC6B993E3D455C2E61694B11B520C64078BB552A65A3BAB407D46C0EE173BBB52A95C7CBD8612380FC0CF1655C8E691BB0493103EC80A5FC92B4951A0D78768504284AD52580F16247B3C44AF0A397F28CE3D0C0E4D34CC48B26B3998B060F2A9A013889685446B6281B3341C08E8300A013390A881A3A4937B412BF4745B069ACBF5315B9955AA4999BA827BCCBBF776829291A9067272059104522D69D1834886BDE76C078A6061305833FEFA710EBBC0DD0729493A285ACBCF2708CF93ECC76B85691E20BFA4379C8521420C231F68429BB5C76E69378F6EF3475FCA5760A5BE829C2B4FA955E0E0931423B0A615194C26225BC538E2DB29B873B2397A7C7ADA2F4B0B589EBC97C50174E4317ED5D9CF2878C924937BD258BACBFC83283A218D443D8EE43F8CF3C64459B189E6B3AD100A6C6A3EDE9916F89B8BB67CAC332C0519F502A4C427F5C9AF1A16A59A2122521A0C624A20149765E986339ED63567CC29CFF15D7E8AC026C96F08D6AC4E057DB4E66361B18CCDC3BCFFC300A996AB7346232DB7310662C75B39AD7AA080B23763ECE54960397B8DE836071B8914D56F95A681ACCB8FCB9529E5E4CFC2EC0601F7B0B291524E180AA0A69FA74AC2F17AA88162C481F51543A5A527DA5C42B59F9A72B14DC91574B51E5806ACE3F022D1F19E3EB621560478BB70BEB8407719A01E16313D2F0C785E3B9886F679ACFA465BA974676C0689A149AC04996F4132DC4974F2FC322B56115A64B0B5DBB8DC71869CC655DD61390B032F062B024BB71505640A41CC6174B68870DA11EAEAC28AD061F3ABCCF4E12231655EAF9285B205251EA69371D90527793495835715AC005868A78B1CAE80025426848C4AE869B52034BB266E1B97480AAA7A31E384780442D9933FDB750EFAEAC0BFA802E5314D28A17D374CAA05B46121E16362E8341DD923A66872DF3C942177B58951C40AD1641F53A53D8708EBCC22AAC67EF262B6155007DC6880A1F45CAD3A5312B282055B1E0B181D9B396591FA78DFCCB9D6A92D5CF8189C14C68CF4238654716F0A1E4F2542CD35A7E4E2185814C1F5B16D8C423213C69D5958C46960B8DF589C185087EC5474DF3C5112B5BB6BBCC6AB7160ABDC2AB28801D775CAAFA049479A837CFC8847763559EA86239889385BAA43A2848B489087FB43AA20ACD7AC05606767798500F9271271E52032F21FC2A82D8D15BF774771B69C570EC488053743DC5398C4363AEB3932A5C54D16F45A033386DBE3B2D0A851116C2CD2FA4671B95CF7E60BDCB4976A2393647B714031870B1A6B2D486A5CF2A8093B7B948C9418F3A27F6296EA12336B8A6DD5A5715CE9A70DC6978038369A10332E3AB6C2971961D5C66441ABC3290113B21C46E96C509AAF09E658D9B77928935B9A122E42BBA23F920B58EA48F3F19A7924128669C09E135F772C275E55904400495153A691794A8D182EE1314446371501E87C41A944F850C9CD288CC2EA90A4E27864C79E554CC5924C4CA9A217DCA424EE8B76E49993AE4B085E9809EAE27401EB9C6C794A67A31705876243478F86D5B9F9CB3295422816526439950A412B4D1D28A70C6B9794C959BE155AADB39E00B418EFD0664B08843D20B71C547F1468C5FDD92B9D818336282F34F19B515946A7961B5A9319D9444CDC1ABA840CBB57272E4DA4AB20FACD5FE4958A57C3C812978FD772C2862DEA8B60B30A601B692DADAABA0F361CFF27C5C734A42265341641B861B7899CB311E7E0ACCE396BCE2809F24289C5361B91CBA88493991987C0ACA3B070411481E154104C15780ABAFE725DD3E1ADF00BB0EFF4A29298AC10C63FC0669DF6379294AABB4588AAD2087C9C16C9AFB654F0C9C213D79CEE1A843A84742D574DE252A4F24795E9AA631D5198F07511160300A2E02A402B4CF8AA556CE67BD341307CE5A1EB6609EFEA3F066379865489701783B2C95EE6967F0893D44D76104BF396577FD719D69EB306117F3ABD65385A87AF12D1BB6D04330C2E803C2872400C49E1BB10232946AB939319E84FF32CD354DC15D082CDE5A3DED5EDAEC5DE3BF5B4D7C2F2E18E87F499C1968993EFF196753DB8045E2C8BA8
-ct = 388475CB89B7F408D2A18DD764070424C7598C459F203221847E08ECF1FDBD3B5F1878CB148EA1E42A1790BAA2432029C674916130A30AAD99DCA2ADC8AABE96C9437AAA361C0E28110A8B6BD9AAC047191B728D9C84EBEEBC7EA2154EDE6065F9313C47DDB6A05413FF5E3571F69BCA571770E9E217136038607BEF7F60CF079E766CACA7875DECF7BF7A8B54D688BCB63EF920586F4733AB3D86BBA18540A20D27C135119CBB7DB4E0F8896B0744557DFBB3C0F615130505E59FBA005B57A317FF4C87BE8906B54870A0C46136BC89E144502F41A2B4564DA200E0AB5A3FA91836F4858FF298456F0C475BB3B8BD057A63B6F9B5DAFDD76C2C111F7B3A933A2F3CE069427077C58EC94A158B6CB4C13FB027CFF9DF3FC7CAE5BDCCD31E3F6A3BC95E6EFAF8CA24F773056AF6C8D9B2798057E2366BDD54FF417B8BDCAD4FC0FF8E64C6D258438F98DD0682A716BA2FCBA64B4CB559630635D115DD846B7182DB50A7B92C73463673CB017EBE6CCE190700E73EF73A790FA85F04656D0085023F483F50DCD5BA9F0EEF8B3E5EDDCF0F4090BC2D243215321E606C4107FEA5564041C07705C545D7956A8E163B9B641C7CEA51AB67A2C29BFFE9C7CF0D3941C0E45664A40F2AB5031C2BDE8EE7E5AA4228685A845F4CBDE42DC3F9157F4FA03631299C84149206B7E087CD56A5809BE0A7CBE54509A29AAD8465BB737DF2631E86DCCC3ABF5ACEA6091813F1E9DC49D9F998C56E72972D9CD51A95A95B59B9AC98B8EB07957E59547FDB243F873FD5A3E77478A6F2368177BFBB95F2D8B2F7924655E271850A72680D2C7ED2CFE57ABB59BE1DB29A84C715828AD7E06E1928747CFE2E1351FD07534AB50855818EFF4CA87A60E86217F991C12380255CCCA0FEFF97C35C7214157F533AF3605B54902AC8300C8E4CD496033D3D05752B3AAA85F5CEFE81632B19263F944C637DCE318E55A8A4BC5AC296DE727708D86367970C17DAF3012DF0AF19A32169153E6C07C28379761B64CA1B87D7A1B8680B9749936D205DA28B2E8E9AFCDFA26C975914332538A54730D96037AE74439289AA97D76045103540230003A430A067C58C881BFBF224DF4DA5841D1B6781937F933267C32698908A6D31BC0402E3274657ADF416C3C9D7378338593442D4CCDCDF7ABC61A45C4EBA05C0737EF175C6F01CB7022A7905A365866961F7D45FAFF18455553012D1A79225A08871971D926D978B5ADFA1723314991467782B9CF2FD063CA70A49EDAFE31BAF3CE55016713CD15F8828A09FA4D6D093C29DE550EBB0BE37FCF1C5A4B6556153578587A0762054EC01E0A114AE186FBBD97BD83F30B411563B4E4369D7A24033ABDF1C0CDDF0958F2CA2272AD358F4C60EC7251E899C6C11B001E4025A6733B270A893F384EAA93DA2F6C4D8C2DD92A1B9305252BE65C3776F5B6DBD92EBDB9E12955C1358C011AFBA5FB7E52AC27D64FAEB290177CF6195658E6D2BE5D6040DE2D26677D47349FFC38123B576A6382ADF7816344D7E257EBD
-ss = 80548D4687DA93177D06D98C1E2DEF33FE85E770F8B871D2F74CAE533F654692
-
-count = 46
-generateEntropy = c1b3cbffad4b306f9af0cdd3028876486dbe858875c9b6497fe20172a986c82b1c96249919cedc2369d8d739ab125e0d2ccb82dfebcd90240a545cdfe07511f2
-encapEntropyPreHash = f4b66a7d3b65b896dfe100b2cad24b175a1168cfd2ae11fd704b835f6bcd311a
-pk = 0846C63E2C3018BC8733F05F8CE3B614088A787669205AC9889BCE2D3B523F366F4BF811F004666B2B654431B135D97A70A00FB9A3928C1A4A2C7285F6F7B19BB766BBE6B966B4013EC06833EC6F1118A772C2465D81B77BA740B7EA33129218542A41E2F1B10F42BB42396E9A6C5011351E783641AA692A982272D9544AC93580FA6A51B8C7B6A4B5B1CE3B58F1D901855BBB2B68B988953AB63607D988999ED96E5A4B963497A061AC69BD90C4EAB7C0DC17820B6963B0293D4CA30D82F5997A877A9AA71C5C7893C1D153AC6779D0A88190B13DF828BF3AFAC9D7EA392FEA899EF844535187AF673972399A5FA31034C02D70B57B97434ECBF3B1985C86EC75B23AC0AFAA67225F12A257B78341966BFD2569670680E012899C112AD3873AAAF26D2F4A5C8CC133C92B9A446530C169B6B87B118D03329374A71ADA1778A2035986CEAE200C763A12B6E2B2FDB672B4D58D8BE640E61576F2CAC617A5ADA5D1B874BBAC9D272EE4C881BBDCCA1C9A84626012B988395EB5A4A48BAB1E7551B6CB57EA7B627138C3AC252BDA1A83CCFAAD69E38CEDA6B149C1B3BA295FD5025C63225CE88CCDFBFA6B3950CBCDF96E14DC0962745A5FA32D10525F71D895A2085620C89024D922359741BE366CE9038AA3B260320A456858A7B8D01BCA12316E9C6D1782BEDCB590A1D2AD9ADA0C26D3818652CE6F3B6403C94DBCD1424D090E9DEAC559472C9AC19CBB26C16E8B27DB9140A1161EA96A171728689CD6B6BA0C8002BA6C46719A1A0C175638770CD088AE29A7FA958209788ADE14354A1B0880F05EF7C15A6786BE063B357FC7521973ABE4FCAC0A8C26F3EAA052959E2F973709C9C6BBF4C889C8B76C0AC81353B4A4DC81B7D316F75ACCDD1911DF10A7E838A7C2023EA1EB0A956ABB53FBA02C48396807229F492966796805E04AD62B8107493AAB264A5BEB32F5459C06AA6E7F79ACBF171899A911FA910DFA6687B2C28C1D419A4817ABCF656FF669B587B72374F3CC20B92858361D21BB85A3B9ABA157100875C993B54CCBC84DB2D72374BCAE29C5479CC95197E625DA047447EA5797551595853651912DAEC4891E68901BB67FAA98BC5050BB50E913645874FB7A0E51C816ACC88A7F8A4AD383170A583A2E17B0D5766E12DCC827386BA8D868EE16B2FB892ACA3941CDFA7A487C13AF9787A309779B759CDC037C13E839314803BB10A3AB19B7FAE477C8C322BF05BD3AD9CFB0B241371C85FFCB607748CB518A6C896830B191737BA289B15288AB59869E22637C57019818801EF9A6B7160AC1B5B4D7519B41905E6687B3FA7230EB88A3C9530813561308B68BD2B740E7AA08CA72CD6468C008CCAB34AB99B6773C533B3914B19B2B80BF7E783E7BD9366C8962E7F3410F34651EE606EB737E6C9C5F6D306AF7348CE955228CF02D15B8ABAED16994B56260221BEB1A29BE5596E204B9CE111127989BD2AB49CF27C976F74AA7B084FA6B8400A25F3C36213F7C2D160045D865C75AA14542F5A4E4D1459B5676491C6A3FA0A2F0319CA1A63A401C9C3A14C94F0016A9A69E64C522AEE93E8B96B4F6691322242B20353E0D8B995A6A9129E961AE7349F92C92A90B833E82B9FAE1AD459AD417635C409C28F9EF936AE28D221563E30F83162CEF01B482889E
-sk = F3AC3178BC3E6B8002EB20046EE3288F9CC63C1ABD0B14A118D52E2C9A998D4C67E2014415084F520945F55B985ADAC8C503079789AECC491EB7BA540F32BE8823A4A837786BE140D260CFF5D46186588F4FE2419E0C4BA1B619567B9D8206B53AB1289640520F2259F5D6854871498B23696A321813D7A544E77FB3100B34C89AF2C63856FB43BB0A74A6073958D1199B4098386984847962B353B4D81AAF4CF65349C8197DB8C1B29A91FDE5AF1F9749A96B3B82C567207A81A163347919AEA565304B4820369799D352CE72415CF1C692537A48AB603B9DC741A08A66D874BF46DAAD570B6F1F4133067A1D900CA87CC25E91C4CE1C84B46D3C5BAAD46FED227268F1A9DBA968EFF27249B3C6E4C7C19E8A13046A2B45BC24F4304A80C09D37AC289F924F33E97181B8393EAA82A6FA54F2E76DD88791B5C3773707046C362D94EA547C3050AB251953464F4E540764B08103A88E448446F6B82375C15E3CA9A98798639B83638ADA857BDC1E3C6705471975C51B8087A26348BABEFD234D27D6C055D3AAB7560B28DCC13D343A79530AC868B5F6AC83AF04B8D7A20B64DABE9DE32A5C1B2C2ACACCC4588C1BA26F5462AAA5C1BDBC36467F346A1AB5C5840A07BD33CEB44093659BB0451C4C87CA4852172DC0BC3674B4275078CD2B9A3AFD61BFE454107D092E5840C4968C547ADC723C1970CFE705C5D33E3A4533F0028655C6BA44AB22C2A4C85A82B4B6DCC09765124E43C985459CB2AB1519DB1EC6F348D017A785484802D90E0222CA2313B4FBC465DEC0CD4F3A5675E33CF0DB79145867D5F0B8F340526C8A744929728CECCD146B6E66D03F660AA4E2E15D200B5960F3A03B571BB2E59160048E498C15379027E07987DDD841BDACA79764BCAA1C9843FCCC65B53695335D9D4CC789E062571665DA99B4E10368467AA551775C39C7C9DFE7624E8940F294C8655503F2F970071B40F6BA3544C64C41887184828BE6057A9E972631604901A7870733580C6AB8D4AA18B49CB4D567577AA8B0CA2490EDC68B168583B8B38415D32F5558996CC911A9470951430C36F71712F1C579A12327C41C441C980C286B71A31748EA54DF2A557FD1701C3173944B7B40117EF9CB08A7D03D45531B8DE4C753F697EC4B4303448C260B0783C81ED599425D9B16806828BF795C8CF65A95F366BB90110CC75D3E6064BEE17CF1497F36C48E68B46EC07417B2A876CB556C705C7DDC387D74F2B0AEEC9070D227AF09A324495F551680A474328D379AAC253A6F4C42C865A183D7C2F4F8CA94A92388B1AFBB5408CB1C0FCD3C945E2923ACDB7E16A45C03EC3298B3C44E9C1E75D049B2EBBCF2F29A2D3B7FC68644530010E052A0D357809009CD786604A39898B385B70AD7B3BE011EA83B93D4426F4F20A3D0836FC6FB532FA14536285013050C16D01C5752884E49A82A4A0BDBC8BC2C7598D548278703AB4C607A16B1BAB64052F40A06D3915CD03825F12C069D956F2A5662E05804183932B5216CA66274214ACF5C01A7F4C77EBF522DB776068F94151F7AC33831259B53BC48E99C50B260FAEC0B7BD3CD4FA9B5A5C2588CF098FCE5AAEEB15FE651355537953D9B8580313B56336F0846C63E2C3018BC8733F05F8CE3B614088A787669205AC9889BCE2D3B523F366F4BF811F004666B2B654431B135D97A70A00FB9A3928C1A4A2C7285F6F7B19BB766BBE6B966B4013EC06833EC6F1118A772C2465D81B77BA740B7EA33129218542A41E2F1B10F42BB42396E9A6C5011351E783641AA692A982272D9544AC93580FA6A51B8C7B6A4B5B1CE3B58F1D901855BBB2B68B988953AB63607D988999ED96E5A4B963497A061AC69BD90C4EAB7C0DC17820B6963B0293D4CA30D82F5997A877A9AA71C5C7893C1D153AC6779D0A88190B13DF828BF3AFAC9D7EA392FEA899EF844535187AF673972399A5FA31034C02D70B57B97434ECBF3B1985C86EC75B23AC0AFAA67225F12A257B78341966BFD2569670680E012899C112AD3873AAAF26D2F4A5C8CC133C92B9A446530C169B6B87B118D03329374A71ADA1778A2035986CEAE200C763A12B6E2B2FDB672B4D58D8BE640E61576F2CAC617A5ADA5D1B874BBAC9D272EE4C881BBDCCA1C9A84626012B988395EB5A4A48BAB1E7551B6CB57EA7B627138C3AC252BDA1A83CCFAAD69E38CEDA6B149C1B3BA295FD5025C63225CE88CCDFBFA6B3950CBCDF96E14DC0962745A5FA32D10525F71D895A2085620C89024D922359741BE366CE9038AA3B260320A456858A7B8D01BCA12316E9C6D1782BEDCB590A1D2AD9ADA0C26D3818652CE6F3B6403C94DBCD1424D090E9DEAC559472C9AC19CBB26C16E8B27DB9140A1161EA96A171728689CD6B6BA0C8002BA6C46719A1A0C175638770CD088AE29A7FA958209788ADE14354A1B0880F05EF7C15A6786BE063B357FC7521973ABE4FCAC0A8C26F3EAA052959E2F973709C9C6BBF4C889C8B76C0AC81353B4A4DC81B7D316F75ACCDD1911DF10A7E838A7C2023EA1EB0A956ABB53FBA02C48396807229F492966796805E04AD62B8107493AAB264A5BEB32F5459C06AA6E7F79ACBF171899A911FA910DFA6687B2C28C1D419A4817ABCF656FF669B587B72374F3CC20B92858361D21BB85A3B9ABA157100875C993B54CCBC84DB2D72374BCAE29C5479CC95197E625DA047447EA5797551595853651912DAEC4891E68901BB67FAA98BC5050BB50E913645874FB7A0E51C816ACC88A7F8A4AD383170A583A2E17B0D5766E12DCC827386BA8D868EE16B2FB892ACA3941CDFA7A487C13AF9787A309779B759CDC037C13E839314803BB10A3AB19B7FAE477C8C322BF05BD3AD9CFB0B241371C85FFCB607748CB518A6C896830B191737BA289B15288AB59869E22637C57019818801EF9A6B7160AC1B5B4D7519B41905E6687B3FA7230EB88A3C9530813561308B68BD2B740E7AA08CA72CD6468C008CCAB34AB99B6773C533B3914B19B2B80BF7E783E7BD9366C8962E7F3410F34651EE606EB737E6C9C5F6D306AF7348CE955228CF02D15B8ABAED16994B56260221BEB1A29BE5596E204B9CE111127989BD2AB49CF27C976F74AA7B084FA6B8400A25F3C36213F7C2D160045D865C75AA14542F5A4E4D1459B5676491C6A3FA0A2F0319CA1A63A401C9C3A14C94F0016A9A69E64C522AEE93E8B96B4F6691322242B20353E0D8B995A6A9129E961AE7349F92C92A90B833E82B9FAE1AD459AD417635C409C28F9EF936AE28D221563E30F83162CEF01B482889E5818AC8D7A38C781E3A0BC43D088E6D391D1D67D9639B260BB6F58A19A57150D1C96249919CEDC2369D8D739AB125E0D2CCB82DFEBCD90240A545CDFE07511F2
-ct = AF94CC0284B48C7858A08B77AE1161A30C07A30D48FADFC030089988BF1B24FF5607C9B5C714AE299658BC5E8801AF51E8876908120917B00751B558FFB7F54E875B71D91E02FB9C218EA63F2BAEB28A16F912896652D7A20861311BEDCB97846CA5F5C43EFC5E09BEC6B699C2EFC6D634F6C310E97793F0FA496970E2B9A3F74B35F96890468FAAB476C179AD7F0D3C601CD54D583C6763DE4A839B7855E68F3BA4756A2AA1EC59FECDEB1D7FAC0B9EB71184240AEEB740A9579BA6350F8F6B930A8AC33D3BFCD3D28DE47430FC34248EE1B292B94BB27BDDC9D9B1A6CDD7B5AAB7FA324295E1B80AC76E04465A50310E0F3DEE3A8414C1927CA2AC9921A50E970A48571C8B73D07C54F58E7D3CDA82BC4A609A9840F3FFEBFD7EC71E52D875712EE5CA94A500E28F5D3193A3EC22C83A2159DEF810FB3640440BDC870295C70CE4D45B9FC902D5F8590C0E1B45A5BC150D379053F277E3D8368EFA67D333031A2B131B8FAB6522D6701BD119E5493C5E6B4862535D4C119265FDF2682A7949BBC1D4BEF0893D979E35719F0D418317D0A828BE60E9F81A35DBA44FF1C286DB5D7BCD3734576C6F5C8A7BAC8DD8364465378557237BF26F539FF9D68FA86244BDB364FB1F6C893CFEF73A9D312037F161482CE9480ABF28809B05318F7A4749983E3577CA3F19E60492BE75DE65171FB51A87301DB5DF692FBB49906696842636B85D6DD6DD020C5B67FEEE25B7FDC68B0FC389B76DC02DAD17C2B58A1B3DD2C7FB17848442F49A674ABE74838095A97949F664F474DAAC1E708F9BAEDD23A32A2A5556F42AF0F2FF57C487E7C97B5CC6E4CCD3E923976E5101AE7C4AE8EEB07FA20CC7BC1EE39F26B002AA0149B84AA7E868ECEC02C304ECF5AEFA03B98F613738D23C09903901481D8F14160BD18DFC0686DA00595C7178DFFEE5A4A9A1F4B8F27B563C4EE84B8BF033EEE964277944D86E416D67F663AD2200922762F1900CB0F65A81EEEE4F758BB20962A85D2FA0155296ED38AC8A4A642E6BDF4E772B7309F4E0280552DB9FDF107D2C3ADED893A015764069D3D6D5E689F1DFAF26A8FDC8628F6B33E8B5D209AB3F3CC4960409486C52D539E32D27687C2BA004201CCFAA17DEECF6533D47CEF4DDF9B6CC8E25F3648BCE3298423485045762E4CD4B85E28B5FBE22C332EE0BC587B2C31AF7B98FD97E95CA1FBC9A57E654BD8B5E54C9D1B3FB59527B1C8F9736E95293BB74613708721281C0E80B79C73E1DB9DBC4B1378A18174D068C5A2B6CFB4F2020EDD74A40FA308D5E60174696E8DF28063198F58605B5DDCD759B6BFB1C0C2CFC9F31FD5E041F047EC94A716758BF66782127771FCE174DC0F141E866241573D48AB0EFA04497686BB3948C785A3F3381BA34E44090E02F5911FFF19570341A7AD12D3E7A487865950462C7DB9F7290E8453981EA4DB3F39619F27DE8B68866BE3A2C1BB6901A646A180E152802831D12FB305CF084DD64C5ADA579BE82A7C55846B550FCD3F4C3274297F08AE37C4C2B61
-ss = 2F2F58E23DBA54D8A44BA11AA4546EE3F1819C6243E986249B7102019DE3A777
-
-count = 47
-generateEntropy = ff7495b8575b5a98e4fd21fb4c3e58cbb60f14bef21aa74cf8802e3153f14807bdc370460375a778d1a31d01c42b66367ed8d9e8f84551002f552f0e52102b5d
-encapEntropyPreHash = 1d7b03d3c5eefb8ae5799dc569aa668f1bcb8c86607b089d3530cf61d6380147
-pk = 964435FC16BE2CD2276B7BC78EE8B5C963AF2AF4673A93940B429131663CC124BE5A706BFF5C157DC17DC5CBC2A11418DC4B8A28C841C5A831B1A2BA989A20FDD17DD06706CEABC0D20714D5595D54216E9FB6824E3272DE0A1E262AA246494152B1CFD95C970F38AA35FC0337B26E76C77A0A76BC2C57B80757550B11807A423B85E32DDB537AB6D4694CB8B9ED58B11C9A6ACC746749C21011A66DBD7896329C3A31D0A7E1E78EFC93574CB7B051D79188EA4981DC6299EB9BD1BC1A133A41565305CD4A09FBB10934E7A3D132BB0EB83559C484EBC92F7CF93E445020B7187E2705A2D1A8386C008EC7F22FE172088360CD3FD160E7020B6D0C747CCBBEDDB1B84FA7549F625DBC064621FC2E13F720188C200C1AC1F10394FE4117018B9640632FBED570C942575FF61A7149A51F9993B90827EA2A08C32A330747CA27ECAE452154CE1A6A67A8B63676998AF929E8A7A9D2AB709E2162A2E0BC0721BFC7E49C5B2C9BA975B3BD881AA3782391F5CEE4CC1835C83732C84F54B373EB18869B2C90E9F986A0EA345CBB020333893B463671C95E6AA07193D06F7E62BF4361CD0009B1E528C85D147D0E650CEA7B0C67F1B4FB754BF2F1A7B9CC621D4C34682A6195776BBB9B2CC866CFA94C368A2B4B346C75A2A6BFE946CEF09416AEF21B15D3C72B7CB408141608C058E506271380841656963174C70E09C1F593ACDFB9BF4A3A9387B693F882495149C62A77595574C0BC745B51BA8338C6361A293402E74DF74A7A70B49FAA1AC4D66B89FB6C31DAE59F318B610F00BF4F4A282F752A070582F2F3C141E168F6FA037F23945893766215B9EE9A3A1DE662060A5B1FD34BC8DAC56C0875A6F82ECF8863C1692DC2073CF517CBED3C362A853BEEF1A8CF2247000CC4CD8176CE980D683B8AD89B3EABA3B962624F5AB3695FA10A88055DDD664A2BA0749E439A39C6999496999BE3BA7BBA2FFE06388B1A6C83068AE70A1C6F8A36E788B8AA148933C896EDA61EFC86CBB7D5C9CC96C9F137C6A9210347289010979BC1E16700A610C7C990D685550F537AB0C45B2BC57E5EF4C08B2220961C6E17E95E2E4482A4A94DA2E17B6854CE57C263D69429E1566BAB646FDB216E0444CD8FCB7DF4168AE66223A0CCAD971583B5917C4805271A17B4A1E17462815CB39332699AC447332A3F7ACEDC03541E93A822A96089D6A1F47A7DF35CC9B659CF419BCD2131B98AACA67343CDBAFA3DB35661C38C0BA1E18043A4C945067ADEE46E428A16011ABFEB58C1BC8B2330288B57CC319389921857C9D015A0471128C34CBC13417DB24B91A3567AC299CFA6D4C2F1123661A3CE0996111D340D9613B966955C6A758FA7F3556F6716E5AC7AD3A93174B2032A983CC0C73C0DE302F9F83A0DE89A1FB576CD3B41505B5BA712C387730C45399B8CF0B0E548CBED984E7BB5095CF7263B05CBA437AC6FC369EBCA85E0211715133BCC314723D79C9B93ABAC57AD3D3A5E77F2986A3539EB795A5B4967AC7753115B916236A97900870B658B9D4B3E35827E1AA9ADC3500FD9BA18FC6B03465903858C61C1259CF485338CB700EB731F31643B469BB259210CEC78C158E3290573C5228518E4697F19171D8F1A3A633448FE9C83BD28097BB29A168DB5AF1D1B354B6881A2CE509B
-sk = 37F7089480382622AC6687B4B15BBDBC1A9AD7467E8FF4CF44F0614DE74B9591B9C5410D2D7084BB57AC27963AAFAC148DE80DDA6232F4A0C634D677A80C226FE67063191C05A54AFC026080877538F63DF93CC6FDECBBC0A9A0A4215488DA1A2F7B1EA8F8B917F32F397B94C80170BCD423C1F1BA4C736449F84BAFD6711B0070DAE72DE1EA3923435FE15A4FB35AC98D6379F0A44C200A37704B5B269BA3A555961ACA5E2CC1518FA4BAD3C23438E06952C9317D198B0C112D79A89560DC3361F5732F820CE4D16ED448AC2ED221C8EA3601602C27F640DCC394A7ECB5079978CF52B80DE15C3015839A44B9EE36837866C5C8E9579849B331E53DBC049E46DBB524C2090A54BA793C845420A7C2C29E78A9B8C83C310D780F74127C02A59AB68C1B29952DFF1196D0940EDC338DF3E1C1C8E34FD0DAC4D5596F97A2AFA98B1E8BE46BC0A96DF412639AE5B52229086229B5BC79AC020B61A56C04091C10CF9940F798A9C50BA1F5FB30BFA947F20B62A60215C5A88D23B70C0E299C53F49A1ED511AC5812558133D9F195E1FB5D77314559EA79E63A88E781C4224155ABB5CA91F089C0C609CECCA32E549B0CBA167D9307A3A64681A815A69C5D7E787751162483E7701437034F0864D8D53201FAB9763C7921ECA6F11247E7EA364298C1C3AB893549572BEC45C1A8C3B88659CFD526810B23F2095AA6C1424C7178187109F83063B52547B9C731F9933622A33C7A8B927A50191593488F9A0D12331017919159C7A027C3956FE109393A167A6475CEBB49224736847319D161490EC52396D7BABFB638BDEA29F50C9CE37314FC858455F63FCC70CFCB751DF12274FEEB45A124AB1B997C917A550C3469A0C185EB0238FFCB4DCBF751E12CA17A71B807B1446EA7180EE302E6998EF8D12A857C84FFC377F5E42FD41238A54345229916A715977025B3B4A6060F778DE7D426A2F95927335CB202BF4080B8510CC0DA12C4EAEC4BBFA42997E21504B8C5D32604F1D66E8D55B50C393F973ACD37A236DB595E3EF08239C42FB5E9243D967181B9B94F4521C104A8AA726DEC057ABD419BC8C6CF350C91ACB78B0832144F409F78992652E30EED7BA2375B3245D877C8E8B873F0427071C956633495381A2C642B15282B9945C758910FE469CD091B4458218105DA96A479BE0AC6B3BA155D359B2815916E93E9BAD3D431945B852E519DF0129174B24A32CC9FB8A62DE96733D153A799CB8FBA3C86B9101CF3D4A97BD3B699467991A57129607C27274D3224CD1848C17F1550BE47B71A119873045E215BB817CB92C12A7BDC6347DF8B64DD686873D800B4672AADE8AF56D2995546CC37C06F9212A54745C5597184EA85CEDCA7B980386FB91B8AE677A035A4547B5848879C2567C8CD6AC285F6F2460DBC0B73F5AE0993C988418C234895380C556042ACD15A6C015A13EBE16CDEA4BE38528A9D244230A0AB053C568E31C64D06A3D7BCA0E5207B7669811A3512F8AC6887137B0B7627D2401CCD604AE786753FB6568CB522B28712211208C1849D1F75CC4FB951D2AA081ADA952998B0B0E938B77359233A76C135897E91059CC5639E978C12C6BBFB735FEF4BCB1D60180DF21D964435FC16BE2CD2276B7BC78EE8B5C963AF2AF4673A93940B429131663CC124BE5A706BFF5C157DC17DC5CBC2A11418DC4B8A28C841C5A831B1A2BA989A20FDD17DD06706CEABC0D20714D5595D54216E9FB6824E3272DE0A1E262AA246494152B1CFD95C970F38AA35FC0337B26E76C77A0A76BC2C57B80757550B11807A423B85E32DDB537AB6D4694CB8B9ED58B11C9A6ACC746749C21011A66DBD7896329C3A31D0A7E1E78EFC93574CB7B051D79188EA4981DC6299EB9BD1BC1A133A41565305CD4A09FBB10934E7A3D132BB0EB83559C484EBC92F7CF93E445020B7187E2705A2D1A8386C008EC7F22FE172088360CD3FD160E7020B6D0C747CCBBEDDB1B84FA7549F625DBC064621FC2E13F720188C200C1AC1F10394FE4117018B9640632FBED570C942575FF61A7149A51F9993B90827EA2A08C32A330747CA27ECAE452154CE1A6A67A8B63676998AF929E8A7A9D2AB709E2162A2E0BC0721BFC7E49C5B2C9BA975B3BD881AA3782391F5CEE4CC1835C83732C84F54B373EB18869B2C90E9F986A0EA345CBB020333893B463671C95E6AA07193D06F7E62BF4361CD0009B1E528C85D147D0E650CEA7B0C67F1B4FB754BF2F1A7B9CC621D4C34682A6195776BBB9B2CC866CFA94C368A2B4B346C75A2A6BFE946CEF09416AEF21B15D3C72B7CB408141608C058E506271380841656963174C70E09C1F593ACDFB9BF4A3A9387B693F882495149C62A77595574C0BC745B51BA8338C6361A293402E74DF74A7A70B49FAA1AC4D66B89FB6C31DAE59F318B610F00BF4F4A282F752A070582F2F3C141E168F6FA037F23945893766215B9EE9A3A1DE662060A5B1FD34BC8DAC56C0875A6F82ECF8863C1692DC2073CF517CBED3C362A853BEEF1A8CF2247000CC4CD8176CE980D683B8AD89B3EABA3B962624F5AB3695FA10A88055DDD664A2BA0749E439A39C6999496999BE3BA7BBA2FFE06388B1A6C83068AE70A1C6F8A36E788B8AA148933C896EDA61EFC86CBB7D5C9CC96C9F137C6A9210347289010979BC1E16700A610C7C990D685550F537AB0C45B2BC57E5EF4C08B2220961C6E17E95E2E4482A4A94DA2E17B6854CE57C263D69429E1566BAB646FDB216E0444CD8FCB7DF4168AE66223A0CCAD971583B5917C4805271A17B4A1E17462815CB39332699AC447332A3F7ACEDC03541E93A822A96089D6A1F47A7DF35CC9B659CF419BCD2131B98AACA67343CDBAFA3DB35661C38C0BA1E18043A4C945067ADEE46E428A16011ABFEB58C1BC8B2330288B57CC319389921857C9D015A0471128C34CBC13417DB24B91A3567AC299CFA6D4C2F1123661A3CE0996111D340D9613B966955C6A758FA7F3556F6716E5AC7AD3A93174B2032A983CC0C73C0DE302F9F83A0DE89A1FB576CD3B41505B5BA712C387730C45399B8CF0B0E548CBED984E7BB5095CF7263B05CBA437AC6FC369EBCA85E0211715133BCC314723D79C9B93ABAC57AD3D3A5E77F2986A3539EB795A5B4967AC7753115B916236A97900870B658B9D4B3E35827E1AA9ADC3500FD9BA18FC6B03465903858C61C1259CF485338CB700EB731F31643B469BB259210CEC78C158E3290573C5228518E4697F19171D8F1A3A633448FE9C83BD28097BB29A168DB5AF1D1B354B6881A2CE509B172CF4F8DACE8A96B8F70DA966080A5E3F132873CA7544343377A99B65E8147FBDC370460375A778D1A31D01C42B66367ED8D9E8F84551002F552F0E52102B5D
-ct = 2E1DD8799B0911BAD860CF08F4A53162A559277EF400A1120A024C0B0BA064D1746AB3926225882CBDAF2B01013FCFF1AF978C02CF3650866AF47564DDDDAB692292F6A1233B0BC4C296DD98FC24FF962E8F3A8336729268EC7FC97D30EFCFC45C2D77AC5FFAA428E1D3BA6087F0CED8406F9C86F1A2119B0539CE5B3251C9A0C0836EF690DFADF37F16040DA580814B865777882332591977D4181320BE97A091E8281ED130A15FC6AD629EC1103CFA0AF8FE257F3C3DBF737231C023C1314484A582F2599BC1249BDB7C5C9088B60E760F57621F4D04D9F32C8B5B354F8943D8917C68030CB263B78C4DA1BAD57C67B07DED2BAF8B52D3F864380DBBB0DFF30152C11F86A0529B29C78E97F91E3DD901676F97E6E1EB3756B213BC19D90DEBDD774F805B30E00AAD86956014C64C09B816B149EA939232B4CBB96F0DA9A9FB422F1154314171BFD2DE10F69767834B90AB15099D30415D66F8442589B8855ED001CCC2DBD6A633AE846D25BCC754838F8316DABD1A58A61C6E7EB763611BDC4CAEA5FAB7A19EC95BD168A4742308A07E8A0E0214C1173FC7D2386E33D187F2D2E5ECCEC18A3180025129065644A8E917554DE34A1CCEE3E9509F9DE89FD35345A9465D02D25704318D5E6EDA8CA7F6A6FBAEEE2D519929DF566062F672825F8BFD3370FCCC384571A1C82575BD9F6B3B4173E255446A5A3F2E2143565C11F12D8FF48FB8105E2E19518CCB1B60F04E7988C58DFC76AD3D1E3FA107A7193AF691D80D3DB1F940CC2E5F50F02D5BBAE18E1F598DF690E82E7BAE5334936B8D1C194663391D3F819CD2FAC47D185192EB9596DDA35B0A8DB158C025961CE2F570F7097D076384F9A548A1B774624C5ED3BF042A06E50FA6E24D7796F813F5C63DDDC70A1BBC85E730ADA2A2FADEBBA236CD0A9BE983FA40166823E52218F729ABFACE09D7AA6F6CFBF6BA25DE959A779CDF2E385A83B2666B5E0CD8A049428B18786D93A125832AF72A6C3202DB30D83E34DB9C2E127B1D7E027A0D8F30AE69C90A5CFD4D3BD610F77751940536174247CDB7A9DD7DF9A010E28E8BF22E346A3AED521FC8B7E3891847F27B7EA06157FF21F14CA7F474D7DF1CCDB371DD9155F8A8958D391A934072EFA43625244B1A79FF2C29753053C42378F338D11D722C283D1436D87FBD38AED972EB4BCCBDD3DFFB9F6F7B2CC2B1EC58F199E0E09ADA57200031E3B26F0556AF815A04112A784E5762AD828737F7F26B55969FF023BF853E4FFCCCFA3A6E3E5D7363B039C2AFEF6A5114E7D2D28405091E258CFE54C3B991A5AED242DBC60430A95EA07776314140BE80C633DD3E2171B2E9121F16FF37548E52650F6241960E6A6C23EB18EC2C6FAEA35B8E3AEE9CC2F7CB0E3DBA2FAD334255CE1E92F684A2E1F8281CEB9EC7A497C41ED0362F9D25281064AE282E8947ECA454E3ECEE228B0F219C243BCEFE589ECA239EA619B152606EED03F788E9824226E2FB390207DFBE953AC99FFB9BEDF0C0F602F0968490BFDDF86E7D0F0E
-ss = 0936224EF45E29DFE9263C6237A22798E94E81A932796174271CECCB78188554
-
-count = 48
-generateEntropy = bdc3fba1c32751139fc45bacffb3ea97f26573d804a5f27a459293d95190ed8efd5a08f656a6eb8cd20679930a31caa6a6331c4b133a6838c223ef9f769f6246
-encapEntropyPreHash = 554f3385b382f4a46314de37ee3885addfc5332bd4038785094e0a832e9e8c2c
-pk = 58718343322DB0162D26965D5E946B700AB88D702FD5A1376920B5BE702297AACDE28588DA91C719D40C1FAB0AF109742AC26C456961338C44C93C83AB58581635499545CCA66160E15A35BA4931E2B91FEE68A8734ACBF72755E8D452D17215457161284435EB6A7A2933C8D146A12679143B80740F68AE052087EEB988771A8FB43B34D6EC79868A0670551BDD19CB5313892BCAC9E4FB500D3375AE471A3ED551B2D9C76142B22607615454A910F8578E44B448AA9200D805CF4C15EB635013BB80A65593FF578C794066F05ABDDB850FF976C74ED6ACB4C41064FB5EEAB479A13BA57DCACF7F02421603194A3CB549F08C0D700790809EE0E585DCE4088F96A740320C57D5A632C8BF5DC173F0F841173AA47CA42004B808EBC2A6A1770AD9DC06027557F80420DB47B0158A1D1FF32007FC058875C4F5D21FABB67BFE8909E10B51BB35C76D0605D0E6A97E56CB93DCC58F722D95F33008B0A237B711420A20269A7097396A4A98BE20B8226E103CB1136EA3FA39D438B305B63FA049C420CC378392B9F911BD7800BBAAF2BDD7586780C7078DEA622DF51C7190841585BB16BAB9A0D83625D55826E3949AE018E7C4703CA082466B9A078393C30A4F6B7B1FC775C9DFF7CFB5909CAFBC66EA946E6F098F881B3039C251FD3AC142029E8728082F838A202CC3586672CB6285B021C41E3C16F5787CE6E319D849483FE40D989C246F7C36C11A991234AE7FEA68770C79D8290AAE3BB72BA014AA1279FD13977A49B0CDD494CA00C610CC2306059B695686399C1590F274F735142639425DD88026F8BE0F260CD66672A12B5C7B5C7323408A2711677F062625EB8F3541098D079C13208415DCCF3FF72D1999721DB3C271F7521DFB0F129B3CB6885310A0689166A3B97B09610347CEEA5579650720DB621DB20EEEC24EEC2144FB523ED2D30F64B9C6655928B3D06E1FD9B088AC8B7C964213E5674757C7BD48A3D066355F0249A50548F430C55A6CA0471953EB7C67E140AAF6322B7741225931622DB114ED46B9EA997974C9AE2F54B87125CE79E8621D712688B50C7A49877D52091643A4A43148550135F27BB30EA131521583F5B79255309465F4B9F2233027855CC0E7C93BB33705136C88392CCA717254640C540573D3A20032C9B297EB5B02C954C744C4C6143A56EB48F1D15439F885803BA5ACB524F3D54BED37145CD9173ED92A00F724273787CF1B89C788184DE0905BEA74FB331DDBA00CDA70C1547C634C706A8447145489752B0633628BA4F5286851E1B5FFB8A7FA2BBAD3F92C542ACE74E67AA07B467E70B6A7D3056592B36A7A37C6C7114C610721E9C6EA933742E43609C41F6F3803E99A8D5A27B069BB73C892BF07524A8B2989633C96CCF33791BA29F3D575F249C640093046D1684FBC701AC633381BB349BB7D351230A8BB1A22223DE3850258AC7043B887770A307C3746002CADA2826E47F7694EF51F94FB9E3645AECE6273298592BF00C0FDF14C07D8C9FCA401FF351D2E35491AEB55AED9B1B0EBC2424CC729AC7EB07630B8B11D0E47C323D6B3C0BA12DC235D5C310CE2C7BC1F0A8467D627568A185855750E12717760355A0B8A756468E95406D375F6A1289B8CDBFED9F6518D7031C57FD3455D4544735CF52680424C90F14F
-sk = 5E43BFE8EA443466AB6B087DEADC672E7AADC85521D549B978B054A9B8949E519E3FC3A653607D794491341039713037D31C9824EACE39E7127A974403441E25B714FAFBA4B98041E85B2FD8D8ACC2A69AEA9C80930306B46BAF5245A505D48E293A77AA4174D1C095B0B4A45754A4A94BCB01D4543BF7C7DEF2AE2009408725C58BC76BDE03ABEF3C4EE0831D3C6B2632609707B3B861F093E857902D52A2A48619B1EC20DDE7A923412F79C22389601473076965959B2AA3C79DD31B98CA9847731C89B0929EF5174CC6B92972CE2C07C8139A62C901216245CFC92B2DA158079E1C93C8E08FF438A02DDCA4CA948F47A106D40AB6A5B0AFAF52052F237E44F0765B3436271421308611845785E257CAE691C39FB8C80BBC1C5FD687A547B7E8E3AA1D7C15A918984B6B359CD24711CBBBB95716EA54A8D3511C5DC983FA1B019E0B0D7DE90C3C0A9E7652C18E72CAD6F9C510E64F0CDA8CBD86502A5880EE1536EDD16AB36BCFD859CE879B3F5D6A0D90630668B7385C8599ECB1849A4942D87A91497129E196309156C9AB245F4C637080C963F9648FB2BA6F32D2566F88BCE680203DFB827438295F8670C9BCC34A98497851BDB0E631EA06ACCC26373809986DA62FA714012D2579D5D61443330E3B882C800B6C9D02C98E9859A4022DB4A09510FC91A3B95BCBF73B3A09311CD13E52B61733E02DBB400E8A54A30668311AC02FAE2B55FE05C95AC43875D92F3C2ACB3D4A6B53D363D5D75A697061055A3A788BCDFA051EDF97C3515CA920EBAC9E7A998BB598B8436BDB63550E416D2AEA5057562A901B609B129D92B27536E02C26EC6A3B2C5F6B733D0529330E9A89600B089DD30A0BB52530A3062BE741B09818A78B4FB9F274B7262CA23B3F2A40542CAA64FE38A6ED06BEB5498733A38A7FD0B5AEC2673ACA2B07E00909E68D40AA207FB179CF7A60A9E13719635A15CB221D1CC88B921E950C94CEE17D60F80CA5B4A656F501D7136D1245207479A1DA42C26C48664297562A0BAE0E7906E9D853FC7C490E4078B5B3B226B37101A31B5D05A26F1CA1F231A853F23F59D86A3FD269A0256EEBD02CC0C6B77F1B1C613114E1084D8D1CBABD0C7702F43D2EE01DB985382C562F1B7885A7015EDF59BD8988B5BCEA1CB04639BBF5B119E6293F908245455070DA3013D2B6E2116776694B44E3A7E433407099A51940870B336F547677665C7066E181CE266FF0E508268731BD13AFA2ECB4546276A5DC50772A6FA38541AF968AE5C59E2D04C3B6002C7120A6A970ADA2671590411552E48E7119C7B7F7AC97429E9B7CC0B5242DF277CC10E7C48976266643A9B2308CF1799324780743F95E65851C03599FEA7129D5552B86AC35AED10B5F00058A8742C02A3E4F6CBF5DF61C66143EBE933060C98A4BB55318566184601BB395625FC86E4BD47377B54459B45E50C145596B9178D57D01BBBAA9A63BF444889FC810F1E40E07D289E0B04A58F84348463B9FCA3176AAAE6C1C119CF679BACC6EB685B9F443C2A9E304BBA0ADF3888B42698AC1F68F1626439E796E1967C7BEF581DBABB6C22C9C16029E18D8493A524FC2A41738A25E735C665E79AC423ACA37B5222D970358718343322DB0162D26965D5E946B700AB88D702FD5A1376920B5BE702297AACDE28588DA91C719D40C1FAB0AF109742AC26C456961338C44C93C83AB58581635499545CCA66160E15A35BA4931E2B91FEE68A8734ACBF72755E8D452D17215457161284435EB6A7A2933C8D146A12679143B80740F68AE052087EEB988771A8FB43B34D6EC79868A0670551BDD19CB5313892BCAC9E4FB500D3375AE471A3ED551B2D9C76142B22607615454A910F8578E44B448AA9200D805CF4C15EB635013BB80A65593FF578C794066F05ABDDB850FF976C74ED6ACB4C41064FB5EEAB479A13BA57DCACF7F02421603194A3CB549F08C0D700790809EE0E585DCE4088F96A740320C57D5A632C8BF5DC173F0F841173AA47CA42004B808EBC2A6A1770AD9DC06027557F80420DB47B0158A1D1FF32007FC058875C4F5D21FABB67BFE8909E10B51BB35C76D0605D0E6A97E56CB93DCC58F722D95F33008B0A237B711420A20269A7097396A4A98BE20B8226E103CB1136EA3FA39D438B305B63FA049C420CC378392B9F911BD7800BBAAF2BDD7586780C7078DEA622DF51C7190841585BB16BAB9A0D83625D55826E3949AE018E7C4703CA082466B9A078393C30A4F6B7B1FC775C9DFF7CFB5909CAFBC66EA946E6F098F881B3039C251FD3AC142029E8728082F838A202CC3586672CB6285B021C41E3C16F5787CE6E319D849483FE40D989C246F7C36C11A991234AE7FEA68770C79D8290AAE3BB72BA014AA1279FD13977A49B0CDD494CA00C610CC2306059B695686399C1590F274F735142639425DD88026F8BE0F260CD66672A12B5C7B5C7323408A2711677F062625EB8F3541098D079C13208415DCCF3FF72D1999721DB3C271F7521DFB0F129B3CB6885310A0689166A3B97B09610347CEEA5579650720DB621DB20EEEC24EEC2144FB523ED2D30F64B9C6655928B3D06E1FD9B088AC8B7C964213E5674757C7BD48A3D066355F0249A50548F430C55A6CA0471953EB7C67E140AAF6322B7741225931622DB114ED46B9EA997974C9AE2F54B87125CE79E8621D712688B50C7A49877D52091643A4A43148550135F27BB30EA131521583F5B79255309465F4B9F2233027855CC0E7C93BB33705136C88392CCA717254640C540573D3A20032C9B297EB5B02C954C744C4C6143A56EB48F1D15439F885803BA5ACB524F3D54BED37145CD9173ED92A00F724273787CF1B89C788184DE0905BEA74FB331DDBA00CDA70C1547C634C706A8447145489752B0633628BA4F5286851E1B5FFB8A7FA2BBAD3F92C542ACE74E67AA07B467E70B6A7D3056592B36A7A37C6C7114C610721E9C6EA933742E43609C41F6F3803E99A8D5A27B069BB73C892BF07524A8B2989633C96CCF33791BA29F3D575F249C640093046D1684FBC701AC633381BB349BB7D351230A8BB1A22223DE3850258AC7043B887770A307C3746002CADA2826E47F7694EF51F94FB9E3645AECE6273298592BF00C0FDF14C07D8C9FCA401FF351D2E35491AEB55AED9B1B0EBC2424CC729AC7EB07630B8B11D0E47C323D6B3C0BA12DC235D5C310CE2C7BC1F0A8467D627568A185855750E12717760355A0B8A756468E95406D375F6A1289B8CDBFED9F6518D7031C57FD3455D4544735CF52680424C90F14F268B6356F92C57DA6DD34494B927E8764ADF0AD519612EF0D1B8951E50966C2FFD5A08F656A6EB8CD20679930A31CAA6A6331C4B133A6838C223EF9F769F6246
-ct = 19444F1E4399BA6307612AC8FF6794B0708DDCC06538D89BB5F49FC3B8AF7C2F31C965417CC17555AA48A9C17445580F27AD4C825937FD7068EFBCBCF3B5AB055DD0D772E5A801935F475D45A63541A9CC892C87AB0CA912731819E4F270564F50BE11E0EEFEB954EB6F4042C4ABA4595AC8EEC5896AEBD7D66C0D1B8E34ADA6F6C4903986D9E0C17E8ADB7A4AB87917B9584C6D43FFD09318D867710CB41112FFBB8D888A536E3A4AFF8CC1896C7AEA3700B501FC468126D0EB82519A336EFC13BBBACAF4C1F48D187CE71BCB2B8F95CA66468485C445629EE33A3EC1C4EC34A193F68C752DB1701D07A9CF6D815CA93C93C6E4FCF4B21F8B0523DB993D25F581C91C5DD94B594EDCA516D6046354B4309CD9EC53BE0F9FF210213DEE06C0066665D325A10C5D2491DA37498644907FDF719515EC507217DCECF16D4B3CD45EAB811684198C48567BFBD65D831ADF41FF4612E9FFFA0587B7B3FC9F2B726DB5D4FD1DCD3D4BD06E309EFB1007C39401FD0A98B2BD6E3D354FFB8FB556F289E858A1244A602CC1D0A41055087A714EABCB42AA85F484F2F27548831B2F32D883A488B74D1C7BB28A8F735F161F2086B346CF0C45153354C690C92D68FE943D723F7E243D0AAC615AD54C3FA336B7E43262E14C850E9EB89978AA10EA10507230209E255192A3695D6FA3CB55EFD7BC69174A44EA0A2C15FD17A22856E571C39A519E94A5A022B04DF98E6C84FCC6D5A5AE3980E651731753517FB87333C02044C12531730F3445AFC02CD54A0A8460F7146F98187CDA6555A8EDF2CBDF6CE301950EA5204DFEADAF64952BC871F7F01517ADADB0A1AC33C34EEF75B7DCC1F64AE20A9101AE95AE24020D8AF3242AE911B3604284D93DF937E74DF3F74F26275D7413CB6D07ED995AB853E180A50F8D0EA305528DDE43F5413F927289CBCFA6B426B615320D635B85B63FFC640E7EC4B121AC71E85811815EC5DF1B9A5A2DC7F79C8A7E6380CA7D49CB3D7901BC28D1E249BCC86EC54EBC31D92D5324A0663222FBE93EA2CB0BD9BFC5AB43D63C8DA12051A4157C210DC10E737B37962C1DE186E286944E1C588B570766F81E944850FB4269491E0FC23F86602CAA9968CDA290D83E7B2EE9917693E47951EFB86F6CFF49CDB80CB04774E51DED7A184BA8E2656861ECC8A90795DE698D70AA85216FD715A11AD8E1D5D07C16A1F10C22DAC064F011D1829826D34C242F8D0DC853DF36D4DA431489785373C8E050EB8A34CE55C6F2FC1745DE58BE0B903C9CC25392A9378A379F6353F04C52DC5AEB80048BB0F13DC7DC9548266729B410C7B809C10116F30A6204AE7F46F7CC68F5ED8202832FF90E1C482B3AF44E85AE6E44A131BF9789147C21B1D5658493CE4CE3BADF7458C26870392494A65AE4F53CFCDD337D07C801A6AC90443A8F78DAD7A7E3ECD7DE8448809FD38B533A3F41512FE7011425E6FD360395F62687EA7E66977B0C3AC4FEDCD1C91F1026E216FA754A4D64F0265B0AAC854C8AEC1F25EC93F70A10E3
-ss = 2073CEA69B598292F44EBF4AF3F7035E1738AFB7203AD67531A7140150176E5E
-
-count = 49
-generateEntropy = 447f6076a627bbc5ad7773fbfeb14b4ba9ac43a0f8b99fb6dcd5e452aa3c47ec20a7237801f470fcc2bd9fd7bea8322859b850f7882d362947432913dd068c01
-encapEntropyPreHash = 38bf0033b779edf5367d9ebc01c988af90904c560970815837380650e4749eea
-pk = D8279F9A0681CB98BC38CB551320031F46262799C182B0355EEC82CDB58D750596A4E6BF1213490810415A4B347E13C9E8514890A0995843936BE342E81C7F4971BF9B75925D61AC8C961492A85D83FA8E33C12FA37BA08D7C681C521ED4060481F58BE673007A081321E01E21419E232283A01CB1A4481550DBADE263382EB93B7E42470B265027A933C480CDA340A9A4065B4BC47990833786456AAAB5A81C0A46E0076B91BA5BB4D4ABE21C6AB193B3A3671C18479DB082A706768A63109D2C4224D71C7C95755CA24B056C355E9C22CF5006662B3218EDD4B317B19962CB514AF123245B152EAC41391CB432C6CAF9295C66DA4E5737AE3D60023F46AA7A604C64A6C403306CA4B96FC2929AED5B4CE7E6C631B473D7D61CBCD19826AB82C0C58880D77CE8F9BCDBF59D645424BAACCCE334809B43ACB99248BBD966C88793A273AE857946902649F97B5516FA2EA2A84FCFBC054653852D8421B6B78C289B49080C8EFAF85DF195AB5562A03E7099C43C439A25AB41390B86DB4F57188F002129F3EA1FFDBB9E9C688EBBB26E0D7AC6EEA395B698A134F70F98480E87313B79444963557CEE82534E9C1CF10B74718CAEDE3BCBD98A68D9956FACD8A45E2184C16B14048B9D28E8BFBF5AB43D1B650EE8CF13148CAF451CFB144656052CBAF82E2F765C8C9C66C23B0CBAE0257D6000F247200AB87F93B5167478A27B42AD7681B6919529BB1430DFCC809E171A334B33A0527A1D9519C18130971C55F6EC172B86248059830FC57C7356C9BD8263F7D571D0F7BD87D2A1686A7C41DB9306558CBDF39F0176959A188B4D457B40C152B7EA09F6860D4D945E78C45EB68B579D48774EB26AD43BC1BE3C0AC327C80B4C1115C2CB58BBC24A18146470ABC223AD51FA10EEFC311F1AC02AF4C7432210233A4ABC408B1DB484E7885D239C0C2B9C4952E577A8EBC3D6A7684E711E12DB96E1F988DF423A395301D2C15FE2F1ABF708BC64147A30E2717F7868FF602D50FA9A3D0B3A0097259AC52057DCC14319C438E113DA967F6DFBA4279245B72CC86CF724C81769DAE271E18C0B6CFA84B916AC89B12A1F8B05D88527AD40346775CC832713146806A2B2884E35628169BC12F67811B507BEE3BBEBCA81AB93B5D700AA92898B3F5CB6E9D345483CA3743457FAD8CC5BEC2A8E7A22A41BA8B67641AB181D42ABAF94D0055206B648C81361F8486408B610BB3552299316B5C0B7D301D9F1C3D55621859AB2EE922C59B11EA9F2A1EFE277C534128F2CAE6B598C0FA059EFC2C24E8A0C2337BC2C57A0BC64A7FCE190C656B529D21244EB66A900288B5C484BB033020B9B9BA3019B72387F2746B3B893A1427882BC3135F0A17F8271F9C8480EB60732672D44336B32F851A283224144C480AA302C05836EDC1AC4569A6020130B341466322D17811229441C4513A2E8041C85E035113992F16799DFE8C1EEF3AFF8CA2F341628808A81E8B66EE5BA47AD0863C735A904565F036A85FB1203058137AAD2206C303F22D3027E732542A342CAF3376D6B065A745E31E865FC2243DA31CE08EABBF8183B4294700BF8928DA8CA78BC08490810C39747FD3851211B22F26451F6772E0C75659133E8D8C063CD3044DA1719855FBBD9796314B11DF8459EBD2D92B7FDC94C4C
-sk = 469963001D4D93DA7CBAAC0ACDFC833C47601AE334DCC0022A9220138C16B9ECA73AD1863431A34F593ADDCA4F0EA393FC4595D22A7CADD0A8D89827086A955400ABAD84226541114CFCB3E3A240FB600DD6C0960A7976175C56B0B48C66721E13882E3AA5784E12869F0C8518037955F876997975D27A7C92D4CF005AB859590504C768B02576A94263C87C4BBFE1AFB09B8C0A5C067776A0D96A5D12925B44AB3D3E57C6971B0A86617F65A16C7E9B42C283577219409E1CA4DE08A92DC5B4E8E87051680C1B24068DDA801FE871E0B28AB0611BBB97CD49BCBF159B7785830BC9D302C0A61AD138277AFC2374AA64E983506BD11288F4A20376B50AE1C1233A1ACF30AF1DA67301A5A420AA826DB58322DC1C7AD8BFD25C3B21025B565C357B4A0802E615A35A384F1794A0612E030228A865A0390197E7C27F45A4258FE26082C850170CAE86721BB5C68CB32153B9934DE4CB11528C570AF363925AB0FEDAC79748B3489B7180E81FF6DB702D5A100336955EC02FD2B9C86C2CC001833B0BA1B7DBC9699C6556B448324D29B0F6A4028BF48A49B1CF60B4A9F91321AA64CA849848CEE2BE0A29219F783008417DA307710F87CAFA2603FD206E5698177E81470AF4C608A6128908541183A5B4769E74166349E55B4D2A2A84600EF712C2D1F13F4FB3C91BCA8CAD209CB5BA0FF578BD6E29A0CF07A972D262A2EA3C4DD44A5D55446C174B345B96871076FCF785CCA68545EB6BE64BC9BE17A7D5914D8A50B286D3A2A8E1A53FAA53815ACF0237B8BF204C34766E97883071E56539361BBDF29187C180414C83D9C09E30983995AA4850A6B2358AA6240642CB9B0FDB739FA5A93EC60C11061AA8B5E71316A517BE2BAEA2F74BAEE32EEAA0A75D2030F5E8BBE1B517F56511FD8AA499621A9EF6C88B96A9F33B2B3CF04381B5C97B743063A6286751AD9EE14903C4674B308DD5E28BC700134C43C788B04460DB78A0E795E24698553722B4C3A095784828960672CBCAFC11AF32C918ACE0580D5BCEAA574409854051A2419F148809147133866F9B651A38622F21E0614F10139BA53724831FF312157146169EA29293D2A3F1250AB9CC877D448ECB53139E6C5487DC2931D45B4A74C34BBA11CBB965E1E664ECFCA54DB7BFE7E61DB2382E50076A70A9AA028670A354013C894B729945830B1125AA53F4D352BFF33FDBE7C64BF70A4C3ACFF3680976FB26368693D928122ED5707B453A1DD714FA9C5A8E6534D45B53A2BA464E217DC0461BE31C5763715BB66B6F3A4C0E7A3A4CC107602CC3B67487A7D162422468B5CF33C8E5A63F801C2016B15C40398F914CBCDAC9664B7601680346FDD3A499D89B5CDB7E77CC8A1215661AA34737149BD0734F7BE6A0C20BB94E6A89DFB9B0A9D6C4BFB86408922FDC9650DF7577E5A89215C8636D5C376F4596C329158964084200C91AF4A7699018C6D139F521204BC521110AA222203774DB88AC0AC94CB97720A71411EABEE0B2863C35607A617E761298825ACD91C73685198BE96B84A98AC7295142F6C19BAB0082C53A8A50A3A39EEC2A34E859CFA2C88C9CBC77B1BDB5377981F61C1FC394D70820336BAF21820D44C0956E09A5D8279F9A0681CB98BC38CB551320031F46262799C182B0355EEC82CDB58D750596A4E6BF1213490810415A4B347E13C9E8514890A0995843936BE342E81C7F4971BF9B75925D61AC8C961492A85D83FA8E33C12FA37BA08D7C681C521ED4060481F58BE673007A081321E01E21419E232283A01CB1A4481550DBADE263382EB93B7E42470B265027A933C480CDA340A9A4065B4BC47990833786456AAAB5A81C0A46E0076B91BA5BB4D4ABE21C6AB193B3A3671C18479DB082A706768A63109D2C4224D71C7C95755CA24B056C355E9C22CF5006662B3218EDD4B317B19962CB514AF123245B152EAC41391CB432C6CAF9295C66DA4E5737AE3D60023F46AA7A604C64A6C403306CA4B96FC2929AED5B4CE7E6C631B473D7D61CBCD19826AB82C0C58880D77CE8F9BCDBF59D645424BAACCCE334809B43ACB99248BBD966C88793A273AE857946902649F97B5516FA2EA2A84FCFBC054653852D8421B6B78C289B49080C8EFAF85DF195AB5562A03E7099C43C439A25AB41390B86DB4F57188F002129F3EA1FFDBB9E9C688EBBB26E0D7AC6EEA395B698A134F70F98480E87313B79444963557CEE82534E9C1CF10B74718CAEDE3BCBD98A68D9956FACD8A45E2184C16B14048B9D28E8BFBF5AB43D1B650EE8CF13148CAF451CFB144656052CBAF82E2F765C8C9C66C23B0CBAE0257D6000F247200AB87F93B5167478A27B42AD7681B6919529BB1430DFCC809E171A334B33A0527A1D9519C18130971C55F6EC172B86248059830FC57C7356C9BD8263F7D571D0F7BD87D2A1686A7C41DB9306558CBDF39F0176959A188B4D457B40C152B7EA09F6860D4D945E78C45EB68B579D48774EB26AD43BC1BE3C0AC327C80B4C1115C2CB58BBC24A18146470ABC223AD51FA10EEFC311F1AC02AF4C7432210233A4ABC408B1DB484E7885D239C0C2B9C4952E577A8EBC3D6A7684E711E12DB96E1F988DF423A395301D2C15FE2F1ABF708BC64147A30E2717F7868FF602D50FA9A3D0B3A0097259AC52057DCC14319C438E113DA967F6DFBA4279245B72CC86CF724C81769DAE271E18C0B6CFA84B916AC89B12A1F8B05D88527AD40346775CC832713146806A2B2884E35628169BC12F67811B507BEE3BBEBCA81AB93B5D700AA92898B3F5CB6E9D345483CA3743457FAD8CC5BEC2A8E7A22A41BA8B67641AB181D42ABAF94D0055206B648C81361F8486408B610BB3552299316B5C0B7D301D9F1C3D55621859AB2EE922C59B11EA9F2A1EFE277C534128F2CAE6B598C0FA059EFC2C24E8A0C2337BC2C57A0BC64A7FCE190C656B529D21244EB66A900288B5C484BB033020B9B9BA3019B72387F2746B3B893A1427882BC3135F0A17F8271F9C8480EB60732672D44336B32F851A283224144C480AA302C05836EDC1AC4569A6020130B341466322D17811229441C4513A2E8041C85E035113992F16799DFE8C1EEF3AFF8CA2F341628808A81E8B66EE5BA47AD0863C735A904565F036A85FB1203058137AAD2206C303F22D3027E732542A342CAF3376D6B065A745E31E865FC2243DA31CE08EABBF8183B4294700BF8928DA8CA78BC08490810C39747FD3851211B22F26451F6772E0C75659133E8D8C063CD3044DA1719855FBBD9796314B11DF8459EBD2D92B7FDC94C4C4C6D304E0494D88D83B5E3AA5761DF3B299551A24F28994D2747B2B08945BEAD20A7237801F470FCC2BD9FD7BEA8322859B850F7882D362947432913DD068C01
-ct = A95AC6C09FB64C6D773EEF1690F3B87550BC37513FD8AFD9B1BD88B7B51BDAF9EC20EF1E5B2F7856C02211A7936FECD414F991C098A77F7C2652B0BF095D368F02A2A293F6300932BAA5AF1311D05EE3C4EF967003DDBE06DAF30277636292E5F435DF449904A9C47597DEEE95152D0296F0DB4013609A986A27FB8C50C453A76906D8494416434B048A2B411D25AAE800469B2ECB73592A2BBAAD4E392F3C5367B7FFF2C9A4DBF65C296873230782E4CBBB2C613FBE8E5892ED04524F353F97B6A83CBAA6ECA393BE675AA3FADC2615FB5A2DDF89745F36C83C1FC204580B7E4CE24029E0273DB147666A6550DE9364BED46F3C20E80F42CC013196FFE4E06CA8FB9FC421C798B6A287189861CAA148EE2B6B4326D73F51B9FFC2B97132EC6F4C0D52DDECAB76ADE333C6A53E090759AC5D8B43779911FD98C080463938E0FB7DC6F69FB35F71919179D82DEF20AB425CB56554893541CDCE3652BE623D49052EE9DEAFB39549B85DB84CDDF45F3D113E815CC0D32B3F180E59FF69415DD50B756624C84579071DE883E2187FEF0A63189EE9D342679FF0DCB98A2E963B490BCA4D60A309D08FB6C31A1CACBDA0D004B6D666676725EAEEA9D31F7205D3C02D12939C3926EF259429642A9D9C375D77F51B8356CFC1F504858BD56E445F05CCFF5109F73B89560788EC833AB196A51E877C751B70A67357C70CEE24DAA81BE2C666BA20D1B7DF9818CF9900D2CBD83FF74E47F999689D2F5BB178E9A6D4B4D49538706136F4096A919469B4006766D5279453735B84D2066389FDE6F600B49D4DE09BE55E09E7C462F314C921F225E0168342DC4D306DDE23B39139627E6AEF656E1F803EC3DB9697A8FA5772994C7F5A0E6E23F71B025D007FB106E81E76C3D9C718930A1A33767DD2B24B3DCBB2728E9746429625330006CC71604950F1A5124C3A820AD98ACC2DCADB4A1FE4EE3B04FFA3FE7305700AD11C06183AA4864FC8A254D9B6319D3C8C42BE03DB71EB74E585EF4A8D8066FC9D6C5D4FBAB3345D8241A9E6F960E238007F8897A50C6FD1EE62EB24AA67EDD962A2F2A9286A365282333932BE877227D0F5E77767CD69FBC6001CE647F29D89E145A91A16D477DF0424F73C6D310C68897E50F3DF553008DE313D9F9ED621E3C43617FFEB5E969C015DFC361A06E9E649195ADF7C4E9BB6AAB204256F1D7F6D0B080E2981932281937175940EA11583F862D7A001BC33A0E142AFD918CFF3764E99E52D3E920591A0030B3AA55C88589C0AAF243EAEBC6F08E2E3B3083E6A41E500150B90C0172F534B597C958B0430AF44204165344E218FD84BFABF8F580489F89748103B451FD9F5462288A03FA317FC72BF986EE03CD87709B646C4C611143536FFE596DA2BF049EDF32F8E40B0C465B24EB81FA09D775C7C5A99F5ACF2C6F24BD13616E6D7E27CF2DC938CF5BC17D8F4EA78549377747A23E341F19455B7C95764A8476AA41F1D33B2344938BC3FDA480F646DC973321108BFB7638767660FDE1FADC387EF
-ss = 633D9672D83A112A260B9D4C17812359B5591900A3B80424B3590B403A5DFBA9
-
-count = 50
-generateEntropy = 2d5df64d62cb07fe630310bb801c658dbf3d97993e68626745de39d37fbfc2b27b534537addaba4ecf14f02ab317d36cb9f0f50222ced7cf029dff8a0d3d2fd9
-encapEntropyPreHash = 048ea516d0ebbd9f709b47eaac66f344c571cf50f0d01c9466aa061a50b66a24
-pk = 41AA7B69158362A41767486EC3DA09AB4335FE2A25DD6C07366478CDA91C691C5ED9264F771124C1F3693050802F480F5DF89D5BE189DA765337A69C5C838488A0A4BA7880E91871FE346CF3ABB0AAEBADB211B5ACD3B773C9146CF97920E509DC202F79B14734C9777A567CD44A43500B5EB8005BF4C5A387701286639E6D9AC2574B33F2432B3A787039E34B2AE511A27825CBA7A8E09B401CFC6123D3B4C42318E7B032331230DA960A09F61A6A196DC185BB8BF1C1A6B691A06CB57F12BE1E45269C56490E256A83C13352A878C724242FF0681881160ED03166612D69894951D65B95E690DB46129D149AFBA2C835D3B138036931423D2F84CA51179466A1028D1601D5C397CC81B1B5E468869185B25095A0E5B5DD6A421B5C7ECEB58C4CF97B7FEB114FBC435C78857C65098D3017FF8A58F5927E5EE7712FA0C2962939B9D8C84BB6428B3902881188DF17479EC01E4709B7840235CCD77ACB0BB3A05995693781FB711D61F2883827A96DDACE29A9CD43EC6ABD4691BE1A758B72A629F6AAE1C795981C0D8BF8160BFB3B8F5047E1A410CDD49C6A42ADF0BCAFED1B21EEB95D504B1A48B1ACE228BB5E1508BF05128F0CB63F5597851B9DF4CAA5B6AC10F7F6188DC41B02761F840CAA42871C55205CD09771AC9125D6265DDC56A466249FBD774EE53756035349CA12A48237221BD53D7FF1AC18242442935BA818A3B50007A3FC14A2FA3ABE437FF14705DF0CB5AF97561A608A3FEA42A809A7A7D5491453C849DAB7ACD99636931C007A70D01655C7302F9A26012C494DE47839C1EA2951A87FF73968DAE83A86F392F021873BE4C75D2B0700A3B540F50CF6FB664A4627DDA9C75394032F434655755D12D4C781E2324AE00DD61744CEF6C5EC9680F379A26284BF9590A33350905E080E9B70547AC1CF3AD888F30232FDEA7BD2C184F9E1A9B6835401E737204C5EBF2B28F2B58EDD399F873C7849CBA8064B8A20C9C391841875B4963BBA2097B958D752739383BF26787E64EC215974B45848185F44B8780C0714B9651A7685E673CD1B6230C5D6639EA5629C20659802BC6F2B95DF274836241165A524EA99A941312FEFC7CDD2FA8016D69B652C3E94E73C70C97F65B3ADF14BBA2D31916522701D80252E9C7FBD7A17D306A4E1E02CDA405F3F07B38EB65824D5C9D8B91F7013784FBA0DF0348F21B00EF5A325C745A829714A5B9ABA16ACBDF029771D5415E867590CC5A57360A8969407F0749AB8A08A65E37E70146FC1B7BC40D789EAE83761E77749A07859BBC046B5A87E3A92A5368251127F12D27789318F8B9C3C1F79211922C852A0B0E10BBB631599190B49A66937920B3F113185D89C6E37DA5F7CE9C12D37C12CC24741CB9A79446606EABE8C9AB06D8963C959955F198E03A0BD127242DBF2A2180281A7B65F54C28EC9C6CAFE64881D6456C07607CDFB89E2CA2FB3BA8F8357720051C30952734932B08B508402A6A2F4F9C76B053C12A267618928032B5D9E41990A18C2C04BA7C2868AD9F4538FF1B494707EB9DA6B81374D7F9731F9A26089D7033A8C24600944D65871D313387B4101C0AAA27AE19D978653638577BCF4CAF48083EEEB57F401544D4DA3B73DC1C5C4A047B0A5EA85EDAC7BEC66F4D87FD2FE422E7DBCD02D1455
-sk = 3C14BDD913CDA0F267ABAA8B0A30A5EAA527638C01926623B0BC2BA55B0B596A92BAD72E92845828E8050F4C2F40873918E4524CEA8505208D345783F71202496721E361A582C5445FA31FB662A64941ABF9FC203AB4A741C9214C1B80B4CA617C4976C819794F53CACDB3509978A6DF5900016278388234CC1A09B804679F36718255B2DB60A7EEE5BC3BC78BCEEA8060354B54031C4C76B30A1A8B1EBB697FF8606CE408FBA72DBF0856E5B53B1E4A4ECC746CDFC77545B46060974C8A788A1D59529A9AAA571B895BE01ED5C23A0D22707D89467A5B9C662767A0D77D5C49ADCA983CE7401F34526DAB1CB9FE744BDE8C54C230705548B9ED00B9F4EA055466CDE77019324C0A7C9BA404B641A6530AE64A964EA47E6E80AAA4652C9A8B66061103F385479E50A780249A909C92B7913329A478880162D8857D58FA39D3283F5A2A7F8FF6ABFFE2463DB40728D06166627E9C92283FA57A2E46190AB869B6C21FBEAC86911284153B259BD2A442070D1CC581FDD333E5990F84AC67F47491DF01128F0959ADA0891C236E0ACA87755289C0E6C8FB136974C97DBB1B8871A4C70AA001FC950F0CBB3ACE4AC44F800252F5BD76FC1DC09A3D2F8860385A4BF8D765B49C5379140E0A2801DAC947C23803AB6B467F2BB1B019B9D53771418312F51B28DB18BE216794A0467D79AC8ABAF2C90F4B1B3474C168BCBCC1E6AE59C5781296467F2B8D63D5842D67935DD429BF8319BC0B8199CCA9D3F78C483B8E0771622EA764FA610EE13C1A188C56D0B5C17094C1B7A45321BB69D99A666A7963268A1D0A0491B8B5CB700A7D86AB9039330EDD8BB17CF1AC79355A82166458D2323E070AC109C98D201358F22BF9A3B513B8BBA43905D1A790A7B1A11F682583AB4FE0A82F3E316B7C70AFDD823C8FB7ACFD330B22F378E8597CA5357454A71197CB4039E9A81D7995D14587B479657584407B281886D6A7FE9B6170A056D2003BF898027C275B7C1C3D1D0C157145BA52D264699B969D60AA3873A9606041C20B17C90055B8016EA703539638CFF8AA0A219542BF51B68CF153A86149881C087D898EF9C3A089CC70A8656117131AA3F233C73CBF439022D224422920501C07243432AEB925C4023185D3F897A79A983D857C6D1422F9B22234005E00882F77C7704CC74ADEA4C8F3971E7964BA1A530C1F722EF696828C46946F0B329D909A47B83353330630359EB8E9B7E78ABC50FCA8C3AA9AF967C89F464430C815D1959A21A226A966A6434301FA600A4D129886826803EC49A54A34ACD62B50E33FD782937571816421341CD76A3570C17AC9C338E4AC4C51077650B98AE445D236904DA694F755C1A5B288275B517B4C9B896C49BBC18933E52D34969B6AD8ADD604B526488C6397842A54B6657B93386B0ED7D36FD2F448EFE43B0A144C33F729DF530C8B6340CD61897B3C50B0D8BA81228604F7A4BCD120CD2A7BBBA3B4818177C435A2B0C3AD838C6D9BD3903D64B32B8A8DA5D93589021251D14C920328C4063C2AF3C8C41228355527ADF41037E1AC6AA69A427A55354CA9D54025306C16F93154776B4A7AF9C9EF2298DBA9B669C40BD0601ABD410357B8940511BEB6C96541AA7B69158362A41767486EC3DA09AB4335FE2A25DD6C07366478CDA91C691C5ED9264F771124C1F3693050802F480F5DF89D5BE189DA765337A69C5C838488A0A4BA7880E91871FE346CF3ABB0AAEBADB211B5ACD3B773C9146CF97920E509DC202F79B14734C9777A567CD44A43500B5EB8005BF4C5A387701286639E6D9AC2574B33F2432B3A787039E34B2AE511A27825CBA7A8E09B401CFC6123D3B4C42318E7B032331230DA960A09F61A6A196DC185BB8BF1C1A6B691A06CB57F12BE1E45269C56490E256A83C13352A878C724242FF0681881160ED03166612D69894951D65B95E690DB46129D149AFBA2C835D3B138036931423D2F84CA51179466A1028D1601D5C397CC81B1B5E468869185B25095A0E5B5DD6A421B5C7ECEB58C4CF97B7FEB114FBC435C78857C65098D3017FF8A58F5927E5EE7712FA0C2962939B9D8C84BB6428B3902881188DF17479EC01E4709B7840235CCD77ACB0BB3A05995693781FB711D61F2883827A96DDACE29A9CD43EC6ABD4691BE1A758B72A629F6AAE1C795981C0D8BF8160BFB3B8F5047E1A410CDD49C6A42ADF0BCAFED1B21EEB95D504B1A48B1ACE228BB5E1508BF05128F0CB63F5597851B9DF4CAA5B6AC10F7F6188DC41B02761F840CAA42871C55205CD09771AC9125D6265DDC56A466249FBD774EE53756035349CA12A48237221BD53D7FF1AC18242442935BA818A3B50007A3FC14A2FA3ABE437FF14705DF0CB5AF97561A608A3FEA42A809A7A7D5491453C849DAB7ACD99636931C007A70D01655C7302F9A26012C494DE47839C1EA2951A87FF73968DAE83A86F392F021873BE4C75D2B0700A3B540F50CF6FB664A4627DDA9C75394032F434655755D12D4C781E2324AE00DD61744CEF6C5EC9680F379A26284BF9590A33350905E080E9B70547AC1CF3AD888F30232FDEA7BD2C184F9E1A9B6835401E737204C5EBF2B28F2B58EDD399F873C7849CBA8064B8A20C9C391841875B4963BBA2097B958D752739383BF26787E64EC215974B45848185F44B8780C0714B9651A7685E673CD1B6230C5D6639EA5629C20659802BC6F2B95DF274836241165A524EA99A941312FEFC7CDD2FA8016D69B652C3E94E73C70C97F65B3ADF14BBA2D31916522701D80252E9C7FBD7A17D306A4E1E02CDA405F3F07B38EB65824D5C9D8B91F7013784FBA0DF0348F21B00EF5A325C745A829714A5B9ABA16ACBDF029771D5415E867590CC5A57360A8969407F0749AB8A08A65E37E70146FC1B7BC40D789EAE83761E77749A07859BBC046B5A87E3A92A5368251127F12D27789318F8B9C3C1F79211922C852A0B0E10BBB631599190B49A66937920B3F113185D89C6E37DA5F7CE9C12D37C12CC24741CB9A79446606EABE8C9AB06D8963C959955F198E03A0BD127242DBF2A2180281A7B65F54C28EC9C6CAFE64881D6456C07607CDFB89E2CA2FB3BA8F8357720051C30952734932B08B508402A6A2F4F9C76B053C12A267618928032B5D9E41990A18C2C04BA7C2868AD9F4538FF1B494707EB9DA6B81374D7F9731F9A26089D7033A8C24600944D65871D313387B4101C0AAA27AE19D978653638577BCF4CAF48083EEEB57F401544D4DA3B73DC1C5C4A047B0A5EA85EDAC7BEC66F4D87FD2FE422E7DBCD02D145572BE2F5CD569E6229F00014854633F7B278E90AF4EA593411909467A03E29CFB7B534537ADDABA4ECF14F02AB317D36CB9F0F50222CED7CF029DFF8A0D3D2FD9
-ct = 90606786779293D177977750726975F4EB4D2843F8F693800A1DD52AFBE25A79C5E48D83D02E9CDA1E3909D1C23DB2E382ED3DE92FBEAF611F326DD2A34E597CE9695E211FF7590CEA226B588A5BF394E8AEA1AA959B45E32E7AF8DC01500F950F9AF77878B8F280E917579650DD9ADD147D1879F249FFA2B48E170B5172B97DDD0BE9BECA1843BE63C7532F7BA2B85E508A600B1592759EFFB657EED4162855ED6B6BD143A91523A3D033BF5F6199F8D1BC7021A37ABFBB82886777797EAE296F9D5748FFC0A1276575FCDFA8056030AF0DC936AD79D24E68228F9C50F3F406CF0DCFC8C7767285B67EB6BAEAD90391D8DD18781752FE025407B96C6F042D251556B610755D1BDF36A806230A11C2852827A048E835875239F99BC4A31455E13ED565961E1EC56AC4719993F2D02CC08F03941F9FE37A7E18A66DCB2E5EF5A591FC5A4C5128EFB1435FB97A2A396B749F911160CB4078F5D34FCC42572B95E4BC5929302E1C77F5E13F633CAC285A61C2DE38877D8CB44D9110FB415C4B7B7132A04050890602D7ECFCC1747600E8F2CC27CE59C9389B227AE001B1133BA633D0B332EFB1D2E1E6CBFEFBD162CC62002A9603CC2F0B580AE0C541D4DBE47E527BE1095112855F97CFE206A38583EC34D7B87CD37824206D7EA069FE35A9C8AD0F14C45E5324A28013C1A2D705364B67D710FE03EB273218CC5EF9DE14243B6F097E7129D90D770B7515E214DBFE7BBB53D816EFF35714CA0B940027145B80598A2031180251C5B508B52970C98DB719F53C11A16E4E8161FD9341AD76EEDCB6AE20B6FF1C0AFF2E78E538515B8819BA6110ED4BE125037533489E0C76E52231A0EC0569DB5EF47F6492B7D6ADA2276F93AD2D53B08E45E8872378AD44710C2254556435483D4BABBA906E60EBEA08D652C17DACB971FF31350EC86E61B655D106D0A7D8BB8D224687C77D9BF70FF94E55D658CBA09EE778ABE08D01FFB05252F98B378DB8467CF5254CE62269C1D42DA233FC59D032B7E69FDCCB57B568BFC40A1050FD73D9E04D29BE0B4E63FB7A817DB603EE7CDBE280E772F7D18B4C2E3805F6EFEA65F1FA09A9F3175F4104C2642B0867DD997AA26D55428F41B522B8CDD48206FBFB97DA0E7CAD7BAB9215B7850B6AD4389148CFAC1F9DF17D1F6B8F629BF5AB4409E99B24016EC0F425ED4EFAC98FAA2166C6B6CD39022BFA01B3FD57D30EDF1F2298601420DC2CF757E3702E34B7EBD285D2DC6BD0FD07967EF1BB9447DAF0F0B5F52F2C61DB0E7849FF02D03C50703961A5C03FA23807218A04FAB9466633563B8833784DAC8E23B11A0D895A5EEDDAB644C23F6332735FDB0AF36345DB18EBA4E5FB4F4A30000DA7AAB1860853103792D4C32FE13B8EADE1451F6537212DDE6D0B1160A151BC4F33725698930774D5E26FF1B57FEE3D2C19A5E5AD0FB0A0093C4875159947DC8B7D915AE10FBDBE2FD73ED5342BAE093D764C26ABD30271EA1AAE78FFBB55B2CCF97CB8D75FC6438147718B4E844D14EFA5965BD6
-ss = 7EFDC40486793DCBC7C030273F8EDB4178075955EDBFBBF0F21B793206A172D4
-
-count = 51
-generateEntropy = 25056d1b8113bb362dd979d98643d7a7ac9c4f95994c0ba060609b6d07002ff3f48a9254dd40b117941fa35a66bb50296327b725525deef70e128ca8045ec451
-encapEntropyPreHash = 686c921c9db1263e78ae753b1c9c2e7936b8229dca48c0942c56c6bca4f10917
-pk = 32B6C92F059443501427AC964FA569CBB074C71053F179BF1963AC704489EBB9936E23950E51AB7E26A98D6031C652701FA4AC59AA7C15D88C0337A067257B8D916DB0456FAD9622F44A928DF6CCE84A3E6634C9CACA246208920C487B9A666342ABC389C14C499785BCB91A95DC868FA20D25B08AC0E48C72E9B486151F21B11731D1BF049174ADF279F9020AA98C38372877299C4F54A4493A3B20F8BC71CBC490B363C4162055CF3A5C13650DB1154687462FC01B5E5B78C9F603255A24189B808358E17E01B9CF736A77D78A32520B6DDC9C1DD65A00E84B562B607B6AB472D5173AB53A97DB08B322E95CB3378D5D088CD3CA6FA4739C6633A27D686ABF040DCAA766BCC18D6B8A2F91E51ED6D49AA37AA44531BD9DFA25C116A842E50F53A68BF1617245E8B7DA778EB3343D3F2575EA84627C640A6509133F4C5D78151A6695245659955CD3824F264A7DF58EC87C8AA3066ECD1B68D848CB758487E647223C0154388912ED028AE364A9FA9A018D8558C3E9B179B66F2488C2BE8792B1849FAC0401A9756F209889FA637CF7ECC4F2C0249EB5C6F7E0219FAA2A9433759AC70DABC7BAAB623C2023CF7EC869B75BCE953CA3316B7A6FA685BDC7C8D467273268A0797B8D6FE57DDFDB03FFF7AD3D5B9C80DC1939720EE8810933A04F51B78262910D7E28C0EAB06B91980B65056472A293F2361183125670AC2426E514790B945D6B09C9EC354FE7C895A30231D95794F89EE60761AC9B2AAA9A75EF168C0950AFB498915B2518E010C3800764BC5A65C0C54B2AF686B7D954E77BC4CF8137AB398FE93429DD0AB80FC846D4CC8DB2B9B2B4BB36D4C4121639C1E74622E59250701302301B4DF96B2FA62736B29CAF0866096F842898B2C6012B93B5AC23D1F39E192002FF0B9005FBB8CFEB8930562A4E0AAE7A40C5032B8B33D0760D96C7C203920E2439D3EA02372C7F5D80B92259349076BA20C3AD4FD21752A3963CC5126342A963A363C1157F33189732F7243E465B14969F1CA199AF45B50851266742151A235A8BA9A595534BD6AA31CCF52B8C5885D571A93D2577C57057E2CAAE68C9C84F565C72681FB15056A345236B02A1E5B13289388F035A2F8E03402F8B0A44259179A904C94725319ACACD28AC1E449B87E8916091940E33861A4A35A8600267F04FFC6A3E06C60858D578BEC60EE7716FD4B0225E5CCEB5FC5437387522200F66FC880E0C874119C71F462CB4EAA24E67BE77CA67278344199B27E2A55B50F372B65345122225D7324CA9504CE4D12BC101639E93B331E3B60E1B520E03C9703A69F54C2B1A52254AC44B86F310A711263A5A9B87A7116EC5654F7297EA76B63F939C1F49CE99D52BC58876160401558193AD98C7C8F4B6822712429679214BB2B6E8B324B58E1F57695DC8968BCA7EC3717DF12C1279408183B49679B349E2E45686E722C3A57BD9547A65656CBC79AEC1D3B129837D84A6975D018C7AB04C88775E9C68839955775FD66AB02AAD69B76307F51DB2AB33915ACA61969AEFF14674A557C322AF6997B1A8D9C51445884779227EE742986446EA1719808996049038E0D9AECEE828BA054417CC3A683A7295066AAEE9CB429C4740531990744A987152DCA2388BA27E3769C8BF287E54E41CBC0ECCA95CE621F2
-sk = 2D149D32C41889573CCB5166C597C3FE207CB806BD13A8A7BDF86267A93DA7110A31F22221A17A5381C367EB1B9CD00810189C1F12358B59ADBFF2060ED6AC6712C660B51B553402D406BCC1D2444A863B6FF261E17AAFFFD01BAA2B05CD83050AB460CED09BC7C0C2963784B7F9798D837BBC0483001539F0EA65A0574B46785645019B25130095725FB71556ADD2832EA245E250973F504DC58A4BA3C45CC8259E7906588D688F4F4CC79A1A955EE31E0FE931D16CC9DA767C3A48BAD09874F7730FA74C349D2163638AADFB59A462E904C5530A0B485541E391B6037041EC6A0560563F186BE2AB97A42520A7DACEABF1216E16870437CF012A6B6D082BBB23349628AF4DD8CA9EA986498A80EDFCC2418C3F5A627BA8BAADF3739B3C578B2F193F57B72DC2827A2DC379AA31B6127C65352338C012CFCCE0AF1B33150D488CF47134E06B5EBAF0432C172090FA6671670BF7B66002E135E7C43D938343D5729E22E5597A06209E0793E65417DE945B5E1AAEB2740FB1B350C902C1390A97586564FA94120CF7538B21AACC0AC0831B477E37C9E984B73EC91ED88705EF4CAFD2F15A50227C0E4C0627D2A6D7875E9605AFEC339799690BB6F0A5B01141A6976FD51AA7A079827D37CA89726686BA95D6F275A59341FA229B4C163C260C4DBC4587C50AB8F0AC777849B5F700209F17C15251854C35AA23C20D486122EC8145565966F4A067251B96461950AC2171F1996E94517610338B88C091C356804CC691922449DB0645A404AE4A641D1482B58E6230C7965C23605D66E96C8F0418AD786801D7530CFA2B5B757E06ABC10518B274E3992E538922B717866C7EEF827D2BB4C05FFA3322981CD8069DFE028D878A8B7A002472D302253A83AB84ADF5530CC5F4671BF5219FE600BA97ABD2555C52857ABB76CCF4760ADB30346C55AA5340B189E1968F72999E64C0B76297D232412B3C9384783457B83309BA7EF74ABD50D16EA1C32A2362AAEBD02DA7790FB8827FF368261CEC14F3A2095323502446703783CA9B6AA595D690031297C59B25414455C155924A47896716AC45330CE7069D131B75A57769FD4B4CA1990170A3570160CDBEF1C930063D56E3546F09B1CD913C82057C0BB89111E6B1BBA88EB8CBCD72078FCBF5059FE25C84BB5607D7B20BD0733FD96DBAE2ABD9531DDBE3CDD89A926361BB56EA0E5F9181B2C8C1532312F3F9005135C07DC211B824B1E63AC96E64845C35C41E0313511A5D429663796ABF2443908D353766D40F47A910FD04A710BA5D6A5B301832A5B6016338D8858B220E8219512B643B8B60CA2A9347EC39638B787FDB44CE72408DCD2504DE24AF91130ABC09B2E7C9BB26B3393EE06FD77019ED3466E019AC92A416C9683DA22CAFB1A9AD3475AF17A15EE9F97446096647578F77FA02E79904FCC008FE509425446CA2A4C1DFF32CDFA4CE120230BB5CC9CB49A2E2841BF69A1C49A762EC171698CA0445201C485A15FEF2562EACABAD3259119C9BA4185677E03AA0470CA848709C4BA0C8E5814416C5678033C819773DB36E7A90C65FA82FFDF6921C38285122163BC0744DE5C5363C9A973428A6DAAD20E5A62D37017B464DA7637D32B6C92F059443501427AC964FA569CBB074C71053F179BF1963AC704489EBB9936E23950E51AB7E26A98D6031C652701FA4AC59AA7C15D88C0337A067257B8D916DB0456FAD9622F44A928DF6CCE84A3E6634C9CACA246208920C487B9A666342ABC389C14C499785BCB91A95DC868FA20D25B08AC0E48C72E9B486151F21B11731D1BF049174ADF279F9020AA98C38372877299C4F54A4493A3B20F8BC71CBC490B363C4162055CF3A5C13650DB1154687462FC01B5E5B78C9F603255A24189B808358E17E01B9CF736A77D78A32520B6DDC9C1DD65A00E84B562B607B6AB472D5173AB53A97DB08B322E95CB3378D5D088CD3CA6FA4739C6633A27D686ABF040DCAA766BCC18D6B8A2F91E51ED6D49AA37AA44531BD9DFA25C116A842E50F53A68BF1617245E8B7DA778EB3343D3F2575EA84627C640A6509133F4C5D78151A6695245659955CD3824F264A7DF58EC87C8AA3066ECD1B68D848CB758487E647223C0154388912ED028AE364A9FA9A018D8558C3E9B179B66F2488C2BE8792B1849FAC0401A9756F209889FA637CF7ECC4F2C0249EB5C6F7E0219FAA2A9433759AC70DABC7BAAB623C2023CF7EC869B75BCE953CA3316B7A6FA685BDC7C8D467273268A0797B8D6FE57DDFDB03FFF7AD3D5B9C80DC1939720EE8810933A04F51B78262910D7E28C0EAB06B91980B65056472A293F2361183125670AC2426E514790B945D6B09C9EC354FE7C895A30231D95794F89EE60761AC9B2AAA9A75EF168C0950AFB498915B2518E010C3800764BC5A65C0C54B2AF686B7D954E77BC4CF8137AB398FE93429DD0AB80FC846D4CC8DB2B9B2B4BB36D4C4121639C1E74622E59250701302301B4DF96B2FA62736B29CAF0866096F842898B2C6012B93B5AC23D1F39E192002FF0B9005FBB8CFEB8930562A4E0AAE7A40C5032B8B33D0760D96C7C203920E2439D3EA02372C7F5D80B92259349076BA20C3AD4FD21752A3963CC5126342A963A363C1157F33189732F7243E465B14969F1CA199AF45B50851266742151A235A8BA9A595534BD6AA31CCF52B8C5885D571A93D2577C57057E2CAAE68C9C84F565C72681FB15056A345236B02A1E5B13289388F035A2F8E03402F8B0A44259179A904C94725319ACACD28AC1E449B87E8916091940E33861A4A35A8600267F04FFC6A3E06C60858D578BEC60EE7716FD4B0225E5CCEB5FC5437387522200F66FC880E0C874119C71F462CB4EAA24E67BE77CA67278344199B27E2A55B50F372B65345122225D7324CA9504CE4D12BC101639E93B331E3B60E1B520E03C9703A69F54C2B1A52254AC44B86F310A711263A5A9B87A7116EC5654F7297EA76B63F939C1F49CE99D52BC58876160401558193AD98C7C8F4B6822712429679214BB2B6E8B324B58E1F57695DC8968BCA7EC3717DF12C1279408183B49679B349E2E45686E722C3A57BD9547A65656CBC79AEC1D3B129837D84A6975D018C7AB04C88775E9C68839955775FD66AB02AAD69B76307F51DB2AB33915ACA61969AEFF14674A557C322AF6997B1A8D9C51445884779227EE742986446EA1719808996049038E0D9AECEE828BA054417CC3A683A7295066AAEE9CB429C4740531990744A987152DCA2388BA27E3769C8BF287E54E41CBC0ECCA95CE621F20831C75B153FA17D336A79FF6E88DDF485DAF7B1B0BCF39D8DF15319D52AC67EF48A9254DD40B117941FA35A66BB50296327B725525DEEF70E128CA8045EC451
-ct = EAC0E656E53BD64C8F7B2BE3647A96712E4F83B04FA4555F1D3B8F9B796B9841C2D239956674CB51CA6DD945F2B9C40CB3341881E883A6A4B356538CC01E6E42B72DE8754BF38C4363C5F39C9661C13B207DC92767B34AE07C3D38BDE0BE4910E4AD5DDADCD4AFD41C5B6B8A00D537ABA8F5796F940B892EA5B797D2A19021168CF55F0054B6C6C7D43B192632F3DAAAF4DC99C2157EC5035E8039809A95126DA22408AAD3558C2C52528B46F313B32D8730CD5C5EFAC4F58F539CB7DDDF931C6EB9AE718BAD5B5F10561A922D4C0EFE6531FA7012568E5A372F6380D5C31A5F722768B2E9395B8D66768E4D8305DE645927D91BF7627977E9739563761581F438E05A50ABEE8178065406D40CE6818EDC2ED16FBF346DE6B40FF715CE1621FB2D55357E359FC3B67D1010FB65A732F4AB7C7BA83F4A9F8C294C7D96DA285B931F78AE792AACC355B8527FF2CBA6EE903B666691DD4F6ADFBD58F21EC2143571E061F6049B61AAF0A56885B34559DF49BCDC71B1D2DF11EFD96BBE1EC331C8483AF5D9EDFCA14F3955CDED0A2AD957759DDCDB02A93C5876FAF55EB8A32B74975D5ECFD3296B00694EA1DADEBD5932B306307943680AB5A2B25CAD113A22AADFBB9DD8F4C462FD6EFEC2560EB8BA20A0B2BFDEEC2193E8D8EEB70F759E32B3F07BB3F7F5AAFEFB74C5C54D7AA8369D8BE515EA5ACEF7FFBE63BE3AFFDCFF6144FF59BB0E4EBC711A9F001E05D3A4BB4971377462E695FFCB41D81AB63ECB228D47049367504E279E5CEC3D1CBEEE4B1B9AFD9EEEB8565CF6AE4FCC0F62F40686DFFBC7E9A4148EB3AFF9B876987E7D67756FC83DF5B69CF46FD3AB096E5B58F16756DD1EFFF6B898CCA1BF81E19B364C3854420DC8570CC2C5B0E9CEF31180712BC4CFE866465409433B57577EE869F77A3D713BF983195B53D825D6B3A6F1DA471ABC964FDAF6A9CD64D21C979C4609FF77339EF560C793DECC75A6C78D01A8A5A6D1071708FEBE38C7DD95CBFAA4685B5C8E22FB0A17849AD8BD0EE1A613CB2A3C6D1EF0A4D32BC535E45FB5C4022B870F7C410C9D93157D13C47E8C4A89DD9742EAF9603AA98E98020B0EA05E9C6D21752CFBB0D77995DCA48E0CDAD479364AAF3ACB4A99204A006EA3BE92B9819FE611FFC3C9C73F240B147C038151BA94CD1DC0E78EB7EEC32ED7B1D2DECDFC6751664B80EAFBA4600737FC2939413ABC36D14100DDB3F67EDAC9317ACDCF043006FC01FD97FDEF6ECCE4400B542A4AD2BDC4107D975DFB762761739ACEFC9A6B2EC26AB9C80F24059B46CB52DB1EBC929ED159497989131A7B67BDF78E141D8BCAE3DCBA7948CF843C2E1409830B2234EA1638C378B40C87907B1557A81044A5D4407CECEF5AB2DD55A28CF30AD06E741BF47A5652E56DD44AE96FB93E57259542F4EF268EB9221D714E472B4C633D2F4194BBAA72B629B83C7108AD2DDE0122B3A31F5D028C911DE14F1E80E23001FFAC0E8434226A1F0834CF5A5E0CA419D46759CB8D9A7236EF949A9CCACF70DFB4
-ss = A33BBCFF1EC8C4D3E3229AEC78463FFEAD5B96C6C1FA857921F8907A9180AF07
-
-count = 52
-generateEntropy = e4d34e12982aeeb1d62fd488d9b9e28557ed3429292239fb4f76fa9098009acae6c45c7fc62329b13c8d29844405db8ff6860de474bf727ecd19e54e6e1a141b
-encapEntropyPreHash = 2387772e50059cabda53cb93ba24b19ae529496c03b36584169451525c4a0e7e
-pk = 7C6B065EF3308AFBA0CF3607B2C98D83F76F7C058262B55F7C0746B3C22437F00DE9D7CB69F40AFD60AE74B0506AFB96E30669F51C464A27B4F177666F92459B293DC208A0DAC5654A8058A8FABC2D1853009743A598BAB2C248068750F01227BE5A4F7C4C6948F9167E88894D43B5AA44687FF177DE837E2F0537F708A8F73A11FE6632DC285C9026BB23424AC2D1CBCE39AC6A0A7686F088D617B096436C9F773E7CC50CEA1C08DB20C2949A7878D18E7372CAE746B04558A8FBE97DF0B9A69090449A507E6E1C07A35680412033127037607B2F0502690B47BD300A84C041650DC748AC2C060260C933A0B81847243FB3267F3CC8DBEA4CEA40790F37CD0373A71EC00634BB3B3B087A82CCB1E1DAB77300156D8094A1D61D1F1BB3F977B749C938AB8092D71C93394856ED133075E2BBDD3CC0F27C2A2D34BC0F633F5E55C0A6C989B1E277EE9132F8779923EB2E22F78A1502BA5E55B6D53A05137867C10536E672C7336A3EA1F237263A6046F260ED3871F1D479BE589744361A0D819439779075CC47A5A33E18326615134D9F09B68B6873C6CCB682F6B75662CECDF5432C37189AE09FAF36735EA01C12F9CE64F4116D509C70E0072A242FF126710D178DAAE86539226C92D090D9B60DC63539F51B46DBF24CC8D54EDA255E0AC19B03D34F5A270B6FDA6D6408BCF1D2A46824B5290B8A26A8131402C9AEA052D0101759345F86A66A4D238A20C6531D792170C52DEED889AC3050FF87C659524337830C205622A989736B788092101933C0073C0B686106A9B88C17958A8711D272392AC448B01507634DF4A23846AA9D594C80BCA99F17505AC1793F2877BAB4F1B211D2985842795C4C1B9FC018DD15B510556EF89B687E6B01701CBCE0B56159A90F7B2C6FC1039AA38449A596C087A62B2EE5A7C3799F5A601BFAF8B9C598834FA115AE010F71167FD41B5CCCC45146009752F380CDC56453E554CC779604F976FDC34E9F135261EABFFBF00AFC514F2699AA6A5ABA0638542891C6858C7F6C6C4A12E4CE2D89B50B04C33EF262EE8B0D9A7777D3C56C85B1BAFAC7052FDBAED24303C843110C1892381887EB351134798B9745BC229208B277C2C999570075903DEB530BF22F7906B75DB35C3B24B04751BF6ED41724058C70988952D86B48519264D25EC2B817894AC370BC081362C841EBAEFCD7625A67A48E3CA492D63BB9036A5B9A35D21470586510ACF76FCC683035B18C05ECA7D0702E0453AE00A8144779117D7C19CFFB568A3C0959193D689A6ADBAC13DF43907FD45FBF3313D49425D32AB9D81C6BD9B3486C3636E6E0015152C1CC78C809F3A3FFBC6F0628609B996980B3C43294C0E293940CD65A34BAC8FCF020CC611E3E2C8E52F5AE886B8D9480551D012885318E5E6C1ECEE0A3D75B342667C691D19F34FC7946E7A7047097F7938516CBB6C7F3ABDB85B15E302A5547198AC0B89E7C2BFBF74050970E8DC746CF16BEE6147076BB89C5124A89E070A785427CEA590301CEA7AB28ADA228EE7BC7FCC17074063358A706989C8D6C82677287905722CCA0A24FF91958C44A3044787EAB3599EAF241EADB932B06B151A1A02BA8B244E9262B96144302124DDDB5584ADF5FEF6BDE5872A551B6840E3A082A8AA6DFB7232A6813367038CC
-sk = 85B01A4A587BAE308D39792B47F71997FC55FDC2746F881DDF7BC215145C56D399C6447ADA39230866384BB718ADA160A7349747867CF695CCCDB8A4F1FBB3E573ADE85CCF38924F36482BACB9798D481521A0CAE103CC9FC9675184490F281D3516CBEE910287758A4C374C0A4313F1C29251B1655522936DC329F540A1FD887F0C775823436DF736C367AA3013341E66854FB39A9EB90B23CAEC3E84690AD531141F39914A77A767A47B60F2868CF11311AAC9DA94C72E9624D21814CDC99C89A4B35E1C4C63CBB3EDEA06888162E180503CFC6616B24D270601D0D275C03109DD9486220B66D523A8111B4DE5B99D236586A09A4F77A240CACB4A737C770BC4915F55B609075EE68499654BAF90622647052A8369872A93114C80C60FCA1345E20114552119669A0D3A7188D3326017CE92112F0B715C26B40851683478E5C719C11088F00AAC577F5A8763D4A76E3CD00CD9061F021672847BA0D4785EA7B1B28FA364E64C4FB7F718D2352B1FC26858B6552419A4D8E1B22F8C7992E3B5373183D040948777C356D514FDFB2D0C5A636BC5416A799270E5C975C0A62F3A76FB134646B333B75582F7F2C51CF4BD37835C3FDB2CE1EA86306362F8216D27E40CA43A45EDC9554F08C604624659AA10EBD29E59A60F7BD66EEE447F4398ADDC73387579148BC4A26B6749C961926FD34296DB3044CB0D2D1312CA6A6755EC48C46865A36A6330A9AA5D39167C6062EF1A7C82CA5C0AC1B163B85E43C278312C4304AA127D66576E7218C2D0C850108076109919AC6931264DC2E919FF441875E607A97772FEB45F14881FBCB37B4D00B45F416CF56C9501C6598FF9425249740EACCA49D92E31D679A4F16C3CCB4384DB45E47621719C6C585CCC03355216D43625C08760254AE3CC4AEB1287CD5C3F0911641B05C7036C9BB360C72902325830BD25EACB5A88ABDC926E0F205EE857AA66C8C47E434D8BB4A6CFABBD8B681C427846F0E18A2762152B170063B489A3E6B8BA06B00F14A3F2E6AC00725E5724CB629B7A312B3A1221C9460917C07637B71050BB644A38A8192270C857D43EA9304495206BF62B1C4C11B04A817AAA996B2A266CEB8A80AA46674F16207B61BFB484AF461B6DAD9A9E6C22C56F81BB355A6705310E921239497809012159E78A8A249796C155A9DC7CBFE7384DD092239C29773F6610E536A77B879EEF054C5E539A381043C1B53D69566A96D1931B166C6F066CF0EC81E7492A200876D42007724AC916460A1266AB77A327EF1282479685BC43A2718C93A806C3DE3A0CB918C7A734CB04759341C5B1496679987AA5DB93B70F903A5F4024C3DA6FE8BB2EBC27182E1179611C61F8F6214069AB83C7165A46CAA74BBCE0897FABEA9B6B58CD34E7535B0297B4359960D23E4A498CF7610601D92AF2FB6163C4B2761615121B62A7900B08D61065C83A69D51253D48399FC665962AD36275ED3774F114A079F13B8BCE420B44638CFA6CE6018B58BEA422A8287A6680EB21C75456592E8B24CB6C26EC3D3C1DC4A19CA16888E9B7FEA1A863B7A0143307530B533269A8B692CB4522AC1AA27B01D38603FD009E1C02017BBB36DA2049A2C5045A63081266D7C6B065EF3308AFBA0CF3607B2C98D83F76F7C058262B55F7C0746B3C22437F00DE9D7CB69F40AFD60AE74B0506AFB96E30669F51C464A27B4F177666F92459B293DC208A0DAC5654A8058A8FABC2D1853009743A598BAB2C248068750F01227BE5A4F7C4C6948F9167E88894D43B5AA44687FF177DE837E2F0537F708A8F73A11FE6632DC285C9026BB23424AC2D1CBCE39AC6A0A7686F088D617B096436C9F773E7CC50CEA1C08DB20C2949A7878D18E7372CAE746B04558A8FBE97DF0B9A69090449A507E6E1C07A35680412033127037607B2F0502690B47BD300A84C041650DC748AC2C060260C933A0B81847243FB3267F3CC8DBEA4CEA40790F37CD0373A71EC00634BB3B3B087A82CCB1E1DAB77300156D8094A1D61D1F1BB3F977B749C938AB8092D71C93394856ED133075E2BBDD3CC0F27C2A2D34BC0F633F5E55C0A6C989B1E277EE9132F8779923EB2E22F78A1502BA5E55B6D53A05137867C10536E672C7336A3EA1F237263A6046F260ED3871F1D479BE589744361A0D819439779075CC47A5A33E18326615134D9F09B68B6873C6CCB682F6B75662CECDF5432C37189AE09FAF36735EA01C12F9CE64F4116D509C70E0072A242FF126710D178DAAE86539226C92D090D9B60DC63539F51B46DBF24CC8D54EDA255E0AC19B03D34F5A270B6FDA6D6408BCF1D2A46824B5290B8A26A8131402C9AEA052D0101759345F86A66A4D238A20C6531D792170C52DEED889AC3050FF87C659524337830C205622A989736B788092101933C0073C0B686106A9B88C17958A8711D272392AC448B01507634DF4A23846AA9D594C80BCA99F17505AC1793F2877BAB4F1B211D2985842795C4C1B9FC018DD15B510556EF89B687E6B01701CBCE0B56159A90F7B2C6FC1039AA38449A596C087A62B2EE5A7C3799F5A601BFAF8B9C598834FA115AE010F71167FD41B5CCCC45146009752F380CDC56453E554CC779604F976FDC34E9F135261EABFFBF00AFC514F2699AA6A5ABA0638542891C6858C7F6C6C4A12E4CE2D89B50B04C33EF262EE8B0D9A7777D3C56C85B1BAFAC7052FDBAED24303C843110C1892381887EB351134798B9745BC229208B277C2C999570075903DEB530BF22F7906B75DB35C3B24B04751BF6ED41724058C70988952D86B48519264D25EC2B817894AC370BC081362C841EBAEFCD7625A67A48E3CA492D63BB9036A5B9A35D21470586510ACF76FCC683035B18C05ECA7D0702E0453AE00A8144779117D7C19CFFB568A3C0959193D689A6ADBAC13DF43907FD45FBF3313D49425D32AB9D81C6BD9B3486C3636E6E0015152C1CC78C809F3A3FFBC6F0628609B996980B3C43294C0E293940CD65A34BAC8FCF020CC611E3E2C8E52F5AE886B8D9480551D012885318E5E6C1ECEE0A3D75B342667C691D19F34FC7946E7A7047097F7938516CBB6C7F3ABDB85B15E302A5547198AC0B89E7C2BFBF74050970E8DC746CF16BEE6147076BB89C5124A89E070A785427CEA590301CEA7AB28ADA228EE7BC7FCC17074063358A706989C8D6C82677287905722CCA0A24FF91958C44A3044787EAB3599EAF241EADB932B06B151A1A02BA8B244E9262B96144302124DDDB5584ADF5FEF6BDE5872A551B6840E3A082A8AA6DFB7232A6813367038CCB30CEDC4316B63D75B641FBAD2F33241A3FC47AB8B3EE1A3ED597E5B04F77C68E6C45C7FC62329B13C8D29844405DB8FF6860DE474BF727ECD19E54E6E1A141B
-ct = 3EE8CAA61756787B200AD5EC90EF835F55359F55AE04C8CAE6D2FA90CC2E32ED38349B52E4A6BA4ABA658A972B95EB04BDF9D9F007FF1DB61055B41052095687D07626DDAE5F9C2D2E7931C6C45250F5604EBD6D6C4044D18C0A193C9CFDCB212393510F1E966377F0BF34DA89597CDA14FAE339D2A82D3415C7652A4B95945AD0BCB12992472766699FD0F5876F728681AF0EE76D6FD4E45563DCD52AA7C2E5E783CF2A6DEAFEEC004C87EE47B2B3DCC98D59486341ED9B282AF0705B69EC8D498517D0CCC5847D6431677A8FB7B5DF6BEA0E5821CAF8D14A81A0AC674089953179A3DD7C0198A9CE8732663261530C138EA09466E68F2A485A492D5875736D590C6BF0AF9238752EA3949593CD15AECDCD783DA5934BA69B70E1D9AE7C56B8885A3AB409098C17A4820CE2BFC365644A8180735EF122F41ECDB5387E87CE5EAFA8AB1414D48C7B57F52F3338AE5E5758E83E560178DE13676A49D69EA415622CED3C09A42F354B3E48205937A660EF1F9053CA4A1FDAB50FB5E83898B6E5FC8A11D6DDC1B06A29EAC43A5F47F2F70FCB085BCDA559BB3CA3B035E119970ECA86B5F373ADF2BA9CF6B5755445FDB574A40650D7E75D7E36F90CD7C96343446A87882AD03464E8ED40797EDCD84DF74FCFAA83584E8A75774DEA67C74F8C5CAFC18F3BE9B2C11EE6EC6E89CE7452D0A98C64C8F6DFA6198D9CA561E86A1631BA17A6FD6D4181186ACDC327E71FB300A9397DB532B88823D8D310ABE4FDABDFEBA7521C939BBF7413BB5199AB40DAE9A8B7EDDCE3C38293D30D6A5F18FFCB12EA2E8ECF1A942E20F8310825BC6960CDD7041BD9186F723743C8C98432536EF35E69F0E7D8E0A0E05F3E40199EB1F2F7A41B18B0E7F2245FC7BBA28B83A3A4F0CEC6CB919D0CB7B66745200FC4074C510795982665FC880D3F6E3820D4CE2333C717D94DDD36C4341F01819002E21C41B12EC7E1184A1F7E3E6FCA6A18971B1C438C773A7124DE94320443C7D80C727237890CB13825436CF0ECE3FCB867A86F8C2BECD314E2274B9BDFEB3971EBE1730BD44E26B587C464E86404B8A18E35C6FC427C7160C4079C394D11CC93F473153967A394D126DDB344441AE12729464DA5E813E5461439B6FB0925A97B726A2D724850829EC1D6E1F3881199CE47E93101D99439304B00FAB1E6875EC82E4D8766912505121628AB17BF0A5094649E8D5803A59CB35999D8E9A2A7D14646A26F9DB4BF0FDAE3527CAE7CD04DD9EC949DDBB122616881AFCAD30959D5022DEFB1A2F86903CC0B1A63DC1D21D477319DF95E7B39322B69F8E3260B0F52D1EBFE21D0754A2076AD4BE30E2E47165EA3EEB054465AA4B5DCDEE133EC90A4D9C9326F153FCDE75D9E3A3351041D13EF0B9117098F2E266EDF666A3F333D8FD17C514A4A351CD2CFCB044FBF406E1DD5C99809731B988458055EB888E00665F3B2EFC0E4E16F81AAA6F28F1C87495B078B236971CFF1148C71C374D52AC1C5E68CEF548A30B0D6223E995D7216F6604409101D7B
-ss = BBC0B0A4782E2BB9EB19257F5B80338D1E239AA6A08710CBCBA0ADB974D7DC64
-
-count = 53
-generateEntropy = cd6a99396eb3539ca663a51e42063a3a262cc1c5a5fce1566f0597b52ad9fa325a3407f591791a5db4578b5972093a95bec3b8e70c1d542c9b5c9789729f8922
-encapEntropyPreHash = 155c29c5f0378df0cd0e847a80a07143cf7522fcd880c9229eb9feb1ce340cd2
-pk = 9E686B49D538CF32A05AB82372F7525DF40085B3413F078226B97C234B815EC615B2683F1D9AB32DC0314C6CCE6E9620C8E73B1DC85BED5205CDE5A44F40427865A62356CE44751C7278A3B236BC2D208C7B383129661810A6A2962496D058CA4875AD234C2DF951612E665984BBAE791C279EE835B105202D4751F1A330DC6B0BDCC38FDD6458B0CA7A9BDA026BD64E80868B87B58CCF2A37CA94CB06279EE77A6731E847487142561863B5F38C5AA4C0158AC28E95012C10A8B8E99EF7DB12C05009311A74791C6C8B355E4A861DD3CB6FA085884D7A7E8CD270F656CE29F9BF3B91B798032C16B00F8CD722A1CABFBB25C3002324C56B66DF87182504581A76297EE1181CF05A6D89698CC94021B16574264435F2CB137A7A667A4548C96F835CBBCF27805AE37448674AA998818CF26D15A63689777A9B98219AC3B9ECF84203826EAE294800F5A07FFA886CC86E7D095F42C471C121A69A1972A7906ABBD31003F6C8C0D07EF481B55FE185811084D9A472CCBCC586B6A9A6F24D269AB36126A3F0381B29532D027C2D5E21CC5B9C6EC8303E4B388A6B7216B3E581C0566558107C8B94C599F09C2ECC4B7A824FA3DB9A29722317D5BC5D43827F4BC6D3A91F65DCA56BC26DE9D40BF2F69263CB010A9A24A749C931631EC2D13EA4D5136AA8A97EE019AE1291EA34B0807886FFA323AD3B0F83F82E5D9A2D748945A3CA34B9535D0460A6F734BBEEB66A4E3C257BB079F5D80F6DEB0DBEC130FE4A182FDB16291403F37A191C381723965C3FD90D9F2B67C36CA3AC141030AB516A01453532AA06B73A91B5BA7D1A308E286FCED38F2858801022A453320A857B564179C55F0436B25CB191865DE69877B47041D9D0C2C9BC42CA513F207A72EA9A5CC48B573FB402BA8B5AE6D73F2E0B044B8CA67C1031577099B9975FAD7103C7F6BF80099BB51138D8A7AF7BB509B761A9C6407DD9826B7FF87879098248D779D6F26AA0215084F286AC77C50849AD19F29A32B07EF517000FF71799D6BE1D177508BB969D9479C6C037A5A18BF4302720E240DFA603B7F8745144906BB88522505B19336BEE5572188853A47B4F8ED8A040B251307299BE642E086317E1504784990F2149CB2D89B1A8542E4A19CFAFD57ADE9A234545142AFCB3E544B49DF75B0CC78F5AAB935752746EE7A7F7936777330A66C1063C50BECC4286A3DB4AA66CB602553849B5BAAF83965AC6BDB19A9E5DB8251DE0267EA3C0EEC342B51505469AA7FE936A5829463892645438A3A182859DA136E033B926695421A1891610816E136DBBE36ADC08CF00E4B44649410B2A11EF254144C27787E54CC5A533E8E54F11EA94F7E9C2009D25A6248321F04A53C31787C12ACA9CC78FCC06B161701852215BC6C29D1779F5C183152CACB583A90399746F75C5BB337F1B580B9029B112579884F792EA5A52187A109F547CDA89B7FBBA90C66065A33423DA4515D13BB5FFA074AADB0C55119065A51239511BB33288F994B121DA8913992B979A59BBD64036968621E76AE336096FD6125CDAC4F767A883E6448B078DC04B1F2B7AA49A1180C0F3BC65D2A93458291982652063419A9CB7F1042C38F483C4A90E17ACA78E9FE10B44687F9AA606CAE8888E4C21AB0F7B85EB3D3A2A3D2FE8ED883D1DE0
-sk = CE732E28B21F42F2BBD1B049E6B80264B218B581CBAB8C9186E325F7617895E6320FE5C697FC3B82546681B3CA5F4A52F1F7501B652F86D35CCB9756E869795C166362FAC89C7B5AD41C7C74C596E2A7458E419CD10C10C890C94FD3564AA25F1EC3A3282607D8B1864022CDCCEBB1B1E48961207E29264A9CA86C94B71D5382C9C6B8004C818F51A52006706285BB3281618A157C80C2C00905C33316516C17F04460124FD79A1C330417984220334C84D96A66FC8A5556814C58F7826EE86F17319DA3F504F0124C3F06CA50792C1E1800FEEA8A8E8805A54BCB90C52ECA144677327F5058CCA151617F443DABBA304B353F4A5CAABF0C179A772582711C033B3F3C1225F191B887D8294FD18914850DE6B194B91C250374963BDC7215B07CDAA8001372A21F0C3845979386C27949E0BBEDC0B004258866A01EC5CB82FC751BA2F4510E514A3FA09B6AEA7E5E45762076B81D781C2BA91DD6F40CF13C91E947A7D7ABC2A2AA91A1404D87462B42AA71EB15209A9B0D4990C2265B051163CD2BA8319576758237482F500F7E94B3FF099616225737A766C10B6AEB213B5B073EFF93C3AC91BBF2B93FF47C84D7CA2E794990E2DB4A7E9AB19CB50CD522427E6A935CE3976490B21792CCE5E4B971668C4793CA4954B477703730411DF1F5AD2557CAEF78C914D0C223D836C407936EC58825F3B2A1925A5164B097A94A13D8AD3A27BF1FFB0C08C72B92215CB1B67C7D2C4A7BC7A6A8A054D2A34DE69C78195BB149E4B4CEBAB78F41612DB19540385F2F74757C662C2DA3C7B03A34A9524E2AB90F5CC21FC0D2AD84BB996E6C73426770FFC1C9942CC22AA2934D97A66037A18760C51B0236CA1B1880A2286EE5241FFC220A4C6EC0E296090874B3CA751DD701086A15F419C67EB4514744047D7848980C036107586D36818E74AD98989C8C02AFAB4134EE0B545ED707876A613FFA10BE7C3F10B758B215827ADA9FA1C83B129C6BDC5B621D3A5DA7F396D6E29B184A38D8091B6A2C288EE2CAE833A68A3CB6B30BAC5AD7567C788D8C803A7B622FBD8A253B274B93593115B5B7A5282EAF93706C88C178BAB897B7198C23B844219852A60410E8AFA85C902EDCB9A5E87A31CA84AC6B89A75830566062BC159CB129277AF0645D5817C8822E384040F1621D66D41643897DF21C1013CB1B426A703F120F21C780C67BB011FB3E8CB746C0B14C9F847DC1235F72E6BDFDA1C55BD26E377395C4B17B764A41E0F7312782BF71820DD379BEFE58901A011FADAC1EFAE549E5933AA9F9C64CE2273C486B56251674D56212C0AD7637854C7B8447A135FB960FFC435AC7553DFE935CAA98BF32186817B5ADB42375E96C30D0A96DF39658EDE95912946813CB75CC32B395AA73A916514533857B4C3405FC32C2946CF4F4251B2091B6CBB00CE296459C45E558B5048B79CC4CB8AA01BD7E82320637A62E2038D5B3C0593B42D32A38BE8312AB022EBB496A5FC4A991A1BAEB660A23988FBA329A79DC7144D20B5246466F25AF4AD971014970EBE2B36316B86B3585F6B0753711A0BF3952C688B4CF6C8A24C0964CDC1F5C1C34B3C28359BA232840063AC30BDDA83F0611042FD8B7C2BB439E686B49D538CF32A05AB82372F7525DF40085B3413F078226B97C234B815EC615B2683F1D9AB32DC0314C6CCE6E9620C8E73B1DC85BED5205CDE5A44F40427865A62356CE44751C7278A3B236BC2D208C7B383129661810A6A2962496D058CA4875AD234C2DF951612E665984BBAE791C279EE835B105202D4751F1A330DC6B0BDCC38FDD6458B0CA7A9BDA026BD64E80868B87B58CCF2A37CA94CB06279EE77A6731E847487142561863B5F38C5AA4C0158AC28E95012C10A8B8E99EF7DB12C05009311A74791C6C8B355E4A861DD3CB6FA085884D7A7E8CD270F656CE29F9BF3B91B798032C16B00F8CD722A1CABFBB25C3002324C56B66DF87182504581A76297EE1181CF05A6D89698CC94021B16574264435F2CB137A7A667A4548C96F835CBBCF27805AE37448674AA998818CF26D15A63689777A9B98219AC3B9ECF84203826EAE294800F5A07FFA886CC86E7D095F42C471C121A69A1972A7906ABBD31003F6C8C0D07EF481B55FE185811084D9A472CCBCC586B6A9A6F24D269AB36126A3F0381B29532D027C2D5E21CC5B9C6EC8303E4B388A6B7216B3E581C0566558107C8B94C599F09C2ECC4B7A824FA3DB9A29722317D5BC5D43827F4BC6D3A91F65DCA56BC26DE9D40BF2F69263CB010A9A24A749C931631EC2D13EA4D5136AA8A97EE019AE1291EA34B0807886FFA323AD3B0F83F82E5D9A2D748945A3CA34B9535D0460A6F734BBEEB66A4E3C257BB079F5D80F6DEB0DBEC130FE4A182FDB16291403F37A191C381723965C3FD90D9F2B67C36CA3AC141030AB516A01453532AA06B73A91B5BA7D1A308E286FCED38F2858801022A453320A857B564179C55F0436B25CB191865DE69877B47041D9D0C2C9BC42CA513F207A72EA9A5CC48B573FB402BA8B5AE6D73F2E0B044B8CA67C1031577099B9975FAD7103C7F6BF80099BB51138D8A7AF7BB509B761A9C6407DD9826B7FF87879098248D779D6F26AA0215084F286AC77C50849AD19F29A32B07EF517000FF71799D6BE1D177508BB969D9479C6C037A5A18BF4302720E240DFA603B7F8745144906BB88522505B19336BEE5572188853A47B4F8ED8A040B251307299BE642E086317E1504784990F2149CB2D89B1A8542E4A19CFAFD57ADE9A234545142AFCB3E544B49DF75B0CC78F5AAB935752746EE7A7F7936777330A66C1063C50BECC4286A3DB4AA66CB602553849B5BAAF83965AC6BDB19A9E5DB8251DE0267EA3C0EEC342B51505469AA7FE936A5829463892645438A3A182859DA136E033B926695421A1891610816E136DBBE36ADC08CF00E4B44649410B2A11EF254144C27787E54CC5A533E8E54F11EA94F7E9C2009D25A6248321F04A53C31787C12ACA9CC78FCC06B161701852215BC6C29D1779F5C183152CACB583A90399746F75C5BB337F1B580B9029B112579884F792EA5A52187A109F547CDA89B7FBBA90C66065A33423DA4515D13BB5FFA074AADB0C55119065A51239511BB33288F994B121DA8913992B979A59BBD64036968621E76AE336096FD6125CDAC4F767A883E6448B078DC04B1F2B7AA49A1180C0F3BC65D2A93458291982652063419A9CB7F1042C38F483C4A90E17ACA78E9FE10B44687F9AA606CAE8888E4C21AB0F7B85EB3D3A2A3D2FE8ED883D1DE0EE044DBDF6787FF038DBF9C133557169C62FC1CE2580739369AA87DF00B496485A3407F591791A5DB4578B5972093A95BEC3B8E70C1D542C9B5C9789729F8922
-ct = AB24A548B90EF59F7595D625B44E8A9B3CB8EE09A1AC6213B709B1CC1833B6D3E3ED145524647D33C527F0E7052DF7FD94C2B1EBD99577600DDD3266100218ACE8C5AEFBBBB3C045C5440AED44856616C5A4456D28A304D3D00B51EA20ABFF1E0A1C671BADE1E8BE2E3BB9A41F1C73612803DB0FF713B5C717B9BB751F750C1FF6310DDC3B25A012F3902A6BEF8F2E7C3B0EFEB6C8B267E1BC9152D48F53591CBBB2010E5D40E778368B9E7E8ABBF52BCFD5B61E4B2E84E8CEDE9FE87CC14DF8890FBA78466246888DD36D71742050C8271261BED8199B5D4C7C341F5E34673E47E58F42AA3F9D28CCDB1DE32A7C6E6AE11C346DDC6D7A9B4E1384E85A466711B2F5A5FFCEB0D00C4F10C8B656A878CDAC8D1738B73E003DC44FAD15AA4E30819C98DE28883E02E501BECCCBA97019D18EBB0565CDE8784F0210A9E6199C55A60AE87559A6104662CB9631BFDFD6E3A7F9FE3D7D542C1D01520984455947052C0C9E8C985C0F247CE9FB8C0D8F2E5EBE09BC6D06D1A1EEB2C97CAD3F557CFD8723D2C3D036F1EC38CDBAD6006A6B0002DEFC9E0599D9950157324A3045DC616786ADE0A56E6378793938485C69411EB7AD38267C02E44DD902E8C242C139DCC336997DA91D1659C4582ED0021B4E14A4E77DEE7803B927B8C12383911461794718355C74F366968EE72289A8AEBCD3BF800F9E91C83F22F6D59D372134CE5154E29385CA973E9BBA04CB674F8C87D4DC29386144F577D6B177791CB28DE72CC33226B9003E42EB040C635C80305996A303F8AA82B6DA9BEA52FD11618F9D04B00D5A1540D836829FB363AD62F63ACF4EE550B09F665A62CBA6AFAA9509E5AB22C02ACC0470B144A110A1D497EE5D2A764CAD986F7F96F3BBB4156C7713784D5D7F343F9D4FBB9E7F75114E5C60EFA58DB8499CEB533B4B9E50522364BA540AA3071C80E5FD3139C64DB8279058BDAA72E1515E483609B537A5D524A766E2914F45875D08F7BE6CDBCC08C9357FF06F897FC3A17DB8341C8E2B1D63DE212E512A51D60129A1375FC9261FBF5D8CEC9252331D75F7A4D180219EA5A6BC18E8A612042639A8B33879F2F8073C23A5B8A983B131193B734B66547426541ADABE13990035BC87A780141972ABD4F98559A6D92B9A605D7AD4F00B8D96F3A4EEA619D9F45D4C2F834A00064CDF2C58B51A9ADB542CF8051B73455BE9881E5097CA9D6F81B0240012A4E55369A056DE74C277B5A0915417A5EBA7A572A9B81121B4057F9A50C94191A446844225860096BFFEDF8B7AEA605F193CD60CCD0A2697D8F8DEA9262A3C5D89E8E94E2721A359364FE1B08245EBD344040746665FA6EC5D2B9D113EEAB5CC42450B5330A232D928FE674D53166416E0E8179100E421341DDFAC2E0E5A80FE51A6C6E8F044DF8EB5596809774CCAC4C255710EFDFF2D4614CEB463BCCF6013A74E1F22760A68AD214A1F5B6952E1935DBCCE1811EE19C2CDF8FCD3D38F7B6C6533DD9DE19B67D917BAE686BD9A9A30FEF043FC8C9055AC8B6DCF
-ss = 3EEA7528610DAE3539F5F81EFD9BEEDDA4D45EF0B9FF91D3D4F3561B4981D286
-
-count = 54
-generateEntropy = 6c8c53ed6f65e6b2e324b84364e10de42d1c26a106d4d1c99eee79c78586fb55b9402bf02481ce4b27a52e87feb92c4399c7f2988d40e942e7496ad15ad2aa88
-encapEntropyPreHash = a9cb9a61a3324b1ea5afe693b32784e2871096b2ca14a11acc9577c52359a241
-pk = ECD4C65CEC93A9B26EFE3B667405482E3AA37D48AEEA67C1698008DA4B68683697DFD34FD72A6F39EC0AA0806EA5C59B4554182F6034B9C5B7CB438E21A14774D58AFAB0099E478A4BA8568E192C71DB7C208B7115D29BF649BFB3D23C2D70599682C549EA28DC16597A43AA6E65C77C432F554B067A64AD62AB71492A1AAD6045677C74E3E8773FB8665259ABD821BF07D2157C09199435BF41992628534DAAE814EE4AC64AD89FFA1547442B8CF6F54664C550DA5CAD0D828174805DA5D66F01E584789992BF0A4036D770B6C5B3E21B78F5DA2467DB42479B478F0570D48071F028110F555857E4ACB555B9C7D5B5D913B75D5B393BD4B9B2C12D34027AEDE4A22FD80ABE26A9C93C938C6B1348708D1BDA7FE6C55BF66981695487AB81362F50B7376C6A52CC39769B921F575E5D7A9666ABC2DD9459A5595E3AD631A0C638C3A2181B649704748141394053849B4F996F9B8A68567B73227B8C9E4588EE4A13B75379D2776A7510ABB21941C2B36357E8248686A5D973B946B82E40802290651A073636B367671C9C001AC91AD03B9D6E83721AE1247CC188FC05B0249571656A276EEA09B6D3376C208335618B1FC2748655CEEF805C39165D0CE9BFED062ADD0C0A50E43167C80E5301A076C9CDC1F13852A5987AA3CEF5E5864A706B3DE947D2AC8E8CEA0C3F83745BF3185BAC9FD0162510F70BD20129D7C5215026114C4B5EF044A8A29A3F01FA02A0A3CE928A65CE8CB566848110994E7CE20EA5C30304D6CCBC7477BB78B3EC527758B7828B836DBB2742AF6095A0BB882C2C9D8E162618029C1FB5AAF4B963FCC4A35AB78B0D9942FBDB53D4684CA85218DC27678719CA0D4A8CD8E9BCAEB944B7C0670AB171927C56C35034AD92BB3E6714D0F7C137C2B9A1FC5B72367C35C55D5FEB93D1274B88BC558158C5D478C34B68240AD193E95C0311AA501B3C1C44B20AB6CA2D2DE1C56B65618CA53F0E91550851BFBC289206D1406B27047FE610EC01A86E8BA94516AA926B99879836DBB27A7056C4D54BBD19A44096D1B3F3E9956CAC29E7AB95F175B9D9A0078DA633F10A6FEE899F400533F0F77102DA19FB02610003674828758E23B5EC724C6829B95B8A6750F1988F431E7537CA9D05701AC8AE2034688082C5C20A122C6349DB27AB958504FDB4C527B223B2420DB7246A4A69B58085A3C1E6997DB19FE17A2BC23BCD60B924CC393EBFCA864DA054BA38BB733B00FDF57AB147B922278FB132C5F5774BFE368DC2B66583790D30D282A248B7E9D43A562BA1892A985B75A7AFF961762A05FB35B9420905BB8C4DE00A3846E38CA7D71411E89F9E2C9489C597834C7A5315080130648F5347639184F315BFF2D580FFD0227C9185ADF9203ED50BAA43A9174A7AE9B5655F2245A15C30F877BB7DCB2EC184138792738113895A980DCA31BAF6B5261E10A1D98AB660C066BCB05AC25429775C3BD1550D4A823FC96442CB2770751C812CE67613E48BFBE66A0FDBA909317513220EBC3C55FA1364F318812199009AF24F9F70C36F81B22B20BE53208F0DC44DD3B6ABB7236E1FD37C53FB1EE8C86810863A86B0029A58955DC73EC8A436112B5C3A75CEEC356BBD91355E4C3941A07E45AD3ECB9AE67E7527F70F6E07A757BD112947074D5120A1F2A1
-sk = F76C7D8002B7CA65BFE6A59AA3645A8E51AFE5FB80145241134CC072A60AD4B72D80C2BCBE1630EEDA661CB62E01B0798203A1A287C4B8F725DD422BEEE6627C864149EBABD84280739193067A2348F2861DBB7F1A0914BA2BB3AC6C80D5CA1F483C8B86C1CF5A2C3BF8F6728555799381A1B1F3CD02E445CBE798AC0361E15335380051294667B9149F38D85A1839AE43D331BF14091C4ACCBB24C8E8105A9D1185BA880B7E13CD3563AA235B899E7509525280A37162C043B089D5A0BD48B225EBB2D0538F49C8AC3C3B0677D8093CF70B3404016B4686D653CE4715A85953171BB937F5A1916271AD53318E8155269DBA4D0A520D057963E70CC01E680FE8408D03D3275C95A2C528190924749BC32DC31B21B58C6F5E4B59C157CAB7653C0D146DEC9A3F94E241993B09BD62446F35AD7772279E116464FB316DB8449A3AB7525B3E89B12B54F14FB19057C39510B072894831A5747782D404487926AD756B1BF81CB416D94265DCACEA475FCDAA727D0B5F01B376250B123F717FBB0B1976B7704FE5AE5AC10CD17B87FA8BBD3D824D3B91B567B5C20243677D741AE2CB1C1D049A842B7F9DA9CECE8931851BB35776CAED97C27D395108E42661AA60CC181ABB2774C67773FB29B445F3554D386C87D489D895A43EF268AF0C81F6065E57E744F719120323B013D35801E26BAC2700968566512106F5161EE8528372D45A42B41022239FB0B3CD23C4251927B355719A1F2A0689A4ABC508660DBC282706B765CA4BC1887FD064CF8285B1155863E15B112BCBB1962255B362CE8FA4C51C97CFCEA7004DAA9F746766F2F5487C93B99EE9825CB78AB0A98BF6863A083758E9279245E495AD0A5B86724C1ADC3E67D756C1C8647FB4BA32B75A6DA3A05A870FC1E12CD279666CA046E064A74625530E742EFC72C1D5F959C9D256389C4C63609FA11A8FB5E70E1E2256C8164D80C69FB8F4008A647AF7F3AD960265F55CB786E8726B65689A6A751FE045B7D45AECF50605D135A44793AD2C6BBA5A59D293528BD94D65F54BAE4798EBA5B26DE8B225728EB8836AD1F373F66A2134B8B429A8457B600C5A3274B0157F66F091EC88436D5667802A15749B4C9C499A36C58FC5A7CCC10A604ED00DE74BBF433502C02AB0ED949F5DA8B9EFB83C4A2395E49413A7030F4F95901E8AA2716A3EBB09AAF61C9384586021301DE0F8C085421460A10FDD176C68B4C115C91DAC04121924213855AC22E8C98E3643C3D7C3B6C6C4CA964308510525C5AA00C32AD9BA258BC44A9F521A2873BEDAF7C56BFC26A320C0FE95CFBE12C0038C1A65B62C18C37E61A2B9194C9EC1DB8B9FD036C7C3A620B5C661D8AB0B46A6CD3391E53218E40CBDB082C2207630C2715541B10E3C395BF2A5A15AE8B506880DDE937432ECB150F9B3C136881058A750024D9B247232B7289BD07462C051B7BA599C985C6EB08C7AC22135C99E85930113554C59AC06AE298D5935658F513644B01132B4C1AB84677E342A1F4A8A9D5C6A44659805CC8898E563823C8286D54A1CB4B8DB866A8F5C74F782784E4B6FBAD380C5131FCAE11D4EC89DF82490B4F1BABD4673D7417B9CF04513718F2CD0CFC29707145034ECD4C65CEC93A9B26EFE3B667405482E3AA37D48AEEA67C1698008DA4B68683697DFD34FD72A6F39EC0AA0806EA5C59B4554182F6034B9C5B7CB438E21A14774D58AFAB0099E478A4BA8568E192C71DB7C208B7115D29BF649BFB3D23C2D70599682C549EA28DC16597A43AA6E65C77C432F554B067A64AD62AB71492A1AAD6045677C74E3E8773FB8665259ABD821BF07D2157C09199435BF41992628534DAAE814EE4AC64AD89FFA1547442B8CF6F54664C550DA5CAD0D828174805DA5D66F01E584789992BF0A4036D770B6C5B3E21B78F5DA2467DB42479B478F0570D48071F028110F555857E4ACB555B9C7D5B5D913B75D5B393BD4B9B2C12D34027AEDE4A22FD80ABE26A9C93C938C6B1348708D1BDA7FE6C55BF66981695487AB81362F50B7376C6A52CC39769B921F575E5D7A9666ABC2DD9459A5595E3AD631A0C638C3A2181B649704748141394053849B4F996F9B8A68567B73227B8C9E4588EE4A13B75379D2776A7510ABB21941C2B36357E8248686A5D973B946B82E40802290651A073636B367671C9C001AC91AD03B9D6E83721AE1247CC188FC05B0249571656A276EEA09B6D3376C208335618B1FC2748655CEEF805C39165D0CE9BFED062ADD0C0A50E43167C80E5301A076C9CDC1F13852A5987AA3CEF5E5864A706B3DE947D2AC8E8CEA0C3F83745BF3185BAC9FD0162510F70BD20129D7C5215026114C4B5EF044A8A29A3F01FA02A0A3CE928A65CE8CB566848110994E7CE20EA5C30304D6CCBC7477BB78B3EC527758B7828B836DBB2742AF6095A0BB882C2C9D8E162618029C1FB5AAF4B963FCC4A35AB78B0D9942FBDB53D4684CA85218DC27678719CA0D4A8CD8E9BCAEB944B7C0670AB171927C56C35034AD92BB3E6714D0F7C137C2B9A1FC5B72367C35C55D5FEB93D1274B88BC558158C5D478C34B68240AD193E95C0311AA501B3C1C44B20AB6CA2D2DE1C56B65618CA53F0E91550851BFBC289206D1406B27047FE610EC01A86E8BA94516AA926B99879836DBB27A7056C4D54BBD19A44096D1B3F3E9956CAC29E7AB95F175B9D9A0078DA633F10A6FEE899F400533F0F77102DA19FB02610003674828758E23B5EC724C6829B95B8A6750F1988F431E7537CA9D05701AC8AE2034688082C5C20A122C6349DB27AB958504FDB4C527B223B2420DB7246A4A69B58085A3C1E6997DB19FE17A2BC23BCD60B924CC393EBFCA864DA054BA38BB733B00FDF57AB147B922278FB132C5F5774BFE368DC2B66583790D30D282A248B7E9D43A562BA1892A985B75A7AFF961762A05FB35B9420905BB8C4DE00A3846E38CA7D71411E89F9E2C9489C597834C7A5315080130648F5347639184F315BFF2D580FFD0227C9185ADF9203ED50BAA43A9174A7AE9B5655F2245A15C30F877BB7DCB2EC184138792738113895A980DCA31BAF6B5261E10A1D98AB660C066BCB05AC25429775C3BD1550D4A823FC96442CB2770751C812CE67613E48BFBE66A0FDBA909317513220EBC3C55FA1364F318812199009AF24F9F70C36F81B22B20BE53208F0DC44DD3B6ABB7236E1FD37C53FB1EE8C86810863A86B0029A58955DC73EC8A436112B5C3A75CEEC356BBD91355E4C3941A07E45AD3ECB9AE67E7527F70F6E07A757BD112947074D5120A1F2A1E965AC6995D525E324E8252D8E2C2DA909A29B24BACA8B68DAA5122CB539A474B9402BF02481CE4B27A52E87FEB92C4399C7F2988D40E942E7496AD15AD2AA88
-ct = 9D503732B866FD6CC6482F203FE35AECECBDD76BA5AF3887AF66020597E9ED58EEE4577F0A07623C03124574A8F263775C83DF468839D2E5F17D5B21E811E0A80B0CBFEA3E370762AC0C47E741C234B5A24E803A60C532B92B658D5E46244F96224B989E6EC2BE14FD13A384EF64977D370B06040AD74D11EF41D126BB07CBBB5CB3CC1BE087F8FD7F61B8B8935F515207A26EBDB29DCAD93ED2159926093097F402EB6A2D4DCC96B7F354D3B46C514CAD7230D0A03AE48FF492CEA84B35F5086A2BAB86E37BE1080950674FACDAE004CE59858E2A2D9DF1D83A3E8719D057848A081BC262559DE7F0D30FD2193788CABA528CD3145465F3F1703D1955F87A896F114213752F389170D6B9E3B45BC4D8CC25A09D35D8C182766A97419302ACB59B18959F68CBE30572CD507D32280B9B3DD03E08F7F912DCCDF6465541FC1776B76E884EA1A1F0B6E7B44326F1C984972AB1FD82D1A095D3F8703F26D15A8FDE507E99100FC4204322D4DAAF774CA4CE9A470D560AFD097745AAE98402B1E8E5C0485620F2996E4369EA9B7D91D66A29AB0E8980AB477E6732F267EFAB52F24D1D19119B82FB1FFE9DBF3D77A0CC9CE84729CCDCD5B27D4321B23B1E9FC40F443AD753C0B876507BBA1DD7755914FD861E3006504D7E406BD8FE652E226D3B21CB7510F570CD1EB1BFE43555886E29AE1389C0791ADBC762EFFCA02553D7026A3820DC6C0DE0808FCED176BC010B0B91DEDE1A6770833AFCFE359E4228D04920870E20DD9892D0A5340C93C2EE86115244A43635DB46D28AE4982C3CB8705C250026C3A18DA5DC2DE6320DC4A4E40962FF78AA98B1C17F2BD49495663282E019982423DB6388C972B4540D7F4C26FC3037356011C090EB5AED0706336AABF252B879799BDC529CF75D748413BC2A499354D0CA2E47957E3F032C1C9B6F398C80468A03CBE6E1857C1EC3E6C046BCCEB9D8417FD3E1C7BCCA9A0ADDCACDA0BCA99966994F6234380B5E58163AF74255D6A9FF8397493DD2987633A4A6C5BA61B00FF125C06A1615F993F660EB8CE966551586BB30794CCDEC762C67843A68A84EE658E629AED04191C8BCE6DBD7A112FFBC6A483AF6D0A3F297340E6E9EBDE6D73F39F4DEB96FE0326A8D25CA7335938F502BA77EC126D5A2CA584C838B2166AA0DD926F645F7B4570AFBBC7345F4FFAC34588B54776A35F24474FF2AE8BE60D7A31A415FA32F194875A0D2792DF994E054378BF15D8502F8E2887DACBA3FBC3FD17C7657DE1D099F4FFA8250CCC9C6EFF5C517B90B7C7035017732AA964A4A2941557391836624F8AFE0D5482143B009A633092829612E6024254F1EF8BBB15B5A6B3644C9142B148C4C7337EFDED7A5246674E2739E5823C785A16EF4254B97F86EC3EBBC28B4A1161A66CDC07D3FF5A3FD1DE52F00AC6EE6258821854943FC73B357B27FD154EAD141B187F3B8A7AF61C80D3F324C341F92DCF9F4962C6EB1AE5B0F0711FCCB3E5AEB439E8A7C8F20A580AE50C1EFB1F27923ABCC8F2DF1DF
-ss = C5E2F0C1EE4F13FA8FBF2D09A78B04A5E2069AAFA978598F96424ACBCF41AD44
-
-count = 55
-generateEntropy = 2107204cd995f1df14314d5381f8c5440f09a347502e161cffc0a2ec3dcfbc7324c3da70fe850e80aa818301d60c70f3038153866dcd5d179e22db59b8991bb4
-encapEntropyPreHash = e99fbae8a024ebbbdcef32ce213f6aa942e3eca925e5da4c09975d773b33a175
-pk = 8C5785417B65B2E4235CC67947D7B214627D326AC1ADEBCCC3A64017E004499A8887C4A649E443E74720F0B1BEDD52B1A8EB78B3AC2D5516B7A3233BE9448575209675F4A813120422684191D6771EF2B44D92B2CA3BCDD5F5AC20A63EFC237FF9D99BB4F5094AFC187EBBAD39B8B9CE75902190741640BABF653886162645A84262A24B1885C626403F23136707816ACF28950BF181742C98347022CD5941B7B69E21B5CFC2B4C6C5F301BD32A2E7882A1E1A9CD94743FC86AF0CD26B51B3512003CBE8628D299663DA40BAEF443677033DA8B8C21E0A0F12FB93F4D63809375FC877866394A1A5409E2F13B3E5011A2A5877732415281B7B19991E6EE0A470561B6BCB46D87B4086F18CA29C5FDCD622F4315DCFB11DB2C6CF136B7B0A870AE89669AD1011477899B8F679E5C9A8413959CA0CBFB3B54AD58C98B94760058C6F1F499435118D9143723DA05BA8F13E5CCA1813F91CE01092917BA1D798BA3481121026713BE1889B58375E5C4F9BB0BCC5FA808E2C00A36CA575C68B1D232778F71BF0927C5F2092D0629588826D02005DB9BC0DCE456E2B928EC9FB9C7A138E7B1065A2B660C287C3D062144CCA71E5C1294442073AD48AFC555767F1BEBAF550D520659496AF9237A22C27670A080F8A461778AA42C6CA9A954C28A658C73847A586FC3EF266562240ACB6978E026152B1149B8D426AEFE37BBD263A00DA05DF48375E53BACF9C4C11D4BBB055666AD008736B9C323A9974661215495E032AAEC611AF0E6A9244C2BFB6F3195D5121EDC3C0719C3FC1365C2BFC70D5C6140E6A383714A0931CCDFF946ADCF73993AA113C90AEF03374E251ACE73770A350428EC32A9DDB4AED8832526968412863966228644B9AF9842C2E967957F10D350A3499876F25D157BB2812501C8DC95365F83BC64B6340FA6CB4C2816B31824D028726DE0112AA9CCC9E0B6869099D310AA6E5B79609487E7A20A56BA75C45986F92F5A4D1672F3D99927A1193BA15BF5DF2586E823292593C49321BAC9044E4844A7A6BCB08309E2520B6ACF20E73BA5B05931E29BA43B2000A48C72A5DF05EF715CD8865CF16A835A83C271402071D1068A426839CA424CB666545664EA5E7461AF147B9D84583285EA1A05A02732031BB0BA40B14C828BB0E82807FC57882B31D9CF509BE7B712F56994721B55DA921EEE8AD45C8B4E99931C9B71B473A89A2D4821213A1ACFC453A41784D35B522E93C2D994D083674C71583782128476B04FEC71F17CCC65B9C83F52C207B08ADB10824A505B6DA8A78D4C599A5B09979D9491E1383EA155576730614FCBDEC1A8C801B94083A0FB55790B136BC5F37B752F3A6C636481DEBC5DA8892AC1B04AC7447953015E7251838ACBB6E24B508578B62D7450C46C76272806AC407112B73F7946D9654A45E943B406776E057C22E669B34A39D92F87928F8689CB8363B5B07B861BE5A750BEDB4A909605E6E26A489A5A4D9FA7BE3976479F8ABAB955200C479E75983BE821E79682FFB18553B72CF0797B2D2117ADD5AC0ABC71CF0E4CA83C26D218295AEC75872BA3A8B3CA22A2AB83404A046355FD394BF35D66DF46A6124D18B9A4606305A5968C4CCDF6B77A5EF23C5D54C68389E610B30DE122C2B2CDCEA30B3C780612FB9992721E26273
-sk = AB150A2298917B1707AF1AC0941ACC5B6B259D1AAE8F878BB0A37089B845991B203EE4C8F1A58CF9D2CC0059ADE2DB131BDC5FE3049E17F350A805C6F30479BE91B12A36190A5332ECA4737DF5A32FD60CCE222B592060ADD75A62F88D5BF6426FB18A944195F1ECB1BABAC1DCF20C39339ED45AC8C3AB582382480851107683102FA1914E753731964FDFF686F0A354703858C15C99F30A19D9C281AE93004C718D1CA5452FE58183D806DD666792DA7A76B0927DC77793396E4508200EF5097E45095A33AF5683A4DD1A5F6878C1E6FA85771A990EA16F7A28034A897855769DB8E4A9A425860FEC7031D09E96B665F57662B2BB86E362C3F9A706E354C12423AC6CDC74973A0767D73E75F5739747433C3451F8E5B85E5311B6E009F79C00CC07BA26B74D512520496B1998A4445C19249729225044CFFD51679B495511223417B2BAC86CC242241F2B70966E9A7A03C3CC0AB526ABF857DC1A140AD85825757D2B5A59B97B7F8C5015DA02159D013C1F15491FF4CF64C564E50C389F6C85B7C060F98011A4518CD3B48C2DF68C67F3497F439C11F8504E577CF49ACFAE704A2B093238520292602CC2138762D87536F6285C001D6975A242654DDECB5663AC44228BBE5BD58D9B90426C66802B466B21DC8D7A23893A953033874D0A93626C00B6A4FA3FE9EB0DFEBA2F3E789AAD8103CA153FBD7218B95547DE700CA526AED4F159639C59A7699296486188C3CA111479DDAA747F99AC825C7593911D6261683CE92EE8AABB77F82AB14838DB54149194B12791C4991181C66BCF05C67E19F05DCB658D8DFAB09C180967311F4E2AA03D9B8218889F87C5A5680299A7459AFDD69DB27302D9761DAA20BE37900B971694D3B6AEA8C6B5D53A686BEAA478F2ABC17C1C461807597148719925590C1E482AA05BB73077C017C1010EA576BFB5A63031875A23B0A019D608D64A30D0DCB39D750099D1C7583C34AB1CB1DD99A115547E3E4CCDF2A872E821B2330A5F6B30918226B7FCFC9FB4F37D8103437DB12EE073A49D29A7359316F8D922F783797E49B8C2B6146F76C7F8A66838C86364A788D3C4AE67D02CA09391E8547EDFE86CA1D131C5B96CAF479D9562688D1238C6196526B17844B475149AC3A76865C94993E518941A63A2E4559E81A46C8A99AFD2A73B36C633DDC6B32B14723F04A83AF89A420A3D04810311A28880247236A3761236B068A9A4EDF55317E8841218441EB1137342977215992BA99C1EEA7DBEA33AA83382B909BF1EAA9030B4386F8BAAEA643E41531204BC0DF8243F81367F4D979BF0125B84EB5D5DF53318463102938A85214AD7355960300DB40719A2ACAB9297381A6708391C78A8D4029487C324291A7E4A0945A806E0F24368C7A2AF91B8BB155D04C557759228673B548B6A4FEB8944B7334BCCBAB144C84344457B8B794A3D3B4DFC2357BE9227F9C4CE8B98003452C1D8D19C7A8332403A41308086346129D3F929B847BAB1AA5D88935D816A708C6A5E41023BCD4252569CBC724A53DF1B88909267A932186C751339863C8DD49CBE200797186924C26EDB976DE613CC2C46BEB06B39F5C264716A76E67831E4198822D77386592C777A088C5785417B65B2E4235CC67947D7B214627D326AC1ADEBCCC3A64017E004499A8887C4A649E443E74720F0B1BEDD52B1A8EB78B3AC2D5516B7A3233BE9448575209675F4A813120422684191D6771EF2B44D92B2CA3BCDD5F5AC20A63EFC237FF9D99BB4F5094AFC187EBBAD39B8B9CE75902190741640BABF653886162645A84262A24B1885C626403F23136707816ACF28950BF181742C98347022CD5941B7B69E21B5CFC2B4C6C5F301BD32A2E7882A1E1A9CD94743FC86AF0CD26B51B3512003CBE8628D299663DA40BAEF443677033DA8B8C21E0A0F12FB93F4D63809375FC877866394A1A5409E2F13B3E5011A2A5877732415281B7B19991E6EE0A470561B6BCB46D87B4086F18CA29C5FDCD622F4315DCFB11DB2C6CF136B7B0A870AE89669AD1011477899B8F679E5C9A8413959CA0CBFB3B54AD58C98B94760058C6F1F499435118D9143723DA05BA8F13E5CCA1813F91CE01092917BA1D798BA3481121026713BE1889B58375E5C4F9BB0BCC5FA808E2C00A36CA575C68B1D232778F71BF0927C5F2092D0629588826D02005DB9BC0DCE456E2B928EC9FB9C7A138E7B1065A2B660C287C3D062144CCA71E5C1294442073AD48AFC555767F1BEBAF550D520659496AF9237A22C27670A080F8A461778AA42C6CA9A954C28A658C73847A586FC3EF266562240ACB6978E026152B1149B8D426AEFE37BBD263A00DA05DF48375E53BACF9C4C11D4BBB055666AD008736B9C323A9974661215495E032AAEC611AF0E6A9244C2BFB6F3195D5121EDC3C0719C3FC1365C2BFC70D5C6140E6A383714A0931CCDFF946ADCF73993AA113C90AEF03374E251ACE73770A350428EC32A9DDB4AED8832526968412863966228644B9AF9842C2E967957F10D350A3499876F25D157BB2812501C8DC95365F83BC64B6340FA6CB4C2816B31824D028726DE0112AA9CCC9E0B6869099D310AA6E5B79609487E7A20A56BA75C45986F92F5A4D1672F3D99927A1193BA15BF5DF2586E823292593C49321BAC9044E4844A7A6BCB08309E2520B6ACF20E73BA5B05931E29BA43B2000A48C72A5DF05EF715CD8865CF16A835A83C271402071D1068A426839CA424CB666545664EA5E7461AF147B9D84583285EA1A05A02732031BB0BA40B14C828BB0E82807FC57882B31D9CF509BE7B712F56994721B55DA921EEE8AD45C8B4E99931C9B71B473A89A2D4821213A1ACFC453A41784D35B522E93C2D994D083674C71583782128476B04FEC71F17CCC65B9C83F52C207B08ADB10824A505B6DA8A78D4C599A5B09979D9491E1383EA155576730614FCBDEC1A8C801B94083A0FB55790B136BC5F37B752F3A6C636481DEBC5DA8892AC1B04AC7447953015E7251838ACBB6E24B508578B62D7450C46C76272806AC407112B73F7946D9654A45E943B406776E057C22E669B34A39D92F87928F8689CB8363B5B07B861BE5A750BEDB4A909605E6E26A489A5A4D9FA7BE3976479F8ABAB955200C479E75983BE821E79682FFB18553B72CF0797B2D2117ADD5AC0ABC71CF0E4CA83C26D218295AEC75872BA3A8B3CA22A2AB83404A046355FD394BF35D66DF46A6124D18B9A4606305A5968C4CCDF6B77A5EF23C5D54C68389E610B30DE122C2B2CDCEA30B3C780612FB9992721E26273A3D8A85F38CFDA38C66AE39B2F9186EF7BC1E0C98E8976A6CBC6C4875D73D7FB24C3DA70FE850E80AA818301D60C70F3038153866DCD5D179E22DB59B8991BB4
-ct = 05ED6A301313B34C67A40B05211E451869D148917D9CFEAA4144521DAFB1BC3CABE8FC527D998CDB6F1BA7A0609FA2144A3BD8DB8460612C8281586F4AEDA3F599CFFE70130A9C8BB5A91812B259167603B8282E96CA090EE6D83588980AE78ACD18324FACE44CBF68340002F1E0F6483DFCCFE092933D5A823F5ED4F06D38EE5747894CA0ED4A64438B1C6DB6DEA5D1A7DEED2A84F4622764FF3739924F3102912357F030CA7491D1A13F50B891294D3271D029E3402351D78479F253891D726B2C9AFB763E7A12BA3F150C54CEE377A91852B4C669A263D882D98896DDEDEEAEFE850159C3638408CA155BCC2D7D5579F156FCC2F7B77758AD4A5723AA45336054D810181E8BC9EAFB7ABD4349FA0F8A22B0E1418767E62EA6C84C2A7BC74E6E575DB8E6FB7EA79AB108C4985F3DC0424AF17B2BA1BA6C6AA2161D872DAA33B3C86D49CC6C0D5C8C07ED16FED4D2FD7F342B41D3F9B616766EC9CEFA0F1A2FC91CF84925243C344B02D6553B4F28D172ECA7A101B3A2EF6081A101DE8E95B1C32BC8B3327F24FF93C29DD66B9F508BA045339DE2C600469A73A65BD72CC348892AECFD3753F489566479AA7FF5390312081E24D9B64CBF8780D959DB66F9BFAA756EBD7CFAE55F991F81E586BDC74EF77A2FA3F3765905118F19443D3482EA18AC6BDA92A754CDC493E052D4482F57FB4ADDA00F9761F9DEED1B77FDE37FCBDFAD1CAE385BF05DE62880932DEAF957891FA11CD255E7C65619FD71B2641A085A5CD9FF4851FB57CCBDDCC10EDB41376032D6227ACF702B2E6265AC9AEE41A2C183EC16ABA9545E88988BB88EF7C0967E1164FA4F8B8943000CE8261420C53AF5A465F15BC6C76DFE8431439FA598D4EE11C3673EA9AB144893E4261454570702E6311392F79728C54DAB95D1329FD70D33E934FAF5FE220FCF9AACFC4D573798BB0D7DD218CEB8413629154745E6CED8A4A6EFEE1E93DCFB3F3BF3811513D5201F0B0A2C213E307767F989FBE19AAC74BAE70013B5D73905A709566356D4212B68349CFC4C7147F09CF0168AE636600BA31C87741AFE142D1CB03F56095DE4BB034991E54D863A9E56C6B9D1786D54A41C08BDBAE1596AADAD9118D3CC0B8121E25B0EB080A5E089EBCC32438A1DB1B72AD7D7B743A15118674F64992395316F426E365AE04DA9919E1A8FBD0959A2EA2A0938BFE7D2FBE844D89F36683E076F8E54E27AC5805128D0B58CDDC93793633FEDD427989AEF1463AF97643D628CC79DF9725C37F745839E85D9916D1C5337A16B47034FF2A36F3B022232BDC881577845CDC8A5621FC21AE5B5BF8EE0BB4E2ABDBBA1C348F2FD58313C9251B8E84FDEFE3915B8EA3CC13A5687AFFD790EBF25C7E761C90B1A0C7F6E9A3BBE04D6595B45D6FF3BA2D238D85ACF7206B0AE25B326E2191291510324A9FDBAED3BB5C770DB6F215DD693D4090BBF610F2208FDC7ADEC620D82F86CBB17DB7D31FB758A332D17E7FFAC763BFAC78B0F3C8A746BB60530A168FB5A06BC129F8F427BCC
-ss = 0B642D9427CAAAB926DFC155993BCB41BFBFB91E6C6D1C4165D8750222CC3688
-
-count = 56
-generateEntropy = 63a925685a8ac5bbd918faa33ac397d1ffbcf99135d9da7c3d6ff7aa4c50af3d3afdb8a246a56ee71465591831c371f2eb87467b0559dedd776ba063ee6d2f93
-encapEntropyPreHash = 67a216f37d67f5e74f782f1badbce1cc8c80a6130aec305b421899a4faa0a6c3
-pk = 605471FEAA9E92B94016A9A05F585F3C52A993A91A6DB73C9AE6364DD2A07B6C2AFB449122E76A3B273D424B94343B3BD7E7B1E1366204820819C8BA8970218A22262CA649D8E3223167BE77D9A466C860AD7C320B227E873A0D68FAAA441C0907805996D64F7759BDEED65CCE25B367F02094714BE404CA9FE56F6AD99E7D38B5396281314898036493002CB516878DB66AB19E09478872C0F76ABBE0F754B443B13DD5AFE610C1ADFC52FB3C82488984DBCC4D9850A0EE4BBC07D0051208C87914A3FA5159C775AD91A552C2FA2AC573787FFA68F456012AF600AF60183F97CB3E2936EF683FD8E2B5742C6DE946B96F825CD0F4807640A532561C70600D4995BF8D2CA543DB1EACD68D28B207617C23CD9A57BBF75ABCB620D941913E6506AA0123F89C261CE9C39C605646904D22586643F4AD250870AFE94DC950913602CC1CDBB77BB9B4DF518D1A18AB0C5A25948302C0535908E70F84587EFF169114161C3E646740893FAAF6B37B42168FDBC494549776D528BFA2C2BAF6A00A7498F403347A646C9A58328C59274AE8CFF8B82787A29D67336DADD3404FB5509640C29C9456FCF82D4ABBCD9899AB108A1FEF872617C5CA780970182861C046A594D62757D33247B79E12873493634C16FA70983C9B593814E69BB160120B4129370519327AC2332063992AF4370D9871E7A27D13420A6FB16ED9B579D1CA1D36A2094EAC96B537109AD83F4DF1A1D2E184C309AB65D75A3E409C57578214EA4035657757AB92AA930A76D251A1B87BC6B58F9D900E38156D73A1961C43BE2E044314C89EA9601937C0A87D9C4B14CB9E79D83E722CC40B048BEC5CCD038304AC0A65BF93B9A787105EB31B5BE8845C5C57B9A9CAF6243F54438ED84159F5B1B8B246073B1715B0F635E8078991118DFEE2CE08887F9680BD4E672D3AA78DF8954554D398D1675D785B85DD28A1675944D7597968F22855999F148CCEABFABC2358C315076C6B4333A82520A8332543AA100034BB0A6776CD959BCB263074FC28956726D0D99B9D81A7DEC14F13AC5CEB5B9EAAECB28E282BB517CAC09809073C3D085718D1DBBD75EC83707CC768BC79A3B637D0ACB34F37C9C2B4C0EEF3233CF91C0BF5A6A9279F6AD136808A9A3515B02E303F4DA26F93264C5AB9010A9C8550B9076D6471C196675EDB08223672C1A229AD31C05EBC4FAB557F46B4BB37DC2B605A87B888A1F475516DB87B92451127436EDA7922BB45B8B8462122542DE969C31622CDD62676A8FAAC5663A8BC2191711383EF4C1CD7A183BB55CC3C83B566E5514F233D79A2963710C5E5225F7B09B0B6176F451A7F77570B1C17B7BA335511BC3C3FEB884E459ADD3A594DD35662419272499B4E9258DC9ACA946CA80911999D455D06407CF9C69E814478A9F5151780BD754A440BC69925155FFF0A675E0C322C69174C27CD804279EBD3260FEB62C0E24EB63C7A042996C25BC9342C589C340E99999F9C5054FF35C760A43974096C5FD23BB9E51E2483722A132B0277BB24010297C4BA2C58BB286C49ED20B7AAE98C5D9B0601F06EE53C1808E07FDA53114EFC6D36B28B906611BE3A29E68A8DA76457BE5419D70059F7C329AAD28692D45892F335D02D36153217D5DB379B621E416A54CE8071DFDA35F639A04B14
-sk = F80C63DD6CBDA93B6CEE719FBAD6BDBE1A03F18B3379306ACE5625FB38C5EDAC9C8C94525C85961E14A76082BBD760CCF9B5AC777088B0CC80E0304FBCFC697CFB13DCF1CF777325EB473D11A43DA4575B697A860445B02CF75E8B945FF9433A337C754E19453D4BBFD2F07C76E8B7A68B92ABC870B56202F7634B9B37902D39BCA04653FAD9A0E4F0BE548ABB97C7A1FA18C34CEBBAE3987F4B3C52A5006629159AC6875276053908B389D931BC7E2871751169B6D81C8D8B5F52854A3E644C5C504675D688BA030E9E78A79E7788522516FFDA2EC9946AA9791A634B6AB6D04456003ACF348BDCD859567A74A7B73556820F8DFC12E467AE2FD11025E430114A5A60D3B42BB43845721637A69596EB953AB7B3E3B28B3BD9923DBC5189A37E9FE7BD9B763FA905314C0A35387A8E8552BF7135698E15B8D99B0777A0A5AF1B7DAFC172AA6A4D69202F10351603771876C580A7D24479DB0D804B6513A09281F291F2706AB128905663AECB0BB31A41046771449D12C335051A2EB50CA81ACE90940A8A6A355B21A9C7505491EA3B48B5323CC567EAD909FBDB380FD504C851452BD34F0F65A39AC62D922A3C50A8566EDAB03358745D701332E4011022BFD4839AE7B6745C66ACA80ABAB8213369E299253B40A7922DF02AB70F9723BACCB1AD563AD20C5EB8A01AE564BE24F40CE91A0F06EC68C0604C74250909D317F8968947A12EA297A279821F1B5377B02653D66897AA526CF51553C268481F7174BD9495DA4B0305650358A637A5FC31C99BA7BA304C6811B555E4B1C2F80EB4223C54032D16238861FB650BCBA24B127026FBA51F5985476103FE1375B94007A06BC2AB048BCB4A78E6D3C748B141BE410992733630B8C917F89960273740A595071824A9D02908D52D334373E8A575D5D52E96E5AD0CC95BF2C761AE577B9EF6BEAD33103E5033E0765D748C409F8A44227B8F55838B38695C5E132F2CB9BFDD7CB8522906E9BC03DDA468A04012277417869277E2169C63112E6A8942A1C13AEE97300FF4CAABF862058B6E7CC16F34C79BA200853701A98D630936A8A595098C8B19820AC91F47451E011069AA688BFBF5AC4EE018C53639A1B0573C8A420C4619166B011E79BD0B843D97766810A48E55D5CE389B5DE4A739F77CCC5FB70D52B3CA5D01729935BF7E4BB984576F2ACB7466C8248F975BAD539B2260568DFA34CF2974D83699761C95405943A7A88374112F8AE79B4D244BF2D683F7CC7A533229BBD8B5E822C8B3449548634FF34BCAEFF25A41AA84A1FA1F52F486F89630A7730E4F81AD23C14D6906816A849810951727042ED0782EF26C31281C0AADE6C9334A88ACB917B781C4F16327196422C24541065B5E80F4374DA0853D478625A68F728A20C1C82CA4FCC4D62744FA658059141221A917D6121187D3B621179AA8F7B7CD0904E6E0787F9A5F65EAA78011B6B63290A55542C80A4BFAD64677467DD1B12785E6BFBC31C1F3D46DB55C0A035604EF658279DB3232C675BC0BC97717CA3EB71D4F44CAAF1B07BDDC90AE982886594F98C41AE7481562CB63D0B2539EEC589146735490A4A87B6EC5CC77BFC0810627AA3452CB061A1648EC7CBB4937605471FEAA9E92B94016A9A05F585F3C52A993A91A6DB73C9AE6364DD2A07B6C2AFB449122E76A3B273D424B94343B3BD7E7B1E1366204820819C8BA8970218A22262CA649D8E3223167BE77D9A466C860AD7C320B227E873A0D68FAAA441C0907805996D64F7759BDEED65CCE25B367F02094714BE404CA9FE56F6AD99E7D38B5396281314898036493002CB516878DB66AB19E09478872C0F76ABBE0F754B443B13DD5AFE610C1ADFC52FB3C82488984DBCC4D9850A0EE4BBC07D0051208C87914A3FA5159C775AD91A552C2FA2AC573787FFA68F456012AF600AF60183F97CB3E2936EF683FD8E2B5742C6DE946B96F825CD0F4807640A532561C70600D4995BF8D2CA543DB1EACD68D28B207617C23CD9A57BBF75ABCB620D941913E6506AA0123F89C261CE9C39C605646904D22586643F4AD250870AFE94DC950913602CC1CDBB77BB9B4DF518D1A18AB0C5A25948302C0535908E70F84587EFF169114161C3E646740893FAAF6B37B42168FDBC494549776D528BFA2C2BAF6A00A7498F403347A646C9A58328C59274AE8CFF8B82787A29D67336DADD3404FB5509640C29C9456FCF82D4ABBCD9899AB108A1FEF872617C5CA780970182861C046A594D62757D33247B79E12873493634C16FA70983C9B593814E69BB160120B4129370519327AC2332063992AF4370D9871E7A27D13420A6FB16ED9B579D1CA1D36A2094EAC96B537109AD83F4DF1A1D2E184C309AB65D75A3E409C57578214EA4035657757AB92AA930A76D251A1B87BC6B58F9D900E38156D73A1961C43BE2E044314C89EA9601937C0A87D9C4B14CB9E79D83E722CC40B048BEC5CCD038304AC0A65BF93B9A787105EB31B5BE8845C5C57B9A9CAF6243F54438ED84159F5B1B8B246073B1715B0F635E8078991118DFEE2CE08887F9680BD4E672D3AA78DF8954554D398D1675D785B85DD28A1675944D7597968F22855999F148CCEABFABC2358C315076C6B4333A82520A8332543AA100034BB0A6776CD959BCB263074FC28956726D0D99B9D81A7DEC14F13AC5CEB5B9EAAECB28E282BB517CAC09809073C3D085718D1DBBD75EC83707CC768BC79A3B637D0ACB34F37C9C2B4C0EEF3233CF91C0BF5A6A9279F6AD136808A9A3515B02E303F4DA26F93264C5AB9010A9C8550B9076D6471C196675EDB08223672C1A229AD31C05EBC4FAB557F46B4BB37DC2B605A87B888A1F475516DB87B92451127436EDA7922BB45B8B8462122542DE969C31622CDD62676A8FAAC5663A8BC2191711383EF4C1CD7A183BB55CC3C83B566E5514F233D79A2963710C5E5225F7B09B0B6176F451A7F77570B1C17B7BA335511BC3C3FEB884E459ADD3A594DD35662419272499B4E9258DC9ACA946CA80911999D455D06407CF9C69E814478A9F5151780BD754A440BC69925155FFF0A675E0C322C69174C27CD804279EBD3260FEB62C0E24EB63C7A042996C25BC9342C589C340E99999F9C5054FF35C760A43974096C5FD23BB9E51E2483722A132B0277BB24010297C4BA2C58BB286C49ED20B7AAE98C5D9B0601F06EE53C1808E07FDA53114EFC6D36B28B906611BE3A29E68A8DA76457BE5419D70059F7C329AAD28692D45892F335D02D36153217D5DB379B621E416A54CE8071DFDA35F639A04B14AA73B40DEDD61E6FDAAC86971965C03AB14AE69E8130426FDF830BD57D0974CE3AFDB8A246A56EE71465591831C371F2EB87467B0559DEDD776BA063EE6D2F93
-ct = 909F5615AFD3C1E5BD517378A979CF9A4267592AE7A8A723314DCD337E5296E07C686EA98FB8FF29067C99D0C8214DF3E1A4A3CD694DD8F53F9B1ECEEFFC203A6BF9E7022ADD6374B08B0C009A0F2B57CB55221FD486E4787ECB8CDE273E980C25B831CE8504E9125B4C402F826EE5F4E2965FBA01771978EDACA1B9AE19E0E302CD019AFFA2FE3714B7C136FE5D3B6F9D7E6622493942323B33DE56202A94D4CF505DF02AF304CB7339460A2DA004D783024AEDE73BEEE0C388816B90B36449F84FB145D99FBED6D46A1B57369F2F1AF1B4887E5AD0B318B527E25F81B0A847188D0BCF722482B90B1E96B114CD0274C8D00401B0A39B29E4C6B07979199A547A27D9EC39DDC7B29FF2D7033CAF8463658113451FC604C0A01656A2968871E153D77D6A1C328EF92ABD4EEE745A3C58D518A0AF004F2C636E2F0BB636436B0517D6F8D6A4323727518B720F55D993E2C9E1653DB50A43F10C4A69FEE9B170C98DA672C1B21A9987E0A231AED4241114D605555955A4FFA66314853FE8E1E4306ADDDF09BFFF1F22EDD64448A2F59ADD8237A759C2B5112DC3AD69404C65C2CA5F97345B492F0100882C83CF33F15E6DC2459976FF8870507865F9616AF8F0AEEE21FC008C9EED3565100F7443A731A5D6392F0D5E88AFC84D6A3F3C3274187A39BEDEE638E5C56E9A1A17047303DB8920A77F17B322C9573FE0096CE446ED1457CEE4FB2BA448D9A9BD690D89C58E47816B08995A36ED6C1A965B4C78CC5D7E90D5EE1CF5FFFDD6874B6B2ABCE7EA3ADA69BEE4CCF3892E8DCC8538CAD74FCED9DC8AA13B976E891ACB8EDA3700BBA39091E4FCB25EBE17F011D392E54B98AB4743FB7DDCAF0840CA05E8691E1C6FF4F46B45663DE89F4BC9B4ABDA850563336C0B82FAD2815D879131F58C4C5850B98AB57EB36A4A3E540E80F7115186754F93719794FD73D7236059A4DBE8169C71F01DD7C4FA1E6E3B3E80E5551C29C428996169E863CA1EC09189138588FE85B759D75C6FAD53746F5B6A6CCD6C2A970D1860FCC12998A7E9CA3DE51050F3B9CEF4A303F80591683CA7FA17909099EB288BE46819EC8E93C54BAB05B67854D7A105AFA20E62DAD71C90924A7FE13C5B0FFCB47DE697B9CCF4F33ABEB151E63A02B1835AD4FB5D4D0D858CD9F0A857801A6AA316076A4ACBB4ADE6F55DEC9B9F77D1633CCB4B391A4F879336AF32C7B54D45DA9683BBD83AE8D8E1A87BAA2E98D1D5C8ACB8418A2BEF076B9C35C45B97B7E5EE24BEE56FEF50D7FE9F30449440EEA673D96F3DEF3FAD0009054C7F4B1F36FEE689BFE6907453F2D08830D7524E311ABA74DB389DF58EDFB4F3715C880779352388ED09E5378760C42105F023574CF146E6A88FD7CD42660DE906BC57DC7F49F6691378FB8575C637979D445E2E74D36961FE0BC675A84E638F8AC4CBB0B85F365B3A73EFA97A4BBBA437A6FFCFF21B50226741F19400751B5B47C1657A259B427FB44FEBE3442123FAEE30EB71EEEBDBDAA798FF7D4DF03B2E5F08B1F248
-ss = 79462708F754BF842716F900E850C228B00996B0E3801B43F6A928BFD4AA9E50
-
-count = 57
-generateEntropy = 6a1aee5e708c1b47f02bdacce4f56c860f74fc7cfec1ef3b58285b1c8ad7fec2230e05b7114ff0395cc6634db1eae8258072d09c09f291e92d6620b177dc50d7
-encapEntropyPreHash = 52b19fea232c9154a3e431e9d69cda40013cf2d485c3cd027ad24e645420420b
-pk = 5B668AE6721C79E07EE5D26233936D195B62B192058CFBCB0A5A73EA0154D78224EBE84B7B611CED7256D0726492A4B41D4A8D6B2CA73A3668F93A77294439B0D8CA9A725C5278C21D896CA5D706E5F03D71526CB175ADE2606E3C3A24D510B4D9816AA6846A77663A80F5AC0D364747307068DA942B15CD2E02A3EED2818F9056D697897B509BD5048B178240C841580BBB77A79423996072F39497869007B19442F401009BA1A039C18F191CCA42F9551713CD791C9FB847690CF6247BB752A17A9873E97BCC36B793B6AD827ACF418543054698D77693F9C38C84354CC81C7A3B6A43ACCCC32DA070FE29411F17A420521FC69C0D09A6425A20AFFC98681568B8CCEA88E54B8DD9F12AEF4B3C10F256EB1519671091984A1DBE972A901BB4B24246D7DB01B86665374BB6CB841B3CDB2593BA5C96E32C20936ECBC4ABFD24AF76158B36A2C752A9BBA8946B34C414EEDB355A3CCB87431221AA2E936B0BD7540E697142DA0817B1B51314FC71CF4017F50544474C572C70BD142C676B69AFBA4292F5F19E88163F2FFBA3B1685073C3BBCAC825B095B5D259228A459FA7E866E09735E4CAB8FA733D4DB6A98172846397883394059C635D23C09FBEE3CAB350B9976C6A8A900C8E1693C3704E779049CD1221CE767651BC23755A3A49C6BE0C314A8C501579F7A447070EFFE0314FA3687AB92090738434E55280A42F22A66EAB77A2932B07E6857A32E31A527A2A909865E053A32148B59CBAC224C12468E444916CA375DC204C600899F90BA7C854B3646F2AF3981797AFC4E261C7A93AABC40A93990DABC82564336D01B2447FD35E8E86A0CBF676CFE6C3D229B256E585D8373D26C3AD66161890325533818F845301D9311BC8035714A722ED9206967123E65410562A745FE28F90D50D772A9CDED6354132688DDB1AE6956EADD896CFAA71C44AA925FB3B2C6B7D5E47CBAE00A91040456F4023174C73DD8A4D50F9714AD1CFF718321677A6962587BA6CA82C341F02A7382BE9715B41994DB91E6D0B487207B9B660793E62470B806A7444B6FAAB38F48747484062FF443AE1DA9E7EF41F797398F0527406787E00E197AC3248EE4A0E5037CF6C754AB9A24D08936E9D3313B99AC18886CFA9972030F1A40E58B25939A21698C434391785A3A98F0445567A9DBC0B4284D49652BB1862BB76FCFC6ABE60831CAC9AEF6469464319411A30F7601B5358568B014E67A76EA42ACACD7C3FC2F983BCE1BC0667897B92590DC724B5284FECF7C36B3842C61C27AF1A2F2EC95899591E707272BEA384CB9C8C9409BB26D743FAF196D3B8B33119A379D5CBF6823D4176CA83BA4E2A426745F346A42861A7B5343AD3AC26EA8895F24A379C449156123ED91A4CA701BD789DA84BA0ED5C707D373634AB7A65680667191F806B6F62CACB4B40AFDD649CC9D1650C3A5E40C8346C91B27EC1B1A957C778EC9C968C670FC84645FC07881C54946B5AB0B6033F45AFCC6A61FBB99746F3991F5B827C22972939C5FF620BDC4B131EB393D108C56556719ABBB978452FF0A12A1D138C9065C304C8514658193232C832B05B0B21A10483C6FAAB378C6B1415B75B43796F314542B9D7C87C1CA5FC13A12E8459454D36096C3BA38E979A3D4C852032429BFE1E663E0C256C2E93
-sk = D809438C90AEA78B897A528534FB009D716DE8D513D32168A1537489E52255D00F49C424BF5B5DB0E15A3A9B9845ECCF287776F9700FF5BB7AB9F40FFEAB7F148A9633546846B672CDA9AB8A37C8F9711B76474E7975AB7E16675A8626F8648B605066A4FB4A5C255A0A39387B03BB7F618C9ED1B37E488D4B7175B593860F6C97D637A2D8761D3B933291B2CCFA6BACC4DCC4DDBCA804C7C55EDB9FC5ABB503036059DA4D2929447CAB1BB1CB746AB01293A2B2F2638BEB06030D476BCD2C335DD5226B7450F8B5B2B130332DC9210640C10DAA5FAAC16C1381C2A0C4AAE3174BE4FAA53CA9CBF29769084715D6F8C163A0185030B0C7C9621336A9875946FBB73BDA9774C07615711451F5594A44313878204C291AB7550AAF981409D4D7CBEE727BA689400DAB7382605F03873F38566421A354B59A3B48BC8F62A09519D932AF5800A9A0C6EFD5783BD93483A0AAAC7853C890C3BA18835D1A2E8F14BD0768CC7D0B951909825C988648F797F5711FBC654380E661BBC41CF89B088E1410F19669AEF65FD817564A4A4F40281B5E16A69BE2B503495A4B6B680A08A54FE0B80AE668041AA120C7A363E38AAF2156CEE293BFD4396DCC503646ACB74B9460142E4476807C058D72C9610E3CBB50A29ED7244419C2C258659B3A8A23E7E69A3047298378424B7A12DF3CCE34F1364732B292B105EEE6A487126815BC0013D66FB7099EFD4931E4301D570BCF2FACBA0B433B9A03147242C298052650416651DB690CE81C268381032B17C429A8E418B7E2BB63D30B570DA588CBC36DC3798C65F81EF05530B9043310E182E88BB3E58356DE408898738C9B3C457FACA42B9B81ED7C4118869D5153338EF4260006C6BE294B528C779BD6C8FFCB16E2AAB439D3032B8AC45216282346200CF1C812033A4F9667AF842481D807F92245BB322E04343971A656087CCA8CE9BD3117013AE816BA745888A4AD51A167A17482EE5B88B0BBA455A565B1D97BD3B9BEEAEAC0B4F2879A727028D4A1C61900D0770F15451A01964366D8A6AD1B5BC520392D43BCA270CCF9A72DF3D68B955C4BED0352B3F78151C4716512097BC92F2CF0A2560923D01358AB1B5F8B7BC687F5C110B04C6512372F119FB23BB852398A6F599F4D145A8AFABAF8AC8726ABAEE569C4579B494A01C67E232B93080D5DF1542DD59F21760A24747E98E26466280C04D1784D9B581B4CABCAC1C3DDE1CA8E00588E0732F76B99EC844032D99EF65C8A9EF4A661E78A47B0542B3129E850647862132C208CB9B3986EB5B510EA1854300EE966B0D3BC09922260FFC96B894A181A95A41F1BB3ACB2572475B3FE8933FE3902C965678B95512289CFBAC30A2B159B8F2B3535E40881D81C204CBA9080B9A7B23190965EB660754368955C0C7929E9447B92AC78E7867C1B4770596047FA820C03A11CAA3C2BA48120E29AD46C289920222C511C9E18343AB20067F926435C6D6B040955F9394601B805E38A751BC8A1853FC05857EAE658A8A7CAD729373E73253E7728FDCA89E347BBFC48A7BAFA48CB167111367F40C93BF71CCF208A891C383BA3B593F2663148D779ED82B23F4B6796209D51425E9168CB22224F39F0695B668AE6721C79E07EE5D26233936D195B62B192058CFBCB0A5A73EA0154D78224EBE84B7B611CED7256D0726492A4B41D4A8D6B2CA73A3668F93A77294439B0D8CA9A725C5278C21D896CA5D706E5F03D71526CB175ADE2606E3C3A24D510B4D9816AA6846A77663A80F5AC0D364747307068DA942B15CD2E02A3EED2818F9056D697897B509BD5048B178240C841580BBB77A79423996072F39497869007B19442F401009BA1A039C18F191CCA42F9551713CD791C9FB847690CF6247BB752A17A9873E97BCC36B793B6AD827ACF418543054698D77693F9C38C84354CC81C7A3B6A43ACCCC32DA070FE29411F17A420521FC69C0D09A6425A20AFFC98681568B8CCEA88E54B8DD9F12AEF4B3C10F256EB1519671091984A1DBE972A901BB4B24246D7DB01B86665374BB6CB841B3CDB2593BA5C96E32C20936ECBC4ABFD24AF76158B36A2C752A9BBA8946B34C414EEDB355A3CCB87431221AA2E936B0BD7540E697142DA0817B1B51314FC71CF4017F50544474C572C70BD142C676B69AFBA4292F5F19E88163F2FFBA3B1685073C3BBCAC825B095B5D259228A459FA7E866E09735E4CAB8FA733D4DB6A98172846397883394059C635D23C09FBEE3CAB350B9976C6A8A900C8E1693C3704E779049CD1221CE767651BC23755A3A49C6BE0C314A8C501579F7A447070EFFE0314FA3687AB92090738434E55280A42F22A66EAB77A2932B07E6857A32E31A527A2A909865E053A32148B59CBAC224C12468E444916CA375DC204C600899F90BA7C854B3646F2AF3981797AFC4E261C7A93AABC40A93990DABC82564336D01B2447FD35E8E86A0CBF676CFE6C3D229B256E585D8373D26C3AD66161890325533818F845301D9311BC8035714A722ED9206967123E65410562A745FE28F90D50D772A9CDED6354132688DDB1AE6956EADD896CFAA71C44AA925FB3B2C6B7D5E47CBAE00A91040456F4023174C73DD8A4D50F9714AD1CFF718321677A6962587BA6CA82C341F02A7382BE9715B41994DB91E6D0B487207B9B660793E62470B806A7444B6FAAB38F48747484062FF443AE1DA9E7EF41F797398F0527406787E00E197AC3248EE4A0E5037CF6C754AB9A24D08936E9D3313B99AC18886CFA9972030F1A40E58B25939A21698C434391785A3A98F0445567A9DBC0B4284D49652BB1862BB76FCFC6ABE60831CAC9AEF6469464319411A30F7601B5358568B014E67A76EA42ACACD7C3FC2F983BCE1BC0667897B92590DC724B5284FECF7C36B3842C61C27AF1A2F2EC95899591E707272BEA384CB9C8C9409BB26D743FAF196D3B8B33119A379D5CBF6823D4176CA83BA4E2A426745F346A42861A7B5343AD3AC26EA8895F24A379C449156123ED91A4CA701BD789DA84BA0ED5C707D373634AB7A65680667191F806B6F62CACB4B40AFDD649CC9D1650C3A5E40C8346C91B27EC1B1A957C778EC9C968C670FC84645FC07881C54946B5AB0B6033F45AFCC6A61FBB99746F3991F5B827C22972939C5FF620BDC4B131EB393D108C56556719ABBB978452FF0A12A1D138C9065C304C8514658193232C832B05B0B21A10483C6FAAB378C6B1415B75B43796F314542B9D7C87C1CA5FC13A12E8459454D36096C3BA38E979A3D4C852032429BFE1E663E0C256C2E93CF754F2EE43694865A09CA7BEB0DEDA9B1328FD0ABDF30CA5C338E27E8BE04B5230E05B7114FF0395CC6634DB1EAE8258072D09C09F291E92D6620B177DC50D7
-ct = 78E7B98228BFDF95F03288762317F3EB2AD2750F51D4078A9FD1F14F002AC59489B6EA1AD30D86EC7AD46296F8D0C69DB4AC9970137901A93F02377F7AF74746C5620A853BDBEB7D706C9B743A78F5AC0F80DD34EA8CC9737EC8DB9B1DA502F14BA2D578EA6836AD314DB2A07133D7C0F80E3A3BD196361CE8E8F24884DD9F602F894656FB68520BA493D064F93F48A9D4D219C8312B9476859A462CB15961F0B045CCEEB860CEF99D4496ABAB16A5FFFC21483E9FDAA826AA9B960F395E8AE4C433E69D10C2687BC17005BEFD809FFCC76070634BF58DC37CCB9806F530EF6ADA63CA422A35CA1349A74A5D0EBDE8036A0801F3F61E838242189D9CB1A8725BE3B93E07AC509CACE9A58426D9CC6D084BEEFF08D8FD3F1020ED2E0A3C0BB7E380049C76B4C8D18F8BA2309A813CF36F247006C247C6A418FE9F070703B80FBCD2AD45DDB3F9707C4F685736C680376D622F79644C2B4EAC7858B960C954C7F1772E708CEDA6812ADB59A6A9A277337C44D0A3156327FED348976D07B500EF61046D2B881B3882AB2358EF741EDD947D72A0EB26C19912DE1D2C77B6F523D277AB762585BDB095162ACA9FD027BBE2BCBB6C4C57EC0B01194363FE086048FCA61489AF4E9A06D8367B28EB465A9F8BF986C207B26BB9EDE3200D6F407DC957A0CE7866882E83CD89AF5702F38FBDC974EDAB62F24BF50C53037437260659EA579348950652F93162BF1A9BCDBB72E44D04B4B3C3975588922EAFF1569837704CC6BB60404E589BB0E1CDBB79E503D0F946186FD35B4E0A294E2CEFDE2C0DCB2B2383348F899176FA5B620B941C68805B52959D0571EC26B9DBDD75F0895561396B3ED20BAA07B7D20D0DEF905B805DBF334601BEB359B93E9D30C56D91AD58CD93193D7DB67DEDDEB02D05B64B23F765368524CDFD40F8F59DFD5CA7280A03E0DA103DB6976331514B965F1D71861A846A59CFF73865BFE35690AE34BA8978876C809BDBADE6726E4ABA2447DF9F0399A06844B1CCA43728EDD3FA348B34B7F15DE627550B1392DD3E0996EE3D8B7351D6A5601C796C4FA317641100ECC8EA2BC8827B6B88344FB5EB4AECC3F24B78FFDCD278DC5D5C7566031DA41BF4B4AF39D11F5355DF82FA68986FF0E84E931B520F600030495E6DDB4AC02F3DFEA6F182FB1332C5F6180D476501118D32A79217A9FDC3CA8DBF3B942158A0CD42C44A426A03101E444CC84DAED5CB8A17DA4E84F56F2C0B9A665E4C144994D982595A22D7E4F1F1E1937E8B0B4C70959621E0EE3F92FEA44FF164B6F7DDBA625C97152494834E604526B8CAF76F995B18F9AFB0BD263ADA10751F45DF9FF83FDF1A64ABF7874EE144E225E39EB4A22179622E7D45DF70BC61237D35BA64E11468C408BEBA085EFE12ADED232044F4BE8EBBC019512EAE687ADA59B8ED47ED82D2B593C46080A75D2B9DD5BD6A612C7C1AF0D76A231DF4D3BAD49F09EF01A38652DC84FF60F3E6F22B471113BDC51DD5C33B73CC65AC2C701F4CBDDBA9B361680FBBD0B4
-ss = BF535EEBD3721E4D832FA4C11369808A154FAED4602220B4070B78900B008358
-
-count = 58
-generateEntropy = 6396b328b100e4c7f4bcae69875edea1a1982421558c608c13c592bf7b5d0fef1100ced48add211a5c937b8d6079d8e271af3f949edc61f70e60453aef20dea9
-encapEntropyPreHash = 64440adb05db3308b189bf999f9ee16e8ee3a6ccbe11eebf0d3ae4b172da7d2f
-pk = 98CCA518437873F144E7E261E8465B3720582CF7706D684F84E618E8834F35857D4A8BBC303134B5E235DD1B2387A81C663876C5530293F99571B97AE5A299DF0C012E9662947089C9F81687722FBDC30CE50689690B30932A8A3CE7BCF6A353BF988DD310A2C347BFE6B30999E69C455B9F472B9BCA0216C84265E5D9486F6A7F1F3125C16467AE41B9F85180497B255ADB06A406A13A221388E14C0DE8CF73B6A952C2B2501644831C3700B7C273B7A3180A7641621F33B41C0F9255EFEC1025FC46F658C64FC89352C54C264B97E5A91C2386CD3790605127740DA2076EAB4876E128F3746843205B8328CFCDC65FEB92C2D973BBBFC68FD7A46DB51641B7830E73589F41D413FB571C37685DFF142863078ACF00043395BFAB3589B0CB435981B84E54318AB46E398389B8E146CAB2A9666330EC4C90A652A0F036951519880A45BF5D000D4E40C6B6554CD222880D0B91B67153C43909EB2C0926354D436C2318C593F9FC214B548E17245C0C9B83174A6783508B97AC6A8D8A88ECD278E2E52C3C9138B1685DABBA2BB1425075B298CB9120E790AFDCB9792C88698CC156CA5A789474992F470B1D554514823E87BCAE52CCC872C951B0C24B4A2B0460F488EE7768D56B07DC79B3B4CC321E5878AC0A5C3146AAEB6CA123206B0C7B5AA6E0BEC5D0A903AC9415DA345AF199CAB86BA99234C9526E6E8812F6DA8001F31337B8498A8374AE527B6032A0CF3142D1D34181A5AFD6AA432A588AE1F644F5A100FA593F0ED2753F441AE5677484738FF694ABCEC58781B06D0213579F827FB4F97B3FC343A445BA3035AEE989685E7B20BE6103FD39AFABC334417379BD666181925ED369680B851A54C41B6546B9C04CA69742B2A814763674ABC9CBCB03E96F9466CBEAEC698CB5C9ACF814E90887F8D15BEE556B28F50B739185EB7A5A06E896ED0048BBD905E016436477A68EBBAB1E172928AC8FA9A8B0A0D999B135A753A29A47D0136865B0F382572B0697D0FCCADC8A77C1B591BD73B639E13F9C21B6F0969B0ABA3EA807303377AFE0F49421B68D0712823FC448FA9A468FA000D5964BCF9A9E7FC92DECE03BF6732A36935B25023B47FC94C15795DD983BB4531E935A19778305D0E8A75C2CC770EB46B6D5759DF503BAC33F0669C775729C59EB94D48223D763880E8B58473683CEE48E309380F7B442E6C83F0EB9BBB0B1AE805B1498471AC1149D578B454041AAA2F5CF13390F10A72DF3385C6A8A1F990BB946F4C888E585069B5849882788A1BE27DA0725276FF9DB130519050B74CFF69A68534222499CC61F5845A8FC0AC5629E0CDA20D3EA2F0046B78A2267FA0187F15721EC53083018772097892BE85C1BE99480247E6E30AAC8FA2C593C630B981E57515E0F7414CFA8B606D931280A950E567C93B319FD23CA1B682FC0B960DD309F80455CABBBC71979C59A025008462C0681465D748FF2A6AE24E86C79922E2845568CEB5063FCB81B78295B93A80B221AE7E14A9A9BB7182C1ACF347F2FA73784835F3375A29ED05E4BD120A119CD0FDA29F76A1EB873AA88D0CB3C661FF0D5652F2B4604E2BDB1497486687F17B8CE7A096A59E0922260AE99BB7412E306CC0B25940FFDDF25214EE4DD4E1AEB851878E2493C05E2BD5A30B5B99D369454
-sk = BA45541CE7B3DE134E6B17030710BCCE09BCDBA837F23566DBF1928C99CFFCB674CAB9C41B3151FAA3078177B9126C7973E25687452DA075965BAA804276859B092D9D4095B5E3A27943776DA65262511F62A3AA875B258C7929B502AD6CBA00E3B38011C943310BB5CB24791A71BC5A2796D6197192D9594936089D88BFE976058CA16C152193838A3D7306B312F8160DF15288F9063514A403ACB76BE298F5C92D65A90A0BCB28A4F438EA447A9C881808A18A2F5C3C1B876B3AE94ED28478FDDC1E98A64FD797A0931CC4A18777E5D481D9E92C0CF2B5F5A58635B368CBC8C25DC733550774C0861795939B74E83A23757C212927805663DE14A0FA00CF10F51850DBB4CDD7CAABD5C09B2818CC0A09A58169E3827969518E8FC7BC8325B45656861A848347A358EF1155E5D43F7910A738A132C8892977075C9A19C1EB6399F2E7BF1DBAB593A907BDA509EF5B0DE35A222FC951A0829A838591A0441294C35CA0B86BE6FC02E1EA1B7D4004E5BCBCAA2A280EF37067D72790BB5D59587E050272DDF8B117286FE80C1BBF078E6D259A9B53BD6FF1B43A86B24ADB27BBFA3546C179B8F295726AB768BC7FC8DC2A62715030D93581165F1E4A03D42374A31039D55741C9C49A1C807468CC826F0380B90C9C3F319CF1F73811D674B05C147BB2613BA56365EA04872B9244B236B0D480DD0B47B7797A23286269F97450E13791B205C8AA3310B72F3423B263D93CA320AE1FF04FE6E3BB703A6C4FC17DCFB6341AEB485576B53D1CAB71D9049DCC68CF86008BDB6152994E70152F96C8AE4A0819102BA5077B26086B2DC6B04B324A31AECCB372CC18976BB9DA42C8EBA89640149ACC544511546C5DD293C3173EF28CA92B85B86188BC6FC09E2725307A2C3802C6086F922CDDC62B5989C5A6846496D2BCBF7775A4B3737EE6C6B69CC3373C96E79675CBC781146C7A78824AAE4322E1A69DBF64336EFC3348E414ECAB04010B9F7399310253679B48AF3C23961BF345B35172C1D472F9A31274C730373A29154A581631A0916A21259A46EFA387B36CC9272B5284085709E46F07BABFCC835959D841B3647F51147A013987DD9556111435124101E5D42FF0848BFE2169A49485C094226EC6994CB50BA9F6476FB2A39522A08145B987593F2FE67A2B2CCB036C4E6540145758C6745A389955CE9744CB8030BD85A838A5904198B318A4D265EEA61C70E5A34156BA00A53F05C9BE7F1AC214F6A75DC8154EECCEC7CA6218B34B8E063231C450EA3A8B48F7C97D9C58FED709C350A28A34873CE76F0FC7A4237AAEA0804E2D3874D726AEC41C3AC8E02706DA459C01736B7A5E0936B3ABCCBEBF146350EA2A246C225BA897473817F28C8D6BBB55FE98A48DE682A91770EDB1BDB190A0EFD677A7FC29FC62690668924CB5887F4078179AADE85C0DC8E3529862B2760B187B7778A56C6B026769E339ACA5F8C948801FDDC4ACC3BCC7FF548DD9FC12CD7A394C24A7CBE18D3D22AE3B48BEB295905B217AF384393705107F33B02547822B0A2CB1B57B6FC637E071C0FDBA2F87F010D0C81C42DB454F5C7BE69AC0069C33330BC40532248FD0B90A28908F7471FBCC543FA94403818698CCA518437873F144E7E261E8465B3720582CF7706D684F84E618E8834F35857D4A8BBC303134B5E235DD1B2387A81C663876C5530293F99571B97AE5A299DF0C012E9662947089C9F81687722FBDC30CE50689690B30932A8A3CE7BCF6A353BF988DD310A2C347BFE6B30999E69C455B9F472B9BCA0216C84265E5D9486F6A7F1F3125C16467AE41B9F85180497B255ADB06A406A13A221388E14C0DE8CF73B6A952C2B2501644831C3700B7C273B7A3180A7641621F33B41C0F9255EFEC1025FC46F658C64FC89352C54C264B97E5A91C2386CD3790605127740DA2076EAB4876E128F3746843205B8328CFCDC65FEB92C2D973BBBFC68FD7A46DB51641B7830E73589F41D413FB571C37685DFF142863078ACF00043395BFAB3589B0CB435981B84E54318AB46E398389B8E146CAB2A9666330EC4C90A652A0F036951519880A45BF5D000D4E40C6B6554CD222880D0B91B67153C43909EB2C0926354D436C2318C593F9FC214B548E17245C0C9B83174A6783508B97AC6A8D8A88ECD278E2E52C3C9138B1685DABBA2BB1425075B298CB9120E790AFDCB9792C88698CC156CA5A789474992F470B1D554514823E87BCAE52CCC872C951B0C24B4A2B0460F488EE7768D56B07DC79B3B4CC321E5878AC0A5C3146AAEB6CA123206B0C7B5AA6E0BEC5D0A903AC9415DA345AF199CAB86BA99234C9526E6E8812F6DA8001F31337B8498A8374AE527B6032A0CF3142D1D34181A5AFD6AA432A588AE1F644F5A100FA593F0ED2753F441AE5677484738FF694ABCEC58781B06D0213579F827FB4F97B3FC343A445BA3035AEE989685E7B20BE6103FD39AFABC334417379BD666181925ED369680B851A54C41B6546B9C04CA69742B2A814763674ABC9CBCB03E96F9466CBEAEC698CB5C9ACF814E90887F8D15BEE556B28F50B739185EB7A5A06E896ED0048BBD905E016436477A68EBBAB1E172928AC8FA9A8B0A0D999B135A753A29A47D0136865B0F382572B0697D0FCCADC8A77C1B591BD73B639E13F9C21B6F0969B0ABA3EA807303377AFE0F49421B68D0712823FC448FA9A468FA000D5964BCF9A9E7FC92DECE03BF6732A36935B25023B47FC94C15795DD983BB4531E935A19778305D0E8A75C2CC770EB46B6D5759DF503BAC33F0669C775729C59EB94D48223D763880E8B58473683CEE48E309380F7B442E6C83F0EB9BBB0B1AE805B1498471AC1149D578B454041AAA2F5CF13390F10A72DF3385C6A8A1F990BB946F4C888E585069B5849882788A1BE27DA0725276FF9DB130519050B74CFF69A68534222499CC61F5845A8FC0AC5629E0CDA20D3EA2F0046B78A2267FA0187F15721EC53083018772097892BE85C1BE99480247E6E30AAC8FA2C593C630B981E57515E0F7414CFA8B606D931280A950E567C93B319FD23CA1B682FC0B960DD309F80455CABBBC71979C59A025008462C0681465D748FF2A6AE24E86C79922E2845568CEB5063FCB81B78295B93A80B221AE7E14A9A9BB7182C1ACF347F2FA73784835F3375A29ED05E4BD120A119CD0FDA29F76A1EB873AA88D0CB3C661FF0D5652F2B4604E2BDB1497486687F17B8CE7A096A59E0922260AE99BB7412E306CC0B25940FFDDF25214EE4DD4E1AEB851878E2493C05E2BD5A30B5B99D3694543A842153DEE9E035299D7E268C9492D71188F9FB24BDC2DD20C1DDCA647A15231100CED48ADD211A5C937B8D6079D8E271AF3F949EDC61F70E60453AEF20DEA9
-ct = D793DFE0884A98CD776624207687CA1753B04CEF55D5DC4B9C5C94264ED0AA15B03251EE0FAF7C60C6221FC790F6E32C36DF947183BA0F3371CAE13EF196F36EE80ED758DF37AC6D9F45F14F351849FA5A18A4B9904B4E47B400B7BD80F7F458B92EE9A1577289A0CBABE7B8D7BDCC1D9BDB1605C96B509514DBF7FC9C84327F692526233F6723B04791CAEAF19B687052CB36CF248A254D4B1ABE5C2AA0D7EDE7174DCDDB2FDE19F5E91014967169A2DB30AA756D794012C290811361DDF4818C6BC1D74C7BB6E7830051C7B3EC51D66C3B1613C8144711CE70585F8FCA8001BCD9CA247DFE8449BFF0F7D52F384E496617449F003F145DDA4B53015AFECC31A72E3803AB561C35A72716D8CE3566A66AA0E921A1098CCF09712086C22C1CE4951791A46C78CAE8734B49C571710EE0EE2CF1138E1FAE19455C4C2B573EB8183DD9892E3D0DC150DAB5ACD32F8237B680865BDDCAAF0D5176FFB2382DCD75EDB2CC8398AE9789B7C49D44E4D4D18E705CAA7E3021229A52D45B12677D8D208EFE1DA2ED0F17C60BEF179C36A5B40B4D2B52A43CB251B65508148666111078D1D0E9ACD129526E48CC09148941E1B53E31392C6BFDB1406B7447589D2FC121E106830935B94AED6AEB66DF8FE843CCE9A0B91AC388E5C4C023E2522026CD518F48345411590AE042B607BD38E33FD15398C721DAA0A1023AEB4704B34125CCD18856EE95910B9044A83560D6EC6B2DD6BAC5BA82F47275B39996BE603485B9A8C8CFC71550F21F1F98458BB29FDB6D1700D47603F64734A910E143094DC3B0FD1B035C6CA03C57B009F4E3DAC49EFBD95D522A130CC70A98145F1B670463BD70917FA0AA10514584F180AD500FCE41902D7C5D1CA1E0BDBA213998FC5050419E2C5D1A149A9739DAD7F64B778D1CF6349939CA95BFD6797DDF9E6FDB14B770874A7F29A8C3CAEED48CD08BCD44931B194E648FEFA354CC754D2DBD1C829DC084EE2292BAEF7F221871E783E5ADC8DC8B2385D24CF98BE75C43628D990EE4B3CA96852F83A300E8FE2A84C1D894B0625036BE83CA29FE97C56DEA2E55C0261C04D5646F2E18CBE6AEEE22EAC0FC9E1A29DB9DF885A612DAB313ECBDE8CA25DA4D689B2D426B55B4FE36BF4512C730F55355CB5A7A980117FC1E63E50BE364D54C91B3001E89C36158D266F36D403CFB90F9CF73B86FB7435FEA20581ADFD570DA4C4C48FC689C1B67B4F457B7EC1C96E9C484FDDC58A27954402CF1D8E2C44BFD518F6B509B8178D4BA3C1B7BD2D1E8CF79C031AAAC3DBE6A9DBD211796A733ABAAF7F43684391368C98069CC42D069815EAC5046E13A8BD6DD39BC4ED2D3F292DA8EE67003947AB77903D72F97E9BDF0C3AF3D916534400545A3075570626F51C00F2BCB9DC611F0BFF8807BBA0A5E8D28CA8B988EAD01B7CD106D61F5D2E72FA46F8B9C80DE2D12778EF8A59444AF28F101B243660CE379C006B8AF92B26C8F1B6186390FEC31183227FC770ACA96B4583773FEE1ED5B1C96949D5DC66F2E76
-ss = 3602269C7AF9FE28EA1019208DC3AB33BA09239D435C509903CA67345717E845
-
-count = 59
-generateEntropy = a453bcacdd2b0d4646009e5ed451c3c45f08fb827ef733db3c517a9dc1af93e67a3cc8aa3239d4c52ce4c95afdeff6efbfacac10d294edc0e7cf4535059bfdba
-encapEntropyPreHash = c8bb46b3a7344ad170c2052fb042b5a3b62e0590562ee82577b1081f6f114d16
-pk = 5E451E4C8C85A192C91DF27C17C0684BAA6375B17586F8BF1EF12B91615BD08A340C58629CD45F7A392F10A04916C249AF956B180BC418B8A95F66B2D0847E79D247B430812D682B1FB91879FAAB68F25602579BF0D895073780007B7D61940239913EB217CB16A63EA08B29656712A21A32C754953335C29E769DF17125D84C32B3250EC96067B975BF524091EE4013A8B67A19A331DAF38A396A765F7820A5E3606A734F5BA854D1E6B6E70CB9EE5B00D4D18D928921EBB8048E284A3A05A3DF9469EC53195180AC9F869A8E8866D69019E9730FD6E672DB024B6ECB4DC55729024033703B6FDB7BBEEECB2345782815843B7B7664627CAD52038F98DB605FD23D24080F809A276419C876AAC69977998B1400395829656C97BE262E053197EAD738D9BC995145CB2713B5E181223E04497C8114EC5A05384AA31CB84406F93365D7059DD88DB8F94A8F068FCD10BE96E32A0E926DCA518B3FE9286A755F29D83CF667407758141B2011FBB1764D3334F3A763A17CCE33C2816AC79EC4CC4C2D842B004C352ABA419BE87281779300708BB20143A43413A2A55C41E36444046A3C021A4D7818DD146D1DC335C66152866597AA69A44F39A2814A4830E002672731D93B7FE5F77587B782AA279CC9807D6126392F812E83662D49DB231DD3060F882D71D2A0A4C94ADB3784BA1785187423D7E8A82F379EECBA7E6F6A67B568698AC3A2C0B096B015100BF9ACFEE522A0192E49880439CC1FA9B30FB7A10544E1867B0C34DA981CE6E660CEBB8853545994454815178C60B04DCA7073531AA2A5095F7B8578CD9889F3428A7D1C72B8FB320F304FE5D23A4291666BF7AA1AFB5086532FC5AA347DC29279A4484261614F2774C81374AA453024B68D384B01565A36D98B751297477A61780E98135375AF8EF68359332826DA01BA6A73D5263ABC659454F57D83172D0E515D3754270AD84543D995C0534788A6786927B952698ABE693BFBB358E9E393151AAC991C97FEC8C55CC407BF027DF7E2A505DB531D47344552321107B651FA4E47D4B389C5825E02CA1F42839ADA4D7EEA2CCB24A74E34672BF1BC4F33C88C3603A3FA6CE87AA5CFE30125F99E81550C19B58A807BA8A586415C2924A6E467CA8BC85A5400F910457E8B9D74A11E2668C0F1A2A1D0389361D09900EC6671206139380EBF9390B2401555BA0A57FCA36D2742F569A573096A2B442C5992C3FB65271479291F097CB94589FA15BF73CB9319D93860EACF1CD1BF7D380E03587CE3FAAEB6360D79574803B5C49841B74918768EFB518CA46B26929F68639EB8FA9F73E61A8B69B004CB5D9D92CF0DAC9ABC03171444A03409714DC1514931182701C19E242AE73B465AF335C8D3588FF468346ABF76604B6EF887A7EB8E8B44005BB55AF328155AF7928C732E7805010CF0A50EC68E29ACCCEBC4A39E2ACA10084E2543746BE6C81D482F6F3C1FE0D31C6A69329D783A1BFA0B43E289A2F843C71196809CA4B82C75C59C7AA5D311350AA55E89735D9C34E6982D17C033937253D9778CA31A14A9894C5D801415056552C410484970CF2AC86B374644A37976EC4A123C0603CCC01C6C6E994514F13885BCEB2F8B0A57073E0F3130DACA54C038DC1085402160513337AF2B6DD900B04DC3BDFCC90BDB
-sk = 2D80A415A1B29961459E396204E5B5E65540A2A9AE9CD52D867A9E20952FC7565B66151653448353697B09723B17E3B1EF375A3E260A5869B579883FD1EB3A06DA5C11E493F4CC9D18381856FB2C36223E7214AD78A178B2153DCDE882451776478A4E06B392CE9B9D0310A5A134B42C37312A8932151571D85CB69D9333FF8685569568A0FC4568682EC2F5506F59742601C46DB34EFB9665B5815574518FF677BE1C0991B644B5931B112220C6EEE10C37C19316156BCBF354FB661635E42F6B26B07F9552D7B1A65D51C7EB6A132034BD755674DFC14345AA72ACBB85D4724B2BA14925421E570543AE904F9BC4016BC0389FB9922CB12A393A24DF219290DC506E501003C0AE8CBBC685A25A91147265207F93F190B12BAEBE7CC7EDEC476553762EA45E48694DDD172B6787B7D9719E89D77563C9C2CCB77CAEB23D7AA9181B82B6CBA09AEF1851235C7986194C8322280B4192B94262FC79CEACE4B894C86814D4929BD773E6A73FB0C7C36C67391A314555674CF415292055BB39319DCAA7B07230204C068028B3AE7A7223DF112032D60EDD1B6B52EA1ED13B86231A1EFB2969A691CEF0D219835A44E907BB0CD2CE6DA1442AF1460F2AB882959E0862BCCFCC6E3FC2BDB5EB673B218D6E9C5DC6461D8796945B614C81A68F9CF381D256BC1E63285141814077AF5F54C2C6B487DD29CDB1D2CE08F09122D09632AB823CB00D86A57F8933743F347C203894D0043F5692A6E12283ABFA1B98B39C6D638132EA4B94644E89A0ADC35816BE01A408F752B3215029D7661B554BD39ABAA906AF32F877CD4B28BCC217825AC897D06A4C233462FBA602A81321DB93279A19BF44131B86035DB3C4CA911F1FA30146F9BE0333650C3C24A5C85BF5E252413853DEFB040F8A16F4ABB9E18CB3D496A69B356D8206C106864C7464A7A7EC5E998B3FD5B18DF1D947E171272EC5AA1137CCBE50AE73ECC106250C0392A41A73A4861ACEA19257BE33CEF406B7EAC1796F605A709A4BC06BBE40867966E830E8AAC19AF626A4642A8447276F09CFBA6486564079E1AA38D7E179D9634E3398B743A1812F02818E979B4434A4516C2C77672600D5B7D3BB6D7E3253189C3694120DBE2519C62C80558AC1D522855682962DF611FEBC9F33FA27A0787501A42802863B5CDCC6AA81B964CC2C9B8081B63750A6358DB5566A0D3229D2989E98199855A2448F54688ED2487B816F5CD651206350FBBB5CDD995A9DB37B089CAA57AB0DEDDC9392EA1C0F99031A42C350CAB7B6F54C1E4ACDD0E28D7975A188502FEF055FEB5889BF87929B6006562626335B05EDFC544F10CBD927AB3C4C9E806700349B9A0099801D5948CFF3BF0977A9691A25AC880D593A36D1E5436EAB078BD9A6BF25BC3D6B5BDFA02AAB06AB5842C440E40D430AAD9311015A8767417B233FA8CFC64914533031AB39B845A3C50CE00BA0F1A586053768EA48293044F3A831B456320600404761C7E826A0B111AE37DB49B31BB3E9389BD3E354F08879906996DF2036AC49B9C773AF5FEC5375519AE7B8C61CE475AC544D13A5B421B8A686251B6D1C64F8A353406248B0430C8A3A308B600D0C9506D6509AAC9A460935645E451E4C8C85A192C91DF27C17C0684BAA6375B17586F8BF1EF12B91615BD08A340C58629CD45F7A392F10A04916C249AF956B180BC418B8A95F66B2D0847E79D247B430812D682B1FB91879FAAB68F25602579BF0D895073780007B7D61940239913EB217CB16A63EA08B29656712A21A32C754953335C29E769DF17125D84C32B3250EC96067B975BF524091EE4013A8B67A19A331DAF38A396A765F7820A5E3606A734F5BA854D1E6B6E70CB9EE5B00D4D18D928921EBB8048E284A3A05A3DF9469EC53195180AC9F869A8E8866D69019E9730FD6E672DB024B6ECB4DC55729024033703B6FDB7BBEEECB2345782815843B7B7664627CAD52038F98DB605FD23D24080F809A276419C876AAC69977998B1400395829656C97BE262E053197EAD738D9BC995145CB2713B5E181223E04497C8114EC5A05384AA31CB84406F93365D7059DD88DB8F94A8F068FCD10BE96E32A0E926DCA518B3FE9286A755F29D83CF667407758141B2011FBB1764D3334F3A763A17CCE33C2816AC79EC4CC4C2D842B004C352ABA419BE87281779300708BB20143A43413A2A55C41E36444046A3C021A4D7818DD146D1DC335C66152866597AA69A44F39A2814A4830E002672731D93B7FE5F77587B782AA279CC9807D6126392F812E83662D49DB231DD3060F882D71D2A0A4C94ADB3784BA1785187423D7E8A82F379EECBA7E6F6A67B568698AC3A2C0B096B015100BF9ACFEE522A0192E49880439CC1FA9B30FB7A10544E1867B0C34DA981CE6E660CEBB8853545994454815178C60B04DCA7073531AA2A5095F7B8578CD9889F3428A7D1C72B8FB320F304FE5D23A4291666BF7AA1AFB5086532FC5AA347DC29279A4484261614F2774C81374AA453024B68D384B01565A36D98B751297477A61780E98135375AF8EF68359332826DA01BA6A73D5263ABC659454F57D83172D0E515D3754270AD84543D995C0534788A6786927B952698ABE693BFBB358E9E393151AAC991C97FEC8C55CC407BF027DF7E2A505DB531D47344552321107B651FA4E47D4B389C5825E02CA1F42839ADA4D7EEA2CCB24A74E34672BF1BC4F33C88C3603A3FA6CE87AA5CFE30125F99E81550C19B58A807BA8A586415C2924A6E467CA8BC85A5400F910457E8B9D74A11E2668C0F1A2A1D0389361D09900EC6671206139380EBF9390B2401555BA0A57FCA36D2742F569A573096A2B442C5992C3FB65271479291F097CB94589FA15BF73CB9319D93860EACF1CD1BF7D380E03587CE3FAAEB6360D79574803B5C49841B74918768EFB518CA46B26929F68639EB8FA9F73E61A8B69B004CB5D9D92CF0DAC9ABC03171444A03409714DC1514931182701C19E242AE73B465AF335C8D3588FF468346ABF76604B6EF887A7EB8E8B44005BB55AF328155AF7928C732E7805010CF0A50EC68E29ACCCEBC4A39E2ACA10084E2543746BE6C81D482F6F3C1FE0D31C6A69329D783A1BFA0B43E289A2F843C71196809CA4B82C75C59C7AA5D311350AA55E89735D9C34E6982D17C033937253D9778CA31A14A9894C5D801415056552C410484970CF2AC86B374644A37976EC4A123C0603CCC01C6C6E994514F13885BCEB2F8B0A57073E0F3130DACA54C038DC1085402160513337AF2B6DD900B04DC3BDFCC90BDBDA43CAE3C4DA51D69A57EB87094A03CD3A9C3E6B4ED864CC691A60F0509CC6467A3CC8AA3239D4C52CE4C95AFDEFF6EFBFACAC10D294EDC0E7CF4535059BFDBA
-ct = 2EF58C14C9258E8E8D59AEC0096B1645D2FC8A2E12F8BDF9813CD87A32835FDA60F096E647CA601C29C41D3331ED6AFF01978D01A0E7D9774211BBA0CBACB6226379A79C8B6575993589B5D73205F92A21A7B30B175CD228B5A449554A99E0C6E6547BE25AC510B9D1E2EAA8E7AF3A6F6F4D43B4887BCD7C5BC9C4C8A1AF737575802AFABAD38B7CA3EDCA440EE9F62F36F5566809572D5712BB03A1936A09E55365905763A631D6FA6D3C441B8B0C90FE04D2CBE0FBEB2ABBA2288EE38AA58E22453A7109F1E0999B3E9E4EBCB39A5763BCDE0290FA7213D9B357359E06DE0F6033433E78585AFE7CAB779A088A9DECF5619BB8C35DD51AACE7A5C3567162017853595D889D57AC96FA8BEDFF46CC035B15C51A72FD865923CB60F8A4562F9C30009EEC7BAD7A9E0C4188EA89A7BA3F719CA1E5243F94A95C2E3B74336D5BE81AB156528B104007F4CBEE6F88346537865CD9CBC40980462890FB2C994119A74A3D65078E24DED0F91718800B72B66629B4E8B534566EE45227A30EC724925066766C4D450AEB655D91B5426B8F2562DB6120BD8EBDF0F96758DEC90DCA1EAEB3479242E65F097EBC602F0AE36B4DD0FF2F7FC067A33B281582E51F93A5948ADFCDBFFF34A51BF8B3826EA030056CCEF16C9288CA0073EC8C50985EECBC97FEADA2C3139F33AF954C03ECDB4A01B468EA4EAE5FF407F27B6F26C1AE5FABFCD592E31C47F8E4567E3D985FE6D93FD7B0255C8D4E00497F93AE1DBF56F55037F2F5D58012757484E9785CC7052778D3198392CB3A7A1CA0E17A9DE34206FEB0BEBC7E454C90DC6351D3C7B8CBA681B8CA70993B19D47A8D12DDBA0105BA12441592FDF4205656A36BB261A42181BE2CB3C967A54C1BD20DEAF6B4882BE7DB475DEF1EEE3F2083A72B77F1C8766DF31C578B48EA5955752E836017213818DD12B0BA8DF7767C5CC432983AB3D82199DFAB7BD98346DF7BDE7D795B96F61417B768F188D3777EE7A17E6D957BC69BA16E1F345D44E4E18E5189705DF89C4BDC10DB1A6CD1429B10596779FF942A703349FFCF6D1144F105A0BA48E04D4A26AF9C9DFFDE23B8BC66B69AF9B7771DBA70A77ECE86564E266B330937921D695145DF0402C8C81B6F2789ADBE07CFAC8ACECDB8D6F8AA0B053FEEFAA1CF4503AB6C3AE6013B93EAFB5AE3C58EA090F1F26E8A96F5BAC73E53FF9FBA367DE06F0B98CBCE936C4C5DFCF19DA140DBF528C431A99787F0698DAE81AC2DF8F5BD837CE013618CB342F8234AC64A5B40A55FD1443F477215A0E8CEFF7A4C0646B0797CE22C495EFCCBD0BF9D6F46B5E2A4065F5E7B0E6196BE5BB6872D1424A1ECED35892FDC4BA8361C21197E5DCBCBB26D34C39E156B2B60EB9105B4172DE9FB8D5950D92E25B4EAC39272D3010792A39943F00C41804D2CC3713E7E321A044F726132689853F954E727FE0B822E5BE6BB0CBD39F6642379C273C0CF30B5DBA4933EF09E9A8C069089C57C6CEE8FEEB1F51692FA5FDFFB0F6AEC6E827E0245E72777B91BCF
-ss = 5E039D591CFB128E51D0804E0993084FC92B0BCA9C0F2D84E24F5FEA5EFB3B8B
-
-count = 60
-generateEntropy = 47ca2b77c5b717f423222c2730ca5cb9c856bc951d01b2b2c80bd76ccb5539b78f1481d7cab000e33fa07de8dc9627a85e76fabb4428a3376e66300cf12a0787
-encapEntropyPreHash = 2e2b70609f3fe029a14d09d5d659871ac776ce2797a0355f16e2eb68f5613fd1
-pk = A20C8DA5745F754B89A990746EF771CF07A6D8109998936B282757F344A1B00B851EAAC27A9A7FBF480D44262868542128461598B5597B10CD3A2A26E3F941A9A4719AB2033FA1181ED08E3247BDD396A834E43F5700522CB307FF4B150BBA9D8B6AAB47361A7947B7A04B8D923202AB1A3D6644BE06BC6C1E0735D5D92821C5B8E9B9A83C343D0C456B181B6FA566B0E83602428B6CD33405A95ABB623A73299C5B4550A7D6C31D6EF81473489BBE457E744B5D1E39AB74D8A051951ABD01A6CFF3942A102A33080327437635C1C17966834340C26654A3F38616E5EACB0E489141B14E9D1B15B7FB30927715273547999B93EA2A1CA2189F5645CC4889943F3CCD95496B71F392F78A82AA1A21D66382C37154323C0616804F50125D6B0698E5DCA3E2D5658CE153BBF57E4B1908C92587B8C863FF4872E9E1963AE6C971C6AC3932BC974B9F15E5743EC069ED203C3624A022F9A7420BA951425A432B46C5E8BB666091D6F223E357CE96C55BF067B3C3F51ABE70ABD85A73A42233800853031313AE9971D280B3AED18489E75CDC16CBB3EBC95A8C97A768AAA6C0BB0DA7943037BF2B4A523E33ABF669C262941F326B11EC6BC8EF51B0666268D6D433B5190BB6996F65925A7EB0761EAB6906178BE9A923D1C61C0B7683CEA681648C44608217D6DC86441A8F423A9D1C288B32EBCD049C15EC151E256A322EE79E2C689A23A53B8D473F4C643AEDC646401761A7B75F7BD4145E837B756003BAB223FF1A74FEACC2E449B5DD9B5777D62FF0E20E4B395821474AB428AA2EA219BFA169B95039616598DAE0B9282C69CE329B534BC7AEA58E17467B1348B1AB2A031324BF835C985371B0F53877DCA53570199B23BC4D70A9425A32B54749082E794E10012E9B458205E106DA807C03AC3202A4350050815487626BD018706C69A6AB02FCB92621114A16CACFBEA02AEC424F82FB874800C61CC23BC6618ED75674A70A6C43C4068E2A7C9723A054967E4DAB09F337695BBB01053A7C5DBC764A0856D2B75DD4A94A9898AF8B95A62B487EC7FA9F00AB75325C9AB8248F1DB65FD7661DFB0B8EECDC2A4134103380988758379D0A73B0F348B00B4B13B115E74674AAAC2BA8C2A7FF440340B622B5C0BCE05CB601259913C488FEE540D7C058A28A0C28B856EA800D26A6A26F8BCDE7D78298314CEA6056B00A845321A245949A8C7C98D9F8821F1264C658A8061A3014249B7E522D586A54AD7A12AD805544247D74058BC9AC0F603A44AC5199BFFB69C1570C4076B345064EC00C5AE0D6A2308947593A84DDB6133BA40577B7B245C20B5D04C5D08281CA0AA10DA2A358386D2A4C048C89A2402C9150A7419C0A1AA17562FE786F00486DC82A9809DAB08F7B16D9432981087B6741269424598EAA99082525D5DB0DEAF1B96F55B41EE209F57ACEB895BABC38828B712724204744834303C496B7171FC458534F46892627AE54800FE6F11D06B6AF2B6B9259144F769B1F16C0586C9CAF01F8491251907FD213AA6C0BCE5B08F060124FB99822D964C502AC49C16CE9FB17EB0C91AF559947C056AF77CA687C4F675C89BE35AAE91584CF82202734379B56784FC5CE56E3852D89B052367D9A5D375D06EC7863E051CB44929F17A4656A2CB2C58D8D457897A1AA0D
-sk = CA481DB6775F3D276A56CA0E60CA79BE147E63B6898F4B814C69A06F55111C9824CBC1C109A01A7BAA259DA651A1A51D60BB358432550BC1AA1CF3656E0667D726C69A39AE564BB99162C824634B8B8A706D82175BD9657EC09A308B51A3B429822667A5135FE4350A8B3CA10E8B03B6DA0BBD616CEEC0A08476909C6182EF0314B284CC3F43C337307FACF7B617348779D7493AE0A25D415124BC5D9134182169238CEA1A46A3001A8165713A3E5C16AE03A477207B99C2CC674FCBB14CA439FCC3032E4C2F1E92841D73859C76CFBE245193816D87C12BB3F12763174997760D6887A429A37F78C32CC1AC8FACC587AA235821C254A2341B7C6BCF8B52C908836B67D39D63458AFA9530FC2748DE4A698AF346F8B5405DC7B43B05953554021AF73C585B6EF248C07ED23116BAA18C845571823D25CBAE0AF57D4F6AB2473B5919CBABDD7B4CCCC1BE89150CFC585953389172590EDD61C3885446B500495247AED57A9FB1140CEB6B29F7F9A9F524106D8CADA3432C12468F9BFB9A50B920CDE85654C25249350F6760293DDAA28C771963497C4C5230C05862A4391330F54CADC3B0C92B9798F5BDF8B21016725AC8F565466464C2033872684608111248FCCF94C61337EB6B1A9017E342C29EB2B148936119797FDB2757BEF51A9A2601A00C6F0547B1831B1CA1118CD2E1CDD601A0B491C588CB5ED88AC36AE183848B9F87264CC5B020B2E965E5B89FF74C58CD2B338177BF1350AFDA9A74516A5845381E5FE132B4089506E8CDE6346FCC760759592345927C5C6A97045B0AD3973E806778759B35988953C80B3E7574B7CAA225C744372EE3042E07CCE978A3F964395D40176AAB7905A4BBA98250F594C5A96BAC41851E09F897DF0376A89516040C1F8FCCB93D44AB474C56913826C9E2171EF67510B53EB31153FC028B3625AA7A353BBE79CC76D393E209115DD00B5D6C98F80101705544604351CDB87715618343BC3FA227C1E9FA1EA3989390B02C59EC9174E5165239427592A2D973774CA62DBD9410164BCFD95834C11621F7DA54DC55C44C594785FB0016448F2CC39A05E01D8581658A2410CAA630347C3F0F6C86F344816BD13B3A04313A730F2DE9BB50659B642353F6463D2E2A1A78B722287616CDC266B01098B3544632152DB3B23938D67C63E51949496E13182326D5B7D70B81D90CC6C5D84D4E5907833A7A76D3850AC4993A696C4B210DCF352A32B4C83DC9114305308129BB4FF73A91D733303BCA92FC0083D95D32CA54557A6FF3C42C2BAB46FF913E1D39BA3F6092E30AB47F9985C7C439448C92B245259D388E291C04DE427F378011CA983B21B2BA8BEA9D6EB36001AC4FA5061EE1670066F9252524848973782774CFA795A2285A2669515D4FDA7093BC54439753FB6B4E6B781EEFF574155B2438E074B332417D751EAB1BA1475436E8FC1B670C3928A3553D2BCFD1A59C46EA2542884F91F98A38D42ECC026EBCF91258ACC99A50AE1EDC88B90C98B74C3961B70759F39B3C20175FA80386376CDE2B66DFF213151B800921AB6932B45B720932A540C79CCA0EACA0A9D5BC841C3ACF3C08096C0446326114F05CB09745EBB986DDB76913FAA6A20C8DA5745F754B89A990746EF771CF07A6D8109998936B282757F344A1B00B851EAAC27A9A7FBF480D44262868542128461598B5597B10CD3A2A26E3F941A9A4719AB2033FA1181ED08E3247BDD396A834E43F5700522CB307FF4B150BBA9D8B6AAB47361A7947B7A04B8D923202AB1A3D6644BE06BC6C1E0735D5D92821C5B8E9B9A83C343D0C456B181B6FA566B0E83602428B6CD33405A95ABB623A73299C5B4550A7D6C31D6EF81473489BBE457E744B5D1E39AB74D8A051951ABD01A6CFF3942A102A33080327437635C1C17966834340C26654A3F38616E5EACB0E489141B14E9D1B15B7FB30927715273547999B93EA2A1CA2189F5645CC4889943F3CCD95496B71F392F78A82AA1A21D66382C37154323C0616804F50125D6B0698E5DCA3E2D5658CE153BBF57E4B1908C92587B8C863FF4872E9E1963AE6C971C6AC3932BC974B9F15E5743EC069ED203C3624A022F9A7420BA951425A432B46C5E8BB666091D6F223E357CE96C55BF067B3C3F51ABE70ABD85A73A42233800853031313AE9971D280B3AED18489E75CDC16CBB3EBC95A8C97A768AAA6C0BB0DA7943037BF2B4A523E33ABF669C262941F326B11EC6BC8EF51B0666268D6D433B5190BB6996F65925A7EB0761EAB6906178BE9A923D1C61C0B7683CEA681648C44608217D6DC86441A8F423A9D1C288B32EBCD049C15EC151E256A322EE79E2C689A23A53B8D473F4C643AEDC646401761A7B75F7BD4145E837B756003BAB223FF1A74FEACC2E449B5DD9B5777D62FF0E20E4B395821474AB428AA2EA219BFA169B95039616598DAE0B9282C69CE329B534BC7AEA58E17467B1348B1AB2A031324BF835C985371B0F53877DCA53570199B23BC4D70A9425A32B54749082E794E10012E9B458205E106DA807C03AC3202A4350050815487626BD018706C69A6AB02FCB92621114A16CACFBEA02AEC424F82FB874800C61CC23BC6618ED75674A70A6C43C4068E2A7C9723A054967E4DAB09F337695BBB01053A7C5DBC764A0856D2B75DD4A94A9898AF8B95A62B487EC7FA9F00AB75325C9AB8248F1DB65FD7661DFB0B8EECDC2A4134103380988758379D0A73B0F348B00B4B13B115E74674AAAC2BA8C2A7FF440340B622B5C0BCE05CB601259913C488FEE540D7C058A28A0C28B856EA800D26A6A26F8BCDE7D78298314CEA6056B00A845321A245949A8C7C98D9F8821F1264C658A8061A3014249B7E522D586A54AD7A12AD805544247D74058BC9AC0F603A44AC5199BFFB69C1570C4076B345064EC00C5AE0D6A2308947593A84DDB6133BA40577B7B245C20B5D04C5D08281CA0AA10DA2A358386D2A4C048C89A2402C9150A7419C0A1AA17562FE786F00486DC82A9809DAB08F7B16D9432981087B6741269424598EAA99082525D5DB0DEAF1B96F55B41EE209F57ACEB895BABC38828B712724204744834303C496B7171FC458534F46892627AE54800FE6F11D06B6AF2B6B9259144F769B1F16C0586C9CAF01F8491251907FD213AA6C0BCE5B08F060124FB99822D964C502AC49C16CE9FB17EB0C91AF559947C056AF77CA687C4F675C89BE35AAE91584CF82202734379B56784FC5CE56E3852D89B052367D9A5D375D06EC7863E051CB44929F17A4656A2CB2C58D8D457897A1AA0D6533C524A32345EEFDADC74A3C6AD7E981832797FAF1068955B79F118DFF93588F1481D7CAB000E33FA07DE8DC9627A85E76FABB4428A3376E66300CF12A0787
-ct = CC18BE84B498262137E39C8C5540DE67A3474E2F9E94953081CAED1A428F3DC8FF3CF27DFFAB8278AC4402A1FCD4C285FC13F251BFBD2E7D5F1E79030BAD0D12F4BA296F374546A5C03A8D270FFC8093E276C62E887CF91BC7B17F2C37065982DBA258B0F8ABF6FB391D5A077A0167E16D046DF535A703412D4C9AE46467AB0DE3B2AC5B80BD5E1875E727DBD633E742DEE2A2166303F7998878A0F96A364ED5B92F9BB74505D8F8694613062353EAF64C50AA7098BD142C431352BCCE1DC9D874505A60EC6318B71158ECC0A6A9C225C19C52D8DDDF1C7B3984A3D90896E89D443398BDF1FBC2569280F22353A9307288B0D99D31FBFA3E391BF4B530165870133645310D41BBB4132A51F8A9F4B62D950CDC33C4C0FC231BCF79D90DBD78D8BEB891EEDBCA40FEF6136C488D474217A77EFA163EDAFB5A23A7D424233923F1E7A4DFF5EC8AD07FFEF39E6ED8F5733A7CA4A484B926FE4268728FF7CE3323E67B3891175677DBADEED1EE2612B58791A6E93D3A9B9662015916359E775BF6357F2ED5A71DBF6783873443BAE37E4DE66B14DA166A4410B2C3D1B0CCF2C26E7A5FC9252B7D7077C32B53BF40D745DB6D32D4C9D7ACB4BD1192ACC55F3BED993871547C361C986AB1B356296E17E34F69F41EE8C60CB97999591484DEB6C6D9EC55ADCBED8D21A6BF236BBBF1981372E6CAC0F688945BCCA2EBD6F76B39C705550B38A10BA9B3F8BFA789E5A80310AF1EF038472E960BD7C2FF20B94E347DD985A702A9D63FDF2CD869BD83D132DBC29E2495B29A8DF54CF7551A68541816CBEA53F3FBB7F32FCA6F9971A7E65CD9147BB81BA13B82DCF914254D7AF5BBB3452346653020870C33AFCA72F5DEC04EAC5B834F29FFE71A9B449306F04FC847421EAB8F42AA045F70A2748D56F69A1AFA39F9B24D04D57D7FF7257262F7E4833A50E617B8AC649414A74278225DAB5AB45B1AF3B65E5C4C8BE12E7CA0F2A74F881E7ABBA0B6402A315EB4FF7CE84C6C0F60309612B53C2AD943A5FC485F8766D493363533B13FFE17B9F8C279213E8F942E35858B3D19627394E5C71B74BD84593976BCC50390557942A4DBD0C4D413AA6B5B4492B957E61EA18C61FBB2C719FB1F79890F91B65BBD173C55B29F01853BAAFC6680629682FD16CF8413488AFCB4CC3C70CAA02B02466901ED472836C4384E8B7C0019436553D4D10FBE261CE1CD1B82494F047947C14F11643EFC41699A6DB1E7803382C51BA88783CE64E3952049897E03D181B4E17AB6AFD40A96AB682A97573CCB1E1B1F09D19547BC746A12F7DEB1447CEB4CD54F6F5E2305CA3F10EC3B4EDBC2B2BA34DE88EEC1218EB1276E1C29CDBD9615C3751B278077A05FE2A35863748207D62ABC17435C2DB742BE8FDEDD9EADF5C71258C906E68EEAE12D438A10F409CD9CBDC3CFE72D116B7C3F1D288DFD9A01899B0FAD6AB18FB34687204620282844DDAD79C457BAD5E03C6D6E6AEEBC7AEBEA18B60D34C106EB66A6B07209D2FBBC99506B0475241E2E6C722D
-ss = EAE95E643381DF7A1CA1954EB0D529DB88A8001B8C1ED98A4B055936BBC6C038
-
-count = 61
-generateEntropy = aaf6eb40e596a5e3e8218871e708b089240dcbe7fd3641f0e5e41e071ce49107e2f8d320ac3cb0c52efdc753282f092bc39baf4a18783a48ea031a191865eb78
-encapEntropyPreHash = 4725dd8fb314bfd8ee23731c2341dbe114606d9abe6434c471b5573e7df193bb
-pk = DB55C6CEC7B63C0721AAD84D2B6551FA941167C78A0C105ED9E5300A24BB2C8B2265251A38EC2B9D05A0635B2849A81A2A7C6F2660504D5602FD2763046820CA168D70B76E35B9641CE46A44F2A394F496DC32353C1A84302381E8D74CE4294A4A260A5B0704797567AE831D7C4410593CB7B9AB74D2042C84805C3AEA6EBD193A927C8189082333B3A5E96857E3970BE7DACA4C884D7BB0B3B9C250CB4135D0B8C90AE320DCB3C423E8A6DE79AD594240AE7AA036E320AD8807CCB7A1BC80C704C9532960864A9528347636B4123337DB7E2DE37823C6AE084418FDD05FF7E904211924FE5A370537762DFA012A2153AF96A46987776D245FDCB9434D66AA10524A3CA74E494C9DE919C8E23C3FF77C58CBD1CBAF5B8A69803A32E23959B2A7D9F808689906A0985AEFF5A8464A2AF64BA053A3C18D89B2CAE3814CD712484288ABF7655063C403F635D7A2AFB9D804E2E89677131BBBF7009C981548036726D25F05F004D605A24B7C2BCCC4294F065C013C8ECB242D25611B5C82BCABEB9E578758F2F3AD3F087BB6813DB1F3990C867A2E679F47F074FD012E87B3B6F51CB1707B9287D99FDBF43C8E58940109C376789E16C4A30B6BC34C870364192C555B81AF58962AE771DF477FF421A9B46C6E64BACD1A8A6D00DA4D9507212C910ED2C62D199C7E330A11982C514F27AAC092A5216B13AD54BEEBAA4049065A68D8CE9B1C969EA01599A71D633197BC33C2F6F958F72CCF14C7C09D973770F170F1F7BB9E458A00936D8677717F4A17655BC7A7EC56119779F7AA391D2356AE3A97D7CA04971CC2515154E148568C176A659A8DECBB2C5C449CCD914D3CB7431CB3A0A400A8C7B59B1CC770C5BB5B64E0932C61783C9979D6CBAC042216A0CC5800EA160C8C8556E0721D610FCE13992396C382E93BAD1514D780CEE046525C443FAE063C5882A01E5A73658A30864B1D6344A6CC46729BAB7810C46F5B480D309A263E30461769A55A2965BA6BA0B44054F211B98C6C2355150ACAB81881E5AC1E561A4BC4B39F9902D1027E56155F5D71B7CA67415185319BA769F88345611CA2C20B233DCACA9DDBA42EDB204576BD028A79BFCA57C9DBB0A54B933C970DE35032B9B51D00C9922ABB5106897CB896065FCA846AA486D9C27F5B616E99EA0ADA711729B75D86669645B9A223959B3C1C2F3AB6536D74295473C4C055AEF8C2CD2D321E9E73CBB872698B3A60667BC768014332083139D08C321157CFF1481F259ED56A7A3FF1717BB64FC951297C709A4AE3C05FE3910D6507AC947F944B970070570FDC9843A8A5BA564141F80F1654766F93048BE6297A1CB76C105A7BA3ADA06A42ED1AB3C17542201712F11824766C07BF14685AB0A9F69A15AD6574E59709D2411B37B509DE3B7FE5E8B0AC65922DF23E680C33141418F9551660467ACCC0C794A67CC530A5B130B4CF1C28747601D26983764ACBDDD30E42EB96125956A5870142574419977209A12E09AB3C5E8A22C1C5252527C90987A816B8830A757EC44B12E2E2BCBF19097D02B19AE47CC7BC99189370A1AACEF36415DED82FA7A63BE809B515F79F06612DABCA5768201C59E2C92EBA6D13B72C31648EE1D504EC3E89C8D796E77FA9A772499AEC973B63E864CE36A29DE99ECEC9695D12112C
-sk = 90D7129B79C095B3063F53058A4BAA74C262A99C822894254A050409215FE67773C26C7A6DCC739D8406A6055B388204604C7B065C0CDCCC16FA880858A36D6200C6CEC473BF81B245E09C6E5A55A8D8314334C23DC14FD6A9C011A2CA93753AFA8609320B1D01FB9A2A4263DDEAB8D5A00C40346B8F84AFC7B945F521321103A5219B533F52BEE42256EDD1B9A526013A00CE07D44EBFD66C0BB67775D1ACDE4AADB7C98731931E54F5C458264894971DF5D0CCD93817BB77A2E7D29CE47ABA205C0971F34096280CC725A3C22A4EE24A9938CC2FCD9A670272A463C852EFC04388CA8CE86A8E9F63273AA208610C2274709C55922AD371C197741AF0526218E84C3BCB61355AB94D5C94DCBB4BC08986AC075E01134B4029C8C1D78F829796C1CAB0EA2075BC25B797D82A8E0385EF1094D0A2B1731624308487991A7164D8A507F2390F354B4FA3A225D5A46463145EBB57B98724F1D3CABF11AD4FDC00BFA267D8F3107CEB7DA37C060AA23E247C28AD0069D30681E37807117AB841F23548CAA02212AFBC1BC54297202FA549DEF55DDEB5BA4D10ACE2650511366EBE9C1D61FA9D5574C86C0714AA523CDF946E1FD259148A7E2AB5C21884314E3B8082BC210B5209CCB6B95EAA2EF62203A0B707BF9C5DB1A155169B07D41C0EDB9709744CAAA36622F189773AD7A59DC142317454D9C81D55D1C637876F104B6836A6842B87174290125505461EEA77D63A8DAD03C7941B69D7F66E434922E13A8182FCC35E51C9CE81978E35818504CB32E4A6DFC777227A5484409A38B2A1E2243110E84D024B1FE0E0BB36D4AAC0622152599FEFA177B294BECE391D47553983E420DE5462C72AB588B2934680A399AC40EF35A5E8819458E0A7BED1AFBB29A446ECBCD4E45A50176EE201526E314CDE085AFDA30226039CEB41A14D87256BF566DB30AC77ACB80B29B1F9D602E919707C96863304372A353771E1CE994241A12369FBF42BCB4315592724CD5085A589B1B4CA46DC49CD65A1247178151E455741C8B5D7C9CAFCB75BF27A5B4ED05B22E932B1E3BFB0C93248400E5485486E0C39FD5CCEC680C78E6137BE96823DECA37C6306D31C9142FC03EC540AC0120EBBE9BD5237583E1972D0C4676708AD35B559FB89BD872428A3E0504350451DD65F58BCB292C0BA437394DAE55E6DF13A8F41827939016A081935D1788C4807A53A011B89528FB60F386632E725B163E83E105324C3914F26F389DAC199A926A25A02624D9A530BF0AFAFA4C5FFE6A5EF9422E422019FF337D1BC2FE16A07D9A046D183137D477DDA378E17A95FC7E02ECDDC0D551724A4F36EE7648C9AA771BD15AE29B7259ABB63D0983917156EDE6557BE445735EC539B2199F9816C562842627CC83BCAA659075F5179ABDD1A7056D27F7DD96A6813A940A9321CFB1946E95C16836EF028106BC26A3EE450D8E569EEB23B70722BCBF828821648B1668E6E47869AFB16C0E4B827C4CEC3C4C9948A6C7F874968DC80160A811CD06D58A885D033210341A6F7907F53A82C98468F6BDB7CC7A60107973DB0E70F9A387673234D6665019676215EE4597C65A13A2636CEE74266F373A4E48BB1DB019BF44EBFB0A5DB55C6CEC7B63C0721AAD84D2B6551FA941167C78A0C105ED9E5300A24BB2C8B2265251A38EC2B9D05A0635B2849A81A2A7C6F2660504D5602FD2763046820CA168D70B76E35B9641CE46A44F2A394F496DC32353C1A84302381E8D74CE4294A4A260A5B0704797567AE831D7C4410593CB7B9AB74D2042C84805C3AEA6EBD193A927C8189082333B3A5E96857E3970BE7DACA4C884D7BB0B3B9C250CB4135D0B8C90AE320DCB3C423E8A6DE79AD594240AE7AA036E320AD8807CCB7A1BC80C704C9532960864A9528347636B4123337DB7E2DE37823C6AE084418FDD05FF7E904211924FE5A370537762DFA012A2153AF96A46987776D245FDCB9434D66AA10524A3CA74E494C9DE919C8E23C3FF77C58CBD1CBAF5B8A69803A32E23959B2A7D9F808689906A0985AEFF5A8464A2AF64BA053A3C18D89B2CAE3814CD712484288ABF7655063C403F635D7A2AFB9D804E2E89677131BBBF7009C981548036726D25F05F004D605A24B7C2BCCC4294F065C013C8ECB242D25611B5C82BCABEB9E578758F2F3AD3F087BB6813DB1F3990C867A2E679F47F074FD012E87B3B6F51CB1707B9287D99FDBF43C8E58940109C376789E16C4A30B6BC34C870364192C555B81AF58962AE771DF477FF421A9B46C6E64BACD1A8A6D00DA4D9507212C910ED2C62D199C7E330A11982C514F27AAC092A5216B13AD54BEEBAA4049065A68D8CE9B1C969EA01599A71D633197BC33C2F6F958F72CCF14C7C09D973770F170F1F7BB9E458A00936D8677717F4A17655BC7A7EC56119779F7AA391D2356AE3A97D7CA04971CC2515154E148568C176A659A8DECBB2C5C449CCD914D3CB7431CB3A0A400A8C7B59B1CC770C5BB5B64E0932C61783C9979D6CBAC042216A0CC5800EA160C8C8556E0721D610FCE13992396C382E93BAD1514D780CEE046525C443FAE063C5882A01E5A73658A30864B1D6344A6CC46729BAB7810C46F5B480D309A263E30461769A55A2965BA6BA0B44054F211B98C6C2355150ACAB81881E5AC1E561A4BC4B39F9902D1027E56155F5D71B7CA67415185319BA769F88345611CA2C20B233DCACA9DDBA42EDB204576BD028A79BFCA57C9DBB0A54B933C970DE35032B9B51D00C9922ABB5106897CB896065FCA846AA486D9C27F5B616E99EA0ADA711729B75D86669645B9A223959B3C1C2F3AB6536D74295473C4C055AEF8C2CD2D321E9E73CBB872698B3A60667BC768014332083139D08C321157CFF1481F259ED56A7A3FF1717BB64FC951297C709A4AE3C05FE3910D6507AC947F944B970070570FDC9843A8A5BA564141F80F1654766F93048BE6297A1CB76C105A7BA3ADA06A42ED1AB3C17542201712F11824766C07BF14685AB0A9F69A15AD6574E59709D2411B37B509DE3B7FE5E8B0AC65922DF23E680C33141418F9551660467ACCC0C794A67CC530A5B130B4CF1C28747601D26983764ACBDDD30E42EB96125956A5870142574419977209A12E09AB3C5E8A22C1C5252527C90987A816B8830A757EC44B12E2E2BCBF19097D02B19AE47CC7BC99189370A1AACEF36415DED82FA7A63BE809B515F79F06612DABCA5768201C59E2C92EBA6D13B72C31648EE1D504EC3E89C8D796E77FA9A772499AEC973B63E864CE36A29DE99ECEC9695D12112CE2F60F27DA7F318EB94A74B437F8E0BC9513E9BCC38DAD99C174C1D75E0145F1E2F8D320AC3CB0C52EFDC753282F092BC39BAF4A18783A48EA031A191865EB78
-ct = CBEEC8C5D1013221D499DF4B687FC8DD032863EEE2A09D95CCFD7CCB41BAC0B0A3122FDC92EFA08BABA7D722EA15C19BDA3F4977AA8AFEBDCDFC3F0E1F4274680048F9E060339D3245E7CD07C368B0A132C6AB6C5FBBE6FC4D87BCED0AE4504A62B3E81DB9F586D2F33C61AB9F04939946AE1C38C0D34D97DB4097E424BFF268243D2CDE37211A073BA22C10FA87BDBC19AF7A7F5F07CE8745458F9EF15134BBFC4EEBB6889D668111C83AF7ACF73E63291A25A47650D2E0471B020B06BE0C34B191550CE2D2AB8323A4F224212EC47FBEEF84B36D17E593E4DC3441196F5B091DDF778C6127A9AB08F6B84997CB057BBA3508B7C31982A0A8A017BFB99279BD375DCB94D8F3AC4C6BC61CB3E63CB1FDC5CAA637D1C9330ED8A251037075D44375450E4224176F475A48854D58652637189D2DDBBE38EF9D34F059582F8796066D8D18362A708190AD0ADC3E91F2F51421EA2172E0170600BFBF23730C6CB025ED8CA4B9AE033F6CBD6EF7F69A7DE1E6F711F42D091A79908C7493AD1B68DED11F32DAA940CD4E92BBAC9EABCE85B3FEA56828A10E01847B92C64CE819E72F62BE4AE0C0F4B6FAC1ED60FCD91C166A4E0C17C13D52075F41113D03404BC422FEDA4B37F990C039218C217B5106A095587E2812E66437D8786B8FC9F3365EEAEBFF0C2E6FF6848F0AA570033471A9834EF83FE62884C2022C8934133970DA578C441787E17423EF9CF2BC3A40B8CC481FE29B8380AF23C42E2A808DA7E5EE6D1D7C96B13031898A8AECCCE1928C49C0A81D47BEDCD8CC53ABA9E77BBC83174AF15C7DE9869DA8FD3B924850FF97558207D7134EC48B9FF33501D4021B6F89208E8421BC07F1D37519614BFD0FA4FC195D54D2F05C118681B2465ADE4375807C5314CB21AFE0936098F6ECA70294F6D1F6DD9E512E0D87CDEF023E317CA27D2F1B373BDA5D96733379CA70731D3710FDB7592DB380CC230E13ED0DC3FE8D8CFE15D730CCF7B6E7151353C21CFFC8B53B5DC2BEEB3FC3DFDD1E4F3EDAD81EB1745353B47668022AE0FBEDFC534AE4248286117550B9BDA0E5643FD95B3293DEA31D9F4F2EEE4FFD4FB3964855E9947CB520EFC349B28B42EFEF607C416BC4A339F04D6EB7E1743F631F061CF4FA5440CA2410AD3088F08190A05FAC211345EB0EAFF7DE7E2294A58B7F27C792FD39DC3B8084F390DB55548E45EFC9674249482140B33C8219C7EDEB1ECBFB17C9F4E07A99ACD348628780138ABCE0C15C96840F04EBE7176090E13D0A08990096149CE1F07C865D35E19B9E1873347D25C03ED113CDBDB3EAB39532247EF19EA00361C4388EDAFDE0B12BEE641310C8AF0C184E3C2D8D5BF7769BAF1F7F6C6B7C7CAF0C1E40E6063E6E601ECE23874E7016D2FDC98ACBBB62B1230CC7C1CEAF1699D004E63F1351501D99D6F23760003C2BCADED3A44CF7B0B572243D8E137DC4AA785ACDDDA836D986C1DCA0587827ECB85B579241C5EFA06E30AFE5CD363C2F63C0E3ACD503F8277FA867626845E6578B40E983
-ss = DFFF52CA2AFC33401B4F72F5E6AB5D9BC21C08A6843FFB2CED24775D786B5A0C
-
-count = 62
-generateEntropy = 6500f32c93415cfdbc0bd31d78d5be95cb9060c8cfa2013955b56f8b6868b322393308641a9a4647f230201e1389624a296b55192a9819fcb19ab77c25f95445
-encapEntropyPreHash = 818d3bb8ebfb32bf464775f7139bac0a5bddce80ec5798595992f9403002cd5d
-pk = 7A2912329482F244226AE33507BA8FC8366736352380B346CA39A936190F09576C5188C5E82315E3532F34D41F1B50BCCC42C1138802CCD5B50A7846FFA7BCADD91FE757AB7FE30E873BA233E13B21D25461030593433F4F66482D94B916AA8D1B4B8D6786926E9364CB579F52236218F199C3925142B53500291A3164516FABB941F98F0DAAA1E2D619C9622D649A0408AC02D5CCB9B787C1F9B196DA37020E362ECDBAB03CCCB63B659C6347104074B1F8254499C8452364726B1294669A3A24AC8B487752175B30CBA68860184D5F78B845B107BEBA80F8750475D059DAD57CAF827878B926FACBC00B54388F24B7B431347E334FFA046C45E234124C958CF66023DCA620E1400CD5C08B89554A474D7D04086E5CBD0D051C03C4580D3442A575255C833026BC19DD301A70367FED300EF27779D2A49819A370519C7FC404ACB3FA441A931C67A3033799519C883BEA134242F35F92393DC134BCE15713DDB33E252B991AF10C7134A8ACD09408C8CB2ADA36BBC25224E8867A4138ED9B4DAF403A477321614B3EE5C7BC2281441936B0B05513C1525421871D007346BCF52D6E09B756B4529BB5480AA3165E617CEF41720167707F35A4415975A62114C7918AD83BBD8905A283D14D22B2400CB29FB1E102562CBEE5A9C10929229F8C60A4B153C430A361812E75B244E4C3954A945459F735D45572E83B505030C13867C720567FD681C539D7094F5558DC5A86DA79B38049B0A45A1259713AF2C1640EE0279BB7191F0C0EC59C2F91184CA70A2E8B7576CE493E32F2C549C4BAD6C925039C4C57114075281AC7631FF4D94EE0723C3400CB2D73C184489AA5B440AD470CDE548F2F70903D08B9B4CB6DB68A5D4FBB049A5A9727F50F9E6C59295C62BED7182CA96D6093578DD014F7EB0B121AC6FAF917FA9B47F6650C6C7336D8848DEDB92A0F70971E456E9AE625CFE266B1000C4EA6252DE1CE20C014BC161FEF405FF327CDDDA37BE4919C2A0C097D6995B0EB743FF66A548307CEE1080A13841ED12333E62EFF081514A5915022C550C6021A27889BB0421DF3A709AB2F9F3B0C0F6019FA8810CE3A9C37F53CD651ACB4E5BC1D8B231F373B7A4CA6723A9710681016943F29697B09F6ABFC1C60E8FC4C201A9AB05C260D2452C83B88423B904DF74F425A9B4D116DE0D059D96779D61017C2E984C2BCCD6159C82DFA5AE7BC63E59304B1105CA054A71D753E7E583742E715BFECC80E51245FF53C16854AE0AB41C581402221CC8834A5F4556A84C19F6172C7C80C759299A42C71BD67040A29185A45C14B91B56A4AF9178E0BBB0C4C197549B5C9765A8874686C63445DEA7A85D43AC4D0B979B4CA13A80BF8DB634A163FE3F4327210A7A128716B9805BC1920DD322B15C74FC722A126069ABB8C95BD090F84497D832A1AB72358D4193B6542BFD627A139374404DC1998416F46054D1B4B538E778D6D0507FBF5571BD01CE56362164793E58355366495AEC80EEA35463C4044B202451B3604D6AB96ACC3617ACC1015379564D6A5FF1A6AE4D802712A94422A99D90988206776055545172B0282B5162B479D748A2E9D22356AF11DAF2629036665EED0642044B76775CFD9417DDACFDCB371AAEF7ABB3C2CFDCA88891DBF808A90028D4F12C57E4985F7
-sk = 0246C2025246911B525E6C3421584BFDBC83D73AB936E76A26236A85215C78DB7DDD010C2E038E3DDA69B5AA2E9F4997D8589BDBF918BE1C046CD518E6958AE6925146009D185B53456B5E16D59257F20CD0F6677535510D02602D5BA5B61C440FA07FABB1B5FBB38437E90522665776892EF205A41A1A2083902648844DC9D65E633266AF871481F036A2888D3FB9901355397F37875A4494777C781EC40478D09A820204A4115701D25A74B4BD91676EA6391FA160617C80CD05B0A80E040CDF22B29978CA55282F2C40316A35433DCC8FF7CCCF4280C0B11C548B5CC08FA45BD0760CE03A02F25689D0F057FAE44CB1574C42E760CB331C2CE4BE16823DBB2870592BA844F30DC407298590A088425E023B856E106437C6074547260A856E648CBA07E51A23E70D7CC65656B4692EC24277F04905C4AEEAAACD36341C705B504CFABA73201C2745AB06B056F1768447981E0D676EC904698EDB230F369190D8C1DADAA5CA59001EE8A68C302F04298DC5700C56B2B577D89CD9A585B239089847CD3E96CA80D928867B27F3657987724FF9031649C246CBCB4673F6CB8544150C9975A13938C89A68CD0B6DE5237FC8D2B7A6BB94E0C0856F00B821636801E9AC84F35276065EE4108BC1D755C1C428566A1CA3762D050458DBC7093567A4465453AB8656272A3C03B4A3C55929271437724471D5D4926109C9792BA49D117813948106D27C33069EB3C40AA8370B79E23F35934AC28666FE72B43F722151F3C26C96CC3B6A40D9E1876E55970F252811070FEFC00D70A009E4871F136A08515AB239C33E2DE638C4260D0C89CFE30B8F8E5927F2C59FEA3947FFD0BD636B10876C3C387C00E15469B42B80BFEB8681DC7715C2B248CA6FED92A9399B72D1023F9507229593BD9BD936A0F6ABBA09BC3367782370B60D9CBD0E8B3D5744101C8CA97EAB822FA4CC399B5BE3195CB1E3C9260030AF60BBE3295C4DE898C502543589142CF48DBC7505EC9A9D93CB6DD4C9678C1CC0A082C5631A255142603DCC01FC07C27D628D89F09B473816B5D5171C18A3F9737BD6D3420D4BCCBD3A5624A2686E54062CE4696E061C83BC2586F1A618639E51E63BC6C64825EB50D4F88334B29145BACC49E28DD564B7A578217FAC230AD00A44F3ACBF8753AA572D66E1AB9198CECDF9BC722455BD267FAF98424EBA4031C3BBEC8298A9388CABC6B3BEEC7A7FBB1C814811117A9D550407C9E6099CEA65ECE641F69454B6A0CA9BF86A3DD472F7C0A7703C6A5B25464C0B091B29258DE673220857878434EA14CF50054FB2E63547E9BE15107BEB7A78CD5C00CBB1462A0347E72B51A15CCB5C333894ABA511295B37C97C7F4C2EB6D97219559B40A67310F457108015AC1B8E3AE15ACF85689C4058EC8A0BB18B75615011F2701BDE8BA70986B39D3368E1F978675A49FBE8509F1239A1C88F1DF4ADF0AC8B68A87E2A403373FB808A7B1192371C7E68B80854B0E4335739090B953A2B67999F9878A32415B78C22289EEAAEFE3298FD38ABEB6ABCF5A55BCA388004E46375A729CC45926A7C3E3BC8B4E2A2B196AABE5651B642C1CB50F666A1BB6DA4D1CCE8C6344356A68DE044214453D03B5C7A2912329482F244226AE33507BA8FC8366736352380B346CA39A936190F09576C5188C5E82315E3532F34D41F1B50BCCC42C1138802CCD5B50A7846FFA7BCADD91FE757AB7FE30E873BA233E13B21D25461030593433F4F66482D94B916AA8D1B4B8D6786926E9364CB579F52236218F199C3925142B53500291A3164516FABB941F98F0DAAA1E2D619C9622D649A0408AC02D5CCB9B787C1F9B196DA37020E362ECDBAB03CCCB63B659C6347104074B1F8254499C8452364726B1294669A3A24AC8B487752175B30CBA68860184D5F78B845B107BEBA80F8750475D059DAD57CAF827878B926FACBC00B54388F24B7B431347E334FFA046C45E234124C958CF66023DCA620E1400CD5C08B89554A474D7D04086E5CBD0D051C03C4580D3442A575255C833026BC19DD301A70367FED300EF27779D2A49819A370519C7FC404ACB3FA441A931C67A3033799519C883BEA134242F35F92393DC134BCE15713DDB33E252B991AF10C7134A8ACD09408C8CB2ADA36BBC25224E8867A4138ED9B4DAF403A477321614B3EE5C7BC2281441936B0B05513C1525421871D007346BCF52D6E09B756B4529BB5480AA3165E617CEF41720167707F35A4415975A62114C7918AD83BBD8905A283D14D22B2400CB29FB1E102562CBEE5A9C10929229F8C60A4B153C430A361812E75B244E4C3954A945459F735D45572E83B505030C13867C720567FD681C539D7094F5558DC5A86DA79B38049B0A45A1259713AF2C1640EE0279BB7191F0C0EC59C2F91184CA70A2E8B7576CE493E32F2C549C4BAD6C925039C4C57114075281AC7631FF4D94EE0723C3400CB2D73C184489AA5B440AD470CDE548F2F70903D08B9B4CB6DB68A5D4FBB049A5A9727F50F9E6C59295C62BED7182CA96D6093578DD014F7EB0B121AC6FAF917FA9B47F6650C6C7336D8848DEDB92A0F70971E456E9AE625CFE266B1000C4EA6252DE1CE20C014BC161FEF405FF327CDDDA37BE4919C2A0C097D6995B0EB743FF66A548307CEE1080A13841ED12333E62EFF081514A5915022C550C6021A27889BB0421DF3A709AB2F9F3B0C0F6019FA8810CE3A9C37F53CD651ACB4E5BC1D8B231F373B7A4CA6723A9710681016943F29697B09F6ABFC1C60E8FC4C201A9AB05C260D2452C83B88423B904DF74F425A9B4D116DE0D059D96779D61017C2E984C2BCCD6159C82DFA5AE7BC63E59304B1105CA054A71D753E7E583742E715BFECC80E51245FF53C16854AE0AB41C581402221CC8834A5F4556A84C19F6172C7C80C759299A42C71BD67040A29185A45C14B91B56A4AF9178E0BBB0C4C197549B5C9765A8874686C63445DEA7A85D43AC4D0B979B4CA13A80BF8DB634A163FE3F4327210A7A128716B9805BC1920DD322B15C74FC722A126069ABB8C95BD090F84497D832A1AB72358D4193B6542BFD627A139374404DC1998416F46054D1B4B538E778D6D0507FBF5571BD01CE56362164793E58355366495AEC80EEA35463C4044B202451B3604D6AB96ACC3617ACC1015379564D6A5FF1A6AE4D802712A94422A99D90988206776055545172B0282B5162B479D748A2E9D22356AF11DAF2629036665EED0642044B76775CFD9417DDACFDCB371AAEF7ABB3C2CFDCA88891DBF808A90028D4F12C57E4985F7D4BF608793939ECBA27DFF5889D4D921C583999A57E20A48085AC549573E6ABF393308641A9A4647F230201E1389624A296B55192A9819FCB19AB77C25F95445
-ct = 3A3E99CDFA0AFF52920DA4CA405CB98307CE61FAA8BF07561C783E8D1636003E6BA1A0E38FF422D21D7E842D98ABDD2632FE1209D662E08A8E3E1459DE3D8F206C6FB378019611CBEE5A835A23AD221F07574E9AE19DABA2AA1E619D25CB73F7AED357D2A68BEB6CA21A905DD876D55FD28B251C94121F4934E8046DC44E31821E44294AB66A42BDC3A0C87A74352872FADB4CF156977B539666718B51F3F725E0F4BE96AA399DFF16802666ED4DF9CD2D83470B90E3BD5B7CF395D029082F0923285CED2148A983AB4D11F525CD9043D261B15EE0D51287E85DB7FDB7215C3363E5E6D2DBC93A546AEE48705A40BB9C8580864AC705499639E7536DB42044D7DAFC6D3ECC7F843CC1AC3374EAD10F60A0F7D31414C3893777A43FC2D9F99BC46D175640A105A0E297EF62D8BD7507A54060ADFD1654AD8446D9B359E6C331D9112DCA7AD22A5A4319EC7FC9BC4ACA3A32CD5F4F34FCB1035521E46E52FF8538A4AD7EC024E9C49F03A6720C55514FB874553875CAFD8924DB711971CA4BCBF8F29BD7571CBF318FAA88E2BD408527A627A1268C96979505FBE85D47720C01DD721795C3A75ACC8DE5184E8EEBAB9F1FF4C4D12FFD3A7C4625C23A2893B1A4C45F4544530F3E9AC72709684B3B3DF2E47E405E84A5339073AD3BBB6C20D9E2300998BE532DB686DDFA4D8EDDED3F5EF868EC100B1D517197313165ED23EC974880D5ADA8D915549121EAF1F0851D9572844D804596573CE5C1A32D2C7BBA0E8FE1190FFE1AF0280E6D781DD31D767FD38899BF7D46BBAD2F7AC2E4CB5FD6E949E259E1EFF9C8A27D8C9C383BB02385C47635D7F631438C560AFB7E4331F1FE6786B6F07379A1CE0A68FEA618616E3F1E5D59C9928C98BA8F00EB1011641F0B2718AE378E4F9CE04C5A539AD899988070E4FFF6CAED2F74F885FF9541BB6B3B713C12FA642C86B075489D06EE26EADC5DFADB91A619E9BFD0BC00B9645605B4B10E5E4029CD30D53C98CAC5C449014E460674F41664F953F624AB6D15DB60365C4FF87AF8993371AE1ABE09428DD55A04154D5A6183D7F2FC1F02B714839A5C7A1EF97B96A3C77E5032191468C43A43107004857F360A0FABEFC62EEDFBE21FC76D148FA89E435CD0004460FA6DCA391393AC3A2E4351C6DA5D9C504E49E8A3988FCF260DCAA781B2882897C6C6913DC72B813634FB39A67C7D341CE8BD5494DD499ACC1824F7585D9A0AF542B8C8D50C6CF42BD79DE25F4575AF276544A3A55B11081CD798053B56C36BA4D0F4BC68E197A4B6BFF7F00E5A3EF02878D5333C0E35C4288A541EA49991C5652D6B751307A15CACDA2774D676EC53C0D36535ECA12BD7428660FA8A8C1C1BE54CEF68D23DA94C0BF547B3EDF5B3D4BC618A5CF67D96A9E8F71839098404573C83E3B0E6CD698B1344697BD4E348A5D56EC3D87C32A1B083C21845251DBB844B16EA2528571E42B631F5A48698658AE63ABCC46E36E721997CDB747F05492BA5701DA2848617A84087D31D040F1DD2DEA513AE87C4
-ss = C870A7BE3DC7BBF5836727E5BD82CF977B1332E7DB276473E4029ED95204ACDA
-
-count = 63
-generateEntropy = 7643cef2d62cc5aaeecf754653ea62294cd2208e5bf3ddeea209e3dc45373d49eac9d531a532770837a854b4f5531f6e0c8d6c10183b30d3435498c2dd142951
-encapEntropyPreHash = c92aa5fb91c980d9cade9ce99d4c75b2ffa7d6a6ff9bd59def1aa701f2a0992b
-pk = 8E892A62437CE84445F2E82B495C9730FAB393DC6F3B36BB2A63759A79AE27B162250076A608522440AC1E04630BA766B4C256341C6AC967B36E6934DC58CDA15621827B9558076361192E89708ED88A71826A20E8EC948B9C7915566C70A7C15A72C36ECC7A3CC644EAE696022657C53500A0F13A8AE50FDFA432D8D2530999275E5B9C1D341FB34B8A5A7421B7D290CBC3218486B555C92572BAC8F1085F058A87FD48796824844553261CA11F06978A03F3A8D68657C22064AF83166280AF52270E004731D20B18982283E51CA3DB7A2679DA6FB0AABA1E75A2D283ADD699A797E1BE93502C6823007BA5B9760A338768615B671BAEDC6A6A6937B9E1C35575776A4A791FEC7751079C6683BA29EA28BAD199175B9629C44BBF219CD88A19F1089AA551946E58032A9C9DFD29BC4CA3B654F494990CC02BBB8E1280B54BA3920EF98903F171C27A5C0FB679C8E84774F22136E89915A534D973733410A96280A3207407235CA0D81A636A35B9DD628DEE9A64A12918D0DC6D4C600989168A163730FAB8C78E61A57970C16C813B791A0EE9F625C438CCD1A9429A93062C4AB38DA5890188829AD116A6F1564A43A2E4F3BBA3712207B65E701995C99B29D691C86BD9844AF2471EB5CECD934F764629DC25839C809432E395FD8582CDA980359246EEF0637B9771FA5853099007F173C8598164DA69C8E67A910A50B9940B213547815E0589326B02FF21B89BC4200219652DEA6CCD59883E29127E2ABE3787738B124D839A67E02195D64989520737E3AA99C6822F2C32249256C45455CBD931A5A1FB27CD56A21E22B51C03217AA387E151631CFA445B2B77EC90AE01828601961ADA8A8E6192104F02BA5064C4EFC27CF2DC3353FC98F34BB947B21EC5235FBA6CAFFB6BC6B1C09A783AB8EF14C4921A28A3896BAC07AE8BA98C117B3624E01ED0496A8C649A38A33FB679BB535A7D1960028CA6C8BA825178E74F0E50B5D74C2A9119B595B863D0375A3DA173C63A03D8C60A8D613CC08064588890E3894A9BF4580704038841526AB84E27CABC8FA4CAD6DBBDE9B53017F100778478B86138FBD6BE713A7E695358538BC4CB5A4FFF531BFF178BB16ACE5A295CA0340985F34267A3A931998B29A36935D3B13AF0631CD37777689CA0B43B9208AFBAB88EF886A8672B331224C66C6086B8B15A8EB86107FC0AE260BF08F970CDEC98ECE9A197751B6996258FFB6DCE05306380770DC63498E9B5D65ACAC5A179D8946B27630525B39C3755C070A120C9F468AB3AA8B1A48848081B888BAAA1156BD600733BE887ABF962C46107C432C34EDCA8E549977D9A6F7EB77EB9974BB353896E8261502820F599257CD9C2852328B0FBC5C2B98658D67E4A636575A46E074A1EFDA2CFA50A0594B0A421661D81D95A9AE0CA1C037532BA7EEAD089961C29765C443D428BF20767D1F08615E85D0C08B0FA5076E297143249283C13486F61A4D9D39780624055D6043120A510D4A686F9B490C74F2DA782AB42157A00991BE019E093A509C0C00B7C1E6AB611DFC4373C640A2F488E7632BE1289666206CBA2B096A479B2140C6AA301BC448B13B6839447C4675AA1BE46EB6ECFCB4DDF2569B2D79ABE93FCEAFF0F0FF88688C870D19759A41D3D361A0CEC73CC908F52BAD8
-sk = 34C91F6EC981B1830501D8969F8847B2C6BD5D5C43DFA044C43B551E610D5675BB7E7C9E393B411E69575301BF4EF4C7FD0B4B59E213905A254EB5540ACA856C370DD28899541B725091C23907C04390AD32A56385075F42A7545672544FE177B74C7ED99507E4D95DEF7C4A9F84C9687B9BC318A23EB452FB7635D5201165A47391D21A7CA732FE9B3455C44EE4E54FC3A6518D51402CD5A2D49429B9C8815CD4B1A22C59ED368ED6C7A9DF83B958CC83C4654C5CD040245543431C0D2C9091376611CFDC2EB9181B21C8417E3931AA2B1141C1051CB82ACA4BBBE6DABDA3356BBF4962C3F883D0578580477AC56353AC7524F3855DE2B00967B7BEE0668112D51CCBC139FA73374DF2685A3CC06838B150F92A64C17772053DE2B05CC4D51832B8A2B8428436D99E1F2484B127CE0D861DC8A11AB0B0019E0B3439733B36A7A600F4638D820BA5624B445349A86465E1B25DE787207DDA0B629CB472D415A42A8BA191B76B5829D4D987A2B0C235521C187A0BADDB603D755EB37396CDD57FF76276CCCA997B00CD481587CB8728830021DCBB8478A267B744A5BFD08B4ACB2C1E726121996E55B60D40F6975637831C392845D6823D4B9092151149992794F4AB29D4164A44239F07C365A87ED9786AF7A57AC0BC0D491018007B6BF7705A21B082D1E040A4F4C25E329EF9A8518956044E7683AF94728487A4F95305D4E15AAD45C040F1CF9C442C519B2AA47A4DFC29063243C21F8B838171701B4B73516944EFC4B61FB5BCA63C3ED12A123F55B832E6C312E8BC48F145D62953F5901F7530068F2C9C9F51CA8FCB342852936D414FDDC2C04F551C827071F99C7C24C991F9C97E10E051694C86789A9442D79092B6547D67AF70D8C8B074CDBF854718A882DAACA3B8EAAD0BB1C2D3E859D3EB03C0A23B290518EF88CE1BB02FE71399EF71B380EC1AEC4C7C6BF3830C1B15F7718D0E471D10234393D94FBD3305ABD09CDF070A0ABC09D7497D2F9B939794B923EB3F28B40904A53A05216A526132D9F3CC64606B40F26434142645D79481A8316E8CB0A9321A4C530A0AD139ED5953168A4AC864C726874E1366AB09A249F251CE5B1A7F5CA60AD66375BFDBCFA3D7AD23A13649C03327D409FDA64581CB00A696557945C58E96C1C889BE648C4885958ADEA79AB212A0BB15506BF5635E437ECEE47B60032B4273B8C96806639C87031B6E23B71996B4576626124281AE4CA0A8FC081E1C91667967B25F76C4F72624CB29BD0A865FD67A4DBF14ACC7A09871BC7ADEAAB37B298F12B60B6372B741681627E4C8346C0D34392716EC173B1B711B1C0A1D010DCA486BD5167223658A5C55BCD0739DCFE30DFCF9BD8AA45B3CA0B5A90243547767A1843E4C87922031819EF9249800C6DB8B0270F9CB8F2624ADF4199741870B0630E1BB1B325768C79984D5E33283A991BB3C98B6BB8BE0EBAAC47C4310C51EB565BABA36BE54F6A3151A104911C38EF78E61F1654EF35B2C836C2321A52FAC710D6B03811444DE5B8403569C8CE0444EF615DAD54AE5649E68AB437C00A2C9EA9B18F59346D8B2A5C6582D763730BBC7F24A7EE7C23607C0683A2826FBB4BAD4A58FF6E3BB3122BC8E892A62437CE84445F2E82B495C9730FAB393DC6F3B36BB2A63759A79AE27B162250076A608522440AC1E04630BA766B4C256341C6AC967B36E6934DC58CDA15621827B9558076361192E89708ED88A71826A20E8EC948B9C7915566C70A7C15A72C36ECC7A3CC644EAE696022657C53500A0F13A8AE50FDFA432D8D2530999275E5B9C1D341FB34B8A5A7421B7D290CBC3218486B555C92572BAC8F1085F058A87FD48796824844553261CA11F06978A03F3A8D68657C22064AF83166280AF52270E004731D20B18982283E51CA3DB7A2679DA6FB0AABA1E75A2D283ADD699A797E1BE93502C6823007BA5B9760A338768615B671BAEDC6A6A6937B9E1C35575776A4A791FEC7751079C6683BA29EA28BAD199175B9629C44BBF219CD88A19F1089AA551946E58032A9C9DFD29BC4CA3B654F494990CC02BBB8E1280B54BA3920EF98903F171C27A5C0FB679C8E84774F22136E89915A534D973733410A96280A3207407235CA0D81A636A35B9DD628DEE9A64A12918D0DC6D4C600989168A163730FAB8C78E61A57970C16C813B791A0EE9F625C438CCD1A9429A93062C4AB38DA5890188829AD116A6F1564A43A2E4F3BBA3712207B65E701995C99B29D691C86BD9844AF2471EB5CECD934F764629DC25839C809432E395FD8582CDA980359246EEF0637B9771FA5853099007F173C8598164DA69C8E67A910A50B9940B213547815E0589326B02FF21B89BC4200219652DEA6CCD59883E29127E2ABE3787738B124D839A67E02195D64989520737E3AA99C6822F2C32249256C45455CBD931A5A1FB27CD56A21E22B51C03217AA387E151631CFA445B2B77EC90AE01828601961ADA8A8E6192104F02BA5064C4EFC27CF2DC3353FC98F34BB947B21EC5235FBA6CAFFB6BC6B1C09A783AB8EF14C4921A28A3896BAC07AE8BA98C117B3624E01ED0496A8C649A38A33FB679BB535A7D1960028CA6C8BA825178E74F0E50B5D74C2A9119B595B863D0375A3DA173C63A03D8C60A8D613CC08064588890E3894A9BF4580704038841526AB84E27CABC8FA4CAD6DBBDE9B53017F100778478B86138FBD6BE713A7E695358538BC4CB5A4FFF531BFF178BB16ACE5A295CA0340985F34267A3A931998B29A36935D3B13AF0631CD37777689CA0B43B9208AFBAB88EF886A8672B331224C66C6086B8B15A8EB86107FC0AE260BF08F970CDEC98ECE9A197751B6996258FFB6DCE05306380770DC63498E9B5D65ACAC5A179D8946B27630525B39C3755C070A120C9F468AB3AA8B1A48848081B888BAAA1156BD600733BE887ABF962C46107C432C34EDCA8E549977D9A6F7EB77EB9974BB353896E8261502820F599257CD9C2852328B0FBC5C2B98658D67E4A636575A46E074A1EFDA2CFA50A0594B0A421661D81D95A9AE0CA1C037532BA7EEAD089961C29765C443D428BF20767D1F08615E85D0C08B0FA5076E297143249283C13486F61A4D9D39780624055D6043120A510D4A686F9B490C74F2DA782AB42157A00991BE019E093A509C0C00B7C1E6AB611DFC4373C640A2F488E7632BE1289666206CBA2B096A479B2140C6AA301BC448B13B6839447C4675AA1BE46EB6ECFCB4DDF2569B2D79ABE93FCEAFF0F0FF88688C870D19759A41D3D361A0CEC73CC908F52BAD865F03ADD3941D22C80D50659F501F8CCA1B448D84462CCB93D5F065889484BC0EAC9D531A532770837A854B4F5531F6E0C8D6C10183B30D3435498C2DD142951
-ct = A37E48A5F89B418765EE73D585AAADF3AB787504364574B84C2ECB3373AF7DCA5582D287A60588C9514086C3A56486D832F0BB56499F22BD19F437505760C1948B04E6DC667881565B63EEDE3D6432F073C7F9F3569CAF3E9E62A6EA7E6B2C2D290ACF3502C87C9702681FE4C6A5CCB0AC957EA2ACC8DD68E574E64508B5C3F8823E8E23ECDE3A8CDA95136D4784F2A17FF9E0E4132A48F1FABF69AD502EFC4DC4A2EB5C05F56FDA2B8243FDEF423D1DA695966F6BCE461B2468F5603B78B1BCC9E8DE0DA3D5CEBDF71A4A2DBCBD653929742EF45E550B34A4B55CF6832347BD9BC0CC56F1CC72F2D92C37689FB2CF08B37D3EC7782941DFDA884F43D58E3CF9DD73F359091DD89D2AEA83C0E5D163775841D41CB6B7E1CD1DAB4C8396F507613E2F842059F5CD8F8D5EB60DEC519AD7D3473A61A1EE79B6EE2D2011F72CE44FC72294C1A8147A6C2C6916D1A88A2BEAB3E886E0B11B815C4C9AA57A253270DD14FE11590ABCBA02E750FB3190C486FD754247FCB0219634A74ACD1F53FBD3A193E6F36049BF3C920D2F0AE28E6F3F70C414BC5EA3660E8D192C1DA4AA6834CCBF2CE4F7A943FF6B32F0246401F6EF6914F5584551290DAE6C3A97F346551A481151796A507654E99819950DA5CE8381F142B3F6AC31B0E6F8B34315FDCE5A024928EF205C2A6A989266D0A4123A5A98CDD9002C29D19D497FDC6F0C77F3B4B1BF569B89DDB22A73D0A59C518B91321277064EE8C5C9765E54C99B60BB9ED63E2D43D9EA7246CB6F8CAD230FF95B622F64748E5E2FCAD034754069997DD003A5FBA93B8D29476C91FBAB4FF0B90C180ACD747EBAB9CD7066F995FDF389874B926478E4A10EB749455DA26CF1D7E78D119E34F0AF246FD5D7DCBAD8479E85C51E59941A0B0B0DEDEED9508DF28198DDCB34624DDB45A50519809A2931594AB8292E96C54D5EB7342355083C2B6206479B50ED7FBD1C35958A94017D40E9E86A5C442E9EF5780357E47AE64631B2F803427F90BC408D3AB639C065F75183249229D8C27716E137891BFF8EE4EE1467B61708E385ED429624EBA3E53440F3248E0C32DA91DED4F934CEC4F872B78283B8E701FA635C941569E113F87A92373091A78DAC58B4AD5521C8472C9F145196D0B594C73126C226B7625D6B7FDE4BDF56E3B32E88ACB3575DCE80AAB36A1A09F9B646AA12D60637EABE185FCB81F45D54C952FD721FC74D761BBD405D50730CB81FE7A6D45B3551B8DC57A78491BC41A310F2478AFD09A539B2AC1545C4796B11DEAD5C4CF2D7342A13B7AA8CA9BBB86BBBAF965DE4D3513EE114F53FB1FDB4C52BB638B2A06C9A93FC93C50458B4D3AF86274258B43A7323281C4E7F2AFF58B43A414708DEC53F4BF23AB3EBE2BF3D51547472F4857F84A697A339AA184FF98A0E980438CEF69EE243B112D5F182F071C4F7BD78410867E3A07D274A7E4A15BD04BD6801D19A3CCA7F50EC6C03D5EA9C495737D71AD9D3A019CBC2C6FD5954680CC6D63722C4AB581BA095A39C29270DBA
-ss = 3A14474E05DF3FF59C6105B1F2AF004A8B8164DD049EB6929B9C9881A873AB08
-
-count = 64
-generateEntropy = f8ee95521060c03bb8dacc79f7eb7db640f545f315613a35d447a09e504cb4e13fc3d8392cb53f36ed647364a04e37278a0e0a45b720f4a75c580c9920eba98d
-encapEntropyPreHash = 7e8086a01dc5b3bb9eda25bcc45d27f99874841b97237968495800e007696ac5
-pk = 61101724795296A2499158C8E1B50E4C900D65C8AE65503932DCA40E058E8192CEC2A997CF12C8A1227567B12A1B21BB31D3198C85C4878C6EA1967668E3952D04B4123CBB9CD8C77F3A7397A9133D99654E6C56E7465D9B98BDBD624C12E36C62B60B6A32C9086A8EEB9B8919706F4573A33C393F74BB51D5609231F1707E152F23F36F6C6830EF28253C8CB81EC5C27ADB02FBDA5302212826F0B88AA4B4D72A509E29CB1BFC8177C019C60598E693BCE999AABC4621123415235208E7869F62AA7B50A51724C13DA2DB59D5BA5302C772F2C1820FB0882EF32F73321C17F40D019CAD39C3B12C57C3519CA0B38366AC4353B133C39262BE6EE47ECF660286F6CA8EB7090418ABA0D9833E22B46B761FA2872FB80972B551809C02775BE07C796636A2C619FC748B90D28E1E702FFB0653E250C8C3759178C39E42411327A81C7E7887B21915A5CC032C37A11382C4D9186221B1C66AFCAE8184559910201C8BAAACEC62BAB984E080433B9465E64A2D987028E9D9090CB2C41753742CD77F0998C672441E83D45F2D06C22899C2136362271B731F6BA3965B32E2517463E627AECA0AE5644BB8602F7FC599ABC120AA111E2E549A276A18D2A92C39502F6F9519CE76C0BCB514E8084C7122A321479338F59ECE08A0ACD30F0AD68F2091855D5980219083398A6C0A63C70D3743678A1C0202A69DC526DDB77E30B779C36AC2575704EAD94DDF1661A38B2624E733F2E2AE18467CE2C3083B75017411390314AB06ABB4D0FB58BFF99DC3949E92994703E85FB6B863AE1C29BDD6656CD75D9BA453AA115A32745F2DC1829881A9F4D5CC2CC053AB79B89D107E6054C69DC93F5AA9C8CA6CC1A7583F2E2739B102378D93990CB8280B21A5D5BA8415C48EC17288044623A9631577C16639922978258CEE0B6C51BBCFE3F70BE07CBAFB7C58111CC7F2F922AA023D5AD01D2D31A57E0469AC428B6FB88A97D957AE22BEB768C3CB7C9F02F583FA2513DB7C580D2986984314E8B346A06501D8972E31AB8EF5B983E9A15E8FFC624D0041FD523570960E09E57D616A06297BB3F9D938F5655628B06C4F6C4FA5F8136F8CC05DFAB7389237EA75AEF46117BF1B67AA978BA622491260128E743F28F95F533B708F3C59230B23FABA96FFB5C239B32B30A65B36FC5A0A76B76F04A60C9C7D5EB78EBE44B736EB56A0812F59D9B5812916246228F2523175242CD1F432F9FB054A8B52D824349DC0756091B2F7C21E2A899362157BF9F631287B90D6C80FB55B1469273F79892435D031B62982C49A1464E2274F815F56F3B6F8C949BE11388DF1151E7077F603AE592623E4259853A2B90159344B041AA29C8AFC5074BEE81959102E0C57A761F1B1AA65B1DCB66A18BBBBE12B2B2942A37D13C77C77B2BDE758EB1901F74C7D57D373A47737D6E23998E35DCEE70983359B4162C7135126E90A807604034D52ADD3530456B66F0DA64453150AFBB67D67D9B359137C2420250C279A1C537AB06952E4823F09372198C253D5B71A7E70A1C48B1DCAC3A85FEAAC35A11E670B2840A57F2A7C77B6A00CC80A282F0A1C8160080C702D619A6B6D68C757306C93A5B21BA8185B1A46C79B03C35880A7B265A3E05B2DB868482FCDBA0367177BBBCAD04F3A50ADEB85DED90BD59DAB
-sk = AB4545850434076342EAE8409FE0590C34955E860267305FCA05C347BB3E53BC714E3134A6E9B338674A9AABB02F021D1A09A190757F03D573C27687F7E35F2D77294D10CDED732218395B344523F1B704B27689DCC286B5C98217F239C159AE5D655436F00517A50C6DC6B7F4F111E7F37A0F319BF6ACC7B0E3345C9367B2A2B8D9D644936220C0A817FBB38CEB3469CD55C661E1C58D06807504443448C4E53204DC59C60A5153494478EB4056C9A85967A42EBBC287AFDA51FDD6B84B285523D41D80A56F7A68A168A4527D902311B18D5E381CFDD578BB7924FE687D3AEA5607906815181171A727E4DBCE1B678762A8B03C2A2BFF1635CA85332AE90F14B880C5EC4E5389B7816AB885C44A8D83C5EF0C4C754C7B6E673D984938D3CA4EB0F5B83B90BEC27172AC85154EF27B91623841E188D76B040F958C38C8A112C05B54103E55A159DE0954F2477E798A573339508B7C2AC3872A623429777BA3179060135C083E2198D1E0AA01967C39C27372A1A36A92BAC3BB13EE3C94B1F0391E2702C50253DD497F16F39BDCB9C68CCAAB6312084884B113E70F38555422767F4E613B2E87AFFC01395FCA37DF0A1AEF74263C1001392732D9D1047CC7C6FB910AE6136C33094526876A113514F2918909532A759617DBE2C97E72176490995DC82B663655DF65324B1996A42150BE41B2A1C90F03B2A6F04174DA1B1CC7FBB024C3C972B9714300C683C28A90F48B01C28607922C3ED25601A609673481B365544B7C36A9550EF20C37005B0E395A268E90CE1A5271E1421B46303B80CBCC81E2894D7569E82C2F5D8C6996C766BC505976628CADD84A3F468C67C209117C8254BBAA1BA584DC2661728A69E959949ED6C9F1B42F01EC8E55614AEB7168CFBB5E16504EB9F585C7789C48E59C17B5975C444BD6E32A6654BCE298A605043BD367400C14B1D8E1A592A034543C04A44C85711AA66C807FB07378FB525600C19D9A4A9A8C920BA7DB0B1D912A45F2B6D518B469E9121D25CF40499196376D3D92827E1B96AE255AFF288037793C7DB07E1D15533C07162AACAE3255C0CC368E2FBA3FEF09540952910EAC0FB2F3AE376AA666FC97A3E122570CCF797C79EC575835E0BE6E808B3CB1B72D8241C3679BF15020B6A63BE65B95A2C9147EB98C6553C71C550E37603E6B73C877C94E7B603A22ECA456C1409D5AA049673D0EA17C123B1835692253FCB589186BAA498F39481C3D0640A4D34931033B30F26EBED6CA9C49BA6FB219D6DC8461937284235A6417CC9C0CA0AD385B04B01C81D5A7B97A34977250E3679AC55C3D76D83B1F7B99DBA039DC179147223B5D6C11FC9109DC062A1E4B7C88C710C449320949BB4405B28EA2C04D48C58AABB46EDAA58E442F3AB6C9810B6D702855F7CA91AF71B0E574BAC1040DBE864DDAA76827874839414CF3418D1702C6F368A10714CB25E208C8A5779F639837A07E348841A11714F41399DA175C49678307D3634D6B9921880FD43CCB8D7842E5F34CE44A4923E7CE6B671C7A989AA748604D147CE7AC25A1533E80AB321B7AACB8D523A3A6298BEB0CFDA435D77714993173D080827FB07B7855769EBA987696AFDF58231F361D61101724795296A2499158C8E1B50E4C900D65C8AE65503932DCA40E058E8192CEC2A997CF12C8A1227567B12A1B21BB31D3198C85C4878C6EA1967668E3952D04B4123CBB9CD8C77F3A7397A9133D99654E6C56E7465D9B98BDBD624C12E36C62B60B6A32C9086A8EEB9B8919706F4573A33C393F74BB51D5609231F1707E152F23F36F6C6830EF28253C8CB81EC5C27ADB02FBDA5302212826F0B88AA4B4D72A509E29CB1BFC8177C019C60598E693BCE999AABC4621123415235208E7869F62AA7B50A51724C13DA2DB59D5BA5302C772F2C1820FB0882EF32F73321C17F40D019CAD39C3B12C57C3519CA0B38366AC4353B133C39262BE6EE47ECF660286F6CA8EB7090418ABA0D9833E22B46B761FA2872FB80972B551809C02775BE07C796636A2C619FC748B90D28E1E702FFB0653E250C8C3759178C39E42411327A81C7E7887B21915A5CC032C37A11382C4D9186221B1C66AFCAE8184559910201C8BAAACEC62BAB984E080433B9465E64A2D987028E9D9090CB2C41753742CD77F0998C672441E83D45F2D06C22899C2136362271B731F6BA3965B32E2517463E627AECA0AE5644BB8602F7FC599ABC120AA111E2E549A276A18D2A92C39502F6F9519CE76C0BCB514E8084C7122A321479338F59ECE08A0ACD30F0AD68F2091855D5980219083398A6C0A63C70D3743678A1C0202A69DC526DDB77E30B779C36AC2575704EAD94DDF1661A38B2624E733F2E2AE18467CE2C3083B75017411390314AB06ABB4D0FB58BFF99DC3949E92994703E85FB6B863AE1C29BDD6656CD75D9BA453AA115A32745F2DC1829881A9F4D5CC2CC053AB79B89D107E6054C69DC93F5AA9C8CA6CC1A7583F2E2739B102378D93990CB8280B21A5D5BA8415C48EC17288044623A9631577C16639922978258CEE0B6C51BBCFE3F70BE07CBAFB7C58111CC7F2F922AA023D5AD01D2D31A57E0469AC428B6FB88A97D957AE22BEB768C3CB7C9F02F583FA2513DB7C580D2986984314E8B346A06501D8972E31AB8EF5B983E9A15E8FFC624D0041FD523570960E09E57D616A06297BB3F9D938F5655628B06C4F6C4FA5F8136F8CC05DFAB7389237EA75AEF46117BF1B67AA978BA622491260128E743F28F95F533B708F3C59230B23FABA96FFB5C239B32B30A65B36FC5A0A76B76F04A60C9C7D5EB78EBE44B736EB56A0812F59D9B5812916246228F2523175242CD1F432F9FB054A8B52D824349DC0756091B2F7C21E2A899362157BF9F631287B90D6C80FB55B1469273F79892435D031B62982C49A1464E2274F815F56F3B6F8C949BE11388DF1151E7077F603AE592623E4259853A2B90159344B041AA29C8AFC5074BEE81959102E0C57A761F1B1AA65B1DCB66A18BBBBE12B2B2942A37D13C77C77B2BDE758EB1901F74C7D57D373A47737D6E23998E35DCEE70983359B4162C7135126E90A807604034D52ADD3530456B66F0DA64453150AFBB67D67D9B359137C2420250C279A1C537AB06952E4823F09372198C253D5B71A7E70A1C48B1DCAC3A85FEAAC35A11E670B2840A57F2A7C77B6A00CC80A282F0A1C8160080C702D619A6B6D68C757306C93A5B21BA8185B1A46C79B03C35880A7B265A3E05B2DB868482FCDBA0367177BBBCAD04F3A50ADEB85DED90BD59DABB8A3B8CF4709204A2FDB19889B0022EA655DFD58FF27E17D530510E1EEF457933FC3D8392CB53F36ED647364A04E37278A0E0A45B720F4A75C580C9920EBA98D
-ct = 25E080415EF5CCB5D8C322634C5DB0F0ED10C73D5A0BAD7B2C5B899D74E6EDEF6B2A8EB9DF8D415BD41DDB01F670B8939D464561ED8C37A2B2217A49D4A0C7B5BC13D4A481FC383BACFC6CB979901098929B9FF7B5ECEB2BC21BCB830B4556C36151A386E2479297066521935A10D3F16222B9246C2885FAEFC2F8597D4AF4F13EBA79C30499435D93420E9F2E46BA2D7C54244A3EB47165ECE9255511DC524D697D13EFEFA8B62B6E61461FEA69830593D894016E83264103A876920663383E13BDADCE37A85D29744751EEEAC229CF89C282A56EE0959E46106E12BD94F4ADDC061442DFF73D7DE2D6AFC2AAE8230A88E53E7E4978B6B897AA6AB040261F9A5BB22F578BC03B0E81D2CE5A05A235EEF3A6177D4064443E20D9603EFC34816E688F515E5A48AF57A98DE730B0F5747D9F3F691F6BBC5F88A7B137E9244EAFBD539F9FB4F2989AE16881DF8036B3ABAE959A2FFF2313EBB7D044EC566A8DDFEFF1114029A30E44ADA4DBFA56CC1EF04774721A507795C10DE58E35F3BB1B1DC4D62095FDE786821BB410EF6AB4972B0A681DDD1A7FE8CA50828DAA7D5D19865644528C2A5A4C475A6B9BD3897E8DCBA0499E6DD75595ABEA0A485F7E41A727353DBD7D45ECB0AA82E39FE03B177710F6180421A465C1930EC9CEF35797E708227BD67451F8810267016EB07116BE1B4327902F538C5512902E6E64364B9AB0392A43892D4396549DB5EFF4EA7DF6754E34125E303311FD6F1CAA7F90D7361F201AF5B4D2632FC7815FE27B93E5B4251A4B1FB4717726E0182EFC9E9A07568871F9552DDD1C986FFB24B88F9EA5E591B07CB8A3E207053D3547950A5DC042B44341F6D178975A9BEDC001451BF7FB6CC4BFAB92972CB5E4217E28A21B8664C6C405C642A6E6400973ECF0F3FA7430936BB58F7D62EAA15F469577CCF957459687ED56713450913641DF199A0747C840FAB4E2B5F7323AE1E736BA0DCE06105327168A457EB1CF4F4B6C5E89D95DE5D9C65A6DF684812D00A22E4890F18EDED894472EF37DC078ACB3BE6997E0E4B34A6D3475056322E3B19930CC5C3482051DD8E9EFB5FE1A288EE3D9CCD181B57D41C7C66BA732707902CE5B9806F63621FD064F387FF413031F04502B482BBFF950BBBE9E854F8E58770A55CCEE324FDBB830FDF4CB47CC579FB49CC092614CB5789239C96D281BF065326B8F58F006BBAB07602C0657A616300286D89C5FDC2CF0D2E4A43152198755AD777C23A6DD8A9A8E64832119D0818CDBFE3CBE8B7EA5E2739E54790E0685203B2CFDF8831E339968B4770EAE40CA9A0723BB1CC9BE0FC4CBCB91A29514418FC04CEE2CD852A222A131927059AB5233FA77E8520211F42BC91FFF9646EA95434A2E867F8C0D4B43FA2E7B72B6C0E2AB72CBEDA1F8538E20FCE37FE6E0B9C4E03A9091A1D7F7B081B2B220BCD0C686729E2CADF8DC00612DF4A8AEA565CAA001EAA4F4309093ECC4FB9FDA290EAFFA313C3796C72F57EABC1CD4FD58E272C9B1471A3806212385A4C4
-ss = 2D26F4DA925E01CAAEAF4A89F5CE81148A000F7A36DFEE74E059A933D973DDBB
-
-count = 65
-generateEntropy = b8bd0493a882e3a49b4e0f6256fb1fea0912562fd9ba26ec3d6c9cc12c8973abd7e4b5d8021c486b9c3114d7cbbeb7cd49eba8a61bc2bcae1f1bef30a1daf76d
-encapEntropyPreHash = bb321ef14d44d8698df879fd52450567657f52a2df8d111185dcd7d4f30a72d4
-pk = 657B941F466659FCC971C1174AA4459551848E7A116B751E5E4022C8F2A4B3152A1B26A3096539C9B0BD6A435EA1E33413AC4D5F401F5DE8570CC11CD4BB9FAC473328D55501702743E2C8D1B97CEDC8AD3D55B67D284158EA8BF1A4A8A17A9DE6D5669E8B9571200B05300CB30BCEC4A58B06F70830C2B32D28992B70427781854456129CBAB53A7C72FF557193D3A221D06177D002095BC04E993B8606245416C3B998B01716AF3B43A535F7A6BEA71270B34EC808CA00E9453AE660B732963BA634F14378B1691A90E3708125CDE31BAE3D10451A5643F526CB790A8D6E091A725681FB539E9B05BDA7B04C48A31B39DA6E39E6BE624663B6284DE9F958C50149CE4090E6A486B68511AE90A0F093297BF090DB3C81D34400A40CBE11D74271E23BBB7A49EA875EA7F7CC25516A899198362ACC52C8A8CA14BEE12BBCEA9A6E3509B6887A3D1D4C3B2B4314C4C44F44C96F48B29A8E7B85339037ACF131F2692B7E7A49282237C8F37267C835C24883D1A189D4DCCB7C6BB1FE622FC31301A6D3612A448084E0A210449B7E15A4FD84A9A538B2D5844DC170C911FC1282BC513E8C18C469A01A548D1CE4853128A03A8B1D369B353C3003B0A29D210AB6AF23ACD010AE3671493C774EFAD8B3746180746401D0E5862A3265E7969F247C954955B4AFC13FC420143C10263EB1C6DABBBF5A8857A7F3BEE7658C8399503C21A9A38BA554132344E214CD2036C2B30D0770CC5DD87ED9B246E7F955EA926965748CB9E58351A938F7E4AC249CA5C970CFDE48C0ADE051BA873D36A581E0FC50D9583109A79549FC5B32BA432444046AC0A66F3C64AE1498F43B1B36D8082442B5AAA7BBCFF2C4CDA8C0C4D2C62CF9135A75709CEB5B82BA4EF5716C4986A36BD7B4AD5C3A505869FD34AEC2D7CABA492F4BC30D232382B2651D5923242BB50DF87092ACE5566BC5A18FB2925CAB467B641DF7B5B91142318D120456245F2F0887FF13516D23216637393C469CE1F776CF2426C6577844CB3D4E0A92ABA85FFB59979A7C33EAF51EA2BAC9862160BF8A85553A3D4EDC05DA102106F632C91B8D1DF2A9B2734185283941EBCDFD788107B307738786D6C0A0E7D4957DFB17488C5D6CC11B83E3504EF2923034A06270563E18A18BB29F48C36A64C132AA626DCFC5A615E4416DF76746673E500186A117A27C5007A4B04867213C33739E27058ADB23C0DE35CE6158C99E59B88B147E2AC05F09F7C0A414C3240ABAF65C24CFDB6857ECA66BFC58E52472861BAB1E03CE70D2115480B443A9BF799379AF9AC978D0072F75BC7923816A189DA5974ED948B8A709A8191CC9BE60AC2A383A7E27CC62543A2A0CA9EA6897D284AE79B595D0893514F75DB35C9254B7AC47260785C1B86A98A5DD733D3DC2B947D148F698C5A117821847604151068412268169C86D50BE92D77683386025704575177AAC0B9D3D3196A610985E860E2F799F480B1331BA346DB0C379CB1833223836D88FD4E11DBF2985825C78330658B9A189233BC76B172127BC7A98E6C644D28DA7B0857F67157AE2C27659297C32A7EB653697A295097A32AC235A11887388265ECB3B46A75C865C239395300D0F8152CBCBA77B4D655C9F1EA4B448FBE32C4996FC298D26CAE25D276BCF6E66BA65E3E97791
-sk = D7E3338B3CA1D6118B7485BF85AB9E8F6C36E158B67D2C3530B0A544B8AFAA0A8604710987429D0D1B1EAABA8F06422E992C475DC4CF909061EFE673A3547575E8B00BA47D5A158C22E6B2C280B3152165A5A01A43D801E96791B6D99C92C0B0602C94C0B13F2672146A7044E4372C5FA8843FA7974692B0F292AF9FC3B5793092C705421E6AA39B7B3EEC76694F5555985A94879ABF737949BC33CFD1F8563565B2F345B6B3389FE061509BE046B3A048A73599AC20466F0707E9B46045352F94507659BA428CC6994EE3375B07D09AD3BE1872C15692C7394626CFC01BF5435D7922BF9199533A22CC4FF021A97C571DB311485B36E2A3344EB880C67819AEA18B09919FBC57CBC11CB228F8C24F38A445C512245C3A5CBC65D20269EE849BC268899981B9F334704499B60A891139D9470A1A147F38470752C4EAEC5B14D51817FCCA22E7BC1C585CD2189131960A9E9284AC7940B2949707EC7A67F22DB280775D8163394A3A9557BD48F50C26F177FFE83030A3455DE1196A763F8AF156DF73CE3BD07AC70447573A79DD04A59E8B40E39C6FEA736E14F1B1B67B5CF556C3ADB29FACFCA4E6D8B759D37737863DA2A7AC4A645A8F202AD61C17068385C21415F7E14146D896020B89CC73AAD60135D5A3B94879184E086F1066A9F56041B6029D1F538FB5B18A7A741E04E2C158B69927A1A7708BCC411988C0C315D0D1BC3A31B0CD473FCD3ABACB1BB3EB23224379B5350081EFCB8C45584D3B845E2500420453718AD83194130983A355B1388BF246B9FE7400443C52629812FC1125C3800C3F824C0FF95BC24A2E8B306D5E3278FFFC585843BBFCD06D2EC3482295717A5111AA7B6475040083106A01491CF981197EEB77D9B01C2BE476F07C59CBEB5C4D19A2000D61546A9CC149A149BA8E57CB0ECB3105D94715C7B1BA7800785EDBA95A7352583354B93CBEF98C78BFA946A7431813EC36AC45488B170859C098B7C6813CAB2FFB519814C3A9DE3C254ED7A144FB6D15B183CB48A9021972233382FC8C388511ADD6A86837801F4BEA0DF0103B3A152648BBCDA68499352691BE0C3E5218A7C22C8CE49790AF1BCD4F6717EAA18CB489B446D24F5CE239C79A6E34215E87BCB8461B5B509C895EC22F94C17C3BCC5904D968C469B200D3322B423761E3749556476D925A915971A62A5A330ACBD106AD77DA7897815CFA31CD44310D44915D762164B6170B2916B5427C694FF3340FB16B73500E92833ECC35BB25DB6E652701D85AB215B366A173604C2797C2A9C420E069E7E4B3D1120DBD1C196D105211134478D23CC4428F8F56182FF3A51C7B84F01A08BA157E86B9374FB7C2E7ECA3D4B65F4A73472E38C6F7C06883C99C4CE934F9B04436D250EF262C42D4862B90C11F4924087469210A25CF4CB29D139D85D9C904004CB246348C60736D707B2B9B111C91ACD3937D9E8934032746AA5025BCEC8BF637936448A0DD67A27DB2A74B60BBA82BCC87D73D4A9033C427A85883613EDA43829C7CA3C7A8F24364633610D8199A5EC8038D0B6686ABBD47692ADA94282C40799ED4BF8ECB65EE7C8B2047C41EB255318C139B89CE909831FE3024BAC10B4110CA34F1BD657B941F466659FCC971C1174AA4459551848E7A116B751E5E4022C8F2A4B3152A1B26A3096539C9B0BD6A435EA1E33413AC4D5F401F5DE8570CC11CD4BB9FAC473328D55501702743E2C8D1B97CEDC8AD3D55B67D284158EA8BF1A4A8A17A9DE6D5669E8B9571200B05300CB30BCEC4A58B06F70830C2B32D28992B70427781854456129CBAB53A7C72FF557193D3A221D06177D002095BC04E993B8606245416C3B998B01716AF3B43A535F7A6BEA71270B34EC808CA00E9453AE660B732963BA634F14378B1691A90E3708125CDE31BAE3D10451A5643F526CB790A8D6E091A725681FB539E9B05BDA7B04C48A31B39DA6E39E6BE624663B6284DE9F958C50149CE4090E6A486B68511AE90A0F093297BF090DB3C81D34400A40CBE11D74271E23BBB7A49EA875EA7F7CC25516A899198362ACC52C8A8CA14BEE12BBCEA9A6E3509B6887A3D1D4C3B2B4314C4C44F44C96F48B29A8E7B85339037ACF131F2692B7E7A49282237C8F37267C835C24883D1A189D4DCCB7C6BB1FE622FC31301A6D3612A448084E0A210449B7E15A4FD84A9A538B2D5844DC170C911FC1282BC513E8C18C469A01A548D1CE4853128A03A8B1D369B353C3003B0A29D210AB6AF23ACD010AE3671493C774EFAD8B3746180746401D0E5862A3265E7969F247C954955B4AFC13FC420143C10263EB1C6DABBBF5A8857A7F3BEE7658C8399503C21A9A38BA554132344E214CD2036C2B30D0770CC5DD87ED9B246E7F955EA926965748CB9E58351A938F7E4AC249CA5C970CFDE48C0ADE051BA873D36A581E0FC50D9583109A79549FC5B32BA432444046AC0A66F3C64AE1498F43B1B36D8082442B5AAA7BBCFF2C4CDA8C0C4D2C62CF9135A75709CEB5B82BA4EF5716C4986A36BD7B4AD5C3A505869FD34AEC2D7CABA492F4BC30D232382B2651D5923242BB50DF87092ACE5566BC5A18FB2925CAB467B641DF7B5B91142318D120456245F2F0887FF13516D23216637393C469CE1F776CF2426C6577844CB3D4E0A92ABA85FFB59979A7C33EAF51EA2BAC9862160BF8A85553A3D4EDC05DA102106F632C91B8D1DF2A9B2734185283941EBCDFD788107B307738786D6C0A0E7D4957DFB17488C5D6CC11B83E3504EF2923034A06270563E18A18BB29F48C36A64C132AA626DCFC5A615E4416DF76746673E500186A117A27C5007A4B04867213C33739E27058ADB23C0DE35CE6158C99E59B88B147E2AC05F09F7C0A414C3240ABAF65C24CFDB6857ECA66BFC58E52472861BAB1E03CE70D2115480B443A9BF799379AF9AC978D0072F75BC7923816A189DA5974ED948B8A709A8191CC9BE60AC2A383A7E27CC62543A2A0CA9EA6897D284AE79B595D0893514F75DB35C9254B7AC47260785C1B86A98A5DD733D3DC2B947D148F698C5A117821847604151068412268169C86D50BE92D77683386025704575177AAC0B9D3D3196A610985E860E2F799F480B1331BA346DB0C379CB1833223836D88FD4E11DBF2985825C78330658B9A189233BC76B172127BC7A98E6C644D28DA7B0857F67157AE2C27659297C32A7EB653697A295097A32AC235A11887388265ECB3B46A75C865C239395300D0F8152CBCBA77B4D655C9F1EA4B448FBE32C4996FC298D26CAE25D276BCF6E66BA65E3E9779146FE6C37136273736CCB11DF5B6D55DEBBC087DE802404B72A003C5E8C809719D7E4B5D8021C486B9C3114D7CBBEB7CD49EBA8A61BC2BCAE1F1BEF30A1DAF76D
-ct = 1D597DA26AFA055E20E20CB3DCCC730B73075CC9B0C01499A4856D0218E744654023B54734E6428408884C182AD6AF6B2FD3CA2F245037F7F540706C5EF18CC520FFBD5CEA84D308A4BBD9999EFE0B95B1F599A141C383DF89D2BEB33077CABB7B10F332526B1AC199576799444B86377AED9A18D6CE0C94B157DB14DF2BBB515464A622E32661CADBC9E6ECFA9733635F3847F2363E58F7E994563375D4E4C0B3174A84AC0CD4408041C4A11563AC5195C1DA47C86D7B88E7323B5ED66D3850A04A348C46BBC627F497B49E3E1D7BD8E23162AD8C232F750D3FBF55C267DB2D9FDF0854972E8EAA6898BCB21CEDEEC79B6BCF494FAE1D6B174779C3F70C27B64E196EC8E8A7C861CF75A5C62AA8A71A7677B995F16A8727BD5E1BC0FB2638BCC864CB1AFA8F793462ED0AA445592E1142CA2FED5792CFCAB5F6FF8E7B7A335043AF926C7C0175C92899EC0E3D2B5BB945334A4379A3533FA1607F6406869191B2F4472F9742AAA9C66BF9A843AA4DDD8F32F4113412CAFFE113DD80C55ADA924D5EF5F5D8E2A7DF5C764F53062730764368589B76B5C6399A8674AF24C02337EEE30E1FB44C8C9AA85F72BF07A61246043B21032FBA0E675A1D1B0C4284228E1EA990FF7803A1992C53D0BD85FD3A4D753DC1F9E1B873D64D5898B78C7DA9F72969D48A433F5AB9766915BD24E9BA07170338EE670B77F68C204A68AF32E3B6DE3580A973872BC756B5EC976A393966AA452F5757745660A15E4E2D4D3E549E99F309E18774CD74F73D5D4572C3A0C49FAFCE2342F1BDAC88D35D22E8663E27470F5691C150344508214F0B0F9F57755AFC52F5590615C64C06D4D611F6920CE7D0F51178DBBC906D71947C1DBBE1D98A7433860D3D21C2E83C4C3EFED6A738CFB48304746E5A7CB7E32CDB8AF44AB7F09E98EBD18B8B4606EFA2C646E37C6123B4FBB37E3DB5C3AAF550A536B1B86B47AB17865E6AF273628F3881937043A56FE323B5368B021F3723ACA9A3937EBA3828ADFB9873A3F2D027C9264B56FDF4CB608F5451EBA1FB1EE4734FB5B1D4ACAAF29ADC1F376D23E45D188D4086F4DC4942531DB72E586AD70350B04036D63EAFE4234FE90DBD68D83E91CBB0F43CD87A8BD3CD5E6A6C81A0706CE2EDB2C9C00ECE4F86D9B82157B4E82BE4C6D655F2BD1376DE64410D0D77CDBE737D8DF1C3751B0B33D1503B1354E70B5A6B3BF5E21435FC575FDDC26F9B261B19DA5CD045FE041FC6C35EA7A4C1C24307D2F4DF6DD6C5D4B211F0C5A98093F7E05815496F0B3B7A80E0079F0E60C5393A6E9079145137B2E89093EA7DF4336B40DE06CFEE5FDEEF322770B114729342B1A24892B0C759147B08275FFA24B5BCF679A5B404B292C818DA88631919A403110959A560D81AAAB2BEBC33F796E2F179CA5F25D3EA7C7DE3A310ACED8DCAB766E02E22AE9130D963DBB3EED2D0316D26F25AF53FF23974CAFCD2543B97F8B13ADF08FFB687926A51403F811BF3606C1C73ECE86E0A724B9A15325278D6F2C6481EDE68FB
-ss = 5012217B85A1E5DBA62A2476D7A441411D8ECDDBE2D3A291F658B7DC1D1197E9
-
-count = 66
-generateEntropy = c0407e41ddf48d333978b89bcf2db01e4613425b456249e76a6f25b8a2827bf5b2dca81e3f5f748d23c9d356a2209f6b2d60247b2e45c9808de497f64f124643
-encapEntropyPreHash = 210a423dadd899b810f011794b79aa7f860823ac1962370e791287d3a1afa384
-pk = EB9B77F8C16DCE72611902A8CCB81E8CD4C5A2FB1D8FC30CE226BB45779F41073FF3EC0362BA152102CF45D3A95874A551C14C8A621436E248FFBBC4CA3B4033D50EFA392DBAD9C339745803F845736C30BF309546229EF52788AB223758C03491F62913FB4CA4307DC6B4C7FD9503A701AD21671387CB2CBC728ECFF4641E312779C7034CE720554A948A021751D4628890CA7367611D4B9F269C5CCB2381F1F6A01B0634D9C5C954FBB934E4144922CCFA2035892C4CC2A8457300946ABA4FFE77868D34C7A90507BE43748A366C49D0A927E66610A08CD0152A2C1BADA92A05694B6E3D2610ACD4579D5634FD2675F2101290E2BA1855252B57A438B50FCB854EA7B6A89B109EA9857C23AA38333428B94CA5A524977D72077B56978328C18980382EBC967DD37E6136360A958D5F00C3B9996DE3B97B6468B9F98C3C50F37A9E73AC8E8364288347D9B018D437B3B065C120D26E9033078B5838DFC7CE68F244B32C5B4AC04DEF068F58FA733E99A418176575EC2BA0F78D4C402D67176DB5717023B57F8D26C636A11F49B926D20B277D2613941C3E786B1A9A3C1135993BCE22A1DE16434A5902C0F101993B65777399828BA52330A2F356203521A3C59B6007C3AA41D198A8232D27C05F8E0280C9076D54D5AEBDFBC95C7C06BCE24507892641F90D2B774A2D98764C42BCF009799432B706DA59BD84CDE4892427C0586929C99850C7D769AD9A221C85A4062A62B2A1847454554224C4CC47898574FA66D147C4AEDC59FF612F49285DB54170508C89E6787A8CE6515CEC673D4545970CA8EC486802933E319800FBE46D5CC14C8363656DAC0600D895FE383FCBC3614FE334CAC0A94C185B73DB30CB5A56A8D04CB271B13859862F164F980625D78AC35ED120605CBD69E6410EB05168819440816EEBF8CC9AD153CDA5BC2EFBB00A7563A55856711231CD12873A9A56996C174AE43B5C172A1445BB40CB3DEEF9051035B33214A61E26852EF3BCB3FB319E1B4D6BD832D6B9BB54B6021D180881D59D2458564ACBA148B0AC36CB501CC8242919064EE24343F26A87A0696000533A20943445C72B9260B4C8A46A1C921C582600D978C5370B400B2412F73541A13BA0349E66FA4025735CAB6402AAC51E08A019B48115C49C665F415244FA91C208C6B1F2BB02BC18C47A5AEE366EDBE3BAE1E41A8B405DDEAA22A2FB254A6B70DC5A16C0217E4DFB933A127039B788E6C035DF8993FF86923500BA466A81D34A0ADA271DA4262F33123A1B81A13621211845A167449D93370BD95A89725A56A8452B510A7FD2642AF41A4A7856ABD9688DD7C85433A868103679A8EB2BDFAA0CB52CC141267E91E2C1E57162C6B4897C9004A3D375C1C8BB87C5AE2CC80C2A107E0F904E5BF8065AC96C9152AEB07322FA181A83A9CBA0224C9FAA0F06CB67E2787EBA832D3F53AC60B7B014D28945361759689C3EC65F8B885EDA081443A2AFD2A735B1C57C201AA4D273B1302267E5A63ABEFBCAE8E1B2D3883439E2BE2436382EB9BD62146DE0E446B6E2BAF8300575091DB145A646C733BF352989938FDD8003218A607739C60DA6758BF448BF18A22630B08AC40635382E3BF86D16625C45E12EBEEF4308B229C948D425016D674119C0AADEFEB21338BA6CEDBF7DF723
-sk = D338B8576C1FD9168551A681F9C590095B6B8D8474F571226A4B68EE81A83738BB964356EDB663D925960388C92896029A201EC7F046CDE497E3384F613A444634AA3C41656C6031D5233720241603612BEC1032AFA7B3D41242CE374C8B118CF6219FB5E645002530781CB4660403F88287D115BAAA07CE95496A7232862282A653367FBBCA1E337155A3C8905E368C1974418E735F93B6965FEC11CE7B43D81710D727A4C4B434003B9110D013568B7BBFB341212543031C862FAC505944B86394554772047B2A864A6675ED984583269362759CBB464E7E248A48C3554B8054ED9342AEDC8E221439F812697B691BD5C89B7FB11EC716BFF96C97DD73C45B00980BC6B1F69117C2329386518058E97B26626D98196025724BAF0C5729109399E035ACE9A630CB6D7CA9CBC16AB560DA5C01E37601BC0DCA7A3AF891B80418C0056145C7AC8C176605411A39BFE843CAFB4FA61463B20A504E984308F2B82CA7081A97951D0961B2664E2D7B41DF902571D02C1FE24EC0EA998609248CF51CF2F81D96A983DBD29BB37B9A7D559C72FC0BAAE894583A842FCAC92D910C7D682DDE70A4A7B26E3259B290A182392CBE36B68D2E321708E9C00D8C06DCA5043C1A461E76438B7801E8FACA17045B272B16999471F8FB42F53A43294124C3B2B7F7A13EEE8B195A01871909A70E41A0CEDB37F3F733EE259F40C1CD12C79DAF90788D78CEAAAB9E1D20B7FF8800A17AC28953A4E90B257D099DA195B6701A695195BC730389A84A499AB784762631935A5A974398C6988A59822BC6382B9CDC6072F0A6CF65C9DFF2309D1A433AC52E6CBAB472E788F76558D57986BAC5C79B921F06E509DB18C70EE88AF044B527E221E5A5105A19610F059FBF6009B985190AC81640607CC4FB69D4892B5D9AC12BAC26765AAD5C874FE3080BEFF77961CB9E747A8E4B4ACAF3F3B81D51A4A755AE8EF2994E8A722DCB5B8014C1CCDC6A79046664C3B75C02B91E0B4C5C250B8EDA5D67E9A0984A6052053D22266B2413B98D841E8AA686F4E0AEB8D5B2ED2C8BBDDB0374D0AD8CD47A0E6945F0AC352307AC0DB224EBA29BC09397F05B1308828CD42B85C556BF0A938959FA7CDE083D3D0163C21B016133145AE0C47EF73604999E76F9AD19432F82E762BA8174F89A23D09333F7E677F33BC15BF996AE6999ADA8747BB0C454412C2B651D2A90382937427EA555B3856D0250AB1E3663B8D78F3D96CF9EB90B5A501129715DF5DB38086076C4B351305A9718903ABF12609FB1BC8A59162E2152F8E0C62241CA5DEB5260D71AE162B7EA827A342584576B00DC674A5BE149C7744D7FF43A5B04A3EBD38C110630FF656F2FF042EB603403D14F18EB17CF675C995C2790E936CF8B60E758484BC04314E50105B28346829077AAACA72ACB46D331E9127B17DCAE5E639D2B33B9F3CCA468F731BF0B332BA41D196AB77B3C436702078730369CF59144540EA08B5025A4C880C1530F40A852E35F96519C91EAA680D90D25A4256FEB1878B48E39143CE43378EB3335D3E03F2A358782E0B54AB56860148DC0FA5CFD149CF26A7260639A347AA72B977B6F38BF29E1472C26B4D7F80E4BB3192DE06EC05A6AEB9B77F8C16DCE72611902A8CCB81E8CD4C5A2FB1D8FC30CE226BB45779F41073FF3EC0362BA152102CF45D3A95874A551C14C8A621436E248FFBBC4CA3B4033D50EFA392DBAD9C339745803F845736C30BF309546229EF52788AB223758C03491F62913FB4CA4307DC6B4C7FD9503A701AD21671387CB2CBC728ECFF4641E312779C7034CE720554A948A021751D4628890CA7367611D4B9F269C5CCB2381F1F6A01B0634D9C5C954FBB934E4144922CCFA2035892C4CC2A8457300946ABA4FFE77868D34C7A90507BE43748A366C49D0A927E66610A08CD0152A2C1BADA92A05694B6E3D2610ACD4579D5634FD2675F2101290E2BA1855252B57A438B50FCB854EA7B6A89B109EA9857C23AA38333428B94CA5A524977D72077B56978328C18980382EBC967DD37E6136360A958D5F00C3B9996DE3B97B6468B9F98C3C50F37A9E73AC8E8364288347D9B018D437B3B065C120D26E9033078B5838DFC7CE68F244B32C5B4AC04DEF068F58FA733E99A418176575EC2BA0F78D4C402D67176DB5717023B57F8D26C636A11F49B926D20B277D2613941C3E786B1A9A3C1135993BCE22A1DE16434A5902C0F101993B65777399828BA52330A2F356203521A3C59B6007C3AA41D198A8232D27C05F8E0280C9076D54D5AEBDFBC95C7C06BCE24507892641F90D2B774A2D98764C42BCF009799432B706DA59BD84CDE4892427C0586929C99850C7D769AD9A221C85A4062A62B2A1847454554224C4CC47898574FA66D147C4AEDC59FF612F49285DB54170508C89E6787A8CE6515CEC673D4545970CA8EC486802933E319800FBE46D5CC14C8363656DAC0600D895FE383FCBC3614FE334CAC0A94C185B73DB30CB5A56A8D04CB271B13859862F164F980625D78AC35ED120605CBD69E6410EB05168819440816EEBF8CC9AD153CDA5BC2EFBB00A7563A55856711231CD12873A9A56996C174AE43B5C172A1445BB40CB3DEEF9051035B33214A61E26852EF3BCB3FB319E1B4D6BD832D6B9BB54B6021D180881D59D2458564ACBA148B0AC36CB501CC8242919064EE24343F26A87A0696000533A20943445C72B9260B4C8A46A1C921C582600D978C5370B400B2412F73541A13BA0349E66FA4025735CAB6402AAC51E08A019B48115C49C665F415244FA91C208C6B1F2BB02BC18C47A5AEE366EDBE3BAE1E41A8B405DDEAA22A2FB254A6B70DC5A16C0217E4DFB933A127039B788E6C035DF8993FF86923500BA466A81D34A0ADA271DA4262F33123A1B81A13621211845A167449D93370BD95A89725A56A8452B510A7FD2642AF41A4A7856ABD9688DD7C85433A868103679A8EB2BDFAA0CB52CC141267E91E2C1E57162C6B4897C9004A3D375C1C8BB87C5AE2CC80C2A107E0F904E5BF8065AC96C9152AEB07322FA181A83A9CBA0224C9FAA0F06CB67E2787EBA832D3F53AC60B7B014D28945361759689C3EC65F8B885EDA081443A2AFD2A735B1C57C201AA4D273B1302267E5A63ABEFBCAE8E1B2D3883439E2BE2436382EB9BD62146DE0E446B6E2BAF8300575091DB145A646C733BF352989938FDD8003218A607739C60DA6758BF448BF18A22630B08AC40635382E3BF86D16625C45E12EBEEF4308B229C948D425016D674119C0AADEFEB21338BA6CEDBF7DF723A074ED1F76E97D68434BA4AF2AF0E549204222679E9E643580C35AF3CDD247CEB2DCA81E3F5F748D23C9D356A2209F6B2D60247B2E45C9808DE497F64F124643
-ct = 62A20A2BA68C9FBC4E9AB487FC36DE9C902FB6E2B9D42A040328B8798E9C8115A0C4CF5F39B0238FE74442936D0891172D6B97C219B4AAA3C628AFE98C56A33070859D5BCA5AD6338CF9491FE2DBBE4F2993F773D5A19C9CC70CE7364BBCAC0CCBD1723B4234265F4C643E425411F3665B7A2047E1C8E07C28B8CBC548BC4740903DFC6A7263B6800DF39DF6519720A9D1D0F7C9B239EEC124FF99F5CAAB64715E595CA1BA9F6A81583F4825FF9E32711AD3F741108A6888905B79DD7342B903488CBCCDBAA690ABC5E49A2534C8CA791B729E116C4304E55BB636C0331BC9C1520A1667356C4698D7D5CD8DB4B8C0CCCCF770405C056FA881558A2E6E1932793252A3CB7C1AE07E7135597E0B8BB173E7544CDF583EE8B33E24756EAE89628AD34C31C5C66590FD2D037512D309A2DE438FA13098A64AA0955A4F5460A8F19E3F1DA1E8EB7BF3B56F3E685E685906818F030B7FBDAA9EAD26F2AD8EDAE76006835BE6A5F07219451ADB37D8ADB356C4B3FD07DDA85579369071FDD5214EBE2CCE89819C316B0F43071367C6EB871947DAB8A2FCD14E656DC27F7A9E8E2596E6479440348A661E31F5A1AFF7347CD890DC3B9728762375E562788BE050748E6E00343E88FA11B165FFFBAB52D2C9004F63526B818DD4128AB69797A661731AB37534E0FE4306F865A353FAFD10B18A7E9438B41D9A9105A52292AB0488F2417C2B2D9A0B74D688F2BA3AB686CF4B08DCEC84C603AD326302684E2768AAFBD1BD7D2FDA5AE14664E287A1F55734A761BC363B91E31F5D5430992F4A6A377930623329FF9169A03736DFD875623A034D7BD4178CD01DC84F6384D6D001BFD22A543E1E9DFC2AC0AAB237FCF8DC7D4D7B3DCA4C00EBB191DD5C24B64B7730F7F4865E8DBD9739C8A374FBCA4DF0A99E8BF3EB0B7ABFD123CDA4DB5994AF01F3FC416A860C3F012C2BC6038D8AC9186ACC89E61F9B820F226CC26B5EBFC6DA09FA5141A1C8B2C2BA3C9C7F8975E73E825155B70FAB089103BFE2D3DEA873FB566E7C70E78CDDA058FC8EE87A58C98986957F5B5C6D25E33C856CE0E5A79F4A9592E223998C34B8459562D0712B7762699A382B470BAA29B4A7186F89F603F3AC17DF82BC52FA30D533DB99E1884B5D58DB45F0B5BE099DF8F27B7CFF57DD5F1F38F58345B43268A24D2B97F8F05334D0DCA0FB01F6F0E271AE002657887A7BC26A140D8761765909253D625CF8D5C3B16F27A9D055E5E4A055DB9E0F5817B9F64B7122D14EB54D3B2881F70D89C07D5D3150F8273731B245A99689B2FD31D089B3D7925645732C890BCF6058EE829A7DB67C34D8B6E0CBFCEDD73FDC7B83A038B5A044C6D9FE947C2608A9200EB21438BF942E66E0E3786ADF6B624FEA3F86185D84C0BAC24FDFB8956FCE2DC60E62721F89F25385031CC0948247E5EE3E6DD849474F4128409363C99BF4035CC43976B9B0EAF70E464833E99701D6708502037E5967490CF5D94F05E62844A329A36F819EB4ED5F93769C99EA65B57CF7F542E36B
-ss = 0DCECAC51C5261E34023D2E04146CCEA10A0B39AE7EDC50736127184FECFC8D8
-
-count = 67
-generateEntropy = 334382d39164d1989696a2ff77b25a28af8bead9883b5365eb6fcca7c1781cc9aba5068af837be962f439f233593d193ce5e08f7d66efb3389885927b89d2523
-encapEntropyPreHash = bc856afe24213e3d14c3d6f9b89223bbcfb2c890722d770fa3492c1e46d1c302
-pk = 9BD11C902A159F41CB5395BE189B1B7E98CC23658DCCC7BF9A843A77B2A6BFA27BC941B04F391950D998C607A59B49330811200B38B243060B55E381C078100DA84975091F3A0ACB06F22AE3FB1B7D756D36F54200A367C109B13CF40F3671231D5B0CE9E5908776768767209F4726C54277D0F8B0E05BB4CD50BB5547A01051C89ABC4A352745316C8D85A3187D68382EF05DC96294446972F4C76C7B9B91A4BABE06FC634E76AE4B778F939C308F22B8C816BC3FD6B48E168F5DFBC19FD8CB7E4686BF2325CB060638C723364B27C8E3123FE26CF9862F247CC31C844AE77754206B03B497BB3283CC7E38664B23771F709E1D308CFAF5086F25ACBD04CBD9F1612ACC2712D129C9C195BC024CB057B0766AAE7B533E60F04D947947F920470BC37E5EB4AC4FA1C48066877B4456D4EA2A5EE089DE38A7FC7573FAE5480BEA823727132651A85D873378CB97D6F7BE1250A94621ABF5EABF0114952665CD2A5005AF338B36D19F6E4C8F77E2CFB6F24D3CB7A909315A026B5AAD50A9CD4BAF3308059A91323B1C226FFC76B3565CD9386592476B76057E3477C8B7CBB201CA91546A2354B59328D411A724CBD8B3689EFA335D879996FB0D1D2244EDB361BE4B2489E84086F4A995F20FFA9404082C4E66061D3EF668FC155BCE04916C92B8FA46B77A4A9FA82C8C0CA5A5A5245883D25FDED230E74B22394169464BC33FD51FB7F2AA9214B1ED546DCFD00AD554AEC80882EC170C6EC44794204170D738EF9341D6034920A7AEC3B68FAC00527B2812D88969C6207F9AA122464A4D76320EAD6271D2836E574155310A756CD4249FA7474B301CA978A0653935B7740A16C50DF1EB678C1BC3EB451CF6FA35BEB903CD89CDE0AA58A43BCE9CF591286792FB3B5E658B5A32196EA24A4252B093D2AB40884C39A4ABCBD19B108B81172E18A84A288AAC2982D113454335423148168BB6B9D97494179BBA1EC8760BE59D06251B94B4BAAF82A6481C4A8F33B0FC3164635452E6497F992308688352CBF44537C618000536F9C41A64361EE162236F9227219B8B84A3984C649EA82211207C974F6C7575027AEEF57E496A58CE2719096A58E2E31E82844F4D674A4CD9CFCADA79AFB0C63E634D2514BA4D8604CCC42B2EEB64691AAF23727C93C4ABE1423C27B3B7ABF0B649334760056E591C32FE812A753723F7C93EF5524C8E0267DB177E6E55620715688CD0AC70B2A90E133CAEC86945BC74D7EA1CB88479A37B45EAE4993BB7048E5316BF66B9715591148C9A20A35412C2404BB62C512B3800B9AE104453D95ACFFE000D3AE85B96D8092532796A03039BA2154F84AFA4A402ACB673B8799441BC505E836C3B558E1FE2057FA79153E1630D72AFD96AA4FE9C0ED4822AB33A559719B81D274EF0A2773E405761A036521278DF5AB3617CBD89D7543CFC7C6AD373B2D0B781DC78DD3B2AFA34B6565979231681FFFB8C62843DCD11686EA59406E23CDF96AED95554E47027C5B6976F5515BC40B0E3A31C556219F89B73C0871E1FF552CA04C33DAA4A363794CC7C0E05249B53D20460EAA8AD217787C8C9423A7EB71058B5A8081B82454DC91F77F8608D60CAFF30A7C42424542A1746F0F10FEB3F0FA52EAAD4F2D4C36E59CA0A5389566FAD53898992A17BBE0A0F
-sk = 9BFC3A71FA83A4070DB5064ADA8410A770845E818C49B91E09A251E1925EDB226EE8AB153F94B2417560D88959113A6BBC854B0065748E6A7DB90977ADA0216F3C41CFF70E5202B306CC22FF8A138C360D75B9CB1BBA849C5BCC8C9B55E80647E513C9E3E15F66A144F013822DA24266765E3F1125F435BDA4C46EF57430EAE331E1D54C91960EEB363CA25387D0D441ABB930E4A7C329191C5FF7A87996A4B1AA74162611E67B303E284C7098A65069356B55304B11B8BBA66C5829647493C09BF62166017977A988333092EFE98D9C13A2BCE53F8EA2C81A0099B7D5C2B11704971366A5565CC14610DF796C604700680226CB165E9ACAA6AB507A923B4D472A4B6C9424E7F5A622F87F4F8A1083B4755067A93C285CC0748D241C7051971128CC5AF4DB5C1F7C144F98B6BF9703F5338628CA22DF4B84D10312EDDA9DF71442464A24491A62687928C22455DCC23ECA964E9248543520790D813924CB58A0C156AAFBCF63906EC5FA891936C7E16B5FAFD98026D64EA2012BD75B6C5F376EEB74AE9B29CFF7041C650B91A2B852C021562BA33B66EBACF787BE40810F22AA43F4174571C77710F775D1719968A5523780B613262F94BC36B611B63F460DC6E02CC588AF99F164302276B0386E697469C55928C0E62438C25AF90577DE0883CF45819262905ED30D9A1A7918B82F9B4A28CA5B8DD1D9AD4326ADC7BA69C087765CC6511668CC0BE83D510245F8834E890662E06774F389C0C623BE3212AAE5ACCEDB101C43463B68889EA9A2C21AA0ACB5329FF80A336F8914FBC602E2B9AE452647777651CCC4BEF70AC06423B66EC5982C861AD9723DFBC834CA6A6433174C1D6C1AB9569265A96AB5D48495D72122763B3A7275B297713F1A729BDC48329B64FFF9C45955C6091375D4D77FBAC540DACB140666610EC7A15FF18BC741AA69425508D5CF682BAFB6D3C9DFE02D80349597F56FBEBB7EC8031FE71B6D6C065C4E6B5E5D17ABF3B412DED81EFCC8B6B1935FB37B467A5CC61F318AED20678800726509BAA73BBA244030500050D4B23E4AD71349CB0877566AD100BA77F8B409BC8F0EF8CFBCFA3CD1BAA1935C9ABCA798FF6965EC7B53141B6709597BC4F9983766403ED80DF4095D59AB482FAB7FCA432EF5E76AFFC77F74F4CDA522A0085A4917D04167A00B09863850D6CAA0621C2D473DE0763B7D3168B6147BDB009EB260901FA82013C8C0A3F6C39DE3CC49A773D08B357EF932077B5BAB86391239B3C366C43010AD15EA2EB1E05267029E5AD8139728A907B98761B65DD6DAB895363159B48875FB6AA80882256A04460B2977280688745C5914C089B37BFC949A8F9864AFEC2E4DC13F6092070EB561D09B530EBA2CCD66B87B0986ADEA1933448066521E28AC2ED9C57EDE492799B401CDBA8377D593DAFC1A0D233004E25877242C30070779D8BC5BB488DD3988004B5A8554861B560EBAA5BFFF7C89DED193EA077F421C216996C1445B165B912901B217315636A168C0216AC026FBBD4239858837B02DAB5A39D1BE6B072468A264661C5E34F42380C66526377C990092434BCB551A744227445C5108FCFC3CB4526D0B711DBD4539CEA05A08A78FBA723F9BD11C902A159F41CB5395BE189B1B7E98CC23658DCCC7BF9A843A77B2A6BFA27BC941B04F391950D998C607A59B49330811200B38B243060B55E381C078100DA84975091F3A0ACB06F22AE3FB1B7D756D36F54200A367C109B13CF40F3671231D5B0CE9E5908776768767209F4726C54277D0F8B0E05BB4CD50BB5547A01051C89ABC4A352745316C8D85A3187D68382EF05DC96294446972F4C76C7B9B91A4BABE06FC634E76AE4B778F939C308F22B8C816BC3FD6B48E168F5DFBC19FD8CB7E4686BF2325CB060638C723364B27C8E3123FE26CF9862F247CC31C844AE77754206B03B497BB3283CC7E38664B23771F709E1D308CFAF5086F25ACBD04CBD9F1612ACC2712D129C9C195BC024CB057B0766AAE7B533E60F04D947947F920470BC37E5EB4AC4FA1C48066877B4456D4EA2A5EE089DE38A7FC7573FAE5480BEA823727132651A85D873378CB97D6F7BE1250A94621ABF5EABF0114952665CD2A5005AF338B36D19F6E4C8F77E2CFB6F24D3CB7A909315A026B5AAD50A9CD4BAF3308059A91323B1C226FFC76B3565CD9386592476B76057E3477C8B7CBB201CA91546A2354B59328D411A724CBD8B3689EFA335D879996FB0D1D2244EDB361BE4B2489E84086F4A995F20FFA9404082C4E66061D3EF668FC155BCE04916C92B8FA46B77A4A9FA82C8C0CA5A5A5245883D25FDED230E74B22394169464BC33FD51FB7F2AA9214B1ED546DCFD00AD554AEC80882EC170C6EC44794204170D738EF9341D6034920A7AEC3B68FAC00527B2812D88969C6207F9AA122464A4D76320EAD6271D2836E574155310A756CD4249FA7474B301CA978A0653935B7740A16C50DF1EB678C1BC3EB451CF6FA35BEB903CD89CDE0AA58A43BCE9CF591286792FB3B5E658B5A32196EA24A4252B093D2AB40884C39A4ABCBD19B108B81172E18A84A288AAC2982D113454335423148168BB6B9D97494179BBA1EC8760BE59D06251B94B4BAAF82A6481C4A8F33B0FC3164635452E6497F992308688352CBF44537C618000536F9C41A64361EE162236F9227219B8B84A3984C649EA82211207C974F6C7575027AEEF57E496A58CE2719096A58E2E31E82844F4D674A4CD9CFCADA79AFB0C63E634D2514BA4D8604CCC42B2EEB64691AAF23727C93C4ABE1423C27B3B7ABF0B649334760056E591C32FE812A753723F7C93EF5524C8E0267DB177E6E55620715688CD0AC70B2A90E133CAEC86945BC74D7EA1CB88479A37B45EAE4993BB7048E5316BF66B9715591148C9A20A35412C2404BB62C512B3800B9AE104453D95ACFFE000D3AE85B96D8092532796A03039BA2154F84AFA4A402ACB673B8799441BC505E836C3B558E1FE2057FA79153E1630D72AFD96AA4FE9C0ED4822AB33A559719B81D274EF0A2773E405761A036521278DF5AB3617CBD89D7543CFC7C6AD373B2D0B781DC78DD3B2AFA34B6565979231681FFFB8C62843DCD11686EA59406E23CDF96AED95554E47027C5B6976F5515BC40B0E3A31C556219F89B73C0871E1FF552CA04C33DAA4A363794CC7C0E05249B53D20460EAA8AD217787C8C9423A7EB71058B5A8081B82454DC91F77F8608D60CAFF30A7C42424542A1746F0F10FEB3F0FA52EAAD4F2D4C36E59CA0A5389566FAD53898992A17BBE0A0F26659F74FC9EC372FE18BE4ED6AA28B7CD84AD1C0F0115DAD011A11D20FDA9EDABA5068AF837BE962F439F233593D193CE5E08F7D66EFB3389885927B89D2523
-ct = 454EBF31D8AB7BE6F8615035FD4F13BD40EE3E6DFD58E307AC2496B25BBB30222661AA2F65A314902C74FD897EDF3230AE401EBC263393C017195ABCF2EE916BF5B8B0A5F5AD109A7F8C049EE62C8E907719593BD3B3D2D35B0EB548C4EEC3C8C11787591967D8EFFE9C9DDB995C98520B4A9CB0A3A3B00CB1EFDE9334671FCE0D5C3052E0FDC48DF0D844C2960419B23AC63BB013BE9761D621DC41BCDD661452EC7A2FEBEFFCCC63B203F26441A366CC8C94ECC89F85404999584FA1B27D66BAD84BD997847B04BF1A594D301ADEEF612BACD232010BB54A8F5C06601E1F95F2C976017D9DF439BBAA02DA479DA944A71FE08082186BF464F3EE043CAD702E5E1F38E76793F19D7ACF46B40EC3D1773183F083F85FB6B2D6DBFC42ED98E78720B11E8C524FEC0A6F86A2A407957FF6D5E4137D8E0D080080F0A9F23CAD84224F558DE68B5F88D05850B29914E9A25AF725C39299546181E7390BF26B1A058F65300E351277EA19AC971FDF2943B44F13D690956C4E864891E397A06BBC70282F229DA50403BC3E354D898F5A079F8CB1333B1F6B0186B83B5DCF264682FAD6281F94FE08C370B2C29BB7FB9F3BEE2BD3A0E408CD1A14A497AB300CB7B39A2C15737F29D3FD9566092FAB82A01839700373C836CA73805C072A9E940E7B7C8739957B7561E90F601B7C50D2A4387D89E1CBEDAA6605062CAD5AFCCE27339CBECBC1CC13B1D690892816B7EDEFDDB90116FC14C6BEEE6D991F72A749830E82E3159B1632921B776EB9B9EA222573BA96355E10140EF9A47695C9F551EF7E2ACB055E54E712F44852604A46057F84358F6C886F2440E55EC68C0ECDE354C99BF5A912C68EDD8F488468ECDB968BF15C9CB764E67315C1A5D585615CE989DA13C8BAA041C448182BEC6005F018437036C296475B83C887E87C5D560DE293C35C8E942BDBE271CED6DD26FBCA0CAC7D1600188F65F32A9B20BE73CED637FE59A24D43B7896A33E58A2858AABD699A4C273C6B2D3AEE18253238F7E44DFA959142ECB729F5011FB840CABC16C183487C18DF53386B81C2EE131DD8959E3894BF36D74B91EA2F117FCD3596BFDC34926D5598864F5FAF775D71B6F17B471AA5EE0FEDF7461324D125AEA4441A1433B908CA4D4693945235B9153A2F1B17B2EA2825CE21101521D52488AE9FBD69B6977A17DF0269AAD0F22F1670AD5D4B95FC4292DE7037BD4E90A2AB0C7356F39951F76A8746C6D16C94861A205DA3F09CD84ABD40C038038B77D61B90FE747E86E41F9CF1E4B745C88556D6DDF1C817D352AE7DEDD801AC158CF4D1C036E39EA1CD1E10A2E1BAB5115FBF61BD52CFB2ABD6F5E96CB7DF1442BFC32F0A3D011691FF429BFB73C5E978E7F349776886FED906480E945103F109FC7616EE73A2F8F0B027E87BF9F4C5D88D085751DC708E1B9E36A6DBBEADBF37A8D2C641AE45A4F31747EBFAD00EF64BD00BB5D1DB84E5F395A914979C62791607A9F9A9AB421A2243329B755DB72A6C26DAF6713711E4D65E287983
-ss = 0D403F00C22FAB72899D302CB536854B934446B62F9DA6D9D6CF1C0F7ABAC2E6
-
-count = 68
-generateEntropy = 6995143e8eb8a6e93840f76eec844f67d2b5f75b1839a5040337e61f9806764a0f4dff8e56f68440836a072412a30d851ace2c7c6f02d60e7a8420001a63e6c6
-encapEntropyPreHash = 5fc00f89563e44b24cd67d0ce684effe5731619fd08e7d72e2406eb016afb66b
-pk = 8683354B3C3F035586B50B88C4140F346A05ADA7CE4BEAAA5F096614CC767AF89FFCCB95124B00E8379EFAF76CA381AE4886ABED9240BDA4710DAC62A71017059B07921C770DA1CA2D209338536C3A9B5238313BCE565FB861BF8AD3A78F030B3F646B34347F1D215E8EC1789D602D92A971FA3C2E892A09CFA68968F96F206A7535766ED7533497FB051C8036B0AA81C2C802FB7333CC6744EC830E4BE56EF1E4874371409486C477CC4EE90092D2919F585BA21F32BC973ACAEF42B4969746AB2618631B6536EC298B2828ABF41E24776BF288CA6A4A8094D63C7CEAC44854BA9E4837E44B3A7B269D6CCBB6D1712E9FFA937EC5194A3541E3FC9C685102F9A47FAA077FECD688D607996E5B60C1715E617994B842B46574B87086A061488BB2445B357A38934B612C16168E662112756BFD764A4FCC5F7B1634F6F28094464D600046EE03B4540C1049BB3D18F783FBA2AC5BD36ECDE662D9E08E2A89CB754B090DB7175277941E5973D010AE08A4B4C922AA99F47F657A49C3B81FCDB54C905A3010405ED544BDDA9942BC857B6D979F796C859E0627A5212543477ED791C2ADC95FDFAC9D21D19750B8B5DDB95F02D721A9304099BA6B2CD0A40C1A2F9DC1649B2318ACC93A5FBC52E3F4900BB44D20A7250142AE5F3B77C0720C77104B74C78EB821BD32E260051C499B5CCDD9D716521163557B5E4526ACAF09A2BEDA04994188A5065B4A975B215171EB288024581CFFA37D6289813773B29F1C0EF5587F9C98049F548D2A0C3A5C71C1693B5EC8C64CE0267FDF625485DCC4B5553C5736A0D0623CFE20596F984C014AAC0380BA9B58257A993B1BE3BD2CB9AC25912B36B2C085443074F093510A46CDE5441EE3CC88DC2CD636A5EF77310F91CB21ABB149DB2541407726582B54B50306CAB4B5356492C220C138C64B4AB293680E01C2AEB369BD611064FD8955B790222BD5997DD76BFBE50A2BD039C1F14F0469B623C53195A3B2FF068182D951DAB05FFCE9A6C8FAB42886987B7999043C12870965BD463980AA6B35E13B5BF9C25B64920D7788A291A98EBC30D3785783C27E53CA9AE809004F23706E3CC0B9AC0BD571084100299C932DB2933CD91566AAA367371B16069A706BE664E86107B33B1CF05360248C808EA250FCACAF9096715478463932A1C632CC9A185EEB08583A9309259C567743995AF013216B1086815B851655D0F14FCC43682720ACDFC36F35806894177EA2144F6E28837CC887E560874DDCAAF60A3580FCC7A5F1733180B1F1202A08182345370CC5C46CD28A507AD846D1D9415AF679D4B22EE560C6C1B2499D5B74AA2758DA090E62713343B3A8B14C68E415A3F196C2573C5E828A16CEA51443104F9CD899AD03C3B727774B48AE61DB98FEDA4C1E029B57F89D1735381166B70450215AF92120CA61A8A38E575ABF2CFAA54C613031A9BA60275D23178BA553A3ED7179AAC44FB3607E93C1C57C7BAD6854533844BF3D6A9B95A966F891612239CF6CC41DF1A859AFEA9C0CEC6D2679CD7C71C2CF251DC9759666C871853A1012294022FABDEB2269B430397F337B3F416E528748903CCB8B24C8FA28197244C0AC3A0345E699B247C863E9A58D8CAEE564224FAA36C70ECD281B67EB98908468420B38F3C24DA9290EA98B24
-sk = 5E484946337E3F4135D738B0862B69F7B247A5BB0812D56201300C53BB87B798B2B551CCEA75A87F002D7DE7878ED08E976A2CB62B4AA559BC36816E9690973F608B262612F89B5BC784365E33193FE9013C05818E0A7151297EA53C95089388BE203071D0335535436C799F6D3AA3260A9C8C9C9E36F79F13135C3DAB92914137C33773660AA15557C32B7A086A5A1CFD125DEA60183ECBA94DA22F0F3A18DD2131BC792C4013B7BF84A7840C976C53117653C4F947839D8CB35538BB97899418688A9E062F9FC17D77450D85261AAB01BD9EE77E917966BD26BD3D3990AABC8561CBADDC5A22F8C80D99453FA7350B2A022E4CA48DEA6C9C07309543611ABFC7CDA76AA03E51ACFDF0CC73921EF2D02F45990AEE50CA77B93F14E4BEF44576134391F7B67658E1CC7876713742267A556EA8F562BD858B24E04314B025CCB5BE0650642A23460C3C65E0D6CB68232CFF709204B7B7CAB0741807100A712686B982F632095D7730DD9385A7A26C23741474E12CD8FC259EF346B5F287EB01B046104EF8415372B47DA145AB0C5C1774626B5DEA7D72DB4C62FAB14C03CA51384420690A799194E8AA05BB914DB21956BEDC948299BAED7289C884AB9833C8669422ADF51D4E1A0466056EECA478F11AB55CE2CE34430ADDC889044A5601357EA6A5B097B54252B046FA83C0211C236953954C36840E390D2707848C0B879ABA2354EA200FCA56CBB86C0C2269A81C790B966893F782AAE9A4BD1B02FA85995A757FF2083FD26347C97711E07560AF77CB59C7CD64F7CDBC880AD26A7BD7FCB9B210710E581C49453A3200AC08554A641068E6879BA6665AE9F281FC14C8FBFCB0CAC0081C1A06DB017D80048B324248F699825A489D0726893E109127A0AE802CCA29AC56F6118D209A54CB842C9A8C539E43B9681CB868018C95D872C532A10A77BF52A796D33187FB8AA3FD780BD2C4B30FB7394DC64B0FE05B81128763A1325BD00EBA411247B1C22A1146FEBA1B255C51F74999DD29A9453151BD9869E3D548347B93C1B798FE92A053B88C80D7AFA5C561D31435D61251253B9A4C2B0F42830C81E990006DCEBDDB7002240EE8E276D4E31C2D249B84414F3997B9C4F5C0698CB2A24C48E3605F6D704E5DB734EAD12D62634DEDC68ED6A1248273BAD5ECAC0651978B098FFCC148667671D4B59EA6095B0B363C31299E5B90282F914BEBC66F6291338BB7600C8310B83963336952EC33854ED7C979B71F30188180B11BB66314C93242ECB890123C9F2AAA786ACBC7DBF560CFC1625D06C3828998ED51B79D28C583BB38719706D1D67B9BA5A556CB9EE1DC4FF2C53C33969F2F97BB93056729F65FD90AA2D7113EDF611C521761BE671FE37BAADA7A2B4A114DD458A19966A2A42914D61B47AEF5ABCCF8240C88AF752B51BCD0A3788C2AA38AAD8DC00D835476C8386DD3A8628B261F1D6B2B9F771842C97DA7BBC3D03696F60524BE6476430044F6A8AA48C22901F750DC55C1EA7813EC3518B26B3FD0657EA6FCB6BE94C026244A0401593664673FAA680F866E174143B0CC086FDACC1F7126C3E941F090332D8487D5E66061D5311C9B5C8EDC39BDFC34948400A9A3AFF3A85A8683354B3C3F035586B50B88C4140F346A05ADA7CE4BEAAA5F096614CC767AF89FFCCB95124B00E8379EFAF76CA381AE4886ABED9240BDA4710DAC62A71017059B07921C770DA1CA2D209338536C3A9B5238313BCE565FB861BF8AD3A78F030B3F646B34347F1D215E8EC1789D602D92A971FA3C2E892A09CFA68968F96F206A7535766ED7533497FB051C8036B0AA81C2C802FB7333CC6744EC830E4BE56EF1E4874371409486C477CC4EE90092D2919F585BA21F32BC973ACAEF42B4969746AB2618631B6536EC298B2828ABF41E24776BF288CA6A4A8094D63C7CEAC44854BA9E4837E44B3A7B269D6CCBB6D1712E9FFA937EC5194A3541E3FC9C685102F9A47FAA077FECD688D607996E5B60C1715E617994B842B46574B87086A061488BB2445B357A38934B612C16168E662112756BFD764A4FCC5F7B1634F6F28094464D600046EE03B4540C1049BB3D18F783FBA2AC5BD36ECDE662D9E08E2A89CB754B090DB7175277941E5973D010AE08A4B4C922AA99F47F657A49C3B81FCDB54C905A3010405ED544BDDA9942BC857B6D979F796C859E0627A5212543477ED791C2ADC95FDFAC9D21D19750B8B5DDB95F02D721A9304099BA6B2CD0A40C1A2F9DC1649B2318ACC93A5FBC52E3F4900BB44D20A7250142AE5F3B77C0720C77104B74C78EB821BD32E260051C499B5CCDD9D716521163557B5E4526ACAF09A2BEDA04994188A5065B4A975B215171EB288024581CFFA37D6289813773B29F1C0EF5587F9C98049F548D2A0C3A5C71C1693B5EC8C64CE0267FDF625485DCC4B5553C5736A0D0623CFE20596F984C014AAC0380BA9B58257A993B1BE3BD2CB9AC25912B36B2C085443074F093510A46CDE5441EE3CC88DC2CD636A5EF77310F91CB21ABB149DB2541407726582B54B50306CAB4B5356492C220C138C64B4AB293680E01C2AEB369BD611064FD8955B790222BD5997DD76BFBE50A2BD039C1F14F0469B623C53195A3B2FF068182D951DAB05FFCE9A6C8FAB42886987B7999043C12870965BD463980AA6B35E13B5BF9C25B64920D7788A291A98EBC30D3785783C27E53CA9AE809004F23706E3CC0B9AC0BD571084100299C932DB2933CD91566AAA367371B16069A706BE664E86107B33B1CF05360248C808EA250FCACAF9096715478463932A1C632CC9A185EEB08583A9309259C567743995AF013216B1086815B851655D0F14FCC43682720ACDFC36F35806894177EA2144F6E28837CC887E560874DDCAAF60A3580FCC7A5F1733180B1F1202A08182345370CC5C46CD28A507AD846D1D9415AF679D4B22EE560C6C1B2499D5B74AA2758DA090E62713343B3A8B14C68E415A3F196C2573C5E828A16CEA51443104F9CD899AD03C3B727774B48AE61DB98FEDA4C1E029B57F89D1735381166B70450215AF92120CA61A8A38E575ABF2CFAA54C613031A9BA60275D23178BA553A3ED7179AAC44FB3607E93C1C57C7BAD6854533844BF3D6A9B95A966F891612239CF6CC41DF1A859AFEA9C0CEC6D2679CD7C71C2CF251DC9759666C871853A1012294022FABDEB2269B430397F337B3F416E528748903CCB8B24C8FA28197244C0AC3A0345E699B247C863E9A58D8CAEE564224FAA36C70ECD281B67EB98908468420B38F3C24DA9290EA98B242CA3D8AD2DAB1DD8A2F4320658FE6EACABF70D907920593919119CF3745163360F4DFF8E56F68440836A072412A30D851ACE2C7C6F02D60E7A8420001A63E6C6
-ct = CC6EDBDAE7FAA07675568A32E556B25F34740418B3603A6ED17CF2943C1531B60542379810B7BDF525790222217880D92343AEDEEAE9D5F1FF7773C676B1894399F36037DDA6A1F2DF2D894FE157A64BBD04A0948DF19303CAF2A59188FB0415291246E115F0663C17DDF4259F2326C3E1C6ADA0A12E69A6DFAE45E3B6C6F8952B09D9C1721886076BDD8FF34878110ABF83EADFC84DFD1F9A426A533E1AC51D87AA50E3EF4F05DB558713D78ABCAEEFC2C98B9900D0A3BCCC818D5572E6F47F99CE87F687874CE23CB1ECFD88D3107D61C2862FC306BA30477BB7A0D121DC6E378D6C20A4F1C300FE69EBDC020F2585A539D972A3A935A2F1D49697F9696313D7AFBDEBA2E97A2107AE83E7D3CCC6ED795C77263D3B4C3632241E0F95028A2B3EB37385B847F67BC4E0F5BAF7EB89E293BBC95F77D609453023934B5C04D34C4AAF06CEBE6C122F76A3608C48FA264A59477B5F41C63936CFCC1E86CD443F9F8FDFC5741CE9CF25F4D4B7FEAF143237D6C03B684514D9C67CEE6BAEBF58A43F10383F72E9CF74B2FB8B865A450756764894640013F2C569E1DDA9DEF2DFE70A48A78510DA2EE18F17279688BFF62CB2F48F6EF0D72AFFE36CE9F656E723B692E418CF98E5A2A4D72E908F148788FD04D680497084CB01795FCAA77EEEBB0AC2C600351C84B4A3D1F6C537E9D9CCF373B2A26E7EECCA9B02183EF4AACBD24BAE4863A40B1A5F3C60F514D718B345A62C15B9F38880D00E50A01A18E7573B213A8DADFD54E2064C9A64CC6354DE8CE3E70C2F1457CC5F0F54055E5F0C05414C125CE82A398F025EBF224302429D818BA3838AE58F895C97130C1DC5CA577C05152FD543F7E6C1E292D8B7B6757023685D8F57A0F44BAEE68375F4D226973007275426EB9EC937835A2E26A1DB9F4DDD63F415E3225B6689210FB7FA323A479A59702F13C11425EE68C982F0106BBF4F6B01127F3BC7801D6B52F3B6226E73EC40659E1FD9A22B33F8614F514A20580C56859470FBA19AD5A558252F939614D1CAD9E3760EA33BEB784D311305EBB0A00CBD28C6DD9902F0C3CB5A88DBA565A4F494E1ED31C657A81685F706B1B0532E0DF6B8D9D90E3318125F1ABF6EF69E3044C04DD09599DBFCBF3E473C022F4B5A2DD2437AF91784767B2763FB99494BD13AF326B0403118DB6BA8271E34016548F56E4E5C75D2002CF237D5F5C26F5AE692444AFB5F6C51958B83B3ED983D248E0FFB8C0ABF455C34D17DF51A8F86C5B3044BE0660D7843033194A1DC4B84D475C089EC2AC1820A0B79C26B7CA3F888F24F784A54536FB852ABD51B0CEF758C855FE33FFA2155F4CB1C0F4AB9AB5B0D74B31067E2C6651460A151D16252F32CE4E037516978EECB123E23671B453B31893601D2D79F22ACE7EB3DDF6A22714C5AE97DF6BEF6EF3ACBA526AFD8920F2CABA016C10CDA20D0C39B32E78D0BFF0CC7A445753CBCAD615B55CE00851C70A92DA2421CC9105A85B6E642052F2692FB84CF642AAA44A9EB7572A6974FD3B767B4E0
-ss = 8C0346216CC65F95D2E0CAAEEC4BFFAACCC49132CBA2DEE8F2A6CE1F922E6DB4
-
-count = 69
-generateEntropy = 995eff7e0d195c6d0533f3dc194d47e60f9ad14696144cde694d60a95f3e96b4b28f7e7a15a005f92400ce33db073d49b53871594a88fc45e0f94207b5f0f2dc
-encapEntropyPreHash = ea22a76065db4b565ee1807fbd813b43bde72b0e08407fb867c6a18995025e50
-pk = B147B4694B12C461130F3126F8F71673E4643B2147DED2A7270AB360F6303DC05B03A314BB776C488318686069C3A4C91CC62435E829A6A8621EF5CF838311A4278D7F453EA5484D32F94C2E9628F5532FF93771DAE106C8AC9CC80AD07D306B1DA78463A08226657680E5ACABA6819543CD96194AA5973D4F7B8682B13A07E7A5194C91EC95A2D671A2627710A4C78AA107B3707942D0C78F3EB2B3A58B7833FCB0FD7785E349A2F0027AFF079B62A68E3F425122F7BC0A0B4C053A6696F90A67088F139B2A39F542D6439091E4C1A0824734D8B6E5E6483F48CA738C39A5BC2016C0746CFA9C1889297F5377D614ACFF2833CED20ABED0AA6C7024221B73D53610575C6D91A262A5E834ABB63CF74207437B31B1E989ECD7416B2C4E7BF807B5F8973006877E204A42774C93A1B394E885CF727B7FD286DEF2B4C8D5684460219C31B1B225AA08AC2EE1DA3922E935E981B3B5E2C3D044A784BC965A580D3052AC48000EF6183B94B0A870E65207BA8029C0BD34A10443E5706792207FE2224DA533D307C3E3077E6E1CBAD064B0399ABC6F445B651864F18B42E1A518FEA187BDD08072E47588527C3B9A5EB244AE9E910F93C92B69FAA7250BCF38E68E9C3A2B2B733B18032F37673907097A4CD65A9B396DB4859312D59113E07B39746C52126EA697A69929B1B625B5AE1B809CE9A811D13CCA70971AE8BD6AD223206691AF6897F136CB451699E0A19739D52D60CC89DFD654A320A79B2C7CD55116843239D6847B8BDC1EFA29CDC0A979F0E3A8F225A16FCB7996FC8CA3E79FAB55B93DC2A395117426A17AF4D404151814CEC80E856B777EB35085F1AD14285078803C2D76AC1D25C3F8609AEEEC4ADBCB64136516A2077CFF4C13748C5D1FE6386782688D944E0027A2F8C9AF77B79352EA5523767CBDE4577877AF1F8017E4DB244E833E99DABD0FC70824BC3C50A38275040446A5C74406873BA0B5BFC2570A406570B424727379E5C1C39EC194A29A8AA249844BEA2A078C1C0F25A400D6BADA80731A00B87BB5A19325B4E79B78AF0BBB2C52C3DB38AE552CA972C3927291145438115A952BF2A85E78F6141E1CAE8516B056E614B7015017E71D54268AB9919B7EBA09D196768D99651D60A334FC443C8CCD9064A420263A68531F0E86CDC48776A3D44B4726916273A0D3002DE095526257BC5E6246DCC10814D1907885207A53241A184AB7E40D87148A336A33262A4BB0826B417ABCDF957F68737ADEE682194115348AC58814661765BB321254A874C4A3C6745CF984528C2B9726AC35441015233219E169D0EA761425C06513720881B330185B48BC271B275DC024419D8761EB23801EB704F6326F162656713ACC2915A1A6F877A583C8372CC391EBCF2CB22873C5BD22C58C80640CCE759B2C09B368AB4AB504C613493479B7725A18811837213F9237734577AF09C4BE0B3FE07AB78B712B0683060BE76920CC5FC56993E56C7B46A543AD675B2D13357C008911320E0D292268768B8370C66CE757AF191BB703CB5732113ACB8F02618EAC98693224ABCCEA04E7B3157C03B27A3CC4F0B880DC4877AC35077C1C2D5584B971261D2C4BB767C75907827AD7370F4074721445E155A3A1624CB4ACA373DE6947F148CA7E2B3C93605E706EDDD992
-sk = DE4627135B3976B8AC07C0059BB28D09E98E3428228C1786C2E8A1D6029D93CB9EED217D09B03E9A7561AF7441E4271C7B6C8C862C5A93E955A05A87B01A63D9E8A334B26E1FC0346051BF31D078860A9AFE939F4A90C2A395B2B6C205475164E36A0C2930CD26E26420470B0D068E36971A978B17BE984A418A3CC5C6B62AB00D6DCA5657F71E08B215EDFB88A5B6751EAA525DEA4B0BD41430388E0CFB445DA3347EAA375B86858F19C81B73A4BF88C2F807638D808F78535B9FC6C6BC0C1402E16F0B784F9A22A30E5C6C1932C2063BC558A7B2636C76D5C0CB77E6C5518B3B31D920A23B2BFFF3AB93FB03B3386F670B07655989C5185D5D393631E9ACEE701DAD333379A63EFBCC636BF2B4FA05B84A375559079C5909651E481DA96B01A771BEFC7BC407DB7D9F94B819A468D443A7AA8C9B4741266875268602336C1B1160A4CE5D41C57FB915335C87A72A7345316373D921A6D0CA09606154199C4F06C244A7C568BC5D82449149F92AD3350B51D3C474E77A3A1053160570C876132434AEDD92C8961B95588910102C62AE1A75479175CDD666AB85478EBB6133920E9154441F1383B0F147137614DADC823F1848FA478B1F301D3F745C647C216C741DFD3B3195483F24F1A5313CB458273FFEB559689004CD534EC1369B0C68A873651F7413037118C6F98C538DAB9C1EC649FF2301A03A650CC0C138E79D15F9079A639737E840A7DC720B173BB329A34CF65418495E4DF2805A491A4C96B47D452725850CA8EB3944399F9D14157FA46B76F0891525461113766DC025EE1C2E735198C3DB253A2B8A566CACB81B65A1C9473C6C6DA9743D780685CF83CEBB441CDFDC9FBA20A9CE2943759C4D08C57A0E74BB0E1888E94723169437AEC19AEC1A2A46C81AE4645DE32BB18F3527F4DCB8221A0F7BE74F3F5A8CAB0609BE216465819FB858232B008A855C9E6B54439A67AAFFD9701967BC46A274D1D6AC1D45CEE7C54CF49669E89A44FFD7B73B2A12327A85BF5938E6975B949C03EF3A1D824CCDE033CB175A3356C8A998E4C69D94630A896606FC1979DCB5C172A54EEA2E99D5AE331BC64D708FAE45C514A2544843CA59C3C122947BC3660DA7357AC0E33F55485E79EB3117D14C42EC5C56653E0DD1A4E8205FE571823098AD8D9844A25B92238063A92040C500CC0BC2B25B493E4CF69DE95C87B03B773A796D13F42014847727345888EB06D9251AEDE24D03E292CB452A3A38A0A461C8B4F9CD9F87B09BC0CA98E62E5027595C24792F818865777A346004FE3B5B587452648263AAF688154526D591ACADB74520F3627D7395EC7B71DC3C6E8414985D591A05C88B6455870C48B12C576D7B328B88795295C051CA6293B0FB4DC61AB8AD34CFB114A4C7E44AB4667D4B1948C83C28BAA424B19370AFE997D8B08E447A2EFF376024F5CA54DC8EC0972B96F057ACF5A6B0D32869FAB3E1797EE2571B1620A076082C4BA6799C27B07FB073092A7A2F7AA110635CB94900E487A6664B318F54956039C57CE509EDE489FAABAC96CB11F58C87708A8ED3408A526701BFB8507D67415FE64E7D41081AC12C21F3092AF02810C604F02C4064E348B4F98F6BE65D87650EB147B4694B12C461130F3126F8F71673E4643B2147DED2A7270AB360F6303DC05B03A314BB776C488318686069C3A4C91CC62435E829A6A8621EF5CF838311A4278D7F453EA5484D32F94C2E9628F5532FF93771DAE106C8AC9CC80AD07D306B1DA78463A08226657680E5ACABA6819543CD96194AA5973D4F7B8682B13A07E7A5194C91EC95A2D671A2627710A4C78AA107B3707942D0C78F3EB2B3A58B7833FCB0FD7785E349A2F0027AFF079B62A68E3F425122F7BC0A0B4C053A6696F90A67088F139B2A39F542D6439091E4C1A0824734D8B6E5E6483F48CA738C39A5BC2016C0746CFA9C1889297F5377D614ACFF2833CED20ABED0AA6C7024221B73D53610575C6D91A262A5E834ABB63CF74207437B31B1E989ECD7416B2C4E7BF807B5F8973006877E204A42774C93A1B394E885CF727B7FD286DEF2B4C8D5684460219C31B1B225AA08AC2EE1DA3922E935E981B3B5E2C3D044A784BC965A580D3052AC48000EF6183B94B0A870E65207BA8029C0BD34A10443E5706792207FE2224DA533D307C3E3077E6E1CBAD064B0399ABC6F445B651864F18B42E1A518FEA187BDD08072E47588527C3B9A5EB244AE9E910F93C92B69FAA7250BCF38E68E9C3A2B2B733B18032F37673907097A4CD65A9B396DB4859312D59113E07B39746C52126EA697A69929B1B625B5AE1B809CE9A811D13CCA70971AE8BD6AD223206691AF6897F136CB451699E0A19739D52D60CC89DFD654A320A79B2C7CD55116843239D6847B8BDC1EFA29CDC0A979F0E3A8F225A16FCB7996FC8CA3E79FAB55B93DC2A395117426A17AF4D404151814CEC80E856B777EB35085F1AD14285078803C2D76AC1D25C3F8609AEEEC4ADBCB64136516A2077CFF4C13748C5D1FE6386782688D944E0027A2F8C9AF77B79352EA5523767CBDE4577877AF1F8017E4DB244E833E99DABD0FC70824BC3C50A38275040446A5C74406873BA0B5BFC2570A406570B424727379E5C1C39EC194A29A8AA249844BEA2A078C1C0F25A400D6BADA80731A00B87BB5A19325B4E79B78AF0BBB2C52C3DB38AE552CA972C3927291145438115A952BF2A85E78F6141E1CAE8516B056E614B7015017E71D54268AB9919B7EBA09D196768D99651D60A334FC443C8CCD9064A420263A68531F0E86CDC48776A3D44B4726916273A0D3002DE095526257BC5E6246DCC10814D1907885207A53241A184AB7E40D87148A336A33262A4BB0826B417ABCDF957F68737ADEE682194115348AC58814661765BB321254A874C4A3C6745CF984528C2B9726AC35441015233219E169D0EA761425C06513720881B330185B48BC271B275DC024419D8761EB23801EB704F6326F162656713ACC2915A1A6F877A583C8372CC391EBCF2CB22873C5BD22C58C80640CCE759B2C09B368AB4AB504C613493479B7725A18811837213F9237734577AF09C4BE0B3FE07AB78B712B0683060BE76920CC5FC56993E56C7B46A543AD675B2D13357C008911320E0D292268768B8370C66CE757AF191BB703CB5732113ACB8F02618EAC98693224ABCCEA04E7B3157C03B27A3CC4F0B880DC4877AC35077C1C2D5584B971261D2C4BB767C75907827AD7370F4074721445E155A3A1624CB4ACA373DE6947F148CA7E2B3C93605E706EDDD992DE62EFF56F6B49A156D065D85EAF0AA21CA229A20FA4E1372A410AB1C4AB6E7EB28F7E7A15A005F92400CE33DB073D49B53871594A88FC45E0F94207B5F0F2DC
-ct = C543D4032D1E98D70EE56B5B7AA1AA456F157F9405CE77EBA7F9C61C8D4634834B2A3DD128ED8022D30D6300EC237AA27B302302932082D9974B04DA94EDB0288EB04855E224669CEB3814CB91854F47FA0BFDFD376B0620DEB5A230C1705555C8D45BFD2751F57E2CF296276AE1A4078DFC4A98DDD7E5CB419B0F0AE1C3CEC1FF4FF1DE6D316CEF569D428C89B9C08EECF992B80CC2C4E5432C1DBC505E3A361F8570E71104591049F72B2C9B17869DB01F14AB30630726A7AD7B6AABE63270B81C033FFF7BDEE9E4189FB9D53BC910DFB3FB5773B8EEB63FD38B32DE2AD0EBB24FD3C7E0AF6BE8970602A270107C0B227A3D35677694CDA2128DF7EF7BA60E5F3D5255C04B817B3B01316D6B6E3D1159693FC7B27C3D5BC8ECB1C82403C7B736CC0844089DA19D5945FAAC08B074605D14B7B3A51DDC7ED207D84820465E44AFF42E9C5871E0FBD1DC147C79868D65911E5966D3480ECF644BEFE22A120C8D069E867D3132F44AE3482A1EA00A1EE14A5240C8412E0E07637BB2859A9C6A6F5B5CE2D7C810B9281A949992FF7A6CD4A7E3474625013E86F6F2713932D2C33C5D65AE15F26E7E45A5A24B9205574282900580338A26D07A2066C050FC5C44972ACD5DC2C2A0FD1D8634B34A4D839B5809D3AB4C14800722DB9F8A94D0239AF0A5C756AA815B1F733999C6F2DBF7E144BF2E2B8C6999394817A1875F4EC794680A4C509046FFC64C4D84D8606A19EA5EC8CDBEE7F5199037A8BBBF9F69BC4159A505B68BDA0E450695977A586D9917E843098E3C7F97A80DF5D092172E89364B1EDC37E8A1738E21FFF20170B157775B4F8F6B9DDD5D0202E735FCD380649C0F0EA7E7C708ACA92A3DA4AB0727907646C78203C81B9816ECFBE1D2B00C85ABFE0EE7BF92B9F9381EF3684400F5ED6625599D472D859D9A21060CCA7D37174945048EC244550EEABD26747F8D2F6C2D0293FFCD68046E5A83E651D65357CF82CF59A6183158F11C114934DC98E9E74CD9AB8CFB4C0811DE80B44ED75E37D1459B614801A548410909E2B9763AC2CDBC1B31F11C5DA7025E909C76465A1BD2E7F0813FFB2E75BFBCBC79B92F0F5220103F2AE62D957B9D69787491A556F45CCFBB7CCB005D5106817EB97ADBE2B83180D242190A54B88BA1FED0FA8B5BE2B264B1D9541A28DC321F0F3DAE9EE41723840EC7B703F41B6635AFA3E683B42364D69F5C5ADD12B20F60F5B3D1E19FFEAA3A98F4D61B3BF1F5FEB947DC586E5D13805C710EC734CD680EB89FFD9CBC1DB5AB3B2E01DB928C7AEAF6F91EC3AE0B48C3E133CE87B6561175C65F9A1417D048F8E9636F5751C62DCFD7EE7BEE93FC5CEF56E0D005AD82CBE3B93BF7E07DF37A8958FD74113F6765BA3614D89DF1A27C49998C88B65A2087118264FB5851581393100EDFF4A3FA54E807B042E62981866ECFE07D4C1E5DE3D49283E18E306074A332ED1E090DA35912DDE3C10416FF0A5E056C0F3BA4734668404E02EE2476C3400A51D7D9EECB09074F23CAC5FF87603BB4
-ss = 35151C059E5220D4ABAB9380FB0EBFA061148E6096D8F5678E4308CBA0226261
-
-count = 70
-generateEntropy = 3e809ec8dd0fec0d911a4e3fac20f70fbb128c5de94dc7184ca7310ae9157a98d8128601c28b1def8d393a0db283229f7c7383152a814e7cefe8ef9d9768c473
-encapEntropyPreHash = e9602b34fe73ad57f4bf6ead99743d645641553a5b9b9bf2e7016629e3e9bd76
-pk = C0C8122855031D7BB0CA735042BB43B8EC6EE13061046ACAB9B873B13519C22678ACE2B59F92AA4E8269844B1DE5E3426D66C0451A8D78CC07E719033A536C2BF4C7397C64C6478BE5F42A06413B8B44111AD9742B8B020711446D63CDD64490C0917557B884EB429B05DBC0DF7ACEC032ADBBA55D3E104F7BF391CBA28B903A07712A8DA3A1A92F5682CD650A628573844032A307704FE77AF738696E974181A85C5CA1C14F7546F8713701115883480BE2CC686625A37B62292367B5E1546F4189592639CDA4CC20974C6A87C0377D15B8EC5C84B70233B64800B79C62E536553B43263532C6BC2B726970CC58BB20F0C0BD35B317D9B66B327BBEB5175D9611985AD799EBB19AD0587AEB856C288464D983256649827DE9AF0FC79AFA1AA5817C06D3447A25AB3EB8248167BA60A4462ED47C007107B1EECB630AC4707B837F24D26DA46BCDA77C4B6ED5B4118B79294744788B9A9C21B168565D9398B41EDB91517493F5FB48AE5CC04FB95BB13A8FCDB8615262408AE25C2985189BA8AB99643624B70557A984011474586C357F1C7551F0BB069336FE85BB903040F48C4A111113507055F2716D37EA6A6FFA48F40584914C4738397430D65756F298AAD345671077DA8A4173728364A493BDCA944B1879B114166CC3B8293937221257C2E78F8F1C7794ECCBF0368CE34921A2EBB01E32A92255A676E77C39564B575AA5D1F9C7D1388226D636F4F12C5636B2E2F712C59CA583A811BDFA56448C013CC820F21A36C3351AEC3C2C6F01243FF47BF17181ECAC752108C43A97729C6B9472270FCEF5A7C08665F7AA9FAA55B152163E8446C1BEE5082192B5ECEAB269EC13E7879DA3768BBEDC0A104C5E9496C63E9507881A4C8E758211076653F369E58B59BD7CAE5B9A64772C2A84329E43F492FECABBB56514CBE70970F361E6D3C6595065F6CC668C64BAE7D587FA8BBAD129136D5C9B6F757A51E653D2754AA0E35307845A55B80086D5A0E86302D306B9EE1550419B495D424F701A098220897FC47333D5A1E994C8584A00D79804E4989A1CF02DCF9A0AC2AC52BE1090BB149778235FF6091075A5360CE095CB705C81E3BE126984F51AA471F90FF98C21D3989FD936502A8A2B38C4A2320A618DF751C7099D1063495A6A5936C744A094CC1FF1B04BA8B56B0464E852BBE06176034CBF5239CD2C687FACC2CD37329ADBEC3A77B4842AEC40BE902E8AF72FA5805345668408CC7B6073097391921E765E4D76025FD5C78E246DA268A4DB21446F2CC3273861D2081DAACC2CC775631927B709DC1FA8993B1E92619590C08940342219682AF351495B2E0AAC74786C897FAB196ABB609E216997C2C7B283BFEFCA4B1F2B1B6E98991BB32424321AB7D61E4D13C44DC93295A75F6145BF2D4B8F1A03109BD7038EF4B16FC15F44CA6EA3411B68400EB20C46C11CBB98201D705A6CF4F4B792AAAE80D97A6AB830576AA651142793FA7DA0B8BEDD877217D54897375EC285849A79268BABACE85176842C601EF8C740A21C2C5321436A21CB968ECB5410E811912CB0962F713322021516535907914B86E9411D27CF164B580528768AD37B57300DC201557BB0A142D9416ED7AFEF52D284175DEC18F24979EF5BA8EDDF7CAA3880AEC7B42A147E75F0DD62B3D0
-sk = 84D7070EE80107976BFD1B0DB6CC33F3C98178817D8460B63DC012311638AA43B253A705BC994931BAB38A62C5D1DBA793B8437BD600A8725D36AA898E353D6B955B80F8578F855BCEE194CE2C6E4C6179ADE8176E34578FB24B6D60C395B674A7A8A4C72550F83A09D24582F94125690428A4E76972B77A53E852FF3718A440B67D6521CA699E5A8C434DC47A38032129BB76BCB4C810028938FC94F1741A1FB26EC95252E259B8F9176BBAD8763CB63DA6F295B460CDE1479BE8D6B9E3C49AB77845C21C8F3F88741759461E339F76376AB81B4F07E7BF0DB861A4AC5B24E09D4144AC900B43CEC07F1DD2CC4F7C976EB0BAA4D8637BCAA70946391109981E978CA023313B200092D26CCC823EBBAA85B8BA1680636D0BE656F01769555B058AF7825FA00D10A38B0A2B127A773CAB406C1D4310A0882889759F20B44AECF68DD24416D9491CB523A1AFB1A1ED87B28E5589F4059132603E228B185D426F49031AF8FA21B11CB0F37C4557F94B2F158340921F95091128C5616F54105D47253F150FF335081D231F5B308A526B9506B03E0B5C6A88394F0C9C6E7C2B475C7508A3A8B1E0D571D1C364784CC8A7CA7AE6C2B24366A0D2865658D42A8495B24A16C9A9D8B1EA77332A1058DC292EC02C4723FA7204E93EEFC24F10C4877425975CBB6142026A2AA649FC6C77E8C72DD3E5B0D9E9495A02C251B12B7AB51F6A9853BFD151A4873CAB4102DB62676496A8B38C8038E4C6D988880A6B2774875A5FE69693D9726AF64A51D77A03E523BAD8B2A6DBCEA137A051D19E81059D07437E38DB7891956C5B2C8ABE282B5A02A5530C56A7B4B46DAAB256588B04344365313A3AD94A2D7ACA4BA7072CB9259E2676A5C86215B24FAA159BC18BCE05451C69D2699A056ED3F6A7F2BC7676F11BB06CB72DC53D7EA6BAFEE89797B57445F3AE11262543A2882B863CDB455D5EA03EBA56946DC61D798A76BDBC4CA7F2A102C518224A2091211EC4D251CCFB08AA2598065A79B8B61A56E925031A579AC5BDEEF1A6E0B1381FE180DB008F19E775E030052A624B91D1550FE5365260150CCAAF228ACB8FE471D2C8B4B27BB57D62AE9AD9CE15A0B72ED98B8A619CFDD3A17ADA37CC455D77640EA327088E9C33D4281B65DC9A27C68D27088B1F2A5FC586BB0993753E62A67BC3886048274AC267A95B42AAAC3E60C2699321A79301ACD350B92899A2C0CCC4703B243660A39C5901E3B6BB146C588DD3431C4A5BEAD8AA29E04F8FDC0D04783751707CC25AC359952ABE7384F839B42D9C9982DC66A21C7FB5CB7316748423E25005D389BCD56FC498080F88CD75EC974CA9CE9F2BA995B50ECA85CF09612FCBDC492CCC6D0662A59F8CC0FF3355F17424ABB6C774A377B81C12B9982F60777926BA0B860123434CAE8F926E902A5E633019E3C62087A1BDDDF2186768BAF91656D903C4F1CA88163B8DCA041823BB6EE525583816CDFAFCCBCFE63DCAE0B93C46A14FB72114194CD084C208921925E7C55EC807EE6C0A8DDB71C4AB3BD5836B7FA160009DABD1E5498D005718548324B0339EC71AC4A75C81F522DFD92B64E3676B337758490E068C3CC747BC004DA30CECAB9C542FFCE826C0C8122855031D7BB0CA735042BB43B8EC6EE13061046ACAB9B873B13519C22678ACE2B59F92AA4E8269844B1DE5E3426D66C0451A8D78CC07E719033A536C2BF4C7397C64C6478BE5F42A06413B8B44111AD9742B8B020711446D63CDD64490C0917557B884EB429B05DBC0DF7ACEC032ADBBA55D3E104F7BF391CBA28B903A07712A8DA3A1A92F5682CD650A628573844032A307704FE77AF738696E974181A85C5CA1C14F7546F8713701115883480BE2CC686625A37B62292367B5E1546F4189592639CDA4CC20974C6A87C0377D15B8EC5C84B70233B64800B79C62E536553B43263532C6BC2B726970CC58BB20F0C0BD35B317D9B66B327BBEB5175D9611985AD799EBB19AD0587AEB856C288464D983256649827DE9AF0FC79AFA1AA5817C06D3447A25AB3EB8248167BA60A4462ED47C007107B1EECB630AC4707B837F24D26DA46BCDA77C4B6ED5B4118B79294744788B9A9C21B168565D9398B41EDB91517493F5FB48AE5CC04FB95BB13A8FCDB8615262408AE25C2985189BA8AB99643624B70557A984011474586C357F1C7551F0BB069336FE85BB903040F48C4A111113507055F2716D37EA6A6FFA48F40584914C4738397430D65756F298AAD345671077DA8A4173728364A493BDCA944B1879B114166CC3B8293937221257C2E78F8F1C7794ECCBF0368CE34921A2EBB01E32A92255A676E77C39564B575AA5D1F9C7D1388226D636F4F12C5636B2E2F712C59CA583A811BDFA56448C013CC820F21A36C3351AEC3C2C6F01243FF47BF17181ECAC752108C43A97729C6B9472270FCEF5A7C08665F7AA9FAA55B152163E8446C1BEE5082192B5ECEAB269EC13E7879DA3768BBEDC0A104C5E9496C63E9507881A4C8E758211076653F369E58B59BD7CAE5B9A64772C2A84329E43F492FECABBB56514CBE70970F361E6D3C6595065F6CC668C64BAE7D587FA8BBAD129136D5C9B6F757A51E653D2754AA0E35307845A55B80086D5A0E86302D306B9EE1550419B495D424F701A098220897FC47333D5A1E994C8584A00D79804E4989A1CF02DCF9A0AC2AC52BE1090BB149778235FF6091075A5360CE095CB705C81E3BE126984F51AA471F90FF98C21D3989FD936502A8A2B38C4A2320A618DF751C7099D1063495A6A5936C744A094CC1FF1B04BA8B56B0464E852BBE06176034CBF5239CD2C687FACC2CD37329ADBEC3A77B4842AEC40BE902E8AF72FA5805345668408CC7B6073097391921E765E4D76025FD5C78E246DA268A4DB21446F2CC3273861D2081DAACC2CC775631927B709DC1FA8993B1E92619590C08940342219682AF351495B2E0AAC74786C897FAB196ABB609E216997C2C7B283BFEFCA4B1F2B1B6E98991BB32424321AB7D61E4D13C44DC93295A75F6145BF2D4B8F1A03109BD7038EF4B16FC15F44CA6EA3411B68400EB20C46C11CBB98201D705A6CF4F4B792AAAE80D97A6AB830576AA651142793FA7DA0B8BEDD877217D54897375EC285849A79268BABACE85176842C601EF8C740A21C2C5321436A21CB968ECB5410E811912CB0962F713322021516535907914B86E9411D27CF164B580528768AD37B57300DC201557BB0A142D9416ED7AFEF52D284175DEC18F24979EF5BA8EDDF7CAA3880AEC7B42A147E75F0DD62B3D066F161D27DC34E1A2F4B98B14A2B221D7EAE26A593BFE432487D9994CB480656D8128601C28B1DEF8D393A0DB283229F7C7383152A814E7CEFE8EF9D9768C473
-ct = DA35DF2985BCD9A10982F3A0A88AF1EE00F083E6A7CF8C64D49E72AD03269EED600E6FEEDBB202CC5FBB12D0F35020B77FDCA235243A2252C82EA4E1D6120262A8CE8A668087D8AD506212240371E5BBE49CF86FCF157E7E284877BBA3FDDD12D2B0BD809C0C29202F07914683F5A248EB748FBFE64C8186CF4B14ACF2F5DE8755E35FA7AB5CE21221576EB118D2D2F9CF5AA0C1D5F8E6ECFBBC5B58D58B6EC340D703685933136B0544016F4974FA814B4AE34688E8FEDF457FD28DAF52784EFA7667041D272275264542B3E04279FE41B74F463E1D77918A5A4D6E1735771CBA792F7B9B014113A96E7A37D318E5A0137770A8F8535D8E54AB1E1CC4F879DC0FC5EBABE4711D940FAC307DA1D1152EADD5BB2883D47F4004EEB4AACA12991CAF663986B4D02CFF065C653B6689FB17F219808B5338319A357D4CDF9D293DC4C4391E88C481B1F7954BC875D6B0959AB89E540291968346632FF24D722A8AFE0E085ABFCD28BE0524578A97DDE657EB9B448DBA91AD1CB58F86FE7626148EAA1962061819821F95D221E7469FDDEEE982B47F3DB8E1B330F84DE756673EDCBC484C645199D92F637173E853E02A805D3E2D9E311E5ADC58E762E8F8D5B64A4CE0EBAC2BB9CC7D738C018FE43FAFDE7C8A1174C2A81C1737901DB8B1F230EECD6FC269EC01396E6893F23BCA652A1A6E3C501FCF016E4592AA5419149BEAF877B8DDBD2B5F9073D5BF532CD1C65161026E0D0CE1969B3B0F208FE23611F8052D54D35ED967E327613B6EEF23A473EFB91D9D23A0B429593F68C61DF78035642DEF971298B70820A43920FE8CF29BC3EEBFECA730DF4E9BA41BFDD3A00E494451F3F19498F3DE4398AE829E5DA0EAA288F9757E7DBA0CE162DBED3B8D7FA9D22D5912B147BD8B88613BB9ED81A9EE73B8FABF3456537F8AAD9B9565C8A638F96F05C9E83B8F147CF1FA829489352AA273172A577FE238A231EDBFFEB6953AB06D5AE7DC63F46B0340F78BF836EB2BD5DC4D72A31260188A888882AB30556EDDC2283879E6481A31EC28A8F3CA1A8DE59E1909B5A0B5A49E4F530E9A0FB285E970A8314F4EF7E8FEE8826A84B062D6DB950D3F15F6ED870678317CA86515485F5922F51B6921D5405F434AC153DBD18E153CDBCCAF0938CEBBE40ABA7795726233FF439D09B03A47F4E9EE894188E5629F8121366222836E8E382C7BABF7A7924991B7F810BA3FCBBF9B286929D67134B55BE9452F54B844BB2D7C8AA76EB76B11C7062A69FD5F2C4A477BBB1826FD5062905B4E89403DBC582125DA4149AD5891A79D6191C95AE2B3041C603F8DBD339FD855FDF7658974878F5369501C8E69C5A561CC2620140F01294E86B2CBEBB393637B8580934C0DEE84A765797BEB43C730C758F83DEA6C5F7BE36EA53C70D33FA62C808BA9A81EFE57F8EF9017FE1EB19CBFAC3556BDCD2FD77E9B39CF7B033F88F43D974923C04DCE51E215BD10667EB54CFC5ACC416EB447E3FC2A4EB309439FCDD2AB4470F660630BA09604626C0C
-ss = FA4C0C7C5BBB803ACD4AE91E49CB8CC659A94490E8B786CABFD9B92E949FBB0B
-
-count = 71
-generateEntropy = dbf1c465fff3d9f783bd9ee61a573715e45691147b8904439b5ffaa64f94ff7bb6d75eac6c76ced1b0a025b40a55440712ad8424672e761e9bc400d63812006f
-encapEntropyPreHash = f72b9080a6c051bbdb9b0abc1949034be0f89a9f73fe277ec4d4740c78d04a83
-pk = 80B3B92647A1DBEC6BB883A4B2160E4DCC84C89C6ADBD955CC055933D3238E325FA826ACEF899A555873A5B9C189117844202C65E40EABA07D9FA94D421BAFE8F3A5E3346B6B93CEF8B75628E4418E2885660B1D3DF32D1BD50CC50757C5227928B32E0C567872E66BCB58128B15C8696710A7B33BFDA469128996F6979F896B93D22910383C90D0D877A56B4B7C77C53C99128719C2995497DD36877276A25FA8B74A4947E223215A314A075585DA457DAAF17C41711363950EF9013A8AD95F9E07635546485A3568AA502D608321061A6999057E705C46B6691183874FA9EA38BC392F718C99DDBBA59A1865A135207A00058A408B6C61772CE777456C92B28A51CE823F7524A26639AC64AA49D6903CC2B2B5B60B59643BC950230362CABA6ABB5BA4F6964331B1F62099CF385BE3F5B43C2B8402006BB3386F5A16354E45118F0B759C3363AB4069EC2C4C15CAC4E07A24FAB0C682548337D157E6BA213C7801DC5A0A7045A442B4939D611469746E9DA665E2E910B51C56B77A035900B25490216C0BB53E04173B3BC454A7A17D77283EE278E7D30496301480C8C1AF6B3E1DCA213B174F968C8A45A3BA2044BDDB1492BEF2AF610B4ED2481AE0823DF53282BA7750FBC7A764DB58E3789CCAEA778083C27ED101E3C75BE5486249F9818A08047F97447773C7DEC3BA7C59AECB5778A09CB7F1182B2E0A01C182A1BD13AB7D72AF97F96F564607A9A970B35A6ADFF275C35C22C2444AD6E997D821C065EA49080900E766C0079B7ACAE7BC7CB3B31301656FD39591E0BFEC2C33F05A0DD633BBA463781F1C519D902342BC12BD16C1AC8305EA9769E489073297784EE45F99B248670749C728385F601FC84C1FFB298BCC447537785226BB5DE712B7BDD04A0CE39226919105F06ECF6BCDDB0CB5EC3B5505B5A169B05480B2587CE4934D2B232A44A6683920A81A6038C59497C9B47FAA62F4F2120B15C360616E6573BCC5A23A88887B50D1A7DBAA429BB00A9F87B63829B1B641922425016C979DB571BA0F1A139267BB362C68F47689715CAD6636402049C2B5C616C321CBA6E43C1C1A48A0E141CF3A71C0099BD183A5C0E59BCA9A2FB637C1B534CB6687493EAC495ACC7C5FCC4898A52E44094FB1B7014A15C88E11A9E7244EE53C2D5B16708C233ED37859268501630A296D63C094F563F0E559C59453ABF05A93722AED5AC0C3CC6A0BE7890F8C3191677C21F70C8153CED3E2BD96A4BFDCE27F86B809D8AB04DFAA837FE030F420B845D23C78CC82A2D7C440897C91C3B726B4622445899DE72BFA263B93C3CCEAA8500B4B0C240046387B25BD98B5901AA670180A2A8B27DE424F4D804A68DCA2E044430D701B67E9B4AF33C60FC54BB3A94A8B8604FA5882A401A5647B8DFBB20878E4B4094136BD4B5BC14288463C2E87F0CDF6D9497FDB5F42F26D2F9CA2E048A757A59B440C2C5642232E714D11FBA959AB9AC52126BF689864AC98CBD1A633BAA3ECF75C09C4C6878994CDCB3E882798EA02AEAF39915DCBCEBFE2BA14E620F53B3D83AB58BBF99509033DB99B0ACBAC29FB4674C95CB94982AC398C2771A8AB6DA1CE9B0771E3D5C2E7655B4BB99EBBB57ADBC7A540F228114639B811C5C1D3B614DAF84266BC4C312FA43C4109DAFDE79000AB39
-sk = 47318B2CC6A9D8BC6EBE7C12489017C03214325B61A2A8541FB783C448C3A31C1D82BA7906B09E3512AF8D00D0706A3D391281F0315044C9C4F92B0AD72C60E18637577B942A442589CBB466AC344438750B86CC86B97D16339A9DB0365E6696B183041543B031C9220E82BFB89C21A5B0A0D301109568B1C00B2B878C9284375949C88394F141ABC188EF7607CB8151BAE654A7B7BFD785B44BBBB5C5A68CA5F96BFE5ABF179CB83A58AEE518202C9119C80081BEB38CAFF81F5EA51811F13BE9491F431B127783227BF9B691031145D6A144213FB4F1C89C38C00C81ABF075C4415586BDF28B946380C948B94D7A0C3A793100842230663F4EDA9174DC7214884E0F552A50D16DFD0A5DDFA7920B0AA50437BFC735A546F5B0F4BB22E174B061BC80E91428547576B6205490CA3934C9B15FCB69611A1639974478800B2CBA3D5243A0E2762BE2F87035295FFF40B56BE37DDC71915434C4AF6472C1E5C519506E691703C49C715B50B360A5C2FCDB79F59C7ADE27380F9905EB7AA6F5042C6A32BAE657C699EB85A53395C0303E87E89800131F96969BF45B3F574A40ED813268603A24F1C3180607814914775350B88A1FA7E1034C9CB155879668950AD5950803ABC0CC58BDFC408FC1F2BF7D3A2972AA66B58844C048150C0B8C89ACA3BD3269474875BF10A94D2B9EA3687AB9547EA59731B73A8849AC7B7C4B946D70B8B87C56B81B77024503BA87485BA3655F669770410E89FC84925B87C008C3CC13C7B9447D82FC2932A1C641230725A422B6219D9BDB5CEEF17E121132E6615075E0B26CF71E91A1593210A09507214716A3405B2503CA5F29D4479914CD10B3457AA62A6BB71BD08736E1519E69F709B8C8439B4441BBAB5D0911BC6737CA742747CA592E5ED734A8AA1B77450A9D4188E05422BD9240E285865D530E718C6F1A816153CC27414446BBA8129A1716171AA60AE086AD09951C2B9AA2744E0153CBD4EC9D1736908CD78E7CD75D0333434715C517633EE6603F7993083724A596069F3270C071B6BAB955844A081A896096F76059B9738D819CA3B6588D5F578058D28D2D0710B2BB2E307A5F9E18533713C41E172A99614A97C00AC0A83A25526C399CC9FA9B74CC4774830C8E754231B04274C90C526DEA7FE3D203688114E7A90D3AC02AE69A139649B754581BB56825A215C3BA282A26C036E5D5785C07C62956B612FC37FB73A7C6EBB506B998D54979FF29781CD09CCB64993299745B34B6D7F897C0E05E1A6966E6757DBEE29AF2EACBBB7701DBC39294DB584C7C3A7841112258951D88145CF73404A17ADB8CC4D11788225557A83B652F95053E8507093B2A8B00CE77E7BBBE83233DC18880F2274472C05E646B90952FE92440D164092A058D69C96869D8A83377A2DA92C2D668607DEC3CBEFC6242B49A9DA97C19C2067722C8D309CB898593B08B5D8138BF2FD1C59081614F764ACB392D7FEB205A85270DFC1129929CF7B53D41031C92944972B8BC9A9C494AB384996647E177A87A101C45C747660AA4A38088A5F7919CA46DAD338576463A1C1425A6C4409E2BA8217827AE83BED4E6C80AB528A6BBC1AD58C868B995D9F72C77E84173C9CA80B3B92647A1DBEC6BB883A4B2160E4DCC84C89C6ADBD955CC055933D3238E325FA826ACEF899A555873A5B9C189117844202C65E40EABA07D9FA94D421BAFE8F3A5E3346B6B93CEF8B75628E4418E2885660B1D3DF32D1BD50CC50757C5227928B32E0C567872E66BCB58128B15C8696710A7B33BFDA469128996F6979F896B93D22910383C90D0D877A56B4B7C77C53C99128719C2995497DD36877276A25FA8B74A4947E223215A314A075585DA457DAAF17C41711363950EF9013A8AD95F9E07635546485A3568AA502D608321061A6999057E705C46B6691183874FA9EA38BC392F718C99DDBBA59A1865A135207A00058A408B6C61772CE777456C92B28A51CE823F7524A26639AC64AA49D6903CC2B2B5B60B59643BC950230362CABA6ABB5BA4F6964331B1F62099CF385BE3F5B43C2B8402006BB3386F5A16354E45118F0B759C3363AB4069EC2C4C15CAC4E07A24FAB0C682548337D157E6BA213C7801DC5A0A7045A442B4939D611469746E9DA665E2E910B51C56B77A035900B25490216C0BB53E04173B3BC454A7A17D77283EE278E7D30496301480C8C1AF6B3E1DCA213B174F968C8A45A3BA2044BDDB1492BEF2AF610B4ED2481AE0823DF53282BA7750FBC7A764DB58E3789CCAEA778083C27ED101E3C75BE5486249F9818A08047F97447773C7DEC3BA7C59AECB5778A09CB7F1182B2E0A01C182A1BD13AB7D72AF97F96F564607A9A970B35A6ADFF275C35C22C2444AD6E997D821C065EA49080900E766C0079B7ACAE7BC7CB3B31301656FD39591E0BFEC2C33F05A0DD633BBA463781F1C519D902342BC12BD16C1AC8305EA9769E489073297784EE45F99B248670749C728385F601FC84C1FFB298BCC447537785226BB5DE712B7BDD04A0CE39226919105F06ECF6BCDDB0CB5EC3B5505B5A169B05480B2587CE4934D2B232A44A6683920A81A6038C59497C9B47FAA62F4F2120B15C360616E6573BCC5A23A88887B50D1A7DBAA429BB00A9F87B63829B1B641922425016C979DB571BA0F1A139267BB362C68F47689715CAD6636402049C2B5C616C321CBA6E43C1C1A48A0E141CF3A71C0099BD183A5C0E59BCA9A2FB637C1B534CB6687493EAC495ACC7C5FCC4898A52E44094FB1B7014A15C88E11A9E7244EE53C2D5B16708C233ED37859268501630A296D63C094F563F0E559C59453ABF05A93722AED5AC0C3CC6A0BE7890F8C3191677C21F70C8153CED3E2BD96A4BFDCE27F86B809D8AB04DFAA837FE030F420B845D23C78CC82A2D7C440897C91C3B726B4622445899DE72BFA263B93C3CCEAA8500B4B0C240046387B25BD98B5901AA670180A2A8B27DE424F4D804A68DCA2E044430D701B67E9B4AF33C60FC54BB3A94A8B8604FA5882A401A5647B8DFBB20878E4B4094136BD4B5BC14288463C2E87F0CDF6D9497FDB5F42F26D2F9CA2E048A757A59B440C2C5642232E714D11FBA959AB9AC52126BF689864AC98CBD1A633BAA3ECF75C09C4C6878994CDCB3E882798EA02AEAF39915DCBCEBFE2BA14E620F53B3D83AB58BBF99509033DB99B0ACBAC29FB4674C95CB94982AC398C2771A8AB6DA1CE9B0771E3D5C2E7655B4BB99EBBB57ADBC7A540F228114639B811C5C1D3B614DAF84266BC4C312FA43C4109DAFDE79000AB397537E68CCF14E8B7E57090D8F648529DC461CA3950288879E88116ACAF57B4A2B6D75EAC6C76CED1B0A025B40A55440712AD8424672E761E9BC400D63812006F
-ct = 2AE65FF9BB3921463D5A4FA59032DE79451B71137E7019EBCAC2234F3478E1E4C4172B97515BEAA552B9580D76BAB278B304B83B05390BC98EC094559F3D21FAAEA79E5D0CF3F9892155BF0E4E989D3C85350C66A94DB3D006530119E4E44BE9B2312EFF20F06D762D4CE489BDDEBF30BCC765A1553AA5A3B5F620DE634F64DE66F1E56D288266195795794441353674E93C69B7D86D829695EC15353186460C20ED184D5AC56917276008772AB381EDFEBAA45A36B8294D9B84C4E5518163E98DA4B5D7461D28493039AC8F378A154152CACDD3D3AAF66EF966C0FB298978D9C293979D0582BD8271C79F5922769D8210F4C7F198B73CD0249330F5B25ED55964F2300694FD1C1D438E7BA0FA0A6AD12F66220A390ED79CE1C40A7A6F50C64435BF538A3A2A1BC859118C35477AF3AF986CCE9BE6FE75BCAA59ACF3FF7FDB1C873AFB6CC5B69621F6B49715A0F362CE441961C452CBF81C128A2B81C1A1B667017026C09DD36AF0DBB856F0D7A4B21CD44003A878243955A12E62F41737D81C16180BD83297AC9990976E506684A24E4F97737E463823B025BA95873954C153BD42DDB06209ACF5BD7E9C9CA404D57202F7236FBD5949004F73828A59FFCAD810E038C741534F044A4BD4FCC0668DF733A7609E493D753FCABC6359B959582A5DC66CDF50A8C88A97B9738F2CDAB363F01124526CA23FB047432789D6C1E430974329411F8C1C63936CDF937540F66C2CC9B76BAC4D9A44055386918370D8051CB79C8C703CD37D3B6C1D53675EA2BFC7976D40ECE547FBE3B969804341FF267CDA5F583A95D0169BB2359ABA56378F319F8587E602459AF732CB1559D684CC4F776E1766F1CEB1483A4D1983E8698B56B37940EA9A7FDA8C8CF9C9E0DC724CA1D60E0C572894D2B9835AA9E82C058FB28271A5979E397AE0C2E72629BD5A56B995F2E3D9DE0C7FCD608E4DDF8A4B0638B1810B70D2B3FDC358CCF45DA5A22C000E4BB70F4067884BFFD9E419C7825145BC80491B417A26567A6B91ED7D89E8E9E9F47B24B0FE1C3DACED4EABB3D1571DBCEFB3E3AA7AE52DCC66AD97BC87B629875165FFA709588B4725E64B07781420D6F6CFC2B485BFDB7CA3D47314452A862050555FD324C5A56BAC047F43A3073F07B05BCF14F505CE528BEF347A2CC2C846675E4EA9417B7E741B776DE1D767A4F3573E78E7D5976E73C8F7CD24AEE462294B4E652460C66E6A4A5F1591446FFEE52A0A61526D16392AA40A4111D4715709FC70AED98E128342F7DA9EA80412C749C80DB3D64C5DBBDE06244C18DE5EDE7F550A8E086F21654994628413E9EA53644B2CCCB530CD1B2288BB9E51F529271E9A9EB795FCE68A74DFDD2CBCBBF98407D68E691C11A979463322B1402629C2338CFB2B14A7BB2CF9AC8073E6E5543E3E989B60DA52F1E07859F591DB172A877483FFD523633E1B8DA9E68BA748F2FFEAD7F9D3882E9FC56D4B4329E1A22CE06E11D0F674C568A2B1218BD4A16A60AAC59DC30FD6B8B76C06A230C39393BD
-ss = B7A8E7B3C6D244B6B0DCC45947DC91F795ED21A5B5AD545205CD5B210DF37325
-
-count = 72
-generateEntropy = 1f7cfd2b70863154e8a69d1758532e86c20cfc763d67c758bd10a13b24e759b5273b38bddc18488024ec90e62a4110129a42a16d2a93c45439888e76008604c6
-encapEntropyPreHash = f1e5542190db8ecf4b8d617a04fd3783ad0df78bf8dab749afb57db8321d151b
-pk = 03A20A0337040ADAB8BD449E0BEAA93B07512485BA33F291AF1A44540BD04AF4A3DD2A09F6454D7304D0944674A580551061BA5F88217AA57C10640DC1A97396F138C1A32CF40B0BD9286F88C4087F9084A9012D248C63EFEC072D77AB0E736719A23A913B7B8B62AAA5BB40BE97CBBC1C29EDB283C776AEB9B032E2C2691AEC9CE89617B84B09712B40E2B713E566C714E0BAA75957D6BA5062BA76471357252B72AC66BA97E10921CA2313A232A6BA908DEA13645B5617938381FBCD748A11F61CBCB615C458D056F0D55A449C4F544C6673322EF106010CF139D1C586AED5A5DC210FFF7A60F3138C34A4244398B692C567ADE5BEB55C1EDCFCBD93183E1ED0C2AFF5BDAB67B51E39A58BDB8388D67CC1EC0D7313B7EC8A56CF3C9B73214C4ADA14592794749B6834E9B81A2BA47DE929E9AC7856B56549F40F38F0784BA0CDFC195952D3155222BCEABA0E3C233FF7E19A65822437217A42721F9C060AC2CBB9C4E6BFA9FC3014D8ADD7B4BDF78291423511F9874A07E06A82B6369FE349E08333C7F56B7B7B808A0B4E888A95799A2DF4873944CC43EB958B1508C66E571268E79A69178793E7A4D430507E1259D01C86F999C16772CFB7B4B330114FF55A51EE5407BCE95A6D27875A91773420C24F8734B3023E9DB777819CA2163C431DE46F22F38398D46EE352B815B6B07E1A242B01A4230B59EA8C7B0C3C3DBE2B7C77B4C860660DAA04C452E391C710722C67BC0632C072FC1E5296A2E70932D4D38EFBB96BD636BB41260A7BF27CF5E71CE3708E6884CF0B8584ADC3CD3B5C5EE1003A13731704472A203C8F9B49534309BF2B60CC3E2448E02B5A46D889FFD78FBE722A709A2D5B5C8A7D805BCFF44052C553CB990AD016079BD87DB7573EB1D431D1E549EDC8AB56A0BF52999F32555E8EF2B03182BD8D812CCA638055A73B548C8B432A2A7D4A6A074AA212D50362D1382747CA8DBB95E03945D95B995D6346D7DB47B24B86E4F774F3767DB7996335B789733CB251F9B1EDD04F8F8CB7AF4C947AF224DFE0AF6A42C7B65120B9C18ABE9161D88CC5C4780FD74403CD177F7160281884A11CF686F0F523F39CB7AD39B780F13A8EE83C0D646F9D85BABEB306D53A7DF53AB00B5A1AA8C215914A48222940FEE10D1939BA5C93617690CAE113A59DE071C969436B3771FC50B2F4AA641A4C852922380A420FCDFCCB81816F4B474A2AB293A4D97B2B280CEF031148EA7E4C9C0DB7E7CD0E50B203A6B7519C3CBC8062C9B60B8B81CD956463B8180C67F34BE4868E3BA94B9F0226D9F010D9EC5EF0BB62C865C807184B96526D94170AF9474BBC100530F7C77E46B98C2AA41F92A48D8027C855C7F84684389BCC8E7C67164A204BC5C0C90828FAA439FBA235B6F20785CC8EF4C090A708BFBBE26E1933886CC96AD9B4562A119D4C66589C85BF0E55606886206734142D432C1B032E0AA93EE3731F069A8CC069A03B95A8AB873B447A04EAD3A32BE3054AF834882BCC581712BE18539B805577E50FF5D982C98C0B0DFCCC96A4C6429281068C8429997DC17A6600F0736B8453E3D77636FAA8D0CA89F9193BB34819CA1117EA368EA23198EE11345C613993EC052992954099BB9A086057DF0C5465326E1932AA50DA74AA8435D9294FD6B7C05A153F30
-sk = CD28AA8C74142A0508C2534D5ADC64284806BB2C653BB9783ADC640E9945C253AF86F57C19B42C6697AC85D1BFA46B5231559C11F5A0DA9B2BF43C40001D4E6C00B81237343E15A41DA190CF8940B641A4B42B72D9CC8BAC681369DC07D80AA62F135B0F956355A4A68E575F34393C42BCCEA68A7A63C269A5821557299FF63B9F0161368F6084132C8B56984F4D1626D7436DAE2596E1B24A86562374B066D2483A1B354FFF9766845480FF396F6AD089B724B0F15A34C2288DEB05A8418909803CBFE2F3C63C30056F358FAB798F4E385EB0E35ED0C38ADE7382787A2502D117AD0BC6CC0A4746AAAD23345F10074B21970C18EACC898472766B2313472DD3348C82F69B7D961CD35A8C61984E7CA20AE6382F04A977A72B532A1395707CBB7CD595E0DA0202498058E59F22E0C340C438851674E3AB1E0D872FDA3BAA7F87B67F449E6BB461BDF1CD771475D5B59FACC30181599DDAC8CE68DC2DE5741B21422FDD512B39D9633ADB202AF3941E323C9326297CB58086C3282F722C4D50B94B32153FF30B91F07A811A9D9E07B7667846806B6F7071AE29323156B668F831A9F79AB7949CB363DCC8D151349DB4B5EC1266E7F5AF98105C95C0A4D47648AEEB01FBE1113948B407FCBE199BC2CDBA40257745D765C6A0766012F19DF41A770E96CC95D3CBC70549F7E61914A73DC71062F2A3A377EC26DED59E0CC85B11A74F43C3237C7561CB7046C0E660B5BB0BA0634FF2B211438A9B9B906F241B04B2439F29A3CF0AD9128D683F0C2C26CA050978CC179872B1664A751458C072106FDFA07D97105188278268B0481018782F361D08555FE5799A0654398285B378F7A9F143CE20673184C75E8B662085899812912FB8A60485921B2F7B3FEAB95CB7AA327D8B9DBCF7C7256A131270B731E33F8F555CF4F8B7A1E6AABB4C83D2938B7B21BEB1C3B3CB3BC08BF52FC1F5715FA89EF8E205D85862F6A2CF420592AA24568FA0B8DCBB90D0B654C7C82C7411B6C3E219F46C352AA034C4FA0AA4FC47DAAC204B351497727B96714359A66466F6C4CC2B83BF6B87785367C7116489D6C5FEB975E41C4BBB2A3D8FDA920021C523227A438374D96032F62C41B17422584AB5880475CDDA8B7F4844E5420C25D97235B0ACF71012ADAB59298BC80052AAF1807E8015695D92184741BAD318BA9AE27C306A2E42C80512534963B70B9D0B7F5AE70326C33E7D43249E8C9CE386947C167C8F33C88947244989C45B4858203249FA5A136734153CD94F1AD467B5043F7ED77F58D34490D1B5F9E323F3E2146011921B8A9F94E419BB85AD965443E7F4A73534457BE43EE5F677A63A7738762B799600FA0B9CD328AE4CF507C1D9845EDA77C30BB7C39C618AFB402CD9B016F0092CB61E8BE13A18925CA122A142409B8DC637A364093CD76925A194AEDA21C61709255BA2DE330693B888A6C2C6F0C39FA5B4C7FCFBCC198B3253C0ABC5AB5EDFB438ED3A82B72B5F54A39D21C37879480C4A648F182A94EA566C598BA4CF697140A20FDF4CABBC540B80E8664216A6E880553899964A7B239D00C68E720706512CD2A58B9C49BC0ACB90283B506CA196F7855ED69AB21F059A11FA3FC4670D03A20A0337040ADAB8BD449E0BEAA93B07512485BA33F291AF1A44540BD04AF4A3DD2A09F6454D7304D0944674A580551061BA5F88217AA57C10640DC1A97396F138C1A32CF40B0BD9286F88C4087F9084A9012D248C63EFEC072D77AB0E736719A23A913B7B8B62AAA5BB40BE97CBBC1C29EDB283C776AEB9B032E2C2691AEC9CE89617B84B09712B40E2B713E566C714E0BAA75957D6BA5062BA76471357252B72AC66BA97E10921CA2313A232A6BA908DEA13645B5617938381FBCD748A11F61CBCB615C458D056F0D55A449C4F544C6673322EF106010CF139D1C586AED5A5DC210FFF7A60F3138C34A4244398B692C567ADE5BEB55C1EDCFCBD93183E1ED0C2AFF5BDAB67B51E39A58BDB8388D67CC1EC0D7313B7EC8A56CF3C9B73214C4ADA14592794749B6834E9B81A2BA47DE929E9AC7856B56549F40F38F0784BA0CDFC195952D3155222BCEABA0E3C233FF7E19A65822437217A42721F9C060AC2CBB9C4E6BFA9FC3014D8ADD7B4BDF78291423511F9874A07E06A82B6369FE349E08333C7F56B7B7B808A0B4E888A95799A2DF4873944CC43EB958B1508C66E571268E79A69178793E7A4D430507E1259D01C86F999C16772CFB7B4B330114FF55A51EE5407BCE95A6D27875A91773420C24F8734B3023E9DB777819CA2163C431DE46F22F38398D46EE352B815B6B07E1A242B01A4230B59EA8C7B0C3C3DBE2B7C77B4C860660DAA04C452E391C710722C67BC0632C072FC1E5296A2E70932D4D38EFBB96BD636BB41260A7BF27CF5E71CE3708E6884CF0B8584ADC3CD3B5C5EE1003A13731704472A203C8F9B49534309BF2B60CC3E2448E02B5A46D889FFD78FBE722A709A2D5B5C8A7D805BCFF44052C553CB990AD016079BD87DB7573EB1D431D1E549EDC8AB56A0BF52999F32555E8EF2B03182BD8D812CCA638055A73B548C8B432A2A7D4A6A074AA212D50362D1382747CA8DBB95E03945D95B995D6346D7DB47B24B86E4F774F3767DB7996335B789733CB251F9B1EDD04F8F8CB7AF4C947AF224DFE0AF6A42C7B65120B9C18ABE9161D88CC5C4780FD74403CD177F7160281884A11CF686F0F523F39CB7AD39B780F13A8EE83C0D646F9D85BABEB306D53A7DF53AB00B5A1AA8C215914A48222940FEE10D1939BA5C93617690CAE113A59DE071C969436B3771FC50B2F4AA641A4C852922380A420FCDFCCB81816F4B474A2AB293A4D97B2B280CEF031148EA7E4C9C0DB7E7CD0E50B203A6B7519C3CBC8062C9B60B8B81CD956463B8180C67F34BE4868E3BA94B9F0226D9F010D9EC5EF0BB62C865C807184B96526D94170AF9474BBC100530F7C77E46B98C2AA41F92A48D8027C855C7F84684389BCC8E7C67164A204BC5C0C90828FAA439FBA235B6F20785CC8EF4C090A708BFBBE26E1933886CC96AD9B4562A119D4C66589C85BF0E55606886206734142D432C1B032E0AA93EE3731F069A8CC069A03B95A8AB873B447A04EAD3A32BE3054AF834882BCC581712BE18539B805577E50FF5D982C98C0B0DFCCC96A4C6429281068C8429997DC17A6600F0736B8453E3D77636FAA8D0CA89F9193BB34819CA1117EA368EA23198EE11345C613993EC052992954099BB9A086057DF0C5465326E1932AA50DA74AA8435D9294FD6B7C05A153F3082F68B15681CCA5C2852C18D6E88BCB102A059C1D21936582ADB71790CC0A335273B38BDDC18488024EC90E62A4110129A42A16D2A93C45439888E76008604C6
-ct = E7657F1E554DDBF021C005B3B9453285A16D4D8CFBA2358A97FD2AAE89F83DBECD0447BDBE9589DED04BAADA5114F3BB1B4B775C8BA614008BA2D5929EDD4D3DAE28253164D131CDA2FCA2B1D4588E176892764848B62172F56AC74C2D9052347F857286781015FC8CC1888A3FFB77837B1C79128D15A405DCF2A68E47DC7FF1131C89E5268033C9304088E6924C59AC82B424122E5B85A55059198598E2BDB173EB0FE9E407B46228A4B16690097BC82941A66404EA7EFD014807CB4CE9D8EA9F4CD3B3A7643A5FAC11D493197DBAAA40BEA54ECB8E0FFBBD887B2501985C019D252D3D663EAC74466008FF6749AC901F3470E755269BBC1D77690F4880B0BF0FD8F0115C2B90BA408D3E1FE46A845A47DCBB404E4B12A296E304920C3828191CBD9B9C81A8BB02EEC087FC9F018EF936297D7A52339DF66396129E4A1C18820CB1BA69B26C9BF1B68C886F8ED7C4F61EBF2AF19402AE037D990C77FC2699D4D22683F4BD46A105459055C5C713E8C1DB1DDA5CE6A658184D26ECD10E5B1D523241E494396A99DD172372737129C29F8C74BC30858076FA33034C44997D084A6C5BC791C4E8C9869B1520AE29D7901B743ED50E9AD108B37132F34FD1D05FD4B5AE9634AE0B1B1C1C46FC1FA1B73A794DA19FBA6FE28A299E6EA7B738E45FD1FC0628968F32906D9486E3AAC29B488A17A7D6437A9F139DB14C0B6F387DFF426E107D2BCB3FB9EC5658B4351A20487C31AA367858355AFCF508F4B6740D912F726C45DE57359683FD9CB65F7F0BA8AB8A319830E6E586C293E953539F85A5C264C30721137128D0E0217D69CC195772FE97D536B8B47643B1A67B90E198D320652833C03F0C382A45F86522966303E3365C6F5B743C53B4F7CDB931BFC894211F71097EBEF6ACA00074DA9465528A82D24718D54473E333C9070EDAA7EB6DB2CDDC806F5AB277EA8EB3DD1C93EB6F433CFF71694EC6560D2F664EA4113CA1FEC25F37BA7083780A2D91EA6F679F3A40172154A053983099F83D48F3BF50C795A832C9F70C88407439607844BB27EBE20F602E0A88781B767D6C2002960B2BB98754A4618301D9973E3FFE8513615F8B0F13175376AE222FBFE36C8125A570719F62152C2945BA648F534B85CA8270CB7DD5B955E25961116DEAD8915466ED19AC772D256B7DE7B10A597E44FFCBB0032C85FC9E5A8F609E2C1C9BD888ABA0F0708B579729E6B7E5377641DDF0649D1B506677D316076E482A8F166CE186448E504B4B9607CF5F3AF8F7B5389049A79E15473F130904C3BD8DA512EBC26951134E767D6D5BAFEE7C6326FBD96DE4239B7229D69331E76EF0D165276E5A2D229D49E3215803E0B82A63E0B20231271DF111F1C27F9F1632E4F86E90DB18A4254521939F6CA60AF9BD7AF584B2109DB991D9E2B9223E0ADD7D5D92B597D0AE7657629B256B5ACEFA958422606C84EBA6C136925815007D126322E9854497907DDE52CB68F65AF75370CAF56467DD1D6E9DA860D26DD4F1E33006A6F41CF3423E58
-ss = 70CF00481198A97F14E0870C268CA55B6EF787D130A4C32314EB7C0A531CD188
-
-count = 73
-generateEntropy = 3a19577908efd37697b8edc7fdaf47d1bd3ad01a1b77faf794bee5b9c3192a6fa3729672816f3eba84c9638a79676eeac0f22c8a48e0c5d50a26ff0844c66b99
-encapEntropyPreHash = 74efa414ae171bf60b6f884cb7e5ce12028f49365daccfa23e845d551711660b
-pk = 611BA36D3A65C0D17CB22B7F3A682B593595B1C682D521A16DD621A05A7D22C9B2D29C9BB75CC5A8567ED3A545BAD39E2C85CEC0F83F37C6AAF101BEC273BCA5D606A5E76FDC183175A233C93373E956580A522BADD22D97D71199C1A7B4149E652686EDA541E69187A2ABB68F89AE9492443547CFDE7B5D609B4835911D154C33E49248C4CBB244ACBF03E93E52E71ED87A75CBC43C3F505422C1AC31C014E82009D4B13BF2CB7DAB16896A320FE6C0476F37767CCCCD80850DC94B410B983FBBCB484DD09B44A817FD95686106C710D983CD2BBC11DC4AE59091A401A6941BC704142C792C407F7524EDE1A71A726E2F921B0626768307C31DAB514A783FEBD67B50E93479D2C7D1787142F591607B7A5626A718D502B37A6F5B8766E8175C6EF276934A12AC1107AA3362840513D3F5C02042AE681181DCAB30F6810389DB07C3FA1790345E786031E3196BCC01C22BD064B2F9C439D7B7A7B7633232AAA4D88E0288CDB791049B8A8C64883637098DEF7C88FBCB974554AF0F3C51C70A758176215871227869766452871602093D6949E1D078691537D9D7030B36926147AFF8151CFBA202C0364795122D1D748A18289CDB33982900B38EF9AAA5D10D146985C757CE5CF82AE0A2489E0C00C83550D455A03FC885DC7A5EBCD71529ECB0CA13CE1259186F9B0CEB4B90789ACA0762C8BEE063780801CE365540F440B0AA0128103AE0F5B4A5D9B98FF3AEC5793E8FD046A7E15B517C5C4164105E87C593DB19B85792B6C705E615C4D95C38BC4BAB4F30737A20241A3189EB38865C6B60F6341DFB931626E729CE39313E122687862BCED934CCF88411730FD066BE831542ABC5B15A1CB2D3F0AEACE904CB419754D9A5CFA35D72E570C8D3B0BDE5A5B18201F14CCA3E3564C16769757A2DAA89B03DD993EC8B7C9FCC63098478AF1890346A8824A4B142F88759F382292AC404F436BD21282D6A3242417B36211C84B75F388151F087186CFC01E59383E8218039DB15DA50120AA1C5489743BC42335A774F8494A4244ACB6677B22A46224DF7BDD8A9292AE58E07F3068CD975ABB51E44631172535E52C910B48748A190C50D877903A4C7B9F4B18993669D254EF566058528A157428111D43D360AB54343ADEBC2A3636720F1E0C8CCFCB0FC3B71B55353C2682946408CAD171FB711CF0B3AB561BA6722647ACEE4B8DAF0AEE2C43352609DC617549841ADAC54ADFD3319EFC715DD917AB2B887DFEB49CBB6323ACB566E43638A5C9B6F865DA4157CC3F866066A551230A335510F55733CA4F3A6329AA0830894E06A05EE578C45B3117FD07D62718A9842CED5F49710F7B15741BA5B06298C550B96BC6FDB0561926240FAF09012E2CB49C66868E27EA318AAAC50BF882C5BB8E674381A96645B7A7DFA936201933C31955E24912E436528027B39F74A909AA5EF4653CC23C5E448BE6F81088FD322FBB1779BE52AD60005C2F57241932EA3B435C47A39E6E0477B989C00BD5EA71BA671D8A37DC64D36216CCEBB14E6DC7420C362926B555598B92F6A78061423A4CC8961D57733982FB8C78573C35584185FED801EA674A7FDA06008517B42D1A45FCC50416883D0963D3B744EDB5E8548C3B3DC474F7843C49A8DBFC939C41AF7F8EC6C8354AEB0C67E05EAE0
-sk = 8DC4A33D0A013D102A7ED6A5303693669033816BCE0C8A83594695531999647A48F6708C65220BE4D9A60F013201A36EE053796356B26E3617126C3D0A354D2FBB82312A372FFA37B939A7BAC8AD0E127F18EABC771462FC57B542A73BB7067FDE6BCFFE4982E6DB3394264D34DAB222318856BA8B6919C5A0A667866C0D2166B69AE04432C044F289BFD7255542CC7946B82C2DB388C8B656F234A3B607C2F6611ACC3A5A12C8111E42138ABCA9B8DBA79921A177682C2AD1138B133636951F5AA77A52B7554943AF52F7B53D0B84ECF44FD77018F7062E564C5E58753994724242D6B3A8F8A66DF518F7E13A0A5C1C4B253DCE12AE197342F5D72C296498BC9888EC347F528958AA689C8DDB81870184C9E2254F918B7465354826870300790044165216C8BC279AE93854381C28CB438BCE444B2258AFC3A84CD4F91DE8373F877B30137C4CE4664E4D330BF763B344489604E97F4C9C24FFC226D07C5824CCABE38CAE22487EA2EA0E89920F304BB911B401F45735089512DCA2298EA1A57F643CD7524A3D6C9F055B25EAA62FBDA318A7B8C8DC9C5CEA953AD5170C0452A7BC04469987712D0522256A1EC52961561175C32ABE93DC5ED37289B9D4CBD3966911FAB85FE47B3C68692CF5A845286BAEF91493E15C6D23437BF7517EC5CF609C8628D82FF7CACB54D4A5EAD25C85F59AB51151F9350247782459B598A2089A85F2C9BF66797E863A4CA0732268A4E40C57009D0C7D1AB1FF46B78E350DBFC19FCAE823BCC040183A27182ABDE00A966A6075E68C011AA62EEF913024CCC85B460098FACC9C4C81D17C577BC009B8F9416D225D156C4E75B84691A90948D31883B1B2AB3635DC357AE867B2496983CF9595423C541E3C17947042B3D141EF825C99862302BA911C67619434B3F9CC489E8C8ABAE92AF1EC3045C895EDB41F745AA1F3D1A625E47EABB49432129A5608571431C4890C8FA5769563B8B1F9BA3C1B77B034F568038865C90304A4F79F65F74C17FAB9E6B52236CB636EF5B686271F955A9E889B7A1EA1A010828AEA1A838DE1723F0149CF172F48890161C34039E99B36185F068B5707FA476D650BF149479B8C928F93089A4B941047B5B528135685797E0B9E65F595D9016A614393CFD630C6A217D0A03091853F606B238EE13C92C2B5D9E19B2C57638CE82A3D767639E115838B8EEAA5A47B7B686EA05CC088ABD47A10AE593AE39A07F55CB4C1347ACAF7CF59422182749E6AEC39D62CCB876094BA3CC0B871C57A03A00AD67C5C1C6EF911C6DC36B13CAB713BE1A6610CAA46DB4EBB86B76572A0BD60ADF163B325C89B506C33CC343C37A2BCA7CACABD90494F044B550778677C2EBEE76E03622705556B509C204087B5C5E5936C0153857691C3149521B800B76C43195897067529A4A87D68E974ED57178B7980EEE227E4150AF1234025757EAA3B645064202D632EAEA3943B40CB10922BF569AB2C44867C411BC8240D110134D78143D3D44B450056BE166B57921FE64A44F80968A1941D91A971E10C347ABA369702B1ED542984F28B6254BF61D94B69F015B0E32B05E8897502238FD21D87978EAAD45BF5997654B40A903319CA64095C9297611BA36D3A65C0D17CB22B7F3A682B593595B1C682D521A16DD621A05A7D22C9B2D29C9BB75CC5A8567ED3A545BAD39E2C85CEC0F83F37C6AAF101BEC273BCA5D606A5E76FDC183175A233C93373E956580A522BADD22D97D71199C1A7B4149E652686EDA541E69187A2ABB68F89AE9492443547CFDE7B5D609B4835911D154C33E49248C4CBB244ACBF03E93E52E71ED87A75CBC43C3F505422C1AC31C014E82009D4B13BF2CB7DAB16896A320FE6C0476F37767CCCCD80850DC94B410B983FBBCB484DD09B44A817FD95686106C710D983CD2BBC11DC4AE59091A401A6941BC704142C792C407F7524EDE1A71A726E2F921B0626768307C31DAB514A783FEBD67B50E93479D2C7D1787142F591607B7A5626A718D502B37A6F5B8766E8175C6EF276934A12AC1107AA3362840513D3F5C02042AE681181DCAB30F6810389DB07C3FA1790345E786031E3196BCC01C22BD064B2F9C439D7B7A7B7633232AAA4D88E0288CDB791049B8A8C64883637098DEF7C88FBCB974554AF0F3C51C70A758176215871227869766452871602093D6949E1D078691537D9D7030B36926147AFF8151CFBA202C0364795122D1D748A18289CDB33982900B38EF9AAA5D10D146985C757CE5CF82AE0A2489E0C00C83550D455A03FC885DC7A5EBCD71529ECB0CA13CE1259186F9B0CEB4B90789ACA0762C8BEE063780801CE365540F440B0AA0128103AE0F5B4A5D9B98FF3AEC5793E8FD046A7E15B517C5C4164105E87C593DB19B85792B6C705E615C4D95C38BC4BAB4F30737A20241A3189EB38865C6B60F6341DFB931626E729CE39313E122687862BCED934CCF88411730FD066BE831542ABC5B15A1CB2D3F0AEACE904CB419754D9A5CFA35D72E570C8D3B0BDE5A5B18201F14CCA3E3564C16769757A2DAA89B03DD993EC8B7C9FCC63098478AF1890346A8824A4B142F88759F382292AC404F436BD21282D6A3242417B36211C84B75F388151F087186CFC01E59383E8218039DB15DA50120AA1C5489743BC42335A774F8494A4244ACB6677B22A46224DF7BDD8A9292AE58E07F3068CD975ABB51E44631172535E52C910B48748A190C50D877903A4C7B9F4B18993669D254EF566058528A157428111D43D360AB54343ADEBC2A3636720F1E0C8CCFCB0FC3B71B55353C2682946408CAD171FB711CF0B3AB561BA6722647ACEE4B8DAF0AEE2C43352609DC617549841ADAC54ADFD3319EFC715DD917AB2B887DFEB49CBB6323ACB566E43638A5C9B6F865DA4157CC3F866066A551230A335510F55733CA4F3A6329AA0830894E06A05EE578C45B3117FD07D62718A9842CED5F49710F7B15741BA5B06298C550B96BC6FDB0561926240FAF09012E2CB49C66868E27EA318AAAC50BF882C5BB8E674381A96645B7A7DFA936201933C31955E24912E436528027B39F74A909AA5EF4653CC23C5E448BE6F81088FD322FBB1779BE52AD60005C2F57241932EA3B435C47A39E6E0477B989C00BD5EA71BA671D8A37DC64D36216CCEBB14E6DC7420C362926B555598B92F6A78061423A4CC8961D57733982FB8C78573C35584185FED801EA674A7FDA06008517B42D1A45FCC50416883D0963D3B744EDB5E8548C3B3DC474F7843C49A8DBFC939C41AF7F8EC6C8354AEB0C67E05EAE0104FBF09445794C0EA0654F5CAF70EE09D51C8386D4E1F467B10633C710AC2A4A3729672816F3EBA84C9638A79676EEAC0F22C8A48E0C5D50A26FF0844C66B99
-ct = 8B40CF1A2D7E21F68E130A85C5A680C65DF56B5CC055D26AD8E6A7E6E75BF88FCC88B5212F2B78521DF1A8F3B1A1D3091CB9270D1AA7865FD1E3AA8BAF208FC1A8B80CDB1D0F229489C15FB02D60F44E09E942D9E36ACEE57013F2F40C17477DC8D2BCEB137E92C140314E8D6F38328056119C757493633D2CDECA9C0E1E727F47406BDDBB7A9B056EF6E4D149498CECC738D835D0D99A5703B0B9BFF04883FB064009F6961363323B7C47E35983F04ABFC00F74A63923DA69CFE3784F8999F6E4ACDC9B9E06E743C03B4C0CC2A404DDB7654888DAF0FDE21FFB1A96D81D95EAB5EEA064938BC105439E287EAB89AED0824DFD4CE65ED0B8A8FFB674AE38BA39A1FA3A8DCF36CBA494A5855ACE0B4F8145AB9C636F1A4D6AF147FF23F94C021E2DA8D0D05564D6C85E502E753B8EE49898B66B6F078A99675435FCAB58BA8C9979761906986DFA4BE67314A3515AA24A0C2757A95509498E08EEB103AD02BA5711E2C84F25E651A611C5C5E48DE5BA54F9C2E6D9930D7F861D14F5CFEF3D297593ABB5E77CEC126846E15238FA7984D05E86DBDB12CB1D44445F9538F89FEE20F677F05437BC27068C61D4D095CC68327ECA3764972B494FD2838400FC3A6F6C64D4B17683A7E778C3807C6F1C1C6A4D92AFD6CAD80DE8C57F06BA5919B10AABA0605F19F61ED80AA119035F37D3F6D8A01E2D72E6C53E47489B5DC876CB99FA742618C9E5016EDCF26D78174AC028C832A1C1AE30514ABF95C35A35F9387D3A30946AECDB5642C0B84150FB8F0ED1DD06F59FE575330EE2D9D5675AE705986D1308923506D47EA2B2FFA7B92FC2C7B2745A07F6D331BA484145C98EF78736A77AECD75C56D719EF112646F57F6166986FA33655D8DB7D2171704C5D69AB50A9588EFAB7ED1B834D8903F2770CFACB204A4B143262AFA85E20DA03D94C22A39A9145B9143E4952722C2CC6DA0723566BB2EB9E1F2C30814A9B80DB5192A673D3A8E8003D30C910B9D31191941E824563B41DAB9FA47C6725986D5EC406B8E43915057D1EB15F68EAE588289D5C4D5AFC0BA4FE38D765786C4F4820415678F79330138D2FEE5E060DF6FAE9B1CAC289FE2D20B298100D0FF4EE76B59EE7DBCA227F4579BC507EB05AF390A2A445BDFE1885D8659A776F3DC6BBB760F93598DBF29F80108A2F007C901F158EE5328BEA6893550FF0E2B2C51FD5FE1269177149B89CE127A7097832003DF2A420FE8D674EBB2CFAF2385C13643ACF832E2D27309A6246FDB1CEC405F1C39AA2986BE172A48F8054989DF59EADF564D99E075CF9053574FBE0B5FBDB1E4E173D4336A8ABF77A6348CCCB49B5B1DC1D75ADC8647792D3A6C4AAB50FF8C0BED7E3A094D0A6882F4547317275837DC7BF460FD37A396E6A4F3E13C404239C58C9EC850FD89C7359F9BB2751FB60A932EEEBCDFBD21C8E3527E4455352AE13D402D45CA7948E6211CE31ED48FAB0ECDAD75D0FE5CF564D521FD2EC76BF52829606EEA3170BD44545B710F2D731A18BBA457B4530EF9BAC
-ss = 2E8FF9C053137CA6B6C31CE8BA7F14135A7E102C211E68EB99DE12B94273F9E2
-
-count = 74
-generateEntropy = ae0f65e29f38804a6759f70f4d01e2aaff7fe1c91ebc4f892dd0de3ab2e68ea5e03ff73e02a217659f53d8c47556bf3d8c94040f630d63605e2d0f923579370c
-encapEntropyPreHash = 0b4c3cffb2ba4380ead13dc0d8acad2356b448a810da1df29f264c44aab6d24f
-pk = DB0A138C9442FD3A7580E68EEC01077D31525465BABEF901806363A2D664EF8C1908A30491E336E27B0F8690AC71C30ADB145805A15FC654AB8982565EAA96FECB93A2EC7EBB697652965FC5AB837F6B7A20E224E4361977B71C694A88E5252F608CAC97E97DD7C80A5AD10D62681B57162269F7B8D812AF039226CE2A7930E43007C0B3EC6A4CDB3897EE85796D051CB053881E1B9706A572CCC75D0EF32F92610C40DB4553824F1A352FEFD979A310124B9456A9106367EC6A50DB6FE0B057FDBB00A46028C0D6A638BB7F2139CA6DF68F014C4E1E0B79670869353912B5D67EDD4B77C70C067AA76D174CCED6C7A901C65737082276188CFFE28BCFAA2604447E68D490C0F11CD22B8C351C2D63E7A01EE460BC408E174BC4A6CB023492C6EED42F5D85244EC883B1B49B8E3584F27835F21B6B2E6060E0671F289771D124168E196EDACC1ABA26CEC9E09FE7367F46893C2EA3677CAA3005E34E722608A3B64A3B987289952DD695A82DE89B9034390355C5E33546EB833F602CB9324C095BB4CF66C05FA0AB98D69BBDCFF155C3169F3DF2A575901724B678FB080B67F32240AB8F0198CB43176F6FFC93FA602748D591F0B2ACB9AA67A8D8B15C27140C320B0EE040E737077A8C9FD6A20DCB865FF51C41808757B0CA750C502A356B1C7D821F1BF804AE2B337819C5EA89542E079045C887BA6550E4F05693F5C7012424D37A17E2294669C0538CE69A1F1C1F121784E3C3537424BBC4D73CF1A685F03A24C4BA8FD603B328D2A07FA2B714DC1EED17693727732EC7BE2B02C0614CAF3D42B222061DDCD758A0674133E6CFC5362F855B717695ACDB971AAF16320690606C1C42238856D757B5D610BD64427F04C97ABE1BC6B0185116CBBB2DCA28B5D7A9AEE205DBD37E92BB36311C8936D958AA1744CA67332A600D8C719377273C7FB0029F27C75817746E1058DD196DE71B0E4302682DA21B4EC1BECA3CBDF690509573959D816CF5FA034CE01D6A4AC477E3BFEA75732678AEA6C0A5401C623DC225C7A9A7AE6A572F738387181913CC71B9379A5A2BBDC45773C6A1167FE756E13731F47226BC678331312B99428B07B2122B2B9DC86B01C5F090FF632FA83B598863C0B42623549CA831F66BDBBBB1D4747D56A97DCEF9C81766A3D90043C1A99CE5E81105E9113043342A539DE446A7C5F9C4B46A8CADEC388FBB8BCA527D90A56C649200CB2A7F968611934014F9A7B6FAF3015BF6494EF72FBA0C7BA40C499357ACC96562C65B9CA7C53231045E35771947172118EAA02CD95F7137C93E2159D9389607C3011A76363560A97DF950B0329258B0126C7BC10E4081CE46B7C7B0AF0752B038386E9AFA2D0A7543D85AB909376B618C0A2D33875D264B76941430E81C48832F43270160176ED5938492A06CC08392237CAA8487ABD3C83019000BB6671784109C7BC4C2A0362A5B5122E620ABA511C49CA42D75091B3B1ABAAD9B8162BC27F182AE310872E789CF05F6C949598C41C3B73A1A9CC0808E68F95C8AD8392F021F77C79618685DB2FB1D04A9A8ACB8441CCC764AA3B191736F5A24AE31C23428390C1C22C6A6052664DB63B94960A433584036C05E031A07823A03CA153015FB2665C77D8FCC529F21AFDE0D4F32CBFA399F2973D812F516C86B
-sk = 38BBB649E7520A59AC57783E32A5022489365713CCE30171AB46AB219B7E81369AF44BAB6F5BADCF613E963938A0829ACE625BD8594ED3C0981C5963F68874AA87685599041C4C296B4CC181E57667D499B2F961F44773CA958193E97988D816D702078C0147E41390F503921F139384D75EFC91CD08544536B4C9C09BCC2914A807E090D98B5C07C1A4A0C16FF0EAB557E5CCC1871BA1A36FF66B1ACD113FACD6BD16053F22CC85634A3D56E564E30862AA1409D48AAF92643B62009F8E206C2C8BB7F357B9432A8474349C3E1679F1D154CFD4A373665A86C481B9C3163308CF3A1A265A6313D0068BA2181AE5E5A1114995005C8FB574C4A7DA80562953348A80BC23CD90C37A2D166EE4E895F2A429AFF3C9EEEB869EC9982D367C5809396987A2EFE93DFDA2CF45E774CC3541BFE655A7280AF9B7601FA5183AB62682465FDB273AB435355B84563047BC4C6204AEC310D4B91E8B849182C16A57605A6F5690D3804D8857379E11B324977F30B461954A17CB16C4DD93761224A47F4C680373C51DE251CB69A2C737CBB1F76D7278033AE86480C7776CC7CA02393F333B6CC00C200AE58922756D3664A30D7B262302672C27A7496746F8F56797726340C734473522FA880819D76A004A480F48B74F7C6EE1998741D39FEC12759670B4E8057AEDC67950B929E200526BA5A27E0BBB67570BAE100B77D525AF70B7B6143A7419A35273C14B492E1E42C5B5918A62F3C829A50C1FD8715B030CEC454C90C72E6509AB1936AE7490C6B62A6720A840AA714F7B6B0134335C75C44A421598B790631E2CA497E256BE08910B69C01997BCD20591D1967EF5EC5C035B0C1F19A01BC0103DE6CAFDA45DB70950CF551DA2442741EB7233B36396C124C6365A83B66D9CC896FF448F54194FA05267B8154895173075039143DCC58062CBBB1946A917ABB184788052920D1428C856BAFB3461A463627EC7430671CE75BC2ADC95622EB2925A582A15E487787389BCF14DFD84801A37BC39136CC1A49CAB7CB924772606D48D3941BCCD3221EB418B12A6342AB6C357F273795339BBC720439AA9CD5A478122B8B01769EDB013686C8E872A4E2C049A755A8F954614665C61D5D9AEC7D67CDDB779512A308BA3CFFD5C4BC642C091226667C40957C17B3C92BEA102143DEC663B6155464AC7A9559C533A647C5A106C38972A26BEAB45C2F04C974C9BB860BCA64615B6F0782305C81862ABC973D280088BAC791876D3172D4E340F26452F60009A49989BEC107B680B62CDC12751F9079ED07C28143A405A600A974230B20719B0953DA3C2DA574CE2C31786C77600646E25B3C305F6507D91084A836366C273D62C526E0630F9B483CAF335D6BBB5BCF4ADEB4143443A07055349CFB690948487F7795B67DC2E45430E7A5C9564CC84CAC0AD0832480AA844417446B9B086A493B7AA163B76A50F35B7384BD054147A8621674843C3040CE06EAEC68B6CE8A2C5B42390C76350E10DDDB35C9F4C4A1CC148BA08601F92B2FB12C9088922C3463139239A62E878E4DB61A3529A8FA7905A7A1AAF90216DAB5026469B27D4122AF5561BB91D111A721A78587EEA259A4C7F6B743574398E30A119DB0A138C9442FD3A7580E68EEC01077D31525465BABEF901806363A2D664EF8C1908A30491E336E27B0F8690AC71C30ADB145805A15FC654AB8982565EAA96FECB93A2EC7EBB697652965FC5AB837F6B7A20E224E4361977B71C694A88E5252F608CAC97E97DD7C80A5AD10D62681B57162269F7B8D812AF039226CE2A7930E43007C0B3EC6A4CDB3897EE85796D051CB053881E1B9706A572CCC75D0EF32F92610C40DB4553824F1A352FEFD979A310124B9456A9106367EC6A50DB6FE0B057FDBB00A46028C0D6A638BB7F2139CA6DF68F014C4E1E0B79670869353912B5D67EDD4B77C70C067AA76D174CCED6C7A901C65737082276188CFFE28BCFAA2604447E68D490C0F11CD22B8C351C2D63E7A01EE460BC408E174BC4A6CB023492C6EED42F5D85244EC883B1B49B8E3584F27835F21B6B2E6060E0671F289771D124168E196EDACC1ABA26CEC9E09FE7367F46893C2EA3677CAA3005E34E722608A3B64A3B987289952DD695A82DE89B9034390355C5E33546EB833F602CB9324C095BB4CF66C05FA0AB98D69BBDCFF155C3169F3DF2A575901724B678FB080B67F32240AB8F0198CB43176F6FFC93FA602748D591F0B2ACB9AA67A8D8B15C27140C320B0EE040E737077A8C9FD6A20DCB865FF51C41808757B0CA750C502A356B1C7D821F1BF804AE2B337819C5EA89542E079045C887BA6550E4F05693F5C7012424D37A17E2294669C0538CE69A1F1C1F121784E3C3537424BBC4D73CF1A685F03A24C4BA8FD603B328D2A07FA2B714DC1EED17693727732EC7BE2B02C0614CAF3D42B222061DDCD758A0674133E6CFC5362F855B717695ACDB971AAF16320690606C1C42238856D757B5D610BD64427F04C97ABE1BC6B0185116CBBB2DCA28B5D7A9AEE205DBD37E92BB36311C8936D958AA1744CA67332A600D8C719377273C7FB0029F27C75817746E1058DD196DE71B0E4302682DA21B4EC1BECA3CBDF690509573959D816CF5FA034CE01D6A4AC477E3BFEA75732678AEA6C0A5401C623DC225C7A9A7AE6A572F738387181913CC71B9379A5A2BBDC45773C6A1167FE756E13731F47226BC678331312B99428B07B2122B2B9DC86B01C5F090FF632FA83B598863C0B42623549CA831F66BDBBBB1D4747D56A97DCEF9C81766A3D90043C1A99CE5E81105E9113043342A539DE446A7C5F9C4B46A8CADEC388FBB8BCA527D90A56C649200CB2A7F968611934014F9A7B6FAF3015BF6494EF72FBA0C7BA40C499357ACC96562C65B9CA7C53231045E35771947172118EAA02CD95F7137C93E2159D9389607C3011A76363560A97DF950B0329258B0126C7BC10E4081CE46B7C7B0AF0752B038386E9AFA2D0A7543D85AB909376B618C0A2D33875D264B76941430E81C48832F43270160176ED5938492A06CC08392237CAA8487ABD3C83019000BB6671784109C7BC4C2A0362A5B5122E620ABA511C49CA42D75091B3B1ABAAD9B8162BC27F182AE310872E789CF05F6C949598C41C3B73A1A9CC0808E68F95C8AD8392F021F77C79618685DB2FB1D04A9A8ACB8441CCC764AA3B191736F5A24AE31C23428390C1C22C6A6052664DB63B94960A433584036C05E031A07823A03CA153015FB2665C77D8FCC529F21AFDE0D4F32CBFA399F2973D812F516C86B0F353D6A29813D354471EB8B4C38DF93939EB3B1DB80DDD1CDD6558A9F2687A3E03FF73E02A217659F53D8C47556BF3D8C94040F630D63605E2D0F923579370C
-ct = 087B75B8A26B2B4E3C850D95F4504A5CE2D9F2400F84645F51D95F572DAD4AAFD3C99F5A8ACD682F7655E23765502705A4AF1574AB38705D4EAC749C78EFE1532F45646BC3358DC2188DDB8A271E8CAA490F81078A9DC3602948F68D392A22E62D584881DEA33F273F1B400C41AD60ED97C67AF9594F44340A49FA8EC7FFE1857CA2785AF21B5346F275D5303BBA6F0D4A0D5A105428B444FDAF0990931E49228C18F90B81A9A8B1B85466986080D0F8D5ECF6256484CA2222F075A718371D15C4AE79FFC2480496C93E2D9909A61AEDC1D29F583CFEE4CEBE3EF54A0A2727E00D5D0525679AABBDD574856CADA9A7A112DF04F7395910D9BEDC5D8B3A373CBD2603012AC33D3523D55C0BB4AE0472BC04C5ED974F6954CB4A7C0D9672BAC55840DBAE2323258746DF9810F0A3CF4C4155C943EB2FED097E481199BA5BD6D853EC00336C751D5E0E853A271FF1F735E4C431B3B349A0874A49592D416554C65D18F7C489DF1F8C633DF432EDBFBE05769FB6FBD780D89451FAF60EB9230F1DE745FA3A68E200FE2DFBACC5C530E6DBACF9022872C84A84390ECA3763402518857C111151F68FA31954892C4F52CB2506B4EC11E466C43225C146530C39387D065A3481DBA695EC9F3EC7FA0859DED1AAF74961A03330F47F213F68F2053840D488B09D72466EF48E3CC7AC30415B574DA8F45C636E19AE109693579D9D66AEFC5CEFD59DC4BBD71DD16F8A2243B113D04B0366B00799A8B4167CDEB34D3CA6ADD02F91578A31B97A4ECF993A34D40E69DB8FB294DFB3EF35E3FBDA0575CED7B1DD09F3C05D645A1D67B73AD22AF881C658D5BC0FDF5E03CD57C77996F22F6E55115D962AB57068CB6A83A96ADF997742DAC616F40BBC391BCE131A18B41FA51D3373E1A70BCB8E40E333BD13BB27C8B60669C610FABF07B83E5A7B908B116233DDEAACBD9511ABF1BAB725C1C15BE87F16C7C82237D37B3916D6A91C55B668801EB4C37E5BCBCB27CD25DA2D218C6FCA8D0AE1EFDDF6C31C1EF2F1BCC6AF451122FB9BF9E7F75DBB5DA4CDB5F55DFA3E56C099C34F624C83939A38EB99D3B734E9EC0959AFA21DE5C2C4BAAC40571218F0CE0193CD912788CA2794F9F48B7C23800FD0F312795A58F723CF1B3DFA86A5D9A1EC9D036F29D6DB54C3DFFF3731E1A0827912C0580DBE616D12B2904212189ECDF5DCFE363A07DD51C0CAAD17CF60AE567C4A2663273D3A639483665AF1A0FD17AC29B9487CF883F1F6726F49918E161419399ABBA4C60FA27471C61B46392940E83B447B1D56D98A2B64B907DE903FBFB88F9EB02E89C46CA3F7B963873F607BC7FBF4B1561DB504DFCF2CD78E4C5F859F49793AAE1427CA2D2FA70FC0E7067F7E5AED5DA6372E95F54186F72971FDED9DE28F7405AC23463A4478B1CC9721EC7D2D07A302DE94AD42E990699D71C7A5290CF3B65E316E3AE2CA9CD349A0A7F7483970B0179352AB93D4A4B110279C9E5D4B0554D904FBA60A710FCCEB98423BA7FCF5F6C73165B8D29D74058FBC
-ss = FFE9448FE824EC92022890969F1FA8E2FA87E5B3E95A9A155839177CD3C8E359
-
-count = 75
-generateEntropy = 6084a235f79dd093ef6d185b54e69df33dacee73a9bf2f379004421a10e3a79d9f684fb055ece19459eb464e91e126a7a6e3ed11ccee0046da234d964c985110
-encapEntropyPreHash = 1c82471dcdfca3a6942061ab4f3d5bf0d197321437c706d9cccccce449447002
-pk = 35A0C8EA287462D8CF8841CDC9016796500E61E89EFF672E87C667F453C8CCD148B94C9A9A3765649CCC6E1C05E5350218D091783B6C7E4958A0807E73E9839992C8C36A87891B7CE5D7122E38B5CDD745FEB1058FC2827B882DF77CB564323746855392247B054527EE862ABC91A557C431E55B81D23B1C1A94992EF540E07338FA944D24B17ED4E693EEB8224A0C5307202457C8033AA4651B2B30F85A9BD8070D1B11675FE240A1009DACFAB21D50036426A6DC9C3DFC05CD1612BA91DA51BD5A0F7EF9B235F1B3B2641747AB8A380B42C060357BF259548CB80788CB41DA4C7D3C4B9401925588920DF255167240F6B092C1329799F0039B74CBD549B2C053A71D4641071A3A95A460B2B3A8ADA727193267DE555E6CE87986AC06E647C4B7967CDBE5083C4B99A1B44B5DF58959C48BEABA0818608FD4046EA0C09A28416C6A97A1066C0650CA619D14A056252D38539F1C2676B69CC53502487389648FE596783BAAD0D7627CC6AB2DA5B6788410B67285841A323E04D037F25E103B38B07672248186C969B04661AC6B2753C5429EEDA389599B78E84608DEA89556A9510627B29E13B1713A1442158561DB8F435BBD6234A420618985DC4F71F0A5F15762FA16084F178E0E76BFC9EC5C35FB52E52301E6809CBB287D42B7591828AFE605CFCC93C337BAB78B55237B075A8BF08C48C15087E82600655234FA99F6987DA7904EF50A1599867D56760AE1D70006925ADE67157508289F137DEF9B9714F4CB72A017EE6A6325F9418F3A0EA3A8762C55987AB406DD9A6D248A33EAF264774AAFF6F00607F37BC20041D3A170E07407792A43C5407FB3622CCB065B74BC1A54F86AF9F7246D288FEE725A6FD85E82477483F778D5388728C4565467A9BA3216D92089BC1C742A20B03BB526B73573CDC91AA8E085F1ECCD1866280E791BD1E43D4843A440E050E2967DAAE26686CC2D32F512332CAC82095AB0005133023E75C9C92B0388BC8B2822A82F93FC3520972E2E0A062A388931092BFA8758F251895C641186D1B40F6A332DF3088BB24381DA133CE40D3461A7D87A93E702472E49AD91CC013C936B02A96C4CE14C2B23AC79869C6D139C8D85B58DA27C6EB4C4250BC3DDAA56DBBBBFFAF452C09074E013A3C7599CD5B8A876076523C6B0AEFC6A503BCEE0FA76407B779DB92453F7AAA4E58401CBC6F3718A3352013E1383B4222572118878C99289B91B02D929DBA06C6DEB6F4C2B0459F86D04FC8D287B6A676B17E45997027568BF7BCCA05C3D394C1557873711174242CA50CFA30BB3D715D1400807CC5FF1049CE720BE3C360FEBCCB61DD7244F4352B655A517485AB13B413983CC089749AC7144312966B2C67AD50096BC176142858881F09E3A075F8FA6BF638A13AF572BA026A172B23317A01A999C8C1EF478422CBFA9802F98F2856BD6A11F8584C532807771C19C411A2900C5A57C9B8E44B4C07B3BE3477BAA738AB2C407653A309D7A82CFC6B86A1B59AD1251E008598E453E04E3306C1877DC703869DA25A9B91FEC80AAF4F30B4D0A83E2DAAAC73990F05A9002D6ADA0409450454291E37112A9AD97147CC89999DC89A30C809757933C5D0356F329BFA3823D34197B7D9E60E307BBABD9B3E8272A0EF1B3333269A7AF6A5BB8740BFA
-sk = AF361347809757C2AE0C4A60393C90222C394CF136E95517552721FF136DCC234D64715A1AB43D15708187F89A6830791E0062CD43253EE486AC54179D320FA6A8BAC4D0C07B7158A1ECCFE52C4847403849982D73288877D04EAAD37D392AA487597F80F19AF7444E5A82CFBE51609AE515C1B320B6C75AEFC121D5E2904A0185654A418E5C7A379B41838ACE149B45C5A4040DD239ADA846102A6BBC811EBED4710B2393ECC4BB8C6254DC815D2667831F962887A74EB883A5A8642E0B427450D01321246A8797B7BE1211EAF64B0C706EEDFA17CBA2B010626112AB6B2B2B928DF38CCBD9B639B9C6AD090E92DA98B5C9914549BEB6A9B5505579A56943D210722BF590D63C1ED56534A96552005226C34CC1AC32572D2AC0823BCE348086096525188088DF229536BAC34A1C95083309A0971F31D975DE0598E4E009D24661B2A79DFAE85343B94FB1BC171493AD77D767E0814837348616205652EB4F98838CE536691DE8C3AF0A4970EB0C3600B4605841BCB0884E08BCA3198B04B2AFA6F575229C56462B9516026D32D2CE33A4B1ADD3B411371EA6516765F457613CCB50F94AB9395F6FBC94395A6C9C104CE3B79171A83A49B22ADD3A915086B804C3B42301BC1F14630EE3217F059AEF485C019A4248B4A78A516D75919EB2B15BB1E5A34CB6B470CA7A797BA1B5193CB4565497F98BFE30A7578044867897C332687D925C8BAB05D0C35693F557F541B571D6AB7E4A752B80267B0329D7558FE4BBC54C8612AA95C03F81641A129B1793160DBA78C4E0269E9361087328A73C67C0044217A25C2E05B64A1B8EBEC972606BC220B1A456D8BA86A76AC4A3C06429CFB6035EA50549DB887A5F6170EA282BCC295A2EF000F571038FA97B6BD98FE0399ECE3755D4B55E16261F7FAB678C394C83676CB9F080BCC915C8B1C67DC998D7097074249585E31C5B30BD0250ABC570531DB43F546C2E05983A7B5219127809987343CF722FC38525B2ECAAD2CA703679CBB7500420F83960D7505BB7B7B59A8B6F0C876C7A53D893A10468A516FA7A6A08C04D3259AD003DB768559E173DF06A08793B10E5A1A46145B6F0FBB230CA504424B4E9617CB3F509993567B4CB94CB2CB39811BC1EAB31B5F5691FF4108E5A6EAA9B15DC2AA45FC4AD26B9CA007A7C2A680ACEFA88F12790ABEC7E3DA1C13A355C1C669117070A7E1976F6859921E273F53632B4144B58E0A74207100D2CADE0C8A0410814D40A4234843A44978D0D4A173BE52434760423235F5D7C8E1F56C8181487BBA930CC9272ACD524EB6C9D71D753FE62B0E9BA33A478B7E82B36D9690607550ACA261085A08725281B02E531432B35398B7ED1355B8172776926BFE41880DF90AF6951A58981C708724DEBA6B6C2BB8AF1C0009C71A0B82AC0D14CB0910A8EC3988251DC9E93F17E067608115C85BB6C47D33A2A9359A35BEB47C3A04AB65537F59BC1EBACBED4B97855F753A954929B6449A4DB7D2098CDFC04008873004BC535BD5C74DD49247419601513C4E8125731307BC858845896A67D33902AFA4B58B50BE969B947851BBD791D66887CC6E92E19A2B92BA6BCC2825C4239AB2894B2467547FF3A63BEF65E35A0C8EA287462D8CF8841CDC9016796500E61E89EFF672E87C667F453C8CCD148B94C9A9A3765649CCC6E1C05E5350218D091783B6C7E4958A0807E73E9839992C8C36A87891B7CE5D7122E38B5CDD745FEB1058FC2827B882DF77CB564323746855392247B054527EE862ABC91A557C431E55B81D23B1C1A94992EF540E07338FA944D24B17ED4E693EEB8224A0C5307202457C8033AA4651B2B30F85A9BD8070D1B11675FE240A1009DACFAB21D50036426A6DC9C3DFC05CD1612BA91DA51BD5A0F7EF9B235F1B3B2641747AB8A380B42C060357BF259548CB80788CB41DA4C7D3C4B9401925588920DF255167240F6B092C1329799F0039B74CBD549B2C053A71D4641071A3A95A460B2B3A8ADA727193267DE555E6CE87986AC06E647C4B7967CDBE5083C4B99A1B44B5DF58959C48BEABA0818608FD4046EA0C09A28416C6A97A1066C0650CA619D14A056252D38539F1C2676B69CC53502487389648FE596783BAAD0D7627CC6AB2DA5B6788410B67285841A323E04D037F25E103B38B07672248186C969B04661AC6B2753C5429EEDA389599B78E84608DEA89556A9510627B29E13B1713A1442158561DB8F435BBD6234A420618985DC4F71F0A5F15762FA16084F178E0E76BFC9EC5C35FB52E52301E6809CBB287D42B7591828AFE605CFCC93C337BAB78B55237B075A8BF08C48C15087E82600655234FA99F6987DA7904EF50A1599867D56760AE1D70006925ADE67157508289F137DEF9B9714F4CB72A017EE6A6325F9418F3A0EA3A8762C55987AB406DD9A6D248A33EAF264774AAFF6F00607F37BC20041D3A170E07407792A43C5407FB3622CCB065B74BC1A54F86AF9F7246D288FEE725A6FD85E82477483F778D5388728C4565467A9BA3216D92089BC1C742A20B03BB526B73573CDC91AA8E085F1ECCD1866280E791BD1E43D4843A440E050E2967DAAE26686CC2D32F512332CAC82095AB0005133023E75C9C92B0388BC8B2822A82F93FC3520972E2E0A062A388931092BFA8758F251895C641186D1B40F6A332DF3088BB24381DA133CE40D3461A7D87A93E702472E49AD91CC013C936B02A96C4CE14C2B23AC79869C6D139C8D85B58DA27C6EB4C4250BC3DDAA56DBBBBFFAF452C09074E013A3C7599CD5B8A876076523C6B0AEFC6A503BCEE0FA76407B779DB92453F7AAA4E58401CBC6F3718A3352013E1383B4222572118878C99289B91B02D929DBA06C6DEB6F4C2B0459F86D04FC8D287B6A676B17E45997027568BF7BCCA05C3D394C1557873711174242CA50CFA30BB3D715D1400807CC5FF1049CE720BE3C360FEBCCB61DD7244F4352B655A517485AB13B413983CC089749AC7144312966B2C67AD50096BC176142858881F09E3A075F8FA6BF638A13AF572BA026A172B23317A01A999C8C1EF478422CBFA9802F98F2856BD6A11F8584C532807771C19C411A2900C5A57C9B8E44B4C07B3BE3477BAA738AB2C407653A309D7A82CFC6B86A1B59AD1251E008598E453E04E3306C1877DC703869DA25A9B91FEC80AAF4F30B4D0A83E2DAAAC73990F05A9002D6ADA0409450454291E37112A9AD97147CC89999DC89A30C809757933C5D0356F329BFA3823D34197B7D9E60E307BBABD9B3E8272A0EF1B3333269A7AF6A5BB8740BFA12E89C47142418C26396EF0174C02F69DC00022D56494D31AF935490EDEE63859F684FB055ECE19459EB464E91E126A7A6E3ED11CCEE0046DA234D964C985110
-ct = 1F2D0A172AF9DFCA569878612151E46E0784B0F2DF0F81A2DD709CB8ABF57585E9AE0E68B50D48B506C84A8710F42826A0CAA795495203ACCF99E76AC2A06B184C9C3F011367F9431A4EBFDD0F57CF8B3B5F0BE55FD0A1EC018E1A2D898D1F126980CEBCB135CBCD5A23E9468261C46592082D9712DEFA7913999386CFD2F69F7907D28BAD9E0C1DB983DBB9645BA4CFD15FBA1AEFD667CCBB497AC67B77C382DC498E5E4407B5E3805FD1680A723B6CD64FCA2A962ED8117BDAEB3ACEEFBB7B1D943B91AF4CE217842EBD7B67BE89774258C2639EF840CCFF2E1C0B0F1B03FD536366B99200B48F110E9ADB48A9AC3D77AB8BE563F5B89C50309180C4233416CA2B0606B7AEB390BE541A468B878E49C79AED0E5472539762C859E1B04CA23BE4D12ACE5C9511B9AC563272944577CDAF9495F95B55CF91BB2D4FBDCC513452C32F080B11FB49ED6866FDD443C3BA3581B9DBF550CEF4B4C18E7A8E2DB5E442DEA3C09AD5A3995E5D4691D13EC4710C1ACFC2CA3CFEABE621D54AA1E13DBF3FFFEC5189E2DFA14C382F21D17EDD9CFFDEDF5AA835301428110333A723EC6A8BCCECC0B93C62A763105F1E32F6F6F15B31DDCE5F6F95052A50CADB5143D195C47B317E7633D37BF11DDA9F0698299BCD25CF53DF532C2684EFD4B6166BF5F5EEA80CEDBA05B8703513767F158EF78D1E19DBFE7B6F38686E8538B6924A0EC78A5D9E4E2A12D4F3EA7CB55FC334486AE00F7A9289694FA7B59C64C2DFA003015C9785DEE363E7825CDD21815521E4438DF858EBA176E1849305D87E0D128CE5281EA24B6DBF821025DE118C52DDC6B60ECF5E527486FFA58DE8A1EE1C4F3314400A0C72687617A03E0FCD606D4B6A4A36B777FB333661DA0BCE06E96A497B5A2B915FCBA5FC8E652B486E5641BF62FBF01278D62C73884EC4BFF145674FB8220E69D7EC8ABDF220AA8F44C90EDE9B1EF5A026817E6BD389C365FDCE6DA3F268F3D4B1C98C9321098D76FAE308278FE8877F7E3A9EEEAEB57DB7B5D9CF671B969AB9998B048E4B37787ABBF9D6B384EE41756EFA4B2235C070A7017475BC808FEBD77A6EE3FFAD7A686BEBE6E84BB3B0C8537399EB39292FCC986D8FDDA05DC3E358E5CA02FDFEBDD84AADD7F78E77E2C8FDDC372E00AB5332683D6FD2BC00FE3758C616CA954CEEF955498699D653F3E35A22B5B8A385588EBCDA436A9DB907A5B069BD8CB0AA5852EE037C31D9C3C7A6AEB30624600D33625DE5DFC69CCB4DFAF0876F9A85536AEA7F67ADA95CE0C3426B9F3F2C51352D721B2EC3862A9B57B4CBB3495CF41883FFB772307166227759F745C9904AB2ACB946E5D38CE5346B9EC712E623F9D4F9DE43E5BA41159BA3D6C18F515CEB0775A38A2DF97A042A6673FAE30F1C957CB6B6E1A1E9C90992E03CDF0D2D79B9EF3D00639EA26BD33E8495958D8696FDFF69893B956E61024137C207FF6B46C2E00C1CE77BE0F3AF4DAA3743E420C2521640A159891CB26C539E1BBF35F6833D64E62FA1DB57904D88681F
-ss = E3F110E7D74400CB476B0E34141A107D874986A3732ECC103D9BDFE76BD492F1
-
-count = 76
-generateEntropy = acd1c0217fad5caa4235544dd9de153ab1880ccf4c76f16f236fae4e4bfda04cf03a8abb0a5010f400ae5722a75bdf5a2f6d5b546b34d73857cb1bfc7e587aa7
-encapEntropyPreHash = 46fe60a18124125ab93e0c578f1c02f1bd1301595013001c7f3c2fa56cde294e
-pk = E4749BCD8577D50A102352B869402EFDE59F5FB54BBEE919E7D4A8BB8CC40FB8C7240401113152BA727CECFC8E4B817C5D537DF050902BD03DF866317006A2AEF59CAC269813A47FD337A0C5B694F4B080F100089255614634A2B0BB1ECBCC3F1D84CDFB3054FA749736E531C2E673716079CF45C89B444B7D821D892C7EC39A74D39B815C2B9981CA47F5E56840341FF9D23FC877285F9B90FC78BEA1B9C5C647AC52D066AD7B8CA2AA01E0729FA22C39D9C3C6CD833C6AAC061AAB1C1EE6819D2A245997B8580A9E1630112CC6B62C4952215A3281111675F25A10CA0C32BC68C7BC920BFBC7BCD82EDFE130B0434AFA29B2B9D90AC3F1143B5664E5E51984B52D976439794507D92CB256A1520078972B843FF3DBC6736602F68B289E0850EE845E49586C889CCDC104CBF13470F6F6C0E6766007E5C3A1348166933A45A1A62E0B749EE14A38E11A094BAE60A38C84079D81AA655782138671A0FA186A727457D351A8A45B6FE05369F7B158DE844E31117DDC47AF9FE52075C6ACD5F93A31C38EC7F608FF9096C8562E0271A35FA7265A56B24BF31C6A727376D1AB3F600573342E60884F41D355B2336E464B94554B7C108614C3394FBD561A2E74BA7045C0D74032877901E4F8A95C41CE9FC72013C51FA93B5C0B3C3B0A8C90CE0960F510A9F6A453B8B0012F7C2430350B8A4B6143AB5ADC7AAA6F3533E230C3062B7CAA33B1E9A3BFDA7BBFFEF8341AD0A33AB272BADA717A4790F4C99CF430BF114B62854810EAB7AF582A2EA327A599C490E25795CC5C42219771391B33DF4C7FC01524C4C520EB4559C2EA8C38AB5CFE27035C756248662C1E969EF478A2D2419ED9DA7125EC32B0557EDB5B77E0DAB221544E5F7A57A2941B89B803ED1C7D8DE65F64A29D8E7BC2020B723D391987F83DB0BC35E96AAE7B2772B37159A3257EAD277532119CF55959FBEC482169C5391A9409877C79255CBD1C8D2B8352CBA074BC4714DEB09F9CD81624D2782DE91EFBC30882C45631E96E35C9B53F77CC0D268722BA5EB858A1DE719A88EC240DA229CD7766B9A237641C1277C006A6672BF61AB5DAB4C223B7381FD3C16704CF7920B2F11210C969B6B46A152B72598DE4AAC1665D72A45BF51370DE61559F83081DCB6AA49339E489968C80498550AFC467C8AAF0C6C1B9085699B801C75EACC3142BE38DE6F6A64AD6708C426EACC13B09D8BEA819BDC200258D31A8D1F308D0A7470DD35161379191576A03B81D70EC58565CA7C4A6BB333338D8113D70F5BEF45B6835917E17C2945A06CBB7F2225675252F351593B06A6DB504B6E67C6E88763FB06879187C5053029724B3477281CC5C5294B36B64F12A08084EEA098489D5CAD338A0CFA61231268BB866C2C524C71BD6A467C845AC7A4EAC579049734970859A2EA753C6B93EF01532B130A103C6244A17870B75023E0014E6D8433AE5CD2B145BFE253A8BBA300B6465FCE277E2FABE36D6C8112887CB0A6DAEA4A54E258CF89071E407594DE1BF1F4AA2BEB50263DC5D5FC729B632957375B5CE6373D9B93211A66A29736A6ED616EF8538E95C45BF595B2EB743D79436D6385BAB74C80D88C1A1F4022E6C3BB3D2294C474C2C554F3BE4D7FAE86455763B97EC8FDBE9640219B35FC36033966A3525D485F1
-sk = 31CB44A14C3FF840758055BF2AFABAD14A723C048D4D20C5908BB781844D574A96A0807C59D5192548A0089396A78B953AA52677B9A111CB012954B674571C5D0C7C5E6488D498290F7665F4F32DBA7228ADE2A724413798EC32619901215663B2C26360612558070BD06261BBAB86B4F96056A498BF37B1B84238C5099EC8F1AF4251C0862B861F334EEE85AF8D364A54F6BAD0E44A23A0577933CA8482889A955086EA3A2C94B057C1C20D540CD6D2976126854AC123CD386A855CAA385927318825494861079AC84606AC0F1810EB78A8398740BE69CFA1777C61A5CC1D758AE28C072D6087C379A567648558AC8A1883734C64361DB33CDD156FD371A2ABE534B162C6E336143B944DC2309AAC106525D6586793A2B3420358185FC787C2CEE3875E3425BE5627C1D49313413EE498B17E8C295908B718B3C4A6E03024D77F1EC37EAEB7462E09C683CB9B272431EF0ABBD0422AE2569FC37902AB90BD2C236F4DA66D78301A61765A77E43ACE81102C7355749C1463B55F10E26727086D73A1800924C6B0EAB6EC905D5B01ADC538C9EEC7A25989B85F24B1F68B9A22637613E9ACF609A67CB20B38BAB1A8D81CBD22A5EA8C7587A13BF8EB8A37E5949084C26B4433741A31C502A4C412535FC6A1C5000057C65103027F78F81DDFC4A8843C59F8563BEBDA15DA543BE2146A3EB7B521700958BB2A5064923236193D981BD1E2920D00B1CFC504E32495DBB116C5BB7AA21B6CEC5C9FC0B1AB73330544E7AF5BB1CEB7C159E3509938D0332CF51ADD245606617DCEC688F117BFEDC27DC5B8B4884446861B592B720B53FB23CF08513F66C3B51833E51B9A63E297054A8C03F8BAA257C64C2C8A265A8A92052C41146BDB3A32CE0B7196AA33564806DAC33AC05A20178C2A0CB04000D484F0325C9D16956DA0AF88F68BB72B7BC6B122A486CC1EB01BD3027AA316C6D7C1AE7D8B9A747443C5D7237989A93ED939D905832E76AFAE4172D5F70589E54F7B5CBABB536E5F316B3D38911513B400AD83F7B2A3C72A6C09EA3B4F68129ED285FB99442FE61237D61756A2AD78B7790EE69748B79E42EBBBD6B9B0D803A3EB77477609AB2CEA5920128356C369878855126C22F1AB66A3A4C202892C8863B609F7926175CF1E3967EA93B7ADE7A8E6779672023DD5D81BD4D9345AF36A38DB17E96B8D85B7C0BEB586AEFC9FD9EBC585F071C1B9C34FA2283A60884A0CC5EA210887AA677D24192DB582F05117FA189C868A3CFFE8B2FB584686EB3D009733E1D86C07D6A9893C7E9410B4CA99A4A880B48053878A45340D0056031068A63113BE4B51A630016875541E099935EA92B2668AE84C5A183CBBFED619691038973CC07B72ADB803CBE26986C827AC75428CF183CD5FE7C9C719378438058F470B62FA977DD658F219983F97B517BB1AED01A478A18DBB89AC1B916419A3B25F388C276C190B866356EC84C33B29022286C08A34D26948C59341A789CFA168ADC0C7A73DB36A72EC6C2C688C06AA3EB1FBB25B7B828CC3719C7B2473719F4E2B5C4AB8A4FC172A132439E0E3AF22A1BEAE17BA4CF39A155925C62A4C9CA76436496646906630B9349A335A4852C01B018F77DA15E4749BCD8577D50A102352B869402EFDE59F5FB54BBEE919E7D4A8BB8CC40FB8C7240401113152BA727CECFC8E4B817C5D537DF050902BD03DF866317006A2AEF59CAC269813A47FD337A0C5B694F4B080F100089255614634A2B0BB1ECBCC3F1D84CDFB3054FA749736E531C2E673716079CF45C89B444B7D821D892C7EC39A74D39B815C2B9981CA47F5E56840341FF9D23FC877285F9B90FC78BEA1B9C5C647AC52D066AD7B8CA2AA01E0729FA22C39D9C3C6CD833C6AAC061AAB1C1EE6819D2A245997B8580A9E1630112CC6B62C4952215A3281111675F25A10CA0C32BC68C7BC920BFBC7BCD82EDFE130B0434AFA29B2B9D90AC3F1143B5664E5E51984B52D976439794507D92CB256A1520078972B843FF3DBC6736602F68B289E0850EE845E49586C889CCDC104CBF13470F6F6C0E6766007E5C3A1348166933A45A1A62E0B749EE14A38E11A094BAE60A38C84079D81AA655782138671A0FA186A727457D351A8A45B6FE05369F7B158DE844E31117DDC47AF9FE52075C6ACD5F93A31C38EC7F608FF9096C8562E0271A35FA7265A56B24BF31C6A727376D1AB3F600573342E60884F41D355B2336E464B94554B7C108614C3394FBD561A2E74BA7045C0D74032877901E4F8A95C41CE9FC72013C51FA93B5C0B3C3B0A8C90CE0960F510A9F6A453B8B0012F7C2430350B8A4B6143AB5ADC7AAA6F3533E230C3062B7CAA33B1E9A3BFDA7BBFFEF8341AD0A33AB272BADA717A4790F4C99CF430BF114B62854810EAB7AF582A2EA327A599C490E25795CC5C42219771391B33DF4C7FC01524C4C520EB4559C2EA8C38AB5CFE27035C756248662C1E969EF478A2D2419ED9DA7125EC32B0557EDB5B77E0DAB221544E5F7A57A2941B89B803ED1C7D8DE65F64A29D8E7BC2020B723D391987F83DB0BC35E96AAE7B2772B37159A3257EAD277532119CF55959FBEC482169C5391A9409877C79255CBD1C8D2B8352CBA074BC4714DEB09F9CD81624D2782DE91EFBC30882C45631E96E35C9B53F77CC0D268722BA5EB858A1DE719A88EC240DA229CD7766B9A237641C1277C006A6672BF61AB5DAB4C223B7381FD3C16704CF7920B2F11210C969B6B46A152B72598DE4AAC1665D72A45BF51370DE61559F83081DCB6AA49339E489968C80498550AFC467C8AAF0C6C1B9085699B801C75EACC3142BE38DE6F6A64AD6708C426EACC13B09D8BEA819BDC200258D31A8D1F308D0A7470DD35161379191576A03B81D70EC58565CA7C4A6BB333338D8113D70F5BEF45B6835917E17C2945A06CBB7F2225675252F351593B06A6DB504B6E67C6E88763FB06879187C5053029724B3477281CC5C5294B36B64F12A08084EEA098489D5CAD338A0CFA61231268BB866C2C524C71BD6A467C845AC7A4EAC579049734970859A2EA753C6B93EF01532B130A103C6244A17870B75023E0014E6D8433AE5CD2B145BFE253A8BBA300B6465FCE277E2FABE36D6C8112887CB0A6DAEA4A54E258CF89071E407594DE1BF1F4AA2BEB50263DC5D5FC729B632957375B5CE6373D9B93211A66A29736A6ED616EF8538E95C45BF595B2EB743D79436D6385BAB74C80D88C1A1F4022E6C3BB3D2294C474C2C554F3BE4D7FAE86455763B97EC8FDBE9640219B35FC36033966A3525D485F12FAC52CA60594E514333EAD02CB1BFA5CD1D9ECDA4A0B25CCDFC47AD3F632A85F03A8ABB0A5010F400AE5722A75BDF5A2F6D5B546B34D73857CB1BFC7E587AA7
-ct = 2C0B8450785EDE64FBF91E190C6B063F50B0AA80BD41C9AD969679FEFC58C69E1354C123AB70C1AF7E44AC63C8A8062E5BAD5313EA0565966301BB0556FB4B7C490463B6CD940AE2D9651A274323F799E25F1888853853C5EC2A4FD34F8AFF4159194E3FBA5FAD3C799CE439C84094C028EF6FC333FBDF19CB40BA8D1228B97CF602A0F7FDE3D15BF5382EDE4AF8A4C6BDC6732AD363735A28ADDCA063AB702F1BF656B474985D31DD68B51DD92E773D3359FF8A02BA792A06689C37EEB3815DCCA7FEB88BD5ECC79E5404ACA3621B3F81AB7BD55BBB293058F61BA5A93A7FEB9A90617EAC208DEF7C6737B353B4C3155B59726CB97A211E1DB42CF2F6805DEE40A68A966BE225A4D94542E9B972D3CF07F3D81EA54535E25AA7F56B8160ACDFA6097EE7FCC81A6F9FB05FB975BBD18315D68740FBACCCB17ACC9132B6622FF91EA8A2AB02CAE313D67A11DB654440A9B63A819A9A51AAA593FE1AA99D70A6ED17C99A25CE4A424DCA9EF9E6DF285818ECE4D4D596505FEC0DE68DB54F7EF7AEED7542908A8A47E07BC69DC4AD657C66FC97C2F3E79009C14A1E115E77D17948D9D599EB85D91F3B07EABE2BED6C549672A751FC75ED2FF131210A14C03987F09B61E24B144C4F7A64D8E0BE83642777A8CC9897379649DF060E5173F5C09BCD2C630DD7CDD51BF995A053DA7590DA319BAA2F8AA4904443AB1E9C5560F3F3624A744A20EFC8F2F7401DF81A228003CFA0F0196F6D57D0AAF7BF962994A60857EB5949BA5ECA8683324CEDAE9BDAA636B1EBE97F43C31A5AF9C51E78C6745231A3E5ED0C0B1E637FDA928F02A3C04B6BCE519EC653971F74E07544EBF78F0F71F58081EFB797F08EF9698A6665889DD1774C551B30158F4FFAF9B6C3E2E3A34213E4147A8437B118C12F5DE786D0EBCA5BB74AAAF88885EDBFCD96A3CE37864D522F7FFB5A1516E447EA2185451B408CB880721B09BC17F33A75C1B1DDD2A33D74D5F24E0F658E4DE0B049074992FF844F90B6E0D444F3612E7C53502643266FC97CD6D94899E5C131EC29F472C991BCC618C8E8786F83952FF53570D32A46FA9CE0A88CC4F4C2A84F185DE78F7CB1B428254886916000E4F030859556E2C5C172A7B73CE74999A58DB2C48CF23E55C43AF92557484DE624ACE9C4930B7A9E0BE561788D645BF8CB2EF2DA50CB04BF3889F39801686B8ED02D94B7C8A0DD936820791267AA3443AB4EB85CF794A80E96C2BBA992FCCFC655FB130569F9A2C47B54A0EA5EAA76C78A56729A516ACB6FC67067467518D79BA9CED47DF8E13113B12BBC467536994E1ECB8628D86AF891B30F4545EE20876340141B8043C0022031070691FDB2EE4F9A043F2AE05693E62434581900DE61A659769FB901460A495D90EEE56948FE26C517EAA0905CA92CBC47BF9CE4FABB881A6AF68EC1EA10AF30933BE24B791A0102F29733D9C1251B679F1CE2F08AEC8B19C75C010822A8439A704D51AEB55B63C958DB26CB0F839756FFFA5D1465E7F3F40661ED966229C193
-ss = E26737292D1A1FC6772D9C14F9D74F0F4E830C0BA04253AEEA21E69830A3A360
-
-count = 77
-generateEntropy = 241191401a63afa750f05662e354dddbc683c776ce3222beb83e3cf913d7ed7ca59b3bd23b49a95bc1fad20070fec930b6060bd827d742b077092e422268e15d
-encapEntropyPreHash = 52fb7cb6a633fd2e83f2892bd9441b48fe59ecee6d026f5246fa7f2a5e55ee3b
-pk = E26411E0CB6648D36C6236468793848AA4B7F4510377E0A24BDCCB712BC98CB21CEABC08101328D3D032CFE9C82D21372924C69AB5A402E9B3D88C87E9BC5C90335E5AC231A1B87EA3C2527B82445D7C8596B10A609616E4DA431C9593B91A1AA21A2E436A359A7A5901902A6B516D562363BF95890501AF4C5946626ACE3F276AF8966709CBB9B666B9842102F3077978E4872307AC65EA11002CBE4DD0BB83677419B89C9E0C9847FA6441C86B8B601663E40357831D1B3C21B4A8985ED50E546C2917F332D4ACB59BD64D9BE88EFB981362458B8D868DA7EC516EA9C807A29C5D51385781302072C1F3295DA2559003D4265CB330F43AC5B774562C182BE83636FA034BDBC3CB25AB6C8C21C69B873329321533A788287A40C1659F457C5E6E15456DA54A7FDB18C8BA246447606F2AA340A48B4FC667D7E67EFEC47910E05C3DA4463B75359668821711530835357B6A8EC62A3E7817C508C79754063F7110362BE73416A46533341CDE577C17A75B3316AC59575EB1A1575EC0104EE77F70941E91786AD457832E1493466A3FAAA55911E9BACEF8CE49F579F1753B5138797EF827F0BB0821EA69BD9C43ABF2181D0775FB64B8694C74F0323600FD3E5F1BC5CBDACDB2329928247E4759747C02CDD924CF1C93BAE5C37BE8C3B9C7E09B4660C3B9901EE33B62350A695D799B52743D5158C015CC609E891C87F9BA02616ED2D3A1C14AABEF101B4B42AD5C47916481BEF01B11B9496819AB76A428C0F5B8A69EBB24FB5B3407E1C22E2020341575C7098E63379406C9B60B6A1733C171682B1776719DB5ACBD2AC6AC4B97AA0A3C8C168A5AB389010A01B4DD01829EE4A402E54E633A229A94CF96E01F72EC4054C13335B89BD6E91E965BC324924C028B433074C9705AC4CA2682FB1B385F058D574515319397754CAC9F68CB70022882A24242D1C3F1242CABDAA4D68A91DDC8A22C939BDF1539645A912A33C1D11A5849211D831ABC2C86834BE35BC3500CC44522BF9ACA86988AAF580BF45A5FF7F8192E110E163356B8A52486F772204BBBBC19BEFC631433F081E8556579D288B3B27C1A8209ECFBAA30A82B34EB722FE2BE60534E2F625C0AE477826A9E75B7C5AED2398525358BF0AD127C15915133A32A9ADD47A72270A98F942807FC59F2420E14365A758C534F289160A65CFB34619C7C9B2992083CC699F554BD64586DCF379605581711D607235C944820CC28416AC761498D8B54193A8CAC8B815D7B19A21B02A6D5A737C4984F3A888C0B9E3F51B95ED9430327642A082787132E94D6C26B298B77554E7F2237AC286F419266580697FC9316EC1176C4D763B194C52D79B25604974C1BC899560B72094701709797C5183391A268853B9FF3AA277C707906BE0B078FD6619050E14B48BC73F877BEE69A3EBDABBB8B2198CF51B14B2CC9ABE673CAA803B419BE1C34B6341C2E83D2013152B557A87AC4FB55C5C86CCBBA995492CF960479B044B3D6233317677C78A453D4E247ECDAB3FB200C3D2A0564C4100A995C4F70597E498CF0897B507AB35E4587E2B875030303DC2CA8CEB41AE2A9725085C12040C8D0CB20ACE46F1936725BCABD60D0B880F7AABC887090195D95FB6EC060B5257AC37481FAA2ECCAEF99C0DA37285D53BAEB0E25BDB9
-sk = DE9A3F4DC6A54E98C850E3AF0F7ABC5CB5B363BC668F2C10C6E197927C89E57088C4960C46B767E27129FE78C7CAE38717E6A2A7FC16DBC1582AC697E8915C90281A0A784C4B75345A13161BC6A586166D4385B507748D3B9516B10550F05782125C10F3761AEA2C631AFA83870C003950B891D96AE721317B192F21A50F2B2CAF49F81177790C29C02216759B005692CCAB4281927A46739FF7A9583E9A5EB9A62314E4967F5BB375FB627E5A45B918C801B4B1DAC24D55C13AA7FC5CFC104647295650B5CADCAC2C74AAAC28B82233F64C1C01AB50F16213154D0312C5ADD25AF449CFDDF494045000A01C449D1084C876163C83C13321B1F6F87757DC186D4C30CE916240E538F196936AB9BB419093FD593409F3A308827AD9002E5A621FB1387AC06B442970CDA9C720AC9049CFF1C307806E9FF9209FD0CC52B9517C685C36C45801875DBCE490163C91C707755CC8701AF04DEB9AA0CE460F24C72E5D811C4ECC297ABCC4C9BA304C75812196409C19BE10C494A8B138A6F05FB5558E7F2CBF6F1694E7D417F73781205B941EAA3ECDF91C71E998F9A8B6B72400A048A77CE4AD17EB265313303CC86150D477E42A39CB4B8C5A3723D03550F4B76D5FB7B524EC2658D374A8C955B0FB3FE878072EBC0201B2328B737F9F19BCA8411F35980890D71E7BD9707C917545AA6A659C3C70877134BBB0A1E970E7035021168C4A493CE1C9950456A76CDC05FEF147FDD625D2B4BC51B39F3B9BC73A35A06A7485306457544B88C168B22E81CBE9BB0174A2B526B6BA0641456A3CC941569124557D3BC652DC8259AC66552DB0AE06CBAEDD091C268C2C6F4BC7E948329778CF48C3B37F9A3ED714C5C8E0099036514D9A052631B256FB7E7F7C91EA0311B8DB8721D5001AE90991111C5873499BBA20A9D08A135ABEAA544706DABF7338497C578084E1BDCE9155F87417B29313DD39505CC90C45C12C324B5D5AF01EB2656D58607724725485465E33A6A64DA220421C038F0A625254AD127AC941EB23362649D2049F8AE8C057321AEEAA31E0E98FE3DA74D53938F4F900B6A33F1305A383CC12B35894AD498293957950010CF7912174373967C294BB89A90331C828048E3FA862FADC95283025E2F66DCA10104BE8B9F286C198B8C9F0F24C79A454E8DC0742283CBBA84B95B388D8F6912F4B74198AA52AB561CE59508CA6CC09251FA2780EC0DA59D8B12B17179320D23B822A3395466DAC34384A364D06882592734F72AB0D2DD7131196AFD4DA54FC5801D85928CF61BB257274C98479EE0C2F65FB985F6C669D948FAC153158530849311F0BC51AE72BB8C23AB5FED55E793A4E8489B423044A1B017273A4BE35A305E19934B99B45DD2734AD4CB4C5B368C7A32650F306B7148C199A44BCC3A297429CCA6015E906204C827CFF8C9DCD48BF1B638091F732DFDC570CE6618DFC839B4A4648A52BB8302E32098C26E9A51A6571C9C290005265B6359F07598B10C7674F5356B0365CEACBB55B1A1822811C92C44F0E4BBDA4A13364749C5384CA7670ACCE69BC48B6A0B0B2BAE8AC5CC40ACA6CE24957167CC0F24DD0CAA3A0228C13934FBBB0C205F53D713AA441F5B0FEB01FE26411E0CB6648D36C6236468793848AA4B7F4510377E0A24BDCCB712BC98CB21CEABC08101328D3D032CFE9C82D21372924C69AB5A402E9B3D88C87E9BC5C90335E5AC231A1B87EA3C2527B82445D7C8596B10A609616E4DA431C9593B91A1AA21A2E436A359A7A5901902A6B516D562363BF95890501AF4C5946626ACE3F276AF8966709CBB9B666B9842102F3077978E4872307AC65EA11002CBE4DD0BB83677419B89C9E0C9847FA6441C86B8B601663E40357831D1B3C21B4A8985ED50E546C2917F332D4ACB59BD64D9BE88EFB981362458B8D868DA7EC516EA9C807A29C5D51385781302072C1F3295DA2559003D4265CB330F43AC5B774562C182BE83636FA034BDBC3CB25AB6C8C21C69B873329321533A788287A40C1659F457C5E6E15456DA54A7FDB18C8BA246447606F2AA340A48B4FC667D7E67EFEC47910E05C3DA4463B75359668821711530835357B6A8EC62A3E7817C508C79754063F7110362BE73416A46533341CDE577C17A75B3316AC59575EB1A1575EC0104EE77F70941E91786AD457832E1493466A3FAAA55911E9BACEF8CE49F579F1753B5138797EF827F0BB0821EA69BD9C43ABF2181D0775FB64B8694C74F0323600FD3E5F1BC5CBDACDB2329928247E4759747C02CDD924CF1C93BAE5C37BE8C3B9C7E09B4660C3B9901EE33B62350A695D799B52743D5158C015CC609E891C87F9BA02616ED2D3A1C14AABEF101B4B42AD5C47916481BEF01B11B9496819AB76A428C0F5B8A69EBB24FB5B3407E1C22E2020341575C7098E63379406C9B60B6A1733C171682B1776719DB5ACBD2AC6AC4B97AA0A3C8C168A5AB389010A01B4DD01829EE4A402E54E633A229A94CF96E01F72EC4054C13335B89BD6E91E965BC324924C028B433074C9705AC4CA2682FB1B385F058D574515319397754CAC9F68CB70022882A24242D1C3F1242CABDAA4D68A91DDC8A22C939BDF1539645A912A33C1D11A5849211D831ABC2C86834BE35BC3500CC44522BF9ACA86988AAF580BF45A5FF7F8192E110E163356B8A52486F772204BBBBC19BEFC631433F081E8556579D288B3B27C1A8209ECFBAA30A82B34EB722FE2BE60534E2F625C0AE477826A9E75B7C5AED2398525358BF0AD127C15915133A32A9ADD47A72270A98F942807FC59F2420E14365A758C534F289160A65CFB34619C7C9B2992083CC699F554BD64586DCF379605581711D607235C944820CC28416AC761498D8B54193A8CAC8B815D7B19A21B02A6D5A737C4984F3A888C0B9E3F51B95ED9430327642A082787132E94D6C26B298B77554E7F2237AC286F419266580697FC9316EC1176C4D763B194C52D79B25604974C1BC899560B72094701709797C5183391A268853B9FF3AA277C707906BE0B078FD6619050E14B48BC73F877BEE69A3EBDABBB8B2198CF51B14B2CC9ABE673CAA803B419BE1C34B6341C2E83D2013152B557A87AC4FB55C5C86CCBBA995492CF960479B044B3D6233317677C78A453D4E247ECDAB3FB200C3D2A0564C4100A995C4F70597E498CF0897B507AB35E4587E2B875030303DC2CA8CEB41AE2A9725085C12040C8D0CB20ACE46F1936725BCABD60D0B880F7AABC887090195D95FB6EC060B5257AC37481FAA2ECCAEF99C0DA37285D53BAEB0E25BDB93EB856043B822DF9D60B55FCCB537AFA3CACCA9EF50433BDE1DD9831E534D192A59B3BD23B49A95BC1FAD20070FEC930B6060BD827D742B077092E422268E15D
-ct = A86CEF6CBEC42D8AEA488688BCD2F5A1DCF7716149399BEB3EB373810B7976F4D76A37CFBBEE50167F2F38B3E1CB60EE8C74CB60B7FA62E412A341794891A7FF3603E926FB870B876B94AA0F52909824A8EDF9699C5F5A3D309E29097F48B5354987DEA5BEAE36BF29DF79B0733622F1C67623A006D79A9909839CD70DF5A1C0BB1B18FA1602FC2D30C965DBB7433F972E73CB3DD31C6F9BE7C5F19C0E74C8F653CDC115725C7E77099F90B2FA2914FD713775FA619AC87F129CD9BD9A35393281BFBD18C56A0164C0C470C3AB1E4B4CE754E1466EE17DABB944A5953849E2DE8A5E69C4CC1B46D6704A03BA021EF55B240210148AB0380970440CC686D8F50E26DB02EA4281AA99BE5A35618576A1CE9CA39D7E4BE2F3D7ACEBB603F602030A995AF41F3441DD939AB30C19CA6D262438424EDF43375D28642F88AB6EC7BC75247E17399942EADE8F8A9DD2E9DE6ACA95256839EC4CBB280B6F7B86ED4016B95AE567BBB8AE138DC77763ED5BD71EFD669FEF71E37BB02EDFE11B3FCA0404C46B4B300476A020ED6BA561E231E731478D47154F35D5D9EE02D52D82482C490A32CED521C81B8BFBC18AEE4375B1C8A31C58ED19F7ED744D8C7EDC471082480CBA60E0B36CAF6B7B95404F427CD47FC93D548E8B5FD014BB045288BDBC2C8AA4164554535F5A3B36F7871EE965965B741F57386D15AA545BFC0E405831166A9D8496FB49894D3F2B3E7635E6C7EA7BBE009489736D506C808DFDF20103A340AF5206B227C9D913522608BF5593C6D08F596DC0341925497765BB68D3C9C9D34B6AB026CDE93CEB535BDB577220F59B87B7272733E9106856CD2E9C6A225F94011CB54E65670855C910251649616D9782A34CD4DE063CFDE8E1C3144B910EC2F83EE3D5A1D0C7B282214F467B3534945723130CEF32B8D8F56C74FAB9DD7750B4858DE350FF1D3B2674BF78076F0282BA0CB74244A4D6887F188BB8DF9ED1663B53543E8A64CA604A4189F0FFF339B8AAD602D39C9877BD96513439C258455F9FF7BD0B05293E8637F8A56F3A96D5B47E122B1367AE7D8F8C65FA4EE444BB8ECAD8D96BA05D060BB03BAC1B63D1A257576E672D77286402B3832297949400E4E799BF2DC14DD2FE364B9EE06F528DB197A9DDD93B9DA9426F7D8DDEBB8F809C6ADF1602F4812C01B002A75728325E3A9A148E0C85CABD9415BAD35C9347E45AD4D01D5D1DA29A6A13CB0949B75BD07A942F26F2851946AE9DEFBAB4094293EB2FF4765F99068DE9328C8E0061C7A6C858EFD839D9725061E9A04DDCEFC0A2D614FAE5D0BBE0F8ADBE61B1AF37CE882ED75397FB228AE317FB91CA45C498AD05B5F9CE1E81D73E94F4ECDD0208F58A363366625E0408136637514A194F79501209C7FD5D798764AC5AD5A88FCDAA776B7D2D134A00759497B469E7B91ABEE9734961CF5A8EAFB4B8DCDE96BE81405A7C06C541FBD8881AA352FDB3B5AF4D00194274E86CA1D8E5E76A60A12E4DF51884E7F8F9EC171383177E7D7280D36623101A
-ss = 1D8DB19740E2F6BA7C8C04216CF2398FE9221B2404ADDFEF8996A03EC72EAD37
-
-count = 78
-generateEntropy = b9a6b0c05677e957d41a34ba03bd06f2a9092e31f63389397d7e70fde6409d18e99c0e7b82be89bc3c1eaee6680aa4efd394e40c2b3f30523c8117f7c26a8969
-encapEntropyPreHash = 0f81a5f97082121244403da3feeb734f6084b314b8d94beb11627aa6ad1914e9
-pk = FB262AA9A031E49084A6127B8410A5A46CBCABE6B18F607C97D4AF6C6A598A089BB40C1998D16CD307895035B15DF2C34BFC05F634813EEC780C96B83FAB557075CDE3B64EAE6BA98B65106E729B81D11C926404E99164BAC5B546997D2A842F6AA9CE1F6BB7AB7551A06A3649E1CAF7872AC675CB8981A124CA05A318BFF9A234853821A3036A86404B0F056491A5B20AE09DEDB123DF8B4E9EB612A00207C6CCBC580373B0921FE2831F50610340865232C60660655184D8A0867A47811B88BCDC4E6DEC5874839919188F63740588BA97405BB1FF2925C1553188C0137336948F7809DBB96D2F910A9C0AA95D49267E543057976E3DC7346CDC7560E68911B8829D37BD0EB20DD5E2B0EB1538A98A76A68798B5469F9DCA82A08648A2DA13BDC1A9B52A7B6F345626BB691AECCD14EC20F1C252B4FB2595474B2DEA0EDDA47B87CB51F020072D489A2E79CFCF9A12B52BB4F626C35BA4C0888C7939F38E6126484A7932F5D6A029E1CA5CEA27D729065D7137BB518C1885A299B58E1F6446FDD8449E58A21453CDE7AB683BEC6D84876CEE590D1AD93852885DB721B85D4061DCA1327179ACDBFC329416B23234572901B3F63A2CDA36AA65B17035F449AF2B404691957C30028F053989C501D8C2CF8A8CC0C04AA59F3B19A98777F814A18A0753A7180264E59F2BE7C9F0266B8DC481CAB4833BE8B3B599818AA930571748D41657256015F68A8C887C23205A6655F30C51084925167BB75C98B8A25B7579BDF40A912365164814794BDB0B78824FE9066CC63473496AB9CEA06248D883D1846FC8084D59F05277AA3EEC0C3186D68BDCEB6C240CD0128A6BC1361467B861AB025309C82183233C37B35E8AF1B464331CBE7CC3974A48A8E015A491677567472F263E31188966EB556151819CF52772053936ABB0D0A48E99357E558301DC8157A8A7853212828269786919A8F9032E17F9B692BA8EFAEBB602E83BD4B75160541500779D1907B1159170DEA870E6F57F5229222E85B178DAB32F897BF45510EAD084887566942656357B7896570756AB1614994F982841A525C8EC63CCC8E4575DF03BE2F5CF96505ADE252FA4E80FCFF664F6FA8C337980251904A9135ABCC509DB15A49FE4C6D57B41BB6383B3483CA5F5CE11641F9EAA423C0C3254A508D4319DFE72168070CC8C771ED3E06CE74C93240947A8DAB87D889F9AD894F37243B25259153324E103B73C708371400EBF007BB5459EE084BE938A18D055AF7CC7AA98FBB88A156849765936E7273BC385A1BCA94A74368168CF26D8806C7901EEE2359C8694B5439F1E82C0A6892E4A68C4858A9A00B1496E177D1EFB57EB9C0AE382B56626595673230903CC19C79714364CC4B10891823535E21CBCD45C90D471E684AF1FE243E925C848565A1989637F7614C900AF1BEA9049B78E07F00950AC800EF72860E209C192A4AA0B901090987BF15A2DB6165516AD0238A40B0BB233A365BBF2BAB2F60EEB8A54771A8D8E5279E2740298563AA2868E2DF1BE582897C7A9A0547ACC2D8933ABA9CBD5D937073455489A30E8CC3659C03D37240BFF084D77F09DEE76B60952221ED2C1AA73B772CBCEA4D7A1FD64561E88BB90327B7C13C809696C0E4711CE152577517BE0A2FB3D597FA5804E0C106A4C10
-sk = C65B5692B9737BD5BCEF94376A685FE08CB59C2B94884B47BB6A4B292C4EF8DBCFD1D9392BA3C464442CBE0879FAC60CB733496FFA7116011CADA07377EAC759172DB45C9035532A5A48C18F3343E7FB3A0A7A1DA9C75F647648A822BB8FCC59A2E0476FE958CDF968433B46EA296056A8460EDC0B7D4430252B227CC38C8DFA639A72759DE9325D3BBBDB1A5305E546580127B11332BB666236924FF1F13105176B81A777EBC946BD4B962E8050C0F80BE026A513F7C9C74308F8336A9BC73BCABC8353AA10AFB69AA502B3B6E9A53AC67F8CD8784BE4519AB3C6E8E47212BB59EC3958BE442BF2162DDA987C602030770555C0BC62B1422367B95A91399642155CD0B17DBB848B642C765FDA2400358040D4CD154A68DB36265BB525FC90988FD0C04BF0B66CE052BB216D6183B444CC385BB8AE17388D5E8024AA41563653B5F72899CC16B37D642F6FF7385F557C941571A1C73BD9425FEF3C343ED9B88BD02A9BE5652736AE69949E43B5C9719C4B8E42C9071C10E3D454B3C90D315C93579CB106A3B16BAB7163983F5C514B818516BBA802B7FB1166679EE03C4C41EBCFFC6322DB61A7988927DD83B48C24BFE82A4FB1901F70E2C39C411FA65C43D56C02C79849E7745BEE15B70E405939B055C2A76FE1021E094B4671A290F5D708EBF0B1155B94FEE9B34CD9858D3A8DD4BC27F5FC0627F2A80D6681C11324ECB74639540B72A23083C3758CB29AD40C979B42679E1436FC56B3A7D1115137015E2A2AF9A8BEF038B6905C8847C16558BA2BC6EA92AD90B026228695D664720C15E6708B0934064760A745EA4A5587BA211312C7203005F838A2D5B7BB09B8DC7AA39D4956D494472F71A268991CA907AACF8048FC98C095798D0EA043C42C437F6762ED3678B6D701560016F405CAD66117C786B56B3A88FB5968C26869F73A2227B129553B220F67CAE75B5433B29259553AB4375A0AA6766B2AA0AD480B6969201ED21CCDA0A39F8B8F565112565065D8D26DBC1A57425A29FE0A606BA826FFE45A69493B08B11712E88A2B4B0371DB5C0EC0125E2659ED08275D18277B9C0CA51797D46CAFE91951737868483A418427733EE2637B4AA9496C30FECAB67B0B7278A76DA2DA201874711E6928B7A40E7859378C867B9BA81529656200584EA9A5881B657B68980EF8CB201338AC1B856C4EC5B0C48A80BCD6676C0CA624F05296E59155D5587C2C20BFA1BEF1005BBE9840DB205D9658935A67614595BB3FE48E52877FC5BA639D023F54D534C58CB90A0A98BD1C2E9E940FDC61193D4753D17463D7EB8C9C6575E0F6845B5C0A5BC69C5F90128D3078960671394B75C5C72EAFFC1E8EF4AFDB395FFD40A2F6BC75FB9B79E1D8756705B710B0BAC1DBB4AC312FFF30745590739C08BB25CC9EC62CAF1226176C161ECE62AEDEC392A3591EC2AC80E92571C1417BE7D82B2F9A1990D50DAB78C1DEE631304AB5AC57274846A8FDC6547B224C72E0781B233FF8A6C876ECA3A3E060A00B560F661042E85340C4A8257660C0592A429C7B81B5137D410B5492864E156DAD292DABF59035FB0E02247E6C6847CFD86B6958C74209A8F389041E5389EBF5B9B633B7FCC08CFE14BAFB262AA9A031E49084A6127B8410A5A46CBCABE6B18F607C97D4AF6C6A598A089BB40C1998D16CD307895035B15DF2C34BFC05F634813EEC780C96B83FAB557075CDE3B64EAE6BA98B65106E729B81D11C926404E99164BAC5B546997D2A842F6AA9CE1F6BB7AB7551A06A3649E1CAF7872AC675CB8981A124CA05A318BFF9A234853821A3036A86404B0F056491A5B20AE09DEDB123DF8B4E9EB612A00207C6CCBC580373B0921FE2831F50610340865232C60660655184D8A0867A47811B88BCDC4E6DEC5874839919188F63740588BA97405BB1FF2925C1553188C0137336948F7809DBB96D2F910A9C0AA95D49267E543057976E3DC7346CDC7560E68911B8829D37BD0EB20DD5E2B0EB1538A98A76A68798B5469F9DCA82A08648A2DA13BDC1A9B52A7B6F345626BB691AECCD14EC20F1C252B4FB2595474B2DEA0EDDA47B87CB51F020072D489A2E79CFCF9A12B52BB4F626C35BA4C0888C7939F38E6126484A7932F5D6A029E1CA5CEA27D729065D7137BB518C1885A299B58E1F6446FDD8449E58A21453CDE7AB683BEC6D84876CEE590D1AD93852885DB721B85D4061DCA1327179ACDBFC329416B23234572901B3F63A2CDA36AA65B17035F449AF2B404691957C30028F053989C501D8C2CF8A8CC0C04AA59F3B19A98777F814A18A0753A7180264E59F2BE7C9F0266B8DC481CAB4833BE8B3B599818AA930571748D41657256015F68A8C887C23205A6655F30C51084925167BB75C98B8A25B7579BDF40A912365164814794BDB0B78824FE9066CC63473496AB9CEA06248D883D1846FC8084D59F05277AA3EEC0C3186D68BDCEB6C240CD0128A6BC1361467B861AB025309C82183233C37B35E8AF1B464331CBE7CC3974A48A8E015A491677567472F263E31188966EB556151819CF52772053936ABB0D0A48E99357E558301DC8157A8A7853212828269786919A8F9032E17F9B692BA8EFAEBB602E83BD4B75160541500779D1907B1159170DEA870E6F57F5229222E85B178DAB32F897BF45510EAD084887566942656357B7896570756AB1614994F982841A525C8EC63CCC8E4575DF03BE2F5CF96505ADE252FA4E80FCFF664F6FA8C337980251904A9135ABCC509DB15A49FE4C6D57B41BB6383B3483CA5F5CE11641F9EAA423C0C3254A508D4319DFE72168070CC8C771ED3E06CE74C93240947A8DAB87D889F9AD894F37243B25259153324E103B73C708371400EBF007BB5459EE084BE938A18D055AF7CC7AA98FBB88A156849765936E7273BC385A1BCA94A74368168CF26D8806C7901EEE2359C8694B5439F1E82C0A6892E4A68C4858A9A00B1496E177D1EFB57EB9C0AE382B56626595673230903CC19C79714364CC4B10891823535E21CBCD45C90D471E684AF1FE243E925C848565A1989637F7614C900AF1BEA9049B78E07F00950AC800EF72860E209C192A4AA0B901090987BF15A2DB6165516AD0238A40B0BB233A365BBF2BAB2F60EEB8A54771A8D8E5279E2740298563AA2868E2DF1BE582897C7A9A0547ACC2D8933ABA9CBD5D937073455489A30E8CC3659C03D37240BFF084D77F09DEE76B60952221ED2C1AA73B772CBCEA4D7A1FD64561E88BB90327B7C13C809696C0E4711CE152577517BE0A2FB3D597FA5804E0C106A4C10306AED2A804A1C9BAD4AB9E59F6126AD7C8633CDD0C2DD9D4C6F639D312ED47BE99C0E7B82BE89BC3C1EAEE6680AA4EFD394E40C2B3F30523C8117F7C26A8969
-ct = 23664DABDDC72005181DEDD4683615FEBB4936288AA5E632624426F07B51A793B5E7A469F91895314F08278C98C5D6B8A184830209A05F7D9C38BCF5F84CD7DA273D7C64615C78FCA0FE08910A506CBF7DFB28B4F9AA5C0CD4CDA71C9CACA34BF27B15CA2E603FF4CDDB14A639277C1DCAC2242B534737922863E1551307071394ACBC98AF20BEDC07163FA84B6C63B08A1380A3D4157FD2006306C95A0D488A83D9B22C3E1B492A97F4921D5099509FEA1D08AE5EB44117B1C7E9417B9A3E6FAC0D519B56380A8B5C5207F454779FD839426E0988BA8936FF50545BCF0E9DDAA818AC0EF08BD2D5A3FAB95BD157C13EF512267278C2F94512A8D5642AC6323F668F1002230DF845D6D5CB5EB02FB4C31B8EE5A820C30A53B74A87E0AB2AF7C51E0546CF5E41CC72B634ACBC96ACE5257B1C221019B4FD70CD0D958E5200927BA66B154613191A0E139CBAE734F2F78F7878373E4C4178E2E3C3E2A7A11E06BDC24D151B475611FB1DF5F39FB5D0FAD043211E16066210EBCE0F31503BF8E62431C863ACF928DA8EEF07FFB5F60E01A6DCAE1C558BC282B3090759F7239A20EC0F5A37CB48B351432CCB3344E25EDD5965422F559C6493FB8C5DFC297DF280536C37CCB41D2625F455BEFC77B71E7D84DC06DC50D32025609D0928EC8BD6B1F78F1784A72FDDB987B5999D1F289D29740ECD423193B9651BE956750D31406FC31A8BE3465F8C06B5742F66F4609E120AF2EA64F6C99895BAB22EF2F19D9F3CB6D7BC27B5550F34F6EBB51B02AFFBE626F051FDCA7C47C57123EEB2EE8865A91AAEE9BEA87F5B5BA63B86696863A9CC67F765C4C0E8DD90D59942710288F0F8C446533EB4E74D22B5F89CF1C714C139E487FB0DDFAE6D900E3B6FB7E568AB7116BB92E04754415C74BEFF6BB6C5D814FFB7A198C5771845BE3B0E2F2D397BE8083E1CB0F87A965D78768E3EDDBE3F234124CD92EF5C55F28A76357413EB2C4E26E7FEB772770733AF930B5C7251B2F0FAA388EFB08D45900738A7D1FEDAE2217914CB18FC3B0C1AEEA2B2C93C72F1811F7BFFB281EBD38020D006E286E0132C5C4875F8657C3E5B141294A69AA98AC26748DAFC3172222314F9B5B9EF0DA13BA75B7B2D8EAF62D50D7442258F6EE56E399964514290CA006095E125AB63E178DCDDE424F03BF59EAA68393FB7D6C36E1091FFE079BFC9BE2FF099722E1BD33F9FA47DC0766C76EA6FDD660DC2D6FAA41CE8B268136C6B050D449A47FA4051817831AA555CCDBDAB8853B377CAFCCCE731849F64539BDCE72785ED15C0AC3E4ED94AE3D4630D7E6AD08AB5B48C018CBD943FC968AD687C5F4117BCE83A663D622A6FFE5A47D44A409EE9D47D32BA9EF5A6453FBCD81CD92C27F9C033E32E83E1A2E7B32F4ED094A79A387F90A6F7F45AAFBEDA7FF11B35BD732BC8F3B75CD84682929D20419BA2FD2640DB63867532639DD4D1CC1042AAAE6821011446EA8E7D2B0BED9B7AAA6C17BED3955DDC566685D7E124A9A01D460DFAEFF51A32405D74ED
-ss = CB0026C186440C0744C1C1C708D8FBF2B7AA1126792A7363576BCB2E64384117
-
-count = 79
-generateEntropy = 28a96c71577ba00c94f99fe965bc595a26db2b3ca6ab5cf8e443cdd8462b17929c35d165453e5fcdc6f9df64526d9de698f2bd3e6bac6c7fdd86601b9ba5f4a5
-encapEntropyPreHash = 31af9345365549ea0360169ed57daf98cc5444799d4c75d9f1f5d615e9df8a91
-pk = 5226AA8EDABD5A4A5A7CF6633A394B756AB38BC652EBC1BDB728C74EC316D039AC982B118F1AAEFEC04E48448D45F72B319289691A93A20283C3CB1FEC992364CA83226332107704D3390F71E1883B46BC2F31B4242744E0847E72D5645586AD0B8C0FE48AC04A003045AC2D2101B52C7C1D494673BEA69766A5ADCB38CE3A978209471B5D7095A720A4C1971D94970884F11FA90C5C8B7009E2E1769B382004C93A2D9187B23929D941468444CDDE233DB3791656C860705B714E3AAF076921458B8DDDD61E09AC461E96A1B1E9AF19AC6984129B6C8CA9D4E39D70277B5D9A6A4B605F5E0454AC05729C2691E87A8D79353289678490A822C41C52A2F56B91A35F89918AEE8935EF2BBC48485BD747CC5C59066B7577739B669AD21A5561018F021663F5CF48E08F39881D221552C846AD789810030326C8530DBB369681C69CC00C2390FA857A37AD81623EED4262DB69929353118A0886E6C1CA3D36C65898968EB7C187B7B866F18A8BB369AEC780E0033EBF1B0DF846CD60633A461C569683598C7744FBECC54282725E337CEC503D12A87F9CF5BA6587BAF31B852BD45A871ABB81E88C8B8A56D324C87A777BEAF543BA153A222418BBC57D7E1325FC2A075608988BDC44E276AF10CA2D7E52B045514080597A0FF73732789D0F955F93BA77E8034900251416B43E291984CAD36C53C947CC954A8320C11424BE43283A6DC586A9FB39B2927867B79772DC1CAA16234233ADB5AC819F1A172DA5194EDB997F924A827A85FC7C7A8281C98F7A9CEE443F68A2AEA6001DE7C7475B46B55EE8991DCCC6527B5FA1393C9107C4D35A073CE29A7EA205A9279B62F5CE21F3AAB0838B42E6679000CC4C182504A2A4E81757B7F6A183428786F09C76C69E2D7598F1E5049CB57738DAAB6972ABF6D8BFD2AC7137493BD2B8B5F997519B2026EF38623294B91999A5419356BFE03E338194E471926FE5842E79740F416ADAE2A24F441BA4A0C08ACC175F347EE3B614664496A5E51C01A55B1D2A3E8486CEC4C3BA461970868502A0F9553D776514857BB8A872C7F736CCB432B1392E99568B51B9C9A56C441AC0CCBE785693722F90D63A0F78C8EE777236EA43DE2583D0E093EC8BCAB7C8C6DDD8254258B7A5732939D953E491A6BF310449083986B2A0F236C5B9A300DB22299146B9A0943115845F3FE98045CA844BCB1132E0BC98CB54746937B1479DADAC5A4F9320DC572BA81CB250F13869D132FA259604A76A5DD56A7543B96C3096D3046389A917DCE53CBDD9AB04A65B31C6C5CFA23A2AD53FAEA3BFF3985FDFF9CA3E3965989C072F4659EE8914DDDA0ACF30A64A1A823B78561D5A9304950EA3056F50B82915C71AE0B6883EF319D061464D8050F37C24C62C7693F204DD4B4D74B66DD7526FDBD707A3490769764ADBEA61C09A2D7F464D7E932705212D6A9151B46C2ED93A7B99C1148F679D622419A4574310AC20941B3E51591CA5D53CFF51A6ED2C081EE7B4BC23C8BA8B1AA2924406618715731B1CC404929A38911020FAC6647C24306E349F1ECB4E2F530E8F200EB9C0A315606A3E130498F96AD5865EBB4CBB55265E69316A3BC96E51745B02F4A593B796B5951F48DDD5D61BCB3F79106FB3F881087B21E528BDC627A8A1FDBB3B1FF5D83954F7
-sk = 52D431D74363BA07B7EC47C2A5B98157F616B8C7B7D3E68CE3F2A31365BF4E21747203C5EDD758000A8C09D38A83457FB7B015BDB187E842B46CB9BFAB29A917435431184219339DF7CB81018A81B283814FF8B15E3A526AC35185BB45C7A865C45AB0CA1C7C5CAC9E35F753D378556A62C8AAC92F0FF59651C1ABB789970A32C69D153B14A687FC2A56B9E0C382BA4F907A0BEF79BDDFF781776ABD042044A1C84C4C80AB9CE9A76BFA6374E9CEE06081E3661A09CC3272331936CC85D6B2319CC7873227303191C36842B61013C0A41082B82034A2E1BFC8C47916859EDA53033D5427741510E842265AE36D530A19E5D7365127BCAB5B506321ABE2B69DE823B660B4699F8859DE76899098159C211CFFE51C7198CF1025BF9EE69236C913B16AAD84AA4C381A577B6C7A3403627B323F11EBC1F304747F47407DB9A8C9E4B866082597F28B6EC272AD2140A43A52188B061650BFFAE19761BA99CA724B71191B6DC5B16450CAC50B247415370D5B207701AAEC3A13CB477983F180388050175658CCB4714ACB603B6B3AEC340DC6C164FCB81331EC194C382FED024E0D962B056627A5B05A00B5511D78BADAA489F8BB3F3C5B484F9C1450708B89828EF24B815EB43A6B8B127BFA49ACACAFC46434987BCAF5F91A926140BD56504FB4525EE1921B63733DB2986DC133078CAA44518871BA12894A553BD024FB731A0AC44AB80199394A2385BC440515877CB69B73B0C847E40ADF238847608908C20BF7E1B86FA84781371D4CB52FCF2CC30306C8D98C679D4CB41EAA0EA8B395C08CAC6DF2348474A9504592ECD34A93B3262C9751E42193719B617355C59A25679D909A5E756C8DB03E3B174E1A063EDC733B9350B4F738618648BAEAEC5B76376D05329BE6E706E632BD61292755F361096CC4565573562053B4402C42C85B5299B1CCA0B9CFEC4605D63665F24561D8C1DCFA896D1C6D8918A3E6F2A8D4224FF97503D1EBCC8D5395F0A64D1454623890BB7AC6B87B29333096535118CD243C52E49CBC0945385E38781B9BCB6B220A66D96D426B9A1F4C4C4D0349CE2BC790732247EC5D98E43BCD37CD94B652BFCA7B988B063BB102EA0772DF0AAEC74C228261B4FA7A49F3B329F2C7C6D04C859C9816D5BA2AABB85E52DCAE066B9AF4D9951766041CC783DC672DDE42558F50473BB43BC1F93BC6EA7D33F46AC4999CD33698EEA603C7DA265AD713E48691C8B048B21134C9998DA19060CFB6AE31CB5A3B7387F2257FE94BB3EA4C963D01849FB021741395F1862085F031B6B05A7834551A6C8F0EF91397A29E12DB6D776B05C7F12C8B260CF128C02E48A9F403A487AC3A6C0888C5299414AAB1D7283252F62F465867A851BE9A82C9A79A25CFA727C632727C765D4C496D466942147A8A7B65AEC4BA84E4E2745671BCB207654B087A26F93AC77C82CF34A7C2F86FE8F48FF9A0B663D79BBA6B2B8908B32FC145E4F65C6A8A379A99C9E68A10C278130A1969E0CB708D0CA6FF1669D8756D1D530ADE051ABA3A07903B5D801456315057187758351588BED222785C9FE83A0FB4C59245CC2A72B309767348EEDB7C2097B457BBAC8AA96A67D785803744E149B3F131A85226AA8EDABD5A4A5A7CF6633A394B756AB38BC652EBC1BDB728C74EC316D039AC982B118F1AAEFEC04E48448D45F72B319289691A93A20283C3CB1FEC992364CA83226332107704D3390F71E1883B46BC2F31B4242744E0847E72D5645586AD0B8C0FE48AC04A003045AC2D2101B52C7C1D494673BEA69766A5ADCB38CE3A978209471B5D7095A720A4C1971D94970884F11FA90C5C8B7009E2E1769B382004C93A2D9187B23929D941468444CDDE233DB3791656C860705B714E3AAF076921458B8DDDD61E09AC461E96A1B1E9AF19AC6984129B6C8CA9D4E39D70277B5D9A6A4B605F5E0454AC05729C2691E87A8D79353289678490A822C41C52A2F56B91A35F89918AEE8935EF2BBC48485BD747CC5C59066B7577739B669AD21A5561018F021663F5CF48E08F39881D221552C846AD789810030326C8530DBB369681C69CC00C2390FA857A37AD81623EED4262DB69929353118A0886E6C1CA3D36C65898968EB7C187B7B866F18A8BB369AEC780E0033EBF1B0DF846CD60633A461C569683598C7744FBECC54282725E337CEC503D12A87F9CF5BA6587BAF31B852BD45A871ABB81E88C8B8A56D324C87A777BEAF543BA153A222418BBC57D7E1325FC2A075608988BDC44E276AF10CA2D7E52B045514080597A0FF73732789D0F955F93BA77E8034900251416B43E291984CAD36C53C947CC954A8320C11424BE43283A6DC586A9FB39B2927867B79772DC1CAA16234233ADB5AC819F1A172DA5194EDB997F924A827A85FC7C7A8281C98F7A9CEE443F68A2AEA6001DE7C7475B46B55EE8991DCCC6527B5FA1393C9107C4D35A073CE29A7EA205A9279B62F5CE21F3AAB0838B42E6679000CC4C182504A2A4E81757B7F6A183428786F09C76C69E2D7598F1E5049CB57738DAAB6972ABF6D8BFD2AC7137493BD2B8B5F997519B2026EF38623294B91999A5419356BFE03E338194E471926FE5842E79740F416ADAE2A24F441BA4A0C08ACC175F347EE3B614664496A5E51C01A55B1D2A3E8486CEC4C3BA461970868502A0F9553D776514857BB8A872C7F736CCB432B1392E99568B51B9C9A56C441AC0CCBE785693722F90D63A0F78C8EE777236EA43DE2583D0E093EC8BCAB7C8C6DDD8254258B7A5732939D953E491A6BF310449083986B2A0F236C5B9A300DB22299146B9A0943115845F3FE98045CA844BCB1132E0BC98CB54746937B1479DADAC5A4F9320DC572BA81CB250F13869D132FA259604A76A5DD56A7543B96C3096D3046389A917DCE53CBDD9AB04A65B31C6C5CFA23A2AD53FAEA3BFF3985FDFF9CA3E3965989C072F4659EE8914DDDA0ACF30A64A1A823B78561D5A9304950EA3056F50B82915C71AE0B6883EF319D061464D8050F37C24C62C7693F204DD4B4D74B66DD7526FDBD707A3490769764ADBEA61C09A2D7F464D7E932705212D6A9151B46C2ED93A7B99C1148F679D622419A4574310AC20941B3E51591CA5D53CFF51A6ED2C081EE7B4BC23C8BA8B1AA2924406618715731B1CC404929A38911020FAC6647C24306E349F1ECB4E2F530E8F200EB9C0A315606A3E130498F96AD5865EBB4CBB55265E69316A3BC96E51745B02F4A593B796B5951F48DDD5D61BCB3F79106FB3F881087B21E528BDC627A8A1FDBB3B1FF5D83954F79BB3963CC1C5CF2B2D1C6CA76226328AB765A79999CCC71FE98D5BF3B34F51B19C35D165453E5FCDC6F9DF64526D9DE698F2BD3E6BAC6C7FDD86601B9BA5F4A5
-ct = A7D918C3251367B43A2CAF232D30CC44BC8313689F61C174CD6055E0939DAFAB9EE9C4CC5C451F6836D2D9FE0B6F1B737BA4B6020737487095AECC3C972201925C7A3E4C6BADDDA7441B89B2A35F8D2E4878D316E5B92E5B6F28EAB2E2D1A98843853324D35A023741F11C426442FB3A8D50A0F9BF5209059AC1E47BBFA11724F49488111C551F11DE6BA8C28E576758F2C30B219AE6BC3C79D73E5DA64F03E0ACEF5BBAEDB7DB863B7E8255F76E5C7FF26E42DF8F82A5435F5BBF861283710FA7DE3AFAE930013F1B6B7DDAA122121C83E0DF00F231020324312B077CA26E4E9C2BD815F93824CA59FA9F4E3AAD70E4D55A853187A4E3CA642710EA0109C00750820AAAFD98BE4A25BB7E1D18164F9A4D439F3FF7169696A108F7274E2D50F269F93967DC2371BE9AAC3716DBC499C9CF6639D02EE86438E2DA002CFF11D70C5F025E4A9A446D0FA9314C1E6B445AEC37771E579182D494FB5C448354B1ABE91FEBF5512C11CA7D2DBD0DCFDC37C91F67613C64B76836A5D91F57FC3678B12707D8451277F776EFF18EF083A00FD39332DDED503819BF343A5ED505059D15BF011766BC392188E8483E64B1438A1B2C270DBB1ED0521212B0BEAA0545FA703CE2FE495113FAE988C7F23282F536EFA269B81A75921A56888BAED7F23FA82195A78225AE72534D28650394AD9681278BCEAAD1A8A1C1E6AA0D51EA85717BA3CF304C67269E0562E90E8281D5C96645B8DDA08D3508DA723554B1CFB0E0B96C3367B49AB0D74793A772E6468B79AF1EB6FF720521361A2D2D70ACEEAADBE408A0CB8349F5083E899B6FE37E381D28B5CBA394BB9B7D943DF0167E1CFA7B263E942BE68F1BE1050AC3B51D5772C5EC02E7BF5A4D585B6031EEE47C35CAFB5D74DB20D643E39F382B8E69054F397CA6FDF47384328FBDAD37BCB29AFF15F2ECA75E7F9D8E8F5C24026EF6E4695345E07AEAB117B347B322B44F150E1B66286E24A31C5714E3D4191283D0AC8D8DB9DE4454710439758381D7C1392219168B8302CECE11F26D6B04A77F8A5DA32B22909498E154486AA5B4425700E1D08EE9DDB319217F7A9E5932C5BFC021EDD7E46FCD67638248C79A6C6C130EED0E8E634F332CD5ECB25FA65CE4B6FEE1CE618CCA6DF05EB9187D0B3D0B200B454753D7B16C7606470760B9CABEB4C3F13D4CBC63A96D2B97A403CE1E85075A7BEADB8C34E94508E87736B563848C1AE9CD34DA56D06DEA69811ADDA02507FFD9C3F10F6850BBE5585A507FCF0F79BE02B677EFD4FF3E4945EC800C6AAD1ECC53B9EA6A2C35B74FF196EE7A25938E267FDB83ECD8E5691E5644905FEC3FFBE86676DC30411C12EA05BFEEE31FCD4A804EC59D73BB15C931D031E8DBD36AFE294985AB20D87E8E338733EC6A6B7B4BFA1E0AD6A9905EBC7D4B5B23CF36C5B589A04357F792BA8D3B9F3270F3EE491DC0683E16DED773A9A6595D43FCF9EFE8C0917A71637C4A03598EEAB0CBF1F0DB3E33B1DA48987C00D85B207B7E960E866469CF67A05BCA16
-ss = F855334CDE90E9E858863DBAED7BF4C45BF189861750EAA59355A3648B1CA1CB
-
-count = 80
-generateEntropy = c08ba2ef8c3a0a043afad931652d7a19e6e8cb670f840de5f1fa03309b2ca9ec5fe6141a25f7ab9f875f79e0a82d6ea5cde5a017ab637d5fdb7c42646a1d71df
-encapEntropyPreHash = 774ae54093d694ef40b63b62c73e6c98295f606feb8699807eda1d030ffb996d
-pk = 724ABFCD15255F0A5EFB7783D909031ED02C52A203DE570873C7A7C556202D53A6C086899802BDC877BC6A813AB59B781BB95F4FCA9EE76028AECB9142A992DD7180BC1C15DBEBB66765C5ABBCC5EBF764D5234D89A378D5925FBAF63A00E35D568804B973450A045E55C7C5F4907FEE390FE6877963E386BC20CBE929C3D247611E346EAE401ACB972843DC204EEABB043644EEA29BA2C1A160B98F0D28CAF0677AB2ABA362B7BFADACA4E1197F54F03AC8033814A71E1CF407972B3F1D9A986637A972B46D3AC46509C053EFBCB9A475BC4055265961C79E1374C2159BD2409A84F22755A1B32E4B604783BCB2AC49A27A5B0B07AE346AC38F54A2943559F02270BBB19508E903888ACA4BAB72E332285837B9EBB466E5CBA74D5AB6BB3B2A0FA26209A97F959C905BB4B058BA8ABF30A5A6C190A018A9803AC29D84BA710B30DA9A0844CC1A1478C289C32737144812355E0D7589B9AB765CA3B23353A350876F05081F3E4B14D8F66C998B81F458A394CC68C3B7BFD37366EC93113DB928E5F9BF0E9AAAEAFC619E332A7EF3898A66020DFC64F671879691C023409B53686770F8148A2B6F7B62B6AA42981EA0CEA7753599585034B9AD99C9AC8B12872B1A47A088BD8AFCA2D42093928A4FB770198C4CC50B0214C4C94FC7B62B5E636423C6ADB553B138591F6372CA6D53343FF7C70782A2DDC4801B262F220A539181C13F3C3E8E0A0D7191A43A54AB008D326DF803FD8757F88AC9BDC8BC75CB83517AC71FF8613B3BA713377FDAD2199BFA332B8C22C136350ADB9553E3643D0C45413782F3BC9E941965DC051DF98738CF50113AB422E4A22759CA016BEA6FCBA390ED64540112842F5B1373A2847107A43403B4AA5CCAE154B9C54831E3911239B79F1FE997BAE30A542560FE6647A2E7C4916097FD484C3D040456EA2BF8B63DBCDCC8577B7AED99C05FA28D468272876B614045095E918600F7C94BB0944F62235C169B58789AE8BC3E6F677CA8D238602399E307553E235D11836BE120B3BAC41B0A668E0841AB11F49E27AABDFC27AFCAABBF542911B6A220CDD626D819C44C72556A3946DF86C43D1B8693944D399A3B5B1309B9780E34330CA387CDE8E4C9B2D0775A962F447828D6295873CC1629777FD93C062098B6149A3E7C383E2C33CC3FE7730537416FC1ADB6C09F4CAA736E4C796D2A97FA3807C9EAB72993B4B876136B856C7BC75AD054288EF491EFFA872247A99AA39A9C2B7602027D65A169317CAFCBB77C37D89ED32489E3C2557998A06689B06AB96615BB5752D439DA446354CB0640686AA794444A806C31D721B8C6B820810A5AFC00932A885107B5F968B5C8EC98207293D8851892A01DFAE4A99832326E3863BCDA75190C4A487B46E3914B702017B1B520CCC30A5C475FB2DA94EA217F76556BFEE825076533973BAD3AC7305B5C764CD040D723617090AF4A7811E9AB206C6A331A647D9385A5E7D8BAD6C89B390B617018C4A0691D262429BBA173598B37D7C245452853506437E756A399670AD8E292B0D820E3567047C82870E82236389D99D678CD9B49526AAC30D1B830B12F4E62407A59C8F88B7B5D088A2D08B9F114C3F158650F32C682EA6A76CB62D3AD7357CC617D597A3DBBDF515F6852D71220768859D599BBAA
-sk = 28BA2F24DB8E2A5B21092964F1871E97E10F2727C8B27916A5068EDD27670D26B91A93332157AC686205E23616EB0271B081B51923C5996743CC114F3AD310CD6791AEB05F77960991513EC655533921A8D14CB2589399EBF18F7BA89BB7D6CD2D7336ECE1B7B63B98F26A49D356578CE7275EE67677D1482E1BB3D85B88325BAE0A00CFD1288C34078D73965442B7B140705F0FB76EE3D0921112C400C7A4D1337D6A3A8CDFF9AF05C64C079C64DD143F1FD56C28096313E82D51836A2DC1B0F37A2E00545F802B417A9406E55420B4D71FBC2210D05A771CDC164AD50932EA40A876051828236153B4E1715EDB1453045721E89A60ACD0066227704B8AB991E8A06812226BC59943C0814C847A1865C19DF4B7FA13BA3EF95543E724EF854CCB28BC1DB49B75C1ACA3649F848BC6F32C139AA79197543C628238ADB755F4DA6BD67130772B4790B28C9F1544A4E9860E875E68C1CDD9CC0CF17451434C7C53F3A9BE39849720B1B80A836BA4C531D49BAD16077E90203C9120C23239CEA972454B08A5F10812443CA75B913DF98DBE29C3312157E156311F67354D414AA041833F8454ACA5B3898B3572E819FB2C4CADA43C9C5191D6F7AED8F310CF77CCAF0C478686952E71A8A8173D0C223B04462B96C04EA7B218A13519B90CBE3BE8C32B276F90D349ACBB6362706DCD54AAD0497A058AB0138A8E57D514D5D431043184BD1A07B77C3299BA6C7205938ECA8403F31A1C605A942B73775A1AC11C40D81988E69C15079719AA769B5F618052D5290D84714CA57418366C15B74DA4E98DF96ABDD19884EC1703F7978C4DD72B48528789D7148F16C23EF8BCD1F353CC4A76E7C238AEB1035424300F529ACD46926874190556133021A6A9283DDFE02EDADB7DE23A4D141B0787539B68110B4882A51F95403865BECEA06E2D7A1C1F534FA3366BC1AB387EB867477B92F00C0D09615BFCC1138137CEDE4098AD57894FF74982D71BA2ECA6A0F502CDC9C89BC6A44BD84FD8B62BB5D84332FAA830E2A732259945028D2830A8AA866F92C24E46D164C4F4658791C11F0703D906A82546C75F81285C24597BBA4B1BE3972F069D6B383D61CC32B9B66604B7CDC4BB39058C74CE770F04F758E6124543E13D2365A915802F75E90997B10B15E650AEE33A291C87030517B6C29CF10670D2DC5C8889AAB7518B4DC86D86E25C52ACC4DB175A5957118F983C3A4443B33803A3161AB24004B7A789778C8414A8AA8C819468EBC28B68AFE5333F7E666D44B5A961533280B0021BD3B24E2AA51BA58F2F45767A5722E918B1204656A2B44CE628A3A84125F918999A6311CB3569431C7B0D6B58ADAB6A30F9473B3747E33C7A2A9BAF87B709353A77743949277147928273F112B5E618167A5715157B49CED69A2492203A08730ED07B7AA14BAD136CFA969DFA68C28AF40B9763872ED1B05D4161489BCE1F473D4CC067A86258F6B664D2436D4856166CC60467887F9B97439F607D336114E46B2A2964C228A18EB532CC4C6813DFB841E60C3BAA59978234A06FC95AAAEABEC0123230AC33BDC48A4452403842BD6158C668F28F20BB5501984C5D3992594A9238E03798D178702B86973350724ABFCD15255F0A5EFB7783D909031ED02C52A203DE570873C7A7C556202D53A6C086899802BDC877BC6A813AB59B781BB95F4FCA9EE76028AECB9142A992DD7180BC1C15DBEBB66765C5ABBCC5EBF764D5234D89A378D5925FBAF63A00E35D568804B973450A045E55C7C5F4907FEE390FE6877963E386BC20CBE929C3D247611E346EAE401ACB972843DC204EEABB043644EEA29BA2C1A160B98F0D28CAF0677AB2ABA362B7BFADACA4E1197F54F03AC8033814A71E1CF407972B3F1D9A986637A972B46D3AC46509C053EFBCB9A475BC4055265961C79E1374C2159BD2409A84F22755A1B32E4B604783BCB2AC49A27A5B0B07AE346AC38F54A2943559F02270BBB19508E903888ACA4BAB72E332285837B9EBB466E5CBA74D5AB6BB3B2A0FA26209A97F959C905BB4B058BA8ABF30A5A6C190A018A9803AC29D84BA710B30DA9A0844CC1A1478C289C32737144812355E0D7589B9AB765CA3B23353A350876F05081F3E4B14D8F66C998B81F458A394CC68C3B7BFD37366EC93113DB928E5F9BF0E9AAAEAFC619E332A7EF3898A66020DFC64F671879691C023409B53686770F8148A2B6F7B62B6AA42981EA0CEA7753599585034B9AD99C9AC8B12872B1A47A088BD8AFCA2D42093928A4FB770198C4CC50B0214C4C94FC7B62B5E636423C6ADB553B138591F6372CA6D53343FF7C70782A2DDC4801B262F220A539181C13F3C3E8E0A0D7191A43A54AB008D326DF803FD8757F88AC9BDC8BC75CB83517AC71FF8613B3BA713377FDAD2199BFA332B8C22C136350ADB9553E3643D0C45413782F3BC9E941965DC051DF98738CF50113AB422E4A22759CA016BEA6FCBA390ED64540112842F5B1373A2847107A43403B4AA5CCAE154B9C54831E3911239B79F1FE997BAE30A542560FE6647A2E7C4916097FD484C3D040456EA2BF8B63DBCDCC8577B7AED99C05FA28D468272876B614045095E918600F7C94BB0944F62235C169B58789AE8BC3E6F677CA8D238602399E307553E235D11836BE120B3BAC41B0A668E0841AB11F49E27AABDFC27AFCAABBF542911B6A220CDD626D819C44C72556A3946DF86C43D1B8693944D399A3B5B1309B9780E34330CA387CDE8E4C9B2D0775A962F447828D6295873CC1629777FD93C062098B6149A3E7C383E2C33CC3FE7730537416FC1ADB6C09F4CAA736E4C796D2A97FA3807C9EAB72993B4B876136B856C7BC75AD054288EF491EFFA872247A99AA39A9C2B7602027D65A169317CAFCBB77C37D89ED32489E3C2557998A06689B06AB96615BB5752D439DA446354CB0640686AA794444A806C31D721B8C6B820810A5AFC00932A885107B5F968B5C8EC98207293D8851892A01DFAE4A99832326E3863BCDA75190C4A487B46E3914B702017B1B520CCC30A5C475FB2DA94EA217F76556BFEE825076533973BAD3AC7305B5C764CD040D723617090AF4A7811E9AB206C6A331A647D9385A5E7D8BAD6C89B390B617018C4A0691D262429BBA173598B37D7C245452853506437E756A399670AD8E292B0D820E3567047C82870E82236389D99D678CD9B49526AAC30D1B830B12F4E62407A59C8F88B7B5D088A2D08B9F114C3F158650F32C682EA6A76CB62D3AD7357CC617D597A3DBBDF515F6852D71220768859D599BBAA6D029BB2121C788B5B6EAD7226DF664490DAE362C4BEFB615717D81C656B32735FE6141A25F7AB9F875F79E0A82D6EA5CDE5A017AB637D5FDB7C42646A1D71DF
-ct = 72A78ED97EC6F0DAFF51A9BAE85D1873B68DCFAA8EB163FBA6FB07A90DFDE6AAC88F65FB4BC7E7EFE6EE951364905859A26AEA558ADDA81619A3D073190F9DF2D0B68016BFC247BD2C3A1CEEC29912EF21B27EB77C7D5FC0CD9B774B75E3E2C584D8116FD0417BFAE6D2E4DE494841E45A217C2A10ED1BD3F158589DAC32DEDE68EBFC3707C473ACA1C9D44B1EAE40339106531779EA144367C767729D4991E7FB0BF3173E3DE8937FD489D09EA263AEE0DA2561E43BE35FCCC2D58EB25DC424E528B9C5575C5E1C53D0581BCF9D5148013A8CFBB5F4C2683AC792F2BE1D4DA00B136262300D51497CA16A2E6CBCDCA91A006F3CE6231D31AD90ADFCC92CF09420A789FCCE4F6254A6BBF1385CA5985C9DC9D8CD57F98EBB445DE0BAFCDD98B8B3FEC85743D9BC78E2CA193B3774E3C5DCA74EA7A8AA51A468AB4587F6C97596F7E66121BB61EAE71A9965BCBBC415D52C826016E84B204199FF893AA7A9212785E456B86775EAE7479B9E109959E4BB26F4E1ECA3181E9FF9E26708616316D5CAFD25F6169CC291B65F555590942871F3E4B62D4A41D9D9C75E8B215006A4371D8AE773333043FA33C0F293119B94E9D0E5E43EE298B7998FD6CDD1A9752BBB3DC19933A3BB232C37D4E5BFC279FA1405B7030D3C3AC2D47C999EF5FD2948DFF6A21855398D0186175923FB9C0A5D9018C74693C6123C52268A28A5B42550B965BC9DA6B3DB2F86613DAE9565646A4CB39A3D3F47C1583CBCA427F7F0B53FC60B31D474C810FDD85C8996189BE93FA1DC6935AC3A9BA2E62CC45C32F74D7C0490EB6E1AAA4F821ACCC848003D83C3B715D43ADB0C7D1D9B7FE54BDDD6A34FDB5A99158C8EE4AB3B9D1B4D4DB6F1518477E3931A56C014E3981AE2B406FD12CB1C6F275CFA4B3AF67457BD10D70D681C00ECB97D5D99EFAC58213FE364E2CB532C198F51A8B5773297CEC7CAC4342189FBDA4C2902A8687E8DFBC0DB4984FDBB9ACC6CF1E7C93B2AD02E7D346D22F3D36187A398F2D28BEBB8AAF98347130835EC07AE255B8BC6D4E50271C6C9CFE29D099DB6C8547A6526B5AA8F30B1E655F82E85ED78DF36215E2FCC5E127BD3670ABA5A368A4D16B8020634590DD1C6FAF3AC0DCBB74B006195F24F503F3EF13B5AE09B0730F9C140AF4B3481A0F50C3C65B90CADB05DFA01EF6494D8FC06A3D2A30B15D4324118CDC330AE4581B2DFFE0D8E7570B5082A9DF811B492F4F9F5C607990056B8CC03F74203F9BCC38E5BA90734142E7DACF63D2EBB1AA4F4A4EA4E29B0849054B57D8AF63F028AC835C50735808039EB602545BC1494592F30BFFB0C1ECE40726F335FBD052FA5CB6CD3FCACBA194850A05BD81C7838624AC8350E64AC910AC805DFE584A680CF9E43D6DF0F654540913DAA58CB0D14C208117E198271DB03E978436C193688B8809DEC85E7E4BEF4F2BEB731AB4220738477764DBFA8DBEE0B1A969BCF0D0BB1468DCF14C20C25D4A02746D0932554FD8501967F2DECE5FD18925C30C0B81AB2EACE088819
-ss = 3030433313514EA95B5D6A2FDFB64D4225FC84EB70336323507AED63C5755481
-
-count = 81
-generateEntropy = 0e3b30e102d707538c2671060f603bb0b8a014103f132d63b09ece07e4a4c75b11eafeca9e810796c34e8cfce9d59342884456007b01ddd12edce6d10ed87e4c
-encapEntropyPreHash = 9f27a47604ab5146caaf0aafe6d149424f8d66e39ba3baf5e6c73b19221b7e21
-pk = 30E92DBF312758B73BEB83625DF3B8D5C47A7A334D4E140915CA1401D461D7052E9FF05F73A1598DC9622C324C1C8B5DE9B0386EA3CD95B86D80085588AC69AE310BE6B5B5379202F4F14878FBB5508907B99490E4191B1E13A6890A9209F0A12910A3E096747EBA94A337AF9E609DA4E8A9F8003633EC099983B8E778CA3D72BCA1C19B4FB4A0FAA4459EA06782367580B7AA49AB74B60C4CEF7AB3BB9BA081227A7E1AC2F5400F8F7395F96567403B2401A2ABB0B70E92E6CA2102C597F496CC8881D7B688861C7988363112155B5B88271072A7A7D68B76036059CA5E402532CE8763C52CA237A334832832F2A49BE3907D15852FCED4675547796D3046535390D44580C24BCC3D67A50CFA2AD8936D46121A7F60179BE7AAD0746E8A2C8CAE124D27181A374493DA6A68D47387A44460B39A45B2619F1D29B08BA4495230470B87BB926279EB760B9041632317C4D7A19E7753458DAC07EB73331D808CE318555E1A2828DA2F1D101CDC9B8363990B85064F63226C36C71061444E17A28C3B56332BAB4BEC2602F5C31394C870DD21030997564DE52602C2628C41CB7AC2388EF35371F870A21675AC522660268A1802A2E4CA4C7152A9776410910175FD08C5E0307F4C2A61C877ABBD2185CE58738FDA15335ABA2C77A804F94077A777FB49854C7A78462263E435A1D7B4A5205AB879438A91EB60397704CD937E66C7310625A6276182D86894EF9750F1817D85709BC578092D3B65F5C84514361264909DC2147AE6F3A577097E64BBB2C679C845D827B1AC393497575E385BB39563E125C3A3925A21160201897072F03F45D6BA85DB7EB1D5B8EC7111DD785EBDE07056653507E967385945389493B95C0A95827583F01DCD473FD3138887D3472E18B24C1B7E2C837668FC6917175471F3CAA1323A34432B72C7B68F658868A2AE87306109B1053ED2BCEDCB7037AB72D8C2BF48D29A0822575CC91CA1E5698286C9B19A7471A5B652F6A900659DF9183C76417F0FC89D743AA635791D588CAE6F650F3D314D65A6AE81A935F38B964F290BE7A1A75F256776F17383F9BB9F9203415622B60B2A152A7CE3420CB49C3592AB8AAEC009A237A12C2C04ABAA08A382622DC84A053C94881664A97381AB88CA41846E82C02E00C6033B4721DB29B71FD29069297A2CC387F2AA5336816C66E75B594BCD144171C3F7AC6DF8A9A10A71F35B39A3DA7D53571CB33860315288C2F7843E855D27DB6F27B38940F973B2B063EBA12B3A8B73D46C6781AC87F44C91E982CB27E534161212B367AB74A318B0F41E7A060823F17814F9A6E4F5A9093A6379FB0291D99916B15ABC596550F152BC79703F1B0393B720CB85A510D4C9557ACF3E620CF994C0BF8C06C2606041E7C3CE6044879A7612C3A2FA587B1B7676B956291A7BA5A78527A163AE08696C7C881076189BC1623C8D360C8D85C287A9C0C6965D0FA315E2037EED604084416FE31B2F01C7678311ADA765ACD7F70DE59A9A85A8249205C78CAC786AAC9A0A0A7352B18F9CF936165A9C39D99AAC7C175A5025F1C66D04354480175FC3249930E66C9D06AA50E7ADFEFAB6AA9C205C1507A8F40512A45CEBFB2B39F3330A962ED717408E0934FDE42A5E1CBF04C80F37D7DFC7EB53A785194C4A1232E61C37A5
-sk = 2F766AD78A0112B8CD4BF28DD0F589873553BF114F19C2719F61A32CBC85C71975B911237BC6AA6ACB32B613CAC9DC80C85493FAF63C3E337C274542AB4729D02ABC5DC07309032C7112540522575D663C89714AA7A456410144D7C2BC1041C03D5A56E08CC7E5663C01F52E5077288BB8CBFBA21B4A8A19C055691E05C22F94C62C3CC2B6A9C155E2A4EB2BB9D95B8C9D5A6394D05AF87B038C210D9FAA266CF07088B3CC7AB56FF3366FBD595B3C790B5497B34B94A72D8153FA13B40BE96B51315CA4D22BE3828C3556843545C47B0254266A802A44BEE6E5A19A446472322C6AAA4CF47218EE3C99247564C552C93ED589EA8BB2C637BCF7277D5B5058DD80342815B2E8864B4C330920A82EC76B4A7BB893E0D18278F47F84743223A67F2983AC8C4A1845A61259670B02D6053CA181BA4C1BCCA05B7AF2A27C59C1E4E38DA723B787AA2F36C71E3BE05039183BFFEA6AB3BC779DE2273326B327D42517B6C6ED8C7F96C6330D4C39E3D2A7B81A538693329ABBBB5947B068C3CF7B45C173C1BA9964C86ED91D0BF64E209C1910C218434311A50A2128D52754148159891E00475654AB30B9693AD507B2E19ACB7FE6B14F27C09C6B2570B861926683A285014631C2D7CB8C0C10A25D073D3C067AB819B9DC27971825AE21CC2E50D377E3396F0266A5BA598BBE9A868B0B6CAD2CA3A8CB503778967BB930D90795719B237238C1F831007C690186949C600C6F587AC0D81C8334C57FE0C59DB3E2815D63C26C620FDD75836261644D99327A334EA5A40571F0CDA39CA716D2BB894A50BC4CC84D6621B60509DAC77ECAA39B9779A3696749CE83933EB70C1E85BB2DC3421AE9A0EF40AC2D83A1FAC16C6DCCB0AA16AFF9A94BB6D125665C3001B845E7F20E7C90A3DB636950B0836BA008DA33500FE47FD4A81DF0E268C62974BAD02A6D3B2267F917E2046DF3C1883187683F030A28A129902083CE26730438B0DC0042998C9472F5A7FDBA371D74481DBCB9BC4CB281E7CC1DC4455823AE1AB8B233E83324544913DC261B6274464B656BCB645F87B0CF4512AF443959E67C47D679020C2905D45E21DA586EE8291085A8A432AC6AFAAC594081EC298DC13175779B8635FC8EAE58982258759999A57B704A5B040245D282A9B6C9CBCA838399523F26695F60389AD42F6512783AE65A0C25B7258674398839AF28866671329109A58E579C026549F0B7041DBB6623665FBC9A2EDE41C0436635325912366AB1364B5A3162C4B8C2A14480AA6BF165588B8D26EA968291CABF66A4E26722F87977DAB7807A2C65A26A9CBD339BAC0B24E6B46E0A8082BE95BB7A41B1B8B670ED3105EAF994A06A6414E9ABE2A1B608C29C94B846012A0FCBD6959ED411D8D0C70A32559C68C74D94B2A9707B9D9755E3C69AC40782E97A1F904A32DA824C7459B59B174A9FBB6B41947F47B3361D5558D831B2B444818FFA4C17F4BFCF8B9C7CE451F4CA99884C13F85C24D3CC4740D2567A54AB0583A175759FD7E197F3000A39717BFD9C768248518D50791CD84DBA795E85388DCA21507BC669FF0B906BF515F38C04DC838D0D1357377B1601887AE1B0A0C4490D38A871910C695C50008E5A5A30E92DBF312758B73BEB83625DF3B8D5C47A7A334D4E140915CA1401D461D7052E9FF05F73A1598DC9622C324C1C8B5DE9B0386EA3CD95B86D80085588AC69AE310BE6B5B5379202F4F14878FBB5508907B99490E4191B1E13A6890A9209F0A12910A3E096747EBA94A337AF9E609DA4E8A9F8003633EC099983B8E778CA3D72BCA1C19B4FB4A0FAA4459EA06782367580B7AA49AB74B60C4CEF7AB3BB9BA081227A7E1AC2F5400F8F7395F96567403B2401A2ABB0B70E92E6CA2102C597F496CC8881D7B688861C7988363112155B5B88271072A7A7D68B76036059CA5E402532CE8763C52CA237A334832832F2A49BE3907D15852FCED4675547796D3046535390D44580C24BCC3D67A50CFA2AD8936D46121A7F60179BE7AAD0746E8A2C8CAE124D27181A374493DA6A68D47387A44460B39A45B2619F1D29B08BA4495230470B87BB926279EB760B9041632317C4D7A19E7753458DAC07EB73331D808CE318555E1A2828DA2F1D101CDC9B8363990B85064F63226C36C71061444E17A28C3B56332BAB4BEC2602F5C31394C870DD21030997564DE52602C2628C41CB7AC2388EF35371F870A21675AC522660268A1802A2E4CA4C7152A9776410910175FD08C5E0307F4C2A61C877ABBD2185CE58738FDA15335ABA2C77A804F94077A777FB49854C7A78462263E435A1D7B4A5205AB879438A91EB60397704CD937E66C7310625A6276182D86894EF9750F1817D85709BC578092D3B65F5C84514361264909DC2147AE6F3A577097E64BBB2C679C845D827B1AC393497575E385BB39563E125C3A3925A21160201897072F03F45D6BA85DB7EB1D5B8EC7111DD785EBDE07056653507E967385945389493B95C0A95827583F01DCD473FD3138887D3472E18B24C1B7E2C837668FC6917175471F3CAA1323A34432B72C7B68F658868A2AE87306109B1053ED2BCEDCB7037AB72D8C2BF48D29A0822575CC91CA1E5698286C9B19A7471A5B652F6A900659DF9183C76417F0FC89D743AA635791D588CAE6F650F3D314D65A6AE81A935F38B964F290BE7A1A75F256776F17383F9BB9F9203415622B60B2A152A7CE3420CB49C3592AB8AAEC009A237A12C2C04ABAA08A382622DC84A053C94881664A97381AB88CA41846E82C02E00C6033B4721DB29B71FD29069297A2CC387F2AA5336816C66E75B594BCD144171C3F7AC6DF8A9A10A71F35B39A3DA7D53571CB33860315288C2F7843E855D27DB6F27B38940F973B2B063EBA12B3A8B73D46C6781AC87F44C91E982CB27E534161212B367AB74A318B0F41E7A060823F17814F9A6E4F5A9093A6379FB0291D99916B15ABC596550F152BC79703F1B0393B720CB85A510D4C9557ACF3E620CF994C0BF8C06C2606041E7C3CE6044879A7612C3A2FA587B1B7676B956291A7BA5A78527A163AE08696C7C881076189BC1623C8D360C8D85C287A9C0C6965D0FA315E2037EED604084416FE31B2F01C7678311ADA765ACD7F70DE59A9A85A8249205C78CAC786AAC9A0A0A7352B18F9CF936165A9C39D99AAC7C175A5025F1C66D04354480175FC3249930E66C9D06AA50E7ADFEFAB6AA9C205C1507A8F40512A45CEBFB2B39F3330A962ED717408E0934FDE42A5E1CBF04C80F37D7DFC7EB53A785194C4A1232E61C37A564C819D9BF66855F6AE70627F04DA8378547E5867E2EB9759FE0971EFD601C4A11EAFECA9E810796C34E8CFCE9D59342884456007B01DDD12EDCE6D10ED87E4C
-ct = 98322D7A13921EF76042F6DF285A8BD2D0618D843820CD3FC35706C97D92720BAECED43615976F33A50EB4F4871B2CAF187088AC58BF63793322CCBE9A510CFF90786A7C3F28CEC3BA32C2D90D280A6411BEDC9046AE4A13A59FBC3FE2330C34D78C6743009EFDC3554392C4139CBB5855659A8A4C814F89BEA551FD3E8C219DACA38F46F8C6FF101E07A31F0A07B8BE8EE2656C189B30C9C6BC69DB6B6F14799A239B0D8677E2A76F31E081182BFC44371F8592B1A4A8A01DC524BEBCDD43F8E48A77550628253B5B78688E6C73CE990E967C6D67383EA3E66B9D8349FCE9EEC43DC2C2301A4AF7A9BEB52AA99DF13C8F578210647E8935871546416B46BF2ADE02A6AAE8B36DD9F0722DDBB5A06FE93E496427EDE60CCB84CD6B29539AD2D7F608D825D6B10AF253852912E2C959EBA801E3D895CEB04319D3791C31855E40D112B93B5444DA843439805F9C154BC0436859A4009354D0497334739EFF86318AD7ADCB4F64B4E67775D8294F92B8501A88FDB13462D82A568CE39FCEF1598A56E3E0188FE62AC5E456F6D87D37CE482D59509CDBE28D909D452A5D7E2A8D8CF90043E23C330026811BABBD9CACFE298C77B487A9814356133CBFBC0C1BCC9FA503012AD5536432313B3A88596D44D16E2B7339B50456EBDCA6345D95FF6E36CCA50B0036A79A86C8500B532AD3159444455DE6EBE469820EC9B9FD8C956134E99A85D4BB83B02F1AD116DE1249750391D9D9B860F9B75817BB09C688FA9BECAF9A5776A8CB6EE94A4540EC7B9B790A7E787B746BA8343CCDD9C73AC6B2F19CE9A2106EE0E2FBC2399DE6B4250B963E6BF5FCB0FB58F4F182A4375077848C09A1F358B2CCAFA3BD7784DF29B099171E74DCE17558934198C0FD3FA998245AB3BCD782B32B810953C845685408AF76D6C6CC252DF2A339247A5C97409B7E59E652C3C70B4D7B10BC4AD9D1DC5B5572ABC7DF75B0D335ED85C98AA6EC2B9A1EB49533B258BD1BB353339D3BCF303232CA1742F7B3BC69C959CF9A540BF7A5B08564D997F467EF6FBB69747B56C4BC07E7E3D6B4738AF1BACA39417DE8C34D72798336D2934162B6EBFA6BF46EBA85B1CD94BF04CC7B5E36A1EF66A9BF687477114295F8EA84C80267C64BD617722D6F7DE3601216059D7E82BDC18728C2F2CFD63EA1029CAE451B15AABF7BE2D13D7191D1EFFEBA909B05A419B820424CB464E7DDBD0D272BC464E689263FD501650B7AD691565625941DEE3D6DDF9195FEC5718DDFF43B067446A32E2B34D1482348446DCC8B92E0A8077C0DCD1E59F05C9B6A7B1FA867F878DCF731E5FA38ED9596F207DBA7BA0FCB3EBF2E1B0A8BCAFFAE5BBDCDBF62FA40F5AE8612B1E319671FBC71DA87F5297DFAE4BD161E02B7115E9C5C6F09A1C44540D5C8435C7E2CDA96B9BCF9414E8EF6F1D938ADE592AEF958996D908DF29D589857A422B620AE1710889B58CE7A59A4DC96AA46A7D194AE8E530DF9DA7BD319ABA09F94F2F02FE5C4DF2AFC59F77453742F35C08D943F59E6E3
-ss = B8B9F3AF55E8C616D07C7042CCC26BB4B83D20FD502BA5CC7B72310990EC50EC
-
-count = 82
-generateEntropy = 2478f7d3de6041e7e5cd11c5e2ef483d1aa6218eb126444091535f6ae532fa7311136e2681df2ef881b51a092a9badbe72c9772c169808521c47149578621e28
-encapEntropyPreHash = 90044031b7597b5e60a4f946b713e8996d0426d2cb013243d9b7d8f8ef159a0f
-pk = BE0AAFF4D255D72C6E8424C2D5D23F0AA4C28094691AC4BF0F56A51EA4799810CFB024C151C35CC3C6CC90A41AB964370C2BC953A84A73C87A02813DE34B933F233DA28643A93388F944C033236372FA6E6ACA085B598123F27122A40074A4AF57684D46398E5D58B13A863B0B984E224A7AD52C1C4EB26909451DCF2A15DCB11AC4CA38D93CA350078138E0AE87F1390FC9045EEA420260C913C6B54DD93495F31AAC32350CD03500DA308FD8BA0777C999CB4982C91E569A1C52396EDC506AC7CC43264A05CC880191501860F1A32F7760AD3B17FF693508339FCFC05FAE095C6A96C1E6864BAF147186BC22DD882620E5A5F4516DF92B8B715394C5677D0DB913EFB25459D6C636442A8CE22899F8943957BB2B281A8ED14BB5D0CE6DE3086EA8B6165798619B2ECBFB22727CAFC6409E23088C6C940C23E86A603788C07BA89D6BADCEF07D79174ACF70C55B7B30C067BD8202A1A70998459C54384196F814515EC9C7F360061270090EF37AD32115242C2AADC0121E1A08623038B311982C669DE3DBB1C7789530191B07A947C9637BFA241ED35AA1D03C81F0D70F8B95112A3B1B08B25C34DC7E1D577FD30A808AC574DECBB51538C2A017287E62128F32AFB0F7A73EC8831E6B975007592B5C652FA636C7315BAA474F873A5DA2E82FD146268DC951689BA83E046C0F4820447C3B3E6C78CD240BC4D21E0A4660EB1C69402B617B83057874122E203BD6313D7874A987F2987599CD4D7946E50665F7D9A80651CC8DBBBC4DF605F48274FBA0640F8609B6554A7760856259C32DF00D3056AEF65436A285583CFC9D9A644F66E382D4907C6D78AA461A2B6BA8887C238F81D31E796A675EE8B7A598AFD5D79A0587965420A2E9F2782B71331737680A499AA759824D11ACF1A001F9A5865B6568ED8A1F4F4CC38F74C24E231965E9830232924526BAA377B2EE933A1FC4677EE74FD98A0881628315AA95085C7415A1A51A98406FA345A69802BA71CFC885816EA30FADEA0232B13EAFBC24B84347124BB41F8C663506665CE4C3801B09933C19675C1F9CE54C418207B69215C91B10451730DE65A4AAB6C97804AD33C50233F83599133510BB334D9C1F4B7970087700EF45500CCB31B7933FE74A346AEA4C9BD409BC5A186F00BDCA67CFA8D041DFEAA56547A71C35CEF1B664629AC9D4F431CFCCAF62A781A4BBB2ADCA7A7914627DA380873977E6E1A11FEC0938A3A886E9B328A8A539557F6C700285693266742F779BBE2E7A0603060673C7BE9591BE19A57A0CAC91CD1C61860A86356B90715886ACAC2306190CFF686883A61E56140F64BA76123C1B07614FF5C8A4B402CDBA738AB68B749C1151DA62C30DFAA3BF826D4848C4910C9EA20669735CCA4DF583E0C5412B610BCE816FD17AB9C203A7EA42081901C8CD78940F090EFB49718AC90AD6A101093580C13B5FFA0AC0D7B094D913A9DDFAB03F835F79173E966746C69A0228D06A2C363E94522EC68312CD312ECCDC688C4A88F6A5B7C3464CB7EC842FC1377359A162032C8C504105461936714F451481D8A4942D1715B6A65583999B96B0C47A914F2F721F5EC6315C91B009E714F6518BFDC75E828256F25740C91E7EFD93A5D7DB1850127DF85B8F086DFC57F1F62A86D6EE7E45AFF3F27BC1
-sk = 6C33B8AB2B4FEBAC9FF7DC3E4A689F468A4F08D5C87EF8A142B4766E24073DF336EFA5A0D6FC17B6BB2C615658EB04AA9035560FF7979E27C65A85CA6B1B9BFAAAB23D89C6A825CDF7E312F81066D516BE72680E5A665830F74E371BC411BA86F00704DCD3C40C8C1295D6B52ACA51AD41732032535AF95BEF907127EAB1EEB54899A36961793EC47B91D9725643664082C4375F4843B0031B815C8DFFCB7F25D4414191746D5AAD14093BF2C005DF655F69917BAA956721B4CB8B8B51531A4A6C0CA50F8AB21DFC7CD9F81D730157A59B971E4B4A0FBA8EF49754A7C2BE0325C8BC623FD2A94A6CC4226677260FFCB64D75167D63334E395DF5BA4505495CBC8C3A3E40AB68796D6C646775339C29683A21F921A7C6A79D39A95C876F782A27A6365908381D793B537D1A681CAB5599817E050CCCF7803BF9A90CCC4084743C96069183B08702979C9DCA2B9D9BC26E1DE849976AA1465B29EB260FFC64478C39945A9B402520172CD7861C5A0CC089A028C8200208B3E4D7B3A91CC8C209C5E1D201278B01CAB34126C701BFC2913DF501F6D73D9424CF1176B8616C04C10940EF9832957585EC350E9761505162AECB28884F659EA23125C382CF24F383F9B09FEEE8AACB981DF21A6BCEC26E2A67493B919FEA06170C18B79E5A01E6E89516707BCC7CA353727825514AA0D52504606013E53BA916BD133814C36B98FFF15F847B7383854F692450AAD28231F2BB4FD839D2B532066114DA65BE8CC5073F9992E03836CA3A623C301999A56FB00332D1BA8A26D599D0F5A97975814BE81FC9DBC536D1C165A131CA3C55D04A05D7A53FFF1299D3860CAFD8BC6E3B97E72A595D294303A12994510F74887FD1D7BB18DA70BFC5BDD58C1F6C1CB56F5994B7F2225CE0AB29E8CF3DC851F1AA5BF2BA255F7215CC71C5DA95115D6A98A2317224BC6DE1B2C79353BC5C3C046A7A0933A73419F7B117B88F3A53777143546CD29014E15E37C33770A8A9A11BC2F38777E400132A812A984908B3D2B87FC465B564045E79453C0666E3682A894C269551AFE25286FCDB681CB50B260B4327B46C2D0699BECA103965B0A218902EB4680C1B8C3ECB2011A396B0DCA97D56AAD231168FD9A7CF177B85B7729DE4A4BF035482AA7758ACA9E1F36BC9033EA34C6DFF91091E8B36FD2A2C6B1094A8338AD540C8F53CAB80D73E7DEC3977452915B616D0F0BF9E842663CC477CDB5DC94579D6222D1B647EF4D358C5435D3D0799242B66818A683E8C5651B0B26CE4909F8656FF35CD7FFA1C5988074FFA32DF093BCDA32AEE2003825593B545B44190787C4C8656D85CAC293F615811CCB35EB0413F44B1722E0A182F09481712AC68E3C9D31085EA77946A54BAA91C8AB8E814C5B94206070C0A6037BC02A292082018933A5AC32141180A6DC760C2C9ACEB3B1A1505464150A732664AA51B02A721B63759379A638BBFD07FF9A7A84E071FDA70200C61894A8891DACC375C120A35E0A4F296A02845477BC0484FB5BC539C3B8BEA3ED2511D480B1DBE76C640622B67A1A8E000B954057322CC005F88284D6290A5D720E32B5F6CB6B992BC182D66A73B5019572867640343F267133B060545D4B2BE0AAFF4D255D72C6E8424C2D5D23F0AA4C28094691AC4BF0F56A51EA4799810CFB024C151C35CC3C6CC90A41AB964370C2BC953A84A73C87A02813DE34B933F233DA28643A93388F944C033236372FA6E6ACA085B598123F27122A40074A4AF57684D46398E5D58B13A863B0B984E224A7AD52C1C4EB26909451DCF2A15DCB11AC4CA38D93CA350078138E0AE87F1390FC9045EEA420260C913C6B54DD93495F31AAC32350CD03500DA308FD8BA0777C999CB4982C91E569A1C52396EDC506AC7CC43264A05CC880191501860F1A32F7760AD3B17FF693508339FCFC05FAE095C6A96C1E6864BAF147186BC22DD882620E5A5F4516DF92B8B715394C5677D0DB913EFB25459D6C636442A8CE22899F8943957BB2B281A8ED14BB5D0CE6DE3086EA8B6165798619B2ECBFB22727CAFC6409E23088C6C940C23E86A603788C07BA89D6BADCEF07D79174ACF70C55B7B30C067BD8202A1A70998459C54384196F814515EC9C7F360061270090EF37AD32115242C2AADC0121E1A08623038B311982C669DE3DBB1C7789530191B07A947C9637BFA241ED35AA1D03C81F0D70F8B95112A3B1B08B25C34DC7E1D577FD30A808AC574DECBB51538C2A017287E62128F32AFB0F7A73EC8831E6B975007592B5C652FA636C7315BAA474F873A5DA2E82FD146268DC951689BA83E046C0F4820447C3B3E6C78CD240BC4D21E0A4660EB1C69402B617B83057874122E203BD6313D7874A987F2987599CD4D7946E50665F7D9A80651CC8DBBBC4DF605F48274FBA0640F8609B6554A7760856259C32DF00D3056AEF65436A285583CFC9D9A644F66E382D4907C6D78AA461A2B6BA8887C238F81D31E796A675EE8B7A598AFD5D79A0587965420A2E9F2782B71331737680A499AA759824D11ACF1A001F9A5865B6568ED8A1F4F4CC38F74C24E231965E9830232924526BAA377B2EE933A1FC4677EE74FD98A0881628315AA95085C7415A1A51A98406FA345A69802BA71CFC885816EA30FADEA0232B13EAFBC24B84347124BB41F8C663506665CE4C3801B09933C19675C1F9CE54C418207B69215C91B10451730DE65A4AAB6C97804AD33C50233F83599133510BB334D9C1F4B7970087700EF45500CCB31B7933FE74A346AEA4C9BD409BC5A186F00BDCA67CFA8D041DFEAA56547A71C35CEF1B664629AC9D4F431CFCCAF62A781A4BBB2ADCA7A7914627DA380873977E6E1A11FEC0938A3A886E9B328A8A539557F6C700285693266742F779BBE2E7A0603060673C7BE9591BE19A57A0CAC91CD1C61860A86356B90715886ACAC2306190CFF686883A61E56140F64BA76123C1B07614FF5C8A4B402CDBA738AB68B749C1151DA62C30DFAA3BF826D4848C4910C9EA20669735CCA4DF583E0C5412B610BCE816FD17AB9C203A7EA42081901C8CD78940F090EFB49718AC90AD6A101093580C13B5FFA0AC0D7B094D913A9DDFAB03F835F79173E966746C69A0228D06A2C363E94522EC68312CD312ECCDC688C4A88F6A5B7C3464CB7EC842FC1377359A162032C8C504105461936714F451481D8A4942D1715B6A65583999B96B0C47A914F2F721F5EC6315C91B009E714F6518BFDC75E828256F25740C91E7EFD93A5D7DB1850127DF85B8F086DFC57F1F62A86D6EE7E45AFF3F27BC1DB315CAFBAEC2F8A0142F45AFFFF65289E826C9244AB1CB03F9F65DF3E3CBCF711136E2681DF2EF881B51A092A9BADBE72C9772C169808521C47149578621E28
-ct = C324CF3A1900484410A1DE432AC56A735217564A14F75A75526E6C83672BE590AFFF601320226F0C0614068ABB30B7B0AA66D54B4FAA789F9D9E0E48DAAF7CB452F4897CBE76FAFD89BE2FE0C32F9D0D4ECD61E6AD891998D5C4B334CB9DD402C2284E0F03A85DF505C876D300DA586E398AC16331D8F8B8E84B7347EA13D50DD1A33B7116520638E8BD779793F6CBDB1ED82D8ACE7F25E50F94EFFA23DE36BEC9210B1DCEBB1319A8AF22200A33A49C09B63998A18B4D438E1E4958F5DB78CCFE9E10FF0537F35931F05E629D8BA4A5B18E9C1EF194089DA0C96105BD287EAC7ADEBF758F4355B560404351C58646BA01A955644D1FCEA3A30F7AFC01641D360E74EA49BD27C1C3943092FA740075AF38EAD19E6376E4C91F9075BE124B4A43A0DBED278B3ABE532698E57B60D1DE574F31E159D98EE07896B6E9D88A4F2594BE1F0A0C73D7466FE92F8464191B7A7E54791981EB2A8D39A0B712F5D4507F8FAEDFC7E49EC6F31ACC77466494EF73277330AC837272D68CCAE0D05D75A235E353AB29216A2E8C7ACCA8123D24441CD51CDC6DFFF3AB4FC70800A427642C1E1795D41C9BA9FC87A3035E7F1CFE390F1EFBB9B955EC6A0918BC45411E8325FE8F4D6BD928D4029949508DFD4978395B6D021C92453B8599D8705951E2FECDA5F03476ADD8B6D7FD9B1336E70A57F42017CFBB329E925180E034A438A50623589871E47EA8994C1ECE7E35EA42384B1E66DEDBB3A111513B6DD7F25D95F5FF0236B717BADC740505777B2CBBCAAB063523C6A8D1EF6A9CC9F689DC6EB2759D5916C4AF16564E6C23F38A4C27DC1219094A023EBF5B56827EA897045DC881F0A89A853645942356EFF1A1A9BEA7F2C12C68B5EBCE0706FAF9CD72E453E0188071856C7FF37B952CCBB53CAD0CBF604DF59438C4022F6F26D71E9073CC1A45AC6BD3F6A71F3EB284FDE720416CCF1ABCBA0C9239144A6AA38AE655786A2C3820407C77F8378858F0877E6CEFCD5BCD8E5FAEDDECD68C1E2FCDF9BDA5EEF60FB7E8AE441CB8054FF7C94A8697BDE5001893ABF8140424583DF49796D1FD10F4DC493BDAF3C1C3B76FC1D34346CE5A5B7755A68F8C5490CE8827CB8AB61C3339F0DECB83F09230EAA58E6154BD8E1A77291654450A4949C3DAF8B4C05B001D94F21F0698C426A93D64B2D1005D1217BE6783588EDA458545CC1D677B2770B25491224D8D194285AD612F741ADAADEC5B2882D13334B9BECEBB39F9F0D4DE237FD36D7B4E114A079BEE6D7C2AFEE75C4961F81C75887A616F1E6497A4825C939128FDCA95DF452C5F4D27B1D516B33DE9336E394906547AB7FA5ED5A45CAFCBB56E324B606DAEBF25E705590EBE36AB32F5B4A4171AB7832DBB66177E9AE6C29E5E4F503AB861488D5AD246988D4CF8A41276F1048E4D778776D34577679069E4248CC09A5EC7F533685E137AC32C984E91E8830E1934F6B2F91B33A3605C53E51A8B7264D53B69AF57507F5B5AB6D4F1B1B09AA1E50CA13CBBAE62AE464E99C40C2072
-ss = 2E4139C499A24CAA334754E10C6BBDDC7A0830499CA65E941AF8D87EE022D483
-
-count = 83
-generateEntropy = 9d405d3ebdaf35fa8722de431b669722acaaea2fd10b814310b17f78b66147d16ceb14f7662be0c42779459f69a145c0e2ce9f0bd9a0cd1bf32ed5694cc9ae32
-encapEntropyPreHash = a7a31e140891ea37d2b6424b59b1f84f89220f32dcb73e037eb912b389d34a48
-pk = 690B34B6586039100E84215EDDB39AD2D40BA9F80165623122A2C5FAF3437AB0376894CE67397D32A67C3BFB9761850C1C68AD988348725C83A378143D504400F995157903B9D04EE43404AB2CC7C35B8E0E09CCE4559945F5640450703F81C35ED332746162F7B8328F78BFC3359E7C1B4FCF06155FC745C70245FFEC09ECA957C8475C62B05BFFF288A5E5A5C78206E48C3EF373658859C3D9636786980578C07B764641D6A87222224557D10436FC72B563883ECB0934E50B6EC89429D7792EC0BFCDA416FC2AC323A58DF3FBCDB6E023140478868055251B1C09FA023E240E109869C1D2967F598A529042D9859F97CCA2E85A635418707B3AA1835B77DF93AE4DC53F228083DE6A04BDF58655C59BF57B107987B88CBC001E010B9C2458BDF138288190F955B62C7013DD5784C809A7B1A29F8C3C33F0311A555306327392DDD44EC8F72FD5893F56F58BAF207F9EE98B7E31092F761C390763A8B57409C7C5C665A913E20C9B62A5E80646364AA8E3B95030FB2FB289991B8637EA57C7B324A25E0389CE979B5E816FF841456261BF042C85DAD84F80D788076B7C69CABB8E389A72657D7D63949657B934A468516C36674194DF1AC3F595A294C28D24C26E1B1B5AF5B542E025A182868E1555442E0B0D064865ED5CC1665074E55AAAD601779E591E1ED2AB07CC551437603D24CA743218FA846822B2857F871FA26834E0422746A6C7DAD256BC0B4BFFF21BD7309482D7669F8857543A0436140EC684C959D26F2F827A84B37534B7AA3BC0A08163689F01141B511E7D11A316D2AA7D73909E889DD000C20E38667DA048278B5EE87188607B4210642F5C38866FAC1549637C600C8BE8C60C11AA394E8344B6C6536E687EF6DABAC397ABF1CA7486F6AE87D8A3DC8070B5687F7C6A73225B9233685C6B703D33677998C24E40A72894193CCA1C5ACBE4A133D85A6912587AD4AD522214974CBB1F877E16164683021EA9C335D41B000CF52A3ED45B2D95B7E2D061B5213DB4C6BC36D76DF5DB9EE6984D31BCB1F6757DE7E51871F1AE7F388C5134956D3286A49BBA39967889C9A424772BF5DAB014C94893A4C8B74AB099687919243C7633CAF297B2B73AB15DF419F6EC22D15A95553831BE379ED0489749C495E3B6B8E190049A8065DBA8933FB21BA3A751CFF289A2E2772B06A4687338CA88C0EEF1488B848AFA1041F4F9607EB18BC0650055803041B728F2F1922CD984D228096FF29E71F097921423CB82254C40A615240A2482A3F5F095F5B399A8F9ADDEB6B726F43E3AF64D09038CAFEA26686CAA2CE2194CBA660EDBB083F92DC2A51142BBC922958C86C62CE7A4B3A4C95240D72244A912C3C193485208CDDC4514495B35863CFC6CB41FA721A78080FD7BA72669AC6B29ACCD3B832D35AD70F7584E197D695B78C832000C1C337FC019F0AAC04B2149A469420C15B2DAF5281DBA5DC3618E0135C043F139CC74B14E7451FC11328F06B73F124766403541131D94506628C30B7BA68564179FAED9C9D2A20F3B61793A33A65E92B699A47FDE974EECBACE22690273A757DA903A886778002D283A819CB1EA2D34B8462DCAB57C85653E363629D9270738434AB1BB46BB71890031FFECAF8FC027D2DFA2A4AD271DD702F055836F40CA137E5D0EF9
-sk = 2220BFA6A447DB5013ED5811B45742B6E95C723A35851518E04B1B619C5607944C341A1ACA4C0EB297BFE3990D514ABA3DE30867D646CD76A1EC1176F1E84EE60704B0E04366E27ED0F321BBF42322F5289F5167435B880851B48DE717E40A1B56387D4705815701BC2B80C55F33B3C20244E0E27FFCF43C457A3674000A4404B4157CBEFA05C54F50021684059939A3AA088DBBA13BE56047DF450AFE33C8742ABB0CF48E0B1C24E8719EECE41EC4A3254836B4E45B4EEBBB43D398A813BCCC0C42CC4E437050740C892B657765B252943896325E3F4C45887452847AA315BA8C811B39254A5C3EE64F65823FCF2A92E3198D2981289E021530AA4CBD210FABF51094392E25E755D778A02CA145FFF47165711AB9397A0F9B3DEF26BD0E5143C23A815C8582976521D63BC74D8B42B95280CDC77DE3528628862F44D475F49AC204C87D2647414A4A136A094B7FB923BFD3496B187592E81B8168BDFFD9522F60BC37052FC579CB3F7A398DD677BA14A3FCA1248057A59A58531B7A1F1773735A27612520B03121390CF624D46927CEC7C7D00AB13DC2BA6445236BC68642EC9659D7BBA40AA692C40794BC4BF5F13FBB617E711A54BD825329AC6A9AF2A88A54A600C0CD6754B4A3ACCADB397CABF2AF41463C00512D6D206D011BAF6D833E4ABB8DFBF736DF8036278A8125389C3B99940881760AC150967464483242DD52358A075271FB82D949AF57F345E5DC46845A94A37893613A76B6E7B4D0DB0EDDA213302677FB73C493A349704333278B201B6BAA8315731A348DED27283DBAA05E057C26C35D68A5252F1715337A1543895DFA4C395F9909B7B1283B450B71730292C32DCFFCA05221B14849AA5F94888E2A3FD33CAB3B380F8093742247AC27012E8D7A6B8702983DFBA43601677679568A8051925133FBF6550DC318E387C3E3176EC9C3CAD6A739C6BA5B72FA587F000CA8F06EEA003CD05970652B0F3F92B8BD4AA1570B02CAB21D2BD0A9937A499943CE285B32706589C11CB662461444629F5C755B4A09805DD5659127BDCF5466270A5CB6328FDD0583E701AA98D34095506284B63A6F7B39D0B31FEDC43E20E4BCB39B99D82515E041627FC5402290BE758A062822C26B750463141D9DE8793B385F556A3A3F74BD8AB61F69304AC4082E08F2CD05E5BEADE17D2C87B9535A084A6B0547389D08F548030B1DDA0137D170039E082C5583BC83695AFF0898F7E19E54204582989556B924DF35A00C518AB95CBB466B5BA0D8AEF007A8294294870902E74152832365FDB79508B69E45484139B4342DF8C391864B80E807B9DC8DDCD4463FD1A986986B81A62D79AA9565308AC1471F09D09A23F24E4EE5522B00265770674C61348FDB3BFDD539994B20FF22B210162961B56DBA538252610FA607372DB1317497B85307B61D890A62B90E4DD37246763DC6093AF5F4CD0DC20081BA4CE2D6BBDC969580607022C590A1687004B0730AF71C60590D1A6B2A5E51C742D2CBBAA826600055F4811287A062DA1696A22808507AAC327A9194C5C6D49C823557100C158E60B845AF953539A855D217C5A77599B1783F7488AA85F222DF73B837E4B8D1006A8FD6B5B06083690B34B6586039100E84215EDDB39AD2D40BA9F80165623122A2C5FAF3437AB0376894CE67397D32A67C3BFB9761850C1C68AD988348725C83A378143D504400F995157903B9D04EE43404AB2CC7C35B8E0E09CCE4559945F5640450703F81C35ED332746162F7B8328F78BFC3359E7C1B4FCF06155FC745C70245FFEC09ECA957C8475C62B05BFFF288A5E5A5C78206E48C3EF373658859C3D9636786980578C07B764641D6A87222224557D10436FC72B563883ECB0934E50B6EC89429D7792EC0BFCDA416FC2AC323A58DF3FBCDB6E023140478868055251B1C09FA023E240E109869C1D2967F598A529042D9859F97CCA2E85A635418707B3AA1835B77DF93AE4DC53F228083DE6A04BDF58655C59BF57B107987B88CBC001E010B9C2458BDF138288190F955B62C7013DD5784C809A7B1A29F8C3C33F0311A555306327392DDD44EC8F72FD5893F56F58BAF207F9EE98B7E31092F761C390763A8B57409C7C5C665A913E20C9B62A5E80646364AA8E3B95030FB2FB289991B8637EA57C7B324A25E0389CE979B5E816FF841456261BF042C85DAD84F80D788076B7C69CABB8E389A72657D7D63949657B934A468516C36674194DF1AC3F595A294C28D24C26E1B1B5AF5B542E025A182868E1555442E0B0D064865ED5CC1665074E55AAAD601779E591E1ED2AB07CC551437603D24CA743218FA846822B2857F871FA26834E0422746A6C7DAD256BC0B4BFFF21BD7309482D7669F8857543A0436140EC684C959D26F2F827A84B37534B7AA3BC0A08163689F01141B511E7D11A316D2AA7D73909E889DD000C20E38667DA048278B5EE87188607B4210642F5C38866FAC1549637C600C8BE8C60C11AA394E8344B6C6536E687EF6DABAC397ABF1CA7486F6AE87D8A3DC8070B5687F7C6A73225B9233685C6B703D33677998C24E40A72894193CCA1C5ACBE4A133D85A6912587AD4AD522214974CBB1F877E16164683021EA9C335D41B000CF52A3ED45B2D95B7E2D061B5213DB4C6BC36D76DF5DB9EE6984D31BCB1F6757DE7E51871F1AE7F388C5134956D3286A49BBA39967889C9A424772BF5DAB014C94893A4C8B74AB099687919243C7633CAF297B2B73AB15DF419F6EC22D15A95553831BE379ED0489749C495E3B6B8E190049A8065DBA8933FB21BA3A751CFF289A2E2772B06A4687338CA88C0EEF1488B848AFA1041F4F9607EB18BC0650055803041B728F2F1922CD984D228096FF29E71F097921423CB82254C40A615240A2482A3F5F095F5B399A8F9ADDEB6B726F43E3AF64D09038CAFEA26686CAA2CE2194CBA660EDBB083F92DC2A51142BBC922958C86C62CE7A4B3A4C95240D72244A912C3C193485208CDDC4514495B35863CFC6CB41FA721A78080FD7BA72669AC6B29ACCD3B832D35AD70F7584E197D695B78C832000C1C337FC019F0AAC04B2149A469420C15B2DAF5281DBA5DC3618E0135C043F139CC74B14E7451FC11328F06B73F124766403541131D94506628C30B7BA68564179FAED9C9D2A20F3B61793A33A65E92B699A47FDE974EECBACE22690273A757DA903A886778002D283A819CB1EA2D34B8462DCAB57C85653E363629D9270738434AB1BB46BB71890031FFECAF8FC027D2DFA2A4AD271DD702F055836F40CA137E5D0EF9C8D853E65B5B118E28B7CB6F0D5D6F282E0EA20FD72F3690A6B232B20A8A55EC6CEB14F7662BE0C42779459F69A145C0E2CE9F0BD9A0CD1BF32ED5694CC9AE32
-ct = 1F5D4D55EDE2DD05BE7F87C0FADDE30550A5D90923B7BA8E773B5EA78DD3770B9CAC323D98A6E08C19BD600C830E2C2FEFFCE4DAC32376EDA9248E0CBBA9FA0EF6656DD0CA9B3797992C92869164EFE226FED579384121C0FA2B417D5A9F1EEC78ADE19AD9942730593C9AD039EA26883991A02B93F7459EF9D461D5D4894EBCB31025F095F1B6BCC6153D5A998B50BEC88D447A8FF33224D2BA9E9A58D2299EC6D3735096CA81244B315CFD39DB3B85FC718AFF5954B017724B3C6BA3F6780D87E637B0EFCA63C4523099016F78F2DF9BFAF6B0DFAC64332F1C5CFA54A646000F00196FF0686F0BE1728F6407EEAADA48F9E7A6946815527972C9B661A7CE051E76F3B6767DBB186AC7B923BC7284F2840F7B321873B2E46206489771533324248CADD5ABED7AFBCCB43FE0AF06F2C6D6F867B189522261A2A7F042679E8C9E15AFF58FF305D6FA288B1471F46AC82F664012E1C1375DA9A100AC4FCD9D093F191FDF8B12088897B2D8E9E0CC9A986A458751717FEB6438DE9186CCA6B8D361A29D2FA7742DE825ED2FDE97A021087D2DEBA129EAFAF10F370C2833C80818B26E062DD34CB9A4B23377F79C20AAC87C9F93F7B7AB25F74AC0FE18F092E1BF6E43A82ED4C456682F11DD7CF5B41E94FBBAED42A1EC9432E36514214C6600B053A0C9DA4F99587267755E95C3B45BAAB7FBC3570A2749A2533E9DCC2BFD4AC1D477D585BDDBC1F44626E40A3B2678ECA64316CB6B9FCF232BB26D988B3EEA81E9568BA4868FF8DD72D457513552F6C25C5C5C605401922DE6DC878688CC6762B3904B7AB8F06BD64F239CC5103863A7D066570235F53D4811361AC876A15770755F9834B7D49C831D97C5602BFD14B9EA2B37DFCAA87E9FF0F7EFF68933C5CC9D8E5A5DBB5ABF8B7B7239D384DD2C3A500AE16C50511F3B464F07A1DE801EC034C3533E55FC94398DEB4E9E6099EB40A75548EB34DD62201D39057D2D3AF3EE71EBF3458267672DA7650CCCEC7D34F8D53B3B63C4BEC77DF151483331A461C724320F4B8C14F0BD96E0B932A39D41DFDC8D256F213DEB9DFA7A9C2B43FC15D807B3F4062D0C1C80FA96EBC28C0F4ADA8E47750AED8089AF233686E9AA2463DAF738CF0E754ED0CE169A1C7B99396BF71C61C81C924066045481A88A2995D0578786CF787ACC37287795CE12A14C7E128556ED72EBF3C25C60F8A4909233EFAC38BA1068E81CCFD3236372565985C41909CF5E40A8962569B361A026B2A5F5AD411E6AFB36A536920C977DB512AC027E1C240A0AA0A0176FC61334C5FDD25099164227D3D4755045EA9414D3D199A16A8C4D9E6DDB25B187928E7037E6E42F895AA598A9CC3F04B1BFD9E8122D1A6F4D8076ADE9F9C33EE2B9AAFC78B685FCBEB2C0B39B84C5B12D0AC4DDD3421F8D20FE77540A78816D364658B49B7161DF6B87D3D7D7F4FC26FA13EFE503C1A50D3EF67B9E367B4EACB81082E3A29C29E708F988D888A80FEDBC9ED2B2ECD1DA8378DA262113FE18A9EF88B8636862D9A92542
-ss = E412F3AAC1C0284D999D5A7F8344B4053D10965FCBE1638F7EF666EF29C521D2
-
-count = 84
-generateEntropy = 9a86490f0615f3edf789cb0654066e9ee339cc59f968281f3b89213f83c692edfaeb2ef44d2f608621e831187ce79b2d2f4a20f1568bbe76b0d3d5af36111714
-encapEntropyPreHash = 70eb3f791faa91f1f982fa477dbcddeb2c55691c07f93b04cd31b37544c94b42
-pk = 44BB530C48419ABC7578B33D6DB56C76179E9DA3808BA4C8D7C227BA5C64AFD5C87E01C1AD12A294758F45804719DC7369950E9E6398BFCB60A7819585A689462346AA5968DFA83BBB3B8A51BB59311C9D100A4A0C7586056201FFC3CBD92C3A42D6851EC064A89227B4D1551CA7AF6B5B3E892B4E44571669412E4240A08C42551DCC50086389F9E0C0290956B5AC58844A84BE308D0A5562B57B5CBC594CEAE87910A13167F27CE63B822F201AF5E9C33BCA746BA7C5E8541FFF17324228321C7A0EC976646A6B5615F80FB56351D319B31960AA8823426682A610652652994D4A78C25659B533F5B40E6236A6E704CD891502E9C2D1858CA64C94D3734AC0BBCAB2DB2F9E03450E721A38C82A4C26A487F006E1966FBF8063AB115E74F441837506559BA5B7266F62B17E4D959209B657193689A0354149880D08434FBC282713118D9DAA89C52186EA918CE2C170D8380E45A32E9F710CD6F89DAF91C9210B767D743F61655A9702051D7C8A46F17A681B136C0863CB62430D084D282099D1636C04D6B1EC212A74046D2D8108470123DD751DB685A1A1FB3A3B2C216F51302FA13AD73B919A439D424A4AD9E12994D1963B3C0E0316739CE50A1A7C23D65ACEA61423A5792321A84AD2E1B3F5B595F11637EACA77FC753260E04CEC9CCF55D70D4D567BB78749EFD005C9525F6E921F0630C25CB9A129781B9B864B7556272D5B4164E340D9464BF192979A073384F6A5E52AA0B6B74D43FAA5412C5914524974161AFCD91660705659DCA87BA482D67C8C1400B069E66A19905B331243701AC8261952C5B736B25290235669FBDCC254631294FA2E97C440D97A0211C35C2FF4B6009AA66E27CC09BC09307C7B3794A5D189892EA60B2B323E95057FF355114AB48613E2760E00BAEB82B0A763067E216AAB899E7CA06E195A5E92486CE8911BFD5C7D956318AC3B029436A9D88C56AAE2A3DC7B382F2C5E7265A037A827761447FC59A40A3C8693BC996CA786FA7AC1BBCC6AA404A1BFDB3D227C6ABE42CFC463C2F1542AE418CF4B38CC2C1595F9343D41B4A1967C7C94A7A0AE91CEC8235705805AF096CBEFD0CAD6DC0BB5130907D64E76E4BE957A117D121D66071598112EA7D02B9648CF53E57AF9E7CC3C9803AAB327D87C53E41CB9BBC42368D332E0A963C3385C18936AD7483A5F4292B625C844C2282F25AF0C86984DDC09371AB555D57DE146664FAAB59DFA514F8BB8D397A987BBC8DBE147EFC2A34DAAA712BAA1E36C9C5113A7F47BA8C4A83DB2DC79AE93688AF7C480DC8ADF0B12D7F5453E669BE2D805DD6961454BA8B40C6EFA961E53DA19EEA2243C998B504C8AB9EAA2DB11B2F9B591990040954A1567074E69154AD6E618D0830D3B554FE4C99F48B51CF6609952CC9693ACAB000C335B98126B4B45A9F317F80A6049558FE9D855A026AEFDC649D295387C530E075CCB32AAA202171C6F6907A4A2202A9C5FCF252D98328F12F927E31C596047140AF9B177E0352B120954D00529A07D6B2BCE5026A6D7CBA01231A85BA39B1692694788C9215B69FCD111FDC8934A1BA24CC7890EB479AEF01FF29161B0A7AD921BB72A8B495FFA74C62C880BF03F0BC175EB865A17ECB56E0AEA501BEF8E12D3025185BA4CF8EDD1B0F297471D58C26516
-sk = 7934A9FABC835BF9A77BB807332251DAA00876E5500D2C59F07485ED01BC934911A336ACDE5527DD166476CA1D1AA558CD88CD7BD17CE1791958E851991867C0525C9472A953C8B04A730E2E132C6C26811CB86F3234229F4CAA2AEACD2E3C840E97B8F1805B94D7317B08354BCAB64887A4E6A98FFD90A7544562CEABBCCE6489C6E8534119C9589C405D7A96DE3230094A459549B6F37078F2C01FC9080F049464B0A969EB742419147C8B39B8065A769D400A17BB25DE51A699B69D54BA460D33AC6A6965916829B7A578D0B24BFF786CEF9963BF961ADCC20F9A0CB1C159865A344A0E36879C67852DF50ACA08A46E72A4A70C027CE283DE5BCB219808F2635BD7540915C5485AB70358CB017882B12ACB4426B22B02605873F2BD0DA59A658075136CBE15418CCA0A11386AAD43A52E3C5AC97F36BC7F648808C260643C325CF456E6166EEEC74EE8476AD62C73D7D334AC279D84B66B6C8AAC217A813DBB3DC6007317A165E6A1657D0277C1E683BECCC956D973C7624E959724FF9275C1AA2BB5ACA75159721B8C6D7B299C7ACB4704C654335982E83AB3724CCAB3709D20601C2A943D5BFBB3D384A7E83A7793905301B1704CF49992077B19F0204F3394717C9AB9A173113004FD325EDB797A30155D0D2A1E4984644F245F5B495B56A98FDC487B29B4A5C6DC4E3047A8DA2C9325F1705613705628458BD525FB333087CB4B967A61A994CBEFC504D18C1B8A62898AF32BC454A57E264722897D5DC71E32C2495CA857E1A234AE61C77083BA9B780342D7CFDFF8B7EC1257B79CAD017113A3238510C5683C3A8C396986ED392B0122C16E34A7249691EA7A931C44087FA1731746C1F3855BC72414FE3484D85B5E2586B6231B4BCF27831EA7B57070A815795F43E90B2112B235F5959EA253DB76192BCB11D4E16399D40C5DC0A15D98C3B3B0289F07839F7738ABA3281D45AA0A9CA1D349A64E79246C2C7770227F1E1CC74DB8AB7EA7B0E60A9DC0E45443B30CA656CD6A8897AB105BDA51B02179936F04374554A52992710F2A70972479462A2859736C2FE4359A474939AC3531B2905F90BC38860B5615ABFB1A1327814C01048BB93C9725C7C3B0547921975766A97E29D529E4D8A090C36820DB0FEC33277CC679CD4A51F7CA05F204BFF20ACF63EC403AC7CCAB951A8EC166C545ABFCE8734833274F724E77E68137967DA75515E3C270CE79838839721BF3A14C952085071D6B3A555CE62D96E7736A583F44F726AEB921CAA340D4BB788D63645DEB2621629DFF8A2C51D23BFEE95CAA7756F1884A0CD263039C37F7415E83D4908507C1B17A7308CB329D829C86953422B8B2F1786A4B86B980751255339258572A02AB22AD845632F859EAC223E1245AC3533D359246316A3CC1AC58B4E6386592859547171CE05DD7A76BF8E93901EB7F40114175AC45E0B35109AC57BE844C52D31A7BA60A24F30EF0E45581242C02E020EC86AF106836B3DBA8071BB8E8574FDF208100982E55F4B0DCA72521440A2AEA68C57B2039D14B21A56274972ECCAC7EED41C4B26CBE2C973507F1CDF4E618077406CCD3C8C5118545178351522485730B1A1CA7971B01766B914E835244BB530C48419ABC7578B33D6DB56C76179E9DA3808BA4C8D7C227BA5C64AFD5C87E01C1AD12A294758F45804719DC7369950E9E6398BFCB60A7819585A689462346AA5968DFA83BBB3B8A51BB59311C9D100A4A0C7586056201FFC3CBD92C3A42D6851EC064A89227B4D1551CA7AF6B5B3E892B4E44571669412E4240A08C42551DCC50086389F9E0C0290956B5AC58844A84BE308D0A5562B57B5CBC594CEAE87910A13167F27CE63B822F201AF5E9C33BCA746BA7C5E8541FFF17324228321C7A0EC976646A6B5615F80FB56351D319B31960AA8823426682A610652652994D4A78C25659B533F5B40E6236A6E704CD891502E9C2D1858CA64C94D3734AC0BBCAB2DB2F9E03450E721A38C82A4C26A487F006E1966FBF8063AB115E74F441837506559BA5B7266F62B17E4D959209B657193689A0354149880D08434FBC282713118D9DAA89C52186EA918CE2C170D8380E45A32E9F710CD6F89DAF91C9210B767D743F61655A9702051D7C8A46F17A681B136C0863CB62430D084D282099D1636C04D6B1EC212A74046D2D8108470123DD751DB685A1A1FB3A3B2C216F51302FA13AD73B919A439D424A4AD9E12994D1963B3C0E0316739CE50A1A7C23D65ACEA61423A5792321A84AD2E1B3F5B595F11637EACA77FC753260E04CEC9CCF55D70D4D567BB78749EFD005C9525F6E921F0630C25CB9A129781B9B864B7556272D5B4164E340D9464BF192979A073384F6A5E52AA0B6B74D43FAA5412C5914524974161AFCD91660705659DCA87BA482D67C8C1400B069E66A19905B331243701AC8261952C5B736B25290235669FBDCC254631294FA2E97C440D97A0211C35C2FF4B6009AA66E27CC09BC09307C7B3794A5D189892EA60B2B323E95057FF355114AB48613E2760E00BAEB82B0A763067E216AAB899E7CA06E195A5E92486CE8911BFD5C7D956318AC3B029436A9D88C56AAE2A3DC7B382F2C5E7265A037A827761447FC59A40A3C8693BC996CA786FA7AC1BBCC6AA404A1BFDB3D227C6ABE42CFC463C2F1542AE418CF4B38CC2C1595F9343D41B4A1967C7C94A7A0AE91CEC8235705805AF096CBEFD0CAD6DC0BB5130907D64E76E4BE957A117D121D66071598112EA7D02B9648CF53E57AF9E7CC3C9803AAB327D87C53E41CB9BBC42368D332E0A963C3385C18936AD7483A5F4292B625C844C2282F25AF0C86984DDC09371AB555D57DE146664FAAB59DFA514F8BB8D397A987BBC8DBE147EFC2A34DAAA712BAA1E36C9C5113A7F47BA8C4A83DB2DC79AE93688AF7C480DC8ADF0B12D7F5453E669BE2D805DD6961454BA8B40C6EFA961E53DA19EEA2243C998B504C8AB9EAA2DB11B2F9B591990040954A1567074E69154AD6E618D0830D3B554FE4C99F48B51CF6609952CC9693ACAB000C335B98126B4B45A9F317F80A6049558FE9D855A026AEFDC649D295387C530E075CCB32AAA202171C6F6907A4A2202A9C5FCF252D98328F12F927E31C596047140AF9B177E0352B120954D00529A07D6B2BCE5026A6D7CBA01231A85BA39B1692694788C9215B69FCD111FDC8934A1BA24CC7890EB479AEF01FF29161B0A7AD921BB72A8B495FFA74C62C880BF03F0BC175EB865A17ECB56E0AEA501BEF8E12D3025185BA4CF8EDD1B0F297471D58C26516F69BD52CB1D071F1CC7720F949D44F66F40C917EB30F3A4B0EB519ECAD2D03DCFAEB2EF44D2F608621E831187CE79B2D2F4A20F1568BBE76B0D3D5AF36111714
-ct = 55B89334DD971C479417D6D70BAA960E1BDF4ADF3DA2D9D2AB18113F740E0558502F016B99254163B21199E2BDFFC897FB3B1022B53B9BFA61C200C0F071BB74507BD0BECB61EA9E4D9F860D376F3D9D23D3EEA50FE0BE1CE6C40B27323C17EE5E9A9DDA5BDEA6021070927A035D822B44A6D457BC9227E162CB2C27CE543BC19A9B3437613C037AE5103B5082F7BA35EDAE372FA5965D00EF8E6CAF2E856B4F0F57995512328203D9524BA18E1912EEEA55DB3E1CA0B8F0AD957E04D009E71CED4F0767BCA4CC3673C33BB0A06AD8C0536EA5B6DD0C093339A0324623F5D4C007F23F0562D505B2737F9482D41B2C293D31B2E9BC5EC86FA8A140E2D1FEAE33FA5E7636C94783F61CB0068CB7AC71DBD06FE2BB6A58010A391B1DEDBEBD34093F6F8DFB6977B1B709C895BD0F2A8D8A39AA9DC3CFC8E8D522BB9EDB8555F06CC418E68F4BFE6E449B069573AE3506D8D8E8167F0B25AFCD48F018E03762AA85B2474C6AEE304ACF649EED0E9688D6C62ABD8638590C74E0359881CD0ED9204777955B6135DE3A777074BE90669DCB9400AC25D55E022A9362224BFB9A830E237113ED56B89898957854161EF6771E58B6A1A7947A381216CE20A97451555D3D2CB902E69BC762651412EF5852C823B1A8DC477426DB5A9DBA4818B76B40E59C8267CC26CB28E2E050502D8506E9511FF57A5A732082170FB25907B272136485D4EB8F2767332E1156B4C7A54F567957CBF0530F7293F61736F44A31FA94B1B6EBF7D79E2A87493C2B5FFDF03DEADE92C1983DF596E16439B6B0DEC17CD95D600748EE2074A219E43F06FF7B93124DAEB91A2ECE0D684559D8A820B4FB35C1B647065EFC0C98EF4A38DE1927C499178F4DE44F74F1849D057FF153571D5ADE12845E0C61E35171DB6C63EBCD9C8269458A3A1C5CB26C20EFB664E79306C841DCCD240A2ECC86F69C00FAC5332CFA28D874847E1A8A3AB531324BF13377D7ACE16DF5B960B1EBEA092A40F5E1B09BA3BF56807FF9037A1BA0C903A7A1BE491D7B27A78A10FEB3A3030280766EC0A75FAE99BD4CF2CA5BE940D45064B0215628C09E4D6FFCFCF7B1B69B1C05A82838FF64C414E66FE6F2816DDCB90887EA23A9F0DE07F7509F005800E2202C63C1B241DD470B48AC484786AEA204AAB301B15F0B647A5776491A7857AF5DE8EE4D77E6B84C1697663A72F28934F5ED40EE72419E7700E18DE42C0365BA0D5F55FD644A874ED0C047D198D379AAC2D60B233A3D8F97F336A7685371DCD1849996157FD921DC42D2A63755B82F4B776912C27837E2AC17C24485E08F7BAC7FEBE512FF7A92F8ABFB262BD53F887D54E77861ECAC9E14D68E27E211EC53DFF507295A0D82B58E2E8E00CE698FB0199D5D7F9F200D876090613D6ADC34A08ED46B55303917373464E5C7DA621E73738DAA1D3CE09DA22B98B48ECF37F8A0D4A44A3E8B086B2F7FA078CC5714F3CD296508DAAEBDBFA565D3ED8010816F4DE58FB4B25DA0A25161A91A38CC42287DEBBF8C30F28B288C
-ss = 4F9DE6E4CBD9948D2DE9250654D5DB97FFE24CF222F68BA51D6261F02F4DC5E7
-
-count = 85
-generateEntropy = 6dfd9b575872560c7bdc2732c4a28dac4db04e535eb8e402c3dffd145c09ce47a2985c1c4d203778597947d710dec806e36b0cd949fe460ef141213bfc525e5b
-encapEntropyPreHash = 30f4095015ba88b6d969672ca3f438c395dacf7d476ea7a9e805ce932d270a13
-pk = 9EB92FFF176A27197EB4AB0171211DC7FA954C652698C50105B5C2E9F7A2A887BFB40880F8624E1FC67B1B43A51139AC6025B9EEB60925D424BB82C58B4B617618C43C99B07FB14E5B86538D29700E1CCB4F53A52BDA2EF566B20D8CCE1D7616DC81398D14ABD03964940C794E6100DA994D5BC0BCF28B04A8971214E7AB9285515EF09A7B486ECAE5C84655C9EE15255B715C3B784D9C243993171C604A3E29450728396E7572228610BB9AC04B06577B3636C137A24E2139B48DB005553152C6B040CF0B2408248675EB90AFB66D6105537A316C7C989746F43C3B284342E2CDB5F2183A16CE71AB39C67797112B0B907C00F6A47F17DB08D924826D526CF88234A25676D82449F93B2859076978860E499A0DE134A936E35F06A7802456008C23970818318AA2B55A1762A9394DDA7A49EBB4B38469410F5945DBA2801AC25BA39A2DF819B0DB194B53C4247FA5065FF99F73E71D51C22F51FC262DD2809EBCC6879B0D90004DA5BA7CC9462F6C822AC8FAC8AB95B769A465CD743BA2BABB26958AB9C3494D329A0C736C28A9CF84F5C90C5A0594485A9B339212D01BF6910105D44109B09BD063B4F2F3B903C94DC650812AE5CC87527754D476FFA82F34F39B5462006029875712CFB1DA648DABACE5AA1590B5CCEA82C20E74795C71BB70826EF4D0BBA580A447693A42D8AF3256C64CE327B370CE576B6343F2BF8FECC76E1434D5E448AA8A3B326584DDC56496704BE54108F8572170C2BC39680598017641422BB81645959B8092E82A54C68AFF60B78BE78107E7BCACB241B09913461579B52AAC5C6C8627CC033BE2273580A523D4CB7979CB65D7056643856BE187DDAC112799559A87168AA96A18089A6C547E87DA949C62B8EA876AA0192AF409BFBC354F05DC08FED46904A2688FBA59FB71B83031A19BC8A6350BBA93552BE0C01B73C89964563FE588A5B76971DACBA69868B588BB2F9076532D6A8FB4316DDA4C85C2945A2A29B6EAD3900E50ABEF2B44375AC36BCB0E028A20CCE58353C827F1D53A9A0510E3827CBD1383A6D18C0D22C374E2B6061C2197A6CB094CA9DCB42F0418C24A9CB893C45423447CD5EABB0B9B410C9144013543E5C3BAD525377CE8073D4A5F4A22BB24874B7E21523CCA731265572B487E3B42AE581A617437348C290F00AD09460AA0C7B6A1A53128E4E01B3C406A296CB35CA0BD0D1917DFF42A4848AB3BC28A2A28044C719CCAAC45C513CA007653BC854DBDB79181157AA17220153CA3563B21BE77ACEAE06BCD02531FF5B7F5453DB0119364DC4E97AC7A495287815B5EB512129643AAC4F42B3AF35AFC1207DB0A3194302FEF097BAE37BF382C154E78154B3407BBD90BB2143BC285AF1EA0B1B4FBCD3EA373A077C6107AC2800C89F20544CB7A83BAF26EF19367724B1C989C39BCB4337DEABF7D531FE2B3327F4AB0F6457C5F3869590C49664923993CB2B0103B8E8A41CC5793ACD192A047972978A2EA1B9E354CB135F2AD8928574B2C14FBC1A4C02715292C9052B69AB2A8329C02938BFA0994C209F816A24EB13F4365AF2D20240EF66F9BF6B39D54AB5D350C7CB3CD6F645379815AA3028232BC89BB89BFA2C62E351A3C6401B7B384EC61A83F9056F3665E523A0C28D48E778B0314C1EC2A83EE9805D0
-sk = 46F47850E2B9AA4A6D209125BE58806002C278A6295DA7A4FFE85551529F17D83B358B243F2A622F353EB6138CC6380F8AD3340D7575E865A6CFD34BF473A3DA8B9FC961CD921452D09B3209D041D6612576C573B08422715160B891A3370268468078F5464D7E5B84B3A3793F0C7CB2A0A13DF37B9763CFBF054C768B1E65A00E8366B406251F812C5D428853D0E00F7BD58A8E348275461C1336C2AC6A39783A35D849AA9A847F37F50BE0B95F617BC7ADB28C0506C16EA3CE89AAA28A9252F0E228D0FCA732289D05D9395133A82D8CB76DB2023924273B39CB52B5A846F338B96C5B6F3ACB41C7265A0C5B13094231F05943D58875BA7C2A6889F16107D325AD1B810A0B3C9E8928169D440194BBB90F771796856F9878158A432EFF742FBFD5ACAF59521E361F448C0BEBD805A1B4435D0761D0448D83E1201A506A0B0A4980172D05E88D7D87B42054680CDA74A386027AA4C3C5193FB1A893BEC2722D55AB9B840D99CC81408153B383345192649EB99825BB4B1957326C4791A2722951C0AB67472F4841C20C23926C3C331F24C360E81977C2791FF3171C2C489B68C923B65D8EE6BD2D510E6AE97FB771BAB401BC1A42935F38A0FD43AE2F8A24D8FC3F6E15C2C6BC800B73CCD8E91C592452484B44E6B2A624881064526182950349C78C7D58180B1676B5191EB6065C50596232B9566E4B8F0635A7D71927F8EB8572E62D57996DDF66CFED2147DC3451E95C034D6B9145BC0D30C915D66B1CCE367406212F8BB40755091C9CB0306A490EF5336E21F82C1B7B6CCC8980DA28A348815112F00C57362EB163A36E016D60F020BD12B6796C9A88A8AF4E833FC4585652E76F2FF77DEED799757C7F64E07EE6E6A300DD1CBBC840AF561746D279BEAA71DEA5318AA3CB3C4C63C4A91E0FB60D6DD6ABF1FB24D1B078DE9413F1B0BFD8916577C4CC9E0B0C332625A5FB705E94BABBE0659E022234586529A194012A6E9E7650C504C380436E1DF83E5C5C9E22F79F394BC0F22A0ACF114B90829B43112FDD617089C8B9D872B70D7027D74402B65058347B56074BA33FB91998E5A559D46622F5423808C8236317767A32E4772AE66CA472EC7828D682D045835EBC5E0089B0FF955DCFB9605214A3E5087F7EE57D5369ABCFF1BE00C7BBC5B5B25A0C1D853424123C98FB330318432D324BBC7330342224BAFF909849D65E1D08A77E07D07CF16CE6F64FC71374EEFB66BF9C742E518F2E30C480F82652B81C4CE7BF42593B990980D94062F96A7178258F31E2B90E86241C04B7B44057BF4700A040B6C0B08E4E8A6BF1CB1EEF738F51CA9BEB9C19B94B1CC623704A6C2455009F48B4CDD0F4A5D7F06320457670DB92C7A4371743593600022DA4600C56296D336A52E98888818CA10282D4767010A7ABDF81BB6752048B5B163DA385D7C5CB134108ECB03398500C1612A1BD563B21A0BC7B94C9719A75BF3B3E02143BF04A7E3D9B0070C4B449CB9594A1A8BBF871E595178BBCB611B466A8677905443ABFA1601A9664C5F54F36DCC1DDF35381F586B4AA4566C02BE610186DF8493A30479F4C72AAF049A6666E806B13FD77C3B738721F81218B48984EF374BABC0156F94E9EB92FFF176A27197EB4AB0171211DC7FA954C652698C50105B5C2E9F7A2A887BFB40880F8624E1FC67B1B43A51139AC6025B9EEB60925D424BB82C58B4B617618C43C99B07FB14E5B86538D29700E1CCB4F53A52BDA2EF566B20D8CCE1D7616DC81398D14ABD03964940C794E6100DA994D5BC0BCF28B04A8971214E7AB9285515EF09A7B486ECAE5C84655C9EE15255B715C3B784D9C243993171C604A3E29450728396E7572228610BB9AC04B06577B3636C137A24E2139B48DB005553152C6B040CF0B2408248675EB90AFB66D6105537A316C7C989746F43C3B284342E2CDB5F2183A16CE71AB39C67797112B0B907C00F6A47F17DB08D924826D526CF88234A25676D82449F93B2859076978860E499A0DE134A936E35F06A7802456008C23970818318AA2B55A1762A9394DDA7A49EBB4B38469410F5945DBA2801AC25BA39A2DF819B0DB194B53C4247FA5065FF99F73E71D51C22F51FC262DD2809EBCC6879B0D90004DA5BA7CC9462F6C822AC8FAC8AB95B769A465CD743BA2BABB26958AB9C3494D329A0C736C28A9CF84F5C90C5A0594485A9B339212D01BF6910105D44109B09BD063B4F2F3B903C94DC650812AE5CC87527754D476FFA82F34F39B5462006029875712CFB1DA648DABACE5AA1590B5CCEA82C20E74795C71BB70826EF4D0BBA580A447693A42D8AF3256C64CE327B370CE576B6343F2BF8FECC76E1434D5E448AA8A3B326584DDC56496704BE54108F8572170C2BC39680598017641422BB81645959B8092E82A54C68AFF60B78BE78107E7BCACB241B09913461579B52AAC5C6C8627CC033BE2273580A523D4CB7979CB65D7056643856BE187DDAC112799559A87168AA96A18089A6C547E87DA949C62B8EA876AA0192AF409BFBC354F05DC08FED46904A2688FBA59FB71B83031A19BC8A6350BBA93552BE0C01B73C89964563FE588A5B76971DACBA69868B588BB2F9076532D6A8FB4316DDA4C85C2945A2A29B6EAD3900E50ABEF2B44375AC36BCB0E028A20CCE58353C827F1D53A9A0510E3827CBD1383A6D18C0D22C374E2B6061C2197A6CB094CA9DCB42F0418C24A9CB893C45423447CD5EABB0B9B410C9144013543E5C3BAD525377CE8073D4A5F4A22BB24874B7E21523CCA731265572B487E3B42AE581A617437348C290F00AD09460AA0C7B6A1A53128E4E01B3C406A296CB35CA0BD0D1917DFF42A4848AB3BC28A2A28044C719CCAAC45C513CA007653BC854DBDB79181157AA17220153CA3563B21BE77ACEAE06BCD02531FF5B7F5453DB0119364DC4E97AC7A495287815B5EB512129643AAC4F42B3AF35AFC1207DB0A3194302FEF097BAE37BF382C154E78154B3407BBD90BB2143BC285AF1EA0B1B4FBCD3EA373A077C6107AC2800C89F20544CB7A83BAF26EF19367724B1C989C39BCB4337DEABF7D531FE2B3327F4AB0F6457C5F3869590C49664923993CB2B0103B8E8A41CC5793ACD192A047972978A2EA1B9E354CB135F2AD8928574B2C14FBC1A4C02715292C9052B69AB2A8329C02938BFA0994C209F816A24EB13F4365AF2D20240EF66F9BF6B39D54AB5D350C7CB3CD6F645379815AA3028232BC89BB89BFA2C62E351A3C6401B7B384EC61A83F9056F3665E523A0C28D48E778B0314C1EC2A83EE9805D010E01965F9C196D2F5F90CE3CE8F552F8A0D76BA8F5345365392FEBC50560012A2985C1C4D203778597947D710DEC806E36B0CD949FE460EF141213BFC525E5B
-ct = A94180C718B23E998B15D6104564B5E20E1D102DA4EFAD7A9740C473EF19F3DB7B226847DE6CB72BE56BEEE3E1BD44D0AFE0A4B55498B4475D8D936D441566CC182E0264F93A6024CF478E3658CD02DAC2C21CB6DE61F8EE7983FB6D79CEE0CC5B134E6887B4C4F79C635533A19BC8819BA2A56715825BA29836CBFC51479CB2C2EF8B0B50332DDB523008F6AD3B5EBA02C767ADAAB5D930760EB496D4C3EDD90BBB24B9CE0DC76013791565D368641F2B8F25A8660810F48E3A12F65BDAD160F3605E2D573844432509E598B3FEE53FDD4A9B83C1B187B66F5E9F2111062E74A3A7E006D638E3DD4990947E0AD370B0F29E183A7FE376C00D8A0713B02D7E1CD8132B7AFAA3FADBF7CEA991B3D9A96EF80A75010C40FA3A31153F15E23446A9491304170E2432112B84F86714A9CAC0F8B60391734EE6A94EF6DEFD30A02079DCD29D938387669A0A3893597AE4F036E1D7020F132B1AF3C8F135033D224CAA5F2791D9943C067257389DCBDFE8544981D6C1C3D5DAD7FD953372FC8910A16BCE4865DEFBDB413CEB80F13374C9D83B54B201C7F4345C97B51D22B33DBFAE34535D9F7F2AECA05D2066B2E9CA9F3C4F7D3DF5FCD1B1153B35418B7C7BC318A9E0810E2328065317F50D5239088AB28724642428CFDDD933032A72D95CAAB610AFA65C968E5381BDF0C7892D3E0696CB75BF1ABE5A14ACEE27CB73CABC5BB23A1AD12EF4D4E917EC4E13B736D1DD50C68B7AB98D8CB2E1EF75E3C1AD1DB7355B484B6AE44B5B7F963B772ABBC5B0ACF47D158853F65CEB9C8829B70481F6D531F59703F7233205806A91061E45FDF6B9EE5546CEBF701CF54BC0805FECDF48804E95956AB9041898AA623FF5C6D3D6F45EC370680F43F138FB6E36018B5D92858A29A17621D9B844F513AF8C021CAFE10687B180D7CBD9FE1B0880B6857947C55C40488F3046E76FC8A00BC4F9DA531A036AB71174AFEF52B3FB4686FA471C34DDFA2F1740A88BE223B536C4325B9CAE46E0B0479CD4CDFA0FBF05F0718052AE62486461D423E4AB819114110FC48A676BB83F3CBEEAAA474C4066CA54DE523DBABBB29DDC39BE50898077649925042F28D15C4C95BB6E745E5367242DC7650E45DD9AD2A5769930099BA2C0F20994D304EEACF8FB3C86EFBA0036D82C8E9ABB01C1F3260EF78D7AFE632261B0012EB612F8A98950018FB12AF3AA0524FAA597DB80873D2FBFED5637098CECD7B2CE5C32A51AC967F277470FEC875E7C00B895AF511D17731519439498A51940733A891E8A2DB137B06E425BB07D0D9D84A6FA70E26F09D61C8800AB74357AECA7BB223F324B9E18A2EB4C0AA1D996543AACE1882726BE7283C0220DC74EC51B6CB82755FA14AA487563053C773A6BAB1547265FDBF4DD4C5738271B410031128A23D2E25289758F4F1C0AEA20C2D30AD81DAAA919B30E268B1A44072A66B0846A436B72BB9FB2A8ED78B551257030DFE5C13B116B8EB577804CC0375872FD0622D96C6EEFB72BAF82B6429C8D7BB0D0098C6D
-ss = DA6373247F33971B39D955418425EF1D1A233FAE7FB1985C0126F541AB8D58D7
-
-count = 86
-generateEntropy = 6fca9f4e384d8418075cc064c70730801bdb8249899d456a77130d5beeb3662cce7683f8a03d3cf04e46970ff7d6a12494ae12558346dfc8fd9370bf944a0102
-encapEntropyPreHash = cf31220f44de862e1719570e1b26e897790159366a385452334fe24cdcae28ba
-pk = 5C405485D51FB10CB0F150B9DB466C53E070F5849049D225047BC47AA15F630A6D62C5B179906EE6C067FA3384A4C22748F984EB31AB4CD69083DA31A5B45F586560371BC99113C44D05828FA7687AA649B261BEB0EB4EEBCB8548139BBD6A0A844CA1E4E59F3D7C4372EA8632B278A7E68B59032012C5518A8021BD5367557077C9C1B4A50944EA1A834BB61004B2CBA7F6401A57839A3CB85B326449A25457851B4A2BBA2E2187F040745FB608079C8B59D2B191813D51C5C3F329B1F5E40771E1B33F63CA400555CE5351CFFCA2DDD268D7855151618587C8B037E7CA290467E4A7C2C38290B84AB8DC4A839F57102DD559114092165B13B130B41BEA2F857C84AE45C1734375A3EA91021014D29AC58F12BD5A44B91CE986E094A66089479DCAC23A6275B864195DF24F2D4A97F1B26B508C3A5BB89B9F0A913867C1294C252D5022D9FC60FFEB3FF3C29B2DD1AA97F22271C5C8E749CACEA39F2C637FF4A235882747CECA1D95E093966462AD401510EC112026BF0FBC106270988B2C35CC7269DA693A7D67052F9156D30C916AD6552EACAA3AC2396BC56668686EA8A1578E46658A71B4B7365AE56A263C783973C1B63100B1AFF4C3FEB64856A781334C6E83519E541511B4D581914C697FF31239DAC56662A145316AC4D14E522480782C4EC52B1A2B8A85F657217ED11426A2A606C01C17171FD10824C07042B189225D40919AAC5CBE05B031689B1EA61041F6091D961A8910A205E62FF21909C6B4095B270D87C9727A2B611118C84AAC033EA9CAB5F40EFAD6117F2160A56505FD775D3F415AAE9271A9B2B1FD1964EDFB772A9C4875F06826A49C26E93F0B1846E006468DE71B98AC6FC0F81AB146236739C9A7B6C13952089D621936E8B265B50DD4016547A2ABD52339DAA0B459D265558A1D9B61C73E49346396B6155195C9C3A437614E68E23143F09FD28857AAEA50AA808600F5C5CA33C5963CC00C4B1C1CE2609486AC4F1B2DDB7B06ACB62398A32320F315DABCAF5D4A833E2A01A6E7C971CA15E40C459EF18DB8452AABE1584412B4C4DC52E6004CA56B5F48555041CC828A7A6DA77C435F05574E5C25EFC3C6057443EB77993C987CAC2363C3030D88E288F4D08966E624794078A39C53ECF273DF178CB022A5FB025A2687409A785CD6C019F5761B0A3087AE91844A69C2A89C1A00B1CAEC7C1F7A67425B87BE02D80B67CA6C7DC3B45BF425DFD33DC5A13E7531907ED6329593C333466D9628668B98422C985182F8C0952CBF5052225363398E516D23678B5320A9CCA38E21C6BE86822C4FCBB9094277BCE80992858C5498C6BCC57DB982C196B1A78C317975544FFDF33E57A30DD29A5CA4A22A918746FD9A84EE1008DB920432E39B6FF182C930243CF350C6F486832A807A36C8A9242A5C39140EAA7A45BACE0086A86FE36BE28ACEC756B5E9A47225638659B250C52B564751CE8C42C39BD1046D2B6CDA70B7951707B63073F0EB5EA3FC5229F816EBF4007CE97307C6607B4CA17CA30330570D4F39BF76998147060CC04B33D4B91294F85F4A717EF9C288E3741F70FA5823AB8329F56D9D0B05C996701A050A387362DB09427D5587E7751131953146EA3591818F0DDE74E33983C010419218B08822DA9C3C62EAE1F2284801B3E4
-sk = 8747252C693A0D6C06AB66071B13517E1C45ABB370D26ABA3FB31641A170B365C5F6235D1FD688D81C72716A3921420D228A7BD5A1C48FF445C47489B8116B7CA14D3EA78B20A7B5E579C5681187A2AA8FC900557501003FB9BEAD185BA9E7939F247BF1757EA66A4392095EA90239A3C67A8CA70186047D9A6B06B8887FAE01BA8E556319A003934C88DDEB05F9F3B4964A6545E8443F57383A2BCDAFD96C794B399296615BCB9C59F8703595709724B6A4BCAD06E116F4542C4322072E3C6713015B1339512419B4DAA8C87F5A8BFF481964A8AB8A101943230F9527A10A604DF6275E1EF18FE54A57D7544402134AB77802333897D4769AC23093F9B951D735B5623452C90270A0896ED3A81BF1191E451A4A67A4542556AF78F1690982360FF1BFCFF66386827DF93BCD894AC8C996BE6E0A29DE70CCD459B9DE46ACC9E8043BB82D01C40E5785845FF4B0DDB8184AFC5E52A72E899093669A9EB110A100A1159241BDD40612A9B1955B1752810764E7B68D89704A61442ADF68108AA229E406CD10B6527A39A6B46068685B5E802CC25614492DBB6E06BA2160E930733956E7B29AB9981D4B477CD4EAB880E56EB711B278F540AC204A996B32FD06B8BFCB7729660CF5125FE1626199F6285DA628FAF491DCE2CA3BF285902350D52C0649339F31EA3AB764B90701BD647194FB27383681C13470B8D5CCB61DD74C5F666FFEA7B0714C469C4803107235599C998349B5BE7AB9E9DC6F01E928593939270411EE2490F16C54BA672EE03B710978760B962319BAB3C2FC67CD9C2E9D4C153A8717826BC4C3D6C7444C051A61A06A2C87A1207A20754E9D7725B91077766871509CCC93F5A1FC1C20680263082801F6B81E8F319B92110F2DA22F0D8C251EE4531B127C44B378DA6A0D26F55DE3285190BA1357012E42521CD1855252147D1ABCB1582422F55091B5EAADE93194CFA0BE536343A282C4A948C355984CD20A7CA454BA034AC7355B02730107A71B3986FA01FAA38D17E07494FB510E5526F690BFB27294FBB963A0606E140A182A9A247029ABDFF6BD8E876EC92207312432CC2700EC4C6A4A7037C5B612EEB2099D54872A5884E28981D794C7855590F1F1464017C8724BC92E0B644DE92B5B80A573F641E4E65BD6F0396184086D6A5A50662F9CC6241FB7241D194B6D23AE6FA3C59FE60C81309FF7E39F93F72BCB0696EDC771A80CC5FFC74138AC9D01B95DEFE7258BC555E3E28CAB6A73372337EFA0B4AA0C7D13B312A7313F8B63426C6677407903822AA1ACF4ACF4A130C4C68DD4DC47DD061ED0A4969E5AB630BAA11FA0AA51133C6509C83E603425A385730AA0E07A2BAC0754358C812F483F5CA6BEF3105CCE4CC33532116C6493F19880F693581E08999BE24DB44B84970C8FA4F6784D50614CDC9E626A31966ACF81309EA6A730EB42011663CF10A90A9EC12F3FE133A7D02CFB95CECC6B52CC08571BD03E8315532B7C76C2040B60E9021A24734854B6A3D77CBFD087015410B7322AD5D9B04F651F895AB5BFC25F8CC9703BC67DC5EB5AEDE41682A17FEB1B4339335EFAA44A64E8B4EB0BBE17FB00875A06318C1E68C42E6CE0946A59C61700A72779765C405485D51FB10CB0F150B9DB466C53E070F5849049D225047BC47AA15F630A6D62C5B179906EE6C067FA3384A4C22748F984EB31AB4CD69083DA31A5B45F586560371BC99113C44D05828FA7687AA649B261BEB0EB4EEBCB8548139BBD6A0A844CA1E4E59F3D7C4372EA8632B278A7E68B59032012C5518A8021BD5367557077C9C1B4A50944EA1A834BB61004B2CBA7F6401A57839A3CB85B326449A25457851B4A2BBA2E2187F040745FB608079C8B59D2B191813D51C5C3F329B1F5E40771E1B33F63CA400555CE5351CFFCA2DDD268D7855151618587C8B037E7CA290467E4A7C2C38290B84AB8DC4A839F57102DD559114092165B13B130B41BEA2F857C84AE45C1734375A3EA91021014D29AC58F12BD5A44B91CE986E094A66089479DCAC23A6275B864195DF24F2D4A97F1B26B508C3A5BB89B9F0A913867C1294C252D5022D9FC60FFEB3FF3C29B2DD1AA97F22271C5C8E749CACEA39F2C637FF4A235882747CECA1D95E093966462AD401510EC112026BF0FBC106270988B2C35CC7269DA693A7D67052F9156D30C916AD6552EACAA3AC2396BC56668686EA8A1578E46658A71B4B7365AE56A263C783973C1B63100B1AFF4C3FEB64856A781334C6E83519E541511B4D581914C697FF31239DAC56662A145316AC4D14E522480782C4EC52B1A2B8A85F657217ED11426A2A606C01C17171FD10824C07042B189225D40919AAC5CBE05B031689B1EA61041F6091D961A8910A205E62FF21909C6B4095B270D87C9727A2B611118C84AAC033EA9CAB5F40EFAD6117F2160A56505FD775D3F415AAE9271A9B2B1FD1964EDFB772A9C4875F06826A49C26E93F0B1846E006468DE71B98AC6FC0F81AB146236739C9A7B6C13952089D621936E8B265B50DD4016547A2ABD52339DAA0B459D265558A1D9B61C73E49346396B6155195C9C3A437614E68E23143F09FD28857AAEA50AA808600F5C5CA33C5963CC00C4B1C1CE2609486AC4F1B2DDB7B06ACB62398A32320F315DABCAF5D4A833E2A01A6E7C971CA15E40C459EF18DB8452AABE1584412B4C4DC52E6004CA56B5F48555041CC828A7A6DA77C435F05574E5C25EFC3C6057443EB77993C987CAC2363C3030D88E288F4D08966E624794078A39C53ECF273DF178CB022A5FB025A2687409A785CD6C019F5761B0A3087AE91844A69C2A89C1A00B1CAEC7C1F7A67425B87BE02D80B67CA6C7DC3B45BF425DFD33DC5A13E7531907ED6329593C333466D9628668B98422C985182F8C0952CBF5052225363398E516D23678B5320A9CCA38E21C6BE86822C4FCBB9094277BCE80992858C5498C6BCC57DB982C196B1A78C317975544FFDF33E57A30DD29A5CA4A22A918746FD9A84EE1008DB920432E39B6FF182C930243CF350C6F486832A807A36C8A9242A5C39140EAA7A45BACE0086A86FE36BE28ACEC756B5E9A47225638659B250C52B564751CE8C42C39BD1046D2B6CDA70B7951707B63073F0EB5EA3FC5229F816EBF4007CE97307C6607B4CA17CA30330570D4F39BF76998147060CC04B33D4B91294F85F4A717EF9C288E3741F70FA5823AB8329F56D9D0B05C996701A050A387362DB09427D5587E7751131953146EA3591818F0DDE74E33983C010419218B08822DA9C3C62EAE1F2284801B3E47C3991FA7983D0DD6E7157CFB152538466E9D5C3998A2B8ED862162B91CA851CCE7683F8A03D3CF04E46970FF7D6A12494AE12558346DFC8FD9370BF944A0102
-ct = A4DB79E6DA55191F585544DD32928AC432171953F3A57EAF2FD786BF1641EF364CD03DCC519FE94C40AD5D3851A820B90C43EF631F15A48FEF9191281DDA67EF23C6AA3093B26C36A7B6F69A86DC1828498540AE4F6C1FB170387D62EAE9B73313D39D07E94A903BAF6DD09ED3BAF005A9E35C7C87CC6724B37BB80FA2153F150F9C811079D3D545BEF636476FDFCE30DC32561F41FDBA2EF7B4F21C58E1EBC033F5C457FDA302AE3D32FA0BCC4F3CB0897AF041C562D48AF1DA6C9EF4CCB651335A825394544BAF7D8914F0CE818E68D711CCF45B9873E108C48AD3876AE59DB02B553B6581B9A5BE72D31CA4033E4CBB767C1ED34D3356541A113D2CF60ED6BEBE3134F8C0A9BFE30C17E2F18FA8E308BBA726429282C7286D0904BF78925B09CD47973566DFCAAD7DB814A3500181EB93D438159358C075F4CDC270E14D74CBAD91A493F05AFD4C8AD851694676103FA00C156E5EE3CC4B9F3C6762E3E5D5AA4E245568BB730DE5C2E0E32EED4310D9FDFD30C68A67ACA0BB692BD5453BAF3056BB10E031CA15B342E6DA3D891FE40DC17CB6ADCF6B3B72943ADDE54D7B01A5BF3A129DE2846817D7C2D9054158D08117A69D5A7A0DB6ABA4286DA7D76E85AABEFD343BFEE54395B046AA35E3F7F5648C84B5C1B6610406FCEBBC01CE448BC8D533198BED851792582FB421C55C5FBC989983D978AA163CC88E01C12437CE22C58A6B5186DD0652417775500146236E12420DDB24054E607E11180A22687744226CEF0CC55D2CEB94E1C0675CE338F2537A3E60C126A91A81702DD3FE1FB7C2FB310571FA3DADC83DDC4B18B1AA5707E907142311FE4988196EC6B48814AD55A0EE7724BEAC278C7D68229B3F63357D81EF5FC16F2C7EE9E8A8E7FBF7FFF7B958F0592C5E1246C6AB95474DB7183FFD15CCD227DA5DD1A3DB842814AB5D4B515546BBEDACD42E4E9ABBEFA9416AD009BB072B5D691C1ADE296BE26F87FBCD82EDA2C93AE73AD7171D1EF1840F26014D8F152A720C47E24F15209E2A478DD7DB0EDDE040403A0655804720F8643B86F37776A2F7DC6B478D77A87EAC0194693787B6439F4B045732866237A8A2EBF9934070737B89DD2AF08C59BA182EB239FCDC476495AC756FAA7451C719156C1DBE099FA7BAA32C16156F4209C9F2C66544CC54DB33BBE0EDAD660CBC13E69F4D808BA98A7854CEFFBB2CD50A5B727762038A216B8B5E85DD01E138EDF154DCE1DE6E832374F0A0614390F76D1E658277FB909C1E95B4E81A9D6852DAA5368281AB21799C6898C07992BF5F7EED402522449461394C87AF555FADF1932DAB0CAB6CC80AEA73340181E91FD99EEB65A013B42F577D9436C75A7166BBF845EDE506AF88E6B1F915EF43043627CA208435E805D5588F4265346A7DAA1C9EFA72592FC999E84E49E6E0872AEBACAE9ED89BCF98CB40466AD61FEEC016E629527923430C13E8CA8C009EBA5D307D29BFAA6E1E6F56DED592573B75FEFDA3955317126A9B2869608C32701FF0F62447D1369765
-ss = 037452D74A46B60F415DAD3498ADBAC608DCABE4EDC7070A358E7325C72CE76F
-
-count = 87
-generateEntropy = e58f71bf175c0550a67e00e0f7b3b7fc36bc2707bf0c93044a492626de36301a7f7054814869cf7625e45647bc1547aff288dbb90699b2ad84893f3b755d9722
-encapEntropyPreHash = bb5e65669a44e5d5c709bafa98c16ccba6ac2c4ae923334f69a11543eda64f5d
-pk = 7E395F02D56D41B5C5889BB6B2F149425A2AC8AA06FF23A82841887DE199B56C91846392A026B50E87453F44588EE6AD4A443F54D25ECAE39AAF286EFB47A760DA01B6C13FA178811C47A0DFB14110FC6482543E8A3A52ABEC3A8D7176AA2868B2D46CF68538C27514222A34371C25FE832184206E5ABB699D61426027A942581D0BAB075A367793C81B7FDC11E2F6772C8040D271BE5D07D00B330A6C874B46D26F51DB8F43F22DFCD72613F8C22D15C28A2B384051142C148B07F7362EEA4771959B635A215B1351F650342D2A071ACB16DD8AB50539096F295E44173BCAC20F3CB271A8041E3008A742057EF2FB2D78F8A3A3C252F6D38D8E85BD57A75D45AB4DC21B8033992CAA623866E8989F98560DE33004D3409F233020899340B2591E1A4A0223A79E20B4B85C632CE7609C0C45A0246251468C1B6C20716315A54520C5718F4C5C7066331FC7E953ED91AA5F3B92E69617B29C256657124242AE8305780CC0CAF00C92896929A1648BE9B47F86F144A3B12D9DD51F347875E6DA935F0BD043ABBFDC7B85066A7836D442872C56FDD41D9A3A01D9AC6A12531079F74B273CA129F36A7AE463F6464436E50FA70CBC2756BD25234893B50A2898345E588B819C0955E9C50072517D58B0A3E4BFC9832B727C7F2FA924AC672D4D104A8F3AB81200A624C61EB6AA7B4553AEB2084360F1C03E443AB99ACB63AC699443A638BA9B8013C7ACA95ACEBC9ED6B12E8BE5A6CCC74EFEA7CEFC7A0F5EE18857250D08F03CD94CB4C455141D7AA2FBFCBE3EB896C2404BFA3580BC63B73265581D87618B206CAA9468C65BB1863B18F560413D1B1D392259F37C00F7D89124C56913483513006FEFF89092F218FDCBB8B118B206B64F2DE52BE0B553665C32831BB4CBA3762991716BE65E6A222B30A0A5CB246207352732BC3C8AD7A2C3243C62424AF222A922787F7FE44DF05299DA1105F9EBB0C5AA18B6C6C73F43390AF9C2454442110AAB4AA629C8F300DD38318C43A25D269885F970DDD8AC1E5918E59A3D53DC8A44873EEA97C31F34108B893B634284D69153779230C28B2A1636B6B839A4D91B7E23F0414B111F2E7C1B3ED58613120FEC37C78308587494233313950D82CE946778E044C3D245A19C29B09A80C3B55416A811AF33032A0068C7A4767F05E9AAC3E8B99B967F88D5281A38B072B8C4E194794C40BCD5366714525E846048E55C008CB48B5EA0C61655B8819B08FBB88337E20D63003F2453462598CA66181ACE033C707C1AE9760CED165596B2B163E54934540C4F7097BDF14D29EA850B95BE6FD42973436144270549A81B5F73192C2C6AC2474686A9A3EE556B6F26A9039866176026E25A60B5864E963850CDC8219D21859B5C5C3714434EA53BB16786DDE8036F317C430B3BDB025E6B62C097340F1E961B90E0C5182183DE05B293A05B58DCC251D8A2911C6E71A635F5179D06D93D33D8CB332C8B835C0E2973261BDAA43E414153118B66C641F834C949E77FCDBCB59DC27089138A2E07A5B40C7666794FD8E6B97685BC4A3C2A65912C35F50A278BBAD765C8C775BACF28181D61530E54AE7FDCAA2681A01BF51C0D7A033D6B005893B98DA86005381F1C6E600B1787BBBC13A01210C0764A4A2578D4BF90A24704178F06A4E4B110F5
-sk = A32B081D2579D7737A984126B05465963AC3D0FC3D471B94E30B242699AE3EE7A305D187D9371AF3568D7BBABDC30CA69BE166AAA07C67799DCE7345B2024EE41C5A6F35733CD12EFA19256DDB74440829C6B52AAA25B258BAC8D950CCDEA410535BB3A44A46EBC44F5772CDAD96596980C32A14916CF5C4A2FA8538491F7EEA270543ABC467344FF098EDB4762F658B6B26431B9863CFA7546C1489A25BC9061B8CA0165528241B4BC173BF17B4E7873A5081016A1C55E4BB1E7F71B849274D03E05E866656C126485979CE9660AFDF3622E3051F76D02243E660A5A78C663880A7F9765DF45410926A86ACC7962878B4037CF2960B06F072367B476EB24B8C57924A9C699815BBEB0BB10B2A88B0C63F0171C759D59CEA91C5C043A41A8155E462325893685F18C5458A0AC3E5BF2C696C8F07727C090E1D3502D075A706551C54A00A710027C52CBD83FB9DBD7567ACA2B6EB809C00838E56B209E0C5AAD2E6235E2C157D3659D906452F4A8C60B26F838A51F6789E42C00580E4595A5C0A12B796CB44240A4724C298ABFF1332BB0970A3EC475A434EC4DC2A4AA92C42E22035A4499C66827C882B542A8FB22B6B6054984FDCBD6A637583145010D89A4654BF0BC0A0C3B86788459B659A539833629C1B585A13134D766C9E8003282683AAC1486A934EDD3A7511319A7952B5EB7C5947B69AB5C904B2481A7709C95BCA352DF45E8BB87775A9CB566581C3777E7B975C629C89063C8F0E982A24D344EE8A22221A02C6538154217C453AC0ECD4BB1F820BAAB94D920765C4AC15972AA79BA974F3B5055EFA7FE5BCB454F7AE70E1C017322A20C73EBF278054060687C6301E13B52952459C56BC8D8795044302FC9123921143EC2C73278939826682126B65C7D9BAC044AE6CC7CA40F92C8FF28470E41D51895ADB53AE30216B1ABA552FCC14AB277A872029F3DC8D56794D842BA06770808F1C097787973B0A14280C5FBCC45C102C23821A07EEA6C3ABB4B52AE116F4B38E4A50CFB849177766495463197BCA3197B53AB72B172C163003C9AB89721EFF925F56B59373F5ABD1430B0731419A12BA80641628D78D712BBB74579C0A18A4CB2AA6EDD76FD7605FBF8214A00AA44E486810F3AC6E36345431C23F247F251112CB8A6C76444B1A5277B7C68AFD2C49D4A81FC5069B9A004CDF0587A4A193D243BC5F16357E1B1F280706B4C16F9D8B3B6A5815A1597C49076589D5303A5C89AD320CF6042F2F819CDFF04B850870E807B4F2B6BF99AA8F3FD16E95B3BEDF247CDBDAB048586116DB7A4530C360BB240FB2964FD41A5128CEE9FA6AD434B536345A49BC758D849260B78CD9F3B3E8461CBE906E93B209742C0ABEC1C1BBA9BAA05A8FD05637D26548F48512F5477B93D0BD54F6674158B2F6EA0488191EB023A641B175CC689A2F326214793228138D6DA03BFE4466DC962FD2A7C57102CF3F96CF3A6619D2F613CA063A35F4515C0473140B8EC3C53B1D9974021616BCA2459BC31502DAAFC861990C1B97EA1AB5AE018EAD781A67A075CC4924F9EA364BEC33ED167637F0A643C3A810914A49366AF69B3CC25938E77422832B7078C6BE562513EE3648758515E3C04F7E395F02D56D41B5C5889BB6B2F149425A2AC8AA06FF23A82841887DE199B56C91846392A026B50E87453F44588EE6AD4A443F54D25ECAE39AAF286EFB47A760DA01B6C13FA178811C47A0DFB14110FC6482543E8A3A52ABEC3A8D7176AA2868B2D46CF68538C27514222A34371C25FE832184206E5ABB699D61426027A942581D0BAB075A367793C81B7FDC11E2F6772C8040D271BE5D07D00B330A6C874B46D26F51DB8F43F22DFCD72613F8C22D15C28A2B384051142C148B07F7362EEA4771959B635A215B1351F650342D2A071ACB16DD8AB50539096F295E44173BCAC20F3CB271A8041E3008A742057EF2FB2D78F8A3A3C252F6D38D8E85BD57A75D45AB4DC21B8033992CAA623866E8989F98560DE33004D3409F233020899340B2591E1A4A0223A79E20B4B85C632CE7609C0C45A0246251468C1B6C20716315A54520C5718F4C5C7066331FC7E953ED91AA5F3B92E69617B29C256657124242AE8305780CC0CAF00C92896929A1648BE9B47F86F144A3B12D9DD51F347875E6DA935F0BD043ABBFDC7B85066A7836D442872C56FDD41D9A3A01D9AC6A12531079F74B273CA129F36A7AE463F6464436E50FA70CBC2756BD25234893B50A2898345E588B819C0955E9C50072517D58B0A3E4BFC9832B727C7F2FA924AC672D4D104A8F3AB81200A624C61EB6AA7B4553AEB2084360F1C03E443AB99ACB63AC699443A638BA9B8013C7ACA95ACEBC9ED6B12E8BE5A6CCC74EFEA7CEFC7A0F5EE18857250D08F03CD94CB4C455141D7AA2FBFCBE3EB896C2404BFA3580BC63B73265581D87618B206CAA9468C65BB1863B18F560413D1B1D392259F37C00F7D89124C56913483513006FEFF89092F218FDCBB8B118B206B64F2DE52BE0B553665C32831BB4CBA3762991716BE65E6A222B30A0A5CB246207352732BC3C8AD7A2C3243C62424AF222A922787F7FE44DF05299DA1105F9EBB0C5AA18B6C6C73F43390AF9C2454442110AAB4AA629C8F300DD38318C43A25D269885F970DDD8AC1E5918E59A3D53DC8A44873EEA97C31F34108B893B634284D69153779230C28B2A1636B6B839A4D91B7E23F0414B111F2E7C1B3ED58613120FEC37C78308587494233313950D82CE946778E044C3D245A19C29B09A80C3B55416A811AF33032A0068C7A4767F05E9AAC3E8B99B967F88D5281A38B072B8C4E194794C40BCD5366714525E846048E55C008CB48B5EA0C61655B8819B08FBB88337E20D63003F2453462598CA66181ACE033C707C1AE9760CED165596B2B163E54934540C4F7097BDF14D29EA850B95BE6FD42973436144270549A81B5F73192C2C6AC2474686A9A3EE556B6F26A9039866176026E25A60B5864E963850CDC8219D21859B5C5C3714434EA53BB16786DDE8036F317C430B3BDB025E6B62C097340F1E961B90E0C5182183DE05B293A05B58DCC251D8A2911C6E71A635F5179D06D93D33D8CB332C8B835C0E2973261BDAA43E414153118B66C641F834C949E77FCDBCB59DC27089138A2E07A5B40C7666794FD8E6B97685BC4A3C2A65912C35F50A278BBAD765C8C775BACF28181D61530E54AE7FDCAA2681A01BF51C0D7A033D6B005893B98DA86005381F1C6E600B1787BBBC13A01210C0764A4A2578D4BF90A24704178F06A4E4B110F58AACD8940FF6FC27F175342BE74D48075F8AE9320CAE20A41C879C27C1BF815D7F7054814869CF7625E45647BC1547AFF288DBB90699B2AD84893F3B755D9722
-ct = 9E0D9479CC0C6672A85DFCAF8C259CFA1CF68A93825FCAD76CBCE06FA3E40EFC821CA036B349FE50EA23E7E22E1C9CD7F8A930F2DC42F867E33884D0CCAABE685E7A7516CED70CAAE58FF50151AD1932F41AF9BDE629F2E96B3CBB7592B178699179E9CA85DF7FD2BBCA8DE9F30AFBE3F8724D77042DCFB19C31CF239BEDF529482BC947E85334ED7C541B2CCF368D2EFEAE1582A0622AA52C24905EC634D11BA0D1B20A946F2E571DB7F867E8EC9E3DEEB544C77D20CFFF9A0A44CDFDC42CD972A01AA8822E0BC728A66EBC0038A7ED1DD7BEC0E0E66CEC422385E0DFE33657EED638341F08BCD32C6BE72EAC5A378BCD02ADEA563734105C7EA803ED2D6260993182EECA13A4A3C999A209E78E4D64ED1E4D7BBBF91A72F02F760B654895C6398F3DD7D270D28133D66C13E899B8EC69A70F5983B539F975EF2294651305DCA09ED622CF151E337A7027145C9B3AF2849ADA810A96D391DC6F4FBDC1745DD30BD358EA3507A55F2E3C19A7F27D212397148C52698B59EB1477F8C6CA3FA829DF3447FFF20F6AB7F5EC445124F29C5F7B79CBAB1B1D23E8EC69EDE923AA3E734B9C999337014E813BC9E310C6850901993133F11019C95E1BD421896E3D2460E61DA9A6A64C7EBF0376395F509AFDB8460420F26ECD066F33EF121E41DFBE769BE03E25716D7F347D9E9BC0BC65A579F5508BD0562B9AAFB98A9B2E5986057632CB409FF5C10FC3D40CB5582231E5BBB4BE2871B8EAD348C1B9D9E81B876D70D03B9DDDAE0AF4DD5CC6F898817753B35EFB191004229B0754E69C9428AACA4DAAC582E1DA39B5983A5A4DE38998D26197A4171F5D6C28B90428522F50FC212A923E90D1E2005348A5E47E6E6F6D005788D2B455A3E35349AFB822AB5F4F1B9F696E0B186DD2B66A9236179763C639DF4CB6D4FF80D3B9942421D11DA771B184EDE6AC47F74A9250B7AE35B4BE975211A9E12972871F702216995DBE6E39688EAAE21EEA262AA89EAA8A8434120FA4252EAD0BA0FFC4F53EC1AB745A171A0F73A60D84B023A4C4E58F173F0C3455C1B056988897C2DA23D6CAAC0DE7A36334E5AEA093C5D6485CCF06F736CCB18DCDBE853FE6B9441545DFC3535F16D936ADC69B9D2BA08C8CC6DAD333190788EC3541E4C19B38D4319C0038F5BC41D4574141F819FF48385F45AA0DD7F6D5CD5E70E05D3A4366F9878E74BACEE5638B3AF0521A50399043C856E9F3E4ED2951BFD758662C82F8AC8325814349110D696B84ACC146AB30C00484B241FDF4BE8D179F6C8B618F8FB35340AC61FB9E221DC9226A1C59896389B3E24FD844197550016A53C5CF67D7A9F8FBA80B7E61B4E39D36CCD32C7EE8948820810811ADA941BE1EFF722EB83CC69B42C396F3AB0BAD3118C708C51B73D41C9C1DA494C0998C183AC5E592A9E0663753584C0364450847D906F5A261652BE33BC0CD359A732B9D1696E245FF04252635540996A57D8A625D37DE41A80EE1D51770777E709E673E31C83C739E2173381F4BA99D8E7FBD6D9D31
-ss = 2CFCF5FA2B4C0AAA85C6069616E19E6715FEC913592D6B8F57EBA9CB4E3B162A
-
-count = 88
-generateEntropy = e3fc575ed51513e62aba655d24cd9c8f1c6c848aaffa946c49a53ac3ea59e474d82c2f1bf2e6aebde5660fa73356982e12999d8fdafbb3cb186341d0386dead0
-encapEntropyPreHash = 9ddb3aa9c7905d1a438c93bcf78e3e321813580371ab4e1289e2dbf3701972c2
-pk = B5D6022EF207E7629736D614527619E33CB92600A1E39A20B25A5B16EB0EC1070E5D566B28449BFB38936F44721ED428CED5768EE647A771B7D76A30C7E5563B515F5AA89FFE994CFFD9277B0695049C355267B3A07C61F3C5A2C0D4AB8DF76129C19F44F762B51BC0374A43E6F6C1155901B2430B2B77AFC9BA4E14D3658607387DBC2D12B99EC0C0B0C2721AF298A6EBC92A7E6B97BC460674931E21F68377C8303B24CAE8D5AB720C79C4399414A514254603B565397857A7078B36E24A262CF9070A92C034C76614D5AB455B60B3B3388500946677195CD587942342A6FC91BEF144EA412ECE186A422B85A213C43FD0C361AA00698458F5C5370C6C553A9C238201754E2B2E2785BB03053E0B414E472087A0276BF2D805CF477378CA34D8F01C21B433F33B49A8B9BCF762451460558FB9C3CD071E654C250DF04B6541BAA278C1669BB49CA3AB4C78CC92D0137A2864BAE0C904E23AA28395EDCB435D9C1CF742562D603BC61C521145CA16F69192B137EE372F04402527BC557B754E187355A388410751267561A6B1F59E04190EBC604FF64A2B08B244B57ABE84F18938C5A9ECDC972191BBA33915C653A84B1A970AAC7343AC98BDB7BB877A3170E8B1E8693FA5089F421281B5763865C584CFDA6AAD7482D00A0520D947FDDB173947865FE178F9800570D4B2B9529A42A514A8691C8531A271C18E5F84380C20CD9A992051D29B5BE76B2235B511514904E3B284E8854556334515162DB1B09894B18A3127982269509BBC5E8758015A5B810569E544BEF9398F7D195A50A958DD78BDA187CEA0B7B2BCA04E2CD90DB634A3D52B734E224C4C60BA3C8240D7B2755AE5892A09A0E7EA1B2424402C45A0AD59563AB97ED906A1A15B8C4412219203CE6826B91DD00AD602089EBC5163B416C0D02009A7A5440350A00A7B49309CE39BA26DF79ECE038F23F4B4300C01287A51F5FC619EBA04AB1B78E6396BB23C1CB86A0F3BB11F7D31A161A480B8F33734CC63EA7219D76BAB759B1AB3405CA61B535B893B1BF2B678849751A6A4F18923EF44470E543924D0C462D8A078782B80241334F547D2AA474D95B8709747162B228993BA15A0C4FBD8BD662A1A2F01CFA859CA723A011949823FBB55947B9C27C2BAD547B0E6D29665071B30F3C8C536651E6437C0D4A314AB38A8F707928C0C2B864A3A67397A936DBFB98FAB2C0935441B83157D05072891A43573882BE97686534C8BC7015AC267B75F0A79C6991CB6C96C735A4BEA90ACC9BB6BA1B12388F0821A074018909F76944D9295B5EFF73E70AC1B0E1644E3A40685305F8A0626B2F05969FBB4CAE07C61F6213159B3471654A88AB58EC3A648F2944625820F6592C67126BC085DCE216FA708089D4947AB911AC14C00E53782A01580FD967594E0B2B2A3272D590AA70C7A3F419ACCD33C1B1294D21242C739A3E8E577316C23EBD4B4C4D0577B2BBB12CCA71841B54C0B76729320BCE26DBFE5BBC017C92491762A6C938D4BB0099AAEA190813A3A78E5685D83975050D719D6B6A80AC313D3018D25B9054B5013F832C1353401E6CBA3FE527B8D2906871B79836CB35284725E733D8FB60E6A8410E5F61428A3CF9C25FD45802D5699F33205A71D6404704483BD2C82E92BA9457926A45BFA0985
-sk = D1F46E67CC5AEA63CA9EC413938661C2F8156CC79E10A64174774545B597E91A8CADB58DEB15B27F343073B071873870BF858B5FA3AC3689698DEB68C570406972210C2B9909571A12753448E00E6A0C165A101469828E8F60A16B55478C8899D9A38C1751BF220A60A999B0D2A429B375137DB8BC9B85AD5FCC073355AE630100F8FC68EBB8534135590CE22D0A0672AB54936C8665AAF476B50293A32135283777C375767B04547501A53B72A14D3C4DE4E001D16B2B2B598A22D784A3711C39DB183AC82CF895B242954B41C713BF464464917D6B608D21B67B3519A6DF161AD237359E262B95C6BE3A8522B9248346785FD0DB03CD083A21092F4D91AF156B12F4C9C77C11CC0B68ADBDB813BEB21289743758F8136661704D0C5CA9302A064040334017D47815B7C35363F5C730298670536C69C122CC91CDFD18783EFC4C39C8C29CB1023F1488A7469F1CFC1D7EBB3D1CEAADBA3B07310000BD89C043290ABED896E655CB1F43A1C7335AEE30044D9652E6D3B8E394218F63072C7050A2984032C45735A3AAA4108AED8B9A19C13B9BAC28CCB123D9987C45B91E89B7A949B5B4AD56ABE4237F21DBBC53AB651BD4B703069F82133C54ACC1AA415DF9961A4785337535869FB758CD04B798907E36197EA428C66AA516F602404E87341E154A0E09C881725CBF00761FD9645B658D97D21F33059E4A898DEB0C826D9057AC302663897D71567117FC4416C860775B026E51A52663711868777D542F1224B277EC005F2BBCFC0C84146591CB36CABA82692B010DE229797CAC57AEB64AF446A896527BED9B3E55539C0F6A0E9ECA5953890B95B0B282C3A4C46A44A8705A54A8806CCC0D3C736A20D34AAB118813651D85F12906958933D69679D0457A4817DC83B525CCC63E94C1BCB1C869CB3A0BC46D47084481C2563754AA8F44682B870ED04996CB8886F43B91AC8767AE12856CE5B85F55C8802830BA1BABF5797D0DA723EEC24616A195AC809371D93F89B19C874C840EE9C39E7370CA561B6E91552CEA47F1D09C9CF633E7CABC9EF85F89D01A29D9CFCA8143BB05C3015B3C6035AFDC45AC7B08B5406566BF864657BB3A82322793906462C03C20969F76C2C8C8EA2622A373C3E40164A77055EBAE05787965B60A861C09658C32D4194DCCD7AB1DF87826590890B1785F0385B965B5AB3B870A0088696A783B5C7A69962B86F789BD43588705315258C117C4313198AF42E2B7FE39894A86189FFC4E8C6BAC5E7A0F03D86D18089A6999972F309A6DEBB365781F64197165D259BDA98C7A920A9E790BDDC587E7C08040D649B8B08FBBF36D1904970354410BD77B87889668566CDF4A94E1C65B04D33C269C5152B049850857308BA1310283A976A31DB34722E97C97DA85D14372E14A8A95BB45C63670BD7712686200D451CAFE599AB0D3A183D2B0DF7B8FBF0995042BA0CE682EBA8B71DC6C0744262C75B7638B51B9C4931D4F7C842328486A799D06027CD5CC75E4B1B6816C2AD66B86ED047EF978184BD344C00AA1200432C5D142246B883B5B85AD5CC8F8FA994F4A790F3B6C201353F77AA9B7E9BB195375060282B7DA42ECD36295FA55F8B5CE94B812BC421BB5D6022EF207E7629736D614527619E33CB92600A1E39A20B25A5B16EB0EC1070E5D566B28449BFB38936F44721ED428CED5768EE647A771B7D76A30C7E5563B515F5AA89FFE994CFFD9277B0695049C355267B3A07C61F3C5A2C0D4AB8DF76129C19F44F762B51BC0374A43E6F6C1155901B2430B2B77AFC9BA4E14D3658607387DBC2D12B99EC0C0B0C2721AF298A6EBC92A7E6B97BC460674931E21F68377C8303B24CAE8D5AB720C79C4399414A514254603B565397857A7078B36E24A262CF9070A92C034C76614D5AB455B60B3B3388500946677195CD587942342A6FC91BEF144EA412ECE186A422B85A213C43FD0C361AA00698458F5C5370C6C553A9C238201754E2B2E2785BB03053E0B414E472087A0276BF2D805CF477378CA34D8F01C21B433F33B49A8B9BCF762451460558FB9C3CD071E654C250DF04B6541BAA278C1669BB49CA3AB4C78CC92D0137A2864BAE0C904E23AA28395EDCB435D9C1CF742562D603BC61C521145CA16F69192B137EE372F04402527BC557B754E187355A388410751267561A6B1F59E04190EBC604FF64A2B08B244B57ABE84F18938C5A9ECDC972191BBA33915C653A84B1A970AAC7343AC98BDB7BB877A3170E8B1E8693FA5089F421281B5763865C584CFDA6AAD7482D00A0520D947FDDB173947865FE178F9800570D4B2B9529A42A514A8691C8531A271C18E5F84380C20CD9A992051D29B5BE76B2235B511514904E3B284E8854556334515162DB1B09894B18A3127982269509BBC5E8758015A5B810569E544BEF9398F7D195A50A958DD78BDA187CEA0B7B2BCA04E2CD90DB634A3D52B734E224C4C60BA3C8240D7B2755AE5892A09A0E7EA1B2424402C45A0AD59563AB97ED906A1A15B8C4412219203CE6826B91DD00AD602089EBC5163B416C0D02009A7A5440350A00A7B49309CE39BA26DF79ECE038F23F4B4300C01287A51F5FC619EBA04AB1B78E6396BB23C1CB86A0F3BB11F7D31A161A480B8F33734CC63EA7219D76BAB759B1AB3405CA61B535B893B1BF2B678849751A6A4F18923EF44470E543924D0C462D8A078782B80241334F547D2AA474D95B8709747162B228993BA15A0C4FBD8BD662A1A2F01CFA859CA723A011949823FBB55947B9C27C2BAD547B0E6D29665071B30F3C8C536651E6437C0D4A314AB38A8F707928C0C2B864A3A67397A936DBFB98FAB2C0935441B83157D05072891A43573882BE97686534C8BC7015AC267B75F0A79C6991CB6C96C735A4BEA90ACC9BB6BA1B12388F0821A074018909F76944D9295B5EFF73E70AC1B0E1644E3A40685305F8A0626B2F05969FBB4CAE07C61F6213159B3471654A88AB58EC3A648F2944625820F6592C67126BC085DCE216FA708089D4947AB911AC14C00E53782A01580FD967594E0B2B2A3272D590AA70C7A3F419ACCD33C1B1294D21242C739A3E8E577316C23EBD4B4C4D0577B2BBB12CCA71841B54C0B76729320BCE26DBFE5BBC017C92491762A6C938D4BB0099AAEA190813A3A78E5685D83975050D719D6B6A80AC313D3018D25B9054B5013F832C1353401E6CBA3FE527B8D2906871B79836CB35284725E733D8FB60E6A8410E5F61428A3CF9C25FD45802D5699F33205A71D6404704483BD2C82E92BA9457926A45BFA0985149E0B6B49FE8ADBA1217C2C57C83F2B8C5F1D92F319E502B184A65869214F75D82C2F1BF2E6AEBDE5660FA73356982E12999D8FDAFBB3CB186341D0386DEAD0
-ct = ED5E2079428744F1871BCB3803773997FD3CBCE4D574D7489A7907C84716AD220EFF0C0CAEAF0F784D0A633F8724D0D70A4E40F115C49BF1C5133A3A99A5F6027BF2BA7BDBEF436D1D8E4A9DDA831DA76E127BFEE0CE3C0483646402F789205D95D406421FEFB2C5A62D60F4C47FFC7C3AEC46BE075BF05FB6336C78B098F47BD1B368F2E5C3DA0E1732F43E67C14C556EC3F7D977B70491A35B5539B8532CA72CAE5B5B8E9936A6FB3A565B535D33EEA5C1B35A5DA0F3BC589B109CD12280DB6557377E9BDDD74B06E583DA873B78F96F323DFEF547D6EAA42D4E450E7CD213DF9B598C9D2134DF772E64CF09D7084ECB4DC6FC079E6B736C2D4B2FDA87B9ED23000E8558C90F5CB9278FFBAC209702CB4F3228944067CAE55CECCCF609F126465754D1040BFF976623811E7A9A1CDCE5D9001074DC30935A06B6543FB5B1F4943961B6330FA0138604B1102DC0F0C643E409EB350E15CCD2EC73280C73DC513E30264EC961366EF741D9CED8F116FC73728AF6CEEC1B61D934124522068D063D5E9479335336C33B7D8EA0EAA02F2E20D0BA7663D863EC198C3D4DB75F0787EE80AFE016BA37F15949C2E7B84B72DC88419DB17F2E992D0E89C451200AA97372331E3A8237BA5AE4B527E33F724F45A8507C22532F064E6843512613D762E5DE7B0FC41670089C15D2F78F8EDDD1DF63D350AC99708459DD6B667E9244D6CD1D3DA09D9B0A194E2E169D5EBFBA9DFC84E62F678A3BF6F0D7BA198B8A1DFC9023AAAA06890FCC8ADE8769C0B049C3143DEC8282287C07C9244CB5CF4592E48CEC9FB6DB7B26C394EA09405194845588F8F29D872502C81D55D11DE84C1507C29F7EAB440D3D5F9D43806E2C3006E3A716F39D9B3DEEF5FB68D3F58121DD5DDD0FB2DF785B6C6A02FF04DC67DAB0928D8CCBB8E8D60F48214F4BB1BC770E940501491AF59F951740EA8C052BFCDD5F22082C46AA94A0E0279AACE1B3A8AA11EA177F8C193E1530B65033F0DA63E1396E5F094EE8D87E87B0738804FEDBA103C38B2422C712B48E1C9515FFBBB7808516C3985250FDF5727E4B3799D242977E9DBB35EAEA63971D2807EA18290CDA801A8654D3C6035FDCE27009368846D18EB5C80615512ACE4C93448552855C4901AC2D3867FBE4A1279CB9F63BAB8348E2128D8435A09DB1ABF5112E8D72BD5D3F77A93544021EC281494267EFD97CFD2B21881DDA6C49CDDD56BBE77E80BE8143C1F38FD47DE797F45A054DDDE6B3117F5D02F78222936D7D3B10135C0942812C049BCD5B257B7F6AC111C92E43C250536B85171EF4337E1F7B55CAE372C943226FC29A06B2AF4D2B69A6A68E91881D6781806510E565CA3776204ADED42213168C22E6D33F167CA62E552F057D8F0D3E0648FE810D5514C5BF4D78410CC41333313716CCD5F0B5540E9106F7D0813ECAD7D180AF071464088F6D233B606C495D78B372C16FE8F94CD574DE08C7369195620704682D7F1465D02D04A87CCBA9BC55BFBF2E4EC387B84AA70E8ECD6EBE7870
-ss = D3551ED0FD716E4887C82A6F24C5008BA80A9B5C3FC9E50F188EB224BE8102C8
-
-count = 89
-generateEntropy = 470b4943f0fe7fd0d8ec5185aba0d1db09d112934e4fb4787e2bbc6b88466e7b8b2809fd40008be70a6b184981101724bc3d5ec5e1956b510b82fd5ad0668a5a
-encapEntropyPreHash = 26d90b190a6c3d0d9a86cf66005154e7086749e966e7187c249ccb9329fd3b8b
-pk = C55170FE0945513748C0ECC9098A02E9D51E44ACC267272633645AD562816D479466B54D2150AFB682B4F32265F1F4BCED21CAF7C7980105B08056CC4192BFE0DA9AA5E00864B0A34712204CF6AE82DBAD360A7C840B4804826C39A59AE029056C1B2542B6A589EB47C14A70ACD1731BB0A4D657656915B91D696B2F92AFD82245945C7B77958A5B6A3B6CBB179AB83A0F32591B757E8B68368D6A5EE63490604AAE70EA7FB4619C91A455429A6B195214BD28BC717385D3CB8235991C05088C7939BF852125DAFC3BC368479165438092B530BB2B869246988B8F85425A2A523ED108C6D2F54358580944D64D801078A4B621F58012F9D8A17A92AB8AD43821E24E2F87BFA844ABD0C6B08650AB76D5397F2CB0060B31AF689FC8612249D46374848F496B360E733FC991809DA804DCBAB14030A4BD18CFE37B41CAD91A66A263437B7DDC2484ED55ACB16AB95A1A8C9345A898E89C37248F9768524C616BABD17A8DC7924F37345DCC32DE04273C5A0AC038A133BA01CE2481FFB57BA153826A7CC4123570293C82082B6A75FA05031CC7FDBB9031E10CA94AA283AA26EB3546F894B646B9A85AFC5DF3B513DB522EFB340287C64492AAAAC5FC25547129B56B9541EB0912222C2E60A11B9304692A749BB174CB47679CC294253B0F768A7872F698C23493FD908C9FF95F9275551B947BFE84780F86C1E0BC105F6CB7C9430369B58BBB07B3B0C87D8541618C76A43D52C98A08166E052B4487177AD222E6A002F7FA3F3601CF1EF0B4C02AB550D76447EAA695561118A46301B544B493C368B5B77AB17C5AF4543FA6A8C682A46AF39CA48046B1529684A53D0E492E1B8596F55334ADE15591DBC4B411537C88A5113458F187A6D77278675B0C85BB017416B6E9543FA1B924B631AC1DDC5556127548FA8CE0C90125139BDF13428E2C7805607A44251A5F289BE4E3A2C3C95C5B5CBF7C87B4A7D87A39A44B672BBE9AF8343DCB062EA3A039E949A7F151C8900484368F1CFA385BD13CF55685BFA4B959F8634ED7C437FC9C044B401683CC7482722C98583DE24EAD414C1833858BE987672C557DB87AEFE4CE2DB8A676D14083462DB35862DC0CAE95F88EC1F59426FA2E24E9CFC54813BE07C98F78A87B9703276B455E15474D7A283D5738D4B639369077E7790DEAD3336E1467C871A571080004A91162FCC31D2912646A9406902248FBBF28DAC4343B081C327743335B9EFA4B7FD13D5177064A5B6E8065B64D8C6580B47E6472C8F5139268145BA7A23A02F59ACF680692B20EC2DCC087A99BE036BF7E9C8C0DF15F168C508AE28E33D951740A9B0F0321E35CC01328B7BA860592B566CB369B21F51B7AE583D26652DA729F07F5B8D59CAEC65AAE42C7C9CBE73C68504F26670BEDC542FBDC67A95C9F2DA1A08E559797170EE63147A4688C8E101E5AAB48A4D1862506CFCD297C7EA61A9ED4A54FD3A28380292FC1570FA2AE43920B0E940675B60534425C69F35BBA714C88B3A6C323090B4C56B7F89963059F8CCB0994373FC1344412F694175C2EABEA110E035BEE6ABF546396D79472EEDA164BF49350F54C2E75754F502DE4A42721B37974A8266C49B57C6837B38A28CA489F02FA05307D7163B35BA6A4C5024B70BA27DB0DE8D64BB8B55C83BFDD24
-sk = 09D0009AA9878C697E2EAC9CEC9675A9570660346547D7AA8D4548E3AA917E238CBBC10C389445D15714B237566CB44132D6983C9610E779570B74482D5BA2742A1BB51C68142C1680B800F1938795367B6D8A56C32A0D77922C78116643530AAC01CFB2692F4BD6BBDE615A3335B397487DB8A1175A043719EA58D0DBA627D7C8511468B34442879CC227E6B39E084DBB68BE71CB988766114A80B1979118ECA08217540F032966688C99FEABA06D0A0A1E701DEAACBCFF9C2F2948A209AC8EE505C85FE0444B5C70D067100B63CBD6D98F9AAB73CB06C97FF31D7AA0CE188707DDC5C07D495B27957B369055650ABD5D9B9F75761770920DD0B574A5841C3BBC9F6F1AB0179C118C7A83B2934E950B3DC732C84264C66FCB0DF78975FCAB5FEABA4E6AF97131696A0CDA1CC9E2C40A266FBE6667C1ABB361F063103311A792B95CC525FF872BF3F394FFB48B30B334CA02BB32A901E3478F811505DA066DE6A5CABA425DF83C27565CA48B16BB2855A797A72DFD57615D5117B24374C2D306473A349521A8107790D268AC6B5813C593CB9E8621F8C68FD2E8082C491C95C5AC74C86DD37B0A4EA0CB66AA576AF50FBDB0A31235BDC9E8107F1859ACD2674FC72C6669A3465556F90269CC30B0A8F53563378EE016A7ABCB5460D5371B01754BD7373C2314E2A42D98636112F3CBE0638E513B38D4850AFD6A1D3D485308181FEBD88B75F532E4541965E0BC592885FD1C1B3108C33F74725850617B526AD4F2C8CECC19B0A0ADE15057C90AB086C26CB014BFF92988903BAFEFA3C4C96CCBCEF178F988A40D339DB324257DE69A119125C52A4147360B1274808299446EE768680170457ACEF18814559996FA96B418275E031199E0D578E86C946381C369AB839B1A75E9D6845C98AECA24253B3B0F00EC7E92CC6F6A40A4D8B04900CA3E78CC7A5C51886E0901A908BF0A08947E3B524F1C606B055451AB6EDA2BBCF832510B3075E2CB0ECD493B71102F4EC69565F96651A3A2C3B738C2D55805798253E055DC8508B98822E6803785130D22E494B50025B0CCBC69667013C4CE4A140C2E9BA928D41D7FB5237DA8C5AC0310EF5007B2B0C6737BC17A747C5A2C1F3C1166BC2B0AD7AAAB1D870E54694C1CA293665286C4EAA35D34BD6EA7AACEA04871C257CF63641264AAA0DB4F65337274356F71D02310A57E44D23EC6B4185BC5CB45A65D3B592AF3138216332060264A6E53702D766D0F4A0F14F70B75B780688591CC414283A59AD2F84D665354D71C2AAA1C278AB6C8BA902283B286F82761906C9B2796595BF5AC01455ED2B43607207A30C949AFB1BA5C50659143C98237279003CA820B4B5963B0882A088CE09C99F4A6368971A7D6885237BCE28580E2EC483FA305FFFC0ACA173A89CC41727A55D4E29A8C410B3FE851B3D58B58C31920759ADA529DA162CCE47618B2F715F3658D71F5455365C67B04748B371A5A96B75F342CC4C031C713C04D2B6CDEC0CC92B7596BF4A2A0C91537A0C8174B3456489D2DB70D3AF2995C4830245120E9411E92ECB2293700973386983A0C6591CD5EAA34D5CC00FD672D20A604E78696D5542646C120E02C8DC5162630E71465ACCBC55170FE0945513748C0ECC9098A02E9D51E44ACC267272633645AD562816D479466B54D2150AFB682B4F32265F1F4BCED21CAF7C7980105B08056CC4192BFE0DA9AA5E00864B0A34712204CF6AE82DBAD360A7C840B4804826C39A59AE029056C1B2542B6A589EB47C14A70ACD1731BB0A4D657656915B91D696B2F92AFD82245945C7B77958A5B6A3B6CBB179AB83A0F32591B757E8B68368D6A5EE63490604AAE70EA7FB4619C91A455429A6B195214BD28BC717385D3CB8235991C05088C7939BF852125DAFC3BC368479165438092B530BB2B869246988B8F85425A2A523ED108C6D2F54358580944D64D801078A4B621F58012F9D8A17A92AB8AD43821E24E2F87BFA844ABD0C6B08650AB76D5397F2CB0060B31AF689FC8612249D46374848F496B360E733FC991809DA804DCBAB14030A4BD18CFE37B41CAD91A66A263437B7DDC2484ED55ACB16AB95A1A8C9345A898E89C37248F9768524C616BABD17A8DC7924F37345DCC32DE04273C5A0AC038A133BA01CE2481FFB57BA153826A7CC4123570293C82082B6A75FA05031CC7FDBB9031E10CA94AA283AA26EB3546F894B646B9A85AFC5DF3B513DB522EFB340287C64492AAAAC5FC25547129B56B9541EB0912222C2E60A11B9304692A749BB174CB47679CC294253B0F768A7872F698C23493FD908C9FF95F9275551B947BFE84780F86C1E0BC105F6CB7C9430369B58BBB07B3B0C87D8541618C76A43D52C98A08166E052B4487177AD222E6A002F7FA3F3601CF1EF0B4C02AB550D76447EAA695561118A46301B544B493C368B5B77AB17C5AF4543FA6A8C682A46AF39CA48046B1529684A53D0E492E1B8596F55334ADE15591DBC4B411537C88A5113458F187A6D77278675B0C85BB017416B6E9543FA1B924B631AC1DDC5556127548FA8CE0C90125139BDF13428E2C7805607A44251A5F289BE4E3A2C3C95C5B5CBF7C87B4A7D87A39A44B672BBE9AF8343DCB062EA3A039E949A7F151C8900484368F1CFA385BD13CF55685BFA4B959F8634ED7C437FC9C044B401683CC7482722C98583DE24EAD414C1833858BE987672C557DB87AEFE4CE2DB8A676D14083462DB35862DC0CAE95F88EC1F59426FA2E24E9CFC54813BE07C98F78A87B9703276B455E15474D7A283D5738D4B639369077E7790DEAD3336E1467C871A571080004A91162FCC31D2912646A9406902248FBBF28DAC4343B081C327743335B9EFA4B7FD13D5177064A5B6E8065B64D8C6580B47E6472C8F5139268145BA7A23A02F59ACF680692B20EC2DCC087A99BE036BF7E9C8C0DF15F168C508AE28E33D951740A9B0F0321E35CC01328B7BA860592B566CB369B21F51B7AE583D26652DA729F07F5B8D59CAEC65AAE42C7C9CBE73C68504F26670BEDC542FBDC67A95C9F2DA1A08E559797170EE63147A4688C8E101E5AAB48A4D1862506CFCD297C7EA61A9ED4A54FD3A28380292FC1570FA2AE43920B0E940675B60534425C69F35BBA714C88B3A6C323090B4C56B7F89963059F8CCB0994373FC1344412F694175C2EABEA110E035BEE6ABF546396D79472EEDA164BF49350F54C2E75754F502DE4A42721B37974A8266C49B57C6837B38A28CA489F02FA05307D7163B35BA6A4C5024B70BA27DB0DE8D64BB8B55C83BFDD2429B1BFF7F12EDA28DFEDFBF0AC16E27008C9FDC62C35E53B28A312BDC91C40BF8B2809FD40008BE70A6B184981101724BC3D5EC5E1956B510B82FD5AD0668A5A
-ct = E9E8B57094849BF2A09A5431B0CFC2CE5A1A6C288B1E7B825A28C5991F8B6D5DEAD55E5BB9FEB5F98A8DEA6A33F9CAB55751C5C8B841B69F3769598F1A1016F0FF9CC42A9927D98607DD7FA1B25E1C2EF43909115E09B6FB434225FDB20A1E3A1DDBC4B7925B34B696A50DF2AC800D00CFF4C0C0E31510EC3D8D0B44D2D80EE5CEE9039802DF9E7367BB0E6E2E71FCD3B5F6AA97CCC6866AFA43619F5EF2726D9E33D2E6404156CADF8EFE1A356C2F2235008A43027720270C3FD0BBBC01CC07A0894247275F1E9A54CF22C819674CADED80C2979D720A6F233C6A0BAE986EF0694007816BB504806769B52177C23753E706D94BE0F5BCFB4E2607A723DA0B2018A1C1711940A353E96C3C6F34A773591ABE5F4BAEA44BC45670A6B8346B0C6EBF8CA3A5DCD33E82913440A9C28FC5A6B8E03D600D2C13A210D4F7A43D66DFA8214060F05754F7B76BE16199F19C5FD0B832F2FDA4EB447640BE835A34F5C9C73DEEE68776C7BFF2BAC601E501A1AE72535067377DFD3A0D07462C3DE3728DC5C02585F4E5CD7B1EE7A47052CCE9A90F098180BBA4EFBEDD10866BB2EF1389EFCDE7D48E9E8F3AA3B0419D23A97C4F915423A26E8181817A2F0B0B9C3AEC1DE80D355CB0313A806ABCB25139980488FFB2084E5A93162CF027D0271050D69E563A42B61107B3CB2BC17562D2ACEC2169BAA778B0BBECBA170C8C40A8E65D3CA9F8409FC14BE20D236846D50BF1019189CFD2AA44F199FDBDA6AF4AC5646B1890817F93DBEDA0FA1BF0EA1E00C1467048F36D8E996D5757A36D48C73DFBE9B9B8F42004A98600685A0500DB9BC9912AA10A7D8EDE8E8CB2CDCE5F67E5AAD00B4D0E17AD03873704DC62769CF5629BD3A3F281FDD75B6E682E1B9CEAEEEF7E3218B37AAD6D4C3F1786B7E5BFD657E3DA0D69AD6E21DB3F00480A56528DC09A72AB06C786EAF3839599F2AA4E7B34F072BF50F28E03A90819894B6F886DA655865F96AD4E6CD8EB3E440351E60CB9FE6D018B3712C32E2E904FE932B49D1590869A19315FF6352F1CC9D97E7D3DA89716F5F2931FCCBBD6ED96EDA6CB5E021A6F5048545585DB127C8CFE7C3AB905A35879CBCE540A1348ED02602A1C3AC0C9CDCF6F3366C396219938AB002736AB1DDE1165F44C90EC3D22FDCC3E86B32BE8677B914BFA24F21036B11C8EE5ACF390E10247E85B71EFC50BAA05945C09771D060F83D7FDB02688732D852507CF53BBCE32DE17703278C71C46026D72870732D822F8F8D0D216A397AB4CD5C6AEDA1FD35287AE6720CD4106D64A8141307ABF41FE68096EA51C59B2827ACF7E54C8E9A00ECCA352B276D588F4E00C54D0AED2E098E6BE9F174C3ACCAF83FC7E5D7CD6B6E6216F54BC9E777DE0A239574D85DF930B00E61C3096962298C2B5D644740FAE2A1867288A2ECD6240CF4E8D207CC2B7362FB1CC064763F0A7CB3696987C33BAC822F431F981885BF7C0377041A2C7EA34F0FB0E3F0147BD0362BC5E6D1EA51289BB1E5187DB1DE6656BDA982BA0A91458
-ss = 03139CF9F20FB6BDAA4EE906AEEE834815FA924E05ED7E7E3BFB432AAD944D6F
-
-count = 90
-generateEntropy = 6df4385db978d27b27d2aa5e452e4152b36f097503d9581ac3390105c5727e7dc95fa08ed106ce84660e8a4c90bd2b22634e40769aa0090a101c5dddad45edc5
-encapEntropyPreHash = 7db6d1a129d6123f1f805b79ad3b413012ea86aed42a05e98e7b1f32f9fbbdec
-pk = D3B1CDAFCAC7F6D08082DA095A7658B3A45F7BF717D4B80A3A050A04CB23E01103FFB1731B2C35A9DC23C4341976B188F5226459A02D348BC9D2064D574040147B41612914CFC2954E4190905446E5AB8632EC96145B917DFB4A9DAC62B18CB0120679E739901D9BCA662024335A083911AA53828D6D79C948425422C32EC471C2FA843B54F6731FC401475612A135AAE4B146FA829871C0654C075DCE41190483C3EF60B7336200A4A39CFB6787AC09AC85F4CB3DBB494727A20ACC8A1CC9CC765862B0D402147A08A5E4AA6E679D482786910399BAC7A36EFA477236B1A01BAF452BADB3F184D7D6AC6EF64CDFB89D1CE66A059A4659D8137DFB3C95CBC9E8D86E064CBFDFA50C68130A8D82258407BB7B926F7A802B53209F3AB78784102E88FB91E6311D496251F7B574AEE5797E881BA1DB16AF40281586267D826C0F33A0518C26E6533E19EA0EBF29474A131D882A189AC03B835C16C34C9AE7A1C4D9F5159F85B8542284E0409DFB0876FA6488E6519867B5C53896867772210E95399A1733D2E78532B7651CA9704AC063DF086CAE4AAF65150093F27054F34E2849449C7680EF1CA1A0AC399A01A9B74484A967592CE85086230582518414C247BB7680ABFC2A04A35A20A851B73548A8E4CFC2B84CB5EC24108396C28498A6614790D56BF8D1B9F9E40BF574C497218EEBC06217C9BD361BAA5D0715E666C2D3D299346A79BE0BBE4B7CCD49F948A60438514129C126AA1F3875718922C5124728F09FE5437AE83194DDEB81F0D744FD2B9B59FC223E2792501B4932924FACC16C1E5444DBD6A823016B3AFCB46EF59CEEB49728AC541BBB6BB64B7E196C59910628C8CA22B1138D884842C387B594B544E5D99784B06ACC3B5D80BA81CD34739A20AF11F7735D645D9FF25C07F8AF9B5902524A1953CA2A58D6B796E3695A006AD6C703DD161C12C01B9BC995773C5D2CE59470C765C3F5401CC07885C77BFB3C15D7F766F0EC7CB3F601DBFC210D599093A21C87D82002212B06898A5A878D4EE913EB451DCE14A1BC424838D4797ED14D9EEA2473B304D6624F1725C820751A9D313CBDC79AC9A26548587FB41371C5F48A4DA04D37AB7189685AAA054853F0491A0388AE4B7AF4259969E29EAAA2B2EB9503518C7C53BA0E6BD20EA8355A63F1C481EB5E662A0B792014AE4C0981274D902759AF794338072A839B05D9D42C1EBB1A3DA33B54066D1A63024A3B1D1437B37A83BBE816075CF416275A6F58336905937105E63A1A017F87911CF0B41DAA41A5DAE3856A606E2A9333176628198B49D2517F54A9182E4BA877760517DC94A079538822251204B4C4A2382CC7889BF84923C09072F86BD1C5879ECC3A37678E6D031568C24012578DDE5CA01005B2DF71A4A0B0455A03AFBE7C366BF1B086973038FB5DEBD793A303B4C867B611772733F66574CB0D7C303563C389B2F1B46E98945A94B142B2B0D647521F4B58F12326FD86286A448909191BC600BC7578B0169A45C071C77F280C583788F9C2AA1200A73431AD56D23B20471BB67A627A594BA9922B1FFB75D2D030432A954C71235A9278857C3010A8A8906C070B77060FB831842140770ACB92E856C8A95E163D5181CAAD6A478AC9AE82EE27F7256F4D4CACDDD43F45CFA4DE4DD067CDCA
-sk = 96D9C668915384C2847B7991E5F557949C99A3D46A2FC9AE7448A229A89EF7F405C2911777FB1E2F44721BE8CC326A80E524486A16A083527E22D51E4EF624B02625FD6A857BEA2C0590A3A4E39F0E041B7284BCC501201842345ED5CEB097A5A5F730EE53176F8ACBF9E03C6DC4A069718DD64C47E1D17323D29ACC630DB2DA9922804802CC768070245380CEC6672F6A5A9D14E4012BB13CAF8C320A320ED63B0591087A0C5A76EA29B57D5C997FDB372E9A57E3F4827A2441CC485718A421D3C45BD0426A87589362E52953822CF785802B2C6AA441ADAEF93DC6451AC68A9867C9B9703ABEDCAA540146BA6DD8ACF7DC317A82A4C1396267032FCCB53BE9306E20E4713B82842E03B7FA984E5827C441E293352B2E2A51566EACA8D9C4206000655F761729020F7FF9B230D6C4B986BC94551175A8ACC7E2A2C174C500666D3CF021A9B40F1A465447291F920865AD16240309B5C838A2DDC5BEB8AA11BF987AA9D7C082E8C55C63AB01D0664E545E505B4AAE50606136B6B01499A5BA10174852224AC6BD242D5D21758C4342F9A02A3D46A9A845112ADCCBB73488CFE3055CAC398B0245C467B94EB342E1845969D70511BC7100F886308CBF21C13840BC17626AC93DFCC4EB22BA18F62B15B521539901166598F25555C32587637A341017885AF1A6D1841AA1C747D918253E1C873C2CCF292BAD45805D8946B00DD23CBDA03878F66357D175D67A1B743C1E5428CE90661067011874B062E9AC8A0F726B55B76627C53338549C3F2605840A11D5606ACD104BFADCB51253AF718835826628235878D6160F15033844D76AE946AE6C240053C2AD6C3A3D72E721D9565A6C79B56840CC5A878C6A4033BB9C88DC43B130348082E41C269CC0D3B05FFE356B5695BB01C95F8AA9C30E50CF31F11419E13ACFFC7192B75948E06A68458DB80A8F71573B6EDC1513AA5B060CB77B12C62761BC188159A49C95180249B3E35C3100635012637CB9CF17CA9936787AAC954BCFC655AEC8B4215861A7709F2846A1C14889D0384591753E3F19CAD2236DFCB7B225ABC430A7B61E6018AB30146D60A6563B2F980ACF66186FEE70A458750CC62C433E651F447CCEF8A773BB2731A866832AE535F0D82E605371F6B35FD6FC1188A52080C609BDD8748C321CA37190321B286C849D35224BB5107D83E2827EF0C63859133852630B237247AA8C100678E43618289239EF19C99AA6B9156704643285BEC89F0B0C21F3A091E2063E5D3029F52C33AF97529E701298D3961F492E6B731D4E2064D034533F4611FEFB64F1899EF563AD71A52E20B199F0D80C557CC8CEDBA3CD1746D3A6AC2E697637F08A43D681ECE3769C8980C76A26ADCC585EB1194D28AB163ABA5563A5C7985720248662BBC21470022EF4110B33B6B8B744A80AB36D0A9B0A7988A0C98C6A597F8CDC76791C467B0CB53A020928F7A55981B520017BC06B36D10A21433797C15124E0892A81230BD6BB4774D46F73B874602588D3F8966469194041BDEE87AC54059458B19724949E7998AE8018755D491BFFDA76A70A64EFF902A4281734A7484037C739B7BF71B658B779CF6370420D2073FB820BEA1B1DF29C3B12C54ED3B1CDAFCAC7F6D08082DA095A7658B3A45F7BF717D4B80A3A050A04CB23E01103FFB1731B2C35A9DC23C4341976B188F5226459A02D348BC9D2064D574040147B41612914CFC2954E4190905446E5AB8632EC96145B917DFB4A9DAC62B18CB0120679E739901D9BCA662024335A083911AA53828D6D79C948425422C32EC471C2FA843B54F6731FC401475612A135AAE4B146FA829871C0654C075DCE41190483C3EF60B7336200A4A39CFB6787AC09AC85F4CB3DBB494727A20ACC8A1CC9CC765862B0D402147A08A5E4AA6E679D482786910399BAC7A36EFA477236B1A01BAF452BADB3F184D7D6AC6EF64CDFB89D1CE66A059A4659D8137DFB3C95CBC9E8D86E064CBFDFA50C68130A8D82258407BB7B926F7A802B53209F3AB78784102E88FB91E6311D496251F7B574AEE5797E881BA1DB16AF40281586267D826C0F33A0518C26E6533E19EA0EBF29474A131D882A189AC03B835C16C34C9AE7A1C4D9F5159F85B8542284E0409DFB0876FA6488E6519867B5C53896867772210E95399A1733D2E78532B7651CA9704AC063DF086CAE4AAF65150093F27054F34E2849449C7680EF1CA1A0AC399A01A9B74484A967592CE85086230582518414C247BB7680ABFC2A04A35A20A851B73548A8E4CFC2B84CB5EC24108396C28498A6614790D56BF8D1B9F9E40BF574C497218EEBC06217C9BD361BAA5D0715E666C2D3D299346A79BE0BBE4B7CCD49F948A60438514129C126AA1F3875718922C5124728F09FE5437AE83194DDEB81F0D744FD2B9B59FC223E2792501B4932924FACC16C1E5444DBD6A823016B3AFCB46EF59CEEB49728AC541BBB6BB64B7E196C59910628C8CA22B1138D884842C387B594B544E5D99784B06ACC3B5D80BA81CD34739A20AF11F7735D645D9FF25C07F8AF9B5902524A1953CA2A58D6B796E3695A006AD6C703DD161C12C01B9BC995773C5D2CE59470C765C3F5401CC07885C77BFB3C15D7F766F0EC7CB3F601DBFC210D599093A21C87D82002212B06898A5A878D4EE913EB451DCE14A1BC424838D4797ED14D9EEA2473B304D6624F1725C820751A9D313CBDC79AC9A26548587FB41371C5F48A4DA04D37AB7189685AAA054853F0491A0388AE4B7AF4259969E29EAAA2B2EB9503518C7C53BA0E6BD20EA8355A63F1C481EB5E662A0B792014AE4C0981274D902759AF794338072A839B05D9D42C1EBB1A3DA33B54066D1A63024A3B1D1437B37A83BBE816075CF416275A6F58336905937105E63A1A017F87911CF0B41DAA41A5DAE3856A606E2A9333176628198B49D2517F54A9182E4BA877760517DC94A079538822251204B4C4A2382CC7889BF84923C09072F86BD1C5879ECC3A37678E6D031568C24012578DDE5CA01005B2DF71A4A0B0455A03AFBE7C366BF1B086973038FB5DEBD793A303B4C867B611772733F66574CB0D7C303563C389B2F1B46E98945A94B142B2B0D647521F4B58F12326FD86286A448909191BC600BC7578B0169A45C071C77F280C583788F9C2AA1200A73431AD56D23B20471BB67A627A594BA9922B1FFB75D2D030432A954C71235A9278857C3010A8A8906C070B77060FB831842140770ACB92E856C8A95E163D5181CAAD6A478AC9AE82EE27F7256F4D4CACDDD43F45CFA4DE4DD067CDCAB990059E901097D00E0EBAF40C5D5DAB009C66798489D357E760478CE884CCE5C95FA08ED106CE84660E8A4C90BD2B22634E40769AA0090A101C5DDDAD45EDC5
-ct = 922014A568044CA7D9086946CCDA46596385465C8065A9BEF75A70EDCACD8DEC0BB08233AB0E0013CB4DC03F59052091254AA8D8895AE1E73A608ED4D913658FFACFEE15EFBDB2CA0ABC843E2FA32AC1DC6FAAF8ACF19E6D2FF14356DD4DFC6171470C9667309AB421FC8663807FF4C614126C4BBF4ADC193CB58465FEC7A70BD508D75838A349827227CAA2F1A4C02461646557A467C73715E4D8B309DE5FEDBB0D8827EA6503C814587CDCCF916BA51FF1B72A2546AC78C170FECF26B84D8D80F6F51131903C5982FCE030DB8C83A6C1D4304E72DC79D77D7E47C7131229FA8279820B627F3DABE4B64B356DCB6E982BF07B1537F656C3DD57E71434AE394FB9E30C14589378AC83D84C6800837445C4610EF536D8C8CAA31A52274434BE4CC66B6B21A6F28463796CA5CF0CDDEBF6663EF308D3066B689FE515F30D0F5B014E49E4971F7B68BECEE860EA549301753BF8FC95EC7574B51DB83389632E7F9291E20BBF20E898E52AAEBCAA3B9FC67CA7F8D63892F355D365C166961A5A3E07D7549E5910CCC06DDBED484002B7B8A0AD3F977FA92BDA8DE05D711C95486693BD79F4D43CDCA8D5FD162A400D8F33D7535774967943282C52164EF50FC337068A374B01D75757F9F36631C963E1981B83F6CFAB6FA528350AE7FBD39C795BA1967402065949296AE14BC734F12BB5559CCCE061BA8579BA3DED45E8C763EF76DFBA1099CEBC9CAD903C5703515FCF3C5867DC73C8C73E176154D41BD4A6F0C039BB56F6FD7806E0F6EFA0BD0F57BA4E64D759C51BB10523AC8673FB236D7502F68532778BCF6ABA52FF6F43A45457CDDB8975623E5A80D85D2119F1828C44D8D5D2610B5D2AFCEE960E85221531B2D0E9C67389B791820D8658D312B2F1C1BA567C297D3D9307568F84BB7CDA8962BBF35A2B41665732121C938953ED1784304B5907F3429C1038522CD7C29E19B33AE7CD8171C7EF05BBF46AA069F05495E31C2357A13D478971F4657FFE95A1F867832BA3DE2A386A46C511BED2E63541B51695B4CFF7AA0D7E453BF56F16BE0128D1D03CAA79C5260BF27C4DEC61497B47D7E7ED1A1795E5D4DE8EFD141A44DB98FD8588663526EA7382E7C36E5B6983EFDEF927BBD8B78E71B8328DA1DC87F84CADF0772E5E01E920EC0DBD625701368156D91D00D621BE1F439AC76AACF8931CC5840358C6DBABD03148CDE362D7E2DD2B98F6CB50B2BE7E8DF737F5044F96430A121F1A9B93A2E17DF7AAC2F17C2D9032F5DF61F98810167300A1075A81A74D3280C603908A236B6042B6FB9F8FAC23B7E4B967DDD3D3FBD7FA1C01A78E9AA44221E0273EBADCA5515F1F8ED6B07ABDD73E7245E865A2E735BB2D309764EB69D32BDB2DA08EA101FD86E6BA18019422F9A1771AE69DCF9525A2D4F4E7C56A80668995F3BFE8D37CB934F34722EB48C841E54277202156DAC0094901D061D9A5E7A9DB61247028728A41262946311662AD4EBB60750FCFAB13ED586E70E4BD7D45D5F3B6F6E2FE1122900948F1BFA130
-ss = F87CFFE1A96BCDED4FE027DC8006065D67D0190B87D805135BDAFCB5EDB9803C
-
-count = 91
-generateEntropy = dbacba825728444921b227cdba54446b3f6881b47be9cd02832f78b023b1bee0e15274a8e2bc08fe818b117ba28c5dfae74d54fcdf6f20052f79be333edc8dde
-encapEntropyPreHash = 1d129b27be7384c359d04311fe5c44917d1fde4bfb57314f483ac617edd5ac49
-pk = 112B1DD09313B9A25B7094700639775F89B8D0314EEF0186ADF7CEABAC36CC9292C270717F27CAEA51B1AFE1CFE6B6A1CB1A7DA53C6715C9C9B2694BD5A581B733AD4841B229FB7A17BC213B969935C672D0993A94EC170BDC8B7C800E66BC6514F84FBC81C7D1C9417B79A82E5B3980ACC792A19C46D13A2E75A3AF791BEB401F7555793D94C0EE1B9E98A5B6C52777E537BFB287268CA9524A4438AD87A0E85279E474C5BE7740B7867D8B04781A2436A8D343F62274E236C736DC3C59D5B326563B9C86798AB14A6C9A0E67B36DB89A82AF690DA7016418BA2D6C435E39095BB81A0E49C01A73A31EC9159844D1A3EB233D16B932919421E6A342473A71DE629477183E8F34B2B7C8ABB7A3B6E516107CB5229D780B93417F9BC94C38BCAA58F34DD88835308C742875CCCF4928122199CD932148F48A94C5C2252295890BB4645761D3C2C0F33AB3E1021AA56B573E9C6FDAC37C83F678B97148CE573A244B0487F3CF771BC7B6A13FE53A6BA58854B87A67A6A17D6A301C85F7C061071B4DDB27B3F404DC402EBACB8254A0568D48B2D299BD831188886A65AEA5CD8D987F6017A2F4392F455C2B4F9B63E6CC1A27EA38F2588B0F8086D7A5C5E4B05B76D2B8918820CB8851704CA6D730861B512FEFB0A76B61401E23B01EA710C5E3B73FA716DFA6408A635423C61372592DBF174D6D811EEF7C4D885BCA5FE669233A141E43810AD10235CB59F824728BD7ACF17765BCD354A493AA60438F07D266D728B640CB07D50275BC2605FA6C964614B2C8143B37B184F3C30668662149BC18C6038706C12F0D31B896B69A7D588D0004497E4808D8C12253987F000168EA758A5B32C195F03F23A07C5A546A6607084CF79E073BC6CC1CB372E385CA827C490A42D900035BF735C6242031B8332BC57765ECCE4792706F1CBA0C7CC390E7BD3595AB876C4E397C58FC325C9607B0EE39692C31730EB4744E967E7FF8139FD1A545622EC870516B2925628BA782CAC845B2429C3CC0EBF7747F414E8D35CD4A91C959D2276404A5DF4790F4363104E6A0D1D60A48B65BBD92B417B51A5338CEBE36C0F218BF27968C05D99947E9B44B4B5B2934C538F85CD7C8B9E3C31637E14C5C0279CDD6386E20CA89A53671FB2F04249565491AC2F900AD380D1A68B67693B185F26A232AA1B43503398002085713CA4B2F94CBCF6E837B020404B7F519A2B520F93B901943C918393F26061346A0193CE9BA8A48B5C4B01B0EFA231EBA0528C5B38CD32CD5D22586494734FA746B411759303A51A12EC58B03FC99A1EDFB1CB01375032054878A6EC9DC4425945AAE387E7FC6CD399C90049854CF51B3DB690EB78A0A2DB04D05102DACAA9834620ABA427B5733BF1D1693643C88BD265AF0280ECC66344B81129C491B3998C6C70CCF03257C2D06115B72AEC35B4C8774CC7936C578B29FB3B0A5C66709363B73F41B08DB919CBE57AD817CBB5DF62B7836AF6FF4AB8CBB07C9FCB7E3D601B2117E6A7242ABB24EA96CA867B597E9E9B45C01ABA9B54D2D323DF8B38D3D37B72C2790E1041037355F274CCEAC2714A92955B31C55D4903A85BCA55B2BC22C536AAB22557D912FE2234423E7BC0894BB5F846A2DBC4A0DBB11C51840059EC11BF6CEFA3AB473E1CB0F0BD17EE0BC3C59
-sk = B1C127D24808FB2B9922332832131C4FD67FE8A1A070AC8D17100BF9F6291EFA0BC8114D98F65C8F4ABAC3AB17B4241DECCC37688B881BCB68503B54379838BBC100B5BAB306327E7965B694644C470A5148666C7FA89872D39AFF60BC533C83F280ABFBC26F073331EF40B694AB25FEEA5B2F55196798B70681CAA21537DFB5746C66129775852E5850F57C2DB2E8A0E90530A57B387B1C429101D04096C3E0BB6E9AF19F83B1B0B74C47BAC678B0F2269798573FBCA5D8E687965B13E495827ADBA63DA8A17564A3E68037B3A4991993401C1C6B149895FFBC03760C13595035A713140EB7A42FF6ADFE6BB371C9AF5A686EF858A8FB7A63FA137492B53305685205B08D44A3AC8F8948F2B7BED9CACE27AB6265722D8F2950E0C9ADE053A4C4CA8E3F80A907A39E33DB78E6065FE9DC050A5A730595AE5EA32E38C512EDB79DCF345F1D9C238A1732C552AB8DB2CCCCD11822972896B323CC43AA03633617F82E89D63D4A1003CF9C5CE3379B1D53A63EAC57ADBC91510316ACDC30FD74A1A2E6C23584AD1CB28444F9231661079B0913E20B3278D8A2E8B18556F336CB750694066B6C82C5D267A903B624CD440D8E187D9E438D178C8394706F016B835E1522AB6904F80CC24358B7DD3BB271039ACC174164021E8A522FAC473054D5B4CB3BC64BB107C6B637CD6360E312A85A3B1E3D2B64436A87E81016ACB763A23CA9B7463023148B0C4888BFB18D9441841F723B9436B77B09C79FC714385A3AE97B5BDE0A2A0C541DCD2B668C696281389EC270BC6D088FC42506CEC85BCB4B611342AF0A61B1B9D75E0DF43BE293CEE6EB0413363716EBBC48EC6C361A48B9D871BD5742FEF2AB286094A92B508CB794F2F69A8EE15C2D748D8FCA8CD2284719815E75B3B0DF76298E48280BF530E09A34D166CD5379777D472F0994BA8E5629EA7691FB973F45869635B61B277C375606B911AA1228271C85B047942A52187BB231412B50F5BE423476720240E62B9D3CFC5B7AF5CE9FB38E03349063741ADE945E994A2D6492A92B1250880318B9B9CE845BA29BD3733228AE960663050888BB98A0FDC21D6FB34CFB5C1AF6D9B98ED6AE454C09B89B6067401FB30A17DD331A845C713715B5BD4A087BBC14CBBC9D2EA83D0F9B0D56D939D01B7D590B3082D2405A20724E2C44B5123BC1407B11DA3DE5889AC52B7B7821C4AF1303D3959EEF3888B8847F3E0695B5B844E8E3C221718A25057E707A50E0159AF4462BB1D103B9057FF7FBC1740BAE1AFA44138AA2B7E3270CF80A6AC745CF701040C97253133EA195648E929E6C6394940B6ECEB18844F1C862DA6597A46F64E0CB5D2803EABA4A08110A011A32452185A6425D9D44B43463893369514957592F519C22D2B06BDC762C519D5CB84E9A68456AC60AEAE85AC6453DE2BCC103E32DD509309FDC08E3B3698A193D83D62DF74719703BB5F8CC5DB7B88B80110D74D6949D00469B840FF7FABDD4C0CEC1A097A6117C28046B06B82C8EE8204296428AB703840ACF7F3333D742726B114D3292B3154B2C4095B6D465657EC0780C488A0C60443717109363C45777271955135E60B46104BC18BAC09A18690B37C8078A22645532112B1DD09313B9A25B7094700639775F89B8D0314EEF0186ADF7CEABAC36CC9292C270717F27CAEA51B1AFE1CFE6B6A1CB1A7DA53C6715C9C9B2694BD5A581B733AD4841B229FB7A17BC213B969935C672D0993A94EC170BDC8B7C800E66BC6514F84FBC81C7D1C9417B79A82E5B3980ACC792A19C46D13A2E75A3AF791BEB401F7555793D94C0EE1B9E98A5B6C52777E537BFB287268CA9524A4438AD87A0E85279E474C5BE7740B7867D8B04781A2436A8D343F62274E236C736DC3C59D5B326563B9C86798AB14A6C9A0E67B36DB89A82AF690DA7016418BA2D6C435E39095BB81A0E49C01A73A31EC9159844D1A3EB233D16B932919421E6A342473A71DE629477183E8F34B2B7C8ABB7A3B6E516107CB5229D780B93417F9BC94C38BCAA58F34DD88835308C742875CCCF4928122199CD932148F48A94C5C2252295890BB4645761D3C2C0F33AB3E1021AA56B573E9C6FDAC37C83F678B97148CE573A244B0487F3CF771BC7B6A13FE53A6BA58854B87A67A6A17D6A301C85F7C061071B4DDB27B3F404DC402EBACB8254A0568D48B2D299BD831188886A65AEA5CD8D987F6017A2F4392F455C2B4F9B63E6CC1A27EA38F2588B0F8086D7A5C5E4B05B76D2B8918820CB8851704CA6D730861B512FEFB0A76B61401E23B01EA710C5E3B73FA716DFA6408A635423C61372592DBF174D6D811EEF7C4D885BCA5FE669233A141E43810AD10235CB59F824728BD7ACF17765BCD354A493AA60438F07D266D728B640CB07D50275BC2605FA6C964614B2C8143B37B184F3C30668662149BC18C6038706C12F0D31B896B69A7D588D0004497E4808D8C12253987F000168EA758A5B32C195F03F23A07C5A546A6607084CF79E073BC6CC1CB372E385CA827C490A42D900035BF735C6242031B8332BC57765ECCE4792706F1CBA0C7CC390E7BD3595AB876C4E397C58FC325C9607B0EE39692C31730EB4744E967E7FF8139FD1A545622EC870516B2925628BA782CAC845B2429C3CC0EBF7747F414E8D35CD4A91C959D2276404A5DF4790F4363104E6A0D1D60A48B65BBD92B417B51A5338CEBE36C0F218BF27968C05D99947E9B44B4B5B2934C538F85CD7C8B9E3C31637E14C5C0279CDD6386E20CA89A53671FB2F04249565491AC2F900AD380D1A68B67693B185F26A232AA1B43503398002085713CA4B2F94CBCF6E837B020404B7F519A2B520F93B901943C918393F26061346A0193CE9BA8A48B5C4B01B0EFA231EBA0528C5B38CD32CD5D22586494734FA746B411759303A51A12EC58B03FC99A1EDFB1CB01375032054878A6EC9DC4425945AAE387E7FC6CD399C90049854CF51B3DB690EB78A0A2DB04D05102DACAA9834620ABA427B5733BF1D1693643C88BD265AF0280ECC66344B81129C491B3998C6C70CCF03257C2D06115B72AEC35B4C8774CC7936C578B29FB3B0A5C66709363B73F41B08DB919CBE57AD817CBB5DF62B7836AF6FF4AB8CBB07C9FCB7E3D601B2117E6A7242ABB24EA96CA867B597E9E9B45C01ABA9B54D2D323DF8B38D3D37B72C2790E1041037355F274CCEAC2714A92955B31C55D4903A85BCA55B2BC22C536AAB22557D912FE2234423E7BC0894BB5F846A2DBC4A0DBB11C51840059EC11BF6CEFA3AB473E1CB0F0BD17EE0BC3C59175EB63C3144108548720CE7EE0F43A9FF3F52A9924EFE9F2F59318BB93C86B5E15274A8E2BC08FE818B117BA28C5DFAE74D54FCDF6F20052F79BE333EDC8DDE
-ct = 3E4CE5CED61DA4C323AE10DB3EB49FB68477E49A4D8A7EB19064F75CD640538F0AF831553F7690E3531E305813C18DEC92A0FB67A341F6E551DEEB0B3438A1A22391AD168A5FC16D6483D0A0F2002D5F43153674B07F6A5C5E337E3351A5DBD3C315D460541EE170E2E7CBA41942C1753A401E230D50D7B80884FD269F913EE4F326FACECCDABE1510EB55FAF17155EB4568F19F4E396213C9A7A252E1815AA0FEDF980409F218D5BA5B383BED0D331D50053DABD30C98619DA2223D746ABC4486EBBE371E33313AF8225E435CBA697EB1B3B99F7A209640C4C82A99CAA9C9642ED63878CC886CA77C45360A2234550E68EC486BD584E1BA6BF122AF1B931CA3D7C6BE30C281D6C5F6E6CEE2C9AB2CE047E56F8F80CE3EF606A0B0DCA9CA7B2B5945E065FD6E50535A3DF08C2FC90B2F02A2638BCF88679D669D7C16E32586CA509E960B73032F223A65EE1286BB54F0780194A0961684E5D4D1E09D147068742488267781305863FC1E2F4EA2CD37B1E34F4179C75F9BC433F279791A62A1D3646B57784AA401AF9AD6082A8F2850602B8EE534250C68223B77E23C7D2A7740D51948BDE1ABC0816F2EF176E9C15AC7A4F40775AC5B9641B7F08C3B084D79FE86464CB1848AF41E52DF272DAC4576319923E22D6845867422E0A07C4AAD7A60B8CF2F344CF82F492704D60C5621F798F9911B24BAE1C04BCE123E40F35A5A78DE33F89CA5BC310D4DC5FDC021159CCF412B875A985CEBAD40E723C9AB585267D1AEEE9737B0422C63F9D84660927A29C88E78660CD989BBA8C29CA60F83FEC307D4C9A676B49A4DA9DD9396E8A7A33CC72842378CEA52F9115D44E99D78B9996D2C8DC3C4198C67007E1F2972F434989B8450C8F87AA7BCD03AFA3542E937AB649FFD3E66E44BBA1747BCA1514C3B00F9B00391812D1AFE38524AFBD89D09948FD648D7945EE3DDD0BB0C67E063362B70F7C96EF09D1944CEDD28C371FD5A4F8D7BE55E47E052D72C95C362D8D1D1C83CA29F70B2422C1F909D14C4D404C39F2AA52EF69B936AE27E0F38C4B564E47399C0E58321AFB00BFAF647ACE5B18582968987A20766CADD4DD7B166DF9CD2DF9B3D339E70FE5BECFCB3A486B0A7CD616CFC8B439012C1A6E87DB9C0BE4CB9566051D5FB0712C5C80AAF79974EE299BC7526D2E351A7A8CBE2F35196C0028CB8BC451049876BAB7D2B6EA233A16BF2F052BDC82CDD43DF3D4DB55FC52DB36FA70AE7F98601BD6C89282AC94FE34854C86BAD00A597A5A684233929F1CA77F6200BE14E2D3F93D089089D800C73DBF4416DD831E175522CADA8FC004FE5AF3581F34FF2084D34ADD151AC9EC634BE82D9C2E149FA94ADF14B03827DE33B1B08C15EB890029713AEF895B413A1992078C1CD4ACADDAFB0546BFA8F940BE6393DFA51EAD36703900E35D8E8D05E02920A37F2F5C4BEC938FDB4B5AD058A9CEDA464A8D1A70AD936A5F7CC55B37E3F1651C3D8CDFDD7CFB1CB33B7E5D59F87E1102B3A534713025B6855DBDB7958708897D3
-ss = D2D4A23DEC18FD2C413D0C64D58C1D14E19D2A18AEF1CB038D14C3C2E79F6A69
-
-count = 92
-generateEntropy = 690eb71fd7052b906eaec09937a8ed374e0b02afa27c2f14399932be5839fad281c38c2cb5cfafac81b96a810ab749b61806b6d54c9f8cf4bf1be0192423288f
-encapEntropyPreHash = bbc773ebd2df42c36ae05952d6a64c63a5dfb82ceb3ef4f8d4df3a30ec8c0467
-pk = DBF001BFA28B07E21ADC142C75111B9785AA2109A795AB792DE4CB7B6298A504200F8850D32CC44E54182761A1C9C9BA591A9FA6873A61025515B068099BB1E63751C5B887D283077F86B733E4344D13310CE12D22322F254A0E92779A87067D19C53C70DBB927E14E1F2892B5273949428EB4C70C49DA8AA7FB87048961DB4892A6F89F18F0BB69347B9575025A964047AC7BD2C7472838383A6072F8338B23AA07D6B7B221E18D4E3C62641916106694315A2FC5BB88C6D664667680DF556C3C046398A88328421F32ECB758BC64CF246815A25922021DCB67C995FC72CC6B46BF5CA9EF3998535AC5CFAB70AA54318F9532DCD138A4C03E2FF5024C52BB486BA7665B27610B822975C412331ED6C98E66721DAA1897936371113A4F17D96EA735A5CDC019809C3907C03FA950C00EBA9DFFC69A902151A39163F2931E1C0271D491562E0A87FDF7B7846C31151017EF08727DFB68F22A8585295659EA358CC1B85C9AB4D107413225B8259804B31850EB347E1FD37F5435617A7A07B15321CC204B1A6B7C30D67E91C088A458BEF5CB704E6B662189A9C0079E224A94E21502C0F1A4DFF6028EF6645CBA38C0C86EAF673E9B2613620BC216914A9781645FC48E33CB9EA06182637439F1D1A19FA50CFD3B5E2CB8310229B74ECBAEAD4B079D535521B8587A2995FA9B8C6694BE6E432343C97C16CA23BF53883E23CC38F10C38E54F5639B9FC0943A4F41CD0ACC8DB40CB12E644CB74B9D4B858F7D6767830B92381A42368476CF2602ADB9ED08B35FF5C4D1EA93C94AA75E218779825401D859902D19822E9820D86C7E57562795B89CDA97EBA773070BBC502884A6F437D7EA7A459C0764CD943E0B6A5B61B8358530459685E2842AE9AB867FA712172207E692A7AFFA872323779087547C3D8B89F368CE078ACECD55AAFD5305371A5BEF24FB255211B2169F4543927C845A3049F7A88513A682303960C2D12BC277656F15738C4368DEB70CFF2A32A1D179F4FDCA57812CEDB21B356E0AA63270788B510E58B4BF613473FE931DC80A9CB8BAFE63AAAC3913936C8A939C413CCA10A1277409250B5DA321EE5C24AD3D093C1C7095FBA34B81380E5DA561BC039E3A8C15FF3982A7938BC16446A3AB2679A50C2E5C1D1A08127DB4CEA30340B5589B2327988C97B78F003D1315DACB301520A11F9F0B4FB33CE7C0203FF11C6A66136C0AAB83928C145F4B968783B131281F2153925DC13AD133FCC5247B595CEF0F03FF0DA0A429C0DE9A54F66C03F1A616C7210B7ED3624FDD27E99F38472867A9283C6B294B0D7014CF9EB62F0D7B051B190F093450453C056081370B45F5EBC4C03808FBB5C6D8B659BD22612C2872DE9034B11C6AA6D356B2BACCEA0F909DA0C775969C12FD5BB0C8A9BED5172A9358E01C29D308636B5D668F5B2C9DEF1380BA23B5C84259D887D3DC4882702B41D99C72C800DD5B19935D7722610741A105C1D227C38C5665CD5A6DAAA991A9868499830C1697FA430BF4F95B03004126FAC283A167281E4B847EBA8487B0032914EDB0B67B1E320C25BAB50499378115CB07A9000E0156C9C93C1D90693B9C22623A3EB15618FA1C470481C4CF292B7462410D057C2E5851E08E31FD88AF2F84B0CF79A88DE834C1F17C7A5FA17D329CAA0
-sk = EEEB8866B17CDA12A45FCC6F9D05AFD103835147647A7301EE071366398473C8103AB3B064E340F4F9866190ACEDE02473FB49635BC38DEBCFF0F34C5175AE0EC025AAF19CCCD46D658C2A6BA62B50D1452B09C21B430EE9A3CE05D36A8E1AAB2BF0185F35664B4999CC8C0DF049C01056AF6AACB025708C184534F1172B28FCC94AAC2FB7012E20443F11F43478E7B1DD8A5C7D9B5A8818C0D2259C7F710F51003777B060F8DB5FE06C3520D35E97F6B5792B0AC3304349387B637686CAC1A6E45149173041FD7C3CFFF5A398BA832DBA04DD7179D0768122A701F4E0BFA48149FF140E2978A723FB985B939458B081E1068EE5102E5F540365E6ACCBB8C28DB84125B21E8D04622412C2F075CB57019EB828616CAA245A8B099A01BD86268CF491823E440E984335AF59924FAC1D43263AF725895C717E827532D35C7DA9AC1420B46AEF13C9F33A427BB5A1BC646F7B54A21760527D303BACB2A21AA39C5577BCD5F416F126741FBA9C2CF9401EC20A14E9A7BB927CC8135BBB0C3180696093289F4B19539C58655B8698A5D1339C9490BE7C04AD3311FD422045A5027B203407CB5755462C21AC51F523389E803F30E12FA9C0AA7B4A1FDD85C66989AF558CBA916C9A037AC7DE1A3F7F1B5BD3208FB6F28661696AD0DB88D10A3B224A5BB5C99CCC96820E153E478AC579C65BEC5A3D4B85AFF1C4AF5BB222E7AAAF9E9149AFD11EA5E86990913D2B543913942D148639D9815D4A8908362A84BFB6AD20B8ACF9596DF4187009E7B773070450010744712F9E7A9B8E9624E3E2B1D6140A9E4789775ABCBD2657AA487740314EA1E446DB5C09746ACCAEE29783B23EBFB255BA5C9706F1254703C676EA09801762E9FA45D858732AE7218B37107B3708EABA05D2C035FD447CEBA46EE446AA324BC184E7B929F7513C16BFDE5C5E55C05E6B5041552C17DD223AF273CBBF65A44B4B6DABD51B341464A9993EFFD671481592C5A655D116B963975006B13503BAAE38332248F58656620098F42F97A813DFC7B4DF880E5E783AF5D833B89079474040AC05A6A7EC5E9EC1BDB282443C736514514F1CB7455958608A62503428464D89C66B209C417445416A54AA66234B1A5BF1C0C3F7064B6D0A7243E170B6ACB01C033C5B1670A3BA6801024C03B24CC1786025FBC56BF04F3B241E4BE701C9764938695BEA4316ADB6ABACFB44F2041D2C29BB867379374B211E990F194B872A7B684A212DC179A4ADD943AABB1E6BEB93F5CB100FE342D0781AA80989406571D1B79D08E31AE15B81740A22DF02270F920EBFAA3C9D74392CD64E71F363DF221134E9BE32B6B855FB76E15B5C91CC6C3F750AEED71071A0803987CA7F35882AC31413A6001A6023C0A183961722B6EBBA16F5577D95BEA2C5AB446AC8E57ACC96281A07599A8D335C2C12388BB0CB9F8633CD2251C8A7563B396072D0CF6E7B8E3AF2192E5731341214C30708E128914C124973E759D4221F1735386B874905220C41FC731A22B9C665CEF0CC5353B799399905F0ACB549F13C6FA56FAE2907D0353FF2054ACCEC40310A2C4B62AAC3F392B014BA88FC90EB868693EAC83516336BAA601F600518FC820BC8B0E76C66DBF001BFA28B07E21ADC142C75111B9785AA2109A795AB792DE4CB7B6298A504200F8850D32CC44E54182761A1C9C9BA591A9FA6873A61025515B068099BB1E63751C5B887D283077F86B733E4344D13310CE12D22322F254A0E92779A87067D19C53C70DBB927E14E1F2892B5273949428EB4C70C49DA8AA7FB87048961DB4892A6F89F18F0BB69347B9575025A964047AC7BD2C7472838383A6072F8338B23AA07D6B7B221E18D4E3C62641916106694315A2FC5BB88C6D664667680DF556C3C046398A88328421F32ECB758BC64CF246815A25922021DCB67C995FC72CC6B46BF5CA9EF3998535AC5CFAB70AA54318F9532DCD138A4C03E2FF5024C52BB486BA7665B27610B822975C412331ED6C98E66721DAA1897936371113A4F17D96EA735A5CDC019809C3907C03FA950C00EBA9DFFC69A902151A39163F2931E1C0271D491562E0A87FDF7B7846C31151017EF08727DFB68F22A8585295659EA358CC1B85C9AB4D107413225B8259804B31850EB347E1FD37F5435617A7A07B15321CC204B1A6B7C30D67E91C088A458BEF5CB704E6B662189A9C0079E224A94E21502C0F1A4DFF6028EF6645CBA38C0C86EAF673E9B2613620BC216914A9781645FC48E33CB9EA06182637439F1D1A19FA50CFD3B5E2CB8310229B74ECBAEAD4B079D535521B8587A2995FA9B8C6694BE6E432343C97C16CA23BF53883E23CC38F10C38E54F5639B9FC0943A4F41CD0ACC8DB40CB12E644CB74B9D4B858F7D6767830B92381A42368476CF2602ADB9ED08B35FF5C4D1EA93C94AA75E218779825401D859902D19822E9820D86C7E57562795B89CDA97EBA773070BBC502884A6F437D7EA7A459C0764CD943E0B6A5B61B8358530459685E2842AE9AB867FA712172207E692A7AFFA872323779087547C3D8B89F368CE078ACECD55AAFD5305371A5BEF24FB255211B2169F4543927C845A3049F7A88513A682303960C2D12BC277656F15738C4368DEB70CFF2A32A1D179F4FDCA57812CEDB21B356E0AA63270788B510E58B4BF613473FE931DC80A9CB8BAFE63AAAC3913936C8A939C413CCA10A1277409250B5DA321EE5C24AD3D093C1C7095FBA34B81380E5DA561BC039E3A8C15FF3982A7938BC16446A3AB2679A50C2E5C1D1A08127DB4CEA30340B5589B2327988C97B78F003D1315DACB301520A11F9F0B4FB33CE7C0203FF11C6A66136C0AAB83928C145F4B968783B131281F2153925DC13AD133FCC5247B595CEF0F03FF0DA0A429C0DE9A54F66C03F1A616C7210B7ED3624FDD27E99F38472867A9283C6B294B0D7014CF9EB62F0D7B051B190F093450453C056081370B45F5EBC4C03808FBB5C6D8B659BD22612C2872DE9034B11C6AA6D356B2BACCEA0F909DA0C775969C12FD5BB0C8A9BED5172A9358E01C29D308636B5D668F5B2C9DEF1380BA23B5C84259D887D3DC4882702B41D99C72C800DD5B19935D7722610741A105C1D227C38C5665CD5A6DAAA991A9868499830C1697FA430BF4F95B03004126FAC283A167281E4B847EBA8487B0032914EDB0B67B1E320C25BAB50499378115CB07A9000E0156C9C93C1D90693B9C22623A3EB15618FA1C470481C4CF292B7462410D057C2E5851E08E31FD88AF2F84B0CF79A88DE834C1F17C7A5FA17D329CAA09BC32A138A2FB5B6072464172ABE0FD97E9EABF357C3FA5391D94A415B53ABD381C38C2CB5CFAFAC81B96A810AB749B61806B6D54C9F8CF4BF1BE0192423288F
-ct = 7C87310316CC1AAE495EF575650D79BC38E091B72BF809E003C71ADFF6C4729139CE41CB1F669F1E1281F223781293E3D9AC647D16EA0D08402CC265F1F4C26D08B7D4651D88F2332BDB9F9F3B417AFE26A433BCE1E8A975D86B547E77E8D4189BD9E46F6F2842166D6389A5CD399E735686BDF4779991C1242E3BFEF69552D6282C476AC51EDA2C9D7A4E3100F8BC8FCDFC449EB57DA0F392CD889BCF45C337A84E48E3B83AD72C50C9D2905A4E22E59CC73AD7FE85D6BEA30550BA2BA5929A3847A9B78D886CA1B93E0C4C14DE5056360E7DD398CC271D96A7950F4C439526EAF8505A37C0DD6AB037885E48D8B66E9C3FB3C218D74AA7F31FCE3FCB58C2FBBCA23D78F994A4465907A6328C2E35D83259CE735CDEE26D516BE175C2BBD5E24616111FC7A3D95AE11D035AF9497BA41692A12900926E8FAA3A80A5349269D2786E4A1F9F57EA473C6173C2C88D6E4FF2371EA3FE8261C21C63D7E29AC72A2995762A378A45A9C8D811F2F92229967C3A7A409452F4EB01083FADD41A0948DE85363733B7C0349DD1FD4D231ACAB563CB5A908A19B819E579AC1A599F5B8135C2794B34A3314D1B8559961FA26E9396BAC778A6697363EF60A60158736C92F7C1BA912791AB962B327E6369C6EDACF69FC9AF49379387D5E8C4CADEEE9B3D5EEDC6919BE78A199DF3341F23678C6D657B5C65279484F18E4A9789B675085EDE2D55BD10311617649DED74918A752A44FF9361D7402EAF97128BED4147EF3CA81B159B304588D22802A2E05A0B2AC5031F9162FA524D28EF0381E166BB81FE396124C4247082EA6DD755F48D8B419BD6C52CAD8CA084CED3AEEA060642FFE0FC7E6C1630D056B449FFC1DA8E693F64925FC179938CF5283F6E3584EADC904338857396FE810F4F3175868578BC21608EDD7A8109AC5A8635FF8C4C3C6DA0C3C618CB2B3448E31E8414D16EA50BAF6A4564F686D12692BFE4AEFA5A0E57B84C55589D0B4CEB2F358AC33254453E001846A2C7C299DED877A07A28D0DB5E7A5E6D41C246775F951CF114F3CE64AD839681C17E995CA123CF2A24006400B4969B99E75D066B774FE4E994828FF84F171D9C618FD2D5A01EF845379831051C84A734C40871CF53935FF8AD0954902C017E8C323DD751CCF14BC50638A31629E4FA70EA6E912B6A6422AC19442832E8A051E7019A820BC6AB81CB9715998F34014DF73DB8F62F5957D53D1FD3192D9F76CB8E2587DC9A1738207F956F6BC706C3B3B7DB0C578D220F30EF2925A7E35CE01059BE2B8AC6561EA7AC253D5F50706515947771C052B015F61FF347ECDFAA1C895AF5BC7E8DC7463A301221AF6C95EB65B8FCD77B1CB4577F5053E34766631E75A0A320EC678ECAFEF5084E514EB48AB6490658492BDA71D6ACEC26488D29DFE809F576FD7F5F38ECB4918657E4C8F25FA09932F435F211E41B207A61D60C9BECFD50FA6D498DE3F4647D6AA922D5A82B33CE96399B67FBE369DA888179F95F655122E0028512944875308EDE8CE87E67A6
-ss = 52E36F81DD9A23FB9BB2363C31B715106D38520A31A3304CF754A9432E757224
-
-count = 93
-generateEntropy = 32e0ea9089fa928482c0770da545af1bb871a03ce38604138b0d08ea2a10ca2bc06c5bef7b6508409daf847a64c8d30d0974fd3ba7476dc76c46b458a036d884
-encapEntropyPreHash = 5b17a6adad541efcbf5ae4b0c0452cd2ce32e4f0f8701801c5b63e197c1fcbf4
-pk = 2DF84A0272C13DA5A495942BA848AC92D302A98A3E55937B8B1B49FE588BE32A540EC90B5CEBBD90D1B80DD24D32EB85FC041A7CA307E522B8C5FA9C85BC258C8ABB9F2678D29569F313A1E660A2454730261A6766945CE42C140E5181C68461EAF12D1F185C358233B9BB4902FC5089F851BAC83CE3F07BD7B185EF08626D7029129703334084375BC5BA27BA023CA6722319A916BAAD529715661E3A413C8137CBBB206E313906DF1CA77CBA73E5499F54FC53047741AF2341D5623278F76131AB47AF10BB4DEA8F493B6C0E4829ECF4C425A46D21755E93E5A80D0A927739848695BE93444A98A45D02D1131E493DA5A0A1117B41D4AB3DB35A7A2E95C6055BA70EF159E7AA0DD5452598F91477087BEF1396ACD48E747B962205AF92EB99FAA809B4BC47EB93BFD3860102D4ADCBFC39BE80024550656C42785A6788C7A851B107823A02A3DAA4CAF25097F1F9AFB29416DBB360C4A824E3CA2A30E19F94B805DE181D0A028E685C378DCC225112899A6B79869109CA4B094909B21042C179C6CDEB22564CFB6F89135022FCA3028CAF7ABAB19A4045DD5A60721C6BB47AC53E40CD932511F2E5473D3B4CEEB44BE1A00E090A886D345B13A58620C49CA0893F23058412054AE5069C1014361CFB0379C2215F330ABC647114A3C597765FD014C64C8C1B1B45B3BD02BE9D5A55B0CACFCE297581FB48FE0256F4C0CFC84AAE1C542F36730E5F10795C72157C653210686801210418B549A7398CA8B7C70ED007CB153D2A55178AE23A5B095EE2D116B9F3A1A9F19FAEC40D75256CDF76AB8E393210D3AFAE375A7BC384799A6EFC5B76F287499C6701368B8DDC219A9F2295E6E01D22C4A50BD08179A08044B702FFD786FAA088F867B63B951A92751CB0F839CD554A83745444C3BB88D3609A9A4BC2E0BC73108A71CC7534217872539BD6E942CD36A09AA0374A3894D279A1F7C38A56E7C0298948C330B8C3A5B6AEC3BBDBB87384677ADA78017564A7FE40C2983A9ED3ACBCE5E29E3A78502952A9540A44975572A1512B1D4284D9BB528E538F43A15216F4B4F2A5208E06C43896A19C416C99C3B677564975948468792EDB6532F9B0567F407FC6D6C302766C6D1373BF78A18896188CF20CCEC39632269F6A193DE5EC5DCA85CAD6BC79023C691D5682643B6F314827E0B24539E2AA91123B3FE42308F041DFB6C876D079D60A3EF5735AB8A36ABAE34F4A12729BE4A00F753C7E4699572375E6C7B037948684206C08A27EC12B26F7349CDACC3559AC29D5CBC35C310870597E391AC4E4C02991096F37492083BC1C43304BC3D5925843622494C735942DAC8904CF195387ECCDCFCC8A999B6D1B744A542359E6B167F91022BE1660BBD218A6A6861AA17C57152552172F38B43D5281956CAA77DAF9B94CF60CBF08CD9D9B4C1EDB6C4A17BAE3B36800891910C280C3E7CBF4AA11F33A7C70E3B419C2B2B9A64709C31878F913FB934D77B4C36E329BA98B44F394631E0A289042061F527D67446D6AB55CE7B43EE1080FBAE67085A2A03B36CC9AD9B5B546156C3C5A79B092A67912A19575F6B5546397C15AE334B451C3D919422F28B70727C75FB631A2AB012BD5971B5B2B75F80E14BEC0494BAEAE3C7AE947BD69827E1FB86388052C3BF3F8B4CD25A568
-sk = B27CA8D40A1CF8AAC1A62553FF541EF56B4B4E352E38C0AE8C2CB2240C2D2525ADC52B1953A1C239E3ADD71B5F7693196875BABF8B31EDC528F3B320E6569997639F1C9B5279C38D5DDB3B691B0228AC4480D45077DB55BAC24285C5820C49BE25632C4AAAA23ED84E10A1256D9CCA9B584D423A9FD37276CBFC5953C9284A4097BF71706069AC413AB857C64EBD179EB75496170778AFD74180D877C9D69E1956450B1289948323F64227960A0B24B442E78C551C5B35E89B34B018B80BD094F7594365195F44C05BACBB2E0A976A86559BD6B23D220B5C900375C6B188FB353C3B064CED669BEE6751D5D22659EB89900A92B7BA84EAB58B7E95CB8495191CA0491EF75A3ABB9469A7939796C2F8C15CA22283235852B0A96DAEC403C5C057B5AC91D09CB16E01BB0D078170E0CE9596B913E953C5AA67BD8A2FF20C0261CA814F334244886DAA0694368293FD858E14E23D13E66AC89A58867574804786C4C48D2FC003336C002A7776217ACFE7084588455A0A85B8AA51C33E99B1CDB75541855577911DB00475DF42168E7A21EFE57402303DFE37AB5BF10200395550A1639DA2AA8E358748EC38946BBD3DFC27DEB08F4F017ABE33A2DF3B9B96CAC0E8C261E487CFFF31A1484CA5E04036797CB4FC87AE6CC72F9EC0835AE2B160B425ACFA8B75236D92870E4D43BFA7EA5C98827F95DB6DD4200068650E3D8812DE827C3F660CF8049933DAA52793AC10F57AD8F2A7445927CA6022D5A485F9424662A175B2A6349B248AAF4853BE709D42228C3CE3B13990794B9698869842B81649CBD9482C2435886441ED9A7927384371D02005A514717ABEC398BD183B321134A4DE85A1FC9B72F7268CCAFBAE289C15DCEC18BC26B81EC43C6B8A3919625165617D60C33F1E6B04CD5492414A15BBCA5CE84284557C9CB481A951FA5DF2E444E2C20969F38284E60FF15B0EE707115880BC6D3834230C7D22C7CD69229D1EEA957F58B2D47B11CA97C926070CF1C1934EF83F5A26241C7C73959C8A0501C2C1C70671987243635FEA56CE6EE292B1D6AA26C4CDDFAA1751520FC3218E7E20C13C6A1DF4835C7D6C0BA45923CEB2AB40FA7FE3732E47AB652309CDF28091D8D86308B73F90D86995220ACDD9C544C95FCD24A77E7C90F2F15E52AAB595E11B1AC0799A3CA95E0644771420AEDC777A9048FA89CE94780C8F2B903548BD46A2C22E453B68736F5CCA6C35EBB027C0C7035678F7F69A9CA02FBB4B23746759660251F6757BE3AA1767D7280AA75B60A7A0CC892F70F67CDA886CFCABB451A36023C688D7AB5E0A3B5BC88514CED3597A594D0E28C7AA25859E57BE9FB12691C047A8A7373FE1695AE742027A8F5630CB2776721815742C66A4BA0C7E7E8B8281144B80288CC7296BFC8625A2CB995B548D48294B2FBCA97D375B91203392CC27FE835F62DB97B14739F6C8B1880A53DDD388E2636F866416817A110258A098D9AF4458A64C68654E97099746B9B9E23ADAB5653970C00719B54E4A2D2092CD7BD62AD9317357E35224184A4E24B4A58014F666B33E1530365070B73AA6DA432D04F2588F34AC1CB3B3F7FB4AB200B459966FAFC689CC40ADAD0C26108859A2943E2DF84A0272C13DA5A495942BA848AC92D302A98A3E55937B8B1B49FE588BE32A540EC90B5CEBBD90D1B80DD24D32EB85FC041A7CA307E522B8C5FA9C85BC258C8ABB9F2678D29569F313A1E660A2454730261A6766945CE42C140E5181C68461EAF12D1F185C358233B9BB4902FC5089F851BAC83CE3F07BD7B185EF08626D7029129703334084375BC5BA27BA023CA6722319A916BAAD529715661E3A413C8137CBBB206E313906DF1CA77CBA73E5499F54FC53047741AF2341D5623278F76131AB47AF10BB4DEA8F493B6C0E4829ECF4C425A46D21755E93E5A80D0A927739848695BE93444A98A45D02D1131E493DA5A0A1117B41D4AB3DB35A7A2E95C6055BA70EF159E7AA0DD5452598F91477087BEF1396ACD48E747B962205AF92EB99FAA809B4BC47EB93BFD3860102D4ADCBFC39BE80024550656C42785A6788C7A851B107823A02A3DAA4CAF25097F1F9AFB29416DBB360C4A824E3CA2A30E19F94B805DE181D0A028E685C378DCC225112899A6B79869109CA4B094909B21042C179C6CDEB22564CFB6F89135022FCA3028CAF7ABAB19A4045DD5A60721C6BB47AC53E40CD932511F2E5473D3B4CEEB44BE1A00E090A886D345B13A58620C49CA0893F23058412054AE5069C1014361CFB0379C2215F330ABC647114A3C597765FD014C64C8C1B1B45B3BD02BE9D5A55B0CACFCE297581FB48FE0256F4C0CFC84AAE1C542F36730E5F10795C72157C653210686801210418B549A7398CA8B7C70ED007CB153D2A55178AE23A5B095EE2D116B9F3A1A9F19FAEC40D75256CDF76AB8E393210D3AFAE375A7BC384799A6EFC5B76F287499C6701368B8DDC219A9F2295E6E01D22C4A50BD08179A08044B702FFD786FAA088F867B63B951A92751CB0F839CD554A83745444C3BB88D3609A9A4BC2E0BC73108A71CC7534217872539BD6E942CD36A09AA0374A3894D279A1F7C38A56E7C0298948C330B8C3A5B6AEC3BBDBB87384677ADA78017564A7FE40C2983A9ED3ACBCE5E29E3A78502952A9540A44975572A1512B1D4284D9BB528E538F43A15216F4B4F2A5208E06C43896A19C416C99C3B677564975948468792EDB6532F9B0567F407FC6D6C302766C6D1373BF78A18896188CF20CCEC39632269F6A193DE5EC5DCA85CAD6BC79023C691D5682643B6F314827E0B24539E2AA91123B3FE42308F041DFB6C876D079D60A3EF5735AB8A36ABAE34F4A12729BE4A00F753C7E4699572375E6C7B037948684206C08A27EC12B26F7349CDACC3559AC29D5CBC35C310870597E391AC4E4C02991096F37492083BC1C43304BC3D5925843622494C735942DAC8904CF195387ECCDCFCC8A999B6D1B744A542359E6B167F91022BE1660BBD218A6A6861AA17C57152552172F38B43D5281956CAA77DAF9B94CF60CBF08CD9D9B4C1EDB6C4A17BAE3B36800891910C280C3E7CBF4AA11F33A7C70E3B419C2B2B9A64709C31878F913FB934D77B4C36E329BA98B44F394631E0A289042061F527D67446D6AB55CE7B43EE1080FBAE67085A2A03B36CC9AD9B5B546156C3C5A79B092A67912A19575F6B5546397C15AE334B451C3D919422F28B70727C75FB631A2AB012BD5971B5B2B75F80E14BEC0494BAEAE3C7AE947BD69827E1FB86388052C3BF3F8B4CD25A5687EF43A72EF04766F1E899D25C9A005009C788B5FAF985123CFB3FB97975DE26DC06C5BEF7B6508409DAF847A64C8D30D0974FD3BA7476DC76C46B458A036D884
-ct = 4C5CE3680E598066FFE1EE7645E55CED8C9A55B6902A491AEB9B6447F58B6184343638F13F4F79D067A0A8A4F10CA355188FDE778B848886E2F38979B5AEF4F14DD0B47E7A95AE839F6A1945D9B32D830189F3994C43DE711F71E8439BCF957B62A8F97CD869EE551D167B4C97E209B972E175947E7C5423EA86B5FF5D4004BBEA6163EE2858FDC9D8A04180D01AEE7E75B8616BD1E37EF33DB050FF02674C3D9C58AF7C1A76D79F4940E29B3DD1365C8259B2DA36E8B8A7D05887BFD3E145E8C78F01CDB63FEDF457A1AF4746828734F23B947F68D217E3FAD14D7CF15B26651915C371D3CD4C58094F15DABD0013E7878EB8ACAAB33EFDD47B2B20688A85A3F92C6A4D90F6045127A17AF0F8643B064A4A30A983F7DDDCE4D8893A3F964578D0529113D9D248E09A41792D4053B8B04942E866AD0DE54F8FE31B64024E647EAB8A10C87526899C6FCE476314ACA7B9B5E2F809721D2660DCDF9FBA5734714592BE7157ED459BFA0500B94242C48E2EFAA774E0F78B0EFEE997658CC82C2DFC8C686C3406A6D997296F2FD3281D3E44750DEBA5B22CBCF7E45BA3663F2909A643838C9E7D5FFDA9AB840C9A0AF6D6FE29BE8A7615D896D8879EC16BCB9999559A645627553BF231FAA4344F6258FC4679C790668D09AB7393CDE99170A770E3BC4491C35F22BC7234C346191E09CAC7CE819B8E43DA70880BD3563622196D860DB3FD4B1E1E814660A024EDC779BDEB38CB686318EE950AAF42AA3B0042716D5365A102C5FEA90A7C0DBE71CEF891F12CA3D20F0A35F7D59E8EC5B35972FDB474D52D780C54B5C79D1C165DB237AC235528A42B21E3D667968418019AFE9F68F44D46DC96EB87A7DA38F2B0B943C9C6C2E87C724C99C65E5CCA40D6C85E32778CE1065F65C95795E0F1ABE400A4C78F22303D8ED54F9BE517CE2EEAE1AE6DBC04E9604DE79952DC74758027C616ACB8F586EE0F7BB7274D3E1E147E27039A44E3C1E0A5A874BB0E70A60F897AAE005701DAE3A9696652869F541EE178EAB5118D3115C923321BD28F9D6358FA012633076754110877C00376C5CCD57E6917DF937AF1C6F449993088D01993E4B470E98CF8F42F7A81120D175CA4CFAF063F76950D2E75046AFE842BDC15FE4CDB69369CC112050B62369D4820C97F407D8355CEE5D8C4B682E7D184F6FA02992BAE0FBBD2ABDAABFF5BA49F4571FED93789E52ACE387AD29A7A6EB8C0FFAB868A4542A42C1B35FD3D42E426714C01F82C8B11D77D768CB5908E60934678140524922EE339D3783C912151EAB2F051C1E61EEA79148F442FB7715855A0C9D6B857412D5CC3526584131180EC763AFF11813EB16446E876F48A25B8FE13EFB071991FF1DEF484AA00A976C4CA8D65B4AF8AB6D59EEB6957932F218DACE7BA7D57D402A9EDA506220A22F03BB70CB60134BC3334B005AAA26A7EA14808F13DCB1EB11BB40DF9A8CAA714A5F0B076F1C64BEF4A0607B174406155E77E531307EB8C5FE2A53D1BE40301EC59AA2CD995FFD5E55708
-ss = D072CB81AFF4AA5712E56F0E9567DD89F2B03488735BA4751A7F0DF1C786402A
-
-count = 94
-generateEntropy = 6fb2ec719f2a0dea152bf3f64b9d148f8ab8ba88f64e61f5db53e12d59f525574f797c007e4061f95c7d56cfc7ee5c49e849dde3fea8f25e7876df2a18515c34
-encapEntropyPreHash = 61ab87659525de9656af41246f20e1dbe85c24e335e7ecf9493f46168bc14e94
-pk = FED53D194419C06B92E51498AC2601869A1024EB0370CA3A420C48A765A5B99BAB88A759251CB83259A628603C54A831AC0147F3A97B8329474258B7BD6067476605A2B2B8311252FE54565C865E2DD96EA9E43B23121C27AB02C348310ACC38D9D583B0D8105DC87896C238069C689027910F9BCB5D29AEEBF57C2B9C78F76866768C0699C6BF743C0B43108C128A5277F39B32C351926369FB8754CD0197EB9AB602F391C4BA564BE2C3423005266229A10B21D31A7CC3D40C2E7192CB6628AFA692D3E75AACE66E7BB1169893C8EE45BDA5560E7F79C711D32D52C0C783EB40BF8977C3063CB114B6368A8D1486A86CB108D146A648E080751440F4D8087116701987C328D8547D0573F8C03D321AC07138A60954297CD832DFB989FD99ABA8B213E7501CB3D25B384C023F66776EFA3AD4981037A54400729634A782ADFC24404BBB4F2405A27A8500CD79E8521DAEE48848E485F53A28DE91089D849EBFB54D97D0CFB3CBA46A27438F426EEA1A0122F2180630864AE46CC5F3A828725CAE89331D540B5B3633EEBC0228000D75908F21277104D7816F56854C3289AD1A5C72C1655830089CFB9C90B1306724CB2828BE679B989A3565758B058AE983C1EA9B71F10553795537D454EED50F50A40274592AE165C846D85527E479E3FA8D8865047BF68D200287C0A5B8A6A78C4769BB3A795979B774713A522DBB723F3628F2F4126B639E3B4C5C4B076D321A208A123D82852AA0DB6FF8457E745B6B710B396C8106E635A379E22C59F17DF7B7070EAAB38D5448E4AB67E6B21078D5B9F9979C6D7365CD1423CEF6B4C2B186AC6B792EF9351B6040F423CA22E7A1455A0473273E3B53B92A132D7C44556477907FB41F981A06CAC9BEEB9655FE90C4FE93CC33337D78294F7C128FFEE82B0D4211E550342C599C9932A201F3CB8BB253A0559FD667A3D2CB46A4936F5CF9C4D0D105880A446066AE06841E12F259E4E6220D932633F77F9A6B463E180778D53C37E0BF423717F4D476ECAB6BFBDA7E461AC3CC9806FF4B38FB80C0AC9B0DCEF56E9B27881D1AA0892657B12A913A8AB84037A6C78399F53816D79C6A1FB40F1CE200334A7E74760999F8A0294C3029BB23EE0CB81700B95BA20140CC5DE537ACA62C9808240E74D508A93263EB14B7D202A31DDC2147747192BA1F38932538241AD1DB35CAA40097393038957B64E716D4CB3675AA9EA46257BF55A6D1FBC2C356B020073E16EBCBDDB3692515BE92DBA54CB62C702165C74864C3A7CE67D8AF92EB78496C4E8EB78B55DB7963B016A252A85E655C95936D6006BC07BA6250E458A387BD7BB43A3F5A16CD8733B66565377C1A74D5488C1A0DBFD7A6DFB474EAF29FA80AADC83267D0B98EB7A8AD3AEABA977A0A5E55B8937AB68E385F94DB13FBC6C26BC23B0B8BA331A578B99B493D875F206C278A3B4F63E156FD386FC13104D6DC96AE9BB3055481B846183DE71ECA09273E58C466EA225B1824246C799AB8B045FB844572882299BD6F1B2787E1094BCA102FB20E0A274257062385DAC60F37A15B0496ED23C465A3BA46BCC0BA9B5B78C93B45CAC0151687859B155AD62A8539CC6B872AEED63847CA64797460FF5F477504DF1B1894FEE3E6BBF8218590936E0102DCE8ADF459D590355576E1
-sk = 2735BC066A2488726C89432E56452ACB24A2A5407522988C0732CE072128C8D5147C42988F94A8516C77873858394A2BEF65B87741C5B9691B6DB84E3B1B2B2F851B1305832E4210E5D05710A5BB7195B8BEE0CBA9B5BA21BA57B962A280565AABE1C9015635CF1A7121A8581FA0A78AB26FC82838B6A405C6FA5D46469136CCCC34930664240915BA5C86E67ED9E73F4B123233C92D73BC05408005DCD6CFD62635C3026C990753C55CA8DD385A29B1C79FDB97C0B4CC8F26B28BA573B5194D6BCC065F5B97DF702009C43A65ECCF452447AF91200EF68F18CAC25E5C71E62A39FD7A26C6B64B47E29D1E4084801599ABA838A3808ED83454B506965507CC6D0B34BB139300D1014168A79D5707C74BBC7B980461249FC31734DC384C9DAC4EA6EB4701402084719593B62AAE53C8D55719945975CFD25BFF31C886640FEC37CAB3942676C840A453C6751CAF16A4743495BCDE6528A942A47E7C2D6499B2A872A76E928EF4B0AABBB21604F33231235A7CB47C96D9C976A2AAD533A06A24024AD0925007984D99ABA3AA8168A8AC92F662348686F756BDC1A23F8537545D13AE9F657CAA801788C9368864A05F40AF22E33E10705741F06EF577CADE6CCBF1D01065565A5B13284690BF611093E45684D6C69FC0F548AF852248DB6A6E86A2A907C95CE0053FD942A92B024DD18803474B03F73FC022912257454C008D137C5E8404379DB2719581AF17108A03F58DEA58892912C5FAB701D28CA845068761F6BAB69BBB75584F7D289DD921AB30379248C91106A784738B17CF0044418BB9CE34BCD913BB26D04CA04896109A255A39BEBA1A2B58490862409E473CA623933AC14C90F64CC74AF396C3186917061B5C8C28F3E8B694535FC2C73AF9843031C19166D2C8A3A76A2ABA45ECA36321BA367BD5B176B5C7B8D7B7192C95CF2803E2C3CA5D585C4EA63009C7B850F08759C278F1027C59499526A8B2E494203197A9304022FA0C4E47A3A6FBD8BC59A7C1312A6D19D3063E8078B1A1BFF964AF48151E4CD3CD87F49BBBE01AFA3A5BF46A7F9BC97DE729285AF35A6A9168683658EE37BA6D9499CBAA8CB44C93BEB287EF7CC7B1EB6491154C14FC2027AB49316B70B8237A546090C9687CC70CBFB82208A7F61F63AAC1A42961568407343A050B1048967C5334F3542860249FF9C2FAC8639EF8C125D0B9FD537FCA93C1006A77499658C0286267B910C10B12A6136152BCBC03E782C41B1FE94A000CD974A3A9ADE3A3B8B4BB8ED8B403683AB4EA3B84B84C4825F61F99D72EACD894337523C6B6AF765BCC99393213938D66B18B2B168D6C73C2EACC42AD22255CD3AC6D75200111C0A6076F02F906B1C96213E80310B8752B1B619E72366F9A0BA4283520333EBF8693F93A7FD6C3560058A8D16CB50B585B3D519E4263B050259A9A0A8823E3CADCD0B81C1CA53820323A9539133C68B0A6CAC1FC834B808D9375431F961FE3233C49FC9E88EA1ED0A068A271B502C0A0376A1309F86013B4947BB671C1B048C0905C8CE16D8035C7C05B9CB8755C7D7B6DB2907DACC5A91B61B666837F209075E8AC5B86444B49AC878F9B2E18D42E0F791AB7CB7C973CA8E0437F158889FED53D194419C06B92E51498AC2601869A1024EB0370CA3A420C48A765A5B99BAB88A759251CB83259A628603C54A831AC0147F3A97B8329474258B7BD6067476605A2B2B8311252FE54565C865E2DD96EA9E43B23121C27AB02C348310ACC38D9D583B0D8105DC87896C238069C689027910F9BCB5D29AEEBF57C2B9C78F76866768C0699C6BF743C0B43108C128A5277F39B32C351926369FB8754CD0197EB9AB602F391C4BA564BE2C3423005266229A10B21D31A7CC3D40C2E7192CB6628AFA692D3E75AACE66E7BB1169893C8EE45BDA5560E7F79C711D32D52C0C783EB40BF8977C3063CB114B6368A8D1486A86CB108D146A648E080751440F4D8087116701987C328D8547D0573F8C03D321AC07138A60954297CD832DFB989FD99ABA8B213E7501CB3D25B384C023F66776EFA3AD4981037A54400729634A782ADFC24404BBB4F2405A27A8500CD79E8521DAEE48848E485F53A28DE91089D849EBFB54D97D0CFB3CBA46A27438F426EEA1A0122F2180630864AE46CC5F3A828725CAE89331D540B5B3633EEBC0228000D75908F21277104D7816F56854C3289AD1A5C72C1655830089CFB9C90B1306724CB2828BE679B989A3565758B058AE983C1EA9B71F10553795537D454EED50F50A40274592AE165C846D85527E479E3FA8D8865047BF68D200287C0A5B8A6A78C4769BB3A795979B774713A522DBB723F3628F2F4126B639E3B4C5C4B076D321A208A123D82852AA0DB6FF8457E745B6B710B396C8106E635A379E22C59F17DF7B7070EAAB38D5448E4AB67E6B21078D5B9F9979C6D7365CD1423CEF6B4C2B186AC6B792EF9351B6040F423CA22E7A1455A0473273E3B53B92A132D7C44556477907FB41F981A06CAC9BEEB9655FE90C4FE93CC33337D78294F7C128FFEE82B0D4211E550342C599C9932A201F3CB8BB253A0559FD667A3D2CB46A4936F5CF9C4D0D105880A446066AE06841E12F259E4E6220D932633F77F9A6B463E180778D53C37E0BF423717F4D476ECAB6BFBDA7E461AC3CC9806FF4B38FB80C0AC9B0DCEF56E9B27881D1AA0892657B12A913A8AB84037A6C78399F53816D79C6A1FB40F1CE200334A7E74760999F8A0294C3029BB23EE0CB81700B95BA20140CC5DE537ACA62C9808240E74D508A93263EB14B7D202A31DDC2147747192BA1F38932538241AD1DB35CAA40097393038957B64E716D4CB3675AA9EA46257BF55A6D1FBC2C356B020073E16EBCBDDB3692515BE92DBA54CB62C702165C74864C3A7CE67D8AF92EB78496C4E8EB78B55DB7963B016A252A85E655C95936D6006BC07BA6250E458A387BD7BB43A3F5A16CD8733B66565377C1A74D5488C1A0DBFD7A6DFB474EAF29FA80AADC83267D0B98EB7A8AD3AEABA977A0A5E55B8937AB68E385F94DB13FBC6C26BC23B0B8BA331A578B99B493D875F206C278A3B4F63E156FD386FC13104D6DC96AE9BB3055481B846183DE71ECA09273E58C466EA225B1824246C799AB8B045FB844572882299BD6F1B2787E1094BCA102FB20E0A274257062385DAC60F37A15B0496ED23C465A3BA46BCC0BA9B5B78C93B45CAC0151687859B155AD62A8539CC6B872AEED63847CA64797460FF5F477504DF1B1894FEE3E6BBF8218590936E0102DCE8ADF459D590355576E12C0DB43F39B672B2CD912F907CF76A0F6FDA925EB2D205546431BE0B37B204114F797C007E4061F95C7D56CFC7EE5C49E849DDE3FEA8F25E7876DF2A18515C34
-ct = BAFB19B80A5CE997C3664CB158299C969C9020D74B644EA41906922A18329F70271FEA4912E7A67335279F58CB3E5E4B7BD7FE3C4A18327BE182BEF8D989E13CF8CC43955E9F6BFB3D4A2C8AD71DC01BF30C34718D01D5D4460C3F7F85E881ABC66E483F8406ABA076C08F6BA3C796945D4E286E9ED09E8B64204FED1354A33EAB64A60EEAC0296357E5AE0058FD67FDA21B0A6DB5029732F86E9C9B92F7D3B5380BC601A5FF35A037862BDE3A399D27E6119F0C43CC8CF852C522EEF46B4867753684E30B27F4D98FE039F203164855CFF6315769BE970D0AAACD411D35679B33BD68A852F836374921C99BCE48C782321E68B16DC964463732ED2BC4002757C7587CC3C780DB57BC7F1BF936A6F685E0F82DEF692568B99DDCB49A8376F2774F2E77F7DE0D188258C4E1BBD0652BE82112371D92EB01D8C38C9A84E5237AB8F6A333642B2A86C9DE4993703428104F76F8BCA911135C78101DEA18F0929F6A00B0F07854E814764F15832F18F60B6F25262BD448453E51686775A824FF5C743B811625FCDB7503E0834C79596B066B6EE2C3548CD6062AC11663E5497632280CFB8BB33B392C8747681A84831CB37799C4E42A25E16552354756CA0D41F19FCE9B3C9F8BAF18D05DAD841740B110F2C1B4E101F76158F307E9543E2015AE0924628996E652588E7EDADB51855ADB306CE70B1223EC445C425AD76D26E89514AB335CE2236E6A3AB1A7BA399B806609E5D22857F3ADF23DF5CFA3C4EDF0AC3EB60A00C27D7C02E0AA3851FB6EC063ECEF6E819AD52F92F260BAE7F83BB44BA8FAB3A608251C2B1DF90548F9DD2BEAC4FDDFB54FA10B251E42F3FC4FA9EB320BBC8AC34BBAF8DEE65BEF1C83EE499397F7930D61B4BED065D809A1F5E6E377C9563C660DD8DDEDA94058861B4875504DAC970EF8097EB7A75822D5EB139D10159D6007CCEB08A8EA28BAA27F78BF60E825353C5AF62F2DEC4AC0E7876A004DCDB4F12854EFF4013166053B9108F5439AF99FAD00C61169BACD84876956E53F1C0267B6E2985DAA07E34BF852947C247450A6AB3BC1820C52BB3AC9550BE7AADA0F8AA692806DC57A748F2C355555C5C58BFEF181E7277DA1C25CCE4B995E6B8A90833AABCCE74E7DE925A2A2C888930D052B9541908472C79E7A5B8E9E08E4CD3DCE557B35E34D94A741121AF0A7DF97131567393826F86A7BC0B785965C5BE0DA83FE4357D2A36E57EB1B1DDF651CF7EA1497563F4CFA4BA171DC8343A3FB549931479DD581FF018B5B10B9E1CB529CA248C00EC45B3F36C1DE804254F54C9B68A328319B59555FF57D832B3F9C047F2D343289582099685AAD6BF96FB956334DBFA7E86589D8D643780C431434F64411CFB85E9898288DF9207C7B38798CF8C68DF372C2A6BE4C11CA29D29CAED09345BFE47071AA801758331B37F658DB6E7EC1408A43486B772807646E5186A40E73EB875DB09DABF293AF7083878248306E2318C72B6E0843F852CEF164446A25481ECE7432B974A0C240CA35DF4AFFDC
-ss = DA1085CBC7452CF2AC98CA36631C6EBCFFF02E60485F9E807CDB3DB77BC92243
-
-count = 95
-generateEntropy = 527fb88c8bd9a4d6031dad15e63878abd2b559e7e08d61f69e8e78fca964ee6ae32d432b4f9f751bde0496c580a181ffed762aa35454a02d3f1f47ee0394c89c
-encapEntropyPreHash = eca2adc3da1fb15f34033405ec08ef2f46163df4bfcccf8842c600ce0bc2026c
-pk = A0E473A9D639B1299251B46D07C79C0DF1CEB995A968B5B707B760D8BCB120F6226EF5B742F34548902A7C73338A8CBF8D6B02A83470874B1EC5845DCFD3A4067C420F8485FAE1286A23ADB7373B9217C6DC173748870BFD164A16D62A3A6608F5E2B7FE78B92364A4B821967DB45AE29AA1B11C0CD67CB4299B32D263AAD7A26EEB3A69BA56790FD806ABE3935D82487AEC3205A856B4981E7F53B8F82A30D13C1B725B1418607B6619B0E8A8870BBA6070E33545730182FB5F6F9938AB2CA68C50719FDB472A88384EF210B0C22785367DEDFC840979AB758479506064B7971426D70AF9A95E7D585DC8B67D4FFC2082BC45A4FA9B4FB9541493C3DFB88FCA757ECCB50F1A9CCED9C046F37062E3879E13958BCF063041E858810B057680276D2CA12A307F511217FD626561587617674319382A4A00CE5E3BCFC5ECB5B3816133910650A469AC663F7A4A742DDB87C4E5BE636213880C246370B1CBB8ADAAB6BB7E1185E1F95C945BB001A0210CF56F326B35051B8DBE85245F9BC6D973B39AFB3A3B961501862B4CAABD0D55693C201390F48FB7511990571985764BE7373A7FC4BBD5E82B31F52494B15B6C2C8B5B593182028BD7AC7A40FB446EA756463C396DE29D0FDBA2569B9001E169F7C824C8A42D313A15B682BD52004867837344324E2F91A06A4C9F7CA447D6291635257CB0934E015C1937F732C1BBA2C13591CCF4ADD16960B2303476000D984A8FC8036772C3B7C5721261387AE535129A7921A1711C98103161A95EBE16C0E0A28555DC3598CAC2D701A98CA249801A4BB10379A5C29A1932ACB6F6C3D040639FA98FA7297C6D453E35587488576DB9BB2F9D1C37F8260CBA3BA90E4B779867AD97DB03FF005ECFE3470D2C25D54105CA287A9E0C039C2A2B71A1CBC6260D59A268D60C05D61202EC336CB8285B41A043BF58949DF50DEF5937BEE1AF32D174E8FB463D03449BA747E92A79A1EAC8DED247AA0A50821A16AD4C9F533A0FA24684D452A71DF461AEE15CDDC2185551112682B4867C6CC27C43BF835432CCA184840B85886A5D970E9F515F7F97151410C401E9BAADF41CE2B8642313C295D28587A327C41C24DA18967A6426663642DCF389C50892D6847718365CBBBB80723C1397B90447B197842C96A141BF6CD317BF12BB64C664FD237E886A9F793313AAB15F668C91C71149C4B90B35B147F7C34B8AB6948799897855B22283050B113D64A60AAC739948844A9F99C448D21C414425D77560670C298F493D891128AB1665D8141D2B1C8E67950A68255B7F9376332B1CD7C6630AC05AE7C127FA7ACC35E640E94285E78661B15B21685A36C889A8CC890CE53C36EF23C2F17CBD8C31351BEBA827949F8707A05324ABF05AA71857BCBE690405AB0030E648FCD3BFC0F2AE2C627E04F490BC3BA237059AB93085DE218029F056B0F57ABD342170F5B16DB069073A3C16BB1C0BDA5136952919B22AC477AC2489237BB0869656614E4AC248B003799C761B2BA5F2711B24A01419C88937DC4CE745ACC16C796E0123A4228EC623A2A4E059B80B72BEB1329C9204B6555B0A62C14DF0B19B4A157BCA985090B428DBA8587B53CA2714B2EC2A04D306B3CD5D09045252960A068412F1BD67B83A217049D0685EC3D63D691559A327B2
-sk = A680635121C694AC4672C809BB3B913E8CA2F659C756DB1D7BB2369F41AB4AC9B3F5141216F3C997B00DCDE37352D46463F371FEC14B26AAB239498D44975F787504815552E727329DD78428F5568B912C76B572AD9B3D335A9F5BC0283C76AEF8D81369A0CEB4523BDC4BB0607C29D9998962F76B217774D74A3453A61FF1F40F89A51365212F39A07E913824BF36B6DBF6C8934014DD8716E998A982B124AED8B082C3A2998708BC1C4733773B73E0BE315203E8E264A032797280CA0AB023A9D81FBF0565F491837CF031E219084B640EE8710589E05E1701870BDB7BF0B0BB539A0B3AB0028447110288C1D7D83F89578413A46B0B04406657B4E7E5A6D04BBB91055BECC8AB907CA9647C4B8B144045B6CABCB974A47A35308A23E9C9281C61C556EC148C9A663AD9518CEA36AAEC71B6995110FC01CB66B75E128478280FCD31A3416A12E28C15BA617574730437DA8BDFB86B58D88C789C4F9E23ADCEE53B170C6A0B80033AD52CFE1A155EA1A568F5B2EF77AB74878E0CE42A1F7C3C845713D17105AB2C91B83836E11B9858A66997B22E8A67682588CA78E6B6D736298EE34B100BCE61E0AD921A9F020A7032351DAED655D35B3659A96B32DB9E68D882FC986DA904408A98C469A84CD29CC999B2B071F84C921C585B9B3233C5BEDF82637BB1253A4B29B36B42B54751DC629A215656AA1890C0C56E0CB62A3C02252B771D72375A60374BF8D84552080E0D456579930B3F2A2A3B7913C031112FABACAEF75BB2DA5202D7671359282CB4707B52740D9CA06AB7034B48A292404D26B6CFD08C8B0DA61550044069F4CF27488C028001F2C29292840B60B321DE5CBDEF1CA216838091C3172ED26D141C957DD93BB6A59D9E883640D87A2A85605A9730DD5333843805374B58747C7262D5A65EF442D6843DEB731C943269B4A9BF00F39B4A3847840C1BF4B9907FD7B9A66C5DA724CEC467102F080D4D0BC519D0B2504A05F7207EDCE7398D009348F64267E01B0EC207780791942565AEB061BF03719D706F87953C4757A75A126EAD15C6C9447C02938C3B75A58AB25CE65A5CAA21898FA8050319880223899F5546E0D253DF7950691B86F8E3115438C3B80CC2E7A6178A96A0F38A0CC47394BE36C9B0721580D646A89B9327210D40728F4BC4ADBD8B130EECCCF528A5A09595F32C0F64E602F6898B8A4C82D79A8ED31C4172A7812C295C93841929B782B334490EEAA38C17CB4E77664306BC7B01726EC656E24311C51B0524C72F0745665D43073604C59EC88DF6FC9EE2F2A0476079BCFB735E562F57E2B0E1987A0220C98F0B4CDEBC70F93CA709C5C2FAC7098A7B866662ACCDF09C85974D7C88CE9AFB01F48276EE320D70C7C0E15950FC0775E13173B60555A470302D0A0047260E5CF85EA2F3C326968D3C308C15EB400B13BCAAA65EBF941EF59A069BA0BD3D00841B6124574303BA8C2BC9F90F107865882C18EBA462F6B09EAEE05796E43A8647C59C64B7A8DB9C0941299280AF728B872C303755B682A3EC10C5876F040543BBA028E870C02A4312AEE9CF2BD1302DF80BD0FACBD0765A778A7FA2D3A4C9675965D6799FC7BD4E28A4E2A53948790234F62BA0E473A9D639B1299251B46D07C79C0DF1CEB995A968B5B707B760D8BCB120F6226EF5B742F34548902A7C73338A8CBF8D6B02A83470874B1EC5845DCFD3A4067C420F8485FAE1286A23ADB7373B9217C6DC173748870BFD164A16D62A3A6608F5E2B7FE78B92364A4B821967DB45AE29AA1B11C0CD67CB4299B32D263AAD7A26EEB3A69BA56790FD806ABE3935D82487AEC3205A856B4981E7F53B8F82A30D13C1B725B1418607B6619B0E8A8870BBA6070E33545730182FB5F6F9938AB2CA68C50719FDB472A88384EF210B0C22785367DEDFC840979AB758479506064B7971426D70AF9A95E7D585DC8B67D4FFC2082BC45A4FA9B4FB9541493C3DFB88FCA757ECCB50F1A9CCED9C046F37062E3879E13958BCF063041E858810B057680276D2CA12A307F511217FD626561587617674319382A4A00CE5E3BCFC5ECB5B3816133910650A469AC663F7A4A742DDB87C4E5BE636213880C246370B1CBB8ADAAB6BB7E1185E1F95C945BB001A0210CF56F326B35051B8DBE85245F9BC6D973B39AFB3A3B961501862B4CAABD0D55693C201390F48FB7511990571985764BE7373A7FC4BBD5E82B31F52494B15B6C2C8B5B593182028BD7AC7A40FB446EA756463C396DE29D0FDBA2569B9001E169F7C824C8A42D313A15B682BD52004867837344324E2F91A06A4C9F7CA447D6291635257CB0934E015C1937F732C1BBA2C13591CCF4ADD16960B2303476000D984A8FC8036772C3B7C5721261387AE535129A7921A1711C98103161A95EBE16C0E0A28555DC3598CAC2D701A98CA249801A4BB10379A5C29A1932ACB6F6C3D040639FA98FA7297C6D453E35587488576DB9BB2F9D1C37F8260CBA3BA90E4B779867AD97DB03FF005ECFE3470D2C25D54105CA287A9E0C039C2A2B71A1CBC6260D59A268D60C05D61202EC336CB8285B41A043BF58949DF50DEF5937BEE1AF32D174E8FB463D03449BA747E92A79A1EAC8DED247AA0A50821A16AD4C9F533A0FA24684D452A71DF461AEE15CDDC2185551112682B4867C6CC27C43BF835432CCA184840B85886A5D970E9F515F7F97151410C401E9BAADF41CE2B8642313C295D28587A327C41C24DA18967A6426663642DCF389C50892D6847718365CBBBB80723C1397B90447B197842C96A141BF6CD317BF12BB64C664FD237E886A9F793313AAB15F668C91C71149C4B90B35B147F7C34B8AB6948799897855B22283050B113D64A60AAC739948844A9F99C448D21C414425D77560670C298F493D891128AB1665D8141D2B1C8E67950A68255B7F9376332B1CD7C6630AC05AE7C127FA7ACC35E640E94285E78661B15B21685A36C889A8CC890CE53C36EF23C2F17CBD8C31351BEBA827949F8707A05324ABF05AA71857BCBE690405AB0030E648FCD3BFC0F2AE2C627E04F490BC3BA237059AB93085DE218029F056B0F57ABD342170F5B16DB069073A3C16BB1C0BDA5136952919B22AC477AC2489237BB0869656614E4AC248B003799C761B2BA5F2711B24A01419C88937DC4CE745ACC16C796E0123A4228EC623A2A4E059B80B72BEB1329C9204B6555B0A62C14DF0B19B4A157BCA985090B428DBA8587B53CA2714B2EC2A04D306B3CD5D09045252960A068412F1BD67B83A217049D0685EC3D63D691559A327B2AAE8E61B905723FA092FB95B839F6DE3670C39CE0498C27B87D20C24E7F64E22E32D432B4F9F751BDE0496C580A181FFED762AA35454A02D3F1F47EE0394C89C
-ct = 8F9648D01A9027F4E1AB3D988F096F3470D09707E288699141A14A78A88C95E1771E6E12B02BD13C2E99207B33F9AADD87C79715928CF9FD76956FC73C2A21D24AF756AC54F75ACCF2667AB9D8458380743A1609A7DA99A5FB521D1061C263964800096B930CE7D448AD1CA9BF48524892960A762B382A1EF36B4ECE3EBD9515EC7295692546891C10C53C6829AE866943E569F539FF1101B5F0B2AC7D1C94EEBAF6378B13BBC1C8A2B144A62A10D752A1F05DBF1A9CF7F1192FB7919CE51FD6CDCBD6BA26B6B8AD7FCAAAD17F3B96DDB8CB78CD0EB4E96958AD38D2FE9BB71A87547AA7CB0ED2AD6CDE695112E6379A333D135808DE697F7FEBE9C179F627F419689B2050E5DE6C87BAE3FDEA59124D39F06F264E2723683A092FB8382186F1737048026459D6E242C0E7FD386F6AE6C8B09FB6613F26745DA21F43FF145C83DEE40C927918C26E8C855038FA8F994790C799393EB031D3DB7F499138186CFF085F3669B45351CC0579299D1E37578D753E447EC2B161DC50373065D20B44712EB059040F72F98F51858E0A250A97409374EF7BD73D58798697B0FCFA35946933856CA5A0A964B7DCA6617EA2D35D16A8B83F536972BBA727BC3C16EE363B5B63CAE7C13AB11B4287568EE64229671DC45F06FEB3DBA8ECABCFC16FBCFFCFDCB4227EF4E705992CA8978A19D1190842A4099A21CE4F96814FEB88E094A69EA7B7BF0EEE9932A1C235AC2ADE53897D3D8BE0E4F02FA7F0CDA13C4EE78127F1FA8C611F50CA159DBD048E9D888234BE8D80B49324621F7980E490A13CA0C5CB8D4CFA07528E808839FB9A21FC167BAA489F3C96AD67B89FFDB4145F3FC9A827C2DB3588B0B348FB8F5F469315B7B89F5C25EDA806D921DEF1768029F99777ED29AD1031CD40EB1C12A92A8D2A130D2D0C1560598C430CB2CFD73E19E290EA864E80384359188D67A53A15A4F31DF7502BB3123BCE2614B87C82DECFD29C0264286A9641AF0EAE2A38E6CA1F065A9E619E3CF39C1158A4BC46A40EBE72536F4607372471D5D6D6CAE5E2FF6265B7BE9DD3B466C159D54FAFEAE8E3CC62ECFA7BD2D047C0E3E93D163D93C7EAD30CD0CB41B789546CF11DFE9306CCAFECB8519C08573268FE46DB18203F6C4CA916C4E1133D5422EB966F716622DBDCD7DB21834BB10BB36631AA2C50FA46D2909F0EEF33B3C62846267A9D5E7187623337950DA98496A703A5E9F7BEC4C2E1CCA8CEA8FFDA5BABE1BE1E612DF7E9625EFFEF36733097CDE4E88ABCF2B8878D3CD9A47C6F907ECDC63E87E89C6CCC6AF8CAB530DCCAF3597E33AF7DDD3814D9FFA5E90A335E31DD2ABCAAD72807AD5C6D89F6FCB1581AEC0F0BFBE7315CDB428D905795BACE3138178A8B1460C665398FD57295014F82C8630EACBBBB4C52A1D22E58FD028B5097758AD913922F6ECCFCFABD165D9959F29C2DFC6B4A548D6E75544D70BAAD0AD24D74DBE1E51EF9C9EA4AE3345B121AC8F0D041F359BC653987C4215EE7253FD0BC21384D0BA14630F5C049A398
-ss = ACA83F1DC628FA87B20133BED4C2EEE34B98021F295AB585DFDCEFC9E3C032F5
-
-count = 96
-generateEntropy = ac6fcfaeeef795b6ef9e062f02bf42975fa01e7d91ba832f74e05269a72684d05aeda108ea4d6c6bc0fb958286850422bc357ca67b83c986048e0d0087fa11ec
-encapEntropyPreHash = c4f15bec2d7701339d0ade4835193bea3632edcf89e74992620d9eb623a0d0d4
-pk = 4D960C98359F5719B20DCA6D1E2916F2829E73F79B55B468170B64F2F8B0C788796801C8EC244E1973C7E033B768414C55D43079B2711BDA630E678B184A70DD161C4DABBCB91C07FB634620D1450664A444E82D22A0A4F54AC6C7C02D74120B2CE205FE49A139B9C8194341F4295EF126B37F3B22E35792A8853B60EB3F7ED01314491C4451470870A5EA5B1D23442019BC1DEF547FB8935ECBEBA0833228B8D7BF2A4ACA52436A3F993F6164666EBB3C38317BF5B48CC7182C00D58D4A095D0FD4C60E4229E77803C4F38F22464C7A4259E45AC71E8CCDE6E5738DCC798777317F9847F8357DCE21B24AE462D0465F1D58203F3B8590D88DEB9C6DF4722A1420A9EA0813EC3777A6CB11CA0271292B6C662A870C292291164004299C82442A8DD5404E74CFBCB45175237AE5649F7136CB47B9C6C053203F265BAB420EEE2C95A5960F8A87C3333785E1B89FF841A6AA5AA964F3A853E512ACABB60E29C3A4810DF33830134C0E49BC5E1BA41B07B671E1BA6BFDA82576406E6DA854920A46914C8EA986B1D6A0328D4A450FC0CE698B9D16954AAA0C52B6F2B5FF7B5347E84C3AF403E9B31EC180238CD5AF96F5C6F0D3644AB51717F7255AD6551F44378294778937CC56B610680704BFB37E3CCC07C5276777E37F36623DEC8225388C3A5A2C7026EB902C63260CE27FFE657BCE34A47DB43667B9293E04AB9677B6FDB0B0A429A4435A9F5624628A2C07BBFA8AFED562BE4233019524E67CAE6F955226437433BC59835561C462071AC38058C145787C242D4B6DC055170675190882792EA49726DC8B2CB638763784D3C23E1791C93A55383A8C4B59643626F8948D228B670312893AB3CE5B123401B1B24432545889D4D124D2B846070C1663B87A3475C01ADC4F4DF286FC91C76B018C05B5A26A696DF86C4B1FBB2ED3050CC9B54CA2786839F854B9461655972FE21C3C98007A693A4D0B8AAFA3AB73F1C411DD283CCE59528477B6E089847CE6518F29B523602F80AC573618070BCA649EFB84FC3947D43B229E05682914C153809521EC9B7978A6BD667F59B18F1D986222DC9AB345AD2C7C7CC5799C15297C22C3734DF18A218C5BACB364C9136B8E055053567A1856C21B96A1A2723913C98CC364BBD1FC4EDEF37E1853C523727A6C677CA4C82AC4D49238E1B60C1531D1DC9835C4A96124A0011C09350353AAC4568A84293E8666F6016E56C38371489EDDBB3DF3E53E6767BD01E231EB122F13F59A83A35101844AB389954E8068F6D7128C738AC1774EDC6465EAE8CCBABCBB41271467C407D36928D9E3174C99665E3A9AF0FC1B2733925B254A3ABA050EC3925DABC511427C0B2930BCA63BA7629366C1BA620CC0D7090752157B5D70C098745E37DB7316056C7BB37C024226425107DA8BA0E9C30E2606752F31A017E50A0E10C05332677EC851EAE14F594A55D07392C23A962248CCEE1221FEB2C8F801860892B33EF2247B801E5FF55BA97675A71037FD133133840050B8B7914125E9D30165847319EB1E483005CA0BB8338B75EED618C47408D0260DDFB1527640A148F29E64F65FCAFC59A8715A8126830024767009BAD41A3385C0173BE51A35F3825843B59FE06B5FC03DC21F6D925B9F6D92FFF175C9DD625BFAF502B4E2870961858852
-sk = CF8293B02A9A6F579F51066BD6E51ABD270104634CFD482823102F2B63B18A8BB4F45A5AF4D8202523CC1779B44FD283860BD004307C399CA5D8EACADE156AF824A988F5AC6BB50EAFA6177A95B9752C922BD6A7C4265A6A88B11D0403E47127B1E80787742669E763929483393CAD6EF91F18143E9D2B7CD3E028C6F56B91768113259BCAB926A082A2A6185A1BF18656448A628258E21A3C6CCA23449B4F9483AE9D01BDD4BC674E06566300AD2A215809E547E2626F8D9437BAA727F3F05C31E85E4D34643148981BB6A82C3C75099A33A0E7528D45303D98223E1A4EF6536170F53A0C61004BEB75FA34B8AED5156E4A538269775808283CB0BA5282607D50661D2A626FAC2737C98CF33050353BB83E1C1136F1C26FE48D81973EB974AB1BA4B97C95C0DEE065523430CC06620DEBBA3DB92888497658BC5C64B98BE65AB2A0738F0750022B95A66C583354A63865B5237FE7098D279C53F731F3FCAE8689754194A7B888199B89761FD09FF75677B2C500D7359905E76357163834712659F26D0D8C9B47192404975CFB89969A77615D1A3FB404BAAA54511FF1B3B08C1577EB274F5B3B0B825434E87F60D18FA73141F912701A99A7C11305000789229A144A0899685596AA646F13573EBA0B54DD3205DE2C60C3CA1614066474B89F2377994BD14EE0A77E1D4C0AF77748C1E623CB8947A98636694C4EFAF0CE2BF779C66A317989A335A0071505831471C8D845A5FA4B3E42D195074244F70578124C4C7894AB84584DAEC8C13A6598524C023CA99F4C0499A68ACA3E6827798B10EF9A4639605E2FE8656606438274AC8ED8C87AE0A16BA3B8E5857A7F25831D8B85BC7105828575320C6BABA75489455154B31E50074A313BA9AD10B747F39405544F44949DDE165070C8271F1BA80E57BB5BD1320C8A1F8FB47354079532BBA51282AE3197026E18C46AE6B2AB9940EABA9F1EE421592770C9A9604263A4917C825C084C3534381F22C057592DD97940ADB1A439D5128CF795CDD25640FA9229220A1CE4A6624CC9956105465246334C77FFCB9907159461CB1416637D8DF34AB4B401413C27B6D5A1D23331F88273222653ADF9685A614BEC9840355B1A23A0C4CE60B0B678AFFED200BCB383BEC2580C89127B2870745C15570BA1CEC89F5DCCC47BE517BB020C57959E433C11DF10810D5B37AA8AB3392B3358793246F11ECE238646724BEB859C861463C42B5030D9A1FDBA3E1D391F9CA5A99DF58A7948C66FA2B50864B73A40B52DC7CFF031B3A3B21009268CD5CB00A89B44C156333B802AD03B2F07F70F7C11057CE78705AB6EE43681AFF0874030807412A7743399CAE832F6F3B65DF56AB1B30D6967379E10B4EF53B9EFB5632A23B942F832A7FA22CDE494B0C7393D51AC807A38AF119D526A5A3B91068E107812269EC85410AA739C288C20446B68880343F2E12157094DD424A349D1523E76C0ACB9C29C22B6346386B522B0466BC8A85B97430A1DF80850510C4825EC4F2AAB987C4A07F11693E7BBB4662A4890A3C54EBC0CBBD75CA468428E38276E81C43D81A8D0E3BDBEBAC9AEB89FC9D7870BB88C5C16A137C41FEE75640774C4B536BB1D7BBCE797844D960C98359F5719B20DCA6D1E2916F2829E73F79B55B468170B64F2F8B0C788796801C8EC244E1973C7E033B768414C55D43079B2711BDA630E678B184A70DD161C4DABBCB91C07FB634620D1450664A444E82D22A0A4F54AC6C7C02D74120B2CE205FE49A139B9C8194341F4295EF126B37F3B22E35792A8853B60EB3F7ED01314491C4451470870A5EA5B1D23442019BC1DEF547FB8935ECBEBA0833228B8D7BF2A4ACA52436A3F993F6164666EBB3C38317BF5B48CC7182C00D58D4A095D0FD4C60E4229E77803C4F38F22464C7A4259E45AC71E8CCDE6E5738DCC798777317F9847F8357DCE21B24AE462D0465F1D58203F3B8590D88DEB9C6DF4722A1420A9EA0813EC3777A6CB11CA0271292B6C662A870C292291164004299C82442A8DD5404E74CFBCB45175237AE5649F7136CB47B9C6C053203F265BAB420EEE2C95A5960F8A87C3333785E1B89FF841A6AA5AA964F3A853E512ACABB60E29C3A4810DF33830134C0E49BC5E1BA41B07B671E1BA6BFDA82576406E6DA854920A46914C8EA986B1D6A0328D4A450FC0CE698B9D16954AAA0C52B6F2B5FF7B5347E84C3AF403E9B31EC180238CD5AF96F5C6F0D3644AB51717F7255AD6551F44378294778937CC56B610680704BFB37E3CCC07C5276777E37F36623DEC8225388C3A5A2C7026EB902C63260CE27FFE657BCE34A47DB43667B9293E04AB9677B6FDB0B0A429A4435A9F5624628A2C07BBFA8AFED562BE4233019524E67CAE6F955226437433BC59835561C462071AC38058C145787C242D4B6DC055170675190882792EA49726DC8B2CB638763784D3C23E1791C93A55383A8C4B59643626F8948D228B670312893AB3CE5B123401B1B24432545889D4D124D2B846070C1663B87A3475C01ADC4F4DF286FC91C76B018C05B5A26A696DF86C4B1FBB2ED3050CC9B54CA2786839F854B9461655972FE21C3C98007A693A4D0B8AAFA3AB73F1C411DD283CCE59528477B6E089847CE6518F29B523602F80AC573618070BCA649EFB84FC3947D43B229E05682914C153809521EC9B7978A6BD667F59B18F1D986222DC9AB345AD2C7C7CC5799C15297C22C3734DF18A218C5BACB364C9136B8E055053567A1856C21B96A1A2723913C98CC364BBD1FC4EDEF37E1853C523727A6C677CA4C82AC4D49238E1B60C1531D1DC9835C4A96124A0011C09350353AAC4568A84293E8666F6016E56C38371489EDDBB3DF3E53E6767BD01E231EB122F13F59A83A35101844AB389954E8068F6D7128C738AC1774EDC6465EAE8CCBABCBB41271467C407D36928D9E3174C99665E3A9AF0FC1B2733925B254A3ABA050EC3925DABC511427C0B2930BCA63BA7629366C1BA620CC0D7090752157B5D70C098745E37DB7316056C7BB37C024226425107DA8BA0E9C30E2606752F31A017E50A0E10C05332677EC851EAE14F594A55D07392C23A962248CCEE1221FEB2C8F801860892B33EF2247B801E5FF55BA97675A71037FD133133840050B8B7914125E9D30165847319EB1E483005CA0BB8338B75EED618C47408D0260DDFB1527640A148F29E64F65FCAFC59A8715A8126830024767009BAD41A3385C0173BE51A35F3825843B59FE06B5FC03DC21F6D925B9F6D92FFF175C9DD625BFAF502B4E287096185885264E085F67E48F00A7A7F82963E8C67176BFF839A54FA1008328C0612F98D83D35AEDA108EA4D6C6BC0FB958286850422BC357CA67B83C986048E0D0087FA11EC
-ct = BB06BFEECC7B7777B56768C6165C5347166BA71E8DC7E9E0258FF889BC123E6B6A1461F717FFBBC9CF11662E6FFEA09EB65AA287ECB4D7206D103F931B0E3C9EA8D71BE6F87B03EDF777EC1427F839922A7C8EEDC8DB4C8FECCA7665227029D6E23F5ED9163253D64D715042A5F301B41E2C59337F282DF32195EFCA03BDB3BD1D8B65C562ABF51EE8FCB39F51CC69DEA3BE7547341608444CA2EB9A9EFF2A3805224504440CF702C95A1FABAE452BA47A25E4D6401D24C0D8FC61962D4E11842FF6C6F82084D28F921E81E818DBE81B7E6A25596ABEC6809157A90C6F8779F4810BB3890D93E6F30546D982732AF2CBAD9E054AB510B64E6377DACB97104C64D9AE8CB451700F9A7776BEC488786733BAF3FBD6153B8B80C468FEB5EE28338817233A34A35E35F97D518AA8C07C9921E3D1BB96984FE1D543630B4FF34CB6AA6C64D7E3A7EBEA73E4B1379A8C53ACE1F2F2F07DF7017262FF152686BA28D8A3A348125F33BA2E795BDA25D2869F8DECB8E02453169E6EC9AF252D673D09060AC1F8E6E203E5950B11D1EFEC554D7E405F918E3472F25AAB2FFAB059EA043038031D23AF3911743FBEDAEC446C316B2801AF1152393F55820A5A7BB6D0DDBCEDE3F9E02423D7C8FD195F0194D2C5BD5A4BA6A9A5C934C1F7CE98D7476E2CF77837AAC2B738B1D6925797CD8752103DF9DE929119340993E36993956EB1CB7B8CD3CB067FE790A36BCF52CE218E9D5C009651EE835C724ADD8872ABB9E360742609E10EE43656719F140A155644AD25825AF6DD160D0CD944E1481AAA174A265DD18DA10AC0DC9F68337C5780672A36001209D8901E28F449ADA470A7134AF449A57494684E98124AD3901D680BCF62BE505368F8277ADE5BA33C3BF448462964728CBAB403FE5B10581E2BB377E10589A06B4C1AFB54927A87A016F63CFD1EC46A8C1A1764EBE07958FA2DC54C2CB90336C4769C7D118F56848122255B995752CF2B51133A4F96753A47B9B7C14E3A2565A326237926C870C8F67FA709F50EA174C3D0D57BD660438244EBD6C68102F1990FB1F1E06F0428A5210159EEA9C1774DCC4CBAEFF4461BA6966F164121EA26F328E831EAC62702119B42C7F430487145B68AFC16E7BAECD74A7EE349997A5244B6E9D74F17F00283DDD99808103AADF2365E4EB5DB20B40C3325333DD9877E019EFC9F1B95FFE67E88976A796DD735A68405C465225E951ACD794336FF7D7C5420BAA47ADA9C9A8C5700BEE94F0C80E693939D73C5C3A0C029DB9053D8D3C2E3F6EA47378FD225E704185D29C30F0C7AFAF47B3B9DE45539B026C77F788D00AB2A2CB41B5C995C0120C1229E9C138E6480BD9AADBABAE6CFD7ABB5FA97EC99D35B76702E8D84D2DF0333E3C9F4002D0C68E98E81440CB0D551C77AB6DF66348E2D798AA8092618B958317881F01EE209CEC22CC8EF0123A0C346EE47A158518C43FE926BA6F49056EF387F023AB9C57A6C0832E53C178A761ED7C382F76A81B340D98EE6FEFE208108994BA3F31F48
-ss = 3CC0EF85A74184338A10FFBFAD5F6D04860D51E7DACF3EE73033B70969785AF8
-
-count = 97
-generateEntropy = ba2fb9318d4dbe7488057c33e95e6f054583a2800c41bb83083c330a914a12cfe63f8ffda3565c2424c89b20974b748a65a5aba75133fcb3156dfb6626a83bab
-encapEntropyPreHash = 28878249e2ac2b6263422993923a0c8bd05ce56e385ed13c943b03d226856947
-pk = B49B9264FAAFE731C0DEE965AC981965A28FF907CEABAC477E2C9B6DC95AAEB0531CBCB65D8B3F6251BE17ECAA89A5B57C1198EA66AF1F4461B91C360E4531C4D49269896107F10ED1F1070E68CDDB2A4E06C387F3126087A71A366A250B450BE1567DC957BBD034B66AB65FD4EAB2D89B8481EC2427A4AF3C1B861C799263F492779053A0128508C86EBD6201C876BBE8AB8053B790314047A1901C9F327207B2130BE5BCE8504BB03817A380975CD81FE0C0416986A7B74A16A21146636ABE4D2B2C5C1223D39265A6845804D49E5F160ABFE3CA21A345B5D044AFA5636C37B976F2894869BF4500C62AE9941B9B3C3E6064FEC351268243FD75BF287CAE8AAA9AAEFC1CFBA1032AD2623A6239A7F834A4826F86132B59AB24EFC9C57CBA929A64BA90271B987BC08A913298911650399429E9BFC40742DF735F7CB935EDA73A41F96CAACBB34324B29E64348C6063AEB0BCEE9066028B3340AA147B09C42752CFD6D491FFA497E17AB6C0726AEFE59C2577764A1A996FD879E58C23F1C0AC9E9372B3F0BE42C829B7B09ACB722E3189A2B3E72124895CCAB565DAE583C6C76C34C2C0075568379639869325F6E92E0B91A2D4100B2F4AA6486B756CD521E1B781A964A21B8B0C72637A2E4299FE15C1AC275FB077CF42F36453E7603C91A648E09CBF128ED188639B7247584B333003A2175BC587925111654F24680C540B32643B035FF38BB4598785524504EBCB26163D513867D74744C8B562BD48989B3A328374A125CA05FA962AC08B0D22277E578206A165A9E3D31A084B4492C664448AA62986B55FE8C8420816A5A9C035644F592969FD0951B6E9AA57303D1F9927FF6B3DE99263E2E11CD8317CFC899A45706746E9850922B9A4F9CDE515623F3C48B86379C969969934CCBEC4BEA3E9796889CBCC56285E9A85F0B3471BF9692F3C72FFD945089B9A262AC1A8844C38C807F7274708AA0587F94A107089A99694FC627291C30FD6B0430ECA692DB54A96019EAF89635CF54F579A63048070B7F32DD2C32A18E2B7E8400344412E9DC5943BF3AF11B4AA6C328499DA7C220670958A22BFFC89B8F0091C8665B6605571D8A1B5C934CE4686C7C047AE416BC6E39B7CCC92CB076DE94001374217E9B8820354351CB377B4F06B7FBB69F64C7B48F781DED2CFEE998718D875EB94866E7C5135358EA4EC92849978438C77CEC1BA1803BF9933C8856657C953125EB76014BACCA8EC9BE6290936130D166B187E1463E55CAE3AD85E96E81BC574220AB0CD374AA1F657ABEA849259B4431F1A00EE59B35486BEB09302BF71B4C2E840963333B4A3BE37F8048D42A0F67C886DE9B47611555495248AD4C587577D45775F52135518793EA14582BF153C74210C36B9251609A4B28559ADE5A93203725A475971B92BEB88A69357BF83F384577CC1DFB62C70FC65401073C67A66AF878FD961BACF46C633E7CAC0E5092458CBBA0C3B69494C4C0C0DA6025CD6516C1AB89B3216BB9BA123040051563610251974A0B11BE7190504522A128CA3107938F5B18E4441B52F7944B0E54CD3946C57E7AE3475BEC06791A9F5A83EACBB12F40AC971CB475610A0E6C546998DAFE5C2ED852D7715B3DBA61B94849DEA30E28720BBCB90C7AF7FEB0AF619A0CF57D173405C82
-sk = A428A1343429CE9C3DADBB6213410E264426D1CB5C69C68E7F377BCBC454AAF867771258FAA622B6367FC5CC46E960682A3984A13230B3D7C25A69CE4AB9AF0234A109878E0CC42A9B858DC559AD3FE82C4060539C08828C51B337B7C0EA768BA646A2F04900A235A4042B88E8934D3B62821A13B67A912F162AA80953CB71C396D91B91521B6665062551E0A6CE453C233460789138CB16AC6E598F670C70D6325804CC494466710D984E3EA551F5EC60C5031E94421919F62C301181831B7FB4FC61DA443FE12784CF84B5ECF240DAECC87D711AAD10808B96233D345BA80B0469797DC03583214355E8E9A356E367A593A6898355AD129A8546A0D03B2279021889C118DB3583DA691A9AD544086540BB2178B2125F00C94AE753038486B6CDF1CF7E5A2202290B4E5AC807EB04BEA95678B52FF76C4757C68D2EB9283B8766F1A39E06C999015B1F1D5C3164338AEB432D54B338C361B9A7258981555FC2563E585A6FF60886C32343E0045746E50FE78A0A9BCBB6281ABE3474BA50E1267B3276A1327A8F128E2B5AB077618C59902C35488553F745D2A0C942B81C0AAB7AFD0C869B9B9C66C1847257CB22B018B81B25C468A9BC35A180B090F4BB90C4EC035C0078B799046833CD90F7BC2678CAB9B75B95A6B457DCA8FCB84937C01479A0B7B6DA9643DA507A2B8B1AE25373825189729BDA8B35FCEA315B3B359705CD5B486582379093E64F431309F0389FF899BEB4C3CA9689B412A210EB654F183362AB8398B1E3696DF7432BE662CBE62666471F2C056504A5C1C91017A6326ACC7306524058FD0937DDEAB972B00734F60D065A1BA8655DBA3093D161B99E698FC778B2FE782FA8EC7C62D422E17B24FD107B87A8338AE7AF6994C70D959CBFC3720B3174B9658F5D43713CD47325EB926320073F384F04E6831435524B686F2CD377C18363F8E554DBE6AF09F93C2FF2A1F4A87159472E7D7A4DB9243A1C6A636AD50735B870F1297B6D6B5303E2552A54AA5991340AA40301CA2D6BD9A765B72FBDE1C3C44A7649EA350E00CDE59628E06ACAD29888C9B73CF0AA65D44B60F086C21C6ABCBD544295317B55EA9AB1117989AB7B7304304E5612119396727943678C31CF2B1779C946B82420A557A8D6426263D33C7F71591C7857E90A7FA05158E315AE19D1046249B3011B22291CAE30501D1423674824B852C34C97258AB972AF6C5195FFA20B6CF05BA0498A529756F173349BEC8C180869293C5967454D01CB3C8EDC7A3A776DBA54C37513727A69CAACFBAAD8EC4A529A1872CA25CB4A99C38B225E379ACE27485D8B91FEF9CEB97C04322B59F533745D23720AE457FA11B3A0B831DE777D07F88ED1771FA1D89DB9ACBC7BAC471BD423ACAC482BFB29DE13881AEAAAE2F340C1E747A73B9071CC551EA59B03646B65BC2E6E04875754A77025985A026ADCD321574AB45CDA47134B560219338FC93B0A398D7F85169B4B32C2EC3A06529F8E3A57FD353327B03F87D5CB60C67074146FB460476C92619D9C23BA7A371FD9425CFC6486992959109CFA1C1A75AB9EBA4235AF63C6F8648AE7855A4EAB5C9D3923386996181980B16B02A53060E5A64A8CF3CED087BBB49B9264FAAFE731C0DEE965AC981965A28FF907CEABAC477E2C9B6DC95AAEB0531CBCB65D8B3F6251BE17ECAA89A5B57C1198EA66AF1F4461B91C360E4531C4D49269896107F10ED1F1070E68CDDB2A4E06C387F3126087A71A366A250B450BE1567DC957BBD034B66AB65FD4EAB2D89B8481EC2427A4AF3C1B861C799263F492779053A0128508C86EBD6201C876BBE8AB8053B790314047A1901C9F327207B2130BE5BCE8504BB03817A380975CD81FE0C0416986A7B74A16A21146636ABE4D2B2C5C1223D39265A6845804D49E5F160ABFE3CA21A345B5D044AFA5636C37B976F2894869BF4500C62AE9941B9B3C3E6064FEC351268243FD75BF287CAE8AAA9AAEFC1CFBA1032AD2623A6239A7F834A4826F86132B59AB24EFC9C57CBA929A64BA90271B987BC08A913298911650399429E9BFC40742DF735F7CB935EDA73A41F96CAACBB34324B29E64348C6063AEB0BCEE9066028B3340AA147B09C42752CFD6D491FFA497E17AB6C0726AEFE59C2577764A1A996FD879E58C23F1C0AC9E9372B3F0BE42C829B7B09ACB722E3189A2B3E72124895CCAB565DAE583C6C76C34C2C0075568379639869325F6E92E0B91A2D4100B2F4AA6486B756CD521E1B781A964A21B8B0C72637A2E4299FE15C1AC275FB077CF42F36453E7603C91A648E09CBF128ED188639B7247584B333003A2175BC587925111654F24680C540B32643B035FF38BB4598785524504EBCB26163D513867D74744C8B562BD48989B3A328374A125CA05FA962AC08B0D22277E578206A165A9E3D31A084B4492C664448AA62986B55FE8C8420816A5A9C035644F592969FD0951B6E9AA57303D1F9927FF6B3DE99263E2E11CD8317CFC899A45706746E9850922B9A4F9CDE515623F3C48B86379C969969934CCBEC4BEA3E9796889CBCC56285E9A85F0B3471BF9692F3C72FFD945089B9A262AC1A8844C38C807F7274708AA0587F94A107089A99694FC627291C30FD6B0430ECA692DB54A96019EAF89635CF54F579A63048070B7F32DD2C32A18E2B7E8400344412E9DC5943BF3AF11B4AA6C328499DA7C220670958A22BFFC89B8F0091C8665B6605571D8A1B5C934CE4686C7C047AE416BC6E39B7CCC92CB076DE94001374217E9B8820354351CB377B4F06B7FBB69F64C7B48F781DED2CFEE998718D875EB94866E7C5135358EA4EC92849978438C77CEC1BA1803BF9933C8856657C953125EB76014BACCA8EC9BE6290936130D166B187E1463E55CAE3AD85E96E81BC574220AB0CD374AA1F657ABEA849259B4431F1A00EE59B35486BEB09302BF71B4C2E840963333B4A3BE37F8048D42A0F67C886DE9B47611555495248AD4C587577D45775F52135518793EA14582BF153C74210C36B9251609A4B28559ADE5A93203725A475971B92BEB88A69357BF83F384577CC1DFB62C70FC65401073C67A66AF878FD961BACF46C633E7CAC0E5092458CBBA0C3B69494C4C0C0DA6025CD6516C1AB89B3216BB9BA123040051563610251974A0B11BE7190504522A128CA3107938F5B18E4441B52F7944B0E54CD3946C57E7AE3475BEC06791A9F5A83EACBB12F40AC971CB475610A0E6C546998DAFE5C2ED852D7715B3DBA61B94849DEA30E28720BBCB90C7AF7FEB0AF619A0CF57D173405C828DAB879DE09B58D0FC7ADE140393FFB5343ABBDDABDC118FAD519B14436A964CE63F8FFDA3565C2424C89B20974B748A65A5ABA75133FCB3156DFB6626A83BAB
-ct = 48E85341492FA71D05723CC0673917821EF717D8C55F9BD6450037745A043EBE12E9A233C310791AD66C101D93B88861FA516333C842C610009DC7F63486830E641A34D44AB9F1E5CA2B7F8513C3C89456EBEA4859AEB7117F90ED1AAC3DCF53EAB33C5363CE46A7AE78CDD0473D4B5EF5DAC4450B95C5CF335A5A656720046E4C12A9054857946B4F356B79478E864E32848DB05A51439A8A72567CD04D82E2CC61ECFF93C154190DD3AC16910AEFF13723D93775B1626D55294BB16958BDBF6CFFDE4B1BEF349AF5E0C7A2C902066A0440E7E5408F9D840AA74C34A6A318FBD810FCAE361B3688EB8CA9EE0FB214B386FC3718EE9141EEE6156280A8236A5EE0EA14A017C08C5EB6A90DCD4771EABE95E33B3966B6C259E2C65E4C1C0D0B34CAF2DBA11FCBB30B10BF337D49416B3E20C492F6CFFB6C83DB5A5E09A8E4CFF44AF0675762E43CA34559E14C1FD7E7F9FC5CD48B02C7CB9B0B788FDCB86B17E302F0C4F9C0DF1672C59DAFC240267D59737B2E6E4DB21982C928810B58A2443AD99E64CBA79AC9FE77249622BDB56503364ABBE7B5ABCE8EDF18F1E710C4642CF794CC22DF0837EDB785D0FD3D60551C5AFC94DCD4F52F3973F4C9434060B0C2A61E046AE5600FB4C9B00271DDF543A0EBD1DE5E41B5A6C7EEB573F862820E92AE2D9D9718E21B93366F54FDC58B9E83285350AEF35191463358DB9FE8860739F6A4119A00F5351F66B06F6EF7A08DD9D387FEA300EE7059A98661D808B50E75F5415D7B82738B73E3BFB58B7905F572C7E47483781BFCE45A805E5D647F9197E5D829B0D80F5B5A617E68FB2FBEAF1A8906F6A5C72CB5D90A04F0109871FB3743D3F588056101EE96894218A2E68CCACD3FCBA9FF4791A985352CC60F7B006D95D66F4903CCBB2607C37B8DB8EB88567A4ACDD1552F8D558C1396046856AC2A828F9117113372FBDF1002A70C9EC7FCF1A8F74DE26D48E44787ECF27BA4383448AB4FA6813A9F320FB4165FBFC363488DE37D3A540D4C55610425A8DE574870CCFAACCC5414B4B9BB029D85F8408AA033EA4D7E7C3074F848A188E13FCE09840C11C3DBCECC928A2079D954BDBE08037729AA6135B68D208A9C1CA2BE8323A949CF303C8486D5258952DCD3190879E986A5EBD406B8D09CA922041643E9E647C9C4E61453C0EF9D64F14E56EFD043D257936431D287FBE3E7B0E4CF301C5A7CB0730DE2C1CB0D22CABD61C1D0006B3E3F310123FD000F41093F4A3054974BCB39E9F474055C1001D372F21A880F864147BCF855FC9351651DCCD8288C2525C7959CD9F2FC6D410278856A5B2B10AA0FB6EF76F5F44ACDF0C01380E38E4A8BBE861815DBF2FB0723E60ABA41B235EAFBAE36DE07F2D478EF39B05D20610772E5D89B7C74D4F626586B8A4BA5DE91D5380A84A8092EEAE7515EF70FD9DBBC54CF9FBC41B3876489FDD481CC2D2CDA5B4231C37CEB508EBBC9712B304EF4EA2BF1E4F75D8D789FE73CA2F7FB9F03C4B48C796980FF39DF52CEB477C1B2D6C4AD1C
-ss = 1DB6E99F80628E170260354EE6F3854F905D198E9669B4FAAB478F4B39CC2F0E
-
-count = 98
-generateEntropy = aa6dd1e5799cdf7af9c4fc632b3eb9d51d66e85c8e0a21ec98664fc51ab63c7dfda268813efab5204efa60f78bf81d320d01ac09ac06244f7afbd2d80fd356d9
-encapEntropyPreHash = 17fc65f7fbd7c75ceec421dee84dff5a8cb22764a182db17e0ebe857f54d60eb
-pk = BC962535672A8D77C9EAF9726CC1A8B8D87D61B1461F33B7F7F5A003A8657297CD100324FEA561BA879FFA75287D9A838275734593ABC2B842D9353906334D3F9324C7D00EED794C78310421DB45CAB6900817348D67490BF1485E85A3DFA255694915D286AB5243B62D3A91F8493F0B19626FB89C0B9109C6E1084BD8C848C06B3472A65A2646DD89BE2D922A0D2C5E816652C826854AB36F44809EE56C9F7E26A1DC30823535997A05255756704AA1029B86601E2853C2D34A192A9B2B76B31C69C1A048A76A6A58E48BC8E512B1C767347AE28AE046076C20179D0977D2D54A3F78ADD2EC6BC06071D9447F0461846FB1A5E91A760112424082C2994A98D07AAB29E818FD15134DE437C7FBC59469CE8BA80545A4A5BF337FE142B72E602D8A1B3009CC95975759AD38274E234AEF0552B8AA65CDFCAC975495A84C124F8426A9C87D8DB03CE48B0382642CB9E31CE210B774724912B09B16D88AE007AC4542C092F9BBED9C262D823D9D5719B357821D4C245F384FC923CD334B9DFF579E324A0BCFBCBA61FB7AE9F69B3AB88693E005EE32BD1A6A3CA950A22421125391A060276B07242A795085D0098906969C421CBC469128FB5393B72590FD391DCDFA3CF87B9F7A4C6CC3A1791AE1717478A5280A3B7580BBEDF88F0DD7C1C09AA67D6B284334049398BA983BCBACB8C56237BC3EFB3FBFDCB358A006457832DF7A01EFD937E68B3299580CBE1C9F69E165D22683B3721E4189ADAAA91846B7717D41BAF8D9A1DC76C387F0B55C2552533326597466ECF06ACA624FBF73226E471D835B0EE4A24A8F1C5FBE359C61D974A4D57C2F7C49822286CA27116839B784D6782C13B606B87804BA0969C7C47C7A29CE16CECFF5514028C3D84944EC8CAB4B4ACB5B681723511087E25B8AE84F3741A2DE6CC21E7A370B35C255C34555F29645D4B420494C4D993BA3F092EE240F1D3691753420891ACFC9421C361CA2186B563ED63456096227EAA738A33AB56029976C1125DCA790114AEB83AEBCF271ED59BBC2E8377301B53D697CFABB4C6B40BAE19B6CECD421A1109F9CAC7B71C749E60A2005A30179C393D5033CB4F8795DE4C98D91538FB9A8CB1654B1E6A82918471470461F54CC71FBA50DEB3E1221C55AA616AD5262E352ADB7A89CA04557A2090FB05704B9521809B8CABFA325892AB46765CEE83850586918422212C812373A1C6217BA890B4C5310F7B0D5D8275B884AA9E4914C85023AB53BEA88AD4281A7F501A87534AC1D806B0F8691E9F1BC7171001043015B391CFAC09B5FA88F840C63194632BD5A012B34B50441BA08C879C44654F136CCCBB7114F7B4099016E0193CBBAE63522927DF4B740B3CA5B32B741EA15A47370B98926A1F90618F5235357E8087443C93444803DD22BBDD5340C876D41F3AC1DB59E9EF17DB71369A315600FC6801A54483FB015AD3766284A97CBC241AD73461F4B2A0F6645EF428805762A6E57474D29288404AD98FAB63AE95E25436626BC66EE10C01E55103597288AC521B463886F863833948455319D3455110B68BF7BC495D1A922191A1A230A5F036C3C4AC05EE2609D09891CE368C01F037D818805A566193A433E924B30F4E86DC76AE2B345932A0E7025F8CE6101884469E31AEACAF4D77E3F1201BC75
-sk = FA198BB15B4278509DC232002C75A8BBF1853C474C8248B5062821E4D77FD5880979922016D17377F76A89AB9477A1024C9780FB728F6DF3295666828143C52FE817B9688C70EBA292D2716AB4970840ABC4603F597B5FCDEB0144813602242625A067EA48B426738DAD0AB986369AA5326DD199C72212C59AB20C8F63429683721A2C682C5AA853B86542698732AB86FE39C340DB2D452286FDD599336B9923599B66C144C0C7848C20A6979133FB7B5EFA3726A4F44389CB93D6A9C1B7E300CB852698C236AC00B2855861C88BAD062A25423362C7774C1626834EE59880762508FB518F926A3F475D01AA8E5C8C4140537091D494AF66B0E9426359032A2264AF67E63541C2408B1853F87C68C28C8C13417F94D77F6AC3315F23405C233E14F7762C152609AC34842553DE175A6FE1C08B44BAA9D15CF09A6049B05B69F71DF322171701AE91D050778A6754E374878169181A2E1336677889318CB54218AC055491B918BC2553023167151C98B30E1340403E0C59B3252F4D0C85EBAC1877798C41AA43C5C7B738B7CE116428C049370BA6665BE646B3125AEB947B1F3B2EC5357C7566C13EAB148C453D6B2274A9295A06C822DF9222CB2026F19603B5602D08D46D4C71384E776AF2A441894826E4559F5975C586E47BC0236B4897622AE4396160334CC97ACA101805814AE44786D1E445147A4728275C32554B9BD148AE9605E10C5A6B556704F1C17297A32EB311F1E92EE5F160E8522E06554B93B5C796E44086E75D236CA88ECC533C3B348091891E35639BD6CBDB3A408720B6E3A328C4268454169267A5C5348703C412C58846C192E0A162014600DBB351424FA8D0599775BD2D851DB4B07438F655AAD6402628563DB3A435F75D440636CD64041DE162D178C923490839F190F106BE0020AB63E7B3EB718A4FB59E01057C416C330CC26E485A6D9C72B707DA0B297C0A25247D26D40F044844C2DB883A5BBFC2B06F1BFBCCC6D10B65C9BDBFB806D7A04CD71774DD60BC423C1DFA897A0512365CD54A90BA6AC509298BF6455363583843925281AA405C291F11695CDA995A9AC5F742351560B38F8720D66327B4DCC47626744241679247CBE42695B8D81C37C718CAD53D1B318F9F900757267C43B982F26639901028F8F636C35091F1CA90A1E329D5CB069A918F45A078F33AB4DFD248390627926AADDFF47ECEF1718B2B048304CD40E72FB0872B6207856A61BD764034E82BB426747405E1AE5B93C63CB12C7BF09E47E27117D26ACBC102B043616E60B714316DFC17306A77800EE87E03E4B74759794EE6943DC274AEC1A08197A841E68F258202B1124803064F6E3295DD51AD18949A5A383A81363BB00118A8569A38D138BF8835362C723E999402D3CF728B0E11F647CE2B9390615B9E50487E23CEE6F9CEFC4A1CE5E83D28D642E3C16934B43931158CCEF3832A457A5E833F317918858807AB084F687A394C257ABCD8435CD717D1E6B79E78A37BB71A236729839B89A9905B5D935AFDC2C1E6C71C597898C6A69765BA05E9784B7849C685AB5B6DE3358C6299D8A4B075045D6EE15B639601AA95603A67378157B54889C3021453E373208CD06C0DEB77BC962535672A8D77C9EAF9726CC1A8B8D87D61B1461F33B7F7F5A003A8657297CD100324FEA561BA879FFA75287D9A838275734593ABC2B842D9353906334D3F9324C7D00EED794C78310421DB45CAB6900817348D67490BF1485E85A3DFA255694915D286AB5243B62D3A91F8493F0B19626FB89C0B9109C6E1084BD8C848C06B3472A65A2646DD89BE2D922A0D2C5E816652C826854AB36F44809EE56C9F7E26A1DC30823535997A05255756704AA1029B86601E2853C2D34A192A9B2B76B31C69C1A048A76A6A58E48BC8E512B1C767347AE28AE046076C20179D0977D2D54A3F78ADD2EC6BC06071D9447F0461846FB1A5E91A760112424082C2994A98D07AAB29E818FD15134DE437C7FBC59469CE8BA80545A4A5BF337FE142B72E602D8A1B3009CC95975759AD38274E234AEF0552B8AA65CDFCAC975495A84C124F8426A9C87D8DB03CE48B0382642CB9E31CE210B774724912B09B16D88AE007AC4542C092F9BBED9C262D823D9D5719B357821D4C245F384FC923CD334B9DFF579E324A0BCFBCBA61FB7AE9F69B3AB88693E005EE32BD1A6A3CA950A22421125391A060276B07242A795085D0098906969C421CBC469128FB5393B72590FD391DCDFA3CF87B9F7A4C6CC3A1791AE1717478A5280A3B7580BBEDF88F0DD7C1C09AA67D6B284334049398BA983BCBACB8C56237BC3EFB3FBFDCB358A006457832DF7A01EFD937E68B3299580CBE1C9F69E165D22683B3721E4189ADAAA91846B7717D41BAF8D9A1DC76C387F0B55C2552533326597466ECF06ACA624FBF73226E471D835B0EE4A24A8F1C5FBE359C61D974A4D57C2F7C49822286CA27116839B784D6782C13B606B87804BA0969C7C47C7A29CE16CECFF5514028C3D84944EC8CAB4B4ACB5B681723511087E25B8AE84F3741A2DE6CC21E7A370B35C255C34555F29645D4B420494C4D993BA3F092EE240F1D3691753420891ACFC9421C361CA2186B563ED63456096227EAA738A33AB56029976C1125DCA790114AEB83AEBCF271ED59BBC2E8377301B53D697CFABB4C6B40BAE19B6CECD421A1109F9CAC7B71C749E60A2005A30179C393D5033CB4F8795DE4C98D91538FB9A8CB1654B1E6A82918471470461F54CC71FBA50DEB3E1221C55AA616AD5262E352ADB7A89CA04557A2090FB05704B9521809B8CABFA325892AB46765CEE83850586918422212C812373A1C6217BA890B4C5310F7B0D5D8275B884AA9E4914C85023AB53BEA88AD4281A7F501A87534AC1D806B0F8691E9F1BC7171001043015B391CFAC09B5FA88F840C63194632BD5A012B34B50441BA08C879C44654F136CCCBB7114F7B4099016E0193CBBAE63522927DF4B740B3CA5B32B741EA15A47370B98926A1F90618F5235357E8087443C93444803DD22BBDD5340C876D41F3AC1DB59E9EF17DB71369A315600FC6801A54483FB015AD3766284A97CBC241AD73461F4B2A0F6645EF428805762A6E57474D29288404AD98FAB63AE95E25436626BC66EE10C01E55103597288AC521B463886F863833948455319D3455110B68BF7BC495D1A922191A1A230A5F036C3C4AC05EE2609D09891CE368C01F037D818805A566193A433E924B30F4E86DC76AE2B345932A0E7025F8CE6101884469E31AEACAF4D77E3F1201BC75919A696301240CD6129F66BE58E19D99B0D827D9932785CD9EA3D92F7BA54463FDA268813EFAB5204EFA60F78BF81D320D01AC09AC06244F7AFBD2D80FD356D9
-ct = 11A268DB2BEE6743849F2492BEA30B6C7458C3AA74364BCEFBC00502E30BBC3D38A6B35E56F73C84774660D3DB94F1224715F9ED1DFF8B76E7D714C68D85F5681DAE7E6928102EA340FA3D892D6E0B22C7CE2D4156BF0B68A63DD0390B49856E397E063B14AC2ECD40CFDB807F794B258F2893B4626A7D1A6A2B9CD1F1D3F0D74249E6CA9ECF42E527F11E1AF6D4FA34DF25A1E236422F83965A5535533BBAB735114794A16A3378A7E64C86FD33402C4E1A5244750EBE3AE44086134B25C7317A60B1F0989D12348618C1BFA05A9E2A9B34B500637DFB96471186F63AC4CB7407F2C636440133B30B8D9957CAB6585D71EAE68CB330431AE66B334B3B90A299E890852A785FCF51B772E3C0FA0980D89B51ADE1BCA47F6F53384566F03A0F2BBEE9FE38931F593401C4A14D9070B18CA7A905C698063A3080256619819B593BFB31FB7CC643D073B166F5D41482041871ECE479918F1F1F121F55EE63A2D12A581E839436F3E4CF5C338518F84BEE8FC08BFF8B107ABEBACC3AB9FFBB0D922D9AB1C0EFAC50D5C82F458968413702719800DB5AF2AE8DA624653889B642F09ABB3EC2464ECF548FB8EA1AED42318EFC9AAE51CD7EA08883C1546AE0D87950B9BF49DAA72F3006AFFCAB882681C8F6DCE038EF3C7653C7D91E975EDB5B6283CA48A93CA55F84027CCAE22A666351633A4414DF8FDEC7004157A174A38811351BAE1339D897FDE8BED32D491B88648EB022577F16C5165D1323B7203030B649E89B07571933AF62B5F2764A05DB9842332AD171B6A7968F87AB14809D0A5C11EA8541F733677AAA809979F4F389201F27EB240F378BCFA6D5AB63AF483CCEA73ECA4ABE515810D89C8E472CB7BECD19EBFE54D70CD035FBAB8E87AF97E1396AB607B64A752C869A92214581E0EF343305E1174236D26FE10F36810872B08268C59385D7B03A5D3389F5F840E65C12C50C576D4D99072929F378EDE448A5AAF01CC582D4692C655004C561E4A653120F9A3D27789D63EF5EE62F340D2FBCB72728A64D3FC0C04F19C7675A80A1001889F7C2A8FE7761475A26018573F9B079B7C770A3B0DC8193F1C86B29483F0725D3F52A1C9D7004AF1DCE7794811F98C1BB8320FC3AF0995989F583A4F6112FC00B05D1CB4EBB1D8A40F8F99A8085B28DEB6129AA524DF1AB6613AF704CCA378525719C71680E189C19E8E49157F29E2289697DA776B4EDC11502B75FF7B62BEF945E04A195759DA9522F9CDA1A3F8DECFB227A734A7D16551E57659B7AA9F9C5D27C67F02FA1ECD003446B58FF6912B274B22ADCC05048FD7CAB9E151B933A641E2441D841352CA90C2615058AC1206101A3CE973609EBE82F3FB0443C96107E52E6346B68F248626FBFEB726CDFD3F103A1E2E9733DDDE3E2D6A5D5DC482657FA26EBC2D5723E6506F1624B745380F1A515FB6498A2AA6BB79681BAC39242C6ADAF4D02571EEAE7DF7416F833D74EBC0929D9F7B53A439C185B9C8D50E2BB9B81F3562A56B756929FA9DF3CA7906A28E8CF
-ss = EF8DE288A7CE14CCD5172A4A2F91588559E3780A75B1DF329A53B1E400C4C7F5
-
-count = 99
-generateEntropy = 195d6c86a3df4c21e3007d7f2768b43c74cb3060e0eca77f0a5d3271542b9a84ae77e0f9f21eabd8c0c6eea7767f4e10fde5c2d79b8400bf96b19014b457ec21
-encapEntropyPreHash = fa0489f3730100609488e951e6aaa15c0f193bc1dbcfcd013bc418d6c507b176
-pk = 28441CC07C18856568C4FC0EDDC04175F564BDA148788608B71756367551A5709127668EFBD60B389877001B948F2C50CE62C7ED63122DAA7C1889400A4175AB959D09AB124BEA2C9D3659B8B4861E482EDED950DBF57A47C87F79FBC143D20420F4162F711963C47DCF7B8EA7FAA329D6A70F601D3A1B15A7890804917C84477D95F916A3761E3D94A0B0D69D9B7C39692B7F4ACB9091F87583810CCF67BDF86C4BE8F08762F2C3428646A3D33DF4B67EB87A2662353A208403BF59334BD9758A9439F8D8BDD45195F2255282A73456D168A2B249E8D180D5B310BA828685B3A1DABA2FB88783BB5062C13B79C2B0C3A10085664377EADBB477329567D1158882085850B95697248C6271F44988218777D33823AD70791BD40E29825ED124B963E05D06547C740A5AB7A1488E38C464B53B6F016BA1B7648A14AAA111907846C5DF162F61CC62747386915724A3B054E868BC04C934D64B7F2FF461AAE980FA806CCA7A9C4D7255564B420887946F7A72E4D1384D8222C70330B09C08D9A70AA176529F0685D087B8F9EB464A776F93606B05D0729FD2AFA7969EEC2662EBB7C7FC821D6B5393707ACF25C0C2C81702CB195F8CF730E8A46442E91E18FC7577F4AAFD6933450491EE24763BF6786D794D889C3005A323CEF2A8863C7AE00998D2E3CCC1F5A6C8A933D5D615CE82AF312990969C6288B6893C42142AD87AB483362461B87C641F646410EF5B393283230220A34730397188920B6873F16478331CB22A5A2C73273D865985533A1F8E109DBDE719C10C8ED87A831AB65562751EBBB15D3D5B6E01F78DB26A54E47943D6B31F916A552ED01A39F96DFF820765D6AE52265010545162D509F6AC3F9B7C0FD0ECAD4008732D6A9DF9449B2017B389522F11870704127BC6D018E0A420DD441EBF636C31B3B63DA9C00DC15BE0B3188371BBC855254217B99294815D78194FDABCD1970E31E38D37B4B1CC69BF428514F50AC9BCCA9125E6473028571BE535FCA274651752DAC691FF8A28C555036378B260ACB060FABA9573B0B65CBC76B892425294D65658F4A1B3309B424C6865BF1AB307B88022087F97F6882D4360ECD91F3D2513059A784BB256E47670AFD5C1AD5C177142A2955B082FD0B546577CA5286E0F1C85AF8B0BD5650038609E8EC8344E6CCB6DF93A056644CB89294FA19266948E9A561BFA66517A900B67F6BE5EFB853C703CCB4A296A493C24607A6AC4A749361D8F738080A80CA62AAF658B6A972894E6CA402AF3C09D2A6E9C181005E0C4D193361859011173BC8B97755FD1085B52808373B29733A7D0488C5F890364ABB9716920C074645AE023679BC9C2B3AD29B9051A94A124A43688A1027C35B90F9303664AA37AA92284F97DBCC7AD0F12B5B6BA38CE0A07130110518C74EA36CA6D6A44399A3983101458F926E0BB3357BAC5A294446463814806AD1623185F295D27F2C913C9608314174B2BB8BC03A92DB6CC6F044D964A7E3E289EA8F064D9B5C0D0EB43357495D09C0FBC4069903BCDC683763BC4C6ACC2517B7C94E3E0265029BFF55773421BC6143A38F57410BFB50BF21BAFEC948548A87667D95439BB78CCA2C9DA670BEB4C816478683B5487A4CE6401EC27A1605F879E2D9C53BF27E165246401CAD7840A077934B8
-sk = 55873EC8C5BAC259501E025FAED327B9B659B0810E7D43B8BF7A25A8C1A51062CFBC9BBEAB182747196797913398DB1C1CA41C1CC3A883400A29797AB4CBB553076C204167AAD2208355279F504DD9A476985362898B4E423821CC2642C335C3C953C866451CECE03098D5A2AE366DDAE1A06E05547E1C0C0667CC98494BFA778EEBC5CBACCC3038F93B82E57F814799CB7A921FB14042AAC83A1B4897BC6A15C87FC94144828966C49B6CB8F842A3157B60D6B3271C3661529D8A93C7DAF7B4DE1396308C0CBBFC9F984617CBB5B1825C88BDBC4C74C58EF3D54D089613A6A431E3A59ACF4201FBB6828DB0061F1BC514DCBFE72023CF8102E9834D5D6BBA8A354FE04C6008B37F9B07857CDA1238F5A562F288F3217FFD1A1BF8B2A0FCF3AF0310C84BD6CD805C246C4A227C9BCF963093A9755CBA968E7C06CC4F987B516171461B69E013076CB652C2A0B10F1B0FC9D6B583A929FA3905BA4B6B41F19D862C82B5F170277530A278773FA740ECA749C00A61735AA1A27719CFB75EB0768956718239F43239E25A316339DB665EB9784AB581137D020B992782956522B824B3EA4CB540A4B12AD7C512046711B0463F779E1279BCD2B7238580C72DF6120850376DB48978DC717CD1424D0B5E7331B76D0AC0B024C6283C8418E5B1A7A297AA483E5D2A65F2181EDE32C69CC4B9A8C4C0B90BB17EC06336D2100766AED931876CE45435B5662DD8A5B9F545292C870A16925546AE0CECACFB737647504EA1A29D13E0BC2D060BF7480345051E9379CFB0F901B9A426641802E5522FF8B199439026B123CF9B5827FFA147567912C46C88CEF0B41D9526D227A72262C0E3B3157DC4898E07CAEBC8038142B5172A799B8A6DB0F7703730C98E1957FEF13D5D7B2A52945EFF5C4337B6CC5004BACBB419BA73568AA357F61C70383447C6015A5896B9C0C0A2F2C7A76D940278D736D6B685F4FB3CC392CAAC1830B439468B6BC73585B4205751E55103099986308702A477588611A990580D88657024FA6D371550141405A8240109824788675D2546AFAD54628E93281ABCCAE4EAC11D200AA5C40A9E440D9F2A40DEB31C2688A3266C9E16B60461087DA271A1973374C99693C8111F9D458F92AC3208268078B177C818038305AB421B6D8297063061BB36F1318BB2108163A723A4BFC3C2A25F958F28B2B806A15E4310B8852103843C8AC26C7773084F1F82151C52083E69772A049123027916F039FD08713B98039F3B84CC83A8F88B2C19F48A958A443339A5A2158DFD7A08D11983601A1892A8C1152C602EDB1592C3AE555B2EE54C5DC6020C0B95626FC06D85D78120AC135FD369DE6B6AA902BB015A7BC3BA13A7391960C533D2F1A6278494E78B6A3C5B91A2B1AA2A0752E5C0A30E33CC86DCBA2E3232C98B9AAF1BBDF9E825B15A6DC3A741D43A53EB10AD18E93541E224EC5A952D673984990AF0D81577D1BC83B09856794D11707FAAC63A1E49A799224B51464916BC07F0A69F06F26696F5806E92CA4ADA050CDA48A9C90635A9C68ACC753A711115C35488758A68256A32F4964C431D50C0A8C5053D1A41126A952270A309F69931C32194FD201BC3809DB548A000558528441CC07C18856568C4FC0EDDC04175F564BDA148788608B71756367551A5709127668EFBD60B389877001B948F2C50CE62C7ED63122DAA7C1889400A4175AB959D09AB124BEA2C9D3659B8B4861E482EDED950DBF57A47C87F79FBC143D20420F4162F711963C47DCF7B8EA7FAA329D6A70F601D3A1B15A7890804917C84477D95F916A3761E3D94A0B0D69D9B7C39692B7F4ACB9091F87583810CCF67BDF86C4BE8F08762F2C3428646A3D33DF4B67EB87A2662353A208403BF59334BD9758A9439F8D8BDD45195F2255282A73456D168A2B249E8D180D5B310BA828685B3A1DABA2FB88783BB5062C13B79C2B0C3A10085664377EADBB477329567D1158882085850B95697248C6271F44988218777D33823AD70791BD40E29825ED124B963E05D06547C740A5AB7A1488E38C464B53B6F016BA1B7648A14AAA111907846C5DF162F61CC62747386915724A3B054E868BC04C934D64B7F2FF461AAE980FA806CCA7A9C4D7255564B420887946F7A72E4D1384D8222C70330B09C08D9A70AA176529F0685D087B8F9EB464A776F93606B05D0729FD2AFA7969EEC2662EBB7C7FC821D6B5393707ACF25C0C2C81702CB195F8CF730E8A46442E91E18FC7577F4AAFD6933450491EE24763BF6786D794D889C3005A323CEF2A8863C7AE00998D2E3CCC1F5A6C8A933D5D615CE82AF312990969C6288B6893C42142AD87AB483362461B87C641F646410EF5B393283230220A34730397188920B6873F16478331CB22A5A2C73273D865985533A1F8E109DBDE719C10C8ED87A831AB65562751EBBB15D3D5B6E01F78DB26A54E47943D6B31F916A552ED01A39F96DFF820765D6AE52265010545162D509F6AC3F9B7C0FD0ECAD4008732D6A9DF9449B2017B389522F11870704127BC6D018E0A420DD441EBF636C31B3B63DA9C00DC15BE0B3188371BBC855254217B99294815D78194FDABCD1970E31E38D37B4B1CC69BF428514F50AC9BCCA9125E6473028571BE535FCA274651752DAC691FF8A28C555036378B260ACB060FABA9573B0B65CBC76B892425294D65658F4A1B3309B424C6865BF1AB307B88022087F97F6882D4360ECD91F3D2513059A784BB256E47670AFD5C1AD5C177142A2955B082FD0B546577CA5286E0F1C85AF8B0BD5650038609E8EC8344E6CCB6DF93A056644CB89294FA19266948E9A561BFA66517A900B67F6BE5EFB853C703CCB4A296A493C24607A6AC4A749361D8F738080A80CA62AAF658B6A972894E6CA402AF3C09D2A6E9C181005E0C4D193361859011173BC8B97755FD1085B52808373B29733A7D0488C5F890364ABB9716920C074645AE023679BC9C2B3AD29B9051A94A124A43688A1027C35B90F9303664AA37AA92284F97DBCC7AD0F12B5B6BA38CE0A07130110518C74EA36CA6D6A44399A3983101458F926E0BB3357BAC5A294446463814806AD1623185F295D27F2C913C9608314174B2BB8BC03A92DB6CC6F044D964A7E3E289EA8F064D9B5C0D0EB43357495D09C0FBC4069903BCDC683763BC4C6ACC2517B7C94E3E0265029BFF55773421BC6143A38F57410BFB50BF21BAFEC948548A87667D95439BB78CCA2C9DA670BEB4C816478683B5487A4CE6401EC27A1605F879E2D9C53BF27E165246401CAD7840A077934B8CB6D7232426BDBDFDACD373C9190722E7BF342825F7D829185DCC9120588FC76AE77E0F9F21EABD8C0C6EEA7767F4E10FDE5C2D79B8400BF96B19014B457EC21
-ct = 7F60D2E6EE01AE6FBB198364141AF9A1AC4BA1B161CBDB16B86224FA77129864F00B71AA221DD1F300BA3EAFB2694610CA8F27C24CDFCD240961C27CF42D01561CCAF742379B19085C462270636676D6DCC5786E23D3881C83CD5FFD667C017FCA1F404A15A5BD368CD95A8FBDEBCCB9771B95958BDE3F65533190C0A758586094EBB86101582DC69FCCD7C2C1900D30648F360B4C805F143C8FE201D2DE242C66378439CBD304A30C67213F364F8FCBB202FFDCC290E85E8F0F718677FF8CB81D4AB3CF0DA5640C5F61B11A240099201D0BFAABECBBBB27A4623D77860BF52DC53A3AFB65ED2FCD4E9C9B1D1A996A643140CCE0D8B801728ED51BC3A47C9003375D8B19401E1C6841379A45BD2BE02A41222C4FE63E19C978D480E2D4E353AB957A1B81B74BBC7655A3D0261C8B2B06F6642BA4A5F8DD87B98B9AE355F57F8A5F978C6372BF594DF54DD8BF7650803EE13D9094B3EE86A1C3E2C21E4FD1F143D8A95CCE869DD365C29FA004070B0BDB899138FBF1D83EB9F76CBC112016C8CE1118FBDF76C3C907D1D3CAE2BA0BA5E419814DADEF0887CDC5817CA9C7B050574CF84009A6731136B39807687D3C3D6863C5D780BD6303F10A7D311D1C2A1C87039C17C6668501D572FC9D56B249ED0E95E17851AEBB45E288A32A1206C4FA475455309CD3D759CA19C47C0128A95DBD07E67937C0324B4B53BAB7402363FB32606387E2C419C0350943C8CB4760C2AA7D2FF9B1392E528B98493A61D2DC6D85CBF9E5759106D6BD1DAD276FB3AA45AAF75EB80BDB5D83AFFD7880371562100226B4E373B421B9EB3032938205012C6C083DD9E44BDFA842E280F03373F6E7E4DB5A50B4AA0B34789AF9AD051709B1E9ABDD71AD733DCC021DFA3A63609994F0FAFC5C1D88A39D46F81FA70E6164575321C2EBBB71F32893348AF887BAD2B1720CD5A86EA3774C1EBD53B15B9F01A4B5542A5F54053107E38ACE2594170B81DCD98D1CC47FEE808BE78DEBA05491F913ADE44B8914D65865EB0EB0F7E02DCBA1DE0D4B34E70485F83F96A5E41BBC064E3458473F43A70D51593F442EE2BD5B39E2C77C53BE83B9188101E3455C513BF4B8F744286BD529DA2804F804CE48E864A15F391A6793E4609279EAD144CDA084F3087678CA971EB22ED3B4B7FB740BE0407571F58DDE930D895140AD8EA096F06A3E255CD95AD48C4A46B99FF777B16452123A28D73B4A0CC0899C0CDAA1286FBE1C5FE95FA9418B5A473CC6ADBA14AFB06F080A544E49E148E492A8CE4BA9F4B5F781436F8FE30058A46F4D49A44E1FDE1B6F07E2A247CD3973AD76D3F473CAE88A2BAB3BEB78BD1875B240B23A901A9AD3F4421E5E355EAB0D3E1E197B246EB4F0861AEFB55BFD3BB54BF2CD6FFDCDFA0B78BAA674130CA2512B7069E7C33903A0A5EEEE7AF46FAFA52DD3F2E952CF909806B9CD2AA6826E823959A4BF03847BA50A4026FA0A72B78CBF6AA7FCD4908BA3BBCBDDE68708EC0AEC44B1E35C4E9E1EB7F01AFF0D9CE48F99BA01D78CEE
-ss = 4793F705AED572ACE61DB13BEDE3900F2538EADDB904988C1F015BAC605A1093

boringssl-0.20260708.tar.xz/rust/bssl-tls-tokio/tests/datagram.rs Deleted

@@ -1,167 +0,0 @@
-// Copyright 2026 The BoringSSL Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#!cfg(unix)
-
-use bssl_tls::{
-    connection::{
-        Client,
-        Server,
-        TlsConnection, //
-    },
-    context::{
-        DtlsMode,
-        TlsContextBuilder, //
-    },
-    credentials::{
-        Certificate,
-        TlsCredentialBuilder, //
-    },
-    errors::Error, //
-};
-use bssl_tls_tokio::{
-    TokioDatagramIo,
-    new_std_datagram_with_tokio, //
-};
-use bssl_x509::{
-    certificates::X509Certificate,
-    keys::PrivateKey,
-    params::Trust,
-    store::X509StoreBuilder, //
-};
-
-const CA: &u8 = include_bytes!("../../test-data/BoringSSLCATest.crt");
-const RSA_SERVER_CERT: &u8 = include_bytes!("../../test-data/BoringSSLServerTest-RSA.crt");
-const RSA_SERVER_KEY: &u8 = include_bytes!("../../test-data/BoringSSLServerTest-RSA.key");
-
-fn dumb_dtls_server_client() -> Result<
-    (
-        TlsConnection<Server, DtlsMode>,
-        TlsConnection<Client, DtlsMode>,
-    ),
-    Error,
-> {
-    let ca = Certificate::parse_one_from_pem(CA, None)?;
-    let server_cert = Certificate::parse_one_from_pem(RSA_SERVER_CERT, None)?;
-    let server_key = PrivateKey::from_pem(RSA_SERVER_KEY, || unreachable!())?;
-
-    let mut server_ctx_builder = TlsContextBuilder::new_dtls();
-    let server_cred = {
-        let mut builder = TlsCredentialBuilder::new();
-        builder
-            .with_certificate_chain(&server_cert, ca)?
-            .with_private_key(server_key)?;
-        builder.build()
-    };
-    server_ctx_builder.with_credential(server_cred.unwrap())?;
-    let server_ctx = server_ctx_builder.build();
-    let server_conn = server_ctx.new_server_connection(None)?.build();
-
-    let mut client_ctx_builder = TlsContextBuilder::new_dtls();
-    let ca = X509Certificate::parse_one_from_pem(CA)?;
-    let mut cert_store = X509StoreBuilder::new();
-    cert_store.set_trust(Trust::SslServer)?.add_cert(ca)?;
-    let cert_store = cert_store.build();
-    client_ctx_builder.with_certificate_store(&cert_store);
-    let client_ctx = client_ctx_builder.build();
-    let client_conn = client_ctx.new_client_connection(None)?.build();
-
-    Ok((server_conn, client_conn))
-}
-
-async fn async_ping_pong(
-    mut server_conn: TlsConnection<Server, DtlsMode>,
-    mut client_conn: TlsConnection<Client, DtlsMode>,
-) -> Result<(), Error> {
-    use bssl_tls::io::IoStatus;
-    use std::time::Duration;
-
-    let task = tokio::spawn(async move {
-        server_conn.async_handshake().await?;
-
-        let mut message = 0; 21;
-        let mut read_bytes = 0;
-        while read_bytes < 21 {
-            match server_conn
-                .as_pin_mut()
-                .async_read(&mut messageread_bytes..)
-                .await?
-            {
-                IoStatus::Ok(n) => read_bytes += n,
-                IoStatus::EndOfStream => break,
-                _ => {}
-            }
-        }
-        assert_eq!(&message, b"BoringSSL is awesome!");
-        tokio::time::sleep(Duration::from_secs(2)).await;
-        server_conn
-            .as_pin_mut()
-            .async_write(b"Oh yeah definitely!")
-            .await?;
-        server_conn.as_pin_mut().async_shutdown().await?;
-        Ok::<_, Error>(())
-    });
-
-    client_conn.async_handshake().await?;
-    client_conn
-        .as_pin_mut()
-        .async_write(b"BoringSSL is awesome!")
-        .await?;
-    let mut message = 0; 19;
-    let mut read_bytes = 0;
-    while read_bytes < 19 {
-        match client_conn
-            .as_pin_mut()
-            .async_read(&mut messageread_bytes..)
-            .await?
-        {
-            IoStatus::Ok(n) => read_bytes += n,
-            IoStatus::EndOfStream => break,
-            _ => {}
-        }
-    }
-    assert_eq!(&message, b"Oh yeah definitely!");
-    assert!(matches!(
-        client_conn.as_pin_mut().async_shutdown().await,
-        Ok(_) | Err(Error::Io(bssl_tls::errors::IoError::EndOfStream))
-    ));
-    task.await.unwrap()?;
-    Ok(())
-}
-
-#tokio::test
-#ignore = "https://crbug.com/532601068"
-async fn async_dtls() -> Result<(), Error> {
-    let (mut server_conn, mut client_conn) = dumb_dtls_server_client().unwrap();
-    let (server_sock, client_sock) = tokio::net::UnixDatagram::pair().unwrap();
-    server_conn.set_io(TokioDatagramIo(server_sock)).unwrap();
-    client_conn.set_io(TokioDatagramIo(client_sock)).unwrap();
-
-    async_ping_pong(server_conn, client_conn).await
-}
-
-#tokio::test
-#ignore = "https://crbug.com/532601068"
-async fn async_dtls_over_fd() -> Result<(), Error> {
-    let (mut server_conn, mut client_conn) = dumb_dtls_server_client().unwrap();
-    let (server_sock, client_sock) = std::os::unix::net::UnixDatagram::pair().unwrap();
-    server_sock.set_nonblocking(true).unwrap();
-    client_sock.set_nonblocking(true).unwrap();
-    let server_sock = new_std_datagram_with_tokio(server_sock).unwrap();
-    let client_sock = new_std_datagram_with_tokio(client_sock).unwrap();
-    server_conn.set_io(server_sock).unwrap();
-    client_conn.set_io(client_sock).unwrap();
-
-    async_ping_pong(server_conn, client_conn).await
-}

boringssl-0.20260708.tar.xz/rust/bssl-tls-tokio/tests/transport.rs Deleted

@@ -1,128 +0,0 @@
-// Copyright 2026 The BoringSSL Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#!cfg(unix)
-
-use bssl_tls::{
-    connection::{
-        Client,
-        Server,
-        TlsConnection, //
-    },
-    context::TlsContextBuilder,
-    credentials::{
-        Certificate,
-        TlsCredentialBuilder, //
-    },
-    errors::Error, //
-};
-use bssl_tls_tokio::{
-    TokioIo,
-    TokioTlsConnection, //
-};
-use bssl_x509::{
-    certificates::X509Certificate,
-    keys::PrivateKey,
-    params::Trust,
-    store::X509StoreBuilder, //
-};
-use tokio::io::{
-    AsyncReadExt,
-    AsyncWriteExt, //
-};
-
-use futures::future::FutureExt;
-
-const CA: &u8 = include_bytes!("../../test-data/BoringSSLCATest.crt");
-const RSA_SERVER_CERT: &u8 = include_bytes!("../../test-data/BoringSSLServerTest-RSA.crt");
-const RSA_SERVER_KEY: &u8 = include_bytes!("../../test-data/BoringSSLServerTest-RSA.key");
-
-fn dumb_server_client() -> Result<(TlsConnection<Server>, TlsConnection<Client>), Error> {
-    let ca = Certificate::parse_one_from_pem(CA, None)?;
-    let server_cert = Certificate::parse_one_from_pem(RSA_SERVER_CERT, None)?;
-    let server_key = PrivateKey::from_pem(RSA_SERVER_KEY, || unreachable!())?;
-
-    let mut server_ctx_builder = TlsContextBuilder::new_tls();
-    let server_cred = {
-        let mut builder = TlsCredentialBuilder::new();
-        builder
-            .with_certificate_chain(&server_cert, ca)?
-            .with_private_key(server_key)?;
-        builder.build()
-    };
-    server_ctx_builder.with_credential(server_cred.unwrap())?;
-    let server_ctx = server_ctx_builder.build();
-    let server_conn = server_ctx.new_server_connection(None)?.build();
-
-    let mut client_ctx_builder = TlsContextBuilder::new_tls();
-    let mut cert_store = X509StoreBuilder::new();
-    cert_store
-        .set_trust(Trust::SslServer)?
-        .add_cert(X509Certificate::parse_one_from_pem(&CA)?)?;
-    let cert_store = cert_store.build();
-    client_ctx_builder.with_certificate_store(&cert_store);
-    let client_ctx = client_ctx_builder.build();
-    let client_conn = client_ctx.new_client_connection(None)?.build();
-
-    Ok((server_conn, client_conn))
-}
-
-#tokio::test
-async fn tokio_io() -> Result<(), Error> {
-    let (server_conn, client_conn) = dumb_server_client()?;
-
-    let (server_tx, server_rx) = tokio::net::unix::pipe::pipe().unwrap();
-    let (client_tx, client_rx) = tokio::net::unix::pipe::pipe().unwrap();
-    let (send_signal, recv_signal) = tokio::sync::oneshot::channel();
-    let server_rx = TokioIo(server_rx);
-    let server_tx = TokioIo(server_tx);
-    let client_rx = TokioIo(client_rx);
-    let client_tx = TokioIo(client_tx);
-
-    let mut server_conn = TokioTlsConnection::new(server_conn);
-    let mut client_conn = TokioTlsConnection::new(client_conn);
-
-    server_conn.set_split_io(client_rx, server_tx)?;
-    client_conn.set_split_io(server_rx, client_tx)?;
-
-    let thread = tokio::spawn(async move {
-        let mut message = 0; 21;
-        server_conn.read_exact(&mut message).await.unwrap();
-        assert_eq!(message, *b"BoringSSL is awesome!");
-        server_conn.write_all(b"Oh yeah definitely!").await.unwrap();
-
-        // The original test used sync_shutdown on established()
-        // We use wrapper's shutdown instead.
-
-        let res = server_conn.shutdown().now_or_never();
-        assert!(res.is_none(), "{res:?}");
-
-        // Make the client progress
-        send_signal.send(()).unwrap();
-
-        server_conn.shutdown().await.unwrap();
-    });
-    client_conn
-        .write_all(b"BoringSSL is awesome!")
-        .await
-        .unwrap();
-    recv_signal.await.unwrap();
-    let mut message = 0; 19;
-    client_conn.read_exact(&mut message).await.unwrap();
-    assert_eq!(message, *b"Oh yeah definitely!");
-    client_conn.shutdown().await.unwrap();
-    thread.await.unwrap();
-
-    Ok(())
-}

boringssl-0.20260708.tar.xz/ssl/test/runner/kyber Deleted

boringssl-0.20260708.tar.xz/ssl/test/runner/kyber/kyber.go Deleted

@@ -1,622 +0,0 @@
-// Copyright 2023 The BoringSSL Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package kyber
-
-// This code is ported from kyber.c.
-
-import (
-	"crypto/sha3"
-	"crypto/subtle"
-	"io"
-)
-
-const (
-	CiphertextSize = 1088
-	PublicKeySize  = 1184
-	PrivateKeySize = 2400
-)
-
-const (
-	degree               = 256
-	rank                 = 3
-	prime                = 3329
-	log2Prime            = 12
-	halfPrime            = (prime - 1) / 2
-	du                   = 10
-	dv                   = 4
-	inverseDegree        = 3303
-	encodedVectorSize    = log2Prime * degree / 8 * rank
-	compressedVectorSize = du * rank * degree / 8
-	barrettMultiplier    = 5039
-	barrettShift         = 24
-)
-
-func reduceOnce(x uint16) uint16 {
-	if x >= 2*prime {
-		panic("reduce_once: value out of range")
-	}
-	subtracted := x - prime
-	mask := 0 - (subtracted >> 15)
-	return (mask & x) | (^mask & subtracted)
-}
-
-func reduce(x uint32) uint16 {
-	if x >= prime+2*prime*prime {
-		panic("reduce: value out of range")
-	}
-	product := uint64(x) * barrettMultiplier
-	quotient := uint32(product >> barrettShift)
-	remainder := uint32(x) - quotient*prime
-	return reduceOnce(uint16(remainder))
-}
-
-// lt returns 0xff..f if a < b and 0 otherwise
-func lt(a, b uint32) uint32 {
-	return uint32(0 - int32(a^((a^b)|((a-b)^a)))>>31)
-}
-
-// Compresses (lossily) an input |x| mod 3329 into |bits| many bits by grouping
-// numbers close to each other together. The formula used is
-// round(2^|bits|/prime*x) mod 2^|bits|.
-// Uses Barrett reduction to achieve constant time. Since we need both the
-// remainder (for rounding) and the quotient (as the result), we cannot use
-// |reduce| here, but need to do the Barrett reduction directly.
-func compress(x uint16, bits int) uint16 {
-	product := uint32(x) << bits
-	quotient := uint32((uint64(product) * barrettMultiplier) >> barrettShift)
-	remainder := product - quotient*prime
-
-	// Adjust the quotient to round correctly:
-	//   0 <= remainder <= halfPrime round to 0
-	//   halfPrime < remainder <= prime + halfPrime round to 1
-	//   prime + halfPrime < remainder < 2 * prime round to 2
-	quotient += 1 & lt(halfPrime, remainder)
-	quotient += 1 & lt(prime+halfPrime, remainder)
-	return uint16(quotient) & ((1 << bits) - 1)
-}
-
-func decompress(x uint16, bits int) uint16 {
-	product := uint32(x) * prime
-	power := uint32(1) << bits
-	// This is |product| % power, since |power| is a power of 2.
-	remainder := product & (power - 1)
-	// This is |product| / power, since |power| is a power of 2.
-	lower := product >> bits
-	// The rounding logic works since the first half of numbers mod |power| have a
-	// 0 as first bit, and the second half has a 1 as first bit, since |power| is
-	// a power of 2. As a 12 bit number, |remainder| is always positive, so we
-	// will shift in 0s for a right shift.
-	return uint16(lower + (remainder >> (bits - 1)))
-}
-
-type scalar degreeuint16
-
-func (s *scalar) zero() {
-	clear(s:)
-}
-
-// This bit of Python will be referenced in some of the following comments:
-//
-// p = 3329
-//
-// def bitreverse(i):
-//     ret = 0
-//     for n in range(7):
-//         bit = i & 1
-//         ret <<= 1
-//         ret |= bit
-//         i >>= 1
-//     return ret
-
-// kNTTRoots = pow(17, bitreverse(i), p) for i in range(128)
-var nttRoots = 128uint16{
-	1, 1729, 2580, 3289, 2642, 630, 1897, 848, 1062, 1919, 193, 797,
-	2786, 3260, 569, 1746, 296, 2447, 1339, 1476, 3046, 56, 2240, 1333,
-	1426, 2094, 535, 2882, 2393, 2879, 1974, 821, 289, 331, 3253, 1756,
-	1197, 2304, 2277, 2055, 650, 1977, 2513, 632, 2865, 33, 1320, 1915,
-	2319, 1435, 807, 452, 1438, 2868, 1534, 2402, 2647, 2617, 1481, 648,
-	2474, 3110, 1227, 910, 17, 2761, 583, 2649, 1637, 723, 2288, 1100,
-	1409, 2662, 3281, 233, 756, 2156, 3015, 3050, 1703, 1651, 2789, 1789,
-	1847, 952, 1461, 2687, 939, 2308, 2437, 2388, 733, 2337, 268, 641,
-	1584, 2298, 2037, 3220, 375, 2549, 2090, 1645, 1063, 319, 2773, 757,
-	2099, 561, 2466, 2594, 2804, 1092, 403, 1026, 1143, 2150, 2775, 886,
-	1722, 1212, 1874, 1029, 2110, 2935, 885, 2154,
-}
-
-func (s *scalar) ntt() {
-	offset := degree
-	for step := 1; step < degree/2; step <<= 1 {
-		offset >>= 1
-		k := 0
-		for i := 0; i < step; i++ {
-			stepRoot := uint32(nttRootsi+step)
-			for j := k; j < k+offset; j++ {
-				odd := reduce(stepRoot * uint32(sj+offset))
-				even := sj
-				sj = reduceOnce(odd + even)
-				sj+offset = reduceOnce(even - odd + prime)
-			}
-			k += 2 * offset
-		}
-	}
-}
-
-// kInverseNTTRoots = pow(17, -bitreverse(i), p) for i in range(128)
-var inverseNTTRoots = 128uint16{
-	1, 1600, 40, 749, 2481, 1432, 2699, 687, 1583, 2760, 69, 543,
-	2532, 3136, 1410, 2267, 2508, 1355, 450, 936, 447, 2794, 1235, 1903,
-	1996, 1089, 3273, 283, 1853, 1990, 882, 3033, 2419, 2102, 219, 855,
-	2681, 1848, 712, 682, 927, 1795, 461, 1891, 2877, 2522, 1894, 1010,
-	1414, 2009, 3296, 464, 2697, 816, 1352, 2679, 1274, 1052, 1025, 2132,
-	1573, 76, 2998, 3040, 1175, 2444, 394, 1219, 2300, 1455, 2117, 1607,
-	2443, 554, 1179, 2186, 2303, 2926, 2237, 525, 735, 863, 2768, 1230,
-	2572, 556, 3010, 2266, 1684, 1239, 780, 2954, 109, 1292, 1031, 1745,
-	2688, 3061, 992, 2596, 941, 892, 1021, 2390, 642, 1868, 2377, 1482,
-	1540, 540, 1678, 1626, 279, 314, 1173, 2573, 3096, 48, 667, 1920,
-	2229, 1041, 2606, 1692, 680, 2746, 568, 3312,
-}
-
-func (s *scalar) inverseNTT() {
-	step := degree / 2
-	for offset := 2; offset < degree; offset <<= 1 {
-		step >>= 1
-		k := 0
-		for i := 0; i < step; i++ {
-			stepRoot := uint32(inverseNTTRootsi+step)
-			for j := k; j < k+offset; j++ {
-				odd := sj+offset
-				even := sj
-				sj = reduceOnce(odd + even)
-				sj+offset = reduce(stepRoot * uint32(even-odd+prime))
-			}
-			k += 2 * offset
-		}
-	}
-	for i := range s {
-		si = reduce(uint32(si) * inverseDegree)
-	}
-}
-
-func (s *scalar) add(b *scalar) {
-	for i := range s {
-		si = reduceOnce(si + bi)
-	}
-}
-
-func (s *scalar) sub(b *scalar) {
-	for i := range s {
-		si = reduceOnce(si - bi + prime)
-	}
-}
-
-// kModRoots = pow(17, 2*bitreverse(i) + 1, p) for i in range(128)
-var modRoots = 128uint16{
-	17, 3312, 2761, 568, 583, 2746, 2649, 680, 1637, 1692, 723, 2606,
-	2288, 1041, 1100, 2229, 1409, 1920, 2662, 667, 3281, 48, 233, 3096,
-	756, 2573, 2156, 1173, 3015, 314, 3050, 279, 1703, 1626, 1651, 1678,
-	2789, 540, 1789, 1540, 1847, 1482, 952, 2377, 1461, 1868, 2687, 642,
-	939, 2390, 2308, 1021, 2437, 892, 2388, 941, 733, 2596, 2337, 992,
-	268, 3061, 641, 2688, 1584, 1745, 2298, 1031, 2037, 1292, 3220, 109,
-	375, 2954, 2549, 780, 2090, 1239, 1645, 1684, 1063, 2266, 319, 3010,
-	2773, 556, 757, 2572, 2099, 1230, 561, 2768, 2466, 863, 2594, 735,
-	2804, 525, 1092, 2237, 403, 2926, 1026, 2303, 1143, 2186, 2150, 1179,
-	2775, 554, 886, 2443, 1722, 1607, 1212, 2117, 1874, 1455, 1029, 2300,
-	2110, 1219, 2935, 394, 885, 2444, 2154, 1175,
-}
-
-func (s *scalar) mult(a, b *scalar) {
-	for i := 0; i < degree/2; i++ {
-		realReal := uint32(a2*i) * uint32(b2*i)
-		imgImg := uint32(a2*i+1) * uint32(b2*i+1)
-		realImg := uint32(a2*i) * uint32(b2*i+1)
-		imgReal := uint32(a2*i+1) * uint32(b2*i)
-		s2*i = reduce(realReal + uint32(reduce(imgImg))*uint32(modRootsi))
-		s2*i+1 = reduce(imgReal + realImg)
-	}
-}
-
-func (s *scalar) innerProduct(left, right *vector) {
-	s.zero()
-	var product scalar
-	for i := range left {
-		product.mult(&lefti, &righti)
-		s.add(&product)
-	}
-}
-
-func (s *scalar) fromKeccakVartime(keccak io.Reader) {
-	var buf 3byte
-	for i := 0; i < len(s); {
-		keccak.Read(buf:)
-		d1 := uint16(buf0) + 256*uint16(buf1%16)
-		d2 := uint16(buf1)/16 + 16*uint16(buf2)
-		if d1 < prime {
-			si = d1
-			i++
-		}
-		if d2 < prime && i < len(s) {
-			si = d2
-			i++
-		}
-	}
-}
-
-func (s *scalar) centeredBinomialEta2(input *33byte) {
-	entropy := sha3.SumSHAKE256(input:, 128)
-
-	for i := 0; i < len(s); i += 2 {
-		b := uint16(entropyi/2)
-
-		value := uint16(prime)
-		value += (b & 1) + ((b >> 1) & 1)
-		value -= ((b >> 2) & 1) + ((b >> 3) & 1)
-		si = reduceOnce(value)
-
-		b >>= 4
-		value = prime
-		value += (b & 1) + ((b >> 1) & 1)
-		value -= ((b >> 2) & 1) + ((b >> 3) & 1)
-		si+1 = reduceOnce(value)
-	}
-}
-
-var masks = 8uint16{0x01, 0x03, 0x07, 0x0f, 0x1f, 0x3f, 0x7f, 0xff}
-
-func (s *scalar) encode(out byte, bits int) byte {
-	var outByte byte
-	outByteBits := 0
-
-	for i := range s {
-		element := si
-		elementBitsDone := 0
-
-		for elementBitsDone < bits {
-			chunkBits := bits - elementBitsDone
-			outBitsRemaining := 8 - outByteBits
-			if chunkBits >= outBitsRemaining {
-				chunkBits = outBitsRemaining
-				outByte |= byte(element&maskschunkBits-1) << outByteBits
-				out0 = outByte
-				out = out1:
-				outByteBits = 0
-				outByte = 0
-			} else {
-				outByte |= byte(element&maskschunkBits-1) << outByteBits
-				outByteBits += chunkBits
-			}
-
-			elementBitsDone += chunkBits
-			element >>= chunkBits
-		}
-	}
-
-	if outByteBits > 0 {
-		out0 = outByte
-		out = out1:
-	}
-
-	return out
-}
-
-func (s *scalar) decode(in byte, bits int) (byte, bool) {
-	var inByte byte
-	inByteBitsLeft := 0
-
-	for i := range s {
-		var element uint16
-		elementBitsDone := 0
-
-		for elementBitsDone < bits {
-			if inByteBitsLeft == 0 {
-				inByte = in0
-				in = in1:
-				inByteBitsLeft = 8
-			}
-
-			chunkBits := bits - elementBitsDone
-			if chunkBits > inByteBitsLeft {
-				chunkBits = inByteBitsLeft
-			}
-
-			element |= (uint16(inByte) & maskschunkBits-1) << elementBitsDone
-			inByteBitsLeft -= chunkBits
-			inByte >>= chunkBits
-
-			elementBitsDone += chunkBits
-		}
-
-		if element >= prime {
-			return nil, false
-		}
-		si = element
-	}
-
-	return in, true
-}
-
-func (s *scalar) compress(bits int) {
-	for i := range s {
-		si = compress(si, bits)
-	}
-}
-
-func (s *scalar) decompress(bits int) {
-	for i := range s {
-		si = decompress(si, bits)
-	}
-}
-
-type vector rankscalar
-
-func (v *vector) zero() {
-	for i := range v {
-		vi.zero()
-	}
-}
-
-func (v *vector) ntt() {
-	for i := range v {
-		vi.ntt()
-	}
-}
-
-func (v *vector) inverseNTT() {
-	for i := range v {
-		vi.inverseNTT()
-	}
-}
-
-func (v *vector) add(b *vector) {
-	for i := range v {
-		vi.add(&bi)
-	}
-}
-
-func (out *vector) mult(m *matrix, v *vector) {
-	out.zero()
-	var product scalar
-	for i := 0; i < rank; i++ {
-		for j := 0; j < rank; j++ {
-			product.mult(&mij, &vj)
-			outi.add(&product)
-		}
-	}
-}
-
-func (out *vector) multTranspose(m *matrix, v *vector) {
-	out.zero()
-	var product scalar
-	for i := 0; i < rank; i++ {
-		for j := 0; j < rank; j++ {
-			product.mult(&mji, &vj)
-			outi.add(&product)
-		}
-	}
-}
-
-func (v *vector) generateSecretEta2(counter *byte, seed *32byte) {
-	var input 33byte
-	copy(input:, seed:)
-	for i := range v {
-		input32 = *counter
-		*counter++
-		vi.centeredBinomialEta2(&input)
-	}
-}
-
-func (v *vector) encode(out byte, bits int) byte {
-	for i := range v {
-		out = vi.encode(out, bits)
-	}
-	return out
-}
-
-func (v *vector) decode(out byte, bits int) (byte, bool) {
-	var ok bool
-	for i := range v {
-		out, ok = vi.decode(out, bits)
-		if !ok {
-			return nil, false
-		}
-	}
-
-	return out, true
-}
-
-func (v *vector) compress(bits int) {
-	for i := range v {
-		vi.compress(bits)
-	}
-}
-
-func (v *vector) decompress(bits int) {
-	for i := range v {
-		vi.decompress(bits)
-	}
-}
-
-type matrix rankrankscalar
-
-func (m *matrix) expand(rho *32byte) {
-	shake := sha3.NewSHAKE128()
-
-	var input 34byte
-	copy(input:, rho:)
-
-	for i := 0; i < rank; i++ {
-		for j := 0; j < rank; j++ {
-			input32 = byte(i)
-			input33 = byte(j)
-
-			shake.Reset()
-			shake.Write(input:)
-			mij.fromKeccakVartime(shake)
-		}
-	}
-}
-
-type PublicKey struct {
-	t             vector
-	rho           32byte
-	publicKeyHash 32byte
-	m             matrix
-}
-
-func UnmarshalPublicKey(data *PublicKeySizebyte) (*PublicKey, bool) {
-	var ret PublicKey
-	ret.publicKeyHash = sha3.Sum256(data:)
-	in, ok := ret.t.decode(data:, log2Prime)
-	if !ok {
-		return nil, false
-	}
-	copy(ret.rho:, in)
-	ret.m.expand(&ret.rho)
-	return &ret, true
-}
-
-func (pub *PublicKey) Marshal() *PublicKeySizebyte {
-	var ret PublicKeySizebyte
-	out := pub.t.encode(ret:, log2Prime)
-	copy(out, pub.rho:)
-	return &ret
-}
-
-func (pub *PublicKey) encryptCPA(message, entropy *32byte) *CiphertextSizebyte {
-	var counter uint8
-	var secret, error vector
-	secret.generateSecretEta2(&counter, entropy)
-	error.generateSecretEta2(&counter, entropy)
-	secret.ntt()
-
-	var input 33byte
-	copy(input:, entropy:)
-	input32 = counter
-	var scalarError scalar
-	scalarError.centeredBinomialEta2(&input)
-
-	var u vector
-	u.mult(&pub.m, &secret)
-	u.inverseNTT()
-	u.add(&error)
-
-	var v scalar
-	v.innerProduct(&pub.t, &secret)
-	v.inverseNTT()
-	v.add(&scalarError)
-
-	out := make(byte, CiphertextSize)
-	var expandedMessage scalar
-	expandedMessage.decode(message:, 1)
-	expandedMessage.decompress(1)
-	v.add(&expandedMessage)
-	u.compress(du)
-	it := u.encode(out, du)
-	v.compress(dv)
-	v.encode(it, dv)
-	return (*CiphertextSizebyte)(out)
-}
-
-func (pub *PublicKey) Encap(outSharedSecret byte, entropy *32byte) *CiphertextSizebyte {
-	var input 64byte
-	copy(input:, entropy:)
-	copy(input32:, pub.publicKeyHash:)
-	prekeyAndRandomness := sha3.Sum512(input:)
-	ciphertext := pub.encryptCPA(entropy, (*32byte)(prekeyAndRandomness32:))
-	ciphertextHash := sha3.Sum256(ciphertext:)
-	copy(prekeyAndRandomness32:, ciphertextHash:)
-	copy(outSharedSecret, sha3.SumSHAKE256(prekeyAndRandomness:, len(outSharedSecret)))
-	return ciphertext
-}
-
-type PrivateKey struct {
-	PublicKey
-	s               vector
-	foFailureSecret 32byte
-}
-
-func NewPrivateKey(entropy *64byte) (*PrivateKey, *PublicKeySizebyte) {
-	hashed := sha3.Sum512(entropy:32)
-	rho := (*32byte)(hashed:32)
-	sigma := (*32byte)(hashed32:)
-	ret := new(PrivateKey)
-	copy(ret.foFailureSecret:, entropy32:)
-	copy(ret.rho:, rho:)
-	ret.m.expand(rho)
-	counter := uint8(0)
-	ret.s.generateSecretEta2(&counter, sigma)
-	ret.s.ntt()
-	var error vector
-	error.generateSecretEta2(&counter, sigma)
-	error.ntt()
-	ret.t.multTranspose(&ret.m, &ret.s)
-	ret.t.add(&error)
-
-	marshalledPublicKey := ret.PublicKey.Marshal()
-	ret.publicKeyHash = sha3.Sum256(marshalledPublicKey:)
-
-	return ret, marshalledPublicKey
-}
-
-func (priv *PrivateKey) decryptCPA(ciphertext *CiphertextSizebyte) 32byte {
-	var u vector
-	u.decode(ciphertext:, du)
-	u.decompress(du)
-	u.ntt()
-
-	var v scalar
-	v.decode(ciphertextcompressedVectorSize:, dv)
-	v.decompress(dv)
-
-	var mask scalar
-	mask.innerProduct(&priv.s, &u)
-	mask.inverseNTT()
-	v.sub(&mask)
-	v.compress(1)
-	var out 32byte
-	v.encode(out:, 1)
-	return out
-}
-
-func (priv *PrivateKey) Decap(outSharedSecret byte, ciphertext *CiphertextSizebyte) {
-	decrypted := priv.decryptCPA(ciphertext)
-	h := sha3.New512()
-	h.Write(decrypted:)
-	h.Write(priv.publicKeyHash:)
-	prekeyAndRandomness := h.Sum(nil)
-	expectedCiphertext := priv.encryptCPA(&decrypted, (*32byte)(prekeyAndRandomness32:))
-	equal := subtle.ConstantTimeCompare(ciphertext:, expectedCiphertext:)
-	var secret 32byte
-	for i := range secret {
-		secreti = byte(subtle.ConstantTimeSelect(equal, int(prekeyAndRandomnessi), int(priv.foFailureSecreti)))
-	}
-	ciphertextHash := sha3.Sum256(ciphertext:)
-
-	shake := sha3.NewSHAKE256()
-	shake.Write(secret:)
-	shake.Write(ciphertextHash:)
-	shake.Read(outSharedSecret)
-}
-
-func (priv *PrivateKey) Marshal() *PrivateKeySizebyte {
-	var ret PrivateKeySizebyte
-	out := priv.s.encode(ret:, log2Prime)
-	publicKey := priv.PublicKey.Marshal()
-	n := copy(out, publicKey:)
-	out = outn:
-	n = copy(out, priv.publicKeyHash:)
-	out = outn:
-	copy(out, priv.foFailureSecret:)
-	return &ret
-}

boringssl-0.20260708.tar.xz/ssl/test/runner/kyber/kyber_test.go Deleted

@@ -1,131 +0,0 @@
-// Copyright 2023 The BoringSSL Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package kyber
-
-import (
-	"bufio"
-	"bytes"
-	"crypto/sha3"
-	"encoding/hex"
-	"flag"
-	"os"
-	"strings"
-	"testing"
-)
-
-var testVectorsPath = flag.String("test-vectors", "../../../../crypto/kyber/kyber_tests.txt", "The path to the test vectors to use")
-
-func TestVectors(t *testing.T) {
-	in, err := os.Open(*testVectorsPath)
-	if err != nil {
-		t.Error(err)
-		return
-	}
-	defer in.Close()
-
-	scanner := bufio.NewScanner(in)
-	var priv *PrivateKey
-	var encodedPublicKey *PublicKeySizebyte
-	var ciphertext *CiphertextSizebyte
-	sharedSecret := make(byte, 32)
-
-	lineNo := 0
-	for scanner.Scan() {
-		lineNo++
-		line := scanner.Text()
-
-		parts := strings.Split(line, "=")
-		if len(parts) != 2 || strings.HasPrefix(line, "count ") {
-			continue
-		}
-		key := strings.TrimSpace(parts0)
-		value, err := hex.DecodeString(strings.TrimSpace(parts1))
-		if err != nil {
-			t.Errorf("bad hex value on line %d: %q", lineNo, parts1)
-			return
-		}
-
-		switch key {
-		case "generateEntropy":
-			priv, encodedPublicKey = NewPrivateKey((*64byte)(value))
-		case "encapEntropyPreHash":
-			hashedEntropy := sha3.Sum256(value)
-			ciphertext = priv.Encap(sharedSecret, &hashedEntropy)
-			decapSharedSecret := make(byte, len(sharedSecret))
-			priv.Decap(decapSharedSecret, ciphertext)
-			if !bytes.Equal(sharedSecret, decapSharedSecret) {
-				t.Errorf("instance on line %d did not round trip", lineNo)
-				return
-			}
-		case "pk":
-			if !bytes.Equal(encodedPublicKey:, value) {
-				t.Errorf("bad 'pk' value on line %d:\nwant: %x\ncalc: %x", lineNo, value, encodedPublicKey)
-				return
-			}
-		case "sk":
-			encodedPrivateKey := priv.Marshal()
-			if !bytes.Equal(encodedPrivateKey:, value) {
-				t.Errorf("bad 'sk' value on line %d:\nwant: %x\ncalc: %x", lineNo, value, encodedPrivateKey)
-				return
-			}
-		case "ct":
-			if !bytes.Equal(ciphertext:, value) {
-				t.Errorf("bad 'ct' value on line %d:\nwant: %x\ncalc: %x", lineNo, value, ciphertext:)
-				return
-			}
-		case "ss":
-			if !bytes.Equal(sharedSecret:, value) {
-				t.Errorf("bad 'ss' value on line %d:\nwant: %x\ncalc: %x", lineNo, value, sharedSecret:)
-				return
-			}
-		}
-	}
-}
-
-func TestIteration(t *testing.T) {
-	h := sha3.NewSHAKE256()
-
-	for i := 0; i < 4096; i++ {
-		var generateEntropy 64byte
-		h.Read(generateEntropy:)
-		var encapEntropy 32byte
-		h.Read(encapEntropy:)
-
-		priv, encodedPublicKey := NewPrivateKey(&generateEntropy)
-		h.Reset()
-		h.Write(encodedPublicKey:)
-		encodedPrivateKey := priv.Marshal()
-		h.Write(encodedPrivateKey:)
-
-		var sharedSecret 32byte
-		ciphertext := priv.Encap(sharedSecret:, &encapEntropy)
-		h.Write(ciphertext:)
-		h.Write(sharedSecret:)
-
-		var decapSharedSecret 32byte
-		priv.Decap(decapSharedSecret:, ciphertext)
-		if !bytes.Equal(decapSharedSecret:, sharedSecret:) {
-			t.Errorf("Decap failed on iteration %d", i)
-			return
-		}
-	}
-
-	var result 16byte
-	h.Read(result:)
-	const expected = "18c6cd04eaebb33b20bb1e8e2762d30d"
-	if hex.EncodeToString(result:) != expected {
-		t.Errorf("iteration test produced %x, but should be %v", result, expected)
-	}
-}

boringssl-0.20260708.tar.xz/.bazelrc -> boringssl-0.20260813.tar.xz/.bazelrc Changed

boringssl-0.20260708.tar.xz/CMakeLists.txt -> boringssl-0.20260813.tar.xz/CMakeLists.txt Changed

@@ -579,7 +579,7 @@
             ${BCM_SOURCES_ASM_USED}
             ${CRYPTO_HEADERS}
     DEPENDS bcm_c_generated_asm
-            delocate
+            ${CMAKE_CURRENT_BINARY_DIR}/delocate
             ${BCM_SOURCES_ASM_USED}
             ${CRYPTO_HEADERS}
     WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
@@ -597,9 +597,9 @@
                 boringssl.googlesource.com/boringssl.git/util/fipstools/inject_hash)
   add_custom_command(
     OUTPUT bcm.o
-    COMMAND ./inject_hash -o bcm.o -in-object $<TARGET_OBJECTS:bcm_hashunset>
-            -in-hash $<TARGET_FILE:bcm_relocated>
-    DEPENDS bcm_hashunset bcm_relocated inject_hash
+    COMMAND ${CMAKE_CURRENT_BINARY_DIR}/inject_hash -o bcm.o -in-object
+            $<TARGET_OBJECTS:bcm_hashunset> -in-hash $<TARGET_FILE:bcm_relocated>
+    DEPENDS bcm_hashunset bcm_relocated ${CMAKE_CURRENT_BINARY_DIR}/inject_hash
     WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
   )
   set(CRYPTO_FIPS_OBJECTS bcm.o)
@@ -821,7 +821,8 @@
   if(PROJECT_IS_TOP_LEVEL AND NOT CMAKE_GENERATOR MATCHES "^Visual Studio ")
     if(GO_EXECUTABLE)
       add_custom_target(
-          run_tests
+          run_unit_tests
+          COMMAND ${CMAKE_COMMAND} -E echo
           COMMAND ${CMAKE_COMMAND} -E echo "Checking pregenerated files"
           COMMAND ${GO_EXECUTABLE} run ./util/pregenerate -check
           COMMAND ${CMAKE_COMMAND} -E echo
@@ -831,16 +832,25 @@
           COMMAND ${CMAKE_COMMAND} -E echo "Running unit tests"
           COMMAND ${GO_EXECUTABLE} run util/all_tests.go -build-dir
                   ${CMAKE_CURRENT_BINARY_DIR}
+          WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+          DEPENDS boringssl_all_tests fips_specific_tests_if_any
+          USES_TERMINAL)
+      add_custom_target(
+          run_tests
           COMMAND ${CMAKE_COMMAND} -E echo
           COMMAND ${CMAKE_COMMAND} -E echo "Running SSL tests"
           COMMAND cd ssl/test/runner &&
                   ${GO_EXECUTABLE} test -shim-path $<TARGET_FILE:bssl_shim>
                     ${HANDSHAKER_ARGS} ${RUNNER_ARGS}
           WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
-          DEPENDS boringssl_all_tests bssl_shim handshaker fips_specific_tests_if_any
+          DEPENDS run_unit_tests bssl_shim handshaker
           USES_TERMINAL)
     else()
       add_custom_target(
+          run_unit_tests
+          COMMAND ${CMAKE_COMMAND} -E echo "Running tests requires Go"
+          COMMAND ${CMAKE_COMMAND} -E false)
+      add_custom_target(
           run_tests
           COMMAND ${CMAKE_COMMAND} -E echo "Running tests requires Go"
           COMMAND ${CMAKE_COMMAND} -E false)

boringssl-0.20260708.tar.xz/MODULE.bazel -> boringssl-0.20260813.tar.xz/MODULE.bazel Changed

boringssl-0.20260708.tar.xz/bench/aead.cc -> boringssl-0.20260813.tar.xz/bench/aead.cc Changed

@@ -41,7 +41,7 @@
 void BM_SpeedAEAD(benchmark::State &state, size_t ad_len,
                   evp_aead_direction_t direction, const EVP_AEAD *aead) {
   const unsigned kAlignment = 16;
-  size_t input_len = static_cast<size_t>(state.range(0));
+  const size_t input_len = static_cast<size_t>(state.range(0));
   ScopedEVP_AEAD_CTX ctx;
   const size_t key_len = EVP_AEAD_key_length(aead);
   const size_t nonce_len = EVP_AEAD_nonce_length(aead);
@@ -58,13 +58,13 @@
   std::vector<uint8_t> ad(ad_len);
   std::vector<uint8_t> tag_storage(overhead_len + kAlignment);
 
-  uint8_t *const in =
+  uint8_t *in =
       static_cast<uint8_t *>(align_pointer(in_storage.data(), kAlignment));
-  uint8_t *const out =
+  uint8_t *out =
       static_cast<uint8_t *>(align_pointer(out_storage.data(), kAlignment));
-  uint8_t *const tag =
+  uint8_t *tag =
       static_cast<uint8_t *>(align_pointer(tag_storage.data(), kAlignment));
-  uint8_t *const in2 =
+  uint8_t *in2 =
       static_cast<uint8_t *>(align_pointer(in2_storage.data(), kAlignment));
 
   if (!EVP_AEAD_CTX_init_with_direction(ctx.get(), aead, key.data(), key_len,
@@ -77,12 +77,20 @@
   if (direction == evp_aead_seal) {
     size_t tag_len;
     for (auto _ : state) {
+      benchmark::DoNotOptimize(nonce.data());
+      benchmark::DoNotOptimize(in);
+      benchmark::DoNotOptimize(ad.data());
+      benchmark::DoNotOptimize(ad_len);
       if (!EVP_AEAD_CTX_seal_scatter(
               ctx.get(), out, tag, &tag_len, overhead_len, nonce.data(),
               nonce_len, in, input_len, nullptr, 0, ad.data(), ad_len)) {
         state.SkipWithError("EVP_AEAD_CTX_seal failed.");
         return;
       }
+      benchmark::DoNotOptimize(out);
+      benchmark::DoNotOptimize(tag);
+      benchmark::DoNotOptimize(tag_len);
+      benchmark::ClobberMemory();
     }
     state.SetBytesProcessed(state.iterations() * input_len);
   } else {
@@ -104,6 +112,11 @@
 
     size_t in2_len;
     for (auto _ : state) {
+      benchmark::DoNotOptimize(nonce.data());
+      benchmark::DoNotOptimize(out);
+      benchmark::DoNotOptimize(out_len);
+      benchmark::DoNotOptimize(ad.data());
+      benchmark::DoNotOptimize(ad_len);
       // N.B. EVP_AEAD_CTX_open_gather is not implemented for all AEADs.
       if (!EVP_AEAD_CTX_open(ctx.get(), in2, &in2_len, input_len + overhead_len,
                              nonce.data(), nonce_len, out, out_len, ad.data(),
@@ -111,6 +124,128 @@
         state.SkipWithError("EVP_AEAD_CTX_open failed.");
         return;
       }
+      benchmark::DoNotOptimize(in2);
+      benchmark::DoNotOptimize(in2_len);
+      benchmark::ClobberMemory();
+    }
+    state.SetBytesProcessed(state.iterations() * input_len);
+  }
+}
+
+void BM_SpeedAEADv(benchmark::State &state, size_t ad_len,
+                   evp_aead_direction_t direction, const EVP_AEAD *aead) {
+  const unsigned kAlignment = 16;
+  const size_t input_len = static_cast<size_t>(state.range(0));
+  const size_t iovec_first = static_cast<size_t>(state.range(1));
+  const size_t iovec_others = static_cast<size_t>(state.range(2));
+  ScopedEVP_AEAD_CTX ctx;
+  const size_t key_len = EVP_AEAD_key_length(aead);
+  const size_t nonce_len = EVP_AEAD_nonce_length(aead);
+  const size_t overhead_len = EVP_AEAD_max_overhead(aead);
+
+  std::vector<uint8_t> key(key_len);
+  std::vector<uint8_t> nonce(nonce_len);
+  std::vector<uint8_t> in_storage(input_len + kAlignment);
+  // N.B. for EVP_AEAD_CTX_sealv the input and output buffers may be the
+  // same size. However, in the direction == evp_aead_open case we copy the tag
+  // to the end of the output to use the non-gathering openv (and to minimize
+  // total chunk count), hence we add overhead_len to the size of this buffer.
+  std::vector<uint8_t> out_storage(input_len + overhead_len + kAlignment);
+  std::vector<uint8_t> in2_storage(input_len + overhead_len + kAlignment);
+  std::vector<uint8_t> ad(ad_len);
+  std::vector<uint8_t> tag_storage(overhead_len + kAlignment);
+
+  uint8_t *in =
+      static_cast<uint8_t *>(align_pointer(in_storage.data(), kAlignment));
+  uint8_t *out =
+      static_cast<uint8_t *>(align_pointer(out_storage.data(), kAlignment));
+  uint8_t *tag =
+      static_cast<uint8_t *>(align_pointer(tag_storage.data(), kAlignment));
+  uint8_t *in2 =
+      static_cast<uint8_t *>(align_pointer(in2_storage.data(), kAlignment));
+
+  if (!EVP_AEAD_CTX_init_with_direction(ctx.get(), aead, key.data(), key_len,
+                                        EVP_AEAD_DEFAULT_TAG_LENGTH,
+                                        evp_aead_seal)) {
+    state.SkipWithError("Failed to create EVP_AEAD_CTX.");
+    return;
+  }
+
+  // If "first" is unaligned, unalign all pointers by one. As kAlignment and
+  // not just kAlignment-1 was added in the allocation, this always fits.
+  if (iovec_first % kAlignment) {
+    ++in;
+    ++out;
+    ++tag;
+    ++in2;
+  }
+
+  std::vector<CRYPTO_IOVEC> inout_vec;
+  std::vector<CRYPTO_IOVEC> outin2_vec;
+  for (size_t pos = 0; pos < input_len;) {
+    size_t can = (pos == 0) ? iovec_first : iovec_others;
+    size_t have = input_len - pos;
+    size_t take = std::min(can, have);
+    inout_vec.push_back(CRYPTO_IOVEC{out + pos, in + pos, take});
+    outin2_vec.push_back(CRYPTO_IOVEC{in2 + pos, out + pos, take});
+    pos += take;
+  }
+  CRYPTO_IVEC ad_vec = {ad.data(), ad_len};
+
+  if (direction == evp_aead_seal) {
+    size_t tag_len;
+    for (auto _ : state) {
+      benchmark::DoNotOptimize(inout_vec);
+      benchmark::DoNotOptimize(nonce.data());
+      benchmark::DoNotOptimize(ad_vec);
+      if (!EVP_AEAD_CTX_sealv(ctx.get(), inout_vec.data(), inout_vec.size(),
+                              tag, &tag_len, overhead_len, nonce.data(),
+                              nonce_len, &ad_vec, 1)) {
+        state.SkipWithError("EVP_AEAD_CTX_sealv failed.");
+        return;
+      }
+      benchmark::DoNotOptimize(out);
+      benchmark::DoNotOptimize(tag);
+      benchmark::DoNotOptimize(tag_len);
+      benchmark::ClobberMemory();
+    }
+    state.SetBytesProcessed(state.iterations() * input_len);
+  } else {
+    size_t tag_len;
+    if (!EVP_AEAD_CTX_sealv(ctx.get(), inout_vec.data(), inout_vec.size(), tag,
+                            &tag_len, overhead_len, nonce.data(), nonce_len,
+                            &ad_vec, 1)) {
+      state.SkipWithError("EVP_AEAD_CTX_sealv failed.");
+      return;
+    }
+
+    ctx.Reset();
+    if (!EVP_AEAD_CTX_init_with_direction(ctx.get(), aead, key.data(), key_len,
+                                          EVP_AEAD_DEFAULT_TAG_LENGTH,
+                                          evp_aead_open)) {
+      state.SkipWithError("Failed to create EVP_AEAD_CTX.");
+      return;
+    }
+
+    // We know `out` and `in2` have enough space for the tag; so let's append
+    // it to the last chunk of `out`.
+    OPENSSL_memcpy(inout_vec.back().out + inout_vec.back().len, tag, tag_len);
+    outin2_vec.back().len += tag_len;
+
+    size_t in2_len;
+    for (auto _ : state) {
+      benchmark::DoNotOptimize(outin2_vec);
+      benchmark::DoNotOptimize(nonce.data());
+      benchmark::DoNotOptimize(ad_vec);
+      // N.B. EVP_AEAD_CTX_openv_detached is not implemented for all AEADs.
+      if (!EVP_AEAD_CTX_openv(ctx.get(), outin2_vec.data(), outin2_vec.size(),
+                              &in2_len, nonce.data(), nonce_len, &ad_vec, 1)) {
+        state.SkipWithError("EVP_AEAD_CTX_openv failed.");
+        return;
+      }
+      benchmark::DoNotOptimize(in2);
+      benchmark::DoNotOptimize(in2_len);
+      benchmark::ClobberMemory();
     }
     state.SetBytesProcessed(state.iterations() * input_len);
   }
@@ -119,14 +254,30 @@
 static const int64_t kInputSizes = {16, 256, 1350, 8192, 16384};
 
 void SetInputLength(benchmark::Benchmark *bench) {
-  bench->ArgName("InputSize");
+  bench->ArgNames({"InputSize"});
   auto input_sizes = bench::GetInputSizes(bench);
-  if (input_sizes.empty()) {
-    bench->ArgsProduct(
-        {std::vector<int64_t>(kInputSizes, std::end(kInputSizes))});
-  } else {
-    bench->ArgsProduct(
-        {std::vector<int64_t>(input_sizes.begin(), input_sizes.end())});
+  for (const int64_t size : input_sizes.empty() ? kInputSizes : input_sizes) {
+    bench->Args({size});
+  }
+}
+
+void SetInputLengthv(benchmark::Benchmark *bench) {
+  // No need to distinguish by name - the IOVec related args suffice to
+  // distinguish them. This allows later making BM_SpeedAEADv the only one,
+  // while renaming it to BM_SpeedAEAD.
+  const std::string prefix = "BM_SpeedAEADv/";
+  BSSL_CHECK(std::string(bench->GetName()).substr(0, prefix.size()) == prefix);
+  bench->Name(std::string("BM_SpeedAEAD/") +
+              std::string(bench->GetName()).substr(prefix.size()));
+
+  bench->ArgNames({"InputSize", "IOVecFirst", "IOVecOthers"});
+  auto input_sizes = bench::GetInputSizes(bench);
+  for (const int64_t size : input_sizes.empty() ? kInputSizes : input_sizes) {
+    bench->Args({size, size, 0});  // One shot.
+    if (size >= 1456) {
+      bench->Args({size, 1456, 1456});  // Nicely aligned.
+      bench->Args({size, 1457, 1456});  // As unaligned as it gets.
+    }
   }
 }
 
@@ -137,6 +288,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_128_gcm, kTLSADLen, evp_aead_open,
                     EVP_aead_aes_128_gcm())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_128_gcm, kTLSADLen, evp_aead_seal,
+                    EVP_aead_aes_128_gcm())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_128_gcm, kTLSADLen, evp_aead_open,
+                    EVP_aead_aes_128_gcm())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_192_gcm, kTLSADLen, evp_aead_seal,
                     EVP_aead_aes_192_gcm())
@@ -144,6 +301,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_192_gcm, kTLSADLen, evp_aead_open,
                     EVP_aead_aes_192_gcm())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_192_gcm, kTLSADLen, evp_aead_seal,
+                    EVP_aead_aes_192_gcm())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_192_gcm, kTLSADLen, evp_aead_open,
+                    EVP_aead_aes_192_gcm())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_256_gcm, kTLSADLen, evp_aead_seal,
                     EVP_aead_aes_256_gcm())
@@ -151,6 +314,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_256_gcm, kTLSADLen, evp_aead_open,
                     EVP_aead_aes_256_gcm())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_256_gcm, kTLSADLen, evp_aead_seal,
+                    EVP_aead_aes_256_gcm())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_256_gcm, kTLSADLen, evp_aead_open,
+                    EVP_aead_aes_256_gcm())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_chacha20_poly1305, kTLSADLen,
                     evp_aead_seal, EVP_aead_chacha20_poly1305())
@@ -158,6 +327,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_chacha20_poly1305, kTLSADLen,
                     evp_aead_open, EVP_aead_chacha20_poly1305())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_chacha20_poly1305, kTLSADLen,
+                    evp_aead_seal, EVP_aead_chacha20_poly1305())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_chacha20_poly1305, kTLSADLen,
+                    evp_aead_open, EVP_aead_chacha20_poly1305())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_xchacha20_poly1305, kTLSADLen,
                     evp_aead_seal, EVP_aead_xchacha20_poly1305())
@@ -165,6 +340,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_xchacha20_poly1305, kTLSADLen,
                     evp_aead_open, EVP_aead_xchacha20_poly1305())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_xchacha20_poly1305, kTLSADLen,
+                    evp_aead_seal, EVP_aead_xchacha20_poly1305())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_xchacha20_poly1305, kTLSADLen,
+                    evp_aead_open, EVP_aead_xchacha20_poly1305())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_128_cbc_sha1, kLegacyADLen,
                     evp_aead_seal, EVP_aead_aes_128_cbc_sha1_tls())
@@ -172,6 +353,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_128_cbc_sha1, kLegacyADLen,
                     evp_aead_open, EVP_aead_aes_128_cbc_sha1_tls())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_128_cbc_sha1, kLegacyADLen,
+                    evp_aead_seal, EVP_aead_aes_128_cbc_sha1_tls())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_128_cbc_sha1, kLegacyADLen,
+                    evp_aead_open, EVP_aead_aes_128_cbc_sha1_tls())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_128_cbc_sha256, kLegacyADLen,
                     evp_aead_seal, EVP_aead_aes_128_cbc_sha256_tls())
@@ -179,6 +366,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_128_cbc_sha256, kLegacyADLen,
                     evp_aead_open, EVP_aead_aes_128_cbc_sha256_tls())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_128_cbc_sha256, kLegacyADLen,
+                    evp_aead_seal, EVP_aead_aes_128_cbc_sha256_tls())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_128_cbc_sha256, kLegacyADLen,
+                    evp_aead_open, EVP_aead_aes_128_cbc_sha256_tls())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_256_cbc_sha1, kLegacyADLen,
                     evp_aead_seal, EVP_aead_aes_256_cbc_sha1_tls())
@@ -186,6 +379,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_256_cbc_sha1, kLegacyADLen,
                     evp_aead_open, EVP_aead_aes_256_cbc_sha1_tls())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_256_cbc_sha1, kLegacyADLen,
+                    evp_aead_seal, EVP_aead_aes_256_cbc_sha1_tls())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_256_cbc_sha1, kLegacyADLen,
+                    evp_aead_open, EVP_aead_aes_256_cbc_sha1_tls())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_128_gcm_siv, kTLSADLen,
                     evp_aead_seal, EVP_aead_aes_128_gcm_siv())
@@ -193,6 +392,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_128_gcm_siv, kTLSADLen,
                     evp_aead_open, EVP_aead_aes_128_gcm_siv())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_128_gcm_siv, kTLSADLen,
+                    evp_aead_seal, EVP_aead_aes_128_gcm_siv())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_128_gcm_siv, kTLSADLen,
+                    evp_aead_open, EVP_aead_aes_128_gcm_siv())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_256_gcm_siv, kTLSADLen,
                     evp_aead_seal, EVP_aead_aes_256_gcm_siv())
@@ -200,6 +405,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_256_gcm_siv, kTLSADLen,
                     evp_aead_open, EVP_aead_aes_256_gcm_siv())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_256_gcm_siv, kTLSADLen,
+                    evp_aead_seal, EVP_aead_aes_256_gcm_siv())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_256_gcm_siv, kTLSADLen,
+                    evp_aead_open, EVP_aead_aes_256_gcm_siv())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_128_eax, kTLSADLen, evp_aead_seal,
                     EVP_aead_aes_128_eax())
@@ -207,6 +418,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_128_eax, kTLSADLen, evp_aead_open,
                     EVP_aead_aes_128_eax())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_128_eax, kTLSADLen, evp_aead_seal,
+                    EVP_aead_aes_128_eax())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_128_eax, kTLSADLen, evp_aead_open,
+                    EVP_aead_aes_128_eax())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_256_eax, kTLSADLen, evp_aead_seal,
                     EVP_aead_aes_256_eax())
@@ -214,6 +431,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_256_eax, kTLSADLen, evp_aead_open,
                     EVP_aead_aes_256_eax())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_256_eax, kTLSADLen, evp_aead_seal,
+                    EVP_aead_aes_256_eax())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_256_eax, kTLSADLen, evp_aead_open,
+                    EVP_aead_aes_256_eax())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_128_ccm_bluetooth, kTLSADLen,
                     evp_aead_seal, EVP_aead_aes_128_ccm_bluetooth())
@@ -221,6 +444,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_128_ccm_bluetooth, kTLSADLen,
                     evp_aead_open, EVP_aead_aes_128_ccm_bluetooth())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_128_ccm_bluetooth, kTLSADLen,
+                    evp_aead_seal, EVP_aead_aes_128_ccm_bluetooth())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_128_ccm_bluetooth, kTLSADLen,
+                    evp_aead_open, EVP_aead_aes_128_ccm_bluetooth())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_128_ccm_bluetooth8, kTLSADLen,
                     evp_aead_seal, EVP_aead_aes_128_ccm_bluetooth_8())
@@ -228,6 +457,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_128_ccm_bluetooth8, kTLSADLen,
                     evp_aead_open, EVP_aead_aes_128_ccm_bluetooth_8())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_128_ccm_bluetooth8, kTLSADLen,
+                    evp_aead_seal, EVP_aead_aes_128_ccm_bluetooth_8())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_128_ccm_bluetooth8, kTLSADLen,
+                    evp_aead_open, EVP_aead_aes_128_ccm_bluetooth_8())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_128_ccm_matter, kTLSADLen,
                     evp_aead_seal, EVP_aead_aes_128_ccm_matter())
@@ -235,6 +470,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_128_ccm_matter, kTLSADLen,
                     evp_aead_open, EVP_aead_aes_128_ccm_matter())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_128_ccm_matter, kTLSADLen,
+                    evp_aead_seal, EVP_aead_aes_128_ccm_matter())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_128_ccm_matter, kTLSADLen,
+                    evp_aead_open, EVP_aead_aes_128_ccm_matter())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_128_ctr_hmac_sha256, kTLSADLen,
                     evp_aead_seal, EVP_aead_aes_128_ctr_hmac_sha256())
@@ -242,6 +483,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_128_ctr_hmac_sha256, kTLSADLen,
                     evp_aead_open, EVP_aead_aes_128_ctr_hmac_sha256())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_128_ctr_hmac_sha256, kTLSADLen,
+                    evp_aead_seal, EVP_aead_aes_128_ctr_hmac_sha256())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_128_ctr_hmac_sha256, kTLSADLen,
+                    evp_aead_open, EVP_aead_aes_128_ctr_hmac_sha256())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_aes_256_ctr_hmac_sha256, kTLSADLen,
                     evp_aead_seal, EVP_aead_aes_256_ctr_hmac_sha256())
@@ -249,6 +496,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_aes_256_ctr_hmac_sha256, kTLSADLen,
                     evp_aead_open, EVP_aead_aes_256_ctr_hmac_sha256())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_aes_256_ctr_hmac_sha256, kTLSADLen,
+                    evp_aead_seal, EVP_aead_aes_256_ctr_hmac_sha256())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_aes_256_ctr_hmac_sha256, kTLSADLen,
+                    evp_aead_open, EVP_aead_aes_256_ctr_hmac_sha256())
+      ->Apply(SetInputLengthv);
 
   BENCHMARK_CAPTURE(BM_SpeedAEAD, seal_des_ede3_cbc_sha1, kLegacyADLen,
                     evp_aead_seal, EVP_aead_des_ede3_cbc_sha1_tls())
@@ -256,6 +509,12 @@
   BENCHMARK_CAPTURE(BM_SpeedAEAD, open_des_ede3_cbc_sha1, kLegacyADLen,
                     evp_aead_open, EVP_aead_des_ede3_cbc_sha1_tls())
       ->Apply(SetInputLength);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, seal_des_ede3_cbc_sha1, kLegacyADLen,
+                    evp_aead_seal, EVP_aead_des_ede3_cbc_sha1_tls())
+      ->Apply(SetInputLengthv);
+  BENCHMARK_CAPTURE(BM_SpeedAEADv, open_des_ede3_cbc_sha1, kLegacyADLen,
+                    evp_aead_open, EVP_aead_des_ede3_cbc_sha1_tls())
+      ->Apply(SetInputLengthv);
 }
 
 }  // namespace

boringssl-0.20260708.tar.xz/bench/ecdh.cc -> boringssl-0.20260813.tar.xz/bench/ecdh.cc Changed

@@ -12,78 +12,71 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#include <vector>
-
 #include <benchmark/benchmark.h>
 
 #include <openssl/base.h>
-#include <openssl/bn.h>
 #include <openssl/ec.h>
+#include <openssl/ec_key.h>
+#include <openssl/ecdh.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/mem.h>
 
 #include "./internal.h"
 
+BSSL_NAMESPACE_BEGIN
 namespace {
+
 void BM_SpeedECDH(benchmark::State &state, const EC_GROUP *group) {
-  bssl::UniquePtr<EC_KEY> peer_key(EC_KEY_new());
+  UniquePtr<EC_KEY> peer_key(EC_KEY_new());
   if (!peer_key || !EC_KEY_set_group(peer_key.get(), group) ||
       !EC_KEY_generate_key(peer_key.get())) {
     state.SkipWithError("peer keygen failed.");
     return;
   }
 
-  size_t peer_value_len =
-      EC_POINT_point2oct(group, EC_KEY_get0_public_key(peer_key.get()),
-                         POINT_CONVERSION_UNCOMPRESSED, nullptr, 0, nullptr);
-  if (peer_value_len == 0) {
-    state.SkipWithError("EC_POINT_point2oct failed.");
+  const EC_POINT *peer_pub = EC_KEY_get0_public_key(peer_key.get());
+
+  UniquePtr<EC_KEY> key(EC_KEY_new());
+  if (!key || !EC_KEY_set_group(key.get(), group) ||
+      !EC_KEY_generate_key(key.get())) {
+    state.SkipWithError("self keygen failed.");
     return;
   }
-  std::vector<uint8_t> peer_value(peer_value_len);
-  peer_value_len =
-      EC_POINT_point2oct(group, EC_KEY_get0_public_key(peer_key.get()),
-                         POINT_CONVERSION_UNCOMPRESSED, peer_value.data(),
-                         peer_value_len, nullptr);
-  if (peer_value_len == 0) {
-    state.SkipWithError("peer pubkey serialisation failed.");
+
+  uint8_t secret66;
+  size_t secret_len = (EC_GROUP_get_degree(group) + 7) / 8;
+  if (secret_len > sizeof(secret)) {
+    state.SkipWithError("secret length exceeds buffer size.");
     return;
   }
 
   for (auto _ : state) {
-    bssl::UniquePtr<EC_KEY> key(EC_KEY_new());
-    if (!key || !EC_KEY_set_group(key.get(), group) ||
-        !EC_KEY_generate_key(key.get())) {
-      state.SkipWithError("self keygen failed.");
-      return;
-    }
-    bssl::UniquePtr<EC_POINT> point(EC_POINT_new(group));
-    bssl::UniquePtr<EC_POINT> peer_point(EC_POINT_new(group));
-    bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
-    bssl::UniquePtr<BIGNUM> x(BN_new());
-    if (!point || !peer_point || !ctx || !x ||
-        !EC_POINT_oct2point(group, peer_point.get(), peer_value.data(),
-                            peer_value_len, ctx.get()) ||
-        !EC_POINT_mul(group, point.get(), nullptr, peer_point.get(),
-                      EC_KEY_get0_private_key(key.get()), ctx.get()) ||
-        !EC_POINT_get_affine_coordinates_GFp(group, point.get(), x.get(),
-                                             nullptr, ctx.get())) {
-      state.SkipWithError("final key agreement failed.");
+    benchmark::ClobberMemory();
+    benchmark::DoNotOptimize(peer_pub);
+
+    int res =
+        ECDH_compute_key(secret, secret_len, peer_pub, key.get(), nullptr);
+    if (res < 0) {
+      state.SkipWithError("ECDH_compute_key failed.");
       return;
     }
+
+    benchmark::DoNotOptimize(secret);
+    benchmark::DoNotOptimize(res);
   }
 }
 
 BSSL_BENCH_LAZY_REGISTER() {
   BENCHMARK_CAPTURE(BM_SpeedECDH, p224, EC_group_p224())
-      ->Apply(bssl::bench::SetThreads);
+      ->Apply(bench::SetThreads);
   BENCHMARK_CAPTURE(BM_SpeedECDH, p256, EC_group_p256())
-      ->Apply(bssl::bench::SetThreads);
+      ->Apply(bench::SetThreads);
   BENCHMARK_CAPTURE(BM_SpeedECDH, p384, EC_group_p384())
-      ->Apply(bssl::bench::SetThreads);
+      ->Apply(bench::SetThreads);
   BENCHMARK_CAPTURE(BM_SpeedECDH, p521, EC_group_p521())
-      ->Apply(bssl::bench::SetThreads);
+      ->Apply(bench::SetThreads);
 }
 
 }  // namespace
+BSSL_NAMESPACE_END

boringssl-0.20260708.tar.xz/bench/ecdsa.cc -> boringssl-0.20260813.tar.xz/bench/ecdsa.cc Changed

@@ -12,6 +12,10 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+#include <cstring>
+
+#include <benchmark/benchmark.h>
+
 #include <openssl/base.h>
 #include <openssl/bn.h>
 #include <openssl/ec.h>
@@ -20,68 +24,92 @@
 #include <openssl/evp.h>
 #include <openssl/mem.h>
 
-#include <benchmark/benchmark.h>
-
 #include "../crypto/internal.h"
 #include "./internal.h"
 
-
 BSSL_NAMESPACE_BEGIN
 namespace {
 
+static constexpr size_t kMaxSignature = 256;
+static constexpr size_t kMaxDigestSize = 66;  // ceil(521 / 8) for P-521
+
 void BM_SpeedECDSASign(benchmark::State &state, const EC_GROUP *group) {
   UniquePtr<EC_KEY> key(EC_KEY_new());
   if (!key || !EC_KEY_set_group(key.get(), group) ||
       !EC_KEY_generate_key(key.get())) {
-    state.SkipWithError("keygen failed");
+    state.SkipWithError("keygen failed.");
     return;
   }
 
-  static constexpr size_t kMaxSignature = 256;
-  if (ECDSA_size(key.get()) > kMaxSignature) {
-    state.SkipWithError("key is too large.");
+  const size_t digest_len = BN_num_bytes(EC_GROUP_get0_order(group));
+  if (digest_len > kMaxDigestSize || ECDSA_size(key.get()) > kMaxSignature) {
+    state.SkipWithError("key or digest is too large.");
     return;
   }
-  uint8_t digest20;
-  OPENSSL_memset(digest, 42, sizeof(digest));
 
+  uint8_t digestkMaxDigestSize;
+  OPENSSL_memset(digest, 42, digest_len);
   uint8_t outkMaxSignature;
+
   for (auto _ : state) {
-    unsigned out_len;
-    if (!ECDSA_sign(0, digest, sizeof(digest), out, &out_len, key.get())) {
+    unsigned out_len = 0;
+    benchmark::ClobberMemory();
+    benchmark::DoNotOptimize(digest);
+
+
+    if (!ECDSA_sign(0, digest, digest_len, out, &out_len, key.get())) {
       state.SkipWithError("signing failed.");
       return;
     }
+
+    benchmark::DoNotOptimize(out);
+    benchmark::DoNotOptimize(out_len);
   }
 }
 
-
 void BM_SpeedECDSAVerify(benchmark::State &state, const EC_GROUP *group) {
-  UniquePtr<EC_KEY> key(EC_KEY_new());
-  if (!key || !EC_KEY_set_group(key.get(), group) ||
-      !EC_KEY_generate_key(key.get())) {
-    state.SkipWithError("keygen failed");
+  uint8_t digestkMaxDigestSize;
+  const size_t digest_len = BN_num_bytes(EC_GROUP_get0_order(group));
+  if (digest_len > kMaxDigestSize) {
+    state.SkipWithError("digest is too large.");
     return;
   }
 
-  static constexpr size_t kMaxSignature = 256;
-  if (ECDSA_size(key.get()) > kMaxSignature) {
-    state.SkipWithError("key is too large.");
-    return;
-  }
-  uint8_t digest20;
-  OPENSSL_memset(digest, 42, sizeof(digest));
+  OPENSSL_memset(digest, 42, digest_len);
 
+  // Declared outside of the loop to avoid running object destructor while
+  // timing.
+  UniquePtr<EC_KEY> key;
   uint8_t signaturekMaxSignature;
   unsigned sig_len;
-  if (!ECDSA_sign(0, digest, sizeof(digest), signature, &sig_len, key.get())) {
-    state.SkipWithError("signing failed");
-    return;
-  }
 
   for (auto _ : state) {
-    if (!ECDSA_verify(0, digest, sizeof(digest), signature, sig_len,
-                      key.get())) {
+    state.PauseTiming();
+
+    key = UniquePtr<EC_KEY>(EC_KEY_new());
+    if (!key || !EC_KEY_set_group(key.get(), group) ||
+        !EC_KEY_generate_key(key.get())) {
+      state.SkipWithError("keygen failed.");
+      return;
+    }
+
+    if (ECDSA_size(key.get()) > kMaxSignature) {
+      state.SkipWithError("key is too large.");
+      return;
+    }
+
+    if (!ECDSA_sign(0, digest, digest_len, signature, &sig_len, key.get())) {
+      state.SkipWithError("signing failed.");
+      return;
+    }
+
+    benchmark::DoNotOptimize(signature);
+    benchmark::DoNotOptimize(sig_len);
+    benchmark::ClobberMemory();
+
+    state.ResumeTiming();
+
+    if (!ECDSA_verify(0, digest, digest_len, signature, sig_len, key.get())) {
       state.SkipWithError("verification failed.");
       return;
     }

boringssl-0.20260708.tar.xz/bench/mlkem.cc -> boringssl-0.20260813.tar.xz/bench/mlkem.cc Changed

@@ -21,6 +21,7 @@
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/mlkem.h>
+#include <openssl/rand.h>
 
 #include "./internal.h"
 
@@ -136,6 +137,23 @@
   }
 }
 
+void BM_SpeedMLKEM768PrivateKeyFromSeedOnly(benchmark::State &state) {
+  for (auto _ : state) {
+    state.PauseTiming();
+    uint8_t seedMLKEM_SEED_BYTES;
+    RAND_bytes(seed, sizeof(seed));
+    benchmark::DoNotOptimize(seed);
+    state.ResumeTiming();
+
+    MLKEM768_private_key priv;
+    if (!MLKEM768_private_key_from_seed(&priv, seed, sizeof(seed))) {
+      state.SkipWithError("MLKEM768_private_key_from_seed failed");
+      return;
+    }
+    benchmark::DoNotOptimize(priv);
+  }
+}
+
 void BM_SpeedMLKEM768DecapOnly(benchmark::State &state) {
   uint8_t ciphertextMLKEM768_CIPHERTEXT_BYTES;
   // This ciphertext is nonsense, but decap is constant-time so, for the
@@ -215,6 +233,23 @@
   }
 }
 
+void BM_SpeedMLKEM1024PrivateKeyFromSeedOnly(benchmark::State &state) {
+  for (auto _ : state) {
+    state.PauseTiming();
+    uint8_t seedMLKEM_SEED_BYTES;
+    RAND_bytes(seed, sizeof(seed));
+    benchmark::DoNotOptimize(seed);
+    state.ResumeTiming();
+
+    MLKEM1024_private_key priv;
+    if (!MLKEM1024_private_key_from_seed(&priv, seed, sizeof(seed))) {
+      state.SkipWithError("MLKEM1024_private_key_from_seed failed");
+      return;
+    }
+    benchmark::DoNotOptimize(priv);
+  }
+}
+
 void BM_SpeedMLKEM1024DecapOnly(benchmark::State &state) {
   uint8_t ciphertextMLKEM1024_CIPHERTEXT_BYTES;
   // This ciphertext is nonsense, but decap is constant-time so, for the
@@ -294,10 +329,14 @@
   BENCHMARK(BM_SpeedMLKEM1024ParseEncap)->Apply(bssl::bench::SetThreads);
 
   BENCHMARK(BM_SpeedMLKEM768KeyGenOnly)->Apply(bssl::bench::SetThreads);
+  BENCHMARK(BM_SpeedMLKEM768PrivateKeyFromSeedOnly)
+      ->Apply(bssl::bench::SetThreads);
   BENCHMARK(BM_SpeedMLKEM768DecapOnly)->Apply(bssl::bench::SetThreads);
   BENCHMARK(BM_SpeedMLKEM768ParseOnly)->Apply(bssl::bench::SetThreads);
   BENCHMARK(BM_SpeedMLKEM768EncapOnly)->Apply(bssl::bench::SetThreads);
   BENCHMARK(BM_SpeedMLKEM1024KeyGenOnly)->Apply(bssl::bench::SetThreads);
+  BENCHMARK(BM_SpeedMLKEM1024PrivateKeyFromSeedOnly)
+      ->Apply(bssl::bench::SetThreads);
   BENCHMARK(BM_SpeedMLKEM1024DecapOnly)->Apply(bssl::bench::SetThreads);
   BENCHMARK(BM_SpeedMLKEM1024ParseOnly)->Apply(bssl::bench::SetThreads);
   BENCHMARK(BM_SpeedMLKEM1024EncapOnly)->Apply(bssl::bench::SetThreads);

boringssl-0.20260708.tar.xz/build.json -> boringssl-0.20260813.tar.xz/build.json Changed

@@ -279,7 +279,6 @@
             "crypto/fuzzer_mode.cc",
             "crypto/hpke/hpke.cc",
             "crypto/hrss/hrss.cc",
-            "crypto/kyber/kyber.cc",
             "crypto/lhash/lhash.cc",
             "crypto/md4/md4.cc",
             "crypto/md5/md5.cc",
@@ -379,6 +378,7 @@
             "crypto/x509/x509_def.cc",
             "crypto/x509/x509_ext.cc",
             "crypto/x509/x509_lu.cc",
+            "crypto/x509/x509_mtc.cc",
             "crypto/x509/x509_obj.cc",
             "crypto/x509/x509_req.cc",
             "crypto/x509/x509_set.cc",
@@ -545,7 +545,6 @@
             "crypto/hrss/internal.h",
             "crypto/bcm_support.h",
             "crypto/internal.h",
-            "crypto/kyber/internal.h",
             "crypto/lhash/internal.h",
             "crypto/md5/internal.h",
             "crypto/mem_internal.h",
@@ -867,7 +866,6 @@
             "crypto/hpke/hpke_test.cc",
             "crypto/hrss/hrss_test.cc",
             "crypto/impl_dispatch_test.cc",
-            "crypto/kyber/kyber_test.cc",
             "crypto/lhash/lhash_test.cc",
             "crypto/md5/md5_test.cc",
             "crypto/mlkem/mlkem_test.cc",
@@ -921,7 +919,6 @@
             "crypto/fipsmodule/rand/ctrdrbg_df_vectors.txt",
             "crypto/hmac/hmac_tests.txt",
             "crypto/hpke/*.txt",
-            "crypto/kyber/kyber_tests.txt",
             "crypto/mldsa/mldsa_nist_keygen_44_tests.txt",
             "crypto/mldsa/mldsa_nist_keygen_65_tests.txt",
             "crypto/mldsa/mldsa_nist_keygen_87_tests.txt",
@@ -1127,6 +1124,12 @@
             "rust/bssl-x509/src/*.rs"
         
     },
+    "rust_bssl_tls_tokio": {
+        "srcs": 
+            "rust/bssl-tls-tokio/src/*.rs",
+            "rust/bssl-tls-tokio/src/*/*.rs"
+        
+    },
     "modulewrapper": {
         "srcs": 
             "util/fipstools/acvp/modulewrapper/main.cc",

boringssl-0.20260708.tar.xz/cmake/OpenSSLConfig.cmake -> boringssl-0.20260813.tar.xz/cmake/OpenSSLConfig.cmake Changed

boringssl-0.20260708.tar.xz/crypto/asn1/asn1_test.cc -> boringssl-0.20260813.tar.xz/crypto/asn1/asn1_test.cc Changed

@@ -381,6 +381,8 @@
       } else {
         uint64_t v;
         EXPECT_FALSE(ASN1_INTEGER_get_uint64(&v, obj));
+        EXPECT_TRUE(
+            ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_INVALID_INTEGER}}));
       }
 
       if (fits_in_i64) {
@@ -390,6 +392,8 @@
       } else {
         int64_t v;
         EXPECT_FALSE(ASN1_INTEGER_get_int64(&v, obj));
+        EXPECT_TRUE(
+            ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_INVALID_INTEGER}}));
       }
 
       if (fits_in_long) {
@@ -468,6 +472,7 @@
     UniquePtr<ASN1_INTEGER> integer(
         d2i_ASN1_INTEGER(nullptr, &ptr, invalid.size()));
     EXPECT_FALSE(integer);
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_INVALID_INTEGER}}));
   }
 
   // Callers expect `ASN1_INTEGER_get` and `ASN1_ENUMERATED_get` to return zero
@@ -861,25 +866,29 @@
     }
   }
 
-  const std::vector<uint8_t> kInvalidInputs = {
+  const struct {
+    std::vector<uint8_t> in;
+    int err_reason;
+  } kInvalidInputs = {
       // Wrong tag
-      {0x04, 0x01, 0x00},
+      {{0x04, 0x01, 0x00}, ASN1_R_DECODE_ERROR},
       // Missing leading byte
-      {0x03, 0x00},
+      {{0x03, 0x00}, ASN1_R_STRING_TOO_SHORT},
       // Leading byte too high
-      {0x03, 0x02, 0x08, 0x00},
-      {0x03, 0x02, 0xff, 0x00},
+      {{0x03, 0x02, 0x08, 0x00}, ASN1_R_INVALID_BIT_STRING_BITS_LEFT},
+      {{0x03, 0x02, 0xff, 0x00}, ASN1_R_INVALID_BIT_STRING_BITS_LEFT},
       // Empty bit strings must have a zero leading byte.
-      {0x03, 0x01, 0x01},
+      {{0x03, 0x01, 0x01}, ASN1_R_INVALID_BIT_STRING_PADDING},
       // Unused bits must all be zero.
-      {0x03, 0x02, 0x06, 0xc1 /* 0b11000001 */},
+      {{0x03, 0x02, 0x06, 0xc1 /* 0b11000001 */}, ASN1_R_INVALID_BIT_STRING_PADDING},
   };
   for (const auto &test : kInvalidInputs) {
-    SCOPED_TRACE(Bytes(test));
-    const uint8_t *ptr = test.data();
+    SCOPED_TRACE(Bytes(test.in));
+    const uint8_t *ptr = test.in.data();
     UniquePtr<ASN1_BIT_STRING> val(
-        d2i_ASN1_BIT_STRING(nullptr, &ptr, test.size()));
+        d2i_ASN1_BIT_STRING(nullptr, &ptr, test.in.size()));
     EXPECT_FALSE(val);
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, test.err_reason}}));
   }
 }
 
@@ -931,8 +940,11 @@
 
   // Negative bits do not exist.
   EXPECT_FALSE(ASN1_BIT_STRING_set_bit(val.get(), -1, 0));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_ASN1, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
   EXPECT_FALSE(ASN1_BIT_STRING_set_bit(val.get(), -1, 1));
-  ERR_clear_error();
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_ASN1, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
 
   // Bits may be set beyond the end of the string.
   ASSERT_TRUE(ASN1_BIT_STRING_set_bit(val.get(), 63, 1));
@@ -1021,12 +1033,22 @@
 
   // All unused bits must be zero.
   EXPECT_FALSE(set1(val.get(), {0xff}, 1));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_INVALID_BIT_STRING_BITS_LEFT}}));
   EXPECT_FALSE(set1(val.get(), {0xf0}, 5));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_INVALID_BIT_STRING_BITS_LEFT}}));
 
   // Invalid unused bit counts.
   EXPECT_FALSE(set1(val.get(), {0x00, 0x00}, 8));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_INVALID_BIT_STRING_BITS_LEFT}}));
   EXPECT_FALSE(set1(val.get(), {0x00, 0x00}, -1));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_INVALID_BIT_STRING_BITS_LEFT}}));
   EXPECT_FALSE(set1(val.get(), {}, 1));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_INVALID_BIT_STRING_BITS_LEFT}}));
 
   // `ASN1_STRING_set` and `ASN1_STRING_set0` should clear the count of unused
   // bits, rather then carry it over.
@@ -1225,6 +1247,7 @@
       EXPECT_EQ(tt, t.time);
     } else {
       EXPECT_FALSE(choice);
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, std::nullopt}}));
     }
   }
 }
@@ -2159,7 +2182,11 @@
   // Overriding existing entries, built-in or custom, is an error.
   EXPECT_FALSE(
       ASN1_STRING_TABLE_add(NID_countryName, -1, -1, DIRSTRING_TYPE, 0));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_ASN1, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
   EXPECT_FALSE(ASN1_STRING_TABLE_add(nid1, -1, -1, DIRSTRING_TYPE, 0));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_ASN1, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
 }
 
 #if defined(OPENSSL_THREADS)
@@ -2210,23 +2237,29 @@
   EXPECT_EQ(-1, name->type);
   // `name` should fail to encode.
   EXPECT_EQ(-1, i2d_GENERAL_NAME(name.get(), nullptr));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_NO_MATCHING_CHOICE_TYPE}}));
 
   // The error should be propagated through types containing `name`.
   UniquePtr<GENERAL_NAMES> names(GENERAL_NAMES_new());
   ASSERT_TRUE(names);
   EXPECT_TRUE(PushToStack(names.get(), std::move(name)));
   EXPECT_EQ(-1, i2d_GENERAL_NAMES(names.get(), nullptr));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_NO_MATCHING_CHOICE_TYPE}}));
 }
 
 // Encoding NID-only `ASN1_OBJECT`s should fail.
 TEST(ASN1Test, InvalidObject) {
   EXPECT_EQ(-1, i2d_ASN1_OBJECT(OBJ_nid2obj(NID_kx_ecdhe), nullptr));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_ILLEGAL_OBJECT}}));
 
   UniquePtr<X509_ALGOR> alg(X509_ALGOR_new());
   ASSERT_TRUE(alg);
   ASSERT_TRUE(X509_ALGOR_set0(alg.get(), OBJ_nid2obj(NID_kx_ecdhe),
                               V_ASN1_UNDEF, nullptr));
   EXPECT_EQ(-1, i2d_X509_ALGOR(alg.get(), nullptr));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_ILLEGAL_OBJECT}}));
 }
 
 // Encoding invalid `ASN1_TYPE`s should fail. `ASN1_TYPE`s are
@@ -2236,6 +2269,7 @@
   ASSERT_TRUE(obj);
   EXPECT_EQ(-1, obj->type);
   EXPECT_EQ(-1, i2d_ASN1_TYPE(obj.get(), nullptr));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_WRONG_TYPE}}));
 
   // The historical in-memory representation of UNIVERSAL 128 was for both
   // `obj->type` and `obj->value.asn1_string->type` to be 128. This is no longer
@@ -2246,6 +2280,7 @@
   obj->value.asn1_string = ASN1_STRING_type_new(128);
   ASSERT_TRUE(obj->value.asn1_string);
   EXPECT_EQ(-1, i2d_ASN1_TYPE(obj.get(), nullptr));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_WRONG_TYPE}}));
 }
 
 // Encoding invalid MSTRING types should fail. An MSTRING is a CHOICE of
@@ -2255,11 +2290,13 @@
   ASSERT_TRUE(obj);
   EXPECT_EQ(-1, obj->type);
   EXPECT_EQ(-1, i2d_ASN1_TIME(obj.get(), nullptr));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_WRONG_TYPE}}));
 
   obj.reset(DIRECTORYSTRING_new());
   ASSERT_TRUE(obj);
   EXPECT_EQ(-1, obj->type);
   EXPECT_EQ(-1, i2d_DIRECTORYSTRING(obj.get(), nullptr));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_WRONG_TYPE}}));
 }
 
 TEST(ASN1Test, TypeMismatch) {
@@ -2622,18 +2659,21 @@
   int tag_class;
   EXPECT_EQ(0x80, ASN1_get_object(&ptr, &length, &tag, &tag_class,
                                   sizeof(kTruncated)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG}}));
 
   // Indefinite-length encoding is not allowed in DER.
   static const uint8_t kIndefinite = {0x30, 0x80, 0x00, 0x00};
   ptr = kIndefinite;
   EXPECT_EQ(0x80, ASN1_get_object(&ptr, &length, &tag, &tag_class,
                                   sizeof(kIndefinite)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG}}));
 
   // DER requires lengths be minimally-encoded. This should be {0x30, 0x00}.
   static const uint8_t kNonMinimal = {0x30, 0x81, 0x00};
   ptr = kNonMinimal;
   EXPECT_EQ(0x80, ASN1_get_object(&ptr, &length, &tag, &tag_class,
                                   sizeof(kNonMinimal)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG}}));
 
   // This should be {0x04, 0x81, 0x80, ...}.
   std::vector<uint8_t> non_minimal = {0x04, 0x82, 0x00, 0x80};
@@ -2641,6 +2681,7 @@
   ptr = non_minimal.data();
   EXPECT_EQ(0x80, ASN1_get_object(&ptr, &length, &tag, &tag_class,
                                   non_minimal.size()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG}}));
 }
 
 template <typename T>
@@ -2650,6 +2691,7 @@
   const uint8_t *ptr = in.data();
   UniquePtr<T> obj(d2i(nullptr, &ptr, in.size()));
   EXPECT_FALSE(obj);
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}}));
 }
 
 // The zero tag, constructed or primitive, is reserved and should rejected by
@@ -2744,12 +2786,18 @@
       inp = t.in.data();
       UniquePtr<ASN1_STRING> str(t.d2i(nullptr, &inp, t.in.size()));
       EXPECT_EQ(t.valid, str != nullptr);
+      if (!t.valid) {
+        EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, std::nullopt}}));
+      }
     }
 
     // Also test with the ANY parser.
     inp = t.in.data();
     UniquePtr<ASN1_TYPE> any(d2i_ASN1_TYPE(nullptr, &inp, t.in.size()));
     EXPECT_EQ(t.valid, any != nullptr);
+    if (!t.valid) {
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, std::nullopt}}));
+    }
   }
 }
 
@@ -2809,11 +2857,13 @@
   // crashes, and actually allocating 512 MiB in a test is likely to break.
   char b = 0;
   EXPECT_FALSE(ASN1_STRING_set(str.get(), &b, INT_MAX / 4));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ERR_R_OVERFLOW}}));
 
 #if defined(OPENSSL_64_BIT)
   // `ASN1_STRING_set` should tolerate lengths that exceed `int` without
   // overflow.
   EXPECT_FALSE(ASN1_STRING_set(str.get(), &b, 1 + (ossl_ssize_t{1} << 48)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ERR_R_OVERFLOW}}));
 #endif
 }
 
@@ -3022,6 +3072,7 @@
 // the full combination of tagging and SEQUENCE OF.
 TEST(ASN1Test, MissingRequiredField) {
   EXPECT_EQ(-1, i2d_REQUIRED_FIELD(nullptr, nullptr));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_MISSING_VALUE}}));
 
   std::unique_ptr<REQUIRED_FIELD, decltype(&REQUIRED_FIELD_free)> obj(
       nullptr, REQUIRED_FIELD_free);
@@ -3032,6 +3083,7 @@
     ASN1_INTEGER_free((*obj).*field);
     (*obj).*field = nullptr;
     EXPECT_EQ(-1, i2d_REQUIRED_FIELD(obj.get(), nullptr));
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_MISSING_VALUE}}));
   }
 
   for (auto field : {&REQUIRED_FIELD::seq, &REQUIRED_FIELD::seq_imp,
@@ -3041,6 +3093,7 @@
     sk_ASN1_INTEGER_pop_free((*obj).*field, ASN1_INTEGER_free);
     (*obj).*field = nullptr;
     EXPECT_EQ(-1, i2d_REQUIRED_FIELD(obj.get(), nullptr));
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_MISSING_VALUE}}));
   }
 
   for (auto field : {&REQUIRED_FIELD::null, &REQUIRED_FIELD::null_imp,
@@ -3049,6 +3102,7 @@
     ASSERT_TRUE(obj);
     (*obj).*field = nullptr;
     EXPECT_EQ(-1, i2d_REQUIRED_FIELD(obj.get(), nullptr));
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_MISSING_VALUE}}));
   }
 }

boringssl-0.20260708.tar.xz/crypto/bio/bio_test.cc -> boringssl-0.20260813.tar.xz/crypto/bio/bio_test.cc Changed

boringssl-0.20260708.tar.xz/crypto/bytestring/bytestring_test.cc -> boringssl-0.20260813.tar.xz/crypto/bytestring/bytestring_test.cc Changed

@@ -16,6 +16,7 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include <optional>
 #include <vector>
 
 #include <gtest/gtest.h>
@@ -429,10 +430,10 @@
 
 TEST(CBBTest, Basic) {
   static const uint8_t kExpected = {
-      0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a,
-      0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14,
-      0x03, 0x02, 0x0a, 0x09, 0x08, 0x07, 0x12, 0x11, 0x10, 0x0f,
-      0x0e, 0x0d, 0x0c, 0x0b, 0x00, 0x00, 0x00, 0x00};
+      0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+      0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x03, 0x02,
+      0x0a, 0x09, 0x08, 0x07, 0x12, 0x11, 0x10, 0x0f, 0x0e, 0x0d, 0x0c,
+      0x0b, 0x00, 0x00, 0x00, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66};
   uint8_t *buf;
   size_t buf_len;
 
@@ -452,6 +453,7 @@
   ASSERT_TRUE(CBB_add_u32le(cbb.get(), 0x708090a));
   ASSERT_TRUE(CBB_add_u64le(cbb.get(), 0xb0c0d0e0f101112));
   ASSERT_TRUE(CBB_add_zeros(cbb.get(), 4));
+  ASSERT_TRUE(CBB_add_u48(cbb.get(), 0x112233445566));
   ASSERT_TRUE(CBB_finish(cbb.get(), &buf, &buf_len));
 
   UniquePtr<uint8_t> scoper(buf);
@@ -479,6 +481,7 @@
   ASSERT_TRUE(CBB_init_fixed(&cbb, buf, 1));
   ASSERT_TRUE(CBB_add_u8(&cbb, 1));
   EXPECT_FALSE(CBB_add_u8(&cbb, 2));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_OVERFLOW}}));
   // We do not need `CBB_cleanup` or |bssl::ScopedCBB| here because a fixed
   // `CBB` has no allocations. Leak-checking tools will confirm there was
   // nothing to clean up.
@@ -488,6 +491,7 @@
   ASSERT_TRUE(CBB_init_fixed(&cbb2, buf, 1));
   ASSERT_TRUE(CBB_add_u8(&cbb2, 1));
   EXPECT_FALSE(CBB_add_u8(&cbb2, 2));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_OVERFLOW}}));
   CBB_cleanup(&cbb2);
 }
 
@@ -502,6 +506,8 @@
   ASSERT_TRUE(CBB_add_u8_length_prefixed(cbb.get(), &child));
 
   EXPECT_FALSE(CBB_finish(&child, &out_buf, &out_size));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
 
   ASSERT_TRUE(CBB_finish(cbb.get(), &out_buf, &out_size));
   UniquePtr<uint8_t> scoper(out_buf);
@@ -652,12 +658,26 @@
   // Since we wrote to `cbb`, `child` is now invalid and attempts to write to
   // it should fail.
   EXPECT_FALSE(CBB_add_u8(&child, 1));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
   EXPECT_FALSE(CBB_add_u16(&child, 1));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
   EXPECT_FALSE(CBB_add_u24(&child, 1));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
   EXPECT_FALSE(CBB_add_u8_length_prefixed(&child, &contents));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
   EXPECT_FALSE(CBB_add_u16_length_prefixed(&child, &contents));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
   EXPECT_FALSE(CBB_add_asn1(&child, &contents, 1));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
   EXPECT_FALSE(CBB_add_bytes(&child, (const uint8_t *)"a", 1));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
 
   ASSERT_TRUE(CBB_finish(cbb.get(), &buf, &buf_len));
   UniquePtr<uint8_t> scoper(buf);
@@ -1322,6 +1342,7 @@
   ASSERT_TRUE(CBB_init_fixed(cbb.get(), buf, sizeof(buf)));
   // Too large.
   EXPECT_FALSE(CBB_reserve(cbb.get(), &ptr, 11));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_OVERFLOW}}));
 
   cbb.Reset();
   ASSERT_TRUE(CBB_init_fixed(cbb.get(), buf, sizeof(buf)));
@@ -1345,31 +1366,59 @@
   ASSERT_TRUE(CBB_add_u8_length_prefixed(cbb.get(), &child));
   ASSERT_TRUE(CBB_add_bytes(&child, kZeros, sizeof(kZeros)));
   ASSERT_FALSE(CBB_flush(cbb.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_OVERFLOW}}));
 
   // All future operations should fail.
   uint8_t *ptr;
   size_t len;
   EXPECT_FALSE(CBB_add_u8(cbb.get(), 0));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
   EXPECT_FALSE(CBB_finish(cbb.get(), &ptr, &len));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
 
   // Write an input that cannot fit in a fixed CBB.
   cbb.Reset();
   uint8_t buf;
   ASSERT_TRUE(CBB_init_fixed(cbb.get(), &buf, 1));
   ASSERT_FALSE(CBB_add_bytes(cbb.get(), kZeros, sizeof(kZeros)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_OVERFLOW}}));
 
   // All future operations should fail.
   EXPECT_FALSE(CBB_add_u8(cbb.get(), 0));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
   EXPECT_FALSE(CBB_finish(cbb.get(), &ptr, &len));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
 
   // Write a u32 that cannot fit in a u24.
   cbb.Reset();
   ASSERT_TRUE(CBB_init(cbb.get(), 0));
   ASSERT_FALSE(CBB_add_u24(cbb.get(), 1u << 24));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_OVERFLOW}}));
 
   // All future operations should fail.
   EXPECT_FALSE(CBB_add_u8(cbb.get(), 0));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
   EXPECT_FALSE(CBB_finish(cbb.get(), &ptr, &len));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
+
+  // Write a u64 that cannot fit in a u48.
+  cbb.Reset();
+  ASSERT_TRUE(CBB_init(cbb.get(), 0));
+  ASSERT_FALSE(CBB_add_u48(cbb.get(), uint64_t{1} << 48));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_OVERFLOW}}));
+
+  // All future operations should fail.
+  EXPECT_FALSE(CBB_add_u8(cbb.get(), 0));
+  EXPECT_FALSE(CBB_finish(cbb.get(), &ptr, &len));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
 }
 
 TEST(CBSTest, BitString) {
@@ -1734,6 +1783,8 @@
     ASSERT_TRUE(CBB_add_asn1(cbb.get(), &child, CBS_ASN1_SET));
     ASSERT_TRUE(CBB_add_bytes(&child, t.data(), t.size()));
     EXPECT_FALSE(CBB_flush_asn1_set_of(&child));
+    EXPECT_TRUE(ErrorsAreAndClear(
+        {{ERR_LIB_CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
   }
 }
 
@@ -2186,5 +2237,65 @@
   }
 }
 
+TEST(CBSTest, OIDComponent) {
+  const struct {
+    // enc is an encoded OID component.
+    std::vector<uint8_t> enc;
+    // v is the decoded OID component, or nullopt if invalid.
+    std::optional<uint64_t> v;
+  } kTests = {
+      // The empty string is not an OID component.
+      {{}, std::nullopt},
+      // Some valid OID components.
+      {{0x00}, 0},
+      {{0x01}, 1},
+      {{0x7f}, 127},
+      {{0x81, 0x00}, 128},
+      {{0x81, 0x01}, 129},
+      {{0x81, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
+       UINT64_MAX},
+      // 2^64 is too large and overflows.
+      {{0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x00},
+       std::nullopt},
+      // Non-minimal OID components are invalid.
+      {{0x80, 0x01}, std::nullopt},
+      {{0x80, 0x81, 0x00}, std::nullopt},
+      {{0x80, 0x81, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
+       std::nullopt},
+      // Truncated OID component.
+      {{0xff}, std::nullopt},
+      {{0x81}, std::nullopt},
+  };
+  for (const auto &t : kTests) {
+    SCOPED_TRACE(Bytes(t.enc));
+    CBS cbs;
+    CBS_init(&cbs, t.enc.data(), t.enc.size());
+    uint64_t v;
+    if (!t.v.has_value()) {
+      EXPECT_FALSE(CBS_get_asn1_oid_component(&cbs, &v));
+      continue;
+    }
+
+    ASSERT_TRUE(CBS_get_asn1_oid_component(&cbs, &v));
+    EXPECT_EQ(v, t.v.value());
+    EXPECT_EQ(CBS_len(&cbs), 0u);
+
+    // Trailing data should be left in `cbs`.
+    std::vector<uint8_t> trailing_data = t.enc;
+    trailing_data.push_back(42);
+    CBS_init(&cbs, trailing_data.data(), trailing_data.size());
+    ASSERT_TRUE(CBS_get_asn1_oid_component(&cbs, &v));
+    EXPECT_EQ(v, t.v.value());
+    EXPECT_EQ(CBS_data(&cbs), trailing_data.data() + t.enc.size());
+    EXPECT_EQ(CBS_len(&cbs), 1u);
+
+    // Test serialization.
+    ScopedCBB cbb;
+    ASSERT_TRUE(CBB_init(cbb.get(), t.enc.size()));
+    ASSERT_TRUE(CBB_add_asn1_oid_component(cbb.get(), t.v.value()));
+    EXPECT_EQ(Bytes(CBBAsSpan(cbb.get())), Bytes(t.enc));
+  }
+}
+
 }  // namespace
 BSSL_NAMESPACE_END

boringssl-0.20260708.tar.xz/crypto/bytestring/cbb.cc -> boringssl-0.20260813.tar.xz/crypto/bytestring/cbb.cc Changed

@@ -18,10 +18,13 @@
 #include <limits.h>
 #include <string.h>
 
+#include <algorithm>
+
 #include <openssl/err.h>
 #include <openssl/mem.h>
 
 #include "../internal.h"
+#include "../mem_internal.h"
 #include "internal.h"
 
 
@@ -74,6 +77,7 @@
 static int cbb_buffer_reserve(struct cbb_buffer_st *base, uint8_t **out,
                               size_t len) {
   if (base == nullptr) {
+    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
 
@@ -137,6 +141,7 @@
 
   if (cbb->u.base.can_resize && (out_data == nullptr || out_len == nullptr)) {
     // `out_data` and `out_len` can only be NULL if the CBB is fixed.
+    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
 
@@ -190,6 +195,7 @@
   // memory.
   struct cbb_buffer_st *base = cbb_get_base(cbb);
   if (base == nullptr || base->error) {
+    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
 
@@ -204,8 +210,11 @@
   size_t child_start = child->offset + child->pending_len_len;
 
   size_t len;
-  if (!CBB_flush(cbb->child) || child_start < child->offset ||
-      base->len < child_start) {
+  if (!CBB_flush(cbb->child)) {
+    goto err;
+  }
+  if (child_start < child->offset || base->len < child_start) {
+    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_INTERNAL_ERROR);
     goto err;
   }
 
@@ -424,6 +433,7 @@
   struct cbb_buffer_st *base = cbb_get_base(cbb);
   size_t newlen = base->len + len;
   if (cbb->child != nullptr || newlen < base->len || newlen > base->cap) {
+    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
   base->len = newlen;
@@ -443,6 +453,7 @@
 
   // `v` must fit in `len_len` bytes.
   if (v != 0) {
+    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW);
     cbb_on_error(cbb);
     return 0;
   }
@@ -466,6 +477,8 @@
   return CBB_add_u32(cbb, CRYPTO_bswap4(value));
 }
 
+int CBB_add_u48(CBB *cbb, uint64_t value) { return cbb_add_u(cbb, value, 6); }
+
 int CBB_add_u64(CBB *cbb, uint64_t value) { return cbb_add_u(cbb, value, 8); }
 
 int CBB_add_u64le(CBB *cbb, uint64_t value) {
@@ -674,33 +687,13 @@
   return add_base128_integer(cbb, value);
 }
 
-static int compare_set_of_element(const void *a_ptr, const void *b_ptr) {
-  // See X.690, section 11.6 for the ordering. They are sorted in ascending
-  // order by their DER encoding.
-  const CBS *a = reinterpret_cast<const CBS *>(a_ptr),
-            *b = reinterpret_cast<const CBS *>(b_ptr);
-  size_t a_len = CBS_len(a), b_len = CBS_len(b);
-  size_t min_len = a_len < b_len ? a_len : b_len;
-  int ret = OPENSSL_memcmp(CBS_data(a), CBS_data(b), min_len);
-  if (ret != 0) {
-    return ret;
-  }
-  if (a_len == b_len) {
-    return 0;
-  }
-  // If one is a prefix of the other, the shorter one sorts first. (This is not
-  // actually reachable. No DER encoding is a prefix of another DER encoding.)
-  return a_len < b_len ? -1 : 1;
-}
-
 int CBB_flush_asn1_set_of(CBB *cbb) {
   if (!CBB_flush(cbb)) {
     return 0;
   }
 
-  CBS cbs;
   size_t num_children = 0;
-  CBS_init(&cbs, CBB_data(cbb), CBB_len(cbb));
+  CBS cbs(CBBAsSpan(cbb));
   while (CBS_len(&cbs) != 0) {
     if (!CBS_get_any_asn1_element(&cbs, nullptr, nullptr, nullptr)) {
       OPENSSL_PUT_ERROR(CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
@@ -715,46 +708,49 @@
 
   // Parse out the children and sort. We alias them into a copy of so they
   // remain valid as we rewrite `cbb`.
-  int ret = 0;
-  size_t buf_len = CBB_len(cbb);
-  uint8_t *buf =
-      reinterpret_cast<uint8_t *>(OPENSSL_memdup(CBB_data(cbb), buf_len));
-  CBS *children =
-      reinterpret_cast<CBS *>(OPENSSL_calloc(num_children, sizeof(CBS)));
-  uint8_t *out;
-  size_t offset = 0;
-  if (buf == nullptr || children == nullptr) {
-    goto err;
+  Array<uint8_t> copy;
+  Array<CBS> children;
+  if (!copy.CopyFrom(CBBAsSpan(cbb)) ||  //
+      !children.Init(num_children)) {
+    return 0;
   }
-  CBS_init(&cbs, buf, buf_len);
+  cbs = CBS(copy);
   for (size_t i = 0; i < num_children; i++) {
     if (!CBS_get_any_asn1_element(&cbs, &childreni, nullptr, nullptr)) {
-      goto err;
+      OPENSSL_PUT_ERROR(CRYPTO, ERR_R_INTERNAL_ERROR);
+      return 0;
     }
   }
-  qsort(children, num_children, sizeof(CBS), compare_set_of_element);
+  std::sort(children.begin(), children.end(), (CBS a, CBS b) -> bool {
+    // See X.690, section 11.6 for the ordering. They are sorted in ascending
+    // order by their DER encoding. First compare the common prefix.
+    size_t a_len = CBS_len(&a), b_len = CBS_len(&b);
+    int cmp =
+        OPENSSL_memcmp(CBS_data(&a), CBS_data(&b), std::min(a_len, b_len));
+    if (cmp != 0) {
+      return cmp < 0;
+    }
+    // If one is a prefix of the other, the shorter one sorts first. (They're
+    // actually always equal length. DER encodings are prefix-free.)
+    return a_len < b_len;
+  });
 
   // Write the contents back in the new order.
-  out = (uint8_t *)CBB_data(cbb);
+  uint8_t *out = const_cast<uint8_t *>(CBB_data(cbb));
+  size_t offset = 0;
   for (size_t i = 0; i < num_children; i++) {
     OPENSSL_memcpy(out + offset, CBS_data(&childreni), CBS_len(&childreni));
     offset += CBS_len(&childreni);
   }
-  assert(offset == buf_len);
-
-  ret = 1;
-
-err:
-  OPENSSL_free(buf);
-  OPENSSL_free(children);
-  return ret;
+  assert(offset == copy.size());
+  return 1;
 }
 
 bool bssl::CBBFinishArray(CBB *cbb, Array<uint8_t> *out) {
   uint8_t *ptr;
   size_t len;
   if (!CBB_finish(cbb, &ptr, &len)) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_INTERNAL_ERROR);
     return false;
   }
   out->Reset(ptr, len);

boringssl-0.20260708.tar.xz/crypto/bytestring/cbs.cc -> boringssl-0.20260813.tar.xz/crypto/bytestring/cbs.cc Changed

@@ -277,10 +277,7 @@
   return seen_digit;
 }
 
-// parse_base128_integer reads a big-endian base-128 integer from `cbs` and sets
-// `*out` to the result. This is the encoding used in DER for both high tag
-// number form and OID components.
-static int parse_base128_integer(CBS *cbs, uint64_t *out) {
+int CBS_get_asn1_oid_component(CBS *cbs, uint64_t *out) {
   uint64_t v = 0;
   uint8_t b;
   do {
@@ -319,8 +316,9 @@
   CBS_ASN1_TAG tag = ((CBS_ASN1_TAG)tag_byte & 0xe0) << CBS_ASN1_TAG_SHIFT;
   CBS_ASN1_TAG tag_number = tag_byte & 0x1f;
   if (tag_number == 0x1f) {
+    // High tag numbers are encoded in the same format as OID components.
     uint64_t v;
-    if (!parse_base128_integer(cbs, &v) ||
+    if (!CBS_get_asn1_oid_component(cbs, &v) ||
         // Check the tag number is within our supported bounds.
         v > CBS_ASN1_TAG_NUMBER_MASK ||
         // Small tag numbers should have used low tag number form, even in BER.
@@ -747,9 +745,9 @@
   uint8_t v, prev = 0;
   while (CBS_get_u8(&copy, &v)) {
     // OID encodings are a sequence of minimally-encoded base-128 integers (see
-    // `parse_base128_integer`). If `prev`'s MSB was clear, it was the last byte
-    // of an integer (or `v` is the first byte). `v` is then the first byte of
-    // the next integer. If first byte of an integer is 0x80, it is not
+    // `CBS_get_asn1_oid_component`). If `prev`'s MSB was clear, it was the last
+    // byte of an integer (or `v` is the first byte). `v` is then the first byte
+    // of the next integer. If first byte of an integer is 0x80, it is not
     // minimally-encoded.
     if ((prev & 0x80) == 0 && v == 0x80) {
       return 0;
@@ -770,7 +768,7 @@
 
   // The first component is 40 * value1 + value2, where value1 is 0, 1, or 2.
   uint64_t v;
-  if (!parse_base128_integer(&copy, &v)) {
+  if (!CBS_get_asn1_oid_component(&copy, &v)) {
     goto err;
   }
 
@@ -785,7 +783,7 @@
   }
 
   while (CBS_len(&copy) != 0) {
-    if (!parse_base128_integer(&copy, &v) || !CBB_add_u8(&cbb, '.') ||
+    if (!CBS_get_asn1_oid_component(&copy, &v) || !CBB_add_u8(&cbb, '.') ||
         !add_decimal(&cbb, v)) {
       goto err;
     }
@@ -817,12 +815,12 @@
 
   // Relative OIDs must have at least one component.
   uint64_t v;
-  if (!parse_base128_integer(&copy, &v) || !add_decimal(cbb.get(), v)) {
+  if (!CBS_get_asn1_oid_component(&copy, &v) || !add_decimal(cbb.get(), v)) {
     return nullptr;
   }
 
   while (CBS_len(&copy) != 0) {
-    if (!parse_base128_integer(&copy, &v) || !CBB_add_u8(cbb.get(), '.') ||
+    if (!CBS_get_asn1_oid_component(&copy, &v) || !CBB_add_u8(cbb.get(), '.') ||
         !add_decimal(cbb.get(), v)) {
       return nullptr;
     }

boringssl-0.20260708.tar.xz/crypto/cipher/aead_test.cc -> boringssl-0.20260813.tar.xz/crypto/cipher/aead_test.cc Changed

@@ -342,6 +342,8 @@
             tag_buf.size(), nonce.data(), nonce.size(), in.data(),
             in.size() - extra_in_size, in.data() + in.size() - extra_in_size,
             extra_in_size, ad.data(), ad.size()));
+        EXPECT_TRUE(
+            ErrorsAreAndClear({{ERR_LIB_CIPHER, CIPHER_R_BUFFER_TOO_SMALL}}));
       }
       {
         std::vector<uint8_t> tag_buf(extra_in_size + tag.size() - 1);
@@ -350,6 +352,8 @@
             tag_buf.size(), nonce.data(), nonce.size(), in.data(),
             in.size() - extra_in_size, in.data() + in.size() - extra_in_size,
             extra_in_size, ad.data(), ad.size()));
+        EXPECT_TRUE(
+            ErrorsAreAndClear({{ERR_LIB_CIPHER, CIPHER_R_BUFFER_TOO_SMALL}}));
       }
     }
   });
@@ -1548,12 +1552,14 @@
     EXPECT_FALSE(EVP_AEAD_CTX_open(ctx.get(), out.data(), &out_len, out.size(),
                                    iv.data(), iv.size(), ct_and_tag.data(),
                                    ct_and_tag.size(), aad.data(), aad.size()));
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_CIPHER, std::nullopt}}));
 
     // Decryption in-place should also fail.
     out = ct_and_tag;
     EXPECT_FALSE(EVP_AEAD_CTX_open(ctx.get(), out.data(), &out_len, out.size(),
                                    iv.data(), iv.size(), out.data(), out.size(),
                                    aad.data(), aad.size()));
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_CIPHER, std::nullopt}}));
   }
 }

boringssl-0.20260708.tar.xz/crypto/cipher/cipher_test.cc -> boringssl-0.20260813.tar.xz/crypto/cipher/cipher_test.cc Changed

@@ -18,6 +18,7 @@
 #include <string.h>
 
 #include <algorithm>
+#include <cstdint>
 #include <string>
 #include <vector>
 
@@ -31,6 +32,7 @@
 #include <openssl/sha.h>
 #include <openssl/span.h>
 
+#include "../fipsmodule/cipher/internal.h"
 #include "../internal.h"
 #include "../test/file_test.h"
 #include "../test/test_util.h"
@@ -1416,5 +1418,186 @@
   }
 }
 
+TEST(CipherTest, RetryAfterError) {
+  const uint8_t kKey16 = {1, 2,  3,  4,  5,  6,  7,  8,
+                            9, 10, 11, 12, 13, 14, 15, 16};
+  const uint8_t kIV16 = {0};
+
+  // Compute a sample plaintext/ciphertext pair.
+  uint8_t plaintext40;
+  for (size_t i = 0; i < sizeof(plaintext); i++) {
+    plaintexti = static_cast<uint8_t>(i);
+  }
+  uint8_t ciphertext48;
+  {
+    bssl::UniquePtr<EVP_CIPHER_CTX> ctx(EVP_CIPHER_CTX_new());
+    ASSERT_TRUE(ctx);
+    ASSERT_TRUE(
+        EVP_EncryptInit_ex(ctx.get(), EVP_aes_128_cbc(), nullptr, kKey, kIV));
+    size_t len1;
+    ASSERT_TRUE(EVP_EncryptUpdate_ex(ctx.get(), ciphertext, &len1,
+                                     sizeof(ciphertext), plaintext,
+                                     sizeof(plaintext)));
+    size_t len2;
+    ASSERT_TRUE(EVP_EncryptFinal_ex2(ctx.get(), ciphertext + len1, &len2,
+                                     sizeof(ciphertext) - len1));
+    ASSERT_EQ(sizeof(ciphertext), len1 + len2);
+  }
+
+  // EncryptUpdate output buffer size error does not poison the context.
+  {
+    bssl::UniquePtr<EVP_CIPHER_CTX> ctx(EVP_CIPHER_CTX_new());
+    ASSERT_TRUE(ctx);
+    ASSERT_TRUE(
+        EVP_EncryptInit_ex(ctx.get(), EVP_aes_128_cbc(), nullptr, kKey, kIV));
+    // Call EVP_EncryptUpdate_ex with too small of a buffer.
+    uint8_t outsizeof(ciphertext);
+    size_t out_len;
+    EXPECT_FALSE(EVP_EncryptUpdate_ex(ctx.get(), out, &out_len, 0, plaintext,
+                                      sizeof(plaintext)));
+    ASSERT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_CIPHER,
+                            CIPHER_R_BUFFER_TOO_SMALL));
+    EXPECT_FALSE(EVP_EncryptUpdate_ex(ctx.get(), out, &out_len,
+                                      31 /* one byte too short */, plaintext,
+                                      sizeof(plaintext)));
+    ASSERT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_CIPHER,
+                            CIPHER_R_BUFFER_TOO_SMALL));
+    // A subsequent call with sufficient output buffer succeeds.
+    ASSERT_TRUE(EVP_EncryptUpdate_ex(ctx.get(), out, &out_len, sizeof(out),
+                                     plaintext, sizeof(plaintext)));
+    EXPECT_EQ(Bytes(out, out_len), Bytes(ciphertext, out_len));
+  }
+
+  // Same as above, but with some buffered plaintext.
+  {
+    bssl::UniquePtr<EVP_CIPHER_CTX> ctx(EVP_CIPHER_CTX_new());
+    ASSERT_TRUE(ctx);
+    ASSERT_TRUE(
+        EVP_EncryptInit_ex(ctx.get(), EVP_aes_128_cbc(), nullptr, kKey, kIV));
+    // Call EVP_EncryptUpdate_ex with too small of a buffer.
+    uint8_t outsizeof(ciphertext);
+    size_t out_len;
+    ASSERT_TRUE(
+        EVP_EncryptUpdate_ex(ctx.get(), out, &out_len, 0, plaintext, 5));
+    EXPECT_EQ(out_len, 0u);
+    auto rest = Span(plaintext).subspan(5);
+    EXPECT_FALSE(EVP_EncryptUpdate_ex(ctx.get(), out, &out_len, 0, rest.data(),
+                                      rest.size()));
+    EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_CIPHER,
+                            CIPHER_R_BUFFER_TOO_SMALL));
+    EXPECT_FALSE(EVP_EncryptUpdate_ex(ctx.get(), out, &out_len,
+                                      31 /* one byte too short */, rest.data(),
+                                      rest.size()));
+    EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_CIPHER,
+                            CIPHER_R_BUFFER_TOO_SMALL));
+    // A subsequent call with sufficient output buffer succeeds.
+    ASSERT_TRUE(EVP_EncryptUpdate_ex(ctx.get(), out, &out_len, sizeof(out),
+                                     rest.data(), rest.size()));
+    EXPECT_EQ(Bytes(out, out_len), Bytes(ciphertext, out_len));
+  }
+
+  // EncryptFinal output buffer size error does not poison the context.
+  {
+    bssl::UniquePtr<EVP_CIPHER_CTX> ctx(EVP_CIPHER_CTX_new());
+    ASSERT_TRUE(ctx);
+    ASSERT_TRUE(
+        EVP_EncryptInit_ex(ctx.get(), EVP_aes_128_cbc(), nullptr, kKey, kIV));
+    uint8_t outsizeof(ciphertext);
+    size_t len1, len2;
+    ASSERT_TRUE(EVP_EncryptUpdate_ex(ctx.get(), out, &len1, sizeof(out),
+                                     plaintext, sizeof(plaintext)));
+    // Call EVP_EncryptFinal_ex2 with too small of a buffer.
+    EXPECT_FALSE(EVP_EncryptFinal_ex2(ctx.get(), out + len1, &len2, 0));
+    EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_CIPHER,
+                            CIPHER_R_BUFFER_TOO_SMALL));
+    EXPECT_FALSE(EVP_EncryptFinal_ex2(ctx.get(), out + len1, &len2,
+                                      sizeof(out) - len1 - 1));
+    EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_CIPHER,
+                            CIPHER_R_BUFFER_TOO_SMALL));
+    // A subsequent call with sufficient output buffer succeeds.
+    ASSERT_TRUE(
+        EVP_EncryptFinal_ex2(ctx.get(), out + len1, &len2, sizeof(out) - len1));
+    EXPECT_EQ(Bytes(out + len1, len2), Bytes(Span(ciphertext).subspan(len1)));
+  }
+
+  // DecryptUpdate output buffer size error does not poison the context.
+  {
+    bssl::UniquePtr<EVP_CIPHER_CTX> ctx(EVP_CIPHER_CTX_new());
+    ASSERT_TRUE(ctx);
+    ASSERT_TRUE(
+        EVP_DecryptInit_ex(ctx.get(), EVP_aes_128_cbc(), nullptr, kKey, kIV));
+    uint8_t outsizeof(plaintext);
+    size_t out_len;
+    // Call EVP_DecryptUpdate_ex with too small of a buffer.
+    EXPECT_FALSE(EVP_DecryptUpdate_ex(ctx.get(), out, &out_len, 0, ciphertext,
+                                      sizeof(ciphertext)));
+    EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_CIPHER,
+                            CIPHER_R_BUFFER_TOO_SMALL));
+    EXPECT_FALSE(EVP_DecryptUpdate_ex(ctx.get(), out, &out_len,
+                                      31 /* one byte too short */, ciphertext,
+                                      sizeof(ciphertext)));
+    EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_CIPHER,
+                            CIPHER_R_BUFFER_TOO_SMALL));
+    // A subsequent call with sufficient output buffer succeeds.
+    ASSERT_TRUE(EVP_DecryptUpdate_ex(ctx.get(), out, &out_len, sizeof(out),
+                                     ciphertext, sizeof(ciphertext)));
+    EXPECT_EQ(Bytes(out, out_len), Bytes(plaintext, out_len));
+  }
+
+  // DecryptFinal output buffer size error does not poison the context.
+  {
+    bssl::UniquePtr<EVP_CIPHER_CTX> ctx(EVP_CIPHER_CTX_new());
+    ASSERT_TRUE(ctx);
+    ASSERT_TRUE(
+        EVP_DecryptInit_ex(ctx.get(), EVP_aes_128_cbc(), nullptr, kKey, kIV));
+    uint8_t outsizeof(plaintext);
+    size_t len1, len2;
+    ASSERT_TRUE(EVP_DecryptUpdate_ex(ctx.get(), out, &len1, sizeof(out),
+                                     ciphertext, sizeof(ciphertext)));
+    // Calling EVP_DecryptFinal_ex2 with too small of a buffer.
+    EXPECT_FALSE(EVP_DecryptFinal_ex2(ctx.get(), out + len1, &len2, 0));
+    EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_CIPHER,
+                            CIPHER_R_BUFFER_TOO_SMALL));
+    EXPECT_FALSE(EVP_DecryptFinal_ex2(ctx.get(), out + len1, &len2,
+                                      sizeof(out) - len1 - 1));
+    EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_CIPHER,
+                            CIPHER_R_BUFFER_TOO_SMALL));
+    // A subsequent call with sufficient output buffer succeeds.
+    ASSERT_TRUE(
+        EVP_DecryptFinal_ex2(ctx.get(), out + len1, &len2, sizeof(out) - len1));
+    EXPECT_EQ(Bytes(out + len1, len2), Bytes(Span(plaintext).subspan(len1)));
+  }
+
+  // DecryptFinal padding failure does not poison the context.
+  //
+  // google/play-licensing, sadly, relies on it by only ever calling `doFinal`
+  // on a cipher object. (Which is known broken as the CBC IV will be wrong for
+  // next call, but as next call's padding will pass if the input string has
+  // correct padding, the IV for the call after will be correct again,
+  // therefore reading bad data once in their `unobfuscate` method will "fix
+  // itself" two calls later). See b/504728350.
+  {
+    uint8_t bad_ciphertext16 = {0};
+    uint8_t out16;
+    int len;
+
+    bssl::UniquePtr<EVP_CIPHER_CTX> ctx(EVP_CIPHER_CTX_new());
+    ASSERT_TRUE(ctx);
+    ASSERT_TRUE(
+        EVP_DecryptInit_ex(ctx.get(), EVP_aes_128_cbc(), nullptr, kKey, kIV));
+    ASSERT_TRUE(EVP_DecryptUpdate(ctx.get(), out, &len, bad_ciphertext,
+                                  sizeof(bad_ciphertext)));
+    // EVP_DecryptFinal_ex fails due to bad padding.
+    EXPECT_FALSE(EVP_DecryptFinal_ex(ctx.get(), out, &len));
+    EXPECT_TRUE(
+        ErrorEquals(ERR_get_error(), ERR_LIB_CIPHER, CIPHER_R_BAD_DECRYPT));
+
+    // Subsequent calls continue to return CIPHER_R_BAD_DECRYPT.
+    EXPECT_FALSE(EVP_DecryptFinal_ex(ctx.get(), out, &len));
+    EXPECT_TRUE(
+        ErrorEquals(ERR_get_error(), ERR_LIB_CIPHER, CIPHER_R_BAD_DECRYPT));
+  }
+}
+
 }  // namespace
 BSSL_NAMESPACE_END

boringssl-0.20260708.tar.xz/crypto/conf/conf_test.cc -> boringssl-0.20260813.tar.xz/crypto/conf/conf_test.cc Changed

boringssl-0.20260708.tar.xz/crypto/crypto_test.cc -> boringssl-0.20260813.tar.xz/crypto/crypto_test.cc Changed

@@ -56,6 +56,74 @@
             CRYPTO_bswap8(UINT64_C(0x0102030405060708)));
 }
 
+TEST(CryptoTest, BitWidth) {
+  EXPECT_EQ(CRYPTO_bit_width(0), 0);
+  EXPECT_EQ(CRYPTO_bit_width(1), 1);
+  EXPECT_EQ(CRYPTO_bit_width(2), 2);
+  EXPECT_EQ(CRYPTO_bit_width(3), 2);
+  EXPECT_EQ(CRYPTO_bit_width(4), 3);
+  EXPECT_EQ(CRYPTO_bit_width(5), 3);
+  EXPECT_EQ(CRYPTO_bit_width(6), 3);
+  EXPECT_EQ(CRYPTO_bit_width(7), 3);
+  EXPECT_EQ(CRYPTO_bit_width(8), 4);
+  EXPECT_EQ(CRYPTO_bit_width(~uint64_t{0}), 64);
+  EXPECT_EQ(CRYPTO_bit_width(~uint64_t{0} - 1), 64);
+}
+
+TEST(CryptoTest, Popcount) {
+  EXPECT_EQ(CRYPTO_popcount(0), 0);
+  EXPECT_EQ(CRYPTO_popcount(1), 1);
+  EXPECT_EQ(CRYPTO_popcount(2), 1);
+  EXPECT_EQ(CRYPTO_popcount(3), 2);
+  EXPECT_EQ(CRYPTO_popcount(4), 1);
+  EXPECT_EQ(CRYPTO_popcount(5), 2);
+  EXPECT_EQ(CRYPTO_popcount(6), 2);
+  EXPECT_EQ(CRYPTO_popcount(7), 3);
+  EXPECT_EQ(CRYPTO_popcount(8), 1);
+  EXPECT_EQ(CRYPTO_popcount(~uint64_t{0}), 64);
+  EXPECT_EQ(CRYPTO_popcount(~uint64_t{0} - 1), 63);
+}
+
+TEST(CryptoTest, BitCeil) {
+  EXPECT_EQ(CRYPTO_bit_ceil(0), 1u);
+  EXPECT_EQ(CRYPTO_bit_ceil(1), 1u);
+  EXPECT_EQ(CRYPTO_bit_ceil(2), 2u);
+  EXPECT_EQ(CRYPTO_bit_ceil(3), 4u);
+  EXPECT_EQ(CRYPTO_bit_ceil(4), 4u);
+  EXPECT_EQ(CRYPTO_bit_ceil(5), 8u);
+  EXPECT_EQ(CRYPTO_bit_ceil(6), 8u);
+  EXPECT_EQ(CRYPTO_bit_ceil(7), 8u);
+  EXPECT_EQ(CRYPTO_bit_ceil(8), 8u);
+  EXPECT_EQ(CRYPTO_bit_ceil(9), 16u);
+}
+
+TEST(CryptoTest, BitFloor) {
+  EXPECT_EQ(CRYPTO_bit_floor(0), 0u);
+  EXPECT_EQ(CRYPTO_bit_floor(1), 1u);
+  EXPECT_EQ(CRYPTO_bit_floor(2), 2u);
+  EXPECT_EQ(CRYPTO_bit_floor(3), 2u);
+  EXPECT_EQ(CRYPTO_bit_floor(4), 4u);
+  EXPECT_EQ(CRYPTO_bit_floor(5), 4u);
+  EXPECT_EQ(CRYPTO_bit_floor(6), 4u);
+  EXPECT_EQ(CRYPTO_bit_floor(7), 4u);
+  EXPECT_EQ(CRYPTO_bit_floor(8), 8u);
+  EXPECT_EQ(CRYPTO_bit_floor(9), 8u);
+}
+
+TEST(CryptoTest, HasSingleBit) {
+  EXPECT_FALSE(CRYPTO_has_single_bit(0));
+  EXPECT_TRUE(CRYPTO_has_single_bit(1));
+  EXPECT_TRUE(CRYPTO_has_single_bit(2));
+  EXPECT_FALSE(CRYPTO_has_single_bit(3));
+  EXPECT_TRUE(CRYPTO_has_single_bit(4));
+  EXPECT_FALSE(CRYPTO_has_single_bit(5));
+  EXPECT_FALSE(CRYPTO_has_single_bit(6));
+  EXPECT_FALSE(CRYPTO_has_single_bit(7));
+  EXPECT_TRUE(CRYPTO_has_single_bit(8));
+  EXPECT_FALSE(CRYPTO_has_single_bit(~uint64_t{0}));
+  EXPECT_TRUE(CRYPTO_has_single_bit(uint64_t{1} << 63));
+}
+
 #if defined(BORINGSSL_FIPS_COUNTERS)
 using CounterArray = size_tfips_counter_max + 1;

boringssl-0.20260708.tar.xz/crypto/dh/dh_test.cc -> boringssl-0.20260813.tar.xz/crypto/dh/dh_test.cc Changed

@@ -428,15 +428,20 @@
   auto check_invalid_group = (DH *dh) {
     // All operations on egregiously invalid groups should fail.
     EXPECT_FALSE(DH_generate_key(dh));
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DH, DH_R_INVALID_PARAMETERS}}));
     int check_result;
     EXPECT_FALSE(DH_check(dh, &check_result));
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DH, DH_R_INVALID_PARAMETERS}}));
     UniquePtr<BIGNUM> pub_key(BN_new());
     ASSERT_TRUE(pub_key);
     ASSERT_TRUE(BN_set_u64(pub_key.get(), 42));
     EXPECT_FALSE(DH_check_pub_key(dh, pub_key.get(), &check_result));
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DH, DH_R_INVALID_PARAMETERS}}));
     uint8_t buf1024;
     EXPECT_EQ(DH_compute_key(buf, pub_key.get(), dh), -1);
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DH, DH_R_INVALID_PARAMETERS}}));
     EXPECT_EQ(DH_compute_key_padded(buf, pub_key.get(), dh), -1);
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DH, DH_R_INVALID_PARAMETERS}}));
   };
 
   UniquePtr<BIGNUM> p(BN_get_rfc3526_prime_2048(nullptr));

boringssl-0.20260708.tar.xz/crypto/digest/digest_test.cc -> boringssl-0.20260813.tar.xz/crypto/digest/digest_test.cc Changed

boringssl-0.20260708.tar.xz/crypto/dsa/dsa_test.cc -> boringssl-0.20260813.tar.xz/crypto/dsa/dsa_test.cc Changed

@@ -197,6 +197,7 @@
       dsa.get(), 10001, /*seed=*/nullptr, /*seed_len=*/0,
       /*out_counter=*/nullptr, /*out_h=*/nullptr,
       /*cb=*/nullptr));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DSA, DSA_R_INVALID_PARAMETERS}}));
 }
 
 TEST(DSATest, GenerateKeyTooLarge) {
@@ -212,6 +213,7 @@
 
   // Don't generate DSA keys if the group is too large.
   EXPECT_FALSE(DSA_generate_key(dsa.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DSA, DSA_R_MODULUS_TOO_LARGE}}));
 }
 
 TEST(DSATest, Verify) {
@@ -223,11 +225,14 @@
   EXPECT_EQ(-1,
             DSA_verify(0, fips_digest, sizeof(fips_digest), fips_sig_negative,
                        sizeof(fips_sig_negative), dsa.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_BN, BN_R_NEGATIVE_NUMBER}}));
   EXPECT_EQ(-1, DSA_verify(0, fips_digest, sizeof(fips_digest), fips_sig_extra,
                            sizeof(fips_sig_extra), dsa.get()));
+  EXPECT_EQ(0u, ERR_peek_error());
   EXPECT_EQ(-1,
             DSA_verify(0, fips_digest, sizeof(fips_digest), fips_sig_bad_length,
                        sizeof(fips_sig_bad_length), dsa.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DSA, DSA_R_DECODE_ERROR}}));
   EXPECT_EQ(0, DSA_verify(0, fips_digest, sizeof(fips_digest), fips_sig_bad_r,
                           sizeof(fips_sig_bad_r), dsa.get()));
 }
@@ -257,6 +262,7 @@
                                    fips_sig_negative, sizeof(fips_sig_negative),
                                    dsa.get()));
   EXPECT_EQ(0, valid);
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_BN, BN_R_NEGATIVE_NUMBER}}));
 
   // Extra data (error)
   valid = 42;
@@ -264,6 +270,7 @@
                                    fips_sig_extra, sizeof(fips_sig_extra),
                                    dsa.get()));
   EXPECT_EQ(0, valid);
+  EXPECT_EQ(0u, ERR_peek_error());
 
   // Bad length (error)
   valid = 42;
@@ -271,6 +278,7 @@
                                    fips_sig_bad_length,
                                    sizeof(fips_sig_bad_length), dsa.get()));
   EXPECT_EQ(0, valid);
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DSA, DSA_R_DECODE_ERROR}}));
 }
 
 TEST(DSATest, InvalidGroup) {
@@ -296,11 +304,13 @@
   ASSERT_TRUE(dsa);
   EXPECT_EQ(-1, DSA_verify(0, fips_digest, sizeof(fips_digest), fips_sig,
                            sizeof(fips_sig), dsa.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DSA, DSA_R_MISSING_PARAMETERS}}));
 
   std::vector<uint8_t> sig(DSA_size(dsa.get()));
   unsigned sig_len;
   EXPECT_FALSE(DSA_sign(0, fips_digest, sizeof(fips_digest), sig.data(),
                         &sig_len, dsa.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DSA, DSA_R_MISSING_PARAMETERS}}));
 }
 
 // Verifying should cleanly fail when the public key is missing.
@@ -309,6 +319,7 @@
   ASSERT_TRUE(dsa);
   EXPECT_EQ(-1, DSA_verify(0, fips_digest, sizeof(fips_digest), fips_sig,
                            sizeof(fips_sig), dsa.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DSA, DSA_R_MISSING_PARAMETERS}}));
 }
 
 // Signing should cleanly fail when the private key is missing.
@@ -320,6 +331,7 @@
   unsigned sig_len;
   EXPECT_FALSE(DSA_sign(0, fips_digest, sizeof(fips_digest), sig.data(),
                         &sig_len, dsa.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DSA, DSA_R_MISSING_PARAMETERS}}));
 }
 
 // A zero private key is invalid and can cause signing to loop forever.
@@ -336,6 +348,7 @@
   unsigned sig_len;
   EXPECT_FALSE(DSA_sign(0, kZeroDigest, sizeof(kZeroDigest), sig.data(),
                         &sig_len, dsa.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DSA, DSA_R_INVALID_PARAMETERS}}));
 }
 
 // If the "field" is actually a ring and the "generator" of the multiplicative
@@ -359,6 +372,7 @@
   unsigned sig_len;
   EXPECT_FALSE(DSA_sign(0, fips_digest, sizeof(fips_digest), sig.data(),
                         &sig_len, dsa.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_DSA, DSA_R_TOO_MANY_ITERATIONS}}));
 }
 
 TEST(DSATest, Overwrite) {

boringssl-0.20260708.tar.xz/crypto/ecdsa/ecdsa_p1363_test.cc -> boringssl-0.20260813.tar.xz/crypto/ecdsa/ecdsa_p1363_test.cc Changed

boringssl-0.20260708.tar.xz/crypto/err/ssl.errordata -> boringssl-0.20260813.tar.xz/crypto/err/ssl.errordata Changed

boringssl-0.20260708.tar.xz/crypto/evp/evp_extra_test.cc -> boringssl-0.20260813.tar.xz/crypto/evp/evp_extra_test.cc Changed

@@ -857,7 +857,11 @@
 
   UniquePtr<EVP_PKEY> pkey(EVP_PKCS82PKEY(p8inf.get()));
   ASSERT_FALSE(pkey) << "Imported invalid EC key";
-  ERR_clear_error();
+  EXPECT_TRUE(ErrorsAreAndClear({
+      {ERR_LIB_EC, EC_R_INVALID_SCALAR},
+      {ERR_LIB_EC, EC_R_INVALID_PRIVATE_KEY},
+      {ERR_LIB_EVP, EVP_R_DECODE_ERROR},
+  }));
 }
 
 // Tests `EVP_marshal_public_key` on an empty key.
@@ -881,18 +885,22 @@
   EXPECT_TRUE(ParsePrivateKey(EVP_PKEY_EC, kExampleECKeyDER));
 
   EXPECT_FALSE(ParsePrivateKey(EVP_PKEY_EC, kExampleBadECKeyDER));
-  ERR_clear_error();
+  EXPECT_TRUE(ErrorsAreAndClear({
+      {ERR_LIB_EC, EC_R_INVALID_SCALAR},
+      {ERR_LIB_EC, EC_R_INVALID_PRIVATE_KEY},
+      {ERR_LIB_EVP, EVP_R_DECODE_ERROR},
+  }));
 
   // Copy the input into a `malloc`'d vector to flag memory errors.
   std::vector<uint8_t> copy(
       kExampleBadECKeyDER2,
       kExampleBadECKeyDER2 + sizeof(kExampleBadECKeyDER2));
   EXPECT_FALSE(ParsePrivateKey(EVP_PKEY_EC, copy));
-  ERR_clear_error();
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_DECODE_ERROR}}));
 
   // Test that an RSA key may not be imported as an EC key.
   EXPECT_FALSE(ParsePrivateKey(EVP_PKEY_EC, kExampleRSAKeyPKCS8));
-  ERR_clear_error();
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES}}));
 }
 
 TEST(EVPExtraTest, Ed25519) {
@@ -1452,6 +1460,7 @@
   // RSA-PSS keys' parameters are not compatible with RSA keys.
   EXPECT_FALSE(EVP_PKEY_parameters_eq(rsa_pss_sha256.get(), rsa.get()));
   EXPECT_FALSE(EVP_PKEY_copy_parameters(rsa_pss_sha256.get(), rsa.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES}}));
 
   // Different RSA-PSS key types are not compatible.
   alg = EVP_pkey_rsa_pss_sha384();
@@ -1463,6 +1472,7 @@
       EVP_PKEY_parameters_eq(rsa_pss_sha256.get(), rsa_pss_sha384.get()));
   EXPECT_FALSE(
       EVP_PKEY_copy_parameters(rsa_pss_sha256.get(), rsa_pss_sha384.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_DIFFERENT_PARAMETERS}}));
 
   // EC keys have parameters, but it is possible to initialize an `EVP_PKEY`
   // with a completely empty `EC_KEY`.
@@ -1503,8 +1513,10 @@
 
   // `EVP_PKEY_copy_parameters` cannot change a key's type or curve.
   EXPECT_FALSE(EVP_PKEY_copy_parameters(rsa.get(), p256.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES}}));
   EXPECT_EQ(EVP_PKEY_RSA, EVP_PKEY_id(rsa.get()));
   EXPECT_FALSE(EVP_PKEY_copy_parameters(rsa.get(), p256.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES}}));
   EXPECT_EQ(EVP_PKEY_RSA, EVP_PKEY_id(rsa.get()));
 }
 
@@ -1552,12 +1564,16 @@
   static const uint8_t kKey = {1, 2, 3, 4};
   EXPECT_FALSE(
       EVP_PKEY_new_raw_public_key(EVP_PKEY_RSA, nullptr, kKey, sizeof(kKey)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM}}));
   EXPECT_FALSE(
       EVP_PKEY_new_raw_private_key(EVP_PKEY_RSA, nullptr, kKey, sizeof(kKey)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM}}));
   EXPECT_FALSE(
       EVP_PKEY_from_raw_public_key(EVP_pkey_rsa(), kKey, sizeof(kKey)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM}}));
   EXPECT_FALSE(
       EVP_PKEY_from_raw_private_key(EVP_pkey_rsa(), kKey, sizeof(kKey)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM}}));
 }
 
 // The default salt length for PSS should be `RSA_PSS_SALTLEN_DIGEST`.
@@ -1664,9 +1680,11 @@
   ScopedCBB cbb;
   ASSERT_TRUE(CBB_init(cbb.get(), 0));
   EXPECT_FALSE(EVP_marshal_public_key(cbb.get(), pkey.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EC, EC_R_UNKNOWN_GROUP}}));
   cbb.Reset();
   ASSERT_TRUE(CBB_init(cbb.get(), 0));
   EXPECT_FALSE(EVP_marshal_private_key(cbb.get(), pkey.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EC, EC_R_UNKNOWN_GROUP}}));
 }
 
 // APIs should avoid creating an `EVP_PKEY` that is missing its underlying data.
@@ -1677,21 +1695,25 @@
   ASSERT_TRUE(pkey);
 
   EXPECT_FALSE(EVP_PKEY_set_type(pkey.get(), EVP_PKEY_RSA));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM}}));
   EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE);
   EXPECT_FALSE(EVP_PKEY_set1_RSA(pkey.get(), nullptr));
   EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE);
 
   EXPECT_FALSE(EVP_PKEY_set_type(pkey.get(), EVP_PKEY_EC));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM}}));
   EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE);
   EXPECT_FALSE(EVP_PKEY_set1_EC_KEY(pkey.get(), nullptr));
   EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE);
 
   EXPECT_FALSE(EVP_PKEY_set_type(pkey.get(), EVP_PKEY_DH));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM}}));
   EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE);
   EXPECT_FALSE(EVP_PKEY_set1_DH(pkey.get(), nullptr));
   EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE);
 
   EXPECT_FALSE(EVP_PKEY_set_type(pkey.get(), EVP_PKEY_DSA));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM}}));
   EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE);
   EXPECT_FALSE(EVP_PKEY_set1_DSA(pkey.get(), nullptr));
   EXPECT_EQ(EVP_PKEY_id(pkey.get()), EVP_PKEY_NONE);
@@ -1711,21 +1733,21 @@
   EXPECT_EQ(EVP_PKEY_id(empty.get()), EVP_PKEY_NONE);
 
   EXPECT_EQ(EVP_PKEY_get_raw_private_key(empty.get(), nullptr, nullptr), 0);
-  EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP,
-                          EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE));
+  EXPECT_TRUE(ErrorsAreAndClear(
+      {{ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE}}));
   EXPECT_EQ(EVP_PKEY_get_private_seed(empty.get(), nullptr, nullptr), 0);
-  EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP,
-                          EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE));
+  EXPECT_TRUE(ErrorsAreAndClear(
+      {{ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE}}));
   EXPECT_EQ(EVP_PKEY_get_raw_public_key(empty.get(), nullptr, nullptr), 0);
-  EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP,
-                          EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE));
+  EXPECT_TRUE(ErrorsAreAndClear(
+      {{ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE}}));
 
   EXPECT_EQ(EVP_PKEY_get1_tls_encodedpoint(empty.get(), nullptr), 0u);
-  EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP,
-                          EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE));
+  EXPECT_TRUE(ErrorsAreAndClear(
+      {{ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE}}));
   EXPECT_EQ(EVP_PKEY_set1_tls_encodedpoint(empty.get(), nullptr, 0u), 0);
-  EXPECT_TRUE(ErrorEquals(ERR_peek_last_error(), ERR_LIB_EVP,
-                          EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE));
+  EXPECT_TRUE(ErrorsAreAndClear(
+      {{ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE}}));
 }
 
 // Due to an OpenSSL API flaw, it is possible to make a half-empty X25519 key.

boringssl-0.20260708.tar.xz/crypto/evp/evp_test.cc -> boringssl-0.20260813.tar.xz/crypto/evp/evp_test.cc Changed

@@ -41,6 +41,7 @@
 #include <openssl/rsa.h>
 #include <openssl/xwing.h>
 
+#include "../bytestring/internal.h"
 #include "../test/der_trailing_data.h"
 #include "../test/file_test.h"
 #include "../test/test_util.h"
@@ -48,11 +49,25 @@
 
 BSSL_NAMESPACE_BEGIN
 namespace {
-// evp_test dispatches between multiple test types. PublicKey and PrivateKey
-// tests take a key name parameter and key information. If the test is
-// successful, the key is saved under that key name. Decrypt, Sign, and Verify
-// tests take a previously imported key name as parameter and test their
-// respective operations.
+
+// Each test in evp_test tests a different operation, based on the type of the
+// first attribute.
+//
+// A test of type "Key" tests key import and takes both key name parameter and
+// key information. The key information describes the key and activate the many
+// APIs we have for importing and exporting keys. These APIs are all expected to
+// import equivalent keys, except that some may or may not have the private half
+// available. If the test is successful, the key is saved in a "key set" under
+// the key name.
+//
+// Tests for individual operations, such as "Decrypt" or "Sign", may reference a
+// previously imported key as parameter. By default, the test will run with all
+// keys in the key set. A "/PublicOnly" suffix on the key name will limit to
+// only those without the private half. A "/Private" suffix will limit to only
+// those with the private half.
+//
+// A test that is expected to fail should have an "Error" attribute specifying
+// the expected error.
 
 const EVP_MD *GetDigest(std::string_view name) {
   if (name == "MD5") {
@@ -97,9 +112,7 @@
 };
 
 const std::map<std::string, AlgorithmInfo> kAllAlgorithms = {
-    {"RSA",
-     {EVP_pkey_rsa(),
-      /*kem=*/nullptr, EVP_PKEY_RSA, true}},
+    {"RSA", {EVP_pkey_rsa(), /*kem=*/nullptr, EVP_PKEY_RSA, true}},
 
     {"RSA-PSS-SHA-256",
      {EVP_pkey_rsa_pss_sha256(), /*kem=*/nullptr, EVP_PKEY_RSA_PSS, false}},
@@ -135,10 +148,240 @@
     {"X-Wing", {EVP_pkey_xwing(), EVP_kem_xwing(), EVP_PKEY_XWING, false}},
 };
 
-using KeyMap = std::map<std::string, bssl::UniquePtr<EVP_PKEY>>;
-
 enum class KeyRole { kPublic, kPrivate };
 
+struct SourceAndKey {
+  KeyRole role = KeyRole::kPublic;
+  std::string source;
+  UniquePtr<EVP_PKEY> pkey;
+};
+
+using KeySet = std::vector<SourceAndKey>;
+using KeyMap = std::map<std::string, KeySet, std::less<>>;
+
+enum class KeyRoleSelect { kAny, kPublicOnly, kPrivate };
+
+bool KeyRoleMatches(KeyRoleSelect select, KeyRole role) {
+  switch (select) {
+    case KeyRoleSelect::kAny:
+      return true;
+    case KeyRoleSelect::kPublicOnly:
+      return role == KeyRole::kPublic;
+    case KeyRoleSelect::kPrivate:
+      return role == KeyRole::kPrivate;
+  }
+  abort();
+}
+
+std::vector<const SourceAndKey *> FindKeys(
+    const KeyMap *key_map, std::string_view name,
+    std::optional<KeyRoleSelect> override_select = std::nullopt) {
+  KeyRoleSelect select = KeyRoleSelect::kAny;
+  size_t slash = name.find('/');
+  if (slash != std::string_view::npos) {
+    std::string_view select_str = name.substr(slash + 1);
+    name = name.substr(0, slash);
+    if (select_str == "PublicOnly") {
+      select = KeyRoleSelect::kPublicOnly;
+    } else if (select_str == "Private") {
+      select = KeyRoleSelect::kPrivate;
+    } else {
+      ADD_FAILURE() << "Unknown selector " << select_str;
+      return {};
+    }
+  }
+
+  select = override_select.value_or(select);
+
+  auto it = key_map->find(name);
+  if (it == key_map->end()) {
+    ADD_FAILURE() << "Could not find key " << name;
+    return {};
+  }
+
+  std::vector<const SourceAndKey *> keys;
+  for (const auto &key : it->second) {
+    if (KeyRoleMatches(select, key.role)) {
+      keys.push_back(&key);
+    }
+  }
+
+  if (keys.empty()) {
+    ADD_FAILURE() << "Could not find keys of matching type in " << name;
+    return {};
+  }
+
+  return keys;
+}
+
+bool ImportSPKIOrPKCS8WithAllAlgs(FileTest *t, KeySet *key_set,
+                                  KeyRole key_role, std::string_view attr) {
+  SCOPED_TRACE(attr);
+  if (!t->HasAttribute(attr)) {
+    return true;  // Nothing to import.
+  }
+  std::vector<uint8_t> input;
+  if (!t->GetBytes(&input, attr)) {
+    return false;
+  }
+  std::vector<const EVP_PKEY_ALG *> algs;
+  for (const auto &name, info : kAllAlgorithms) {
+    algs.push_back(info.alg);
+  }
+  auto parse_func = key_role == KeyRole::kPublic
+                        ? &EVP_PKEY_from_subject_public_key_info
+                        : &EVP_PKEY_from_private_key_info;
+  UniquePtr<EVP_PKEY> key(
+      parse_func(input.data(), input.size(), algs.data(), algs.size()));
+  if (key == nullptr) {
+    return false;
+  }
+  key_set->push_back(
+      {key_role, std::string(attr) + " - all algs", std::move(key)});
+
+  return true;
+}
+
+bool ImportSPKIOrPKCS8WithAlg(FileTest *t, KeySet *key_set, KeyRole key_role,
+                              const AlgorithmInfo &alg_info,
+                              std::string_view attr) {
+  SCOPED_TRACE(attr);
+  if (!t->HasAttribute(attr)) {
+    return true;  // Nothing to import.
+  }
+  std::vector<uint8_t> input;
+  if (!t->GetBytes(&input, attr)) {
+    return false;
+  }
+  auto parse_func = key_role == KeyRole::kPublic
+                        ? &EVP_PKEY_from_subject_public_key_info
+                        : &EVP_PKEY_from_private_key_info;
+  UniquePtr<EVP_PKEY> key(
+      parse_func(input.data(), input.size(), &alg_info.alg, 1));
+  if (key == nullptr) {
+    return false;
+  }
+  key_set->push_back(
+      {key_role, std::string(attr) + " - specified alg", std::move(key)});
+
+  // Test that the parsers reject trailing data.
+  bool ok =
+      TestDERTrailingData(input, &(Span<const uint8_t> rewritten, size_t n) {
+        // We currently intentionally ignore trailing data in the outermost
+        // PKCS#8 PrivateKeyInfo element because we don't parse the attributes.
+        if (n == 0 && key_role == KeyRole::kPrivate) {
+          return;
+        }
+        SCOPED_TRACE(n);
+        UniquePtr<EVP_PKEY> parsed(
+            parse_func(rewritten.data(), rewritten.size(), &alg_info.alg, 1));
+        EXPECT_FALSE(parsed);
+        EXPECT_TRUE(ErrorsAreAndClear({{std::nullopt, std::nullopt}}));
+      });
+  EXPECT_TRUE(ok);
+
+  // Also parse with the default algorithms.
+  auto parse_default_func = key_role == KeyRole::kPublic
+                                ? &EVP_parse_public_key
+                                : &EVP_parse_private_key;
+  CBS cbs(input);
+  key.reset(parse_default_func(&cbs));
+  if (key == nullptr || CBS_len(&cbs) != 0) {
+    EXPECT_FALSE(alg_info.is_default);
+    if (alg_info.is_default) {
+      ERR_clear_error();
+    } else {
+      EXPECT_TRUE(
+          ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM}}));
+    }
+  } else {
+    EXPECT_TRUE(alg_info.is_default);
+    key_set->push_back({key_role, std::string(attr) + " - default algorithms",
+                        std::move(key)});
+  }
+
+  return true;
+}
+
+// Many parsing functions have a similar type signature.
+bool ImportWithAlgCommon(FileTest *t, KeySet *key_set, KeyRole key_role,
+                         std::string_view attr, const AlgorithmInfo &alg_info,
+                         EVP_PKEY *(*parse_func)(const EVP_PKEY_ALG *,
+                                                 const uint8_t *, size_t)) {
+  SCOPED_TRACE(attr);
+  if (!t->HasAttribute(attr) ||
+      t->HasAttribute("SkipImport" + std::string(attr))) {
+    return true;  // Nothing to import.
+  }
+  std::vector<uint8_t> input;
+  if (!t->GetBytes(&input, attr)) {
+    return false;
+  }
+  UniquePtr<EVP_PKEY> key(parse_func(alg_info.alg, input.data(), input.size()));
+  if (key == nullptr) {
+    return false;
+  }
+  key_set->push_back({key_role, std::string(attr), std::move(key)});
+  return true;
+}
+
+bool ImportRSAPublicParams(FileTest *t, KeySet *key_set,
+                           const AlgorithmInfo &alg_info) {
+  if (alg_info.pkey_id != EVP_PKEY_RSA || !t->HasAttribute("RSAParamN") ||
+      !t->HasAttribute("RSAParamE")) {
+    return true;  // Nothing to import.
+  }
+  UniquePtr<BIGNUM> n = HexToBIGNUM(t->GetAttributeOrDie("RSAParamN").c_str());
+  UniquePtr<BIGNUM> e = HexToBIGNUM(t->GetAttributeOrDie("RSAParamE").c_str());
+  if (n == nullptr || e == nullptr) {
+    return false;
+  }
+  UniquePtr<RSA> rsa(RSA_new_public_key(n.get(), e.get()));
+  UniquePtr<EVP_PKEY> key(EVP_PKEY_new());
+  if (rsa == nullptr || key == nullptr ||
+      !EVP_PKEY_set1_RSA(key.get(), rsa.get())) {
+    return false;
+  }
+  key_set->push_back({KeyRole::kPublic, "RSA public params", std::move(key)});
+  return true;
+}
+
+bool ImportRSAPrivateParams(FileTest *t, KeySet *key_set,
+                            const AlgorithmInfo &alg_info) {
+  if (alg_info.pkey_id != EVP_PKEY_RSA || !t->HasAttribute("RSAParamN") ||
+      !t->HasAttribute("RSAParamE") || !t->HasAttribute("RSAParamD") ||
+      !t->HasAttribute("RSAParamP") || !t->HasAttribute("RSAParamQ") ||
+      !t->HasAttribute("RSAParamDMP1") || !t->HasAttribute("RSAParamDMQ1") ||
+      !t->HasAttribute("RSAParamIQMP")) {
+    return true;  // Nothing to import.
+  }
+  UniquePtr<BIGNUM> n = HexToBIGNUM(t->GetAttributeOrDie("RSAParamN").c_str());
+  UniquePtr<BIGNUM> e = HexToBIGNUM(t->GetAttributeOrDie("RSAParamE").c_str());
+  UniquePtr<BIGNUM> d = HexToBIGNUM(t->GetAttributeOrDie("RSAParamD").c_str());
+  UniquePtr<BIGNUM> p = HexToBIGNUM(t->GetAttributeOrDie("RSAParamP").c_str());
+  UniquePtr<BIGNUM> q = HexToBIGNUM(t->GetAttributeOrDie("RSAParamQ").c_str());
+  UniquePtr<BIGNUM> dmp1 =
+      HexToBIGNUM(t->GetAttributeOrDie("RSAParamDMP1").c_str());
+  UniquePtr<BIGNUM> dmq1 =
+      HexToBIGNUM(t->GetAttributeOrDie("RSAParamDMQ1").c_str());
+  UniquePtr<BIGNUM> iqmp =
+      HexToBIGNUM(t->GetAttributeOrDie("RSAParamIQMP").c_str());
+  if (n == nullptr || e == nullptr || d == nullptr || p == nullptr ||
+      q == nullptr || dmp1 == nullptr || dmq1 == nullptr || iqmp == nullptr) {
+    return false;
+  }
+  UniquePtr<RSA> rsa(RSA_new_private_key(n.get(), e.get(), d.get(), p.get(),
+                                         q.get(), dmp1.get(), dmq1.get(),
+                                         iqmp.get()));
+  UniquePtr<EVP_PKEY> key(EVP_PKEY_new());
+  if (rsa == nullptr || key == nullptr ||
+      !EVP_PKEY_set1_RSA(key.get(), rsa.get())) {
+    return false;
+  }
+  key_set->push_back({KeyRole::kPrivate, "RSA private params", std::move(key)});
+  return true;
+}
+
 void CheckRSAParam(FileTest *t, std::string_view attr_name,
                    const EVP_PKEY *pkey,
                    const BIGNUM *(*rsa_getter)(const RSA *)) {
@@ -161,12 +404,41 @@
   // not currently assert that we omit them.
 }
 
-bool CheckRawKey(FileTest *t, std::string_view attr_name, const EVP_PKEY *pkey,
+bool CheckMarshalCBB(FileTest *t, std::string_view attr_name,
+                     KeyRoleSelect role_select, const SourceAndKey &key,
+                     int (*marshal_func)(CBB *cbb, const EVP_PKEY *pkey)) {
+  SCOPED_TRACE(attr_name);
+  ScopedCBB cbb;
+  if (!CBB_init(cbb.get(), 0)) {
+    return false;
+  }
+  if (!t->HasAttribute(attr_name) || !KeyRoleMatches(role_select, key.role)) {
+    EXPECT_FALSE(marshal_func(cbb.get(), key.pkey.get()))
+        << "Marshaling key unexpectedly succeeded with "
+        << Bytes(CBBAsSpan(cbb.get()));
+    ERR_clear_error();
+    return true;
+  }
+  std::vector<uint8_t> expected;
+  if (!t->GetBytes(&expected, attr_name)) {
+    return false;
+  }
+  if (!marshal_func(cbb.get(), key.pkey.get())) {
+    return false;
+  }
+  EXPECT_EQ(Bytes(CBBAsSpan(cbb.get())), Bytes(expected));
+  return true;
+}
+
+bool CheckRawKey(FileTest *t, std::string_view attr_name,
+                 KeyRoleSelect role_select, const SourceAndKey &key,
                  int (*getter)(const EVP_PKEY *pkey, uint8_t *out,
                                size_t *out_len)) {
-  if (!t->HasAttribute(attr_name)) {
+  SCOPED_TRACE(attr_name);
+  if (!t->HasAttribute(attr_name) || !KeyRoleMatches(role_select, key.role)) {
     size_t len;
-    EXPECT_FALSE(getter(pkey, nullptr, &len));
+    EXPECT_FALSE(getter(key.pkey.get(), nullptr, &len));
+    ERR_clear_error();
     return true;
   }
 
@@ -177,12 +449,12 @@
 
   std::vector<uint8_t> raw;
   size_t len;
-  if (!getter(pkey, nullptr, &len)) {
+  if (!getter(key.pkey.get(), nullptr, &len)) {
     return false;
   }
   const size_t expected_len = len;
   raw.resize(len);
-  if (!getter(pkey, raw.data(), &len)) {
+  if (!getter(key.pkey.get(), raw.data(), &len)) {
     return false;
   }
   EXPECT_EQ(len, expected_len);
@@ -192,120 +464,43 @@
   // Short buffers should be rejected.
   raw.resize(expected_len - 1);
   len = raw.size();
-  EXPECT_FALSE(getter(pkey, raw.data(), &len));
+  EXPECT_FALSE(getter(key.pkey.get(), raw.data(), &len));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_BUFFER_TOO_SMALL}}));
 
   // Long buffer should be accepted and the proper length written out.
   raw.resize(expected_len + 1);
   len = raw.size();
-  EXPECT_TRUE(getter(pkey, raw.data(), &len));
+  EXPECT_TRUE(getter(key.pkey.get(), raw.data(), &len));
   EXPECT_EQ(len, expected_len);
   raw.resize(len);
   EXPECT_EQ(Bytes(raw), Bytes(expected));
   return true;
 }
 
-bool ImportRawKey(FileTest *t, KeyMap *key_map, KeyRole key_role,
-                  bool use_seed) {
-  auto parse_func = key_role == KeyRole::kPublic
-                        ? &EVP_PKEY_from_raw_public_key
-                        : (use_seed ? &EVP_PKEY_from_private_seed
-                                    : &EVP_PKEY_from_raw_private_key);
-  auto getter = key_role == KeyRole::kPublic
-                    ? &EVP_PKEY_get_raw_public_key
-                    : (use_seed ? &EVP_PKEY_get_private_seed
-                                : &EVP_PKEY_get_raw_private_key);
-  std::string alg_name;
-  if (!t->GetAttribute(&alg_name, "Algorithm")) {
-    return false;
-  }
-  const auto it = kAllAlgorithms.find(alg_name);
-  if (it == kAllAlgorithms.end()) {
-    ADD_FAILURE() << "Unknown algorithm: " << alg_name;
-    return false;
-  }
-  const AlgorithmInfo &alg_info = it->second;
-
-  std::vector<uint8_t> input;
-  if (!t->GetBytes(&input, "Input")) {
-    return false;
-  }
-  UniquePtr<EVP_PKEY> pkey(
-      parse_func(alg_info.alg, input.data(), input.size()));
-  if (pkey == nullptr) {
-    return false;
-  }
-  if (!CheckRawKey(t, "Input", pkey.get(), getter)) {
-    return false;
-  }
-  // Ensure the other raw getters are consistent with the input.
-  if ((t->HasAttribute("RawPrivate") &&
-       !CheckRawKey(t, "RawPrivate", pkey.get(),
-                    EVP_PKEY_get_raw_private_key)) ||
-      (t->HasAttribute("RawPublic") &&
-       !CheckRawKey(t, "RawPublic", pkey.get(), EVP_PKEY_get_raw_public_key)) ||
-      (t->HasAttribute("PrivateSeed") &&
-       !CheckRawKey(t, "PrivateSeed", pkey.get(), EVP_PKEY_get_private_seed))) {
-    return false;
-  }
-
-  // Save the key for future tests.
-  const std::string &key_name = t->GetParameter();
-  EXPECT_EQ(0u, key_map->count(key_name)) << "Duplicate key: " << key_name;
-  (*key_map)key_name = std::move(pkey);
-  return true;
-}
-
-bool ImportKey(FileTest *t, KeyMap *key_map, KeyRole key_role) {
-  std::string format_name = key_role == KeyRole::kPublic ? "spki" : "pkcs8";
-  auto parse_func = key_role == KeyRole::kPublic
-                        ? &EVP_PKEY_from_subject_public_key_info
-                        : &EVP_PKEY_from_private_key_info;
-  auto parse_default_func = key_role == KeyRole::kPublic
-                                ? &EVP_parse_public_key
-                                : &EVP_parse_private_key;
-  auto marshal_func = key_role == KeyRole::kPublic ? &EVP_marshal_public_key
-                                                   : &EVP_marshal_private_key;
-
-  // This test will first import the key from all available methods, then check
-  // that all properties on all keys match.
-  std::vector<std::pair<std::string, bssl::UniquePtr<EVP_PKEY>>> keys;
-
-  // Parse from SPKI or PKCS#8.
-  std::vector<uint8_t> input;
-  if (!t->GetBytes(&input, "Input")) {
-    return false;
-  }
+bool ImportKey(FileTest *t, KeyMap *key_map) {
+  // Fill in `key_set` with every import method we have that matches `t`.
+  KeySet key_set;
+
+  const std::pair<KeyRole, std::string_view> kSPKIOrPKCS8 = {
+      {KeyRole::kPublic, "SPKI"},
+      {KeyRole::kPublic, "SPKINonCanonical"},
+      {KeyRole::kPrivate, "PKCS8"},
+      {KeyRole::kPrivate, "PKCS8NonCanonical"},
+      // TODO(davidben): Give FileTest a better API for repeat attributes. For
+      // now, just manually loop up to the highest that exists.
+      {KeyRole::kPrivate, "PKCS8NonCanonical/2"},
+      {KeyRole::kPrivate, "PKCS8NonCanonical/3"},
+  };
 
-  // First, parse the key with all algorithms active. Check this before
-  // specifying an individual algorithm, so that error cases do not need to
-  // specify an Algorithm key.
-  std::vector<const EVP_PKEY_ALG *> algs;
-  for (const auto &name, info : kAllAlgorithms) {
-    algs.push_back(info.alg);
-  }
-  bssl::UniquePtr<EVP_PKEY> new_key(
-      parse_func(input.data(), input.size(), algs.data(), algs.size()));
-  if (new_key == nullptr) {
-    return false;
+  // Parse the key with all algorithms active. Check this before extracting
+  // Algorithm, so that error cases do not need to specify an Algorithm key.
+  for (const auto &role, attr : kSPKIOrPKCS8) {
+    if (!ImportSPKIOrPKCS8WithAllAlgs(t, &key_set, role, attr)) {
+      return false;
+    }
   }
-  keys.emplace_back(format_name + " - all algs", std::move(new_key));
 
-  // Test that the parsers reject trailing data.
-  bool ok = TestDERTrailingData(
-      input, &(bssl::Span<const uint8_t> rewritten, size_t n) {
-        // We currently intentionally ignore trailing data in the outermost
-        // PKCS#8 PrivateKeyInfo element because we don't parse the attributes.
-        if (n == 0 && key_role == KeyRole::kPrivate) {
-          return;
-        }
-        SCOPED_TRACE(n);
-        bssl::UniquePtr<EVP_PKEY> parsed(parse_func(
-            rewritten.data(), rewritten.size(), algs.data(), algs.size()));
-        EXPECT_FALSE(parsed);
-      });
-  EXPECT_TRUE(ok);
-
-  // Parse with just the specific algorithm.
+  // All other methods depend on Algorithm.
   std::string alg_name;
   if (!t->GetAttribute(&alg_name, "Algorithm")) {
     return false;
@@ -316,214 +511,134 @@
     return false;
   }
   const AlgorithmInfo &alg_info = it->second;
-  new_key.reset(parse_func(input.data(), input.size(), &alg_info.alg, 1));
-  if (new_key == nullptr) {
-    return false;
-  }
-  keys.emplace_back(format_name + " - " + alg_name + " only",
-                    std::move(new_key));
-
-  // Parsing with all other algorithms should fail. This currently assumes each
-  // key can only be parsed by one algorithm. Make the field a list of
-  // algorithms if this ever changes.
-  algs.clear();
-  for (const auto &name, info : kAllAlgorithms) {
-    if (name != alg_name) {
-      algs.push_back(info.alg);
-    }
-  }
-  new_key.reset(
-      parse_func(input.data(), input.size(), algs.data(), algs.size()));
-  EXPECT_FALSE(new_key);
-  ERR_clear_error();
-
-  // Parse with the default parser.
-  CBS cbs(input);
-  new_key.reset(parse_default_func(&cbs));
-  if (alg_info.is_default) {
-    if (new_key == nullptr) {
+  for (const auto &role, attr : kSPKIOrPKCS8) {
+    if (!ImportSPKIOrPKCS8WithAlg(t, &key_set, role, alg_info, attr)) {
       return false;
     }
-    keys.emplace_back(format_name + " - default algorithms",
-                      std::move(new_key));
-  } else {
-    EXPECT_FALSE(new_key);
-    ERR_clear_error();
   }
 
-  // Import as a raw key.
-  if (key_role == KeyRole::kPublic && t->HasAttribute("RawPublic")) {
-    std::vector<uint8_t> raw;
-    if (!t->GetBytes(&raw, "RawPublic")) {
-      return false;
-    }
-    new_key.reset(
-        EVP_PKEY_from_raw_public_key(alg_info.alg, raw.data(), raw.size()));
-    if (new_key == nullptr) {
-      return false;
-    }
-    keys.emplace_back("raw public", std::move(new_key));
+
+  // Import various type-specific formats.
+  if (!ImportWithAlgCommon(t, &key_set, KeyRole::kPublic, "RawPublic", alg_info,
+                           &EVP_PKEY_from_raw_public_key) ||
+      !ImportWithAlgCommon(t, &key_set, KeyRole::kPrivate, "RawPrivate",
+                           alg_info, &EVP_PKEY_from_raw_private_key) ||
+      !ImportWithAlgCommon(t, &key_set, KeyRole::kPrivate, "PrivateSeed",
+                           alg_info, &EVP_PKEY_from_private_seed) ||
+      !ImportWithAlgCommon(t, &key_set, KeyRole::kPublic, "ECUncompressedPoint",
+                           alg_info, &EVP_PKEY_from_ec_uncompressed_point) ||
+      !ImportWithAlgCommon(t, &key_set, KeyRole::kPublic, "ECCompressedPoint",
+                           alg_info, &EVP_PKEY_from_ec_compressed_point) ||
+      !ImportWithAlgCommon(t, &key_set, KeyRole::kPrivate, "ECPrivateScalar",
+                           alg_info, &EVP_PKEY_from_ec_private_scalar) ||
+      !ImportWithAlgCommon(t, &key_set, KeyRole::kPublic, "RSAPublicKey",
+                           alg_info, &EVP_PKEY_from_rsa_public_key) ||
+      !ImportWithAlgCommon(t, &key_set, KeyRole::kPrivate, "RSAPrivateKey",
+                           alg_info, &EVP_PKEY_from_rsa_private_key) ||
+      !ImportRSAPublicParams(t, &key_set, alg_info) ||
+      !ImportRSAPrivateParams(t, &key_set, alg_info)) {
+    return false;
   }
-  if (key_role == KeyRole::kPrivate && t->HasAttribute("RawPrivate")) {
-    std::vector<uint8_t> raw;
-    if (!t->GetBytes(&raw, "RawPrivate")) {
-      return false;
-    }
-    new_key.reset(
-        EVP_PKEY_from_raw_private_key(alg_info.alg, raw.data(), raw.size()));
-    if (new_key == nullptr) {
-      return false;
-    }
-    keys.emplace_back("raw private", std::move(new_key));
+
+  if (key_set.empty()) {
+    ADD_FAILURE() << "No keys imported";
+    return false;
   }
-  if (key_role == KeyRole::kPrivate && t->HasAttribute("PrivateSeed")) {
-    std::vector<uint8_t> raw;
-    if (!t->GetBytes(&raw, "PrivateSeed")) {
-      return false;
-    }
-    new_key.reset(
-        EVP_PKEY_from_private_seed(alg_info.alg, raw.data(), raw.size()));
-    if (new_key == nullptr) {
-      return false;
-    }
-    keys.emplace_back("private seed", std::move(new_key));
-  }
-
-  // Import RSA key from parameters.
-  if (alg_info.pkey_id == EVP_PKEY_RSA) {
-    if (key_role == KeyRole::kPublic && t->HasAttribute("RSAParamN") &&
-        t->HasAttribute("RSAParamE")) {
-      bssl::UniquePtr<BIGNUM> n =
-          HexToBIGNUM(t->GetAttributeOrDie("RSAParamN").c_str());
-      bssl::UniquePtr<BIGNUM> e =
-          HexToBIGNUM(t->GetAttributeOrDie("RSAParamE").c_str());
-      if (n == nullptr || e == nullptr) {
-        return false;
-      }
-      bssl::UniquePtr<RSA> rsa(RSA_new_public_key(n.get(), e.get()));
-      new_key.reset(EVP_PKEY_new());
-      if (rsa == nullptr || new_key == nullptr ||
-          !EVP_PKEY_set1_RSA(new_key.get(), rsa.get())) {
+
+  // Add a key that went through `EVP_PKEY_copy_public` to the mix, one from
+  // each role.
+  for (KeyRole role : {KeyRole::kPublic, KeyRole::kPrivate}) {
+    auto found =
+        std::find_if(key_set.begin(), key_set.end(),
+                     =(const SourceAndKey &key) { return key.role == role; });
+    if (found != key_set.end()) {
+      UniquePtr<EVP_PKEY> public_copy(EVP_PKEY_copy_public(found->pkey.get()));
+      if (!public_copy) {
         return false;
       }
-      keys.emplace_back("RSA public params", std::move(new_key));
+      key_set.push_back({KeyRole::kPublic,
+                         role == KeyRole::kPublic
+                             ? "public copied from public"
+                             : "public copied from private",
+                         std::move(public_copy)});
     }
-    if (key_role == KeyRole::kPrivate && t->HasAttribute("RSAParamN") &&
-        t->HasAttribute("RSAParamE") && t->HasAttribute("RSAParamD") &&
-        t->HasAttribute("RSAParamP") && t->HasAttribute("RSAParamQ") &&
-        t->HasAttribute("RSAParamDMP1") && t->HasAttribute("RSAParamDMQ1") &&
-        t->HasAttribute("RSAParamIQMP")) {
-      bssl::UniquePtr<BIGNUM> n =
-          HexToBIGNUM(t->GetAttributeOrDie("RSAParamN").c_str());
-      bssl::UniquePtr<BIGNUM> e =
-          HexToBIGNUM(t->GetAttributeOrDie("RSAParamE").c_str());
-      bssl::UniquePtr<BIGNUM> d =
-          HexToBIGNUM(t->GetAttributeOrDie("RSAParamD").c_str());
-      bssl::UniquePtr<BIGNUM> p =
-          HexToBIGNUM(t->GetAttributeOrDie("RSAParamP").c_str());
-      bssl::UniquePtr<BIGNUM> q =
-          HexToBIGNUM(t->GetAttributeOrDie("RSAParamQ").c_str());
-      bssl::UniquePtr<BIGNUM> dmp1 =
-          HexToBIGNUM(t->GetAttributeOrDie("RSAParamDMP1").c_str());
-      bssl::UniquePtr<BIGNUM> dmq1 =
-          HexToBIGNUM(t->GetAttributeOrDie("RSAParamDMQ1").c_str());
-      bssl::UniquePtr<BIGNUM> iqmp =
-          HexToBIGNUM(t->GetAttributeOrDie("RSAParamIQMP").c_str());
-      if (n == nullptr || e == nullptr) {
-        return false;
-      }
-      bssl::UniquePtr<RSA> rsa(RSA_new_private_key(n.get(), e.get(), d.get(),
-                                                   p.get(), q.get(), dmp1.get(),
-                                                   dmq1.get(), iqmp.get()));
-      new_key.reset(EVP_PKEY_new());
-      if (rsa == nullptr || new_key == nullptr ||
-          !EVP_PKEY_set1_RSA(new_key.get(), rsa.get())) {
-        return false;
-      }
-      keys.emplace_back("RSA private params", std::move(new_key));
+  }
+
+  // All keys, public or private, must compare equal:
+  for (const auto &key1 : key_set) {
+    SCOPED_TRACE("source: " + key1.source);
+    for (const auto &key2 : key_set) {
+      SCOPED_TRACE("source: " + key2.source);
+      EXPECT_EQ(EVP_PKEY_eq(key1.pkey.get(), key2.pkey.get()), 1);
     }
   }
 
   // Check properties of the keys.
-  for (const auto &name, pkey : keys) {
-    SCOPED_TRACE(name);
+  for (const auto &key : key_set) {
+    SCOPED_TRACE("source: " + key.source);
 
-    EXPECT_EQ(alg_info.pkey_id, EVP_PKEY_id(pkey.get()));
+    EXPECT_EQ(alg_info.pkey_id, EVP_PKEY_id(key.pkey.get()));
 
     // In almost all cases, a non-empty key must have a public key. The only
     // exception is a private RSA key with (n, d) params only, which is tested
     // not here but elsewhere.
-    EXPECT_EQ(EVP_PKEY_has_public(pkey.get()), 1);
-    EXPECT_EQ(EVP_PKEY_has_private(pkey.get()), key_role == KeyRole::kPrivate);
+    EXPECT_EQ(EVP_PKEY_has_public(key.pkey.get()), 1);
+    EXPECT_EQ(EVP_PKEY_has_private(key.pkey.get()),
+              key.role == KeyRole::kPrivate);
 
     if (t->HasAttribute("Bits")) {
-      EXPECT_EQ(EVP_PKEY_bits(pkey.get()),
+      EXPECT_EQ(EVP_PKEY_bits(key.pkey.get()),
                 atoi(t->GetAttributeOrDie("Bits").c_str()));
     }
 
     if (t->HasAttribute("ECCurve")) {
-      EXPECT_EQ(OBJ_nid2sn(EVP_PKEY_get_ec_curve_nid(pkey.get())),
+      EXPECT_EQ(OBJ_nid2sn(EVP_PKEY_get_ec_curve_nid(key.pkey.get())),
                 t->GetAttributeOrDie("ECCurve"));
     } else {
-      EXPECT_EQ(EVP_PKEY_get_ec_curve_nid(pkey.get()), NID_undef);
+      EXPECT_EQ(EVP_PKEY_get_ec_curve_nid(key.pkey.get()), NID_undef);
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_EXPECTING_A_EC_KEY}}));
     }
 
-    CheckRSAParam(t, "RSAParamN", pkey.get(), RSA_get0_n);
-    CheckRSAParam(t, "RSAParamE", pkey.get(), RSA_get0_e);
-    CheckRSAParam(t, "RSAParamD", pkey.get(), RSA_get0_d);
-    CheckRSAParam(t, "RSAParamP", pkey.get(), RSA_get0_p);
-    CheckRSAParam(t, "RSAParamQ", pkey.get(), RSA_get0_q);
-    CheckRSAParam(t, "RSAParamDMP1", pkey.get(), RSA_get0_dmp1);
-    CheckRSAParam(t, "RSAParamDMQ1", pkey.get(), RSA_get0_dmq1);
-    CheckRSAParam(t, "RSAParamIQMP", pkey.get(), RSA_get0_iqmp);
-
-    // All keys must compare equal.
-    EXPECT_EQ(EVP_PKEY_eq(pkey.get(), keys.front().second.get()), 1);
-
-    // The key must re-encode correctly.
-    bssl::ScopedCBB cbb;
-    if (!CBB_init(cbb.get(), 0) || !marshal_func(cbb.get(), pkey.get())) {
-      return false;
-    }
-    std::vector<uint8_t> output = input;
-    if (t->HasAttribute("Output") && !t->GetBytes(&output, "Output")) {
-      return false;
+    CheckRSAParam(t, "RSAParamN", key.pkey.get(), RSA_get0_n);
+    CheckRSAParam(t, "RSAParamE", key.pkey.get(), RSA_get0_e);
+    if (key.role == KeyRole::kPrivate) {
+      CheckRSAParam(t, "RSAParamD", key.pkey.get(), RSA_get0_d);
+      CheckRSAParam(t, "RSAParamP", key.pkey.get(), RSA_get0_p);
+      CheckRSAParam(t, "RSAParamQ", key.pkey.get(), RSA_get0_q);
+      CheckRSAParam(t, "RSAParamDMP1", key.pkey.get(), RSA_get0_dmp1);
+      CheckRSAParam(t, "RSAParamDMQ1", key.pkey.get(), RSA_get0_dmq1);
+      CheckRSAParam(t, "RSAParamIQMP", key.pkey.get(), RSA_get0_iqmp);
     }
-    EXPECT_EQ(Bytes(output), Bytes(CBB_data(cbb.get()), CBB_len(cbb.get())))
-        << "Re-encoding the key did not match.";
 
-    if (!CheckRawKey(t, "RawPrivate", pkey.get(),
+    // The key must re-encode correctly.
+    if (!CheckMarshalCBB(t, "SPKI", KeyRoleSelect::kAny, key,
+                         EVP_marshal_public_key) ||
+        !CheckMarshalCBB(t, "PKCS8", KeyRoleSelect::kPrivate, key,
+                         EVP_marshal_private_key) ||
+        !CheckRawKey(t, "RawPrivate", KeyRoleSelect::kPrivate, key,
                      EVP_PKEY_get_raw_private_key) ||
-        !CheckRawKey(t, "RawPublic", pkey.get(), EVP_PKEY_get_raw_public_key) ||
-        !CheckRawKey(t, "PrivateSeed", pkey.get(), EVP_PKEY_get_private_seed)) {
+        !CheckRawKey(t, "RawPublic", KeyRoleSelect::kAny, key,
+                     EVP_PKEY_get_raw_public_key) ||
+        !CheckRawKey(t, "PrivateSeed", KeyRoleSelect::kPrivate, key,
+                     EVP_PKEY_get_private_seed) ||
+        !CheckMarshalCBB(t, "ECUncompressedPoint", KeyRoleSelect::kAny, key,
+                         EVP_PKEY_marshal_ec_uncompressed_point) ||
+        !CheckMarshalCBB(t, "ECCompressedPoint", KeyRoleSelect::kAny, key,
+                         EVP_PKEY_marshal_ec_compressed_point) ||
+        !CheckMarshalCBB(t, "ECPrivateScalar", KeyRoleSelect::kPrivate, key,
+                         EVP_PKEY_marshal_ec_private_scalar) ||
+        !CheckMarshalCBB(t, "RSAPublicKey", KeyRoleSelect::kAny, key,
+                         EVP_PKEY_marshal_rsa_public_key) ||
+        !CheckMarshalCBB(t, "RSAPrivateKey", KeyRoleSelect::kPrivate, key,
+                         EVP_PKEY_marshal_rsa_private_key)) {
       return false;
     }
-
-    // Test copying the public part of the key.
-    UniquePtr<EVP_PKEY> public_copy(EVP_PKEY_copy_public(pkey.get()));
-    EXPECT_TRUE(public_copy);
-    EXPECT_TRUE(EVP_PKEY_has_public(public_copy.get()));
-    EXPECT_FALSE(EVP_PKEY_has_private(public_copy.get()));
-    EXPECT_EQ(EVP_PKEY_eq(public_copy.get(), pkey.get()), 1);
-    EXPECT_EQ(EVP_PKEY_parameters_eq(public_copy.get(), pkey.get()), 1);
-    // Check that the copied public key serializes the same.
-    bssl::ScopedCBB cbb_public, cbb_public_copy;
-    if (!CBB_init(cbb_public.get(), 0) ||
-        !EVP_marshal_public_key(cbb_public.get(), pkey.get()) ||
-        !CBB_init(cbb_public_copy.get(), 0) ||
-        !EVP_marshal_public_key(cbb_public_copy.get(), public_copy.get())) {
-      return false;
-    }
-    EXPECT_EQ(
-        Bytes(CBB_data(cbb_public.get()), CBB_len(cbb_public.get())),
-        Bytes(CBB_data(cbb_public_copy.get()), CBB_len(cbb_public_copy.get())))
-        << "Public copy of the key did not match.";
   }
 
   // Save the key for future tests.
   const std::string &key_name = t->GetParameter();
   EXPECT_EQ(0u, key_map->count(key_name)) << "Duplicate key: " << key_name;
-  (*key_map)key_name = std::move(keys.front().second);
+  (*key_map)key_name = std::move(key_set);
   return true;
 }
 
@@ -543,6 +658,7 @@
   return *out != nullptr;
 }
 
+// TODO(davidben): Integrate this into the ImportKey framework.
 bool ImportDHKey(FileTest *t, KeyMap *key_map) {
   bssl::UniquePtr<BIGNUM> p, q, g, pub_key, priv_key;
   if (!GetOptionalBignum(t, &p, "P") ||  //
@@ -577,7 +693,9 @@
   // Save the key for future tests.
   const std::string &key_name = t->GetParameter();
   EXPECT_EQ(0u, key_map->count(key_name)) << "Duplicate key: " << key_name;
-  (*key_map)key_name = std::move(pkey);
+  (*key_map)key_name.push_back(
+      {priv_key != nullptr ? KeyRole::kPrivate : KeyRole::kPublic, "DH params",
+       std::move(pkey)});
   return true;
 }
 
@@ -623,13 +741,11 @@
     buf.release();
   }
   if (t->HasAttribute("DerivePeer")) {
-    std::string derive_peer = t->GetAttributeOrDie("DerivePeer");
-    auto it = key_map->find(derive_peer);
-    if (it == key_map->end()) {
-      ADD_FAILURE() << "Could not find key " << derive_peer;
+    auto keys = FindKeys(key_map, t->GetAttributeOrDie("DerivePeer"));
+    if (keys.empty()) {
       return false;
     }
-    EVP_PKEY *derive_peer_key = it->second.get();
+    EVP_PKEY *derive_peer_key = keys.front()->pkey.get();
     if (!EVP_PKEY_derive_set_peer(ctx, derive_peer_key)) {
       return false;
     }
@@ -852,7 +968,7 @@
     // The correct output size was written out.
     EXPECT_EQ(secret_size, expected_secret_len);
     decapsulated_secret.resize(secret_size);
-    EXPECT_EQ(secret, decapsulated_secret);
+    EXPECT_EQ(Bytes(secret), Bytes(decapsulated_secret));
   };
 
   // Perform decapsulation.
@@ -962,17 +1078,9 @@
   return true;
 }
 
-bool TestEVPOperation(FileTest *t, const KeyMap *key_map, bool copy_ctx) {
+bool TestEVPOperation(FileTest *t, const KeyMap *key_map, EVP_PKEY *key,
+                      bool copy_ctx) {
   SCOPED_TRACE(copy_ctx);
-  // Load the key.
-  const std::string &key_name = t->GetParameter();
-  auto it = key_map->find(key_name);
-  if (it == key_map->end()) {
-    ADD_FAILURE() << "Could not find key " << key_name;
-    return false;
-  }
-  EVP_PKEY *key = it->second.get();
-
   int (*key_op_init)(EVP_PKEY_CTX *ctx) = nullptr;
   int (*key_op)(EVP_PKEY_CTX *ctx, uint8_t *out, size_t *out_len,
                 const uint8_t *in, size_t in_len) = nullptr;
@@ -1103,9 +1211,16 @@
   }
 
   if (t->HasAttribute("CheckDecrypt")) {
-    // Encryption is non-deterministic, so we check by decrypting.
+    // Encryption is non-deterministic, so we check by decrypting. We may be
+    // testing a public key, so look for a corresponding private key to check.
+    auto private_keys =
+        FindKeys(key_map, t->GetParameter(), KeyRoleSelect::kPrivate);
+    if (private_keys.empty()) {
+      return false;
+    }
     size_t plaintext_len;
-    bssl::UniquePtr<EVP_PKEY_CTX> decrypt_ctx(EVP_PKEY_CTX_new(key, nullptr));
+    bssl::UniquePtr<EVP_PKEY_CTX> decrypt_ctx(
+        EVP_PKEY_CTX_new(private_keys.front()->pkey.get(), nullptr));
     if (!decrypt_ctx ||  //
         !EVP_PKEY_decrypt_init(decrypt_ctx.get()) ||
         !MaybeReplaceWithCopy(&decrypt_ctx, copy_ctx) ||
@@ -1159,29 +1274,26 @@
 }
 
 bool TestEVP(FileTest *t, KeyMap *key_map) {
-  if (t->GetType() == "PrivateKey") {
-    return ImportKey(t, key_map, KeyRole::kPrivate);
+  if (t->GetType() == "Key") {
+    return ImportKey(t, key_map);
   }
-
-  if (t->GetType() == "PrivateKeyFromSeed") {
-    return ImportRawKey(t, key_map, KeyRole::kPrivate, /*use_seed=*/true);
-  }
-
-  if (t->GetType() == "PublicKey") {
-    return ImportKey(t, key_map, KeyRole::kPublic);
-  }
-
-  if (t->GetType() == "PublicKeyFromRaw") {
-    return ImportRawKey(t, key_map, KeyRole::kPublic, /*use_seed=*/false);
-  }
-
   if (t->GetType() == "DHKey") {
     return ImportDHKey(t, key_map);
   }
 
-  // Run the test twice, once copying the context and once normally.
-  return TestEVPOperation(t, key_map, /*copy_ctx=*/false) &&
-         TestEVPOperation(t, key_map, /*copy_ctx=*/true);
+  auto keys = FindKeys(key_map, t->GetParameter());
+  if (keys.empty()) {
+    return false;
+  }
+  for (const SourceAndKey *key : keys) {
+    SCOPED_TRACE(key->source);
+    // Run the test twice, once copying the context and once normally.
+    if (!TestEVPOperation(t, key_map, key->pkey.get(), /*copy_ctx=*/false) ||
+        !TestEVPOperation(t, key_map, key->pkey.get(), /*copy_ctx=*/true)) {
+      return false;
+    }
+  }
+  return true;
 }
 
 void RunEVPTests(const char *path) {
@@ -1195,6 +1307,7 @@
     } else if (!result) {
       ADD_FAILURE() << "Operation unexpectedly failed.";
     }
+    ERR_clear_error();
   });
 }
 
@@ -1305,6 +1418,9 @@
       int ret = EVP_DigestVerify(ctx.get(), sig.data(), sig.size(), msg.data(),
                                  msg.size());
       EXPECT_EQ(ret, expect_valid ? 1 : 0);
+      if (!expect_valid) {
+        ERR_clear_error();
+      }
     }
   });
 }

boringssl-0.20260708.tar.xz/crypto/evp/p_ec.cc -> boringssl-0.20260813.tar.xz/crypto/evp/p_ec.cc Changed

@@ -575,6 +575,127 @@
   return ec_key;
 }
 
+static const EC_GROUP *alg_to_group(const EVP_PKEY_ALG *alg) {
+  if (alg->method->pkey_id != EVP_PKEY_EC) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
+    return nullptr;
+  }
+  auto *alg_ec = static_cast<const EVP_PKEY_ALG_EC *>(alg);
+  if (alg_ec->ec_group == nullptr) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
+    return nullptr;
+  }
+  return alg_ec->ec_group();
+}
+
+static EVP_PKEY *pkey_from_ec_point(const EC_GROUP *group, const uint8_t *in,
+                                    size_t len) {
+  UniquePtr<EVP_PKEY> pkey(EVP_PKEY_new());
+  UniquePtr<EC_KEY> ec_key(EC_KEY_new());
+  if (pkey == nullptr || ec_key == nullptr ||
+      !EC_KEY_set_group(ec_key.get(), group) ||
+      !EC_KEY_oct2key(ec_key.get(), in, len, nullptr)) {
+    return nullptr;
+  }
+  EVP_PKEY_assign_EC_KEY(pkey.get(), ec_key.release());
+  return pkey.release();
+}
+
+EVP_PKEY *EVP_PKEY_from_ec_uncompressed_point(
+    const EVP_PKEY_ALG *alg, const uint8_t *in, size_t len) {
+  const EC_GROUP *group = alg_to_group(alg);
+  if (group == nullptr) {
+    return nullptr;
+  }
+  // The `EC_KEY` APIs are not separated by uncompressed and compressed.
+  if (len == 0 || in0 != 0x04) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+    return nullptr;
+  }
+  return pkey_from_ec_point(group, in, len);
+}
+
+EVP_PKEY *EVP_PKEY_from_ec_compressed_point(const EVP_PKEY_ALG *alg,
+                                            const uint8_t *in, size_t len) {
+  const EC_GROUP *group = alg_to_group(alg);
+  if (group == nullptr) {
+    return nullptr;
+  }
+  // The `EC_KEY` APIs are not separated by uncompressed and compressed.
+  if (len == 0 || in0 == 0x04) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
+    return nullptr;
+  }
+  return pkey_from_ec_point(group, in, len);
+}
+
+static int marshal_ec_point(CBB *cbb, const EVP_PKEY *key,
+                            point_conversion_form_t form) {
+  const EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(key);
+  if (ec_key == nullptr) {
+    return 0;
+  }
+  const EC_GROUP *group = EC_KEY_get0_group(ec_key);
+  const EC_POINT *pub = EC_KEY_get0_public_key(ec_key);
+  if (group == nullptr || pub == nullptr) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_MISSING_PUBLIC_KEY);
+    return 0;
+  }
+  return EC_POINT_point2cbb(cbb, group, pub, form, nullptr);
+}
+
+int EVP_PKEY_marshal_ec_uncompressed_point(CBB *cbb, const EVP_PKEY *key) {
+  return marshal_ec_point(cbb, key, POINT_CONVERSION_UNCOMPRESSED);
+}
+
+int EVP_PKEY_marshal_ec_compressed_point(CBB *cbb, const EVP_PKEY *key) {
+  return marshal_ec_point(cbb, key, POINT_CONVERSION_COMPRESSED);
+}
+
+EVP_PKEY *EVP_PKEY_from_ec_private_scalar(const EVP_PKEY_ALG *alg,
+                                          const uint8_t *in, size_t len) {
+  const EC_GROUP *group = alg_to_group(alg);
+  if (group == nullptr) {
+    return nullptr;
+  }
+  UniquePtr<EVP_PKEY> pkey(EVP_PKEY_new());
+  UniquePtr<EC_KEY> ec_key(EC_KEY_new());
+  if (pkey == nullptr || ec_key == nullptr ||
+      !EC_KEY_set_group(ec_key.get(), group) ||
+      !EC_KEY_oct2priv(ec_key.get(), in, len)) {
+    return nullptr;
+  }
+  // TODO(crbug.com/42290404): `EC_KEY_oct2priv` should fill in the public key
+  // internally.
+  UniquePtr<EC_POINT> pub(EC_POINT_new(group));
+  if (pub == nullptr ||
+      !EC_POINT_mul(group, pub.get(), EC_KEY_get0_private_key(ec_key.get()),
+                    nullptr, nullptr, nullptr) ||
+      !EC_KEY_set_public_key(ec_key.get(), pub.get())) {
+    return 0;
+  }
+
+  EVP_PKEY_assign_EC_KEY(pkey.get(), ec_key.release());
+  return pkey.release();
+}
+
+int EVP_PKEY_marshal_ec_private_scalar(CBB *cbb, const EVP_PKEY *key) {
+  const EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(key);
+  if (ec_key == nullptr) {
+    return 0;
+  }
+  size_t len = EC_KEY_priv2oct(ec_key, nullptr, 0);
+  if (len == 0) {
+    return 0;
+  }
+  uint8_t *out;
+  if (!CBB_reserve(cbb, &out, len)) {
+    return 0;
+  }
+  len = EC_KEY_priv2oct(ec_key, out, len);
+  return len != 0 && CBB_did_write(cbb, len);
+}
+
 int EVP_PKEY_get_ec_curve_nid(const EVP_PKEY *pkey) {
   const EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(pkey);
   if (ec_key == nullptr) {

boringssl-0.20260708.tar.xz/crypto/evp/p_rsa.cc -> boringssl-0.20260813.tar.xz/crypto/evp/p_rsa.cc Changed

@@ -205,6 +205,14 @@
   return 1;
 }
 
+static void evp_pkey_set0_pss(EvpPkey *out, const EVP_PKEY_ALG *alg,
+                              UniquePtr<RSA> rsa) {
+  BSSL_CHECK(alg->pkey_method->pkey_id == EVP_PKEY_RSA_PSS);
+  const auto *alg_pss = static_cast<const EVP_PKEY_ALG_RSA_PSS *>(alg);
+  FromOpaque(rsa.get())->pss_params = alg_pss->pss_params;
+  evp_pkey_set0(out, alg->method, rsa.release());
+}
+
 static bssl::evp_decode_result_t rsa_pub_decode_pss(const EVP_PKEY_ALG *alg,
                                                     EvpPkey *out, CBS *params,
                                                     CBS *key) {
@@ -214,15 +222,13 @@
     return ret;
   }
 
-  UniquePtr<RSAImpl> rsa(
-      FromOpaque(RSA_public_key_from_bytes(CBS_data(key), CBS_len(key))));
+  UniquePtr<RSA> rsa(RSA_public_key_from_bytes(CBS_data(key), CBS_len(key)));
   if (rsa == nullptr) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
     return evp_decode_error;
   }
 
-  rsa->pss_params = alg_pss->pss_params;
-  evp_pkey_set0(out, &rsa_pss_asn1_meth, rsa.release());
+  evp_pkey_set0_pss(out, alg, std::move(rsa));
   return evp_decode_ok;
 }
 
@@ -254,15 +260,13 @@
     return ret;
   }
 
-  UniquePtr<RSAImpl> rsa(
-      FromOpaque(RSA_private_key_from_bytes(CBS_data(key), CBS_len(key))));
+  UniquePtr<RSA> rsa(RSA_private_key_from_bytes(CBS_data(key), CBS_len(key)));
   if (rsa == nullptr) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
     return evp_decode_error;
   }
 
-  rsa->pss_params = alg_pss->pss_params;
-  evp_pkey_set0(out, &rsa_pss_asn1_meth, rsa.release());
+  evp_pkey_set0_pss(out, alg, std::move(rsa));
   return evp_decode_ok;
 }
 
@@ -974,6 +978,70 @@
   return pkey;
 }
 
+EVP_PKEY *EVP_PKEY_from_rsa_public_key(const EVP_PKEY_ALG *alg,
+                                       const uint8_t *in, size_t len) {
+  if (alg->pkey_method->pkey_id != EVP_PKEY_RSA &&
+      alg->pkey_method->pkey_id != EVP_PKEY_RSA_PSS) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
+    return nullptr;
+  }
+  UniquePtr<RSA> rsa(RSA_public_key_from_bytes(in, len));
+  if (rsa == nullptr) {
+    return nullptr;
+  }
+  UniquePtr<EVP_PKEY> ret(EVP_PKEY_new());
+  if (ret == nullptr) {
+    return nullptr;
+  }
+  // Use the PSS-specific setter if needed, to fill in `rsa->pss_params`.
+  if (alg->pkey_method->pkey_id == EVP_PKEY_RSA) {
+    evp_pkey_set0(FromOpaque(ret.get()), alg->method, rsa.release());
+  } else {
+    evp_pkey_set0_pss(FromOpaque(ret.get()), alg, std::move(rsa));
+  }
+  return ret.release();
+}
+
+EVP_PKEY *EVP_PKEY_from_rsa_private_key(const EVP_PKEY_ALG *alg,
+                                        const uint8_t *in, size_t len) {
+  if (alg->pkey_method->pkey_id != EVP_PKEY_RSA &&
+      alg->pkey_method->pkey_id != EVP_PKEY_RSA_PSS) {
+    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
+    return nullptr;
+  }
+  UniquePtr<RSA> rsa(RSA_private_key_from_bytes(in, len));
+  if (rsa == nullptr) {
+    return nullptr;
+  }
+  UniquePtr<EVP_PKEY> ret(EVP_PKEY_new());
+  if (ret == nullptr) {
+    return nullptr;
+  }
+  // Use the PSS-specific setter if needed, to fill in `rsa->pss_params`.
+  if (alg->pkey_method->pkey_id == EVP_PKEY_RSA) {
+    evp_pkey_set0(FromOpaque(ret.get()), alg->method, rsa.release());
+  } else {
+    evp_pkey_set0_pss(FromOpaque(ret.get()), alg, std::move(rsa));
+  }
+  return ret.release();
+}
+
+int EVP_PKEY_marshal_rsa_public_key(CBB *cbb, const EVP_PKEY *key) {
+  const RSA *rsa = EVP_PKEY_get0_RSA(key);
+  if (rsa == nullptr) {
+    return 0;
+  }
+  return RSA_marshal_public_key(cbb, rsa);
+}
+
+int EVP_PKEY_marshal_rsa_private_key(CBB *cbb, const EVP_PKEY *key) {
+  const RSA *rsa = EVP_PKEY_get0_RSA(key);
+  if (rsa == nullptr) {
+    return 0;
+  }
+  return RSA_marshal_private_key(cbb, rsa);
+}
+
 int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key) {
   if (EVP_PKEY_assign_RSA(pkey, key)) {
     RSA_up_ref(key);

boringssl-0.20260708.tar.xz/crypto/evp/p_xwing.cc -> boringssl-0.20260813.tar.xz/crypto/evp/p_xwing.cc Changed

boringssl-0.20260708.tar.xz/crypto/evp/scrypt_test.cc -> boringssl-0.20260813.tar.xz/crypto/evp/scrypt_test.cc Changed

@@ -79,24 +79,31 @@
   // p and r are non-zero.
   EXPECT_FALSE(EVP_PBE_scrypt(nullptr, 0, nullptr, 0, 1024 /* N */, 0 /* r */,
                               1 /* p */, 0 /* max_mem */, key, sizeof(key)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_INVALID_PARAMETERS}}));
   EXPECT_FALSE(EVP_PBE_scrypt(nullptr, 0, nullptr, 0, 1024 /* N */, 8 /* r */,
                               0 /* p */, 0 /* max_mem */, key, sizeof(key)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_INVALID_PARAMETERS}}));
 
   // N must be a power of 2 > 1.
   EXPECT_FALSE(EVP_PBE_scrypt(nullptr, 0, nullptr, 0, 0 /* N */, 8 /* r */,
                               1 /* p */, 0 /* max_mem */, key, sizeof(key)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_INVALID_PARAMETERS}}));
   EXPECT_FALSE(EVP_PBE_scrypt(nullptr, 0, nullptr, 0, 1 /* N */, 8 /* r */,
                               1 /* p */, 0 /* max_mem */, key, sizeof(key)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_INVALID_PARAMETERS}}));
   EXPECT_FALSE(EVP_PBE_scrypt(nullptr, 0, nullptr, 0, 1023 /* N */, 8 /* r */,
                               1 /* p */, 0 /* max_mem */, key, sizeof(key)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_INVALID_PARAMETERS}}));
   EXPECT_TRUE(EVP_PBE_scrypt(nullptr, 0, nullptr, 0, 1024 /* N */, 8 /* r */,
-                              1 /* p */, 0 /* max_mem */, key, sizeof(key)));
+                             1 /* p */, 0 /* max_mem */, key, sizeof(key)));
   EXPECT_FALSE(EVP_PBE_scrypt(nullptr, 0, nullptr, 0, 1025 /* N */, 8 /* r */,
                               1 /* p */, 0 /* max_mem */, key, sizeof(key)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_INVALID_PARAMETERS}}));
 
   // N must be below 2^(128 * r / 8).
   EXPECT_FALSE(EVP_PBE_scrypt(nullptr, 0, nullptr, 0, 65536 /* N */, 1 /* r */,
                               1 /* p */, 0 /* max_mem */, key, sizeof(key)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_INVALID_PARAMETERS}}));
   EXPECT_TRUE(EVP_PBE_scrypt(nullptr, 0, nullptr, 0, 32768 /* N */, 1 /* r */,
                              1 /* p */, 0 /* max_mem */, key, sizeof(key)));
 }

boringssl-0.20260708.tar.xz/crypto/evp/test/ec_tests.txt -> boringssl-0.20260813.tar.xz/crypto/evp/test/ec_tests.txt Changed

@@ -1,106 +1,177 @@
 # EVP EC tests
 
 # EC P-256 key
-PrivateKey = P-256
+Key = P-256
 Algorithm = EC-P-256
 Bits = 256
 ECCurve = prime256v1
-Input = 308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+ECUncompressedPoint = 042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+ECCompressedPoint = 032c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b3
+ECPrivateScalar = 8a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725
+PKCS8 = 308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+SPKI = 3059301306072a8648ce3d020106082a8648ce3d030107034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+# The same key as above with redundant parameters.
+PKCS8NonCanonical = 308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+# The same key, but with the curve spelled explicitly.
+PKCS8NonCanonical = 308201610201003081ec06072a8648ce3d02013081e0020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff30440420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b0441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551020101046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+# The same as above, but with the optional cofactor omitted.
+PKCS8NonCanonical = 308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
 
 # The same key as above with the optional public key omitted.
-PrivateKey = P-256-MissingPublic
-Algorithm = EC-P-256
-Bits = 256
-ECCurve = prime256v1
-Input = 3041020100301306072a8648ce3d020106082a8648ce3d0301070427302502010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725
-
-# The same key as above with redundant parameters.
-PrivateKey = P-256-ExtraParameters
+Key = P-256-MissingPublic
 Algorithm = EC-P-256
 Bits = 256
 ECCurve = prime256v1
-Input = 308193020100301306072a8648ce3d020106082a8648ce3d0301070479307702010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a00a06082a8648ce3d030107a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
-# The key re-encodes with the parameters removed.
-Output = 308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+ECUncompressedPoint = 042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+ECCompressedPoint = 032c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b3
+ECPrivateScalar = 8a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725
+PKCS8 = 3041020100301306072a8648ce3d020106082a8648ce3d0301070427302502010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725
+# Even with the public key omitted, we compute the public key.
+SPKI = 3059301306072a8648ce3d020106082a8648ce3d030107034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+# TODO(crbug.com/503025567): Currently, we remember whether the public key was
+# omitted and roundtrip it back out, so this is a seprate key set. Pick a
+# canonical one instead? Remembering it also means that importing
+# ECPrivateScalar produces a slightly different object from importing PKCS8. To
+# avoid breaking the cross-format tests, skip importing ECPrivateScalar.
+SkipImportECPrivateScalar
 
 # The same key, but with the redundant parameters in the ECPrivateKey mismatched.
-PrivateKey = P-256-BadInnerParameters
-Input = 308190020100301306072a8648ce3d020106082a8648ce3d0301070476307402010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a00706052b81040022a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+Key = P-256-BadInnerParameters
+PKCS8 = 308190020100301306072a8648ce3d020106082a8648ce3d0301070476307402010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a00706052b81040022a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
 Error = GROUP_MISMATCH
 
-# The same key, but with the curve spelled explicitly.
-PrivateKey = P-256-ExplicitParameters
-Algorithm = EC-P-256
-Bits = 256
-ECCurve = prime256v1
-Input = 308201610201003081ec06072a8648ce3d02013081e0020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff30440420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b0441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551020101046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
-Output = 308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
-
-# The same as above, but with the optional cofactor omitted.
-PrivateKey = P-256-ExplicitParameters-NoCofactor
-Algorithm = EC-P-256
-Bits = 256
-ECCurve = prime256v1
-Input = 3082015e0201003081e906072a8648ce3d02013081dd020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff30440420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b0441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
-Output = 308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
-
 # The same as above, but the cofactor is zero instead of one.
-PrivateKey = P-256-ExplicitParameters-CofactorZero
-Input = 308201610201003081ec06072a8648ce3d02013081e0020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff30440420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b0441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551020100046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+Key = P-256-ExplicitParameters-CofactorZero
+PKCS8 = 308201610201003081ec06072a8648ce3d02013081e0020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff30440420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b0441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551020100046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
 Error = UNSUPPORTED_ALGORITHM
 
 # The same as above, but the cofactor is two instead of one.
-PrivateKey = P-256-ExplicitParameters-CofactorTwo
-Input = 308201610201003081ec06072a8648ce3d02013081e0020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff30440420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b0441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551020102046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+Key = P-256-ExplicitParameters-CofactorTwo
+PKCS8 = 308201610201003081ec06072a8648ce3d02013081e0020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff30440420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b0441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551020102046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
 Error = UNSUPPORTED_ALGORITHM
 
 # A zero ECDSA key, with the optional public key encoded.
-PrivateKey = P-256-Zero
-Input = 3047020100301306072a8648ce3d020106082a8648ce3d030107042d302b02010104200000000000000000000000000000000000000000000000000000000000000000a10403020000
+Key = P-256-Zero
+PKCS8 = 3047020100301306072a8648ce3d020106082a8648ce3d030107042d302b02010104200000000000000000000000000000000000000000000000000000000000000000a10403020000
 Error = INVALID_PRIVATE_KEY
 
 # A zero ECDSA key, with the optional public key omitted.
-PrivateKey = P-256-Zero-NoPublic
-Input = 3041020100301306072a8648ce3d020106082a8648ce3d0301070427302502010104200000000000000000000000000000000000000000000000000000000000000000
+Key = P-256-Zero-NoPublic
+PKCS8 = 3041020100301306072a8648ce3d020106082a8648ce3d0301070427302502010104200000000000000000000000000000000000000000000000000000000000000000
 Error = INVALID_PRIVATE_KEY
 
-# The public half of the same key encoded as a PublicKey.
-PublicKey = P-256-SPKI
-Algorithm = EC-P-256
-Bits = 256
-ECCurve = prime256v1
-Input = 3059301306072a8648ce3d020106082a8648ce3d030107034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
-
-# The same as above, but with the curve explicitly spelled out.
-PublicKey = P-256-SPKI
-Input = 3082014b3082010306072a8648ce3d02013081f7020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff305b0420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b031500c49d360886e704936a6678e1139d26b7819f7e900441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551020101034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+# SPKIs with explicit parameters are rejected.
+Key = P-256-SPKI-ExplicitParameters
+SPKI = 3082014b3082010306072a8648ce3d02013081f7020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff305b0420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b031500c49d360886e704936a6678e1139d26b7819f7e900441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551020101034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
 Error = DECODE_ERROR
 
-# The same as above, but with trailing data after the curve name.
-PublicKey = P-256-SPKI
-Input = 305b301506072a8648ce3d020106082a8648ce3d0301070500034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+# SPKIs with trailing data after the curve name are rejected.
+Key = P-256-SPKI-TrailingData
+SPKI = 305b301506072a8648ce3d020106082a8648ce3d0301070500034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
 Error = DECODE_ERROR
 
-PrivateKey = P-224-ExplicitParameters
-Input = 308201540201003081eb06072a8648ce3d02013081df020101302806072a8648ce3d0101021d00ffffffffffffffffffffffffffffffff0000000000000000000000013053041cfffffffffffffffffffffffffffffffefffffffffffffffffffffffe041cb4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4031500bd71344799d5c7fcdc45b59fa3b9ab8f6a948bc5043904b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34021d00ffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d0201010461305f020101041caa17cf0a0c8064bf6b509c212e48293d61e0d97acc85f8dea5c99166a13c033a00041a95d8c8d08635ad7fa0facd3a9fe56f8f42451b58ea8a29f7d28b0fb214690b1149a69f016f644cdb3320b78a381027835d6091903f0513
+Key = P-224
+# Explicit parameters
+PKCS8NonCanonical = 308201540201003081eb06072a8648ce3d02013081df020101302806072a8648ce3d0101021d00ffffffffffffffffffffffffffffffff0000000000000000000000013053041cfffffffffffffffffffffffffffffffefffffffffffffffffffffffe041cb4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4031500bd71344799d5c7fcdc45b59fa3b9ab8f6a948bc5043904b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34021d00ffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d0201010461305f020101041caa17cf0a0c8064bf6b509c212e48293d61e0d97acc85f8dea5c99166a13c033a00041a95d8c8d08635ad7fa0facd3a9fe56f8f42451b58ea8a29f7d28b0fb214690b1149a69f016f644cdb3320b78a381027835d6091903f0513
 Algorithm = EC-P-224
 Bits = 224
 ECCurve = secp224r1
-Output = 3078020100301006072a8648ce3d020106052b810400210461305f020101041caa17cf0a0c8064bf6b509c212e48293d61e0d97acc85f8dea5c99166a13c033a00041a95d8c8d08635ad7fa0facd3a9fe56f8f42451b58ea8a29f7d28b0fb214690b1149a69f016f644cdb3320b78a381027835d6091903f0513
-
-PrivateKey = P-384-ExplicitParameters
-Input = 3082020c0201003082016406072a8648ce3d020130820157020101303c06072a8648ce3d0101023100fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff307b0430fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc0430b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef031500a335926aa319a27a1d00896a6773a4827acdac73046104aa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab73617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f023100ffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc5297302010104819e30819b0201010430a29991b86091401328e62ec8caadd0482f887ff0936910e42a56c19f48cbe87331037a4e2b36f1091dd4a26ee2d2b01fa16403620004826b3df548ad2e0b96436cb13508e88745a33b4b06cf485ad8350824b4dfe01ee66a5e1d1aaebfebcaa6337a1f33c338afc0d59b7ce7e389f73f66c9c4a44bbfcf570aec5cc52e7b6608c9061ab4d72de933448c39dd9238177917d398c22c5e
+ECUncompressedPoint = 041a95d8c8d08635ad7fa0facd3a9fe56f8f42451b58ea8a29f7d28b0fb214690b1149a69f016f644cdb3320b78a381027835d6091903f0513
+ECCompressedPoint = 031a95d8c8d08635ad7fa0facd3a9fe56f8f42451b58ea8a29f7d28b0f
+ECPrivateScalar = aa17cf0a0c8064bf6b509c212e48293d61e0d97acc85f8dea5c99166
+PKCS8 = 3078020100301006072a8648ce3d020106052b810400210461305f020101041caa17cf0a0c8064bf6b509c212e48293d61e0d97acc85f8dea5c99166a13c033a00041a95d8c8d08635ad7fa0facd3a9fe56f8f42451b58ea8a29f7d28b0fb214690b1149a69f016f644cdb3320b78a381027835d6091903f0513
+SPKI = 304e301006072a8648ce3d020106052b81040021033a00041a95d8c8d08635ad7fa0facd3a9fe56f8f42451b58ea8a29f7d28b0fb214690b1149a69f016f644cdb3320b78a381027835d6091903f0513
+
+Key = P-384
+# Explicit parameters
+PKCS8NonCanonical = 3082020c0201003082016406072a8648ce3d020130820157020101303c06072a8648ce3d0101023100fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff307b0430fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc0430b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef031500a335926aa319a27a1d00896a6773a4827acdac73046104aa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab73617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f023100ffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc5297302010104819e30819b0201010430a29991b86091401328e62ec8caadd0482f887ff0936910e42a56c19f48cbe87331037a4e2b36f1091dd4a26ee2d2b01fa16403620004826b3df548ad2e0b96436cb13508e88745a33b4b06cf485ad8350824b4dfe01ee66a5e1d1aaebfebcaa6337a1f33c338afc0d59b7ce7e389f73f66c9c4a44bbfcf570aec5cc52e7b6608c9061ab4d72de933448c39dd9238177917d398c22c5e
 Algorithm = EC-P-384
 Bits = 384
 ECCurve = secp384r1
-Output = 3081b6020100301006072a8648ce3d020106052b8104002204819e30819b0201010430a29991b86091401328e62ec8caadd0482f887ff0936910e42a56c19f48cbe87331037a4e2b36f1091dd4a26ee2d2b01fa16403620004826b3df548ad2e0b96436cb13508e88745a33b4b06cf485ad8350824b4dfe01ee66a5e1d1aaebfebcaa6337a1f33c338afc0d59b7ce7e389f73f66c9c4a44bbfcf570aec5cc52e7b6608c9061ab4d72de933448c39dd9238177917d398c22c5e
-
-PrivateKey = P-521-ExplicitParameters
-Input = 308202b0020100308201d006072a8648ce3d0201308201c3020101304d06072a8648ce3d0101024201ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff30819f044201fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc04420051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00031500d09e8800291cb85396cc6717393284aaa0da64ba0481850400c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650024201fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e913864090201010481d63081d30201010442002eeee9c16b9b4d2dee606f443cf3b41d2899a4734ff7555b54c735afb34a6912f81c68a89ea9b427c69a1026d98ef1d7f9c683aec5c5103d9a4c21e403c638412fa18189038186000400f58adcbe5c07f6b500fadd3209487e38f9567f97c2204435a4eb140739905c201407e2530a6667216aad01fb849bcbefa3862b2f187f13c9a87923d378a0a184df017b4bb93f4766531785878458da6aaa525724e10dfb1f35cfbe55c56fc705714295ea74b6c3e714152ad78e929f5415683aed9bc7c68f0329934177829d715f03f2
+ECUncompressedPoint = 04826b3df548ad2e0b96436cb13508e88745a33b4b06cf485ad8350824b4dfe01ee66a5e1d1aaebfebcaa6337a1f33c338afc0d59b7ce7e389f73f66c9c4a44bbfcf570aec5cc52e7b6608c9061ab4d72de933448c39dd9238177917d398c22c5e
+ECCompressedPoint = 02826b3df548ad2e0b96436cb13508e88745a33b4b06cf485ad8350824b4dfe01ee66a5e1d1aaebfebcaa6337a1f33c338
+ECPrivateScalar = a29991b86091401328e62ec8caadd0482f887ff0936910e42a56c19f48cbe87331037a4e2b36f1091dd4a26ee2d2b01f
+PKCS8 = 3081b6020100301006072a8648ce3d020106052b8104002204819e30819b0201010430a29991b86091401328e62ec8caadd0482f887ff0936910e42a56c19f48cbe87331037a4e2b36f1091dd4a26ee2d2b01fa16403620004826b3df548ad2e0b96436cb13508e88745a33b4b06cf485ad8350824b4dfe01ee66a5e1d1aaebfebcaa6337a1f33c338afc0d59b7ce7e389f73f66c9c4a44bbfcf570aec5cc52e7b6608c9061ab4d72de933448c39dd9238177917d398c22c5e
+SPKI = 3076301006072a8648ce3d020106052b8104002203620004826b3df548ad2e0b96436cb13508e88745a33b4b06cf485ad8350824b4dfe01ee66a5e1d1aaebfebcaa6337a1f33c338afc0d59b7ce7e389f73f66c9c4a44bbfcf570aec5cc52e7b6608c9061ab4d72de933448c39dd9238177917d398c22c5e
+
+Key = P-521
+# Explicit parameters
+PKCS8NonCanonical = 308202b0020100308201d006072a8648ce3d0201308201c3020101304d06072a8648ce3d0101024201ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff30819f044201fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc04420051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00031500d09e8800291cb85396cc6717393284aaa0da64ba0481850400c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650024201fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e913864090201010481d63081d30201010442002eeee9c16b9b4d2dee606f443cf3b41d2899a4734ff7555b54c735afb34a6912f81c68a89ea9b427c69a1026d98ef1d7f9c683aec5c5103d9a4c21e403c638412fa18189038186000400f58adcbe5c07f6b500fadd3209487e38f9567f97c2204435a4eb140739905c201407e2530a6667216aad01fb849bcbefa3862b2f187f13c9a87923d378a0a184df017b4bb93f4766531785878458da6aaa525724e10dfb1f35cfbe55c56fc705714295ea74b6c3e714152ad78e929f5415683aed9bc7c68f0329934177829d715f03f2
 Algorithm = EC-P-521
 Bits = 521
 ECCurve = secp521r1
-Output = 3081ee020100301006072a8648ce3d020106052b810400230481d63081d30201010442002eeee9c16b9b4d2dee606f443cf3b41d2899a4734ff7555b54c735afb34a6912f81c68a89ea9b427c69a1026d98ef1d7f9c683aec5c5103d9a4c21e403c638412fa18189038186000400f58adcbe5c07f6b500fadd3209487e38f9567f97c2204435a4eb140739905c201407e2530a6667216aad01fb849bcbefa3862b2f187f13c9a87923d378a0a184df017b4bb93f4766531785878458da6aaa525724e10dfb1f35cfbe55c56fc705714295ea74b6c3e714152ad78e929f5415683aed9bc7c68f0329934177829d715f03f2
+ECUncompressedPoint = 0400f58adcbe5c07f6b500fadd3209487e38f9567f97c2204435a4eb140739905c201407e2530a6667216aad01fb849bcbefa3862b2f187f13c9a87923d378a0a184df017b4bb93f4766531785878458da6aaa525724e10dfb1f35cfbe55c56fc705714295ea74b6c3e714152ad78e929f5415683aed9bc7c68f0329934177829d715f03f2
+ECCompressedPoint = 0200f58adcbe5c07f6b500fadd3209487e38f9567f97c2204435a4eb140739905c201407e2530a6667216aad01fb849bcbefa3862b2f187f13c9a87923d378a0a184df
+ECPrivateScalar = 002eeee9c16b9b4d2dee606f443cf3b41d2899a4734ff7555b54c735afb34a6912f81c68a89ea9b427c69a1026d98ef1d7f9c683aec5c5103d9a4c21e403c638412f
+PKCS8 = 3081ee020100301006072a8648ce3d020106052b810400230481d63081d30201010442002eeee9c16b9b4d2dee606f443cf3b41d2899a4734ff7555b54c735afb34a6912f81c68a89ea9b427c69a1026d98ef1d7f9c683aec5c5103d9a4c21e403c638412fa18189038186000400f58adcbe5c07f6b500fadd3209487e38f9567f97c2204435a4eb140739905c201407e2530a6667216aad01fb849bcbefa3862b2f187f13c9a87923d378a0a184df017b4bb93f4766531785878458da6aaa525724e10dfb1f35cfbe55c56fc705714295ea74b6c3e714152ad78e929f5415683aed9bc7c68f0329934177829d715f03f2
+SPKI = 30819b301006072a8648ce3d020106052b81040023038186000400f58adcbe5c07f6b500fadd3209487e38f9567f97c2204435a4eb140739905c201407e2530a6667216aad01fb849bcbefa3862b2f187f13c9a87923d378a0a184df017b4bb93f4766531785878458da6aaa525724e10dfb1f35cfbe55c56fc705714295ea74b6c3e714152ad78e929f5415683aed9bc7c68f0329934177829d715f03f2
+
+# Compressed and uncompressed forms swapped
+Key = P-256-WrongForm-1
+Algorithm = EC-P-256
+ECUncompressedPoint = 032c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b3
+Error = DECODE_ERROR
+
+Key = P-256-WrongForm-2
+Algorithm = EC-P-256
+ECCompressedPoint = 042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+Error = DECODE_ERROR
+
+# Wrong length
+Key = P-256-Scalar-Too-Short
+Algorithm = EC-P-256
+ECPrivateScalar = 8a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb57287
+Error = DECODE_ERROR
+
+Key = P-256-Scalar-Too-Long
+Algorithm = EC-P-256
+ECPrivateScalar = 008a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725
+Error = DECODE_ERROR
+
+# Scalar not reduced.
+Key = P-256-Scalar-NotReduced-1
+Algorithm = EC-P-256
+ECPrivateScalar = ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551
+Error = INVALID_SCALAR
+
+Key = P-256-Scalar-NotReduced-2
+Algorithm = EC-P-256
+ECPrivateScalar = ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552
+Error = INVALID_SCALAR
+
+# Truncated points
+Key = P-256-Truncated-Uncompressed
+Algorithm = EC-P-256
+ECUncompressedPoint = 042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9f
+Error = INVALID_ENCODING
+
+Key = P-256-Truncated-Compressed
+Algorithm = EC-P-256
+ECCompressedPoint = 032c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78
+Error = INVALID_ENCODING
+
+# First byte is wrong
+Key = P-256-Bad-First-Byte-Uncompressed
+Algorithm = EC-P-256
+ECUncompressedPoint = 052c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9
+Error = DECODE_ERROR
+
+Key = P-256-Bad-First-Byte-Compressed
+Algorithm = EC-P-256
+ECCompressedPoint = 052c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b3
+Error = INVALID_ENCODING
+
+# Uncompressed point not on the curve
+Key = P-256-Not-On-Curve
+Algorithm = EC-P-256
+ECUncompressedPoint = 042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c8
+Error = POINT_IS_NOT_ON_CURVE
+
+# Compressed point has no square root
+Key = P-256-No-Square-Root-2
+Algorithm = EC-P-256
+ECCompressedPoint = 03ffffffff00000001000000000000000000000000fffffffffffffffffffffffe
+Error = INVALID_COMPRESSED_POINT
 
 
 # ECDSA tests
@@ -110,11 +181,6 @@
 Input = "0123456789ABCDEF1234"
 Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec8
 
-Verify = P-256-SPKI
-Digest = SHA1
-Input = "0123456789ABCDEF1234"
-Output = 3045022100b1d1cb1a577035bccdd5a86c6148c2cc7c633cd42b7234139b593076d041e15202201898cdd52b41ca502098184b409cf83a21bc945006746e3b7cea52234e043ec8
-
 # Digest too long
 Verify = P-256
 Digest = SHA1
@@ -166,19 +232,29 @@
 
 # ECDH tests
 
-PrivateKey = ECDH-P256-Private
+Key = ECDH-P256-Ours
 Algorithm = EC-P-256
 Bits = 256
 ECCurve = prime256v1
-Input = 3041020100301306072a8648ce3d020106082a8648ce3d0301070427302502010104207d7dc5f71eb29ddaf80d6214632eeae03d9058af1fb6d22ed80badb62bc1a534
+ECUncompressedPoint = 04ead218590119e8876b29146ff89ca61770c4edbbf97d38ce385ed281d8a6b23028af61281fd35e2fa7002523acc85a429cb06ee6648325389f59edfce1405141
+ECCompressedPoint = 03ead218590119e8876b29146ff89ca61770c4edbbf97d38ce385ed281d8a6b230
+ECPrivateScalar = 7d7dc5f71eb29ddaf80d6214632eeae03d9058af1fb6d22ed80badb62bc1a534
+PKCS8 = 308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b02010104207d7dc5f71eb29ddaf80d6214632eeae03d9058af1fb6d22ed80badb62bc1a534a14403420004ead218590119e8876b29146ff89ca61770c4edbbf97d38ce385ed281d8a6b23028af61281fd35e2fa7002523acc85a429cb06ee6648325389f59edfce1405141
+SPKI = 3059301306072a8648ce3d020106082a8648ce3d03010703420004ead218590119e8876b29146ff89ca61770c4edbbf97d38ce385ed281d8a6b23028af61281fd35e2fa7002523acc85a429cb06ee6648325389f59edfce1405141
 
-PublicKey = ECDH-P256-Peer
+Key = ECDH-P256-Peer
 Algorithm = EC-P-256
 Bits = 256
 ECCurve = prime256v1
-Input = 3059301306072a8648ce3d020106082a8648ce3d03010703420004700c48f77f56584c5cc632ca65640db91b6bacce3a4df6b42ce7cc838833d287db71e509e3fd9b060ddb20ba5c51dcc5948d46fbf640dfe0441782cab85fa4ac
+ECUncompressedPoint = 04700c48f77f56584c5cc632ca65640db91b6bacce3a4df6b42ce7cc838833d287db71e509e3fd9b060ddb20ba5c51dcc5948d46fbf640dfe0441782cab85fa4ac
+ECCompressedPoint = 02700c48f77f56584c5cc632ca65640db91b6bacce3a4df6b42ce7cc838833d287
+SPKI = 3059301306072a8648ce3d020106082a8648ce3d03010703420004700c48f77f56584c5cc632ca65640db91b6bacce3a4df6b42ce7cc838833d287db71e509e3fd9b060ddb20ba5c51dcc5948d46fbf640dfe0441782cab85fa4ac
 
-Derive = ECDH-P256-Private
+Derive = ECDH-P256-Ours/Private
 DerivePeer = ECDH-P256-Peer
 Output = 46fc62106420ff012e54a434fbdd2d25ccc5852060561e68040dd7778997bd7b
 SmallBufferTruncates
+
+Derive = ECDH-P256-Ours/PublicOnly
+DerivePeer = ECDH-P256-Peer
+Error = NO_PRIVATE_VALUE

boringssl-0.20260708.tar.xz/crypto/evp/test/ed25519_tests.txt -> boringssl-0.20260813.tar.xz/crypto/evp/test/ed25519_tests.txt Changed

@@ -1,81 +1,55 @@
 # EVP Ed25519 tests
 
-# Private keys from RFC 8032.
-PrivateKey = Ed25519
+# Keys from RFC 8032.
+Key = Ed25519
 Algorithm = Ed25519
-Input = 302e020100300506032b6570042204209d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60
+PKCS8 = 302e020100300506032b6570042204209d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60
+SPKI = 302a300506032b6570032100d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a
 RawPrivate = 9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60
 RawPublic = d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a
 
-PrivateKey = Ed25519-2
+Key = Ed25519-2
 Algorithm = Ed25519
-Input = 302e020100300506032b6570042204204ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb
+PKCS8 = 302e020100300506032b6570042204204ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb
+SPKI = 302a300506032b65700321003d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c
 RawPrivate = 4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb
 RawPublic = 3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c
 
-PrivateKey = Ed25519-3
+Key = Ed25519-3
 Algorithm = Ed25519
-Input = 302e020100300506032b657004220420c5aa8df43f9f837bedb7442f31dcb7b166d38535076f094b85ce3a2e0b4458f7
+PKCS8 = 302e020100300506032b657004220420c5aa8df43f9f837bedb7442f31dcb7b166d38535076f094b85ce3a2e0b4458f7
+SPKI = 302a300506032b6570032100fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025
 RawPrivate = c5aa8df43f9f837bedb7442f31dcb7b166d38535076f094b85ce3a2e0b4458f7
 RawPublic = fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025
 
-PrivateKey = Ed25519-4
+Key = Ed25519-4
 Algorithm = Ed25519
-Input = 302e020100300506032b657004220420f5e5767cf153319517630f226876b86c8160cc583bc013744c6bf255f5cc0ee5
+PKCS8 = 302e020100300506032b657004220420f5e5767cf153319517630f226876b86c8160cc583bc013744c6bf255f5cc0ee5
+SPKI = 302a300506032b6570032100278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e
 RawPrivate = f5e5767cf153319517630f226876b86c8160cc583bc013744c6bf255f5cc0ee5
 RawPublic = 278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e
 
-PrivateKey = Ed25519-5
+Key = Ed25519-5
 Algorithm = Ed25519
-Input = 302e020100300506032b657004220420833fe62409237b9d62ec77587520911e9a759cec1d19755b7da901b96dca3d42
+PKCS8 = 302e020100300506032b657004220420833fe62409237b9d62ec77587520911e9a759cec1d19755b7da901b96dca3d42
+SPKI = 302a300506032b6570032100ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf
 RawPrivate = 833fe62409237b9d62ec77587520911e9a759cec1d19755b7da901b96dca3d42
 RawPublic = ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf
 
-# Public keys from RFC 8032.
-PublicKey = Ed25519-SPKI
-Algorithm = Ed25519
-Input = 302a300506032b6570032100d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a
-RawPublic = d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a
-
-PublicKey = Ed25519-SPKI-2
-Algorithm = Ed25519
-Input = 302a300506032b65700321003d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c
-RawPublic = 3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c
-
-PublicKey = Ed25519-SPKI-3
-Algorithm = Ed25519
-Input = 302a300506032b6570032100fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025
-RawPublic = fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025
-
-PublicKey = Ed25519-SPKI-4
-Algorithm = Ed25519
-Input = 302a300506032b6570032100278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e
-RawPublic = 278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e
-
-PublicKey = Ed25519-SPKI-5
-Algorithm = Ed25519
-Input = 302a300506032b6570032100ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf
-RawPublic = ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf
-
 # The first key, private and public, with invalid NULL parameters.
-PrivateKey = Ed25519-NULL
-Input = 3030020100300706032b65700500042204209d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60
+Key = Ed25519-NULL
+PKCS8 = 3030020100300706032b65700500042204209d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60
 Error = DECODE_ERROR
 
-PublicKey = Ed25519-SPKI-NULL
-Input = 302c300706032b65700500032100d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a
+Key = Ed25519-SPKI-NULL
+SPKI = 302c300706032b65700500032100d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a
 Error = DECODE_ERROR
 
-# Sample public key from RFC 8410.
-PublicKey = Ed25519-SPKI-Spec
-Algorithm = Ed25519
-Input = 302a300506032b657003210019bf44096984cdfe8541bac167dc3b96c85086aa30b6b6cb0c5c38ad703166e1
-RawPublic = 19bf44096984cdfe8541bac167dc3b96c85086aa30b6b6cb0c5c38ad703166e1
-
-# Sample private key from RFC 8410.
-PrivateKey = Ed25519-Spec
+# Sample key from RFC 8410.
+Key = Ed25519-Spec
 Algorithm = Ed25519
-Input = 302e020100300506032b657004220420d4ee72dbf913584ad5b6d8f1f769f8ad3afe7c28cbf1d4fbe097a88f44755842
+PKCS8 = 302e020100300506032b657004220420d4ee72dbf913584ad5b6d8f1f769f8ad3afe7c28cbf1d4fbe097a88f44755842
+SPKI = 302a300506032b657003210019bf44096984cdfe8541bac167dc3b96c85086aa30b6b6cb0c5c38ad703166e1
 RawPublic = 19bf44096984cdfe8541bac167dc3b96c85086aa30b6b6cb0c5c38ad703166e1
 RawPrivate = d4ee72dbf913584ad5b6d8f1f769f8ad3afe7c28cbf1d4fbe097a88f44755842
 
@@ -83,28 +57,28 @@
 # Signing and verifying tests
 
 # Signing test vectors from RFC 8032.
-SignMessage = Ed25519
+SignMessage = Ed25519/Private
 Input = ""
 Output = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b
 
-SignMessage = Ed25519-2
+SignMessage = Ed25519-2/Private
 Input = 72
 Output = 92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00
 
-SignMessage = Ed25519-3
+SignMessage = Ed25519-3/Private
 Input = af82
 Output = 6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a
 
-SignMessage = Ed25519-4
+SignMessage = Ed25519-4/Private
 Input = 08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d879de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4feba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbefefd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed185ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f27088d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc2732e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b0707e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128bab27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51addd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429ec96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb751fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34dff7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e488acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a32ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5fb93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b50d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380db2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0
 Output = 0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681e30a6ac00a9704a188a03
 
-SignMessage = Ed25519-5
+SignMessage = Ed25519-5/Private
 Input = ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f
 Output = dc2a4459e7369633a52b1bf277839a00201009a3efbf3ecb69bea2186c26b58909351fc9ac90b3ecfdfbc7c66431e0303dca179c138ac17ad9bef1177331a704
 
 # Signing with public keys is not allowed.
-SignMessage = Ed25519-SPKI
+SignMessage = Ed25519/PublicOnly
 Input = ""
 Error = NOT_A_PRIVATE_KEY
 
@@ -114,62 +88,42 @@
 Input = ""
 Output = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b
 
-VerifyMessage = Ed25519-SPKI
-Input = ""
-Output = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b
-
 VerifyMessage = Ed25519-2
 Input = 72
 Output = 92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00
 
-VerifyMessage = Ed25519-SPKI-2
-Input = 72
-Output = 92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00
-
 VerifyMessage = Ed25519-3
 Input = af82
 Output = 6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a
 
-VerifyMessage = Ed25519-SPKI-3
-Input = af82
-Output = 6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a
-
 VerifyMessage = Ed25519-4
 Input = 08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d879de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4feba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbefefd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed185ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f27088d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc2732e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b0707e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128bab27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51addd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429ec96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb751fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34dff7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e488acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a32ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5fb93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b50d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380db2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0
 Output = 0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681e30a6ac00a9704a188a03
 
-VerifyMessage = Ed25519-SPKI-4
-Input = 08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d879de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4feba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbefefd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed185ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f27088d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc2732e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b0707e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128bab27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51addd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429ec96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb751fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34dff7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e488acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a32ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5fb93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b50d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380db2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0
-Output = 0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681e30a6ac00a9704a188a03
-
 VerifyMessage = Ed25519-5
 Input = ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f
 Output = dc2a4459e7369633a52b1bf277839a00201009a3efbf3ecb69bea2186c26b58909351fc9ac90b3ecfdfbc7c66431e0303dca179c138ac17ad9bef1177331a704
 
-VerifyMessage = Ed25519-SPKI-5
-Input = ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f
-Output = dc2a4459e7369633a52b1bf277839a00201009a3efbf3ecb69bea2186c26b58909351fc9ac90b3ecfdfbc7c66431e0303dca179c138ac17ad9bef1177331a704
-
 # Length is wrong.
-VerifyMessage = Ed25519-SPKI
+VerifyMessage = Ed25519
 Input = ""
 Output = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a10
 Error = INVALID_SIGNATURE
 
 # Message is wrong.
-VerifyMessage = Ed25519-SPKI
+VerifyMessage = Ed25519
 Input = "Hello world"
 Output = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b
 Error = INVALID_SIGNATURE
 
 # Ed25519 does not support configuring a digest.
-SignMessage = Ed25519
+SignMessage = Ed25519/Private
 Input = ""
 Digest = SHA256
 Error = COMMAND_NOT_SUPPORTED
 
 # Ed25519 does not support signing a pre-hashed value.
-Sign = Ed25519
+Sign = Ed25519/Private
 Input = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
 Error = OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE

boringssl-0.20260708.tar.xz/crypto/evp/test/evp_tests.txt -> boringssl-0.20260813.tar.xz/crypto/evp/test/evp_tests.txt Changed

@@ -8,35 +8,36 @@
 # unreasonable to define one that doesn't, such an SPKI is not necessarily a
 # syntax error when the algorithm is unknown.
 
-PublicKey = UnknownAlgorithm-Public
-Input = 3014300e060c2a864886f712040184b70902030205e0
+Key = UnknownAlgorithm-Public
+SPKI = 3014300e060c2a864886f712040184b70902030205e0
 Error = UNSUPPORTED_ALGORITHM
 
-PrivateKey = UnknownAlgorithm-Private
-Input = 301b020100300e060c2a864886f712040184b709020406040474657374
+Key = UnknownAlgorithm-Private
+PKCS8 = 301b020100300e060c2a864886f712040184b709020406040474657374
 Error = UNSUPPORTED_ALGORITHM
 
 # We support parsing DSA keys, but no operations on them.
 
 # A DSA private key.
-PrivateKey = DSA-2048
+Key = DSA-2048
 Algorithm = DSA
 Bits = 2048
-Input = 308202650201003082023906072a8648ce3804013082022c02820101009e12fab3de12213501dd82aa10ca2d101d2d4ebfef4d2a3f8daa0fe0cedad8d6af85616aa2f3252c0a2b5a6db09e6f14900e0ddb8311876dd8f9669525f99ed65949e184d5064793271169a228680b95ec12f59a8e20b21f2b58eb2a2012d35bde2ee351822fe8f32d0a330565dcce5c672b7259c14b2433d0b5b2ca2b2db0ab626e8f13f47fe0345d904e7294bb038e9ce21a9e580b83356278706cfe768436c69de149ccff98b4aab8cb4f6385c9f102ce59346eaeef27e0ad222d53d6e89cc8cde5776dd00057b03f2d88ab3cedbafd7b585f0b7f7835e17a3728bbf25ea62572f245dc111f3ce39cb6ffacc31b0a2790e7bde90224ea9b09315362af3d2b022100f381dcf53ebf724f8b2e5ca82c010fb4b5eda9358d0fd88ed278589488b54fc3028201000c402a725dcc3a62e02bf4cf43cd17f4a493591220223669cf4193edab423ad08dfb552e308a6a57a5ffbc7cd0fb2087f81f8df0cb08ab2133287d2b6968714a94f633c940845a48a3e16708dde761cc6a8eab2d84db21b6ea5b07681493cc9c31fbc368b243f6ddf8c932a8b4038f44e7b15ca876344a147859f2b43b39458668ad5e0a1a9a669546dd2812e3b3617a0aef99d58e3bb4cc87fd94225e01d2dcc469a77268146c51918f18e8b4d70aa1f0c7623bcc52cf3731d38641b2d2830b7eecb2f09552ff137d046e494e7f33c3590002b16d1b97d936fda28f90c3ed3ca35338168ac16f77c3c57adc2e8f7c6c2256e41a5f65450590dbb5bcf06d66610423022100b0c768702743bc51242993a971a52889795444f7c6452203d0ce84fe6117d46e
+PKCS8 = 308202650201003082023906072a8648ce3804013082022c02820101009e12fab3de12213501dd82aa10ca2d101d2d4ebfef4d2a3f8daa0fe0cedad8d6af85616aa2f3252c0a2b5a6db09e6f14900e0ddb8311876dd8f9669525f99ed65949e184d5064793271169a228680b95ec12f59a8e20b21f2b58eb2a2012d35bde2ee351822fe8f32d0a330565dcce5c672b7259c14b2433d0b5b2ca2b2db0ab626e8f13f47fe0345d904e7294bb038e9ce21a9e580b83356278706cfe768436c69de149ccff98b4aab8cb4f6385c9f102ce59346eaeef27e0ad222d53d6e89cc8cde5776dd00057b03f2d88ab3cedbafd7b585f0b7f7835e17a3728bbf25ea62572f245dc111f3ce39cb6ffacc31b0a2790e7bde90224ea9b09315362af3d2b022100f381dcf53ebf724f8b2e5ca82c010fb4b5eda9358d0fd88ed278589488b54fc3028201000c402a725dcc3a62e02bf4cf43cd17f4a493591220223669cf4193edab423ad08dfb552e308a6a57a5ffbc7cd0fb2087f81f8df0cb08ab2133287d2b6968714a94f633c940845a48a3e16708dde761cc6a8eab2d84db21b6ea5b07681493cc9c31fbc368b243f6ddf8c932a8b4038f44e7b15ca876344a147859f2b43b39458668ad5e0a1a9a669546dd2812e3b3617a0aef99d58e3bb4cc87fd94225e01d2dcc469a77268146c51918f18e8b4d70aa1f0c7623bcc52cf3731d38641b2d2830b7eecb2f09552ff137d046e494e7f33c3590002b16d1b97d936fda28f90c3ed3ca35338168ac16f77c3c57adc2e8f7c6c2256e41a5f65450590dbb5bcf06d66610423022100b0c768702743bc51242993a971a52889795444f7c6452203d0ce84fe6117d46e
+SPKI = 308203463082023906072a8648ce3804013082022c02820101009e12fab3de12213501dd82aa10ca2d101d2d4ebfef4d2a3f8daa0fe0cedad8d6af85616aa2f3252c0a2b5a6db09e6f14900e0ddb8311876dd8f9669525f99ed65949e184d5064793271169a228680b95ec12f59a8e20b21f2b58eb2a2012d35bde2ee351822fe8f32d0a330565dcce5c672b7259c14b2433d0b5b2ca2b2db0ab626e8f13f47fe0345d904e7294bb038e9ce21a9e580b83356278706cfe768436c69de149ccff98b4aab8cb4f6385c9f102ce59346eaeef27e0ad222d53d6e89cc8cde5776dd00057b03f2d88ab3cedbafd7b585f0b7f7835e17a3728bbf25ea62572f245dc111f3ce39cb6ffacc31b0a2790e7bde90224ea9b09315362af3d2b022100f381dcf53ebf724f8b2e5ca82c010fb4b5eda9358d0fd88ed278589488b54fc3028201000c402a725dcc3a62e02bf4cf43cd17f4a493591220223669cf4193edab423ad08dfb552e308a6a57a5ffbc7cd0fb2087f81f8df0cb08ab2133287d2b6968714a94f633c940845a48a3e16708dde761cc6a8eab2d84db21b6ea5b07681493cc9c31fbc368b243f6ddf8c932a8b4038f44e7b15ca876344a147859f2b43b39458668ad5e0a1a9a669546dd2812e3b3617a0aef99d58e3bb4cc87fd94225e01d2dcc469a77268146c51918f18e8b4d70aa1f0c7623bcc52cf3731d38641b2d2830b7eecb2f09552ff137d046e494e7f33c3590002b16d1b97d936fda28f90c3ed3ca35338168ac16f77c3c57adc2e8f7c6c2256e41a5f65450590dbb5bcf06d6661038201050002820100319731a14e385688db941dbf655cda4bc210de742003ce1360f2251d557c5d9482540853db8595bfdd5e50d596e079511bbf4d4eb93ac5eec45e98757bbeff30e6d07ba6f1bc29eadfecf38bfa83119f3ff05d065132aa21fc2617e750c216bafa54b77e1d2ca6a34166339483b9bfa04fbda6fd2c8158353339c06d33405664125acd355321788f272437668adf5e5f63fc8b2def57db4025d517530be4a5ae54bf464fa679c374fa1f8534646dc503eb7298807bc08f3511a709eb51e0b0ac9214f2ad37955aba8cc4dbedc44e8b8f843364f85712d7087e9066df915023f273c06bb115dd64d7c975177372da33c46fa547a1ccd1c662e5caab5f2a8f6bcc
 
 # An invalid zero DSA private key.
-PrivateKey = DSA-2048-Zero
-Input = 308202450201003082023906072a8648ce3804013082022c02820101009e12fab3de12213501dd82aa10ca2d101d2d4ebfef4d2a3f8daa0fe0cedad8d6af85616aa2f3252c0a2b5a6db09e6f14900e0ddb8311876dd8f9669525f99ed65949e184d5064793271169a228680b95ec12f59a8e20b21f2b58eb2a2012d35bde2ee351822fe8f32d0a330565dcce5c672b7259c14b2433d0b5b2ca2b2db0ab626e8f13f47fe0345d904e7294bb038e9ce21a9e580b83356278706cfe768436c69de149ccff98b4aab8cb4f6385c9f102ce59346eaeef27e0ad222d53d6e89cc8cde5776dd00057b03f2d88ab3cedbafd7b585f0b7f7835e17a3728bbf25ea62572f245dc111f3ce39cb6ffacc31b0a2790e7bde90224ea9b09315362af3d2b022100f381dcf53ebf724f8b2e5ca82c010fb4b5eda9358d0fd88ed278589488b54fc3028201000c402a725dcc3a62e02bf4cf43cd17f4a493591220223669cf4193edab423ad08dfb552e308a6a57a5ffbc7cd0fb2087f81f8df0cb08ab2133287d2b6968714a94f633c940845a48a3e16708dde761cc6a8eab2d84db21b6ea5b07681493cc9c31fbc368b243f6ddf8c932a8b4038f44e7b15ca876344a147859f2b43b39458668ad5e0a1a9a669546dd2812e3b3617a0aef99d58e3bb4cc87fd94225e01d2dcc469a77268146c51918f18e8b4d70aa1f0c7623bcc52cf3731d38641b2d2830b7eecb2f09552ff137d046e494e7f33c3590002b16d1b97d936fda28f90c3ed3ca35338168ac16f77c3c57adc2e8f7c6c2256e41a5f65450590dbb5bcf06d66610403020100
+Key = DSA-2048-Zero
+PKCS8 = 308202450201003082023906072a8648ce3804013082022c02820101009e12fab3de12213501dd82aa10ca2d101d2d4ebfef4d2a3f8daa0fe0cedad8d6af85616aa2f3252c0a2b5a6db09e6f14900e0ddb8311876dd8f9669525f99ed65949e184d5064793271169a228680b95ec12f59a8e20b21f2b58eb2a2012d35bde2ee351822fe8f32d0a330565dcce5c672b7259c14b2433d0b5b2ca2b2db0ab626e8f13f47fe0345d904e7294bb038e9ce21a9e580b83356278706cfe768436c69de149ccff98b4aab8cb4f6385c9f102ce59346eaeef27e0ad222d53d6e89cc8cde5776dd00057b03f2d88ab3cedbafd7b585f0b7f7835e17a3728bbf25ea62572f245dc111f3ce39cb6ffacc31b0a2790e7bde90224ea9b09315362af3d2b022100f381dcf53ebf724f8b2e5ca82c010fb4b5eda9358d0fd88ed278589488b54fc3028201000c402a725dcc3a62e02bf4cf43cd17f4a493591220223669cf4193edab423ad08dfb552e308a6a57a5ffbc7cd0fb2087f81f8df0cb08ab2133287d2b6968714a94f633c940845a48a3e16708dde761cc6a8eab2d84db21b6ea5b07681493cc9c31fbc368b243f6ddf8c932a8b4038f44e7b15ca876344a147859f2b43b39458668ad5e0a1a9a669546dd2812e3b3617a0aef99d58e3bb4cc87fd94225e01d2dcc469a77268146c51918f18e8b4d70aa1f0c7623bcc52cf3731d38641b2d2830b7eecb2f09552ff137d046e494e7f33c3590002b16d1b97d936fda28f90c3ed3ca35338168ac16f77c3c57adc2e8f7c6c2256e41a5f65450590dbb5bcf06d66610403020100
 Error = INVALID_PARAMETERS
 
 # A DSA public key.
-PublicKey = DSA-1024-SPKI
+Key = DSA-1024-SPKI
 Algorithm = DSA
 Bits = 1024
-Input = 308201b73082012c06072a8648ce3804013082011f02818100b3429b8b128c9079f9b72e86857e98d265e5d91661ed8b5f4cc56e5eed1e571da30186983a9dd76297eab73ee13a1db841f8800d04a7cab478af6cde2ea4a2868531af169a24858c6268efa39ceb7ed0d4227eb5bbb01124a2a5a26038c7bcfb8cc827f68f5202345166e4718596799b65c9def82828ce44e62e38e41a0d24b1021500c5a56c81ddd87f47e676546c56d05706421624cf0281810094de40d27314fe929e47ff9b1ac65cfc73ef38c4d381c890be6217b15039ae18190e6b421af8c0bda35a5cfd050f58ae2644adce83e68c8e5ba11729df56bbb21e227a60b816cc033fa799a38fe1ba5b4aa1801b6f841ce3df99feb3b4fb96950c960af13fa2ce920aabc12dd24ad2044a35063ea0e25f67f560f4cfbdc5598303818400028180258c30ebbb7f34fdc873ce679f6cea373c7886d75d4421b90920db034daedd292c64d8edd8cdbdd7f3ad23d74cfa2135247d0cef6ecf2e14f99e19d22a8c1266bd8fb8719c0e5667c716c45c7adbdabe548085bdad2dfee636f8d52fd6adb2193df6c4f0520fbd171b91882e0e4f321f8250ffecf4dbea00e114427d3ef96c1a
+SPKI = 308201b73082012c06072a8648ce3804013082011f02818100b3429b8b128c9079f9b72e86857e98d265e5d91661ed8b5f4cc56e5eed1e571da30186983a9dd76297eab73ee13a1db841f8800d04a7cab478af6cde2ea4a2868531af169a24858c6268efa39ceb7ed0d4227eb5bbb01124a2a5a26038c7bcfb8cc827f68f5202345166e4718596799b65c9def82828ce44e62e38e41a0d24b1021500c5a56c81ddd87f47e676546c56d05706421624cf0281810094de40d27314fe929e47ff9b1ac65cfc73ef38c4d381c890be6217b15039ae18190e6b421af8c0bda35a5cfd050f58ae2644adce83e68c8e5ba11729df56bbb21e227a60b816cc033fa799a38fe1ba5b4aa1801b6f841ce3df99feb3b4fb96950c960af13fa2ce920aabc12dd24ad2044a35063ea0e25f67f560f4cfbdc5598303818400028180258c30ebbb7f34fdc873ce679f6cea373c7886d75d4421b90920db034daedd292c64d8edd8cdbdd7f3ad23d74cfa2135247d0cef6ecf2e14f99e19d22a8c1266bd8fb8719c0e5667c716c45c7adbdabe548085bdad2dfee636f8d52fd6adb2193df6c4f0520fbd171b91882e0e4f321f8250ffecf4dbea00e114427d3ef96c1a
 
 # The same key as above, but without the parameters. Although allowed by
 # RFC 3279, we do not support this.
-PublicKey = DSA-1024-SPKI-No-Params
-Input = 308192300906072a8648ce38040103818400028180258c30ebbb7f34fdc873ce679f6cea373c7886d75d4421b90920db034daedd292c64d8edd8cdbdd7f3ad23d74cfa2135247d0cef6ecf2e14f99e19d22a8c1266bd8fb8719c0e5667c716c45c7adbdabe548085bdad2dfee636f8d52fd6adb2193df6c4f0520fbd171b91882e0e4f321f8250ffecf4dbea00e114427d3ef96c1a
+Key = DSA-1024-SPKI-No-Params
+SPKI = 308192300906072a8648ce38040103818400028180258c30ebbb7f34fdc873ce679f6cea373c7886d75d4421b90920db034daedd292c64d8edd8cdbdd7f3ad23d74cfa2135247d0cef6ecf2e14f99e19d22a8c1266bd8fb8719c0e5667c716c45c7adbdabe548085bdad2dfee636f8d52fd6adb2193df6c4f0520fbd171b91882e0e4f321f8250ffecf4dbea00e114427d3ef96c1a
 Error = DECODE_ERROR

boringssl-0.20260708.tar.xz/crypto/evp/test/mldsa_tests.txt -> boringssl-0.20260813.tar.xz/crypto/evp/test/mldsa_tests.txt Changed

@@ -7,287 +7,260 @@
 # ML-DSA keys are very long. It is recommended to disable line wrapping in your
 # editor to page through it more easily.
 
-PrivateKey = ML-DSA-44-RFC-Seed
+Key = ML-DSA-44-RFC
 Algorithm = ML-DSA-44
-Input = 3034020100300b060960864801650304031104228020000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
+SPKI = 30820532300b06096086480165030403110382052100d7b2b47254aae0db45e7930d4a98d2c97d8f1397d1789dafa17024b316e9bec94fc9946d42f19b79a7413bbaa33e7149cb42ed5115693ac041facb988adeb5fe0e1d8631184995b592c397d2294e2e14f90aa414ba3826899ac43f4cccacbc26e9a832b95118d5cb433cbef9660b00138e0817f61e762ca274c36ad554eb22aac1162e4ab01acba1e38c4efd8f80b65b333d0f72e55dfe71ce9c1ebb9889e7c56106c0fd73803a2aecfeafded7aa3cb2ceda54d12bd8cd36a78cf975943b47abd25e880ac452e5742ed1e8d1a82afa86e590c758c15ae4d2840d92bca1a5090f40496597fca7d8b9513f1a1bda6e950aaa98de467507d4a4f5a4f0599216582c3572f62eda8905ab3581670c4a02777a33e0ca7295fd8f4ff6d1a0a3a7683d65f5f5f7fc60da023e826c5f92144c02f7d1ba1075987553ea9367fcd76d990b7fa99cd45afdb8836d43e459f5187df058479709a01ea6835935fa70460990cd3dc1ba401ba94bab1dde41ac67ab3319dcaca06048d4c4eef27ee13a9c17d0538f430f2d642dc2415660de78877d8d8abc72523978c042e4285f4319846c44126242976844c10e556ba215b5a719e59d0c6b2a96d39859071fdcc2cde7524a7bedae54e85b318e854e8fe2b2f3edfac9719128270aafd1e5044c3a4fdafd9ff31f90784b8e8e4596144a0daf586511d3d9962b9ea95af197b4e5fc60f2b1ed15de3a5bef5f89bdc79d91051d9b2816e74fa54531efdc1cbe74d448857f476bcd58f21c0b653b3b76a4e076a6559a302718555cc63f74859aabab925f023861ca8cd0f7badb2871f67d55326d7451135ad45f4a1ba69118fbb2c8a30eec9392ef3f977066c9add5c710cc647b1514d217d958c7017c3e90fd20c04e674b90486e9370a31a001d32f473979e4906749e7e477fa0b74508f8a5f2378312b83c25bd388ca0b0fff7478baf42b71667edaac97c46b129643e586e5b055a0c211946d4f36e675bed5860fa042a315d9826164d6a9237c35a5fbf495490a5bd4df248b95c4aae7784b605673166ac4245b5b4b082a09e9323e62f2078c5b76783446defd736ad3a3702d49b089844900a61833397bc4419b30d7a97a0b387c1911474c4d41b53e32a977acb6f0ea75db65bb39e59e701e76957def6f2d44559c31a77122b5204e3b5c219f1688b14ed0bc0b801b3e6e82dcd43e9c0e9f41744cd9815bd1bc8820d8bb123f04facd1b1b685dd5a2b1b8dbbf3ed933670f095a180b4f192d08b10b8fabbdfcc2b24518e32eea0a5e0c904ca844780083f3b0cd2d0b8b6af67bc355b9494025dc7b0a78fa80e3a2dbfeb51328851d6078198e9493651ae787ec0251f922ba30e9f51df62a6d72784cf3dd205393176dfa324a512bd94970a36dd34a514a86791f0eb36f0145b09ab64651b4a0313b299611a2a1c48891627598768a3114060ba4443486df51522a1ce88b30985c216f8e6ed178dd567b304a0d4cafba882a28342f17a9aa26ae58db630083d2c358fdf566c3f5d62a428567bc9ea8ce95caa0f35474b0bfa8f339a250ab4dfcf2083be8eefbc1055e18fe15370eecb260566d83ff06b211aaec43ca29b54ccd00f8815a2465ef0b46515cc7e41f3124f09efff739309ab58b29a1459a00bce5038e938c9678f72eb0e4ee5fdaae66d9f8573fc97fc42b4959f4bf8b61d78433e86b0335d6e9191c4d8bf487b3905c108cfd6ac24b0ceb7dcb7cf51f84d0ed687b95eaeb1c533c06f0d97023d92a70825837b59ba6cb7d4e56b0a87c203862ae8f315ba5925e8edefa679369a2202766151f16a965f9f81ece76cc070b55869e4db9784cf05c830b3242c8312
+PKCS8 = 3034020100300b060960864801650304031104228020000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
 Bits = 10496
 RawPublic = d7b2b47254aae0db45e7930d4a98d2c97d8f1397d1789dafa17024b316e9bec94fc9946d42f19b79a7413bbaa33e7149cb42ed5115693ac041facb988adeb5fe0e1d8631184995b592c397d2294e2e14f90aa414ba3826899ac43f4cccacbc26e9a832b95118d5cb433cbef9660b00138e0817f61e762ca274c36ad554eb22aac1162e4ab01acba1e38c4efd8f80b65b333d0f72e55dfe71ce9c1ebb9889e7c56106c0fd73803a2aecfeafded7aa3cb2ceda54d12bd8cd36a78cf975943b47abd25e880ac452e5742ed1e8d1a82afa86e590c758c15ae4d2840d92bca1a5090f40496597fca7d8b9513f1a1bda6e950aaa98de467507d4a4f5a4f0599216582c3572f62eda8905ab3581670c4a02777a33e0ca7295fd8f4ff6d1a0a3a7683d65f5f5f7fc60da023e826c5f92144c02f7d1ba1075987553ea9367fcd76d990b7fa99cd45afdb8836d43e459f5187df058479709a01ea6835935fa70460990cd3dc1ba401ba94bab1dde41ac67ab3319dcaca06048d4c4eef27ee13a9c17d0538f430f2d642dc2415660de78877d8d8abc72523978c042e4285f4319846c44126242976844c10e556ba215b5a719e59d0c6b2a96d39859071fdcc2cde7524a7bedae54e85b318e854e8fe2b2f3edfac9719128270aafd1e5044c3a4fdafd9ff31f90784b8e8e4596144a0daf586511d3d9962b9ea95af197b4e5fc60f2b1ed15de3a5bef5f89bdc79d91051d9b2816e74fa54531efdc1cbe74d448857f476bcd58f21c0b653b3b76a4e076a6559a302718555cc63f74859aabab925f023861ca8cd0f7badb2871f67d55326d7451135ad45f4a1ba69118fbb2c8a30eec9392ef3f977066c9add5c710cc647b1514d217d958c7017c3e90fd20c04e674b90486e9370a31a001d32f473979e4906749e7e477fa0b74508f8a5f2378312b83c25bd388ca0b0fff7478baf42b71667edaac97c46b129643e586e5b055a0c211946d4f36e675bed5860fa042a315d9826164d6a9237c35a5fbf495490a5bd4df248b95c4aae7784b605673166ac4245b5b4b082a09e9323e62f2078c5b76783446defd736ad3a3702d49b089844900a61833397bc4419b30d7a97a0b387c1911474c4d41b53e32a977acb6f0ea75db65bb39e59e701e76957def6f2d44559c31a77122b5204e3b5c219f1688b14ed0bc0b801b3e6e82dcd43e9c0e9f41744cd9815bd1bc8820d8bb123f04facd1b1b685dd5a2b1b8dbbf3ed933670f095a180b4f192d08b10b8fabbdfcc2b24518e32eea0a5e0c904ca844780083f3b0cd2d0b8b6af67bc355b9494025dc7b0a78fa80e3a2dbfeb51328851d6078198e9493651ae787ec0251f922ba30e9f51df62a6d72784cf3dd205393176dfa324a512bd94970a36dd34a514a86791f0eb36f0145b09ab64651b4a0313b299611a2a1c48891627598768a3114060ba4443486df51522a1ce88b30985c216f8e6ed178dd567b304a0d4cafba882a28342f17a9aa26ae58db630083d2c358fdf566c3f5d62a428567bc9ea8ce95caa0f35474b0bfa8f339a250ab4dfcf2083be8eefbc1055e18fe15370eecb260566d83ff06b211aaec43ca29b54ccd00f8815a2465ef0b46515cc7e41f3124f09efff739309ab58b29a1459a00bce5038e938c9678f72eb0e4ee5fdaae66d9f8573fc97fc42b4959f4bf8b61d78433e86b0335d6e9191c4d8bf487b3905c108cfd6ac24b0ceb7dcb7cf51f84d0ed687b95eaeb1c533c06f0d97023d92a70825837b59ba6cb7d4e56b0a87c203862ae8f315ba5925e8edefa679369a2202766151f16a965f9f81ece76cc070b55869e4db9784cf05c830b3242c8312
 PrivateSeed = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
 
-PrivateKey = ML-DSA-44-RFC-Expanded
-Input = 30820a18020100300b060960864801650304031104820a0404820a00d7b2b47254aae0db45e7930d4a98d2c97d8f1397d1789dafa17024b316e9bec939ce0f7f77f8db5644dcda366bfe4734bd95f435ff9a613aa54aa41c2c694c04329a07b1fabb48f52a309f11a1898f848e2322ffe623ec810db3bee33685854a88269da320d5120bfcfe89a18e30f7114d83aa404a646b6c997389860d12522ee0006e2384819186619b260d118664d4a62822184482402898146148a6614c4248a19208c2382951244808a125c2083108c47120140914836c18a78084106ec9c07022b56408b0610c070498124451886959004622932041062e42b64c01164914284c41a85180460a5116515a0820022244dc9849d13251e13065d3c08592a85112a1640039220946621cc70cd9086dd0062652408580443091062c50c80924c5841a966d4a982c99066da4443220a7645a326e11b57020926124138e04852c0a4872c8a051d3082a99208058242024074e59148810a46460c06de0b28d1b1909203422c024410943710a212061a2015222521b80809a340013934dd3322922170a9892691a14512027219cc02062a2814818691a854d8344695b2041031242cb184601a90d0c023183b0215a224ac89205d9906904306a4b064ad2b2011c404081423252327254a6405a18100c321292c2805212625c82280bb46c03428d53100c14010ee1365288842491020a63462620062911c228d0204802b36ca236095a8648cbb4618b4662c440821a890910024d24b24520122524c90588288cc9c04d5948220a276ec134644c90605b445082864943880443b28c603080a2882d84a46d8ca629d0c68442064689885100a98d01498de4380da4068dd3947142b26c1a84611ba32842b42808a0711ac531e0a04c013765242862142890091061d940221b3360090292d02481200408491844a3222d5c8844149808a446610195640b390a0c9450ca406ad2b220c0380182308e13b908918084148829c0189112350da02422e20406d9c2850428121cc989180272d24029c20812d8062a9994719bb8682384291a2289144511dc82445096450c4484c0b2049aa60543862c44326e88442120a84c9a3070e3b82d63268803254903438c48a809ca147253344e1243081ba704593022d99480e234228142129c302a9434266104452426281346094a326d11280918b82562281113410d41b21190844c8b1212a2c688c9c030220606d2188e848630904452128831d9207113c52843060e033060cca6845826524c88011ef72562c85ffa43acfa49217f2b172d7bbc14620e6d980a71aabbdf0c45e9a206ecb1423fee15decc17601300149d9223cd6e6c6e1fa8e41fc7c64938ab68905fd3dcda50d87082e7d0d71d1bc9b2b84c85523ca8fe6cad294adf83be15b108ff721d0cc87bc3dd3a7590184b0e845663a91fc9e1c3c53a61d867420b04f092355753bc65a06368fd41295fd09924132c6f91f67964c142674a725c343914c4cecf58c074bcaf4558c97bf7911e07aa6d0938f2ee2bb3c1a8c595d635e84342fdea01dc24b211ad2fc281cf77e59110c7abc54bf0c86d480b9be276471dc9d603cee98cfdab3e9fcfb703793560549ea4450fa7b33fb9169c44b4d25fb9c457f49791cd3da03eac96095813c105132ccda4e63e49228cd23d8a1f37856f142d93b90db09f82af89258c63aab8047a80c036c9357ea2046f8dc6354f0c5295f342bb417d3cfeb0b1fd33622c29e14cbbd92e1363c65ebd4504b7512329b9670e32e1b2c67a54e7f1a55f8b9f9ea04e8ca3a705e62a3c5e637374afb7aeb6ddea612cde28f01a202d7aa4e34722d27dd3f9b89894d019fd5d4d7119efe3723bba104cb8bb0981e074de3afe200daaaead826cc45f244dbf431afab34efbdf782474d2fd57118f646214934ed99cba3b003e8d67a3836f6f19fc41910ce5163ee3ae99eb84d514eb761e63684ea56f9791d2dd4aac6e6168b948c817f75a222acb0e8cdc03cc4afe8f67157e1a363b7faeff9f172b98913677c5a1dd085e9ee4c22052c1af58193116673dcd3bfc5f34b855dcc6c77885649e9e71f43d4aea0f4b72ca7eda0578ba13d31a658d2d060a9a66ff69ed1be7997a2fb1d2723d38f9bfabe18f8e7b3cda906e4e9b5e942c8eaeb296070ebfd364947a940cc978bed66b37749e6d5dcd7be8c494440e2b84cecfefb98c0bedfb3c41e3359d2cd7197fbe720c48aa6c6b6465c1ee63e3569c2adc744491370b7f7826fe0b77a1d19d64101d032b918106b42d2ef73747e5601fe4ba50f23ede521f031a817d15294a43722e8378784b6db0cf1ba9e8ae911d9201b9ce9cc3019c6f5c27cb98da26144b64225a7c932b30f761e78a2d59a1d8b83ec6344a2f6dd47e765706d00bf4a79a6a926c3ba91d812c8f2c797ab1796709e5d16856778293529f0286d015c3b5399619642a333e9e593d6e3f5353994208e9e6a332851d7f652522a928b917e27e2d6d42137dfe2ebfa6fb1c67b26c0254528685f7ebdbe315a68eaa2da769e8a9f42d3e60007c71330926b2c0012d83ead4e4fd1ed872ccd1972201d2b027f3545ac2d30cd78bc1d740feccbc6fc2a0446c6e30eac51f5a69098aa2d447f2085b4e4e4b92ccc26921d2de478518cd090ce267aea2d27ada57fd88b4976d89fb843cdccf49a76ca2679e6801bfa7fb031896fb50629704b9923936bb5dd385311121cadfb11995e59b73034cf67ed03ab813867648d025828087e949a9afd16b95d72d99b1edca257aac132ffb7a0709aed5a9c0ff05fb0f2bbf28409eed7b5f5801be964ced019e1cb7851d3851f10290674e19ffb008b301c4acf641a2bb14216e1d69cabf52b5ef227496b0f30799a855d117fad3744a6fa33503ea798b52ddd7ee5426609dbfcd3f0c13b164d6c051f7ed4a119719a712e388d328402081ff1354b554d2c237afed3b151c4ba8e9f4bdeb8499a3066e26bbc69e8af089dec71731d1dc529eab17ef7374734c0fe475494c83836bdd34a03b9bc89914716061bfb98ec6e61c3ed4438edcaf25243c647086b9ea7018b0d9a8a0b00cecb00abde2498d69c2336101a772cbe4f571523f51bd05882cdf358b849cc140aa1faf22423a12851ce0e33fd48975a4959fa5c5fe418c93908191ab6e741b77bfe02cbd698ee795c466d615619e6441382c6eac01834ee9ab73cea80bbe235c78da91bd79b6f82f899785d68700d393e675c2224d6b7a1ad21320495679adaed70167b50866713a53109db7b6f7d81304ecdfd83b319b1ef248306b45ad29e7ddcc863dac56048b5d69ea175011f7614c00a86a863cde1872a8932878b9ac7e1ac5bda4997b72064f0cd75f4c814e034de11acb9013cf7ea926b4e7eaace070c7ba2188efad2e431e1223d45dd05c4d8403c2e45cee6413ecbe7527e873e455c4e610a61839aacc0bd56d2483e78f298b66a478eb2f558cbafca86be847baeb02c5b216c8cd88fea4df249b09e670a20703abac24b0a91abc4a5646601442ba10becfd30993880051d07f56a05a9379e7a8e6befee3f22faa106398f7706006e42e9be1ef89d25c272f11a95095c587d713732284de9dbd3c7217b0689e21d8eb0ff69668
+Key = ML-DSA-44-RFC-Expanded
+PKCS8 = 30820a18020100300b060960864801650304031104820a0404820a00d7b2b47254aae0db45e7930d4a98d2c97d8f1397d1789dafa17024b316e9bec939ce0f7f77f8db5644dcda366bfe4734bd95f435ff9a613aa54aa41c2c694c04329a07b1fabb48f52a309f11a1898f848e2322ffe623ec810db3bee33685854a88269da320d5120bfcfe89a18e30f7114d83aa404a646b6c997389860d12522ee0006e2384819186619b260d118664d4a62822184482402898146148a6614c4248a19208c2382951244808a125c2083108c47120140914836c18a78084106ec9c07022b56408b0610c070498124451886959004622932041062e42b64c01164914284c41a85180460a5116515a0820022244dc9849d13251e13065d3c08592a85112a1640039220946621cc70cd9086dd0062652408580443091062c50c80924c5841a966d4a982c99066da4443220a7645a326e11b57020926124138e04852c0a4872c8a051d3082a99208058242024074e59148810a46460c06de0b28d1b1909203422c024410943710a212061a2015222521b80809a340013934dd3322922170a9892691a14512027219cc02062a2814818691a854d8344695b2041031242cb184601a90d0c023183b0215a224ac89205d9906904306a4b064ad2b2011c404081423252327254a6405a18100c321292c2805212625c82280bb46c03428d53100c14010ee1365288842491020a63462620062911c228d0204802b36ca236095a8648cbb4618b4662c440821a890910024d24b24520122524c90588288cc9c04d5948220a276ec134644c90605b445082864943880443b28c603080a2882d84a46d8ca629d0c68442064689885100a98d01498de4380da4068dd3947142b26c1a84611ba32842b42808a0711ac531e0a04c013765242862142890091061d940221b3360090292d02481200408491844a3222d5c8844149808a446610195640b390a0c9450ca406ad2b220c0380182308e13b908918084148829c0189112350da02422e20406d9c2850428121cc989180272d24029c20812d8062a9994719bb8682384291a2289144511dc82445096450c4484c0b2049aa60543862c44326e88442120a84c9a3070e3b82d63268803254903438c48a809ca147253344e1243081ba704593022d99480e234228142129c302a9434266104452426281346094a326d11280918b82562281113410d41b21190844c8b1212a2c688c9c030220606d2188e848630904452128831d9207113c52843060e033060cca6845826524c88011ef72562c85ffa43acfa49217f2b172d7bbc14620e6d980a71aabbdf0c45e9a206ecb1423fee15decc17601300149d9223cd6e6c6e1fa8e41fc7c64938ab68905fd3dcda50d87082e7d0d71d1bc9b2b84c85523ca8fe6cad294adf83be15b108ff721d0cc87bc3dd3a7590184b0e845663a91fc9e1c3c53a61d867420b04f092355753bc65a06368fd41295fd09924132c6f91f67964c142674a725c343914c4cecf58c074bcaf4558c97bf7911e07aa6d0938f2ee2bb3c1a8c595d635e84342fdea01dc24b211ad2fc281cf77e59110c7abc54bf0c86d480b9be276471dc9d603cee98cfdab3e9fcfb703793560549ea4450fa7b33fb9169c44b4d25fb9c457f49791cd3da03eac96095813c105132ccda4e63e49228cd23d8a1f37856f142d93b90db09f82af89258c63aab8047a80c036c9357ea2046f8dc6354f0c5295f342bb417d3cfeb0b1fd33622c29e14cbbd92e1363c65ebd4504b7512329b9670e32e1b2c67a54e7f1a55f8b9f9ea04e8ca3a705e62a3c5e637374afb7aeb6ddea612cde28f01a202d7aa4e34722d27dd3f9b89894d019fd5d4d7119efe3723bba104cb8bb0981e074de3afe200daaaead826cc45f244dbf431afab34efbdf782474d2fd57118f646214934ed99cba3b003e8d67a3836f6f19fc41910ce5163ee3ae99eb84d514eb761e63684ea56f9791d2dd4aac6e6168b948c817f75a222acb0e8cdc03cc4afe8f67157e1a363b7faeff9f172b98913677c5a1dd085e9ee4c22052c1af58193116673dcd3bfc5f34b855dcc6c77885649e9e71f43d4aea0f4b72ca7eda0578ba13d31a658d2d060a9a66ff69ed1be7997a2fb1d2723d38f9bfabe18f8e7b3cda906e4e9b5e942c8eaeb296070ebfd364947a940cc978bed66b37749e6d5dcd7be8c494440e2b84cecfefb98c0bedfb3c41e3359d2cd7197fbe720c48aa6c6b6465c1ee63e3569c2adc744491370b7f7826fe0b77a1d19d64101d032b918106b42d2ef73747e5601fe4ba50f23ede521f031a817d15294a43722e8378784b6db0cf1ba9e8ae911d9201b9ce9cc3019c6f5c27cb98da26144b64225a7c932b30f761e78a2d59a1d8b83ec6344a2f6dd47e765706d00bf4a79a6a926c3ba91d812c8f2c797ab1796709e5d16856778293529f0286d015c3b5399619642a333e9e593d6e3f5353994208e9e6a332851d7f652522a928b917e27e2d6d42137dfe2ebfa6fb1c67b26c0254528685f7ebdbe315a68eaa2da769e8a9f42d3e60007c71330926b2c0012d83ead4e4fd1ed872ccd1972201d2b027f3545ac2d30cd78bc1d740feccbc6fc2a0446c6e30eac51f5a69098aa2d447f2085b4e4e4b92ccc26921d2de478518cd090ce267aea2d27ada57fd88b4976d89fb843cdccf49a76ca2679e6801bfa7fb031896fb50629704b9923936bb5dd385311121cadfb11995e59b73034cf67ed03ab813867648d025828087e949a9afd16b95d72d99b1edca257aac132ffb7a0709aed5a9c0ff05fb0f2bbf28409eed7b5f5801be964ced019e1cb7851d3851f10290674e19ffb008b301c4acf641a2bb14216e1d69cabf52b5ef227496b0f30799a855d117fad3744a6fa33503ea798b52ddd7ee5426609dbfcd3f0c13b164d6c051f7ed4a119719a712e388d328402081ff1354b554d2c237afed3b151c4ba8e9f4bdeb8499a3066e26bbc69e8af089dec71731d1dc529eab17ef7374734c0fe475494c83836bdd34a03b9bc89914716061bfb98ec6e61c3ed4438edcaf25243c647086b9ea7018b0d9a8a0b00cecb00abde2498d69c2336101a772cbe4f571523f51bd05882cdf358b849cc140aa1faf22423a12851ce0e33fd48975a4959fa5c5fe418c93908191ab6e741b77bfe02cbd698ee795c466d615619e6441382c6eac01834ee9ab73cea80bbe235c78da91bd79b6f82f899785d68700d393e675c2224d6b7a1ad21320495679adaed70167b50866713a53109db7b6f7d81304ecdfd83b319b1ef248306b45ad29e7ddcc863dac56048b5d69ea175011f7614c00a86a863cde1872a8932878b9ac7e1ac5bda4997b72064f0cd75f4c814e034de11acb9013cf7ea926b4e7eaace070c7ba2188efad2e431e1223d45dd05c4d8403c2e45cee6413ecbe7527e873e455c4e610a61839aacc0bd56d2483e78f298b66a478eb2f558cbafca86be847baeb02c5b216c8cd88fea4df249b09e670a20703abac24b0a91abc4a5646601442ba10becfd30993880051d07f56a05a9379e7a8e6befee3f22faa106398f7706006e42e9be1ef89d25c272f11a95095c587d713732284de9dbd3c7217b0689e21d8eb0ff69668
 Error = PRIVATE_KEY_WAS_NOT_SEED
 
-PrivateKey = ML-DSA-44-RFC-Both
-Input = 30820a3e020100300b060960864801650304031104820a2a30820a260420000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f04820a00d7b2b47254aae0db45e7930d4a98d2c97d8f1397d1789dafa17024b316e9bec939ce0f7f77f8db5644dcda366bfe4734bd95f435ff9a613aa54aa41c2c694c04329a07b1fabb48f52a309f11a1898f848e2322ffe623ec810db3bee33685854a88269da320d5120bfcfe89a18e30f7114d83aa404a646b6c997389860d12522ee0006e2384819186619b260d118664d4a62822184482402898146148a6614c4248a19208c2382951244808a125c2083108c47120140914836c18a78084106ec9c07022b56408b0610c070498124451886959004622932041062e42b64c01164914284c41a85180460a5116515a0820022244dc9849d13251e13065d3c08592a85112a1640039220946621cc70cd9086dd0062652408580443091062c50c80924c5841a966d4a982c99066da4443220a7645a326e11b57020926124138e04852c0a4872c8a051d3082a99208058242024074e59148810a46460c06de0b28d1b1909203422c024410943710a212061a2015222521b80809a340013934dd3322922170a9892691a14512027219cc02062a2814818691a854d8344695b2041031242cb184601a90d0c023183b0215a224ac89205d9906904306a4b064ad2b2011c404081423252327254a6405a18100c321292c2805212625c82280bb46c03428d53100c14010ee1365288842491020a63462620062911c228d0204802b36ca236095a8648cbb4618b4662c440821a890910024d24b24520122524c90588288cc9c04d5948220a276ec134644c90605b445082864943880443b28c603080a2882d84a46d8ca629d0c68442064689885100a98d01498de4380da4068dd3947142b26c1a84611ba32842b42808a0711ac531e0a04c013765242862142890091061d940221b3360090292d02481200408491844a3222d5c8844149808a446610195640b390a0c9450ca406ad2b220c0380182308e13b908918084148829c0189112350da02422e20406d9c2850428121cc989180272d24029c20812d8062a9994719bb8682384291a2289144511dc82445096450c4484c0b2049aa60543862c44326e88442120a84c9a3070e3b82d63268803254903438c48a809ca147253344e1243081ba704593022d99480e234228142129c302a9434266104452426281346094a326d11280918b82562281113410d41b21190844c8b1212a2c688c9c030220606d2188e848630904452128831d9207113c52843060e033060cca6845826524c88011ef72562c85ffa43acfa49217f2b172d7bbc14620e6d980a71aabbdf0c45e9a206ecb1423fee15decc17601300149d9223cd6e6c6e1fa8e41fc7c64938ab68905fd3dcda50d87082e7d0d71d1bc9b2b84c85523ca8fe6cad294adf83be15b108ff721d0cc87bc3dd3a7590184b0e845663a91fc9e1c3c53a61d867420b04f092355753bc65a06368fd41295fd09924132c6f91f67964c142674a725c343914c4cecf58c074bcaf4558c97bf7911e07aa6d0938f2ee2bb3c1a8c595d635e84342fdea01dc24b211ad2fc281cf77e59110c7abc54bf0c86d480b9be276471dc9d603cee98cfdab3e9fcfb703793560549ea4450fa7b33fb9169c44b4d25fb9c457f49791cd3da03eac96095813c105132ccda4e63e49228cd23d8a1f37856f142d93b90db09f82af89258c63aab8047a80c036c9357ea2046f8dc6354f0c5295f342bb417d3cfeb0b1fd33622c29e14cbbd92e1363c65ebd4504b7512329b9670e32e1b2c67a54e7f1a55f8b9f9ea04e8ca3a705e62a3c5e637374afb7aeb6ddea612cde28f01a202d7aa4e34722d27dd3f9b89894d019fd5d4d7119efe3723bba104cb8bb0981e074de3afe200daaaead826cc45f244dbf431afab34efbdf782474d2fd57118f646214934ed99cba3b003e8d67a3836f6f19fc41910ce5163ee3ae99eb84d514eb761e63684ea56f9791d2dd4aac6e6168b948c817f75a222acb0e8cdc03cc4afe8f67157e1a363b7faeff9f172b98913677c5a1dd085e9ee4c22052c1af58193116673dcd3bfc5f34b855dcc6c77885649e9e71f43d4aea0f4b72ca7eda0578ba13d31a658d2d060a9a66ff69ed1be7997a2fb1d2723d38f9bfabe18f8e7b3cda906e4e9b5e942c8eaeb296070ebfd364947a940cc978bed66b37749e6d5dcd7be8c494440e2b84cecfefb98c0bedfb3c41e3359d2cd7197fbe720c48aa6c6b6465c1ee63e3569c2adc744491370b7f7826fe0b77a1d19d64101d032b918106b42d2ef73747e5601fe4ba50f23ede521f031a817d15294a43722e8378784b6db0cf1ba9e8ae911d9201b9ce9cc3019c6f5c27cb98da26144b64225a7c932b30f761e78a2d59a1d8b83ec6344a2f6dd47e765706d00bf4a79a6a926c3ba91d812c8f2c797ab1796709e5d16856778293529f0286d015c3b5399619642a333e9e593d6e3f5353994208e9e6a332851d7f652522a928b917e27e2d6d42137dfe2ebfa6fb1c67b26c0254528685f7ebdbe315a68eaa2da769e8a9f42d3e60007c71330926b2c0012d83ead4e4fd1ed872ccd1972201d2b027f3545ac2d30cd78bc1d740feccbc6fc2a0446c6e30eac51f5a69098aa2d447f2085b4e4e4b92ccc26921d2de478518cd090ce267aea2d27ada57fd88b4976d89fb843cdccf49a76ca2679e6801bfa7fb031896fb50629704b9923936bb5dd385311121cadfb11995e59b73034cf67ed03ab813867648d025828087e949a9afd16b95d72d99b1edca257aac132ffb7a0709aed5a9c0ff05fb0f2bbf28409eed7b5f5801be964ced019e1cb7851d3851f10290674e19ffb008b301c4acf641a2bb14216e1d69cabf52b5ef227496b0f30799a855d117fad3744a6fa33503ea798b52ddd7ee5426609dbfcd3f0c13b164d6c051f7ed4a119719a712e388d328402081ff1354b554d2c237afed3b151c4ba8e9f4bdeb8499a3066e26bbc69e8af089dec71731d1dc529eab17ef7374734c0fe475494c83836bdd34a03b9bc89914716061bfb98ec6e61c3ed4438edcaf25243c647086b9ea7018b0d9a8a0b00cecb00abde2498d69c2336101a772cbe4f571523f51bd05882cdf358b849cc140aa1faf22423a12851ce0e33fd48975a4959fa5c5fe418c93908191ab6e741b77bfe02cbd698ee795c466d615619e6441382c6eac01834ee9ab73cea80bbe235c78da91bd79b6f82f899785d68700d393e675c2224d6b7a1ad21320495679adaed70167b50866713a53109db7b6f7d81304ecdfd83b319b1ef248306b45ad29e7ddcc863dac56048b5d69ea175011f7614c00a86a863cde1872a8932878b9ac7e1ac5bda4997b72064f0cd75f4c814e034de11acb9013cf7ea926b4e7eaace070c7ba2188efad2e431e1223d45dd05c4d8403c2e45cee6413ecbe7527e873e455c4e610a61839aacc0bd56d2483e78f298b66a478eb2f558cbafca86be847baeb02c5b216c8cd88fea4df249b09e670a20703abac24b0a91abc4a5646601442ba10becfd30993880051d07f56a05a9379e7a8e6befee3f22faa106398f7706006e42e9be1ef89d25c272f11a95095c587d713732284de9dbd3c7217b0689e21d8eb0ff69668
+Key = ML-DSA-44-RFC-Both
+PKCS8 = 30820a3e020100300b060960864801650304031104820a2a30820a260420000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f04820a00d7b2b47254aae0db45e7930d4a98d2c97d8f1397d1789dafa17024b316e9bec939ce0f7f77f8db5644dcda366bfe4734bd95f435ff9a613aa54aa41c2c694c04329a07b1fabb48f52a309f11a1898f848e2322ffe623ec810db3bee33685854a88269da320d5120bfcfe89a18e30f7114d83aa404a646b6c997389860d12522ee0006e2384819186619b260d118664d4a62822184482402898146148a6614c4248a19208c2382951244808a125c2083108c47120140914836c18a78084106ec9c07022b56408b0610c070498124451886959004622932041062e42b64c01164914284c41a85180460a5116515a0820022244dc9849d13251e13065d3c08592a85112a1640039220946621cc70cd9086dd0062652408580443091062c50c80924c5841a966d4a982c99066da4443220a7645a326e11b57020926124138e04852c0a4872c8a051d3082a99208058242024074e59148810a46460c06de0b28d1b1909203422c024410943710a212061a2015222521b80809a340013934dd3322922170a9892691a14512027219cc02062a2814818691a854d8344695b2041031242cb184601a90d0c023183b0215a224ac89205d9906904306a4b064ad2b2011c404081423252327254a6405a18100c321292c2805212625c82280bb46c03428d53100c14010ee1365288842491020a63462620062911c228d0204802b36ca236095a8648cbb4618b4662c440821a890910024d24b24520122524c90588288cc9c04d5948220a276ec134644c90605b445082864943880443b28c603080a2882d84a46d8ca629d0c68442064689885100a98d01498de4380da4068dd3947142b26c1a84611ba32842b42808a0711ac531e0a04c013765242862142890091061d940221b3360090292d02481200408491844a3222d5c8844149808a446610195640b390a0c9450ca406ad2b220c0380182308e13b908918084148829c0189112350da02422e20406d9c2850428121cc989180272d24029c20812d8062a9994719bb8682384291a2289144511dc82445096450c4484c0b2049aa60543862c44326e88442120a84c9a3070e3b82d63268803254903438c48a809ca147253344e1243081ba704593022d99480e234228142129c302a9434266104452426281346094a326d11280918b82562281113410d41b21190844c8b1212a2c688c9c030220606d2188e848630904452128831d9207113c52843060e033060cca6845826524c88011ef72562c85ffa43acfa49217f2b172d7bbc14620e6d980a71aabbdf0c45e9a206ecb1423fee15decc17601300149d9223cd6e6c6e1fa8e41fc7c64938ab68905fd3dcda50d87082e7d0d71d1bc9b2b84c85523ca8fe6cad294adf83be15b108ff721d0cc87bc3dd3a7590184b0e845663a91fc9e1c3c53a61d867420b04f092355753bc65a06368fd41295fd09924132c6f91f67964c142674a725c343914c4cecf58c074bcaf4558c97bf7911e07aa6d0938f2ee2bb3c1a8c595d635e84342fdea01dc24b211ad2fc281cf77e59110c7abc54bf0c86d480b9be276471dc9d603cee98cfdab3e9fcfb703793560549ea4450fa7b33fb9169c44b4d25fb9c457f49791cd3da03eac96095813c105132ccda4e63e49228cd23d8a1f37856f142d93b90db09f82af89258c63aab8047a80c036c9357ea2046f8dc6354f0c5295f342bb417d3cfeb0b1fd33622c29e14cbbd92e1363c65ebd4504b7512329b9670e32e1b2c67a54e7f1a55f8b9f9ea04e8ca3a705e62a3c5e637374afb7aeb6ddea612cde28f01a202d7aa4e34722d27dd3f9b89894d019fd5d4d7119efe3723bba104cb8bb0981e074de3afe200daaaead826cc45f244dbf431afab34efbdf782474d2fd57118f646214934ed99cba3b003e8d67a3836f6f19fc41910ce5163ee3ae99eb84d514eb761e63684ea56f9791d2dd4aac6e6168b948c817f75a222acb0e8cdc03cc4afe8f67157e1a363b7faeff9f172b98913677c5a1dd085e9ee4c22052c1af58193116673dcd3bfc5f34b855dcc6c77885649e9e71f43d4aea0f4b72ca7eda0578ba13d31a658d2d060a9a66ff69ed1be7997a2fb1d2723d38f9bfabe18f8e7b3cda906e4e9b5e942c8eaeb296070ebfd364947a940cc978bed66b37749e6d5dcd7be8c494440e2b84cecfefb98c0bedfb3c41e3359d2cd7197fbe720c48aa6c6b6465c1ee63e3569c2adc744491370b7f7826fe0b77a1d19d64101d032b918106b42d2ef73747e5601fe4ba50f23ede521f031a817d15294a43722e8378784b6db0cf1ba9e8ae911d9201b9ce9cc3019c6f5c27cb98da26144b64225a7c932b30f761e78a2d59a1d8b83ec6344a2f6dd47e765706d00bf4a79a6a926c3ba91d812c8f2c797ab1796709e5d16856778293529f0286d015c3b5399619642a333e9e593d6e3f5353994208e9e6a332851d7f652522a928b917e27e2d6d42137dfe2ebfa6fb1c67b26c0254528685f7ebdbe315a68eaa2da769e8a9f42d3e60007c71330926b2c0012d83ead4e4fd1ed872ccd1972201d2b027f3545ac2d30cd78bc1d740feccbc6fc2a0446c6e30eac51f5a69098aa2d447f2085b4e4e4b92ccc26921d2de478518cd090ce267aea2d27ada57fd88b4976d89fb843cdccf49a76ca2679e6801bfa7fb031896fb50629704b9923936bb5dd385311121cadfb11995e59b73034cf67ed03ab813867648d025828087e949a9afd16b95d72d99b1edca257aac132ffb7a0709aed5a9c0ff05fb0f2bbf28409eed7b5f5801be964ced019e1cb7851d3851f10290674e19ffb008b301c4acf641a2bb14216e1d69cabf52b5ef227496b0f30799a855d117fad3744a6fa33503ea798b52ddd7ee5426609dbfcd3f0c13b164d6c051f7ed4a119719a712e388d328402081ff1354b554d2c237afed3b151c4ba8e9f4bdeb8499a3066e26bbc69e8af089dec71731d1dc529eab17ef7374734c0fe475494c83836bdd34a03b9bc89914716061bfb98ec6e61c3ed4438edcaf25243c647086b9ea7018b0d9a8a0b00cecb00abde2498d69c2336101a772cbe4f571523f51bd05882cdf358b849cc140aa1faf22423a12851ce0e33fd48975a4959fa5c5fe418c93908191ab6e741b77bfe02cbd698ee795c466d615619e6441382c6eac01834ee9ab73cea80bbe235c78da91bd79b6f82f899785d68700d393e675c2224d6b7a1ad21320495679adaed70167b50866713a53109db7b6f7d81304ecdfd83b319b1ef248306b45ad29e7ddcc863dac56048b5d69ea175011f7614c00a86a863cde1872a8932878b9ac7e1ac5bda4997b72064f0cd75f4c814e034de11acb9013cf7ea926b4e7eaace070c7ba2188efad2e431e1223d45dd05c4d8403c2e45cee6413ecbe7527e873e455c4e610a61839aacc0bd56d2483e78f298b66a478eb2f558cbafca86be847baeb02c5b216c8cd88fea4df249b09e670a20703abac24b0a91abc4a5646601442ba10becfd30993880051d07f56a05a9379e7a8e6befee3f22faa106398f7706006e42e9be1ef89d25c272f11a95095c587d713732284de9dbd3c7217b0689e21d8eb0ff69668
 Error = PRIVATE_KEY_WAS_NOT_SEED
 
-PublicKey = ML-DSA-44-RFC-Public
-Algorithm = ML-DSA-44
-Input = 30820532300b06096086480165030403110382052100d7b2b47254aae0db45e7930d4a98d2c97d8f1397d1789dafa17024b316e9bec94fc9946d42f19b79a7413bbaa33e7149cb42ed5115693ac041facb988adeb5fe0e1d8631184995b592c397d2294e2e14f90aa414ba3826899ac43f4cccacbc26e9a832b95118d5cb433cbef9660b00138e0817f61e762ca274c36ad554eb22aac1162e4ab01acba1e38c4efd8f80b65b333d0f72e55dfe71ce9c1ebb9889e7c56106c0fd73803a2aecfeafded7aa3cb2ceda54d12bd8cd36a78cf975943b47abd25e880ac452e5742ed1e8d1a82afa86e590c758c15ae4d2840d92bca1a5090f40496597fca7d8b9513f1a1bda6e950aaa98de467507d4a4f5a4f0599216582c3572f62eda8905ab3581670c4a02777a33e0ca7295fd8f4ff6d1a0a3a7683d65f5f5f7fc60da023e826c5f92144c02f7d1ba1075987553ea9367fcd76d990b7fa99cd45afdb8836d43e459f5187df058479709a01ea6835935fa70460990cd3dc1ba401ba94bab1dde41ac67ab3319dcaca06048d4c4eef27ee13a9c17d0538f430f2d642dc2415660de78877d8d8abc72523978c042e4285f4319846c44126242976844c10e556ba215b5a719e59d0c6b2a96d39859071fdcc2cde7524a7bedae54e85b318e854e8fe2b2f3edfac9719128270aafd1e5044c3a4fdafd9ff31f90784b8e8e4596144a0daf586511d3d9962b9ea95af197b4e5fc60f2b1ed15de3a5bef5f89bdc79d91051d9b2816e74fa54531efdc1cbe74d448857f476bcd58f21c0b653b3b76a4e076a6559a302718555cc63f74859aabab925f023861ca8cd0f7badb2871f67d55326d7451135ad45f4a1ba69118fbb2c8a30eec9392ef3f977066c9add5c710cc647b1514d217d958c7017c3e90fd20c04e674b90486e9370a31a001d32f473979e4906749e7e477fa0b74508f8a5f2378312b83c25bd388ca0b0fff7478baf42b71667edaac97c46b129643e586e5b055a0c211946d4f36e675bed5860fa042a315d9826164d6a9237c35a5fbf495490a5bd4df248b95c4aae7784b605673166ac4245b5b4b082a09e9323e62f2078c5b76783446defd736ad3a3702d49b089844900a61833397bc4419b30d7a97a0b387c1911474c4d41b53e32a977acb6f0ea75db65bb39e59e701e76957def6f2d44559c31a77122b5204e3b5c219f1688b14ed0bc0b801b3e6e82dcd43e9c0e9f41744cd9815bd1bc8820d8bb123f04facd1b1b685dd5a2b1b8dbbf3ed933670f095a180b4f192d08b10b8fabbdfcc2b24518e32eea0a5e0c904ca844780083f3b0cd2d0b8b6af67bc355b9494025dc7b0a78fa80e3a2dbfeb51328851d6078198e9493651ae787ec0251f922ba30e9f51df62a6d72784cf3dd205393176dfa324a512bd94970a36dd34a514a86791f0eb36f0145b09ab64651b4a0313b299611a2a1c48891627598768a3114060ba4443486df51522a1ce88b30985c216f8e6ed178dd567b304a0d4cafba882a28342f17a9aa26ae58db630083d2c358fdf566c3f5d62a428567bc9ea8ce95caa0f35474b0bfa8f339a250ab4dfcf2083be8eefbc1055e18fe15370eecb260566d83ff06b211aaec43ca29b54ccd00f8815a2465ef0b46515cc7e41f3124f09efff739309ab58b29a1459a00bce5038e938c9678f72eb0e4ee5fdaae66d9f8573fc97fc42b4959f4bf8b61d78433e86b0335d6e9191c4d8bf487b3905c108cfd6ac24b0ceb7dcb7cf51f84d0ed687b95eaeb1c533c06f0d97023d92a70825837b59ba6cb7d4e56b0a87c203862ae8f315ba5925e8edefa679369a2202766151f16a965f9f81ece76cc070b55869e4db9784cf05c830b3242c8312
-Bits = 10496
-RawPublic = d7b2b47254aae0db45e7930d4a98d2c97d8f1397d1789dafa17024b316e9bec94fc9946d42f19b79a7413bbaa33e7149cb42ed5115693ac041facb988adeb5fe0e1d8631184995b592c397d2294e2e14f90aa414ba3826899ac43f4cccacbc26e9a832b95118d5cb433cbef9660b00138e0817f61e762ca274c36ad554eb22aac1162e4ab01acba1e38c4efd8f80b65b333d0f72e55dfe71ce9c1ebb9889e7c56106c0fd73803a2aecfeafded7aa3cb2ceda54d12bd8cd36a78cf975943b47abd25e880ac452e5742ed1e8d1a82afa86e590c758c15ae4d2840d92bca1a5090f40496597fca7d8b9513f1a1bda6e950aaa98de467507d4a4f5a4f0599216582c3572f62eda8905ab3581670c4a02777a33e0ca7295fd8f4ff6d1a0a3a7683d65f5f5f7fc60da023e826c5f92144c02f7d1ba1075987553ea9367fcd76d990b7fa99cd45afdb8836d43e459f5187df058479709a01ea6835935fa70460990cd3dc1ba401ba94bab1dde41ac67ab3319dcaca06048d4c4eef27ee13a9c17d0538f430f2d642dc2415660de78877d8d8abc72523978c042e4285f4319846c44126242976844c10e556ba215b5a719e59d0c6b2a96d39859071fdcc2cde7524a7bedae54e85b318e854e8fe2b2f3edfac9719128270aafd1e5044c3a4fdafd9ff31f90784b8e8e4596144a0daf586511d3d9962b9ea95af197b4e5fc60f2b1ed15de3a5bef5f89bdc79d91051d9b2816e74fa54531efdc1cbe74d448857f476bcd58f21c0b653b3b76a4e076a6559a302718555cc63f74859aabab925f023861ca8cd0f7badb2871f67d55326d7451135ad45f4a1ba69118fbb2c8a30eec9392ef3f977066c9add5c710cc647b1514d217d958c7017c3e90fd20c04e674b90486e9370a31a001d32f473979e4906749e7e477fa0b74508f8a5f2378312b83c25bd388ca0b0fff7478baf42b71667edaac97c46b129643e586e5b055a0c211946d4f36e675bed5860fa042a315d9826164d6a9237c35a5fbf495490a5bd4df248b95c4aae7784b605673166ac4245b5b4b082a09e9323e62f2078c5b76783446defd736ad3a3702d49b089844900a61833397bc4419b30d7a97a0b387c1911474c4d41b53e32a977acb6f0ea75db65bb39e59e701e76957def6f2d44559c31a77122b5204e3b5c219f1688b14ed0bc0b801b3e6e82dcd43e9c0e9f41744cd9815bd1bc8820d8bb123f04facd1b1b685dd5a2b1b8dbbf3ed933670f095a180b4f192d08b10b8fabbdfcc2b24518e32eea0a5e0c904ca844780083f3b0cd2d0b8b6af67bc355b9494025dc7b0a78fa80e3a2dbfeb51328851d6078198e9493651ae787ec0251f922ba30e9f51df62a6d72784cf3dd205393176dfa324a512bd94970a36dd34a514a86791f0eb36f0145b09ab64651b4a0313b299611a2a1c48891627598768a3114060ba4443486df51522a1ce88b30985c216f8e6ed178dd567b304a0d4cafba882a28342f17a9aa26ae58db630083d2c358fdf566c3f5d62a428567bc9ea8ce95caa0f35474b0bfa8f339a250ab4dfcf2083be8eefbc1055e18fe15370eecb260566d83ff06b211aaec43ca29b54ccd00f8815a2465ef0b46515cc7e41f3124f09efff739309ab58b29a1459a00bce5038e938c9678f72eb0e4ee5fdaae66d9f8573fc97fc42b4959f4bf8b61d78433e86b0335d6e9191c4d8bf487b3905c108cfd6ac24b0ceb7dcb7cf51f84d0ed687b95eaeb1c533c06f0d97023d92a70825837b59ba6cb7d4e56b0a87c203862ae8f315ba5925e8edefa679369a2202766151f16a965f9f81ece76cc070b55869e4db9784cf05c830b3242c8312
-
-PrivateKey = ML-DSA-65-RFC-Seed
+Key = ML-DSA-65-RFC
 Algorithm = ML-DSA-65
-Input = 3034020100300b060960864801650304031204228020000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
+SPKI = 308207b2300b0609608648016503040312038207a10048683d91978e31eb3dddb8b0473482d2b88a5f625949fd8f58a561e696bd4c27d05b38dbb2edf01e664efd81be1ea893688ce68aa2d51c5958f8bbc6eb4e89ee67d2c0320954d57212cac7229ff1d6eaf03928bd51511f8d88d847736c7de2730d5978e5410713160978867711bf5539a0bfc4c350c2be572baf0ee2e2fb16ccfea08028d99ac49aebb75937ddce111cdab62fff3cea8ba2233d1e56fbc5c5a1e726de63fadd2af016b119177fa3d971a2d9277173fce55b67745af0b7c21d597dbeb93e6a32f341c49a5a8be9e825088d1f2aa45155d6c8ae15367e4eb003b8fdf7851071949739f9fff09023eaf45104d2a84a45906eed4671a44dc28d27987bb55df69e9e8561f61a80a72699503865fed9b7ee72a8e17a19c408144f4b29afef7031c3a6d8571610b42c9f421245a88f197e16812b031159b65b9687e5b3e934c5225ae98a79ba73d2b399d73510effad19e53b8450f0ba8fce1012fd98d260a74aaaa13fae249a006b1c34f5ba0b882f26378222fb36f2283c243f0ffeb5f1bb414a0a70d55e3d40a56b6cbc88ae1f03b7b2882d98deea28e145c9dedfd8eaf1cef2ed94a8b050f8964f46d1ea0d0c2a43e0dda6182adbf4f6ed175b6742257859bf22f3a417ecf1f9d89317b5e539d587af16b9e1313e04514ffa64ba8b3ff2b8321f8811cb3fb022c8f644e70a4b80a2fbfee604abb7379091ea8e6c5c74dfc0283666b40c0793870028204a136bf5da9568eb798d349038bdb0c11e03445e7847cb5069c75cf28ac601c7799d958210ddbcb226e51afef9f1de47b073873d6d3f97456bede085082e74a298b2cd48f4b3093155f366c8fa601c6af858dfa32c08491b2a29887f90335949a5d6edaa679882a3a95d6bf6d970a221f4b9d3d8cbf384af81aac95e2b3294e04789ac83727a5dc04559f96af41d8a053516feeeebc52746eb6ab2819e09108710d835f011fa63065872ad334d5cdffb2b2310507e92fc993ae317da97f4f309cdaf0f67ed99d90215576083849f953b246d7fedb3fdb67679850a5ad404e64147fb7cf4f6aeddd05afb4b834968d1fe88014960dce5d942236526e12a478d69e5fbe6970310b308c06845018cfc7b2ab430a13a6b1ac7bb02cccbb3d911ac2f11068613fbe029bfdce02cf5cd38950ed72c83944edfbc75615af87f864c051f3c55456c5412863a40c06d1dab562bdff0571b8d3c3917bbd300880bba5e998239b95fa91b7d6416d4f398b3adbcd30983ed3592b4d9ef7d4236fd00f50d98aa53a235ac4172720f77d96172672980cfe8ff7a5a702783edc2ba31b2259015a112fc7f468a9c2f9464039002d30ef678b4cb798bc116216bf7a9a7c18ba03b7b58fd07515d3115049d3614be7a07e744300750df1d2c58753389059eafc3d785ccdd31c07648bedc03a5c3b8ad46d064d59c13d57374729fc4e295362e2a5191204530428bc1522afa28ff5fe1655e304ca5bc8c27ad0e0c6a39dd4df28956c14b38cc93682cefe402bbd5e82d29c464e44eb5d37b48fc568dfe0cc6e8e16baea05e5135590f19294e73e8367b0216dbb815030b9de55913f08039c42351c59e5515dd5af8e089a15e625e8f6dee639386c46497d7a263288774de581a7de9629b41b4424141f978fb8331208efdec3c6e0de39bc57063f3dcd6c470373c08891ea29cbc7cc6d6483b8889083ace86aa7b51b1c2cfe6e2ad18d97ce36fbc56ea42fae97e6a7ac114864478c366df1ebb1e7b11a9098504fd5975bdf1f49dc70002b63c1739a9d263fbad4073f6a9f6c2b8af4b4c332a103a0cffa5deeb2d062ca3c215fd360026be7c5164f4a4424ef74948804d66f46487732c8202c795478647b4ea71d627c086024cca354a41f0877b38f19b3774ad2095c8da53b069e21c76ae2d2007e16719ed40080d334f7da52e9f5a5990439caf083a95b833f02ad10a08c1a6d0f260c007285bd4a2f47703a5aef465287d253b18ac22514316210ff566814b10f87a293d6f199d3c3959990d0c1268b4f50d5f9fcefbbf237bd0c28b80182d6659741f14f10bfbb21bba12ab620aa2396f56c0686b4ea9017990224216b2fe8ad76c4a9148eef9a86a3635a6aa77bc1dcfb6fba59a77dfda9b7530dc0ca8648c8d973738e01bab8f08b4905e84aa4641bd602410cd97520265f2f231f2b35e15eb2fa04d2bd94d5a77abaf1e0e161010a990087f5b46ea988b2bc0512fda0fa923dadd6c45c5301d09483673265b5ab2e10f4ba520f6bbad564a5c3d5e27bdb080f7d20e13296a3181954c39c649c943ebe17df5c1f7aae0a8fe126c477585a5d4d648a0d008b6af5e8cd31be69a9296d4f3fd25ed86f221e4b93f65f5929967533624b9235750c30707550b58536d109a7131c5a5bbe4a5715567c12534aec7660761eebb9fae2891c774589b80e566ad557ddef7367196b7227ea9870ef09ddfec79d6b9319a6879b5205d76bf7aba5acf33afb59d17fc54e68383d6be5a08e9b66da53dcde008bb294b8582bd132cdcc49959fdbc21e52721880c8ad0352c79f03a43bbd84c4cdfdc6c529005e1e7cd9a349a7168a35569ba5dea818968d5a91466bd6e64e20bf62417198afc4e81c28dd77ed4028232398b52fbde86bc84f475b9016710ce2aabc11a06b4dbac901ec16cf365ca3f2d53813948a693a0f93e79c46ca5d5a6dca3d28ca50ad18bd13fca55059dd9b185f79f9c47196a4e81b2104bc460a051e02f2e8444f
+PKCS8 = 3034020100300b060960864801650304031204228020000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
 Bits = 15616
 RawPublic = 48683d91978e31eb3dddb8b0473482d2b88a5f625949fd8f58a561e696bd4c27d05b38dbb2edf01e664efd81be1ea893688ce68aa2d51c5958f8bbc6eb4e89ee67d2c0320954d57212cac7229ff1d6eaf03928bd51511f8d88d847736c7de2730d5978e5410713160978867711bf5539a0bfc4c350c2be572baf0ee2e2fb16ccfea08028d99ac49aebb75937ddce111cdab62fff3cea8ba2233d1e56fbc5c5a1e726de63fadd2af016b119177fa3d971a2d9277173fce55b67745af0b7c21d597dbeb93e6a32f341c49a5a8be9e825088d1f2aa45155d6c8ae15367e4eb003b8fdf7851071949739f9fff09023eaf45104d2a84a45906eed4671a44dc28d27987bb55df69e9e8561f61a80a72699503865fed9b7ee72a8e17a19c408144f4b29afef7031c3a6d8571610b42c9f421245a88f197e16812b031159b65b9687e5b3e934c5225ae98a79ba73d2b399d73510effad19e53b8450f0ba8fce1012fd98d260a74aaaa13fae249a006b1c34f5ba0b882f26378222fb36f2283c243f0ffeb5f1bb414a0a70d55e3d40a56b6cbc88ae1f03b7b2882d98deea28e145c9dedfd8eaf1cef2ed94a8b050f8964f46d1ea0d0c2a43e0dda6182adbf4f6ed175b6742257859bf22f3a417ecf1f9d89317b5e539d587af16b9e1313e04514ffa64ba8b3ff2b8321f8811cb3fb022c8f644e70a4b80a2fbfee604abb7379091ea8e6c5c74dfc0283666b40c0793870028204a136bf5da9568eb798d349038bdb0c11e03445e7847cb5069c75cf28ac601c7799d958210ddbcb226e51afef9f1de47b073873d6d3f97456bede085082e74a298b2cd48f4b3093155f366c8fa601c6af858dfa32c08491b2a29887f90335949a5d6edaa679882a3a95d6bf6d970a221f4b9d3d8cbf384af81aac95e2b3294e04789ac83727a5dc04559f96af41d8a053516feeeebc52746eb6ab2819e09108710d835f011fa63065872ad334d5cdffb2b2310507e92fc993ae317da97f4f309cdaf0f67ed99d90215576083849f953b246d7fedb3fdb67679850a5ad404e64147fb7cf4f6aeddd05afb4b834968d1fe88014960dce5d942236526e12a478d69e5fbe6970310b308c06845018cfc7b2ab430a13a6b1ac7bb02cccbb3d911ac2f11068613fbe029bfdce02cf5cd38950ed72c83944edfbc75615af87f864c051f3c55456c5412863a40c06d1dab562bdff0571b8d3c3917bbd300880bba5e998239b95fa91b7d6416d4f398b3adbcd30983ed3592b4d9ef7d4236fd00f50d98aa53a235ac4172720f77d96172672980cfe8ff7a5a702783edc2ba31b2259015a112fc7f468a9c2f9464039002d30ef678b4cb798bc116216bf7a9a7c18ba03b7b58fd07515d3115049d3614be7a07e744300750df1d2c58753389059eafc3d785ccdd31c07648bedc03a5c3b8ad46d064d59c13d57374729fc4e295362e2a5191204530428bc1522afa28ff5fe1655e304ca5bc8c27ad0e0c6a39dd4df28956c14b38cc93682cefe402bbd5e82d29c464e44eb5d37b48fc568dfe0cc6e8e16baea05e5135590f19294e73e8367b0216dbb815030b9de55913f08039c42351c59e5515dd5af8e089a15e625e8f6dee639386c46497d7a263288774de581a7de9629b41b4424141f978fb8331208efdec3c6e0de39bc57063f3dcd6c470373c08891ea29cbc7cc6d6483b8889083ace86aa7b51b1c2cfe6e2ad18d97ce36fbc56ea42fae97e6a7ac114864478c366df1ebb1e7b11a9098504fd5975bdf1f49dc70002b63c1739a9d263fbad4073f6a9f6c2b8af4b4c332a103a0cffa5deeb2d062ca3c215fd360026be7c5164f4a4424ef74948804d66f46487732c8202c795478647b4ea71d627c086024cca354a41f0877b38f19b3774ad2095c8da53b069e21c76ae2d2007e16719ed40080d334f7da52e9f5a5990439caf083a95b833f02ad10a08c1a6d0f260c007285bd4a2f47703a5aef465287d253b18ac22514316210ff566814b10f87a293d6f199d3c3959990d0c1268b4f50d5f9fcefbbf237bd0c28b80182d6659741f14f10bfbb21bba12ab620aa2396f56c0686b4ea9017990224216b2fe8ad76c4a9148eef9a86a3635a6aa77bc1dcfb6fba59a77dfda9b7530dc0ca8648c8d973738e01bab8f08b4905e84aa4641bd602410cd97520265f2f231f2b35e15eb2fa04d2bd94d5a77abaf1e0e161010a990087f5b46ea988b2bc0512fda0fa923dadd6c45c5301d09483673265b5ab2e10f4ba520f6bbad564a5c3d5e27bdb080f7d20e13296a3181954c39c649c943ebe17df5c1f7aae0a8fe126c477585a5d4d648a0d008b6af5e8cd31be69a9296d4f3fd25ed86f221e4b93f65f5929967533624b9235750c30707550b58536d109a7131c5a5bbe4a5715567c12534aec7660761eebb9fae2891c774589b80e566ad557ddef7367196b7227ea9870ef09ddfec79d6b9319a6879b5205d76bf7aba5acf33afb59d17fc54e68383d6be5a08e9b66da53dcde008bb294b8582bd132cdcc49959fdbc21e52721880c8ad0352c79f03a43bbd84c4cdfdc6c529005e1e7cd9a349a7168a35569ba5dea818968d5a91466bd6e64e20bf62417198afc4e81c28dd77ed4028232398b52fbde86bc84f475b9016710ce2aabc11a06b4dbac901ec16cf365ca3f2d53813948a693a0f93e79c46ca5d5a6dca3d28ca50ad18bd13fca55059dd9b185f79f9c47196a4e81b2104bc460a051e02f2e8444f
 PrivateSeed = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
 
-PrivateKey = ML-DSA-65-RFC-Expanded
-Input = 30820fd8020100300b060960864801650304031204820fc404820fc048683d91978e31eb3dddb8b0473482d2b88a5f625949fd8f58a561e696bd4c27d853fa69b8199023e8cd678dd9fabf9047646ffd0cb3cc7f795805a71e70d2371b0563e3cd3346149c8c9ebcf23b0a4e5a900eea9c6562790a7c63e38663daa2dddb6e480dc405a1e701948b74841ef5cc1c3f2bf327972e9510510cd5375ecc0855717711872221862381000424778061475007501717035504515125471838046175722244108868608646012747567180870666864332444122043638667502823634244322057364106455547722755681433614625508206437685468754353751068718333805475052580752818843811087260202008588301836113828212061711578768788878643754601657155084718866072732880664741856762180318276641578245025646643113504364780126673143011660655864718368863503847861101202356116137860785321240075478823043666116604255418285605367785638434430632610770731784272141116530385276867460150823735320766107504681248066603032652312445408800318088767217307182472151278011654474866172233380866064468352158420368011802118183317735453488100448653674370577258833460384232856810060426042584560235682051838638432421224245645858677145728504788717180618836086864156508116502646700608266227383172407257300727288620667588682607064020330343663155464245345667187345658370225084685628807036708462371710065717584778708655537822351446772856730322870014332061715845526632502651334777380355164313473510662751757402468881706743468186017652453330872104343401032287635155265081307745444168154183636411204026873043677712808846355453006245810458365124842780345166635843785601465115742321436685224777313450178362420550006484471234408800604735405783336308210615225207248851348637067622588571265673476816464684258708122705500838320023208066345336003346857247063554003577122752307142536874374570056643224482852072183330205337334077278055253063525040673346131807280717248377634573185851602333443625164338160858773462428830070365853755007552315037021324630437086806361503030043586357080211066473463522620330438021085287578321078867480856347436734284058466841437005510873426447721127384736526472577144704178644260247118740812216605847178137067680817058185585471363421075580163583585184403847110338742628247741365544270734635777500662562684202124683864616646031225388845400845734464754472560546166846630880638271563287183840652247681160662130330186802801384630505657238758365723230688046122606651675570532413227673517080153001628460134887701118815571315464311704732882856368234555041862765631111687505104254414427852211171788153685157447166255365583630250285576875327137103723705714761713651841242366444664143520521085157033363860258426628148110546268173038756433216588568663632813406254012040886547886171657623726234867030115115632050753502122108426531435567111525720106853630150557586058784314313278788087384788637881813873426178388524667733506021151464238232680135440783475385535752832335187601152134325773333655188615816168241842212230841448151201103024777242544366067717707603014525403500183873237735265086357113734481605277456553730085837785035121115480628850180268138652053468013207241803213005723864076427114101838525510632607104865176833828572762354518735083132886376661426311675033112553764176031433177212234418a82e4f5c9ea0faf99eb04d78a7332711117c33f18eca21f8743376ada5219804a7ed9a5557fcd67a3550b3a4b8c588629c021475fa3d56d5d6cfbb1a09bda8d14de622ddff16d8bc99b14278a8af1d76bed157672dd9c32316f97e8daadef8d9da69586725567fb96b59990d4bf0bc9c195b90b74295f5675b24257c2710c175b0153f2911328c2eb7abb9ad46e70a8b53c39ea642cee4b3cb42620e863ce8b650ce8adcd923721a1687023c673a8cbb6b03d51cd197e8c346ebadce93950f88cee201db9e320843e29f300d9a19500d70a4caf272c69e4eef69fbb8a55efd7ca2bed990d2d3b582848f9c45c2abc54cfc47d34f06c0ffa56fcd762ab9cba9146d7725218963b240d72b6d22c93171fbd47788b76e72042def0878d23df631a1a1e5a6027686de5b4a10e91069c8f2ba0259b04d6409da96567ca52da497026e583a0ecefc1f01e6b988e21f9767a2b7e1672deb9a1e2a3fcc863aa91517c334620601b4fe79730e934935f4b6fbc4e32695145c2b5f6a127fecc0a277451ebc3fd523444f9ee7c9c34534f356db544fc31c1bfde5f65c77ea2f7c2eae4c55ebaf104271c566fd4ebac71c7a62c74952817ae675504d9599b1b762b6aca168a83248c9d9adb0ceb1556e5759490bbc0c7900795ad72123038b662f64f106a9993681a25d59af7bc97a235be9284c5bc45a6c90cb1c2999c663d96b478e2307f85548957d65740e2673e9ebd1352829038f462b8fd3b5681da55c0252523853525ea0ad647e71ac2c5a8893e603ac97e56c04ceb2f26f5c5b4b6d94ab811380fd00f2208fe86535086aebfd35c29120624c04fbb6113929d9c556350253766c209fdba83c95fccd342a28099355d00bc863f4eef596eb0b42ebcc7c79491cceae205ea0b8059fbb8a5726c5949d2b15e7e29c51fc9b02ee1a4fc357b5f1bef9c4add46a2a920c2fbf08a37eb1514bfa15110a4392a74c6f13c50c5cffd97531098d7cd23b60eb35c4a428b46c55386e1010c4ba7f70e4c7ecb7575f3063a71e84dfdcf09a58b2cdb0f99f27ed378610d25cbad7bfa6ba0d59189cfe88eab9b46d7e6db0307eabe4198e99bd71f779ab66581e0912fc7b1d2585245e9a12687a975cd5e8e1dcc045d5f891c4c685db07cf81e77389b363eb6bdfe39b27ff84c97eefee162e3b451fe6914719cb6436d855960ff915d7cea6adeafdfc1c05786c49f923a474ffdfc3153a06e6ed0b0ad220d72524434d5273c0aab6dde4e91476d581a2695a60de6d9f44d77aa08266e938eeb4a9597c9b64986059e49262a4eab2454e14015ad0536c42733a5d77d7995c2a20446009ebfe5632c80c08ed2b97af35066489f597eb1b1f11f04f60e0c9040159c44ab3e60e0a15229d191228bed17bbc3ac939b3c67cee135f352c27216c9c31f72a3e87040c5f619306eb0b6cca2a9ce7b22a1694d00ca9c05e315126457f26ce84f9617241860782f864b473d84017491902b1bdc8cdc5800dd46127fb80a71c095b473a562529b3b1e7e437e158a5f6666e9974d005b062c2309e6dce98f9b658c6e3f9a216d58c8c9142bd1c8c85a9da872ebbfad3fea9d9aba2b68c0e8f19c6ff5f00584d45daf9d6c9d69ed04b8da8d687258b77807927612c530446fea7697ae3f926698929bc6a5a8cf3e2024c0f0c5ee57b5869bf981881caf9e3665fc7f7efc678929f87a56eaa42ea4d1ff6691822dd79a47096b776d1d8f01456e5873b0738406c382c573ae9cde2d9e7f231b6cc5c676e7cf43963373013a58075381ff0949be084546d72e4f8a3e5fe4aa5091add234e2afe0030b1b663ae9d2d32410986b9402aaaf2465b74a5e2d0bc38e3a92bbddd8a1fed7b948c23cce6f8c08fe356835ba65b0f984068616ef48138efd89bf357a54d2ebbf376cbdcc69c5f1f61c64d2794bc06ccb9abdf66e25085d8c830e2ae3b0fe0f07a7af8b9320bf342970997d67d7c12593a8fbfade635aac53083a7022c47d5f77a52b57b598da9392ae6d86afc46fc06455181b9c75a646dc21f81e4bf213753de737fd2a140027920add35a223f9f5f4465ceb60c03ed0455a333a5cc83adbf43f1f42c2ccb8328c21c7ab7faed2b21cfade2da55223aaab2af9b41c7332341746341b39aa2f43815650f5480511424cfa6901779c4d18b638cc0287aaaf31680338d20b17c7449fdc6a278a8d96a82ee4c4eca40125e2d65290071c7aef1be6a991598fb9d59512523bcd4b38c566b8e80a73ae333e134414327ef1d83c47c49dfe7936df1338a5e247787868fc84fdcb95ac89c185c4bb5fd57b2338ac42b41c10a823df39624f36b15a2f067584e06ca2e08ccaff1618fe01dd06df3512e0b724dec8506da24215acacc2c51b82ad8d302002fb41068b1da4f8bb147987b3516bad5dbddf01318fd3fa9bc43702ac498c719d95f2e841b622a5e4848a3c5c262959992ea7a7d72ca8a368028f497dfad93355cbb1bb9786d14ff2cf590317848f95856427110dda36f5192a816ce9c8816cc7bbfc804efc40085a3850b89f1e7fe5656dba410f906a97c32336c1ae7e81737a83e087354e428da8538d948dbf5dfacb59dd2b5fd3bc803f4ba432c9a739df2cfa9ed9484320f97edff1a48c6b86b3002cfb772dd5e562bc4c3d683ed964b6199fa0514b0790d958095b7b85c6be875fbb559e1930146ccea63a388a194fe09c3dea03be52de27e901017afe809af630a7382bf5c4cd4d1b8f41579fb4348ede4ca05f4cd3f139a31b2544e516dbe4086b9bb4b2bed47e2d230982dd5192429d377b7c0745cc068e2f5a4aa04c7ff87209ed1259976a0fc9b25e9e851d4e3502c02c85d6dff029e211d01ebf0e9e7188d568f8437d813b0f122f2fb17603b693ed9c38f17cfd50b815e6d9dfc0ed2ccf19f6399274a1420f235a59d8bf724345e14e45d9e4be8934dfc3fa92678db61d7118bf53cb8a2225b335f7eae50e3f941237628db76d8ea38f77a72af3a26c81fe43523b335535a5d1db7c38f341082bb5734d089e8ae309cfda3a0bcb5cd5b097113c8edf9616aa4f6e6631b9125276fb3f680a34341c3db668dc6cad45fc93b2708ca2af75ccce734fd191c50089dad53982fddae02531ff93e1f21ff395fc0a12874edf06b6f9647e95a7324586c71dfd91d901d621858190fecd00ccd110bbac59f96cb884c3c93994748a56f41283bfc41fb89052153a894588c3cb9017f3d66326c985637e575acb812346342654025d602de3ba940c19ac1a633dffda977b529b8013e19c1d6d0680f4dae62c924450ae66aab82f21473061dab3d62b247f907e3551939ad3f5465e9d08a82bfea17eea1b6b2b923757477f993000b2f43b70f28aaab1fe9a26ad1fd3361616c0b0e242fe76604b7033a1f30e97e28f526ca3c880fe2b8d9d1b0c9ff188b31cb9d97425acab9b216d98a6ae355e583da71e8864ee3d16b0759796190ef545c1e62bfef92af6ca147b13244d6c892fc8ef223ab3f43f924c2f466097ee8
+Key = ML-DSA-65-RFC-Expanded
+PKCS8 = 30820fd8020100300b060960864801650304031204820fc404820fc048683d91978e31eb3dddb8b0473482d2b88a5f625949fd8f58a561e696bd4c27d853fa69b8199023e8cd678dd9fabf9047646ffd0cb3cc7f795805a71e70d2371b0563e3cd3346149c8c9ebcf23b0a4e5a900eea9c6562790a7c63e38663daa2dddb6e480dc405a1e701948b74841ef5cc1c3f2bf327972e9510510cd5375ecc0855717711872221862381000424778061475007501717035504515125471838046175722244108868608646012747567180870666864332444122043638667502823634244322057364106455547722755681433614625508206437685468754353751068718333805475052580752818843811087260202008588301836113828212061711578768788878643754601657155084718866072732880664741856762180318276641578245025646643113504364780126673143011660655864718368863503847861101202356116137860785321240075478823043666116604255418285605367785638434430632610770731784272141116530385276867460150823735320766107504681248066603032652312445408800318088767217307182472151278011654474866172233380866064468352158420368011802118183317735453488100448653674370577258833460384232856810060426042584560235682051838638432421224245645858677145728504788717180618836086864156508116502646700608266227383172407257300727288620667588682607064020330343663155464245345667187345658370225084685628807036708462371710065717584778708655537822351446772856730322870014332061715845526632502651334777380355164313473510662751757402468881706743468186017652453330872104343401032287635155265081307745444168154183636411204026873043677712808846355453006245810458365124842780345166635843785601465115742321436685224777313450178362420550006484471234408800604735405783336308210615225207248851348637067622588571265673476816464684258708122705500838320023208066345336003346857247063554003577122752307142536874374570056643224482852072183330205337334077278055253063525040673346131807280717248377634573185851602333443625164338160858773462428830070365853755007552315037021324630437086806361503030043586357080211066473463522620330438021085287578321078867480856347436734284058466841437005510873426447721127384736526472577144704178644260247118740812216605847178137067680817058185585471363421075580163583585184403847110338742628247741365544270734635777500662562684202124683864616646031225388845400845734464754472560546166846630880638271563287183840652247681160662130330186802801384630505657238758365723230688046122606651675570532413227673517080153001628460134887701118815571315464311704732882856368234555041862765631111687505104254414427852211171788153685157447166255365583630250285576875327137103723705714761713651841242366444664143520521085157033363860258426628148110546268173038756433216588568663632813406254012040886547886171657623726234867030115115632050753502122108426531435567111525720106853630150557586058784314313278788087384788637881813873426178388524667733506021151464238232680135440783475385535752832335187601152134325773333655188615816168241842212230841448151201103024777242544366067717707603014525403500183873237735265086357113734481605277456553730085837785035121115480628850180268138652053468013207241803213005723864076427114101838525510632607104865176833828572762354518735083132886376661426311675033112553764176031433177212234418a82e4f5c9ea0faf99eb04d78a7332711117c33f18eca21f8743376ada5219804a7ed9a5557fcd67a3550b3a4b8c588629c021475fa3d56d5d6cfbb1a09bda8d14de622ddff16d8bc99b14278a8af1d76bed157672dd9c32316f97e8daadef8d9da69586725567fb96b59990d4bf0bc9c195b90b74295f5675b24257c2710c175b0153f2911328c2eb7abb9ad46e70a8b53c39ea642cee4b3cb42620e863ce8b650ce8adcd923721a1687023c673a8cbb6b03d51cd197e8c346ebadce93950f88cee201db9e320843e29f300d9a19500d70a4caf272c69e4eef69fbb8a55efd7ca2bed990d2d3b582848f9c45c2abc54cfc47d34f06c0ffa56fcd762ab9cba9146d7725218963b240d72b6d22c93171fbd47788b76e72042def0878d23df631a1a1e5a6027686de5b4a10e91069c8f2ba0259b04d6409da96567ca52da497026e583a0ecefc1f01e6b988e21f9767a2b7e1672deb9a1e2a3fcc863aa91517c334620601b4fe79730e934935f4b6fbc4e32695145c2b5f6a127fecc0a277451ebc3fd523444f9ee7c9c34534f356db544fc31c1bfde5f65c77ea2f7c2eae4c55ebaf104271c566fd4ebac71c7a62c74952817ae675504d9599b1b762b6aca168a83248c9d9adb0ceb1556e5759490bbc0c7900795ad72123038b662f64f106a9993681a25d59af7bc97a235be9284c5bc45a6c90cb1c2999c663d96b478e2307f85548957d65740e2673e9ebd1352829038f462b8fd3b5681da55c0252523853525ea0ad647e71ac2c5a8893e603ac97e56c04ceb2f26f5c5b4b6d94ab811380fd00f2208fe86535086aebfd35c29120624c04fbb6113929d9c556350253766c209fdba83c95fccd342a28099355d00bc863f4eef596eb0b42ebcc7c79491cceae205ea0b8059fbb8a5726c5949d2b15e7e29c51fc9b02ee1a4fc357b5f1bef9c4add46a2a920c2fbf08a37eb1514bfa15110a4392a74c6f13c50c5cffd97531098d7cd23b60eb35c4a428b46c55386e1010c4ba7f70e4c7ecb7575f3063a71e84dfdcf09a58b2cdb0f99f27ed378610d25cbad7bfa6ba0d59189cfe88eab9b46d7e6db0307eabe4198e99bd71f779ab66581e0912fc7b1d2585245e9a12687a975cd5e8e1dcc045d5f891c4c685db07cf81e77389b363eb6bdfe39b27ff84c97eefee162e3b451fe6914719cb6436d855960ff915d7cea6adeafdfc1c05786c49f923a474ffdfc3153a06e6ed0b0ad220d72524434d5273c0aab6dde4e91476d581a2695a60de6d9f44d77aa08266e938eeb4a9597c9b64986059e49262a4eab2454e14015ad0536c42733a5d77d7995c2a20446009ebfe5632c80c08ed2b97af35066489f597eb1b1f11f04f60e0c9040159c44ab3e60e0a15229d191228bed17bbc3ac939b3c67cee135f352c27216c9c31f72a3e87040c5f619306eb0b6cca2a9ce7b22a1694d00ca9c05e315126457f26ce84f9617241860782f864b473d84017491902b1bdc8cdc5800dd46127fb80a71c095b473a562529b3b1e7e437e158a5f6666e9974d005b062c2309e6dce98f9b658c6e3f9a216d58c8c9142bd1c8c85a9da872ebbfad3fea9d9aba2b68c0e8f19c6ff5f00584d45daf9d6c9d69ed04b8da8d687258b77807927612c530446fea7697ae3f926698929bc6a5a8cf3e2024c0f0c5ee57b5869bf981881caf9e3665fc7f7efc678929f87a56eaa42ea4d1ff6691822dd79a47096b776d1d8f01456e5873b0738406c382c573ae9cde2d9e7f231b6cc5c676e7cf43963373013a58075381ff0949be084546d72e4f8a3e5fe4aa5091add234e2afe0030b1b663ae9d2d32410986b9402aaaf2465b74a5e2d0bc38e3a92bbddd8a1fed7b948c23cce6f8c08fe356835ba65b0f984068616ef48138efd89bf357a54d2ebbf376cbdcc69c5f1f61c64d2794bc06ccb9abdf66e25085d8c830e2ae3b0fe0f07a7af8b9320bf342970997d67d7c12593a8fbfade635aac53083a7022c47d5f77a52b57b598da9392ae6d86afc46fc06455181b9c75a646dc21f81e4bf213753de737fd2a140027920add35a223f9f5f4465ceb60c03ed0455a333a5cc83adbf43f1f42c2ccb8328c21c7ab7faed2b21cfade2da55223aaab2af9b41c7332341746341b39aa2f43815650f5480511424cfa6901779c4d18b638cc0287aaaf31680338d20b17c7449fdc6a278a8d96a82ee4c4eca40125e2d65290071c7aef1be6a991598fb9d59512523bcd4b38c566b8e80a73ae333e134414327ef1d83c47c49dfe7936df1338a5e247787868fc84fdcb95ac89c185c4bb5fd57b2338ac42b41c10a823df39624f36b15a2f067584e06ca2e08ccaff1618fe01dd06df3512e0b724dec8506da24215acacc2c51b82ad8d302002fb41068b1da4f8bb147987b3516bad5dbddf01318fd3fa9bc43702ac498c719d95f2e841b622a5e4848a3c5c262959992ea7a7d72ca8a368028f497dfad93355cbb1bb9786d14ff2cf590317848f95856427110dda36f5192a816ce9c8816cc7bbfc804efc40085a3850b89f1e7fe5656dba410f906a97c32336c1ae7e81737a83e087354e428da8538d948dbf5dfacb59dd2b5fd3bc803f4ba432c9a739df2cfa9ed9484320f97edff1a48c6b86b3002cfb772dd5e562bc4c3d683ed964b6199fa0514b0790d958095b7b85c6be875fbb559e1930146ccea63a388a194fe09c3dea03be52de27e901017afe809af630a7382bf5c4cd4d1b8f41579fb4348ede4ca05f4cd3f139a31b2544e516dbe4086b9bb4b2bed47e2d230982dd5192429d377b7c0745cc068e2f5a4aa04c7ff87209ed1259976a0fc9b25e9e851d4e3502c02c85d6dff029e211d01ebf0e9e7188d568f8437d813b0f122f2fb17603b693ed9c38f17cfd50b815e6d9dfc0ed2ccf19f6399274a1420f235a59d8bf724345e14e45d9e4be8934dfc3fa92678db61d7118bf53cb8a2225b335f7eae50e3f941237628db76d8ea38f77a72af3a26c81fe43523b335535a5d1db7c38f341082bb5734d089e8ae309cfda3a0bcb5cd5b097113c8edf9616aa4f6e6631b9125276fb3f680a34341c3db668dc6cad45fc93b2708ca2af75ccce734fd191c50089dad53982fddae02531ff93e1f21ff395fc0a12874edf06b6f9647e95a7324586c71dfd91d901d621858190fecd00ccd110bbac59f96cb884c3c93994748a56f41283bfc41fb89052153a894588c3cb9017f3d66326c985637e575acb812346342654025d602de3ba940c19ac1a633dffda977b529b8013e19c1d6d0680f4dae62c924450ae66aab82f21473061dab3d62b247f907e3551939ad3f5465e9d08a82bfea17eea1b6b2b923757477f993000b2f43b70f28aaab1fe9a26ad1fd3361616c0b0e242fe76604b7033a1f30e97e28f526ca3c880fe2b8d9d1b0c9ff188b31cb9d97425acab9b216d98a6ae355e583da71e8864ee3d16b0759796190ef545c1e62bfef92af6ca147b13244d6c892fc8ef223ab3f43f924c2f466097ee8
 Error = PRIVATE_KEY_WAS_NOT_SEED
 
-PrivateKey = ML-DSA-65-RFC-Both
-Input = 30820ffe020100300b060960864801650304031204820fea30820fe60420000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f04820fc048683d91978e31eb3dddb8b0473482d2b88a5f625949fd8f58a561e696bd4c27d853fa69b8199023e8cd678dd9fabf9047646ffd0cb3cc7f795805a71e70d2371b0563e3cd3346149c8c9ebcf23b0a4e5a900eea9c6562790a7c63e38663daa2dddb6e480dc405a1e701948b74841ef5cc1c3f2bf327972e9510510cd5375ecc0855717711872221862381000424778061475007501717035504515125471838046175722244108868608646012747567180870666864332444122043638667502823634244322057364106455547722755681433614625508206437685468754353751068718333805475052580752818843811087260202008588301836113828212061711578768788878643754601657155084718866072732880664741856762180318276641578245025646643113504364780126673143011660655864718368863503847861101202356116137860785321240075478823043666116604255418285605367785638434430632610770731784272141116530385276867460150823735320766107504681248066603032652312445408800318088767217307182472151278011654474866172233380866064468352158420368011802118183317735453488100448653674370577258833460384232856810060426042584560235682051838638432421224245645858677145728504788717180618836086864156508116502646700608266227383172407257300727288620667588682607064020330343663155464245345667187345658370225084685628807036708462371710065717584778708655537822351446772856730322870014332061715845526632502651334777380355164313473510662751757402468881706743468186017652453330872104343401032287635155265081307745444168154183636411204026873043677712808846355453006245810458365124842780345166635843785601465115742321436685224777313450178362420550006484471234408800604735405783336308210615225207248851348637067622588571265673476816464684258708122705500838320023208066345336003346857247063554003577122752307142536874374570056643224482852072183330205337334077278055253063525040673346131807280717248377634573185851602333443625164338160858773462428830070365853755007552315037021324630437086806361503030043586357080211066473463522620330438021085287578321078867480856347436734284058466841437005510873426447721127384736526472577144704178644260247118740812216605847178137067680817058185585471363421075580163583585184403847110338742628247741365544270734635777500662562684202124683864616646031225388845400845734464754472560546166846630880638271563287183840652247681160662130330186802801384630505657238758365723230688046122606651675570532413227673517080153001628460134887701118815571315464311704732882856368234555041862765631111687505104254414427852211171788153685157447166255365583630250285576875327137103723705714761713651841242366444664143520521085157033363860258426628148110546268173038756433216588568663632813406254012040886547886171657623726234867030115115632050753502122108426531435567111525720106853630150557586058784314313278788087384788637881813873426178388524667733506021151464238232680135440783475385535752832335187601152134325773333655188615816168241842212230841448151201103024777242544366067717707603014525403500183873237735265086357113734481605277456553730085837785035121115480628850180268138652053468013207241803213005723864076427114101838525510632607104865176833828572762354518735083132886376661426311675033112553764176031433177212234418a82e4f5c9ea0faf99eb04d78a7332711117c33f18eca21f8743376ada5219804a7ed9a5557fcd67a3550b3a4b8c588629c021475fa3d56d5d6cfbb1a09bda8d14de622ddff16d8bc99b14278a8af1d76bed157672dd9c32316f97e8daadef8d9da69586725567fb96b59990d4bf0bc9c195b90b74295f5675b24257c2710c175b0153f2911328c2eb7abb9ad46e70a8b53c39ea642cee4b3cb42620e863ce8b650ce8adcd923721a1687023c673a8cbb6b03d51cd197e8c346ebadce93950f88cee201db9e320843e29f300d9a19500d70a4caf272c69e4eef69fbb8a55efd7ca2bed990d2d3b582848f9c45c2abc54cfc47d34f06c0ffa56fcd762ab9cba9146d7725218963b240d72b6d22c93171fbd47788b76e72042def0878d23df631a1a1e5a6027686de5b4a10e91069c8f2ba0259b04d6409da96567ca52da497026e583a0ecefc1f01e6b988e21f9767a2b7e1672deb9a1e2a3fcc863aa91517c334620601b4fe79730e934935f4b6fbc4e32695145c2b5f6a127fecc0a277451ebc3fd523444f9ee7c9c34534f356db544fc31c1bfde5f65c77ea2f7c2eae4c55ebaf104271c566fd4ebac71c7a62c74952817ae675504d9599b1b762b6aca168a83248c9d9adb0ceb1556e5759490bbc0c7900795ad72123038b662f64f106a9993681a25d59af7bc97a235be9284c5bc45a6c90cb1c2999c663d96b478e2307f85548957d65740e2673e9ebd1352829038f462b8fd3b5681da55c0252523853525ea0ad647e71ac2c5a8893e603ac97e56c04ceb2f26f5c5b4b6d94ab811380fd00f2208fe86535086aebfd35c29120624c04fbb6113929d9c556350253766c209fdba83c95fccd342a28099355d00bc863f4eef596eb0b42ebcc7c79491cceae205ea0b8059fbb8a5726c5949d2b15e7e29c51fc9b02ee1a4fc357b5f1bef9c4add46a2a920c2fbf08a37eb1514bfa15110a4392a74c6f13c50c5cffd97531098d7cd23b60eb35c4a428b46c55386e1010c4ba7f70e4c7ecb7575f3063a71e84dfdcf09a58b2cdb0f99f27ed378610d25cbad7bfa6ba0d59189cfe88eab9b46d7e6db0307eabe4198e99bd71f779ab66581e0912fc7b1d2585245e9a12687a975cd5e8e1dcc045d5f891c4c685db07cf81e77389b363eb6bdfe39b27ff84c97eefee162e3b451fe6914719cb6436d855960ff915d7cea6adeafdfc1c05786c49f923a474ffdfc3153a06e6ed0b0ad220d72524434d5273c0aab6dde4e91476d581a2695a60de6d9f44d77aa08266e938eeb4a9597c9b64986059e49262a4eab2454e14015ad0536c42733a5d77d7995c2a20446009ebfe5632c80c08ed2b97af35066489f597eb1b1f11f04f60e0c9040159c44ab3e60e0a15229d191228bed17bbc3ac939b3c67cee135f352c27216c9c31f72a3e87040c5f619306eb0b6cca2a9ce7b22a1694d00ca9c05e315126457f26ce84f9617241860782f864b473d84017491902b1bdc8cdc5800dd46127fb80a71c095b473a562529b3b1e7e437e158a5f6666e9974d005b062c2309e6dce98f9b658c6e3f9a216d58c8c9142bd1c8c85a9da872ebbfad3fea9d9aba2b68c0e8f19c6ff5f00584d45daf9d6c9d69ed04b8da8d687258b77807927612c530446fea7697ae3f926698929bc6a5a8cf3e2024c0f0c5ee57b5869bf981881caf9e3665fc7f7efc678929f87a56eaa42ea4d1ff6691822dd79a47096b776d1d8f01456e5873b0738406c382c573ae9cde2d9e7f231b6cc5c676e7cf43963373013a58075381ff0949be084546d72e4f8a3e5fe4aa5091add234e2afe0030b1b663ae9d2d32410986b9402aaaf2465b74a5e2d0bc38e3a92bbddd8a1fed7b948c23cce6f8c08fe356835ba65b0f984068616ef48138efd89bf357a54d2ebbf376cbdcc69c5f1f61c64d2794bc06ccb9abdf66e25085d8c830e2ae3b0fe0f07a7af8b9320bf342970997d67d7c12593a8fbfade635aac53083a7022c47d5f77a52b57b598da9392ae6d86afc46fc06455181b9c75a646dc21f81e4bf213753de737fd2a140027920add35a223f9f5f4465ceb60c03ed0455a333a5cc83adbf43f1f42c2ccb8328c21c7ab7faed2b21cfade2da55223aaab2af9b41c7332341746341b39aa2f43815650f5480511424cfa6901779c4d18b638cc0287aaaf31680338d20b17c7449fdc6a278a8d96a82ee4c4eca40125e2d65290071c7aef1be6a991598fb9d59512523bcd4b38c566b8e80a73ae333e134414327ef1d83c47c49dfe7936df1338a5e247787868fc84fdcb95ac89c185c4bb5fd57b2338ac42b41c10a823df39624f36b15a2f067584e06ca2e08ccaff1618fe01dd06df3512e0b724dec8506da24215acacc2c51b82ad8d302002fb41068b1da4f8bb147987b3516bad5dbddf01318fd3fa9bc43702ac498c719d95f2e841b622a5e4848a3c5c262959992ea7a7d72ca8a368028f497dfad93355cbb1bb9786d14ff2cf590317848f95856427110dda36f5192a816ce9c8816cc7bbfc804efc40085a3850b89f1e7fe5656dba410f906a97c32336c1ae7e81737a83e087354e428da8538d948dbf5dfacb59dd2b5fd3bc803f4ba432c9a739df2cfa9ed9484320f97edff1a48c6b86b3002cfb772dd5e562bc4c3d683ed964b6199fa0514b0790d958095b7b85c6be875fbb559e1930146ccea63a388a194fe09c3dea03be52de27e901017afe809af630a7382bf5c4cd4d1b8f41579fb4348ede4ca05f4cd3f139a31b2544e516dbe4086b9bb4b2bed47e2d230982dd5192429d377b7c0745cc068e2f5a4aa04c7ff87209ed1259976a0fc9b25e9e851d4e3502c02c85d6dff029e211d01ebf0e9e7188d568f8437d813b0f122f2fb17603b693ed9c38f17cfd50b815e6d9dfc0ed2ccf19f6399274a1420f235a59d8bf724345e14e45d9e4be8934dfc3fa92678db61d7118bf53cb8a2225b335f7eae50e3f941237628db76d8ea38f77a72af3a26c81fe43523b335535a5d1db7c38f341082bb5734d089e8ae309cfda3a0bcb5cd5b097113c8edf9616aa4f6e6631b9125276fb3f680a34341c3db668dc6cad45fc93b2708ca2af75ccce734fd191c50089dad53982fddae02531ff93e1f21ff395fc0a12874edf06b6f9647e95a7324586c71dfd91d901d621858190fecd00ccd110bbac59f96cb884c3c93994748a56f41283bfc41fb89052153a894588c3cb9017f3d66326c985637e575acb812346342654025d602de3ba940c19ac1a633dffda977b529b8013e19c1d6d0680f4dae62c924450ae66aab82f21473061dab3d62b247f907e3551939ad3f5465e9d08a82bfea17eea1b6b2b923757477f993000b2f43b70f28aaab1fe9a26ad1fd3361616c0b0e242fe76604b7033a1f30e97e28f526ca3c880fe2b8d9d1b0c9ff188b31cb9d97425acab9b216d98a6ae355e583da71e8864ee3d16b0759796190ef545c1e62bfef92af6ca147b13244d6c892fc8ef223ab3f43f924c2f466097ee8
+Key = ML-DSA-65-RFC-Both
+PKCS8 = 30820ffe020100300b060960864801650304031204820fea30820fe60420000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f04820fc048683d91978e31eb3dddb8b0473482d2b88a5f625949fd8f58a561e696bd4c27d853fa69b8199023e8cd678dd9fabf9047646ffd0cb3cc7f795805a71e70d2371b0563e3cd3346149c8c9ebcf23b0a4e5a900eea9c6562790a7c63e38663daa2dddb6e480dc405a1e701948b74841ef5cc1c3f2bf327972e9510510cd5375ecc0855717711872221862381000424778061475007501717035504515125471838046175722244108868608646012747567180870666864332444122043638667502823634244322057364106455547722755681433614625508206437685468754353751068718333805475052580752818843811087260202008588301836113828212061711578768788878643754601657155084718866072732880664741856762180318276641578245025646643113504364780126673143011660655864718368863503847861101202356116137860785321240075478823043666116604255418285605367785638434430632610770731784272141116530385276867460150823735320766107504681248066603032652312445408800318088767217307182472151278011654474866172233380866064468352158420368011802118183317735453488100448653674370577258833460384232856810060426042584560235682051838638432421224245645858677145728504788717180618836086864156508116502646700608266227383172407257300727288620667588682607064020330343663155464245345667187345658370225084685628807036708462371710065717584778708655537822351446772856730322870014332061715845526632502651334777380355164313473510662751757402468881706743468186017652453330872104343401032287635155265081307745444168154183636411204026873043677712808846355453006245810458365124842780345166635843785601465115742321436685224777313450178362420550006484471234408800604735405783336308210615225207248851348637067622588571265673476816464684258708122705500838320023208066345336003346857247063554003577122752307142536874374570056643224482852072183330205337334077278055253063525040673346131807280717248377634573185851602333443625164338160858773462428830070365853755007552315037021324630437086806361503030043586357080211066473463522620330438021085287578321078867480856347436734284058466841437005510873426447721127384736526472577144704178644260247118740812216605847178137067680817058185585471363421075580163583585184403847110338742628247741365544270734635777500662562684202124683864616646031225388845400845734464754472560546166846630880638271563287183840652247681160662130330186802801384630505657238758365723230688046122606651675570532413227673517080153001628460134887701118815571315464311704732882856368234555041862765631111687505104254414427852211171788153685157447166255365583630250285576875327137103723705714761713651841242366444664143520521085157033363860258426628148110546268173038756433216588568663632813406254012040886547886171657623726234867030115115632050753502122108426531435567111525720106853630150557586058784314313278788087384788637881813873426178388524667733506021151464238232680135440783475385535752832335187601152134325773333655188615816168241842212230841448151201103024777242544366067717707603014525403500183873237735265086357113734481605277456553730085837785035121115480628850180268138652053468013207241803213005723864076427114101838525510632607104865176833828572762354518735083132886376661426311675033112553764176031433177212234418a82e4f5c9ea0faf99eb04d78a7332711117c33f18eca21f8743376ada5219804a7ed9a5557fcd67a3550b3a4b8c588629c021475fa3d56d5d6cfbb1a09bda8d14de622ddff16d8bc99b14278a8af1d76bed157672dd9c32316f97e8daadef8d9da69586725567fb96b59990d4bf0bc9c195b90b74295f5675b24257c2710c175b0153f2911328c2eb7abb9ad46e70a8b53c39ea642cee4b3cb42620e863ce8b650ce8adcd923721a1687023c673a8cbb6b03d51cd197e8c346ebadce93950f88cee201db9e320843e29f300d9a19500d70a4caf272c69e4eef69fbb8a55efd7ca2bed990d2d3b582848f9c45c2abc54cfc47d34f06c0ffa56fcd762ab9cba9146d7725218963b240d72b6d22c93171fbd47788b76e72042def0878d23df631a1a1e5a6027686de5b4a10e91069c8f2ba0259b04d6409da96567ca52da497026e583a0ecefc1f01e6b988e21f9767a2b7e1672deb9a1e2a3fcc863aa91517c334620601b4fe79730e934935f4b6fbc4e32695145c2b5f6a127fecc0a277451ebc3fd523444f9ee7c9c34534f356db544fc31c1bfde5f65c77ea2f7c2eae4c55ebaf104271c566fd4ebac71c7a62c74952817ae675504d9599b1b762b6aca168a83248c9d9adb0ceb1556e5759490bbc0c7900795ad72123038b662f64f106a9993681a25d59af7bc97a235be9284c5bc45a6c90cb1c2999c663d96b478e2307f85548957d65740e2673e9ebd1352829038f462b8fd3b5681da55c0252523853525ea0ad647e71ac2c5a8893e603ac97e56c04ceb2f26f5c5b4b6d94ab811380fd00f2208fe86535086aebfd35c29120624c04fbb6113929d9c556350253766c209fdba83c95fccd342a28099355d00bc863f4eef596eb0b42ebcc7c79491cceae205ea0b8059fbb8a5726c5949d2b15e7e29c51fc9b02ee1a4fc357b5f1bef9c4add46a2a920c2fbf08a37eb1514bfa15110a4392a74c6f13c50c5cffd97531098d7cd23b60eb35c4a428b46c55386e1010c4ba7f70e4c7ecb7575f3063a71e84dfdcf09a58b2cdb0f99f27ed378610d25cbad7bfa6ba0d59189cfe88eab9b46d7e6db0307eabe4198e99bd71f779ab66581e0912fc7b1d2585245e9a12687a975cd5e8e1dcc045d5f891c4c685db07cf81e77389b363eb6bdfe39b27ff84c97eefee162e3b451fe6914719cb6436d855960ff915d7cea6adeafdfc1c05786c49f923a474ffdfc3153a06e6ed0b0ad220d72524434d5273c0aab6dde4e91476d581a2695a60de6d9f44d77aa08266e938eeb4a9597c9b64986059e49262a4eab2454e14015ad0536c42733a5d77d7995c2a20446009ebfe5632c80c08ed2b97af35066489f597eb1b1f11f04f60e0c9040159c44ab3e60e0a15229d191228bed17bbc3ac939b3c67cee135f352c27216c9c31f72a3e87040c5f619306eb0b6cca2a9ce7b22a1694d00ca9c05e315126457f26ce84f9617241860782f864b473d84017491902b1bdc8cdc5800dd46127fb80a71c095b473a562529b3b1e7e437e158a5f6666e9974d005b062c2309e6dce98f9b658c6e3f9a216d58c8c9142bd1c8c85a9da872ebbfad3fea9d9aba2b68c0e8f19c6ff5f00584d45daf9d6c9d69ed04b8da8d687258b77807927612c530446fea7697ae3f926698929bc6a5a8cf3e2024c0f0c5ee57b5869bf981881caf9e3665fc7f7efc678929f87a56eaa42ea4d1ff6691822dd79a47096b776d1d8f01456e5873b0738406c382c573ae9cde2d9e7f231b6cc5c676e7cf43963373013a58075381ff0949be084546d72e4f8a3e5fe4aa5091add234e2afe0030b1b663ae9d2d32410986b9402aaaf2465b74a5e2d0bc38e3a92bbddd8a1fed7b948c23cce6f8c08fe356835ba65b0f984068616ef48138efd89bf357a54d2ebbf376cbdcc69c5f1f61c64d2794bc06ccb9abdf66e25085d8c830e2ae3b0fe0f07a7af8b9320bf342970997d67d7c12593a8fbfade635aac53083a7022c47d5f77a52b57b598da9392ae6d86afc46fc06455181b9c75a646dc21f81e4bf213753de737fd2a140027920add35a223f9f5f4465ceb60c03ed0455a333a5cc83adbf43f1f42c2ccb8328c21c7ab7faed2b21cfade2da55223aaab2af9b41c7332341746341b39aa2f43815650f5480511424cfa6901779c4d18b638cc0287aaaf31680338d20b17c7449fdc6a278a8d96a82ee4c4eca40125e2d65290071c7aef1be6a991598fb9d59512523bcd4b38c566b8e80a73ae333e134414327ef1d83c47c49dfe7936df1338a5e247787868fc84fdcb95ac89c185c4bb5fd57b2338ac42b41c10a823df39624f36b15a2f067584e06ca2e08ccaff1618fe01dd06df3512e0b724dec8506da24215acacc2c51b82ad8d302002fb41068b1da4f8bb147987b3516bad5dbddf01318fd3fa9bc43702ac498c719d95f2e841b622a5e4848a3c5c262959992ea7a7d72ca8a368028f497dfad93355cbb1bb9786d14ff2cf590317848f95856427110dda36f5192a816ce9c8816cc7bbfc804efc40085a3850b89f1e7fe5656dba410f906a97c32336c1ae7e81737a83e087354e428da8538d948dbf5dfacb59dd2b5fd3bc803f4ba432c9a739df2cfa9ed9484320f97edff1a48c6b86b3002cfb772dd5e562bc4c3d683ed964b6199fa0514b0790d958095b7b85c6be875fbb559e1930146ccea63a388a194fe09c3dea03be52de27e901017afe809af630a7382bf5c4cd4d1b8f41579fb4348ede4ca05f4cd3f139a31b2544e516dbe4086b9bb4b2bed47e2d230982dd5192429d377b7c0745cc068e2f5a4aa04c7ff87209ed1259976a0fc9b25e9e851d4e3502c02c85d6dff029e211d01ebf0e9e7188d568f8437d813b0f122f2fb17603b693ed9c38f17cfd50b815e6d9dfc0ed2ccf19f6399274a1420f235a59d8bf724345e14e45d9e4be8934dfc3fa92678db61d7118bf53cb8a2225b335f7eae50e3f941237628db76d8ea38f77a72af3a26c81fe43523b335535a5d1db7c38f341082bb5734d089e8ae309cfda3a0bcb5cd5b097113c8edf9616aa4f6e6631b9125276fb3f680a34341c3db668dc6cad45fc93b2708ca2af75ccce734fd191c50089dad53982fddae02531ff93e1f21ff395fc0a12874edf06b6f9647e95a7324586c71dfd91d901d621858190fecd00ccd110bbac59f96cb884c3c93994748a56f41283bfc41fb89052153a894588c3cb9017f3d66326c985637e575acb812346342654025d602de3ba940c19ac1a633dffda977b529b8013e19c1d6d0680f4dae62c924450ae66aab82f21473061dab3d62b247f907e3551939ad3f5465e9d08a82bfea17eea1b6b2b923757477f993000b2f43b70f28aaab1fe9a26ad1fd3361616c0b0e242fe76604b7033a1f30e97e28f526ca3c880fe2b8d9d1b0c9ff188b31cb9d97425acab9b216d98a6ae355e583da71e8864ee3d16b0759796190ef545c1e62bfef92af6ca147b13244d6c892fc8ef223ab3f43f924c2f466097ee8
 Error = PRIVATE_KEY_WAS_NOT_SEED
 
-PublicKey = ML-DSA-65-RFC-Public
-Algorithm = ML-DSA-65
-Input = 308207b2300b0609608648016503040312038207a10048683d91978e31eb3dddb8b0473482d2b88a5f625949fd8f58a561e696bd4c27d05b38dbb2edf01e664efd81be1ea893688ce68aa2d51c5958f8bbc6eb4e89ee67d2c0320954d57212cac7229ff1d6eaf03928bd51511f8d88d847736c7de2730d5978e5410713160978867711bf5539a0bfc4c350c2be572baf0ee2e2fb16ccfea08028d99ac49aebb75937ddce111cdab62fff3cea8ba2233d1e56fbc5c5a1e726de63fadd2af016b119177fa3d971a2d9277173fce55b67745af0b7c21d597dbeb93e6a32f341c49a5a8be9e825088d1f2aa45155d6c8ae15367e4eb003b8fdf7851071949739f9fff09023eaf45104d2a84a45906eed4671a44dc28d27987bb55df69e9e8561f61a80a72699503865fed9b7ee72a8e17a19c408144f4b29afef7031c3a6d8571610b42c9f421245a88f197e16812b031159b65b9687e5b3e934c5225ae98a79ba73d2b399d73510effad19e53b8450f0ba8fce1012fd98d260a74aaaa13fae249a006b1c34f5ba0b882f26378222fb36f2283c243f0ffeb5f1bb414a0a70d55e3d40a56b6cbc88ae1f03b7b2882d98deea28e145c9dedfd8eaf1cef2ed94a8b050f8964f46d1ea0d0c2a43e0dda6182adbf4f6ed175b6742257859bf22f3a417ecf1f9d89317b5e539d587af16b9e1313e04514ffa64ba8b3ff2b8321f8811cb3fb022c8f644e70a4b80a2fbfee604abb7379091ea8e6c5c74dfc0283666b40c0793870028204a136bf5da9568eb798d349038bdb0c11e03445e7847cb5069c75cf28ac601c7799d958210ddbcb226e51afef9f1de47b073873d6d3f97456bede085082e74a298b2cd48f4b3093155f366c8fa601c6af858dfa32c08491b2a29887f90335949a5d6edaa679882a3a95d6bf6d970a221f4b9d3d8cbf384af81aac95e2b3294e04789ac83727a5dc04559f96af41d8a053516feeeebc52746eb6ab2819e09108710d835f011fa63065872ad334d5cdffb2b2310507e92fc993ae317da97f4f309cdaf0f67ed99d90215576083849f953b246d7fedb3fdb67679850a5ad404e64147fb7cf4f6aeddd05afb4b834968d1fe88014960dce5d942236526e12a478d69e5fbe6970310b308c06845018cfc7b2ab430a13a6b1ac7bb02cccbb3d911ac2f11068613fbe029bfdce02cf5cd38950ed72c83944edfbc75615af87f864c051f3c55456c5412863a40c06d1dab562bdff0571b8d3c3917bbd300880bba5e998239b95fa91b7d6416d4f398b3adbcd30983ed3592b4d9ef7d4236fd00f50d98aa53a235ac4172720f77d96172672980cfe8ff7a5a702783edc2ba31b2259015a112fc7f468a9c2f9464039002d30ef678b4cb798bc116216bf7a9a7c18ba03b7b58fd07515d3115049d3614be7a07e744300750df1d2c58753389059eafc3d785ccdd31c07648bedc03a5c3b8ad46d064d59c13d57374729fc4e295362e2a5191204530428bc1522afa28ff5fe1655e304ca5bc8c27ad0e0c6a39dd4df28956c14b38cc93682cefe402bbd5e82d29c464e44eb5d37b48fc568dfe0cc6e8e16baea05e5135590f19294e73e8367b0216dbb815030b9de55913f08039c42351c59e5515dd5af8e089a15e625e8f6dee639386c46497d7a263288774de581a7de9629b41b4424141f978fb8331208efdec3c6e0de39bc57063f3dcd6c470373c08891ea29cbc7cc6d6483b8889083ace86aa7b51b1c2cfe6e2ad18d97ce36fbc56ea42fae97e6a7ac114864478c366df1ebb1e7b11a9098504fd5975bdf1f49dc70002b63c1739a9d263fbad4073f6a9f6c2b8af4b4c332a103a0cffa5deeb2d062ca3c215fd360026be7c5164f4a4424ef74948804d66f46487732c8202c795478647b4ea71d627c086024cca354a41f0877b38f19b3774ad2095c8da53b069e21c76ae2d2007e16719ed40080d334f7da52e9f5a5990439caf083a95b833f02ad10a08c1a6d0f260c007285bd4a2f47703a5aef465287d253b18ac22514316210ff566814b10f87a293d6f199d3c3959990d0c1268b4f50d5f9fcefbbf237bd0c28b80182d6659741f14f10bfbb21bba12ab620aa2396f56c0686b4ea9017990224216b2fe8ad76c4a9148eef9a86a3635a6aa77bc1dcfb6fba59a77dfda9b7530dc0ca8648c8d973738e01bab8f08b4905e84aa4641bd602410cd97520265f2f231f2b35e15eb2fa04d2bd94d5a77abaf1e0e161010a990087f5b46ea988b2bc0512fda0fa923dadd6c45c5301d09483673265b5ab2e10f4ba520f6bbad564a5c3d5e27bdb080f7d20e13296a3181954c39c649c943ebe17df5c1f7aae0a8fe126c477585a5d4d648a0d008b6af5e8cd31be69a9296d4f3fd25ed86f221e4b93f65f5929967533624b9235750c30707550b58536d109a7131c5a5bbe4a5715567c12534aec7660761eebb9fae2891c774589b80e566ad557ddef7367196b7227ea9870ef09ddfec79d6b9319a6879b5205d76bf7aba5acf33afb59d17fc54e68383d6be5a08e9b66da53dcde008bb294b8582bd132cdcc49959fdbc21e52721880c8ad0352c79f03a43bbd84c4cdfdc6c529005e1e7cd9a349a7168a35569ba5dea818968d5a91466bd6e64e20bf62417198afc4e81c28dd77ed4028232398b52fbde86bc84f475b9016710ce2aabc11a06b4dbac901ec16cf365ca3f2d53813948a693a0f93e79c46ca5d5a6dca3d28ca50ad18bd13fca55059dd9b185f79f9c47196a4e81b2104bc460a051e02f2e8444f
-Bits = 15616
-RawPublic = 48683d91978e31eb3dddb8b0473482d2b88a5f625949fd8f58a561e696bd4c27d05b38dbb2edf01e664efd81be1ea893688ce68aa2d51c5958f8bbc6eb4e89ee67d2c0320954d57212cac7229ff1d6eaf03928bd51511f8d88d847736c7de2730d5978e5410713160978867711bf5539a0bfc4c350c2be572baf0ee2e2fb16ccfea08028d99ac49aebb75937ddce111cdab62fff3cea8ba2233d1e56fbc5c5a1e726de63fadd2af016b119177fa3d971a2d9277173fce55b67745af0b7c21d597dbeb93e6a32f341c49a5a8be9e825088d1f2aa45155d6c8ae15367e4eb003b8fdf7851071949739f9fff09023eaf45104d2a84a45906eed4671a44dc28d27987bb55df69e9e8561f61a80a72699503865fed9b7ee72a8e17a19c408144f4b29afef7031c3a6d8571610b42c9f421245a88f197e16812b031159b65b9687e5b3e934c5225ae98a79ba73d2b399d73510effad19e53b8450f0ba8fce1012fd98d260a74aaaa13fae249a006b1c34f5ba0b882f26378222fb36f2283c243f0ffeb5f1bb414a0a70d55e3d40a56b6cbc88ae1f03b7b2882d98deea28e145c9dedfd8eaf1cef2ed94a8b050f8964f46d1ea0d0c2a43e0dda6182adbf4f6ed175b6742257859bf22f3a417ecf1f9d89317b5e539d587af16b9e1313e04514ffa64ba8b3ff2b8321f8811cb3fb022c8f644e70a4b80a2fbfee604abb7379091ea8e6c5c74dfc0283666b40c0793870028204a136bf5da9568eb798d349038bdb0c11e03445e7847cb5069c75cf28ac601c7799d958210ddbcb226e51afef9f1de47b073873d6d3f97456bede085082e74a298b2cd48f4b3093155f366c8fa601c6af858dfa32c08491b2a29887f90335949a5d6edaa679882a3a95d6bf6d970a221f4b9d3d8cbf384af81aac95e2b3294e04789ac83727a5dc04559f96af41d8a053516feeeebc52746eb6ab2819e09108710d835f011fa63065872ad334d5cdffb2b2310507e92fc993ae317da97f4f309cdaf0f67ed99d90215576083849f953b246d7fedb3fdb67679850a5ad404e64147fb7cf4f6aeddd05afb4b834968d1fe88014960dce5d942236526e12a478d69e5fbe6970310b308c06845018cfc7b2ab430a13a6b1ac7bb02cccbb3d911ac2f11068613fbe029bfdce02cf5cd38950ed72c83944edfbc75615af87f864c051f3c55456c5412863a40c06d1dab562bdff0571b8d3c3917bbd300880bba5e998239b95fa91b7d6416d4f398b3adbcd30983ed3592b4d9ef7d4236fd00f50d98aa53a235ac4172720f77d96172672980cfe8ff7a5a702783edc2ba31b2259015a112fc7f468a9c2f9464039002d30ef678b4cb798bc116216bf7a9a7c18ba03b7b58fd07515d3115049d3614be7a07e744300750df1d2c58753389059eafc3d785ccdd31c07648bedc03a5c3b8ad46d064d59c13d57374729fc4e295362e2a5191204530428bc1522afa28ff5fe1655e304ca5bc8c27ad0e0c6a39dd4df28956c14b38cc93682cefe402bbd5e82d29c464e44eb5d37b48fc568dfe0cc6e8e16baea05e5135590f19294e73e8367b0216dbb815030b9de55913f08039c42351c59e5515dd5af8e089a15e625e8f6dee639386c46497d7a263288774de581a7de9629b41b4424141f978fb8331208efdec3c6e0de39bc57063f3dcd6c470373c08891ea29cbc7cc6d6483b8889083ace86aa7b51b1c2cfe6e2ad18d97ce36fbc56ea42fae97e6a7ac114864478c366df1ebb1e7b11a9098504fd5975bdf1f49dc70002b63c1739a9d263fbad4073f6a9f6c2b8af4b4c332a103a0cffa5deeb2d062ca3c215fd360026be7c5164f4a4424ef74948804d66f46487732c8202c795478647b4ea71d627c086024cca354a41f0877b38f19b3774ad2095c8da53b069e21c76ae2d2007e16719ed40080d334f7da52e9f5a5990439caf083a95b833f02ad10a08c1a6d0f260c007285bd4a2f47703a5aef465287d253b18ac22514316210ff566814b10f87a293d6f199d3c3959990d0c1268b4f50d5f9fcefbbf237bd0c28b80182d6659741f14f10bfbb21bba12ab620aa2396f56c0686b4ea9017990224216b2fe8ad76c4a9148eef9a86a3635a6aa77bc1dcfb6fba59a77dfda9b7530dc0ca8648c8d973738e01bab8f08b4905e84aa4641bd602410cd97520265f2f231f2b35e15eb2fa04d2bd94d5a77abaf1e0e161010a990087f5b46ea988b2bc0512fda0fa923dadd6c45c5301d09483673265b5ab2e10f4ba520f6bbad564a5c3d5e27bdb080f7d20e13296a3181954c39c649c943ebe17df5c1f7aae0a8fe126c477585a5d4d648a0d008b6af5e8cd31be69a9296d4f3fd25ed86f221e4b93f65f5929967533624b9235750c30707550b58536d109a7131c5a5bbe4a5715567c12534aec7660761eebb9fae2891c774589b80e566ad557ddef7367196b7227ea9870ef09ddfec79d6b9319a6879b5205d76bf7aba5acf33afb59d17fc54e68383d6be5a08e9b66da53dcde008bb294b8582bd132cdcc49959fdbc21e52721880c8ad0352c79f03a43bbd84c4cdfdc6c529005e1e7cd9a349a7168a35569ba5dea818968d5a91466bd6e64e20bf62417198afc4e81c28dd77ed4028232398b52fbde86bc84f475b9016710ce2aabc11a06b4dbac901ec16cf365ca3f2d53813948a693a0f93e79c46ca5d5a6dca3d28ca50ad18bd13fca55059dd9b185f79f9c47196a4e81b2104bc460a051e02f2e8444f
-
-PrivateKey = ML-DSA-87-RFC-Seed
+Key = ML-DSA-87-RFC-Seed
 Algorithm = ML-DSA-87
-Input = 3034020100300b060960864801650304031304228020000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
+SPKI = 30820a32300b060960864801650304031303820a21009792bcec2f2430686a82fccf3c2f5ff665e771d7ab41b90258cfa7e90ec97124a73b323b9ba21ab64d767c433f5a521effe18f86e46a188952c4467e048b729e7fc4d115e7e48da1896d5fe119b10dcddef62cb307954074b42336e52836de61da941f8d37ea68ac8106fabe19070679af6008537120f70793b8ea9cc0e6e7b7b4c9a5c7421c60f24451ba1e933db1a2ee16c79559f21b3d1b8305850aa42afbb13f1f4d5b9f4835f9d87dfceb162d0ef4a7fdc4cba1743cd1c87bb4967da16cc8764b6569df8ee5bdcbffe9a4e05748e6fdf225af9e4eeb7773b62e8f85f9b56b548945551844fbd89806a4ac369bed2d256100f688a6ad5e0a709826dc4449e91e23c5506e642361ef5a313712f79bc4b3186861ca85a4bab17e7f943d1b8a333aa3ae7ce16b440d6018f9e04daf5725c7f1a93fad1a5a27b67895bd249aa91685de20af32c8b7e268c7f96877d0c85001135a4f0a8f1b8264fa6ebe5a349d8aecad1a16299ccf2fd9c7b85bace2ced3aa1276ba61ee78ed7e5ca5b67cdd458a9354030e6abbbabf56a0a2316fec9dba83b51d42fd3167f1e0f90855d5c66509b210265dc1e54ec44b43ba7cf9aef118b44d80912ce75166a6651e116cebe49229a7062c09931f71abd2293f76f7efc3215ba97800037e58e470bdbbb43c1b0439eaf79c54d93b44aac9efe9fbe151874cfb2a64cbee28cc4c0fe7775e5d870f1c02e5b2e3c5004c995f24c9b779cb753a277d0e71fd425eb6bc2ca56ce129db51f70740f31e63976b50c7312e9797d78c5b1ac24a5fa347cc916e0a83f5c3b675cd30b81e3fa10b93444e07397571cce98b28da51db9056bc728c5b0b1181e2fbd387b4c79ab1a5fefece37167af772ddad14eb4c3982da5a59d0e9eb173ec6315091170027a3ab5ef6aa129cb8585727b9358a28501d713a72f3f1db31714286f9b6408013af06045d75592fc0b7dd47c73ed9c75b11e9d7c69f7cadfc3280a9062c5273c43be1c34f87448864cea7b5c97d6d32f59bd5f25384653bb5c4faa45bea8b89402843e645b6b9269e2bd988ddacb033328ffb060450f7df080053e6969b251e875ecec32cfc592840d69ab69a75e06b379c535d95266b082f4f09c93162b33b0d9f7307a4eaaa52104437fed66f8ee3eabbd45d67b25a8133f496468b52baffdbfad93eef1a9818b5e42ec722788a3d8d3529fc777d2ba570801dfae01ec88302837c1fb9e0355727645ee1046c3f915f6ae82dad4fb6b0356a46518ffc834155c3b4fe6dafa6cc8a5ccf53c73a0849d8d44f7dcf72754e70e1b7dfb447bb4ef49d1a718f6171bbce200950e0ce926106b151a3e871d5ce49731bd6650a9b0ca972da1c5f136d44820ea6383c08f3b384cf2338e789c513f618cc5694a6f0cee104511e1ed7c5f23a1ebfd8a0db8424553240156dbf622831b0c643d1c551b6f3f7a98d29b85c2de05a65fa615eee16495bd90737672115b53e91c5d90028cf3f1a93953a153de53b44084e9ccff6b736693926daefebb2d77aa5ad689b92f31686669df16d1715cc58f7a2cfb72dd1a51e92f825993a74022be7e9eb6054654457094d14928f20215e7b222ac56b51adbec8d8bdb6983979a7e3a21b44b5d1518ca97d0b5195f51ed6a24350c89747e1edea51b448e3e9147054ce927873c90db394d86888e07dff177593d6f79e152302204aeb03be2386af3e24078bd028b1689f5e147c9f452c8ceb02ec59cc9db63a03576ceeafe98239023897da0236630a53c0de7f435a19869792fab36e7b9e635760f09069e6432e700035ac2a02879fff0a1e1bec522047193d94eb5df1efd53eea1144ca78940852f5ec9727904b366ede4f5e2d331fad5fc282ea2c47e923142771c3dd75a87357487def99e5f18e9d9ed623c175d02888c51f82c07a80d54716b3c3c2bdbe2e9f0a9bbaaebeb4d52936876406f5c00e8e4bbd0a5ec05797e6207c5ab6c88f1a688421bd05a114f4d7de2ac241fa0e8bedff47f762ddcbeaa91004f8d31e85095c81054994ad3826e344ba96040810fc0b2ad1de48cfade002c62e5a49a0731ab38344bc1636df16bf607d56855e56d684003c718e4bad9e5a099979fcddeeb1c4a7776cd37a3417cb0e184e29ef9bc0e87475ba663be09e00ab562eb7c0f7165f969a9b42414198ccf1bff2a2c8d689a414ece7662927665689e94db961ebaec5615cbc1a7895c6851ac961432ff1118d4607d32ef9dc732d51333be4b4d0e30ddea784eca8be47e741be9c19631dc470a52ef4dc13a4f3633fd434d787c170977b417df598e1d0dde506bb71d6f0bc17ec70e3b03cdc1965cb36993f633b0472e50d0923ac6c66fdf1d3e6459cc121f0f5f94d09e9dbcf5d690e23233838a0bacb7c638d1b2650a4308cd171b6855126d1da672a6ed85a8d78c286fb56f4ab3d21497528045c63262c8a42af2f9802c53b7bb8be28e78fe0b5ce45fbb7a1af1a3b28a8d94b7890e3c882e39bc98e9f0ad76025bf0dd2f00298e7141a226b3d7cee414f604d1e0ba54d11d5fe58bccea6ad77ad2e8c1caacf32459014b7b91001b1efa8ad172a523fb8e365b577121bf9fd88a2c60c21e821d7b6acb47a5a995e40caced5c223b8fe6de5e18e9d2e5893aefebb7aae7ff1a146260e2f110e939528213a0025a38ec79aabc861b25ebc509a4674c132aaacb7e0146f14efd11cfcaf4caa4f775a716ce325e0a435a4d349d720bcf137450afc45046fc1a1f83a9d329777a7084e4aadae7122ce97005930528eb3c7f7f1129b372887a371155a3ba201a25cbf1dcb64e7cdee092c3141fb5550fe3d0dd82e870e578b2b46500818113b8f6569773c677385b69a42b77dcba7acffd95fd4452e23aaa1d37e1da2151ea658d40a3596b27ac9f8129dc6cf0643772624b59f4f461230df471ca26087c3942d5c6687df6082835935a3f87cb762b0c3b1d0dda4a6533965bef1b7b8292e254c014d090fed857c44c1839c694c0a64e3fad90a11f534722b6ee1574f2e149d55d744de4887024e08511431c062750e16c74ab9f3242f2db3ffb12a8d6107faa229d6f6373b07f36d3932b3bdb04c19dd64eadd7f93c3c564c358a1c81dcf1c9c31e5b06568f97544c17dc15698c5cb38983a9afc42783faa773a52c9d8260690be9e3156aa5bc1509dea3f69587695cd6ff172ba83e6a6d8a7d6bbebbbcda3672731983f89bc5831dc37c3f3c5c56facc697f3cb20bd5dbadbd702e54844ac2f626901fe159db93dfd4773d8fe73562b846c1fc856d1802762840ebc72d7988bde75cbca70d319d32ce0cc0253bb2ad455723ee0c7f4736ce6e6665c5aca32a481c53839bc259167b013d0423395eeb9aaaee3206149a7d550d67fc5fdfe4a8a5c35d2510b664379ab8f72855a2af47abce2a632048eaf89e5cb4a88debc53a595103acce4f1cff18acff07afe1eb5716aa1e40b63134c3a3ae9579fa87f515be093c2d29db6d6b65c93661e00636b592704d093cc6716c2342eb1853d48c85c63ac8a2854462c7b77e7e3bd1eac5bca28ffaa00b5d349f8a547ad875b96a8c2b2910c9301309a3f9138a5693111f55b3c009ca947c39dfc82d98eb1caa4a9cbe885f786fa86e55be062222f8ba90a974073326b31212aece0a34a60
+PKCS8 = 3034020100300b060960864801650304031304228020000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
 Bits = 20736
 RawPublic = 9792bcec2f2430686a82fccf3c2f5ff665e771d7ab41b90258cfa7e90ec97124a73b323b9ba21ab64d767c433f5a521effe18f86e46a188952c4467e048b729e7fc4d115e7e48da1896d5fe119b10dcddef62cb307954074b42336e52836de61da941f8d37ea68ac8106fabe19070679af6008537120f70793b8ea9cc0e6e7b7b4c9a5c7421c60f24451ba1e933db1a2ee16c79559f21b3d1b8305850aa42afbb13f1f4d5b9f4835f9d87dfceb162d0ef4a7fdc4cba1743cd1c87bb4967da16cc8764b6569df8ee5bdcbffe9a4e05748e6fdf225af9e4eeb7773b62e8f85f9b56b548945551844fbd89806a4ac369bed2d256100f688a6ad5e0a709826dc4449e91e23c5506e642361ef5a313712f79bc4b3186861ca85a4bab17e7f943d1b8a333aa3ae7ce16b440d6018f9e04daf5725c7f1a93fad1a5a27b67895bd249aa91685de20af32c8b7e268c7f96877d0c85001135a4f0a8f1b8264fa6ebe5a349d8aecad1a16299ccf2fd9c7b85bace2ced3aa1276ba61ee78ed7e5ca5b67cdd458a9354030e6abbbabf56a0a2316fec9dba83b51d42fd3167f1e0f90855d5c66509b210265dc1e54ec44b43ba7cf9aef118b44d80912ce75166a6651e116cebe49229a7062c09931f71abd2293f76f7efc3215ba97800037e58e470bdbbb43c1b0439eaf79c54d93b44aac9efe9fbe151874cfb2a64cbee28cc4c0fe7775e5d870f1c02e5b2e3c5004c995f24c9b779cb753a277d0e71fd425eb6bc2ca56ce129db51f70740f31e63976b50c7312e9797d78c5b1ac24a5fa347cc916e0a83f5c3b675cd30b81e3fa10b93444e07397571cce98b28da51db9056bc728c5b0b1181e2fbd387b4c79ab1a5fefece37167af772ddad14eb4c3982da5a59d0e9eb173ec6315091170027a3ab5ef6aa129cb8585727b9358a28501d713a72f3f1db31714286f9b6408013af06045d75592fc0b7dd47c73ed9c75b11e9d7c69f7cadfc3280a9062c5273c43be1c34f87448864cea7b5c97d6d32f59bd5f25384653bb5c4faa45bea8b89402843e645b6b9269e2bd988ddacb033328ffb060450f7df080053e6969b251e875ecec32cfc592840d69ab69a75e06b379c535d95266b082f4f09c93162b33b0d9f7307a4eaaa52104437fed66f8ee3eabbd45d67b25a8133f496468b52baffdbfad93eef1a9818b5e42ec722788a3d8d3529fc777d2ba570801dfae01ec88302837c1fb9e0355727645ee1046c3f915f6ae82dad4fb6b0356a46518ffc834155c3b4fe6dafa6cc8a5ccf53c73a0849d8d44f7dcf72754e70e1b7dfb447bb4ef49d1a718f6171bbce200950e0ce926106b151a3e871d5ce49731bd6650a9b0ca972da1c5f136d44820ea6383c08f3b384cf2338e789c513f618cc5694a6f0cee104511e1ed7c5f23a1ebfd8a0db8424553240156dbf622831b0c643d1c551b6f3f7a98d29b85c2de05a65fa615eee16495bd90737672115b53e91c5d90028cf3f1a93953a153de53b44084e9ccff6b736693926daefebb2d77aa5ad689b92f31686669df16d1715cc58f7a2cfb72dd1a51e92f825993a74022be7e9eb6054654457094d14928f20215e7b222ac56b51adbec8d8bdb6983979a7e3a21b44b5d1518ca97d0b5195f51ed6a24350c89747e1edea51b448e3e9147054ce927873c90db394d86888e07dff177593d6f79e152302204aeb03be2386af3e24078bd028b1689f5e147c9f452c8ceb02ec59cc9db63a03576ceeafe98239023897da0236630a53c0de7f435a19869792fab36e7b9e635760f09069e6432e700035ac2a02879fff0a1e1bec522047193d94eb5df1efd53eea1144ca78940852f5ec9727904b366ede4f5e2d331fad5fc282ea2c47e923142771c3dd75a87357487def99e5f18e9d9ed623c175d02888c51f82c07a80d54716b3c3c2bdbe2e9f0a9bbaaebeb4d52936876406f5c00e8e4bbd0a5ec05797e6207c5ab6c88f1a688421bd05a114f4d7de2ac241fa0e8bedff47f762ddcbeaa91004f8d31e85095c81054994ad3826e344ba96040810fc0b2ad1de48cfade002c62e5a49a0731ab38344bc1636df16bf607d56855e56d684003c718e4bad9e5a099979fcddeeb1c4a7776cd37a3417cb0e184e29ef9bc0e87475ba663be09e00ab562eb7c0f7165f969a9b42414198ccf1bff2a2c8d689a414ece7662927665689e94db961ebaec5615cbc1a7895c6851ac961432ff1118d4607d32ef9dc732d51333be4b4d0e30ddea784eca8be47e741be9c19631dc470a52ef4dc13a4f3633fd434d787c170977b417df598e1d0dde506bb71d6f0bc17ec70e3b03cdc1965cb36993f633b0472e50d0923ac6c66fdf1d3e6459cc121f0f5f94d09e9dbcf5d690e23233838a0bacb7c638d1b2650a4308cd171b6855126d1da672a6ed85a8d78c286fb56f4ab3d21497528045c63262c8a42af2f9802c53b7bb8be28e78fe0b5ce45fbb7a1af1a3b28a8d94b7890e3c882e39bc98e9f0ad76025bf0dd2f00298e7141a226b3d7cee414f604d1e0ba54d11d5fe58bccea6ad77ad2e8c1caacf32459014b7b91001b1efa8ad172a523fb8e365b577121bf9fd88a2c60c21e821d7b6acb47a5a995e40caced5c223b8fe6de5e18e9d2e5893aefebb7aae7ff1a146260e2f110e939528213a0025a38ec79aabc861b25ebc509a4674c132aaacb7e0146f14efd11cfcaf4caa4f775a716ce325e0a435a4d349d720bcf137450afc45046fc1a1f83a9d329777a7084e4aadae7122ce97005930528eb3c7f7f1129b372887a371155a3ba201a25cbf1dcb64e7cdee092c3141fb5550fe3d0dd82e870e578b2b46500818113b8f6569773c677385b69a42b77dcba7acffd95fd4452e23aaa1d37e1da2151ea658d40a3596b27ac9f8129dc6cf0643772624b59f4f461230df471ca26087c3942d5c6687df6082835935a3f87cb762b0c3b1d0dda4a6533965bef1b7b8292e254c014d090fed857c44c1839c694c0a64e3fad90a11f534722b6ee1574f2e149d55d744de4887024e08511431c062750e16c74ab9f3242f2db3ffb12a8d6107faa229d6f6373b07f36d3932b3bdb04c19dd64eadd7f93c3c564c358a1c81dcf1c9c31e5b06568f97544c17dc15698c5cb38983a9afc42783faa773a52c9d8260690be9e3156aa5bc1509dea3f69587695cd6ff172ba83e6a6d8a7d6bbebbbcda3672731983f89bc5831dc37c3f3c5c56facc697f3cb20bd5dbadbd702e54844ac2f626901fe159db93dfd4773d8fe73562b846c1fc856d1802762840ebc72d7988bde75cbca70d319d32ce0cc0253bb2ad455723ee0c7f4736ce6e6665c5aca32a481c53839bc259167b013d0423395eeb9aaaee3206149a7d550d67fc5fdfe4a8a5c35d2510b664379ab8f72855a2af47abce2a632048eaf89e5cb4a88debc53a595103acce4f1cff18acff07afe1eb5716aa1e40b63134c3a3ae9579fa87f515be093c2d29db6d6b65c93661e00636b592704d093cc6716c2342eb1853d48c85c63ac8a2854462c7b77e7e3bd1eac5bca28ffaa00b5d349f8a547ad875b96a8c2b2910c9301309a3f9138a5693111f55b3c009ca947c39dfc82d98eb1caa4a9cbe885f786fa86e55be062222f8ba90a974073326b31212aece0a34a60
 PrivateSeed = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
 
-PrivateKey = ML-DSA-87-RFC-Expanded
-Input = 30821338020100300b060960864801650304031304821324048213209792bcec2f2430686a82fccf3c2f5ff665e771d7ab41b90258cfa7e90ec97124d8e9ee4e90a16c602f5ec9bc38517dc30e329d5ab27673bd85f4c9b0300f776389886750b57c24db3fc012e61ede59753337374fa7124991549af243496d0637cb3be05a5948235bf79875f896d8fe0cab30c84948db4d6315aaaf160ac6243664220148161109112c94028922452c62b84500452a08967090126e149370d446108444515896910ca92982b241c90871c428680496894840859b226d1c28645912419cb891840489449005cb3462a086904026922099291305695c3468a4328e19269259461009a44923424d1236615810650128901a334c998631d3a249098225431428c0388103154d5b2886088748233152942225c3c04da49821984020d14286cb40705bb0719c962cc112065346090c450214466e91b42154b08ce446429a208c0121251341055a402213c90ca0184052c230cb342c4bc8681ba4604984846330294aa0695b8004d2380a14264ce2b2448ba211244649c414520b427103b210922880012488e308110a052819c481002022dc446842122244002ac9266a0c8731e0c04499148418360d11374222188c63b2910c9808a1a0010892440413245c987182847184325251b0319c422e1aa82802089101c0890bc7058a246522c2644c88915c826813a56450208621040291944448223022394a02988409a28819192944488c22950ca104720487701221104206841b498589064ad33608dbc04058b6510ca7098c24619990648cc2905b249010a34903256143328a119844c8b22004384110472c19c6441c252c048830d946699b20001b46825aa4805ba0491890250026800bc2315a407254c620c1b03124b14d10952814000aa0c84d54a28823988160900402162c13214091868d08c291911426d0b40c09c66051442e04112600291193c20863a431220028c114080c402c4114069c20725422068b084da148691030411c284944188ecc9648d942501b06490c458823040d20302e23852c14073040b6854cc02044862019006c540248cc886c59063249148404c750134928e40609d3c610c8284c23394452a464cca8494438320a898400342c22858d1031090932651c898c40402921850009a16d84c064e2022d48044012098ee0422e93440812106a01840592308acb348ea2262e5c86110b3508181000023426242389d1840024466013b249242846180271a03890891444d3962da31840232721c0185043c80441428d5c264144a26d48120e4032250b14820a482ecb828803a3601b25268cb82024b08598042108a72c833864543289010401234984029569d1a44d13a40c91460d6194809038455cc65001172053c6289b1810411268901221c01084421692538229812649d8a4059a2624240329e04026d20248112468119989981485c9200d50128c1c0810021000009528c1289059b485d314650a406e11296518c24c213465d830691030521931668c188ac8c0084c9830a3a62041162218052e22252a64b8250ab30163208409800919280e021101a39411e3986c58202109411060362208067112c2855aa085c0c6845c3806cbb669148484532282a1a640cc8600c42622a0a808983472d4204143c4904816681b16521a370250204248488a201141e2006cc0c20c14064911314d19060a8946091b816544c800820670001672cc24508a42899c969064287092b268982662619440c11689d842641a214e62906421c8248b286d5c4292a0c64d0c8580cc884dd4428d42348a0b0451c32686242581123506a04404c894815bb4311c08065c240803276a20c225e1809019b46da3460c4b186050c62c1b922d111504a2000421482ed81606d2108a83a22508310d093851d948490b164c2332251919024a4409d1b2210b832c23258593168544a0441b83500222724b04809b146521936018130ad9460d224561c8b440a1422d02b8090014449bb6110b978c40104a82146ada90051c028e0c1972a3b48d24305011870964c628e4189298b46c61165140460e1c3248da205188368a23b1218290281a1532e2186192048e13b690131368c984684c406d0b330081464dd2380c049681a4885002908522b004d3a471d28010ca964051a641a48428e008520b308cd2380a0c2951c38209ca2091d83692a3a628924222a216011a348637d9a659169881ec21cf4811869d1d7f139f0537e96f1184585405fd17808af1e06239d3b34e5aca8bf1369677b447ac718ac47d850c4d77b0be31dc9f508e3978f24274ab0185f727abdff59f4490371bf04610e364e64ec875ef9d20dc94077e1e166327a879b8ab516160b2a3f77437b9b3cc7d17aeaddc84db62746a35ac096f782f62a7f01aa6d6693deec90b23c66985a02307e0a1cae598a67324dba0f52f22432275e93257065c3b7e5e1cfe1dfd4d0df086df21243414a2d27e20230a829be4eb4c82c16d35f78b0e5e198332e00074bb64612fab17d4c8971cb68e5edab0369f1157b3469abd8384e2d9553f1b78e786e1ee9d0b98d39f83ccecf37d1ebd3a9d63aec766164a10171a4fd8c63daf182c421258c5f529aa55cb7ebae2e1652315e1f71e8a74131410d03247ede11d34db91f6f08aa2478fd789679c04949f71bc0171e07e3a8bb5753dbbdaa411a6350ab46eefbf86fc551c29efe4cdd7661d5cf6c3db22d0cedde599854459d97f20df7455bdf356a198d0f7eb6d34111fc940b25c0543b788edda9d26810eac3d6cc9c51327c2cf83e887d4089e19695e11add837f6f440cc360f93f32fee8a9663712c6bbd38c84ab7b54823ec363eb7e42eb59fc1fce60fbd55307b3ec85fd9daf3206d7b4b3917f1c8b7a92e3c67d89880fdf2e47f5a0c994595db170af41babf5a25b4dc1c42dd6a9db271e764de2fb015a49a850c7919be47006a336e2e325fde53ac599554d0a7de4ef45ec40c39d6baff311beee75d89e02ad31f4be4bd20ae9194f5edddaa6650776116e9f270f77714ad7a8e89acef74b7ff7d8dbec27f8020a985247e2cdacef4894a4d68ba37ca912d6be73501c995181e5b77723350b3631da3700e13fd366e131bf06b36eb6b0345093209f0a7beffae1fdd875b00687c1163c353d7d2ac90937b34e978e92f821adc9662202ece89a17e7bb65ae17d83b90dbbe6a501a4e1345bee4e5a5b53af2e5ba3d1ef3f4e05adf0b3a4cf2e530360fee64929902b571f6fd2e305652a4cb010f79f815e18f2bbb8cc89fa6fc76f77c89e293cf175a0b195800fe72d2ccdd7d75e5bd90bc6ac435d6a440ef852e9a1c8c53de03bf193365d735aaf29c5162a617e364e7f944168d0fb48fef40558f454297cc3dd508662cf23fb88e1954aa45d1c5e115bcc36f05b3e098d555220f40be2629b34507b8464c54c27b5dec78da8f22650514797af86a2512bcb7e2923379ef6d73c137006c1b38f51e37f93585e29041a3e4e3af46007ce13b8b5f7b17d5d65d7d5668e427bcbe7ec1d7c408c054a48c1ae797bf99acbc8d2607522935fd665ea7822d930f23eabff783bb23697569e204b943141e00c08810956be0525365dbab54ed48cb76964ccdf5cbd3aee7282d4a0000d2784d7b8fab16b2f7f0d5225732b1efbc4eb1cfedeb43fde79b69ecc0fbeaa1e6b40728673bd4b2e98a0d4a8f02f853950730f28d35eb12fcc79768b8e18e4bda0e58a331a2f71d7ccc2d451b32b1c65c312acf47ee513b21954c41c00c873872ee94cf14f46037425361f4bdb54821f711460cebae8c07508a9219f88fa6bedaa678eed501944a16ae6f7b5bb7a2e1e357e70d7b98461a2c71cb0fa762d6ad9824081d37f292fd4be8b84c36110dc744360201beebe0bd6c9d05e869256d2ff3f99517b7efd2a33774056cb5671675a8b492e9f5f2620eb8ef9381d3d1df19938b7b5ffaac59bc8110fa87ba8d7a3d0165f8e41dd0f804f11b9ded0f352a597835d06307a8e0c6ef4d21904339e1cf458923a3e89e025d945347366c02f3dd6368d4e47e85d3d2a9705bd57961852e5a579f93b1c514c539f49ea1163a2a493b0efcb47f4748f6a99e10bf7078282e4ace18136e2a8b3ee0a380dcd3b3ef3e65e1b8157289d62467ad488ba0392b2e90a1ededcbdc931dc17298ccef76645c7d330a05c2ce40f89b85468f357a217751e154631304ec4e04bb45b3678909c74af51ce370364d8f4f7eb1e61e00287429c9961de8322ca9a2629b1309d800e92bc1dc5055dcc797f33866eb0cfd8d490250d48ffca8022f49290e2d5376162fbaa982d16453c825b35f6515635ea92bea72367baa54de3f9eaea69542a81a4127f71cbaa257f324fefef14f08fbd65a049cd2fb362594a8e23ff1a2617db5b158f6f01cf50ab0ed95c6e709841164108b06e1b40ab0ab11c408301d3d9d8ea69e968a9600b3d17f38011ce28074e2c2e10bf6197c602d8d0ce7d3a3ef2d89623bc9f12ea338791e9266bb8ce02b124c6c7929baea693244098454a080eb7523e13bb1b7c5b6775fabababbe9075fe5687aa451397bb9cfccd051243e9bf5aef24062d335de5fce24e9ddbde1191052d80c36df9f8434872f277ed4f5a1ce8ebd3b960824a4e4f1001b04cb685f9bee4d0ddb0c571598ac2021a6606fd23345c6fbb84f0ce05fe52734521b7b07c6388d3a3b99318bf0131504aa9dfbaf548f9d32a9cd4c6893524b11330a2d3aad3ed2a58966ebb0134465d543fd7797af549f568eaebe957f64fec854674902b97558756986946ea3ab7a251cbbea11a687bd43f5d0bd89cd2caba61d5218374990ee8b92219ed25dca011c68a9757c013bd837b2dd734e3751f64fcb4b23dcd6bc57ea567f5716e17367244751e2303b22a953e772756956cdcc013ffd2c32490754422a572529d4c92f1ebb19f1dad4d036f2fdf31ca9101bdf81aea948aedcf217aa8fccd7a0771aa2753e1a823bf41c95377a2ffa61b2265138153ce86d2c87dd07a4b32d27f5f2872641431ce9a18a502aaefd9afc5b0d13cd46c357e38e69e1ee945add1992932a5b1e5c5629c9f48f7661853da00787c9d78fb925553bf07a50dd5b9d935853420e4d1a71ae62ff90ca193cdd6c2f4bed263415aaf9a35094bc2a22e2a663c7645001cd190b7bc17c75feadf8e87ce5c24b763b6584ed32e71b0268142ea3ed6898157bf923bebf0192d1bf5ee30a7d351634a60b504dde38a2e114f7ae9bf176d4a18ba2895a7bb4b47444a9ba8dbb4c124cd41bbb32f4bcb1de48c4abb510607a001b5a000bba43618b6c19e43517b45b42405928b67c713881858bad3a42511c2716ff9cd332034b672b52ff16610805cdbe7544a8a84b66e1c745a73c1b6bcda5b77b951f36c0f7a5372de9e5d1f9bbcde8843c6909002dda4875e67571af0bec581856c32c09c240e664e761e57cd0d8dc8a71cb918a5762d111285cd8b5613ddbd0ca08ac0342b2bdee38f96fa754bb2b087179c113c93986a810356eb94540b93cb9dec4aa9290ff12ec1aa2e656c9be3d590753c366c601406c061bc22033a1fd1f4e1111d039b8813b983cb506c3ea7ff3057983e8bf01682fbb00f43005313c82c1392918a6165a13338ffe11a992c1fb3d1032aa679a418c8ba4f8a0bc199e10cf6bd77a14fdd6a06093514348e3a8974434ae8a3676369c6be2cf90e672b343fce04ac6b22e0cf47568bc45d70a68e68c649a4830ae218590c1a437e7a23a54efe44f67086eb697b9fa57835f0b8f70f0a929226efb336c0e21833a028218cd63732c80aa477e62d141dba81854f70da68daff4a84cb6de779254e8a97e73565374af4092af05cbd6654afc3fd72f0ae232695cb6668eafecc4069bd90bb528b83efa2fbcdbd93b289929621ed74d808738fc103eeb105510851fc9319f171ea0ced0b97b5b9fb5ef985186bc52098f9eb476f67b7cc7665d47587975cb45a50fc64100719bf76345f0fdf1e09efe9fb800dc114e46be0879a195cc06870e23d2631dae71c3994481c8761c40d07c5bfca95e718b7b22585af03ed34175a46d57af3518e32a7fc1aa4482732a81a87f724f8d2e780b3a39d451a380f75c2d680cc7213eab1d4a59d394ae3810a1c90818d52f93fb203e2d8b1b5fa8f60b2d585d9135d648846f138b86953242d2bb1f2ecdf389b4de7651817b8e4e64b333f1aac523a93f2748a9c38ffbc29ced457b6f9781b08a67a1975d031ccd71545c0037434056c2434d13e6c4beebf46fc12222c0b2eccd6159d5aea8e554d7a09652b06bf7ca699a7199e716d05dd553041a8f2b303d236a9babaafb9fa528f28a2ca2aa780b940383c099aa65a0074b83fd1f0bc5b7b5e46c25e54838b3cbcfc95f87f1d471b3ba894434fa58952fdcb77f161372693306dba4e8f216d1c8e5caff0fe8360a51c60763644169fdc6a8267f2e3f909a61b2a678bce6ae90403a836b1a7b7e8cd8b54c37087a9e14446d95e6908d2eedbfcc653e02fdf771f701a79b9e5a26ed0a947842070f3b5701742211219e761762c37f0d0a1d1b9750fee577e1208115c66ac07ec091e6a3fc4aa6a253bcba868edd3154dcaf5162f615e85490a6ca342f34c43ac61a3ea6bfeefd850e190eb1d8da4d28b5eceeb1678c02433ecd5d48b2536404257e8ca7bef5855f2b813ed2f4c409445a3317c9be1a35ae2fb4d2b87921b904bf2c14db514cee045251cfc276374db15c99dea15acde197c6eb524988e39b63287beb8676865aaa3bad1b43b8cab15cbf27a498759e3203abf369e97242f0b0154149f14ac233cdb73a22b7fb8f09325bf2ace83bb6b5db8a121a2b682149a69131ccce52229840b113fc7b0bcc58405bfe87f1f95ffc2e96fc5596567e94364dfaa6d9d5a6eb99ae4ddf424
+Key = ML-DSA-87-RFC-Expanded
+PKCS8 = 30821338020100300b060960864801650304031304821324048213209792bcec2f2430686a82fccf3c2f5ff665e771d7ab41b90258cfa7e90ec97124d8e9ee4e90a16c602f5ec9bc38517dc30e329d5ab27673bd85f4c9b0300f776389886750b57c24db3fc012e61ede59753337374fa7124991549af243496d0637cb3be05a5948235bf79875f896d8fe0cab30c84948db4d6315aaaf160ac6243664220148161109112c94028922452c62b84500452a08967090126e149370d446108444515896910ca92982b241c90871c428680496894840859b226d1c28645912419cb891840489449005cb3462a086904026922099291305695c3468a4328e19269259461009a44923424d1236615810650128901a334c998631d3a249098225431428c0388103154d5b2886088748233152942225c3c04da49821984020d14286cb40705bb0719c962cc112065346090c450214466e91b42154b08ce446429a208c0121251341055a402213c90ca0184052c230cb342c4bc8681ba4604984846330294aa0695b8004d2380a14264ce2b2448ba211244649c414520b427103b210922880012488e308110a052819c481002022dc446842122244002ac9266a0c8731e0c04499148418360d11374222188c63b2910c9808a1a0010892440413245c987182847184325251b0319c422e1aa82802089101c0890bc7058a246522c2644c88915c826813a56450208621040291944448223022394a02988409a28819192944488c22950ca104720487701221104206841b498589064ad33608dbc04058b6510ca7098c24619990648cc2905b249010a34903256143328a119844c8b22004384110472c19c6441c252c048830d946699b20001b46825aa4805ba0491890250026800bc2315a407254c620c1b03124b14d10952814000aa0c84d54a28823988160900402162c13214091868d08c291911426d0b40c09c66051442e04112600291193c20863a431220028c114080c402c4114069c20725422068b084da148691030411c284944188ecc9648d942501b06490c458823040d20302e23852c14073040b6854cc02044862019006c540248cc886c59063249148404c750134928e40609d3c610c8284c23394452a464cca8494438320a898400342c22858d1031090932651c898c40402921850009a16d84c064e2022d48044012098ee0422e93440812106a01840592308acb348ea2262e5c86110b3508181000023426242389d1840024466013b249242846180271a03890891444d3962da31840232721c0185043c80441428d5c264144a26d48120e4032250b14820a482ecb828803a3601b25268cb82024b08598042108a72c833864543289010401234984029569d1a44d13a40c91460d6194809038455cc65001172053c6289b1810411268901221c01084421692538229812649d8a4059a2624240329e04026d20248112468119989981485c9200d50128c1c0810021000009528c1289059b485d314650a406e11296518c24c213465d830691030521931668c188ac8c0084c9830a3a62041162218052e22252a64b8250ab30163208409800919280e021101a39411e3986c58202109411060362208067112c2855aa085c0c6845c3806cbb669148484532282a1a640cc8600c42622a0a808983472d4204143c4904816681b16521a370250204248488a201141e2006cc0c20c14064911314d19060a8946091b816544c800820670001672cc24508a42899c969064287092b268982662619440c11689d842641a214e62906421c8248b286d5c4292a0c64d0c8580cc884dd4428d42348a0b0451c32686242581123506a04404c894815bb4311c08065c240803276a20c225e1809019b46da3460c4b186050c62c1b922d111504a2000421482ed81606d2108a83a22508310d093851d948490b164c2332251919024a4409d1b2210b832c23258593168544a0441b83500222724b04809b146521936018130ad9460d224561c8b440a1422d02b8090014449bb6110b978c40104a82146ada90051c028e0c1972a3b48d24305011870964c628e4189298b46c61165140460e1c3248da205188368a23b1218290281a1532e2186192048e13b690131368c984684c406d0b330081464dd2380c049681a4885002908522b004d3a471d28010ca964051a641a48428e008520b308cd2380a0c2951c38209ca2091d83692a3a628924222a216011a348637d9a659169881ec21cf4811869d1d7f139f0537e96f1184585405fd17808af1e06239d3b34e5aca8bf1369677b447ac718ac47d850c4d77b0be31dc9f508e3978f24274ab0185f727abdff59f4490371bf04610e364e64ec875ef9d20dc94077e1e166327a879b8ab516160b2a3f77437b9b3cc7d17aeaddc84db62746a35ac096f782f62a7f01aa6d6693deec90b23c66985a02307e0a1cae598a67324dba0f52f22432275e93257065c3b7e5e1cfe1dfd4d0df086df21243414a2d27e20230a829be4eb4c82c16d35f78b0e5e198332e00074bb64612fab17d4c8971cb68e5edab0369f1157b3469abd8384e2d9553f1b78e786e1ee9d0b98d39f83ccecf37d1ebd3a9d63aec766164a10171a4fd8c63daf182c421258c5f529aa55cb7ebae2e1652315e1f71e8a74131410d03247ede11d34db91f6f08aa2478fd789679c04949f71bc0171e07e3a8bb5753dbbdaa411a6350ab46eefbf86fc551c29efe4cdd7661d5cf6c3db22d0cedde599854459d97f20df7455bdf356a198d0f7eb6d34111fc940b25c0543b788edda9d26810eac3d6cc9c51327c2cf83e887d4089e19695e11add837f6f440cc360f93f32fee8a9663712c6bbd38c84ab7b54823ec363eb7e42eb59fc1fce60fbd55307b3ec85fd9daf3206d7b4b3917f1c8b7a92e3c67d89880fdf2e47f5a0c994595db170af41babf5a25b4dc1c42dd6a9db271e764de2fb015a49a850c7919be47006a336e2e325fde53ac599554d0a7de4ef45ec40c39d6baff311beee75d89e02ad31f4be4bd20ae9194f5edddaa6650776116e9f270f77714ad7a8e89acef74b7ff7d8dbec27f8020a985247e2cdacef4894a4d68ba37ca912d6be73501c995181e5b77723350b3631da3700e13fd366e131bf06b36eb6b0345093209f0a7beffae1fdd875b00687c1163c353d7d2ac90937b34e978e92f821adc9662202ece89a17e7bb65ae17d83b90dbbe6a501a4e1345bee4e5a5b53af2e5ba3d1ef3f4e05adf0b3a4cf2e530360fee64929902b571f6fd2e305652a4cb010f79f815e18f2bbb8cc89fa6fc76f77c89e293cf175a0b195800fe72d2ccdd7d75e5bd90bc6ac435d6a440ef852e9a1c8c53de03bf193365d735aaf29c5162a617e364e7f944168d0fb48fef40558f454297cc3dd508662cf23fb88e1954aa45d1c5e115bcc36f05b3e098d555220f40be2629b34507b8464c54c27b5dec78da8f22650514797af86a2512bcb7e2923379ef6d73c137006c1b38f51e37f93585e29041a3e4e3af46007ce13b8b5f7b17d5d65d7d5668e427bcbe7ec1d7c408c054a48c1ae797bf99acbc8d2607522935fd665ea7822d930f23eabff783bb23697569e204b943141e00c08810956be0525365dbab54ed48cb76964ccdf5cbd3aee7282d4a0000d2784d7b8fab16b2f7f0d5225732b1efbc4eb1cfedeb43fde79b69ecc0fbeaa1e6b40728673bd4b2e98a0d4a8f02f853950730f28d35eb12fcc79768b8e18e4bda0e58a331a2f71d7ccc2d451b32b1c65c312acf47ee513b21954c41c00c873872ee94cf14f46037425361f4bdb54821f711460cebae8c07508a9219f88fa6bedaa678eed501944a16ae6f7b5bb7a2e1e357e70d7b98461a2c71cb0fa762d6ad9824081d37f292fd4be8b84c36110dc744360201beebe0bd6c9d05e869256d2ff3f99517b7efd2a33774056cb5671675a8b492e9f5f2620eb8ef9381d3d1df19938b7b5ffaac59bc8110fa87ba8d7a3d0165f8e41dd0f804f11b9ded0f352a597835d06307a8e0c6ef4d21904339e1cf458923a3e89e025d945347366c02f3dd6368d4e47e85d3d2a9705bd57961852e5a579f93b1c514c539f49ea1163a2a493b0efcb47f4748f6a99e10bf7078282e4ace18136e2a8b3ee0a380dcd3b3ef3e65e1b8157289d62467ad488ba0392b2e90a1ededcbdc931dc17298ccef76645c7d330a05c2ce40f89b85468f357a217751e154631304ec4e04bb45b3678909c74af51ce370364d8f4f7eb1e61e00287429c9961de8322ca9a2629b1309d800e92bc1dc5055dcc797f33866eb0cfd8d490250d48ffca8022f49290e2d5376162fbaa982d16453c825b35f6515635ea92bea72367baa54de3f9eaea69542a81a4127f71cbaa257f324fefef14f08fbd65a049cd2fb362594a8e23ff1a2617db5b158f6f01cf50ab0ed95c6e709841164108b06e1b40ab0ab11c408301d3d9d8ea69e968a9600b3d17f38011ce28074e2c2e10bf6197c602d8d0ce7d3a3ef2d89623bc9f12ea338791e9266bb8ce02b124c6c7929baea693244098454a080eb7523e13bb1b7c5b6775fabababbe9075fe5687aa451397bb9cfccd051243e9bf5aef24062d335de5fce24e9ddbde1191052d80c36df9f8434872f277ed4f5a1ce8ebd3b960824a4e4f1001b04cb685f9bee4d0ddb0c571598ac2021a6606fd23345c6fbb84f0ce05fe52734521b7b07c6388d3a3b99318bf0131504aa9dfbaf548f9d32a9cd4c6893524b11330a2d3aad3ed2a58966ebb0134465d543fd7797af549f568eaebe957f64fec854674902b97558756986946ea3ab7a251cbbea11a687bd43f5d0bd89cd2caba61d5218374990ee8b92219ed25dca011c68a9757c013bd837b2dd734e3751f64fcb4b23dcd6bc57ea567f5716e17367244751e2303b22a953e772756956cdcc013ffd2c32490754422a572529d4c92f1ebb19f1dad4d036f2fdf31ca9101bdf81aea948aedcf217aa8fccd7a0771aa2753e1a823bf41c95377a2ffa61b2265138153ce86d2c87dd07a4b32d27f5f2872641431ce9a18a502aaefd9afc5b0d13cd46c357e38e69e1ee945add1992932a5b1e5c5629c9f48f7661853da00787c9d78fb925553bf07a50dd5b9d935853420e4d1a71ae62ff90ca193cdd6c2f4bed263415aaf9a35094bc2a22e2a663c7645001cd190b7bc17c75feadf8e87ce5c24b763b6584ed32e71b0268142ea3ed6898157bf923bebf0192d1bf5ee30a7d351634a60b504dde38a2e114f7ae9bf176d4a18ba2895a7bb4b47444a9ba8dbb4c124cd41bbb32f4bcb1de48c4abb510607a001b5a000bba43618b6c19e43517b45b42405928b67c713881858bad3a42511c2716ff9cd332034b672b52ff16610805cdbe7544a8a84b66e1c745a73c1b6bcda5b77b951f36c0f7a5372de9e5d1f9bbcde8843c6909002dda4875e67571af0bec581856c32c09c240e664e761e57cd0d8dc8a71cb918a5762d111285cd8b5613ddbd0ca08ac0342b2bdee38f96fa754bb2b087179c113c93986a810356eb94540b93cb9dec4aa9290ff12ec1aa2e656c9be3d590753c366c601406c061bc22033a1fd1f4e1111d039b8813b983cb506c3ea7ff3057983e8bf01682fbb00f43005313c82c1392918a6165a13338ffe11a992c1fb3d1032aa679a418c8ba4f8a0bc199e10cf6bd77a14fdd6a06093514348e3a8974434ae8a3676369c6be2cf90e672b343fce04ac6b22e0cf47568bc45d70a68e68c649a4830ae218590c1a437e7a23a54efe44f67086eb697b9fa57835f0b8f70f0a929226efb336c0e21833a028218cd63732c80aa477e62d141dba81854f70da68daff4a84cb6de779254e8a97e73565374af4092af05cbd6654afc3fd72f0ae232695cb6668eafecc4069bd90bb528b83efa2fbcdbd93b289929621ed74d808738fc103eeb105510851fc9319f171ea0ced0b97b5b9fb5ef985186bc52098f9eb476f67b7cc7665d47587975cb45a50fc64100719bf76345f0fdf1e09efe9fb800dc114e46be0879a195cc06870e23d2631dae71c3994481c8761c40d07c5bfca95e718b7b22585af03ed34175a46d57af3518e32a7fc1aa4482732a81a87f724f8d2e780b3a39d451a380f75c2d680cc7213eab1d4a59d394ae3810a1c90818d52f93fb203e2d8b1b5fa8f60b2d585d9135d648846f138b86953242d2bb1f2ecdf389b4de7651817b8e4e64b333f1aac523a93f2748a9c38ffbc29ced457b6f9781b08a67a1975d031ccd71545c0037434056c2434d13e6c4beebf46fc12222c0b2eccd6159d5aea8e554d7a09652b06bf7ca699a7199e716d05dd553041a8f2b303d236a9babaafb9fa528f28a2ca2aa780b940383c099aa65a0074b83fd1f0bc5b7b5e46c25e54838b3cbcfc95f87f1d471b3ba894434fa58952fdcb77f161372693306dba4e8f216d1c8e5caff0fe8360a51c60763644169fdc6a8267f2e3f909a61b2a678bce6ae90403a836b1a7b7e8cd8b54c37087a9e14446d95e6908d2eedbfcc653e02fdf771f701a79b9e5a26ed0a947842070f3b5701742211219e761762c37f0d0a1d1b9750fee577e1208115c66ac07ec091e6a3fc4aa6a253bcba868edd3154dcaf5162f615e85490a6ca342f34c43ac61a3ea6bfeefd850e190eb1d8da4d28b5eceeb1678c02433ecd5d48b2536404257e8ca7bef5855f2b813ed2f4c409445a3317c9be1a35ae2fb4d2b87921b904bf2c14db514cee045251cfc276374db15c99dea15acde197c6eb524988e39b63287beb8676865aaa3bad1b43b8cab15cbf27a498759e3203abf369e97242f0b0154149f14ac233cdb73a22b7fb8f09325bf2ace83bb6b5db8a121a2b682149a69131ccce52229840b113fc7b0bcc58405bfe87f1f95ffc2e96fc5596567e94364dfaa6d9d5a6eb99ae4ddf424
 Error = PRIVATE_KEY_WAS_NOT_SEED
 
-PrivateKey = ML-DSA-87-RFC-Both
-Input = 3082135e020100300b06096086480165030403130482134a308213460420000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f048213209792bcec2f2430686a82fccf3c2f5ff665e771d7ab41b90258cfa7e90ec97124d8e9ee4e90a16c602f5ec9bc38517dc30e329d5ab27673bd85f4c9b0300f776389886750b57c24db3fc012e61ede59753337374fa7124991549af243496d0637cb3be05a5948235bf79875f896d8fe0cab30c84948db4d6315aaaf160ac6243664220148161109112c94028922452c62b84500452a08967090126e149370d446108444515896910ca92982b241c90871c428680496894840859b226d1c28645912419cb891840489449005cb3462a086904026922099291305695c3468a4328e19269259461009a44923424d1236615810650128901a334c998631d3a249098225431428c0388103154d5b2886088748233152942225c3c04da49821984020d14286cb40705bb0719c962cc112065346090c450214466e91b42154b08ce446429a208c0121251341055a402213c90ca0184052c230cb342c4bc8681ba4604984846330294aa0695b8004d2380a14264ce2b2448ba211244649c414520b427103b210922880012488e308110a052819c481002022dc446842122244002ac9266a0c8731e0c04499148418360d11374222188c63b2910c9808a1a0010892440413245c987182847184325251b0319c422e1aa82802089101c0890bc7058a246522c2644c88915c826813a56450208621040291944448223022394a02988409a28819192944488c22950ca104720487701221104206841b498589064ad33608dbc04058b6510ca7098c24619990648cc2905b249010a34903256143328a119844c8b22004384110472c19c6441c252c048830d946699b20001b46825aa4805ba0491890250026800bc2315a407254c620c1b03124b14d10952814000aa0c84d54a28823988160900402162c13214091868d08c291911426d0b40c09c66051442e04112600291193c20863a431220028c114080c402c4114069c20725422068b084da148691030411c284944188ecc9648d942501b06490c458823040d20302e23852c14073040b6854cc02044862019006c540248cc886c59063249148404c750134928e40609d3c610c8284c23394452a464cca8494438320a898400342c22858d1031090932651c898c40402921850009a16d84c064e2022d48044012098ee0422e93440812106a01840592308acb348ea2262e5c86110b3508181000023426242389d1840024466013b249242846180271a03890891444d3962da31840232721c0185043c80441428d5c264144a26d48120e4032250b14820a482ecb828803a3601b25268cb82024b08598042108a72c833864543289010401234984029569d1a44d13a40c91460d6194809038455cc65001172053c6289b1810411268901221c01084421692538229812649d8a4059a2624240329e04026d20248112468119989981485c9200d50128c1c0810021000009528c1289059b485d314650a406e11296518c24c213465d830691030521931668c188ac8c0084c9830a3a62041162218052e22252a64b8250ab30163208409800919280e021101a39411e3986c58202109411060362208067112c2855aa085c0c6845c3806cbb669148484532282a1a640cc8600c42622a0a808983472d4204143c4904816681b16521a370250204248488a201141e2006cc0c20c14064911314d19060a8946091b816544c800820670001672cc24508a42899c969064287092b268982662619440c11689d842641a214e62906421c8248b286d5c4292a0c64d0c8580cc884dd4428d42348a0b0451c32686242581123506a04404c894815bb4311c08065c240803276a20c225e1809019b46da3460c4b186050c62c1b922d111504a2000421482ed81606d2108a83a22508310d093851d948490b164c2332251919024a4409d1b2210b832c23258593168544a0441b83500222724b04809b146521936018130ad9460d224561c8b440a1422d02b8090014449bb6110b978c40104a82146ada90051c028e0c1972a3b48d24305011870964c628e4189298b46c61165140460e1c3248da205188368a23b1218290281a1532e2186192048e13b690131368c984684c406d0b330081464dd2380c049681a4885002908522b004d3a471d28010ca964051a641a48428e008520b308cd2380a0c2951c38209ca2091d83692a3a628924222a216011a348637d9a659169881ec21cf4811869d1d7f139f0537e96f1184585405fd17808af1e06239d3b34e5aca8bf1369677b447ac718ac47d850c4d77b0be31dc9f508e3978f24274ab0185f727abdff59f4490371bf04610e364e64ec875ef9d20dc94077e1e166327a879b8ab516160b2a3f77437b9b3cc7d17aeaddc84db62746a35ac096f782f62a7f01aa6d6693deec90b23c66985a02307e0a1cae598a67324dba0f52f22432275e93257065c3b7e5e1cfe1dfd4d0df086df21243414a2d27e20230a829be4eb4c82c16d35f78b0e5e198332e00074bb64612fab17d4c8971cb68e5edab0369f1157b3469abd8384e2d9553f1b78e786e1ee9d0b98d39f83ccecf37d1ebd3a9d63aec766164a10171a4fd8c63daf182c421258c5f529aa55cb7ebae2e1652315e1f71e8a74131410d03247ede11d34db91f6f08aa2478fd789679c04949f71bc0171e07e3a8bb5753dbbdaa411a6350ab46eefbf86fc551c29efe4cdd7661d5cf6c3db22d0cedde599854459d97f20df7455bdf356a198d0f7eb6d34111fc940b25c0543b788edda9d26810eac3d6cc9c51327c2cf83e887d4089e19695e11add837f6f440cc360f93f32fee8a9663712c6bbd38c84ab7b54823ec363eb7e42eb59fc1fce60fbd55307b3ec85fd9daf3206d7b4b3917f1c8b7a92e3c67d89880fdf2e47f5a0c994595db170af41babf5a25b4dc1c42dd6a9db271e764de2fb015a49a850c7919be47006a336e2e325fde53ac599554d0a7de4ef45ec40c39d6baff311beee75d89e02ad31f4be4bd20ae9194f5edddaa6650776116e9f270f77714ad7a8e89acef74b7ff7d8dbec27f8020a985247e2cdacef4894a4d68ba37ca912d6be73501c995181e5b77723350b3631da3700e13fd366e131bf06b36eb6b0345093209f0a7beffae1fdd875b00687c1163c353d7d2ac90937b34e978e92f821adc9662202ece89a17e7bb65ae17d83b90dbbe6a501a4e1345bee4e5a5b53af2e5ba3d1ef3f4e05adf0b3a4cf2e530360fee64929902b571f6fd2e305652a4cb010f79f815e18f2bbb8cc89fa6fc76f77c89e293cf175a0b195800fe72d2ccdd7d75e5bd90bc6ac435d6a440ef852e9a1c8c53de03bf193365d735aaf29c5162a617e364e7f944168d0fb48fef40558f454297cc3dd508662cf23fb88e1954aa45d1c5e115bcc36f05b3e098d555220f40be2629b34507b8464c54c27b5dec78da8f22650514797af86a2512bcb7e2923379ef6d73c137006c1b38f51e37f93585e29041a3e4e3af46007ce13b8b5f7b17d5d65d7d5668e427bcbe7ec1d7c408c054a48c1ae797bf99acbc8d2607522935fd665ea7822d930f23eabff783bb23697569e204b943141e00c08810956be0525365dbab54ed48cb76964ccdf5cbd3aee7282d4a0000d2784d7b8fab16b2f7f0d5225732b1efbc4eb1cfedeb43fde79b69ecc0fbeaa1e6b40728673bd4b2e98a0d4a8f02f853950730f28d35eb12fcc79768b8e18e4bda0e58a331a2f71d7ccc2d451b32b1c65c312acf47ee513b21954c41c00c873872ee94cf14f46037425361f4bdb54821f711460cebae8c07508a9219f88fa6bedaa678eed501944a16ae6f7b5bb7a2e1e357e70d7b98461a2c71cb0fa762d6ad9824081d37f292fd4be8b84c36110dc744360201beebe0bd6c9d05e869256d2ff3f99517b7efd2a33774056cb5671675a8b492e9f5f2620eb8ef9381d3d1df19938b7b5ffaac59bc8110fa87ba8d7a3d0165f8e41dd0f804f11b9ded0f352a597835d06307a8e0c6ef4d21904339e1cf458923a3e89e025d945347366c02f3dd6368d4e47e85d3d2a9705bd57961852e5a579f93b1c514c539f49ea1163a2a493b0efcb47f4748f6a99e10bf7078282e4ace18136e2a8b3ee0a380dcd3b3ef3e65e1b8157289d62467ad488ba0392b2e90a1ededcbdc931dc17298ccef76645c7d330a05c2ce40f89b85468f357a217751e154631304ec4e04bb45b3678909c74af51ce370364d8f4f7eb1e61e00287429c9961de8322ca9a2629b1309d800e92bc1dc5055dcc797f33866eb0cfd8d490250d48ffca8022f49290e2d5376162fbaa982d16453c825b35f6515635ea92bea72367baa54de3f9eaea69542a81a4127f71cbaa257f324fefef14f08fbd65a049cd2fb362594a8e23ff1a2617db5b158f6f01cf50ab0ed95c6e709841164108b06e1b40ab0ab11c408301d3d9d8ea69e968a9600b3d17f38011ce28074e2c2e10bf6197c602d8d0ce7d3a3ef2d89623bc9f12ea338791e9266bb8ce02b124c6c7929baea693244098454a080eb7523e13bb1b7c5b6775fabababbe9075fe5687aa451397bb9cfccd051243e9bf5aef24062d335de5fce24e9ddbde1191052d80c36df9f8434872f277ed4f5a1ce8ebd3b960824a4e4f1001b04cb685f9bee4d0ddb0c571598ac2021a6606fd23345c6fbb84f0ce05fe52734521b7b07c6388d3a3b99318bf0131504aa9dfbaf548f9d32a9cd4c6893524b11330a2d3aad3ed2a58966ebb0134465d543fd7797af549f568eaebe957f64fec854674902b97558756986946ea3ab7a251cbbea11a687bd43f5d0bd89cd2caba61d5218374990ee8b92219ed25dca011c68a9757c013bd837b2dd734e3751f64fcb4b23dcd6bc57ea567f5716e17367244751e2303b22a953e772756956cdcc013ffd2c32490754422a572529d4c92f1ebb19f1dad4d036f2fdf31ca9101bdf81aea948aedcf217aa8fccd7a0771aa2753e1a823bf41c95377a2ffa61b2265138153ce86d2c87dd07a4b32d27f5f2872641431ce9a18a502aaefd9afc5b0d13cd46c357e38e69e1ee945add1992932a5b1e5c5629c9f48f7661853da00787c9d78fb925553bf07a50dd5b9d935853420e4d1a71ae62ff90ca193cdd6c2f4bed263415aaf9a35094bc2a22e2a663c7645001cd190b7bc17c75feadf8e87ce5c24b763b6584ed32e71b0268142ea3ed6898157bf923bebf0192d1bf5ee30a7d351634a60b504dde38a2e114f7ae9bf176d4a18ba2895a7bb4b47444a9ba8dbb4c124cd41bbb32f4bcb1de48c4abb510607a001b5a000bba43618b6c19e43517b45b42405928b67c713881858bad3a42511c2716ff9cd332034b672b52ff16610805cdbe7544a8a84b66e1c745a73c1b6bcda5b77b951f36c0f7a5372de9e5d1f9bbcde8843c6909002dda4875e67571af0bec581856c32c09c240e664e761e57cd0d8dc8a71cb918a5762d111285cd8b5613ddbd0ca08ac0342b2bdee38f96fa754bb2b087179c113c93986a810356eb94540b93cb9dec4aa9290ff12ec1aa2e656c9be3d590753c366c601406c061bc22033a1fd1f4e1111d039b8813b983cb506c3ea7ff3057983e8bf01682fbb00f43005313c82c1392918a6165a13338ffe11a992c1fb3d1032aa679a418c8ba4f8a0bc199e10cf6bd77a14fdd6a06093514348e3a8974434ae8a3676369c6be2cf90e672b343fce04ac6b22e0cf47568bc45d70a68e68c649a4830ae218590c1a437e7a23a54efe44f67086eb697b9fa57835f0b8f70f0a929226efb336c0e21833a028218cd63732c80aa477e62d141dba81854f70da68daff4a84cb6de779254e8a97e73565374af4092af05cbd6654afc3fd72f0ae232695cb6668eafecc4069bd90bb528b83efa2fbcdbd93b289929621ed74d808738fc103eeb105510851fc9319f171ea0ced0b97b5b9fb5ef985186bc52098f9eb476f67b7cc7665d47587975cb45a50fc64100719bf76345f0fdf1e09efe9fb800dc114e46be0879a195cc06870e23d2631dae71c3994481c8761c40d07c5bfca95e718b7b22585af03ed34175a46d57af3518e32a7fc1aa4482732a81a87f724f8d2e780b3a39d451a380f75c2d680cc7213eab1d4a59d394ae3810a1c90818d52f93fb203e2d8b1b5fa8f60b2d585d9135d648846f138b86953242d2bb1f2ecdf389b4de7651817b8e4e64b333f1aac523a93f2748a9c38ffbc29ced457b6f9781b08a67a1975d031ccd71545c0037434056c2434d13e6c4beebf46fc12222c0b2eccd6159d5aea8e554d7a09652b06bf7ca699a7199e716d05dd553041a8f2b303d236a9babaafb9fa528f28a2ca2aa780b940383c099aa65a0074b83fd1f0bc5b7b5e46c25e54838b3cbcfc95f87f1d471b3ba894434fa58952fdcb77f161372693306dba4e8f216d1c8e5caff0fe8360a51c60763644169fdc6a8267f2e3f909a61b2a678bce6ae90403a836b1a7b7e8cd8b54c37087a9e14446d95e6908d2eedbfcc653e02fdf771f701a79b9e5a26ed0a947842070f3b5701742211219e761762c37f0d0a1d1b9750fee577e1208115c66ac07ec091e6a3fc4aa6a253bcba868edd3154dcaf5162f615e85490a6ca342f34c43ac61a3ea6bfeefd850e190eb1d8da4d28b5eceeb1678c02433ecd5d48b2536404257e8ca7bef5855f2b813ed2f4c409445a3317c9be1a35ae2fb4d2b87921b904bf2c14db514cee045251cfc276374db15c99dea15acde197c6eb524988e39b63287beb8676865aaa3bad1b43b8cab15cbf27a498759e3203abf369e97242f0b0154149f14ac233cdb73a22b7fb8f09325bf2ace83bb6b5db8a121a2b682149a69131ccce52229840b113fc7b0bcc58405bfe87f1f95ffc2e96fc5596567e94364dfaa6d9d5a6eb99ae4ddf424
+Key = ML-DSA-87-RFC-Both
+PKCS8 = 3082135e020100300b06096086480165030403130482134a308213460420000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f048213209792bcec2f2430686a82fccf3c2f5ff665e771d7ab41b90258cfa7e90ec97124d8e9ee4e90a16c602f5ec9bc38517dc30e329d5ab27673bd85f4c9b0300f776389886750b57c24db3fc012e61ede59753337374fa7124991549af243496d0637cb3be05a5948235bf79875f896d8fe0cab30c84948db4d6315aaaf160ac6243664220148161109112c94028922452c62b84500452a08967090126e149370d446108444515896910ca92982b241c90871c428680496894840859b226d1c28645912419cb891840489449005cb3462a086904026922099291305695c3468a4328e19269259461009a44923424d1236615810650128901a334c998631d3a249098225431428c0388103154d5b2886088748233152942225c3c04da49821984020d14286cb40705bb0719c962cc112065346090c450214466e91b42154b08ce446429a208c0121251341055a402213c90ca0184052c230cb342c4bc8681ba4604984846330294aa0695b8004d2380a14264ce2b2448ba211244649c414520b427103b210922880012488e308110a052819c481002022dc446842122244002ac9266a0c8731e0c04499148418360d11374222188c63b2910c9808a1a0010892440413245c987182847184325251b0319c422e1aa82802089101c0890bc7058a246522c2644c88915c826813a56450208621040291944448223022394a02988409a28819192944488c22950ca104720487701221104206841b498589064ad33608dbc04058b6510ca7098c24619990648cc2905b249010a34903256143328a119844c8b22004384110472c19c6441c252c048830d946699b20001b46825aa4805ba0491890250026800bc2315a407254c620c1b03124b14d10952814000aa0c84d54a28823988160900402162c13214091868d08c291911426d0b40c09c66051442e04112600291193c20863a431220028c114080c402c4114069c20725422068b084da148691030411c284944188ecc9648d942501b06490c458823040d20302e23852c14073040b6854cc02044862019006c540248cc886c59063249148404c750134928e40609d3c610c8284c23394452a464cca8494438320a898400342c22858d1031090932651c898c40402921850009a16d84c064e2022d48044012098ee0422e93440812106a01840592308acb348ea2262e5c86110b3508181000023426242389d1840024466013b249242846180271a03890891444d3962da31840232721c0185043c80441428d5c264144a26d48120e4032250b14820a482ecb828803a3601b25268cb82024b08598042108a72c833864543289010401234984029569d1a44d13a40c91460d6194809038455cc65001172053c6289b1810411268901221c01084421692538229812649d8a4059a2624240329e04026d20248112468119989981485c9200d50128c1c0810021000009528c1289059b485d314650a406e11296518c24c213465d830691030521931668c188ac8c0084c9830a3a62041162218052e22252a64b8250ab30163208409800919280e021101a39411e3986c58202109411060362208067112c2855aa085c0c6845c3806cbb669148484532282a1a640cc8600c42622a0a808983472d4204143c4904816681b16521a370250204248488a201141e2006cc0c20c14064911314d19060a8946091b816544c800820670001672cc24508a42899c969064287092b268982662619440c11689d842641a214e62906421c8248b286d5c4292a0c64d0c8580cc884dd4428d42348a0b0451c32686242581123506a04404c894815bb4311c08065c240803276a20c225e1809019b46da3460c4b186050c62c1b922d111504a2000421482ed81606d2108a83a22508310d093851d948490b164c2332251919024a4409d1b2210b832c23258593168544a0441b83500222724b04809b146521936018130ad9460d224561c8b440a1422d02b8090014449bb6110b978c40104a82146ada90051c028e0c1972a3b48d24305011870964c628e4189298b46c61165140460e1c3248da205188368a23b1218290281a1532e2186192048e13b690131368c984684c406d0b330081464dd2380c049681a4885002908522b004d3a471d28010ca964051a641a48428e008520b308cd2380a0c2951c38209ca2091d83692a3a628924222a216011a348637d9a659169881ec21cf4811869d1d7f139f0537e96f1184585405fd17808af1e06239d3b34e5aca8bf1369677b447ac718ac47d850c4d77b0be31dc9f508e3978f24274ab0185f727abdff59f4490371bf04610e364e64ec875ef9d20dc94077e1e166327a879b8ab516160b2a3f77437b9b3cc7d17aeaddc84db62746a35ac096f782f62a7f01aa6d6693deec90b23c66985a02307e0a1cae598a67324dba0f52f22432275e93257065c3b7e5e1cfe1dfd4d0df086df21243414a2d27e20230a829be4eb4c82c16d35f78b0e5e198332e00074bb64612fab17d4c8971cb68e5edab0369f1157b3469abd8384e2d9553f1b78e786e1ee9d0b98d39f83ccecf37d1ebd3a9d63aec766164a10171a4fd8c63daf182c421258c5f529aa55cb7ebae2e1652315e1f71e8a74131410d03247ede11d34db91f6f08aa2478fd789679c04949f71bc0171e07e3a8bb5753dbbdaa411a6350ab46eefbf86fc551c29efe4cdd7661d5cf6c3db22d0cedde599854459d97f20df7455bdf356a198d0f7eb6d34111fc940b25c0543b788edda9d26810eac3d6cc9c51327c2cf83e887d4089e19695e11add837f6f440cc360f93f32fee8a9663712c6bbd38c84ab7b54823ec363eb7e42eb59fc1fce60fbd55307b3ec85fd9daf3206d7b4b3917f1c8b7a92e3c67d89880fdf2e47f5a0c994595db170af41babf5a25b4dc1c42dd6a9db271e764de2fb015a49a850c7919be47006a336e2e325fde53ac599554d0a7de4ef45ec40c39d6baff311beee75d89e02ad31f4be4bd20ae9194f5edddaa6650776116e9f270f77714ad7a8e89acef74b7ff7d8dbec27f8020a985247e2cdacef4894a4d68ba37ca912d6be73501c995181e5b77723350b3631da3700e13fd366e131bf06b36eb6b0345093209f0a7beffae1fdd875b00687c1163c353d7d2ac90937b34e978e92f821adc9662202ece89a17e7bb65ae17d83b90dbbe6a501a4e1345bee4e5a5b53af2e5ba3d1ef3f4e05adf0b3a4cf2e530360fee64929902b571f6fd2e305652a4cb010f79f815e18f2bbb8cc89fa6fc76f77c89e293cf175a0b195800fe72d2ccdd7d75e5bd90bc6ac435d6a440ef852e9a1c8c53de03bf193365d735aaf29c5162a617e364e7f944168d0fb48fef40558f454297cc3dd508662cf23fb88e1954aa45d1c5e115bcc36f05b3e098d555220f40be2629b34507b8464c54c27b5dec78da8f22650514797af86a2512bcb7e2923379ef6d73c137006c1b38f51e37f93585e29041a3e4e3af46007ce13b8b5f7b17d5d65d7d5668e427bcbe7ec1d7c408c054a48c1ae797bf99acbc8d2607522935fd665ea7822d930f23eabff783bb23697569e204b943141e00c08810956be0525365dbab54ed48cb76964ccdf5cbd3aee7282d4a0000d2784d7b8fab16b2f7f0d5225732b1efbc4eb1cfedeb43fde79b69ecc0fbeaa1e6b40728673bd4b2e98a0d4a8f02f853950730f28d35eb12fcc79768b8e18e4bda0e58a331a2f71d7ccc2d451b32b1c65c312acf47ee513b21954c41c00c873872ee94cf14f46037425361f4bdb54821f711460cebae8c07508a9219f88fa6bedaa678eed501944a16ae6f7b5bb7a2e1e357e70d7b98461a2c71cb0fa762d6ad9824081d37f292fd4be8b84c36110dc744360201beebe0bd6c9d05e869256d2ff3f99517b7efd2a33774056cb5671675a8b492e9f5f2620eb8ef9381d3d1df19938b7b5ffaac59bc8110fa87ba8d7a3d0165f8e41dd0f804f11b9ded0f352a597835d06307a8e0c6ef4d21904339e1cf458923a3e89e025d945347366c02f3dd6368d4e47e85d3d2a9705bd57961852e5a579f93b1c514c539f49ea1163a2a493b0efcb47f4748f6a99e10bf7078282e4ace18136e2a8b3ee0a380dcd3b3ef3e65e1b8157289d62467ad488ba0392b2e90a1ededcbdc931dc17298ccef76645c7d330a05c2ce40f89b85468f357a217751e154631304ec4e04bb45b3678909c74af51ce370364d8f4f7eb1e61e00287429c9961de8322ca9a2629b1309d800e92bc1dc5055dcc797f33866eb0cfd8d490250d48ffca8022f49290e2d5376162fbaa982d16453c825b35f6515635ea92bea72367baa54de3f9eaea69542a81a4127f71cbaa257f324fefef14f08fbd65a049cd2fb362594a8e23ff1a2617db5b158f6f01cf50ab0ed95c6e709841164108b06e1b40ab0ab11c408301d3d9d8ea69e968a9600b3d17f38011ce28074e2c2e10bf6197c602d8d0ce7d3a3ef2d89623bc9f12ea338791e9266bb8ce02b124c6c7929baea693244098454a080eb7523e13bb1b7c5b6775fabababbe9075fe5687aa451397bb9cfccd051243e9bf5aef24062d335de5fce24e9ddbde1191052d80c36df9f8434872f277ed4f5a1ce8ebd3b960824a4e4f1001b04cb685f9bee4d0ddb0c571598ac2021a6606fd23345c6fbb84f0ce05fe52734521b7b07c6388d3a3b99318bf0131504aa9dfbaf548f9d32a9cd4c6893524b11330a2d3aad3ed2a58966ebb0134465d543fd7797af549f568eaebe957f64fec854674902b97558756986946ea3ab7a251cbbea11a687bd43f5d0bd89cd2caba61d5218374990ee8b92219ed25dca011c68a9757c013bd837b2dd734e3751f64fcb4b23dcd6bc57ea567f5716e17367244751e2303b22a953e772756956cdcc013ffd2c32490754422a572529d4c92f1ebb19f1dad4d036f2fdf31ca9101bdf81aea948aedcf217aa8fccd7a0771aa2753e1a823bf41c95377a2ffa61b2265138153ce86d2c87dd07a4b32d27f5f2872641431ce9a18a502aaefd9afc5b0d13cd46c357e38e69e1ee945add1992932a5b1e5c5629c9f48f7661853da00787c9d78fb925553bf07a50dd5b9d935853420e4d1a71ae62ff90ca193cdd6c2f4bed263415aaf9a35094bc2a22e2a663c7645001cd190b7bc17c75feadf8e87ce5c24b763b6584ed32e71b0268142ea3ed6898157bf923bebf0192d1bf5ee30a7d351634a60b504dde38a2e114f7ae9bf176d4a18ba2895a7bb4b47444a9ba8dbb4c124cd41bbb32f4bcb1de48c4abb510607a001b5a000bba43618b6c19e43517b45b42405928b67c713881858bad3a42511c2716ff9cd332034b672b52ff16610805cdbe7544a8a84b66e1c745a73c1b6bcda5b77b951f36c0f7a5372de9e5d1f9bbcde8843c6909002dda4875e67571af0bec581856c32c09c240e664e761e57cd0d8dc8a71cb918a5762d111285cd8b5613ddbd0ca08ac0342b2bdee38f96fa754bb2b087179c113c93986a810356eb94540b93cb9dec4aa9290ff12ec1aa2e656c9be3d590753c366c601406c061bc22033a1fd1f4e1111d039b8813b983cb506c3ea7ff3057983e8bf01682fbb00f43005313c82c1392918a6165a13338ffe11a992c1fb3d1032aa679a418c8ba4f8a0bc199e10cf6bd77a14fdd6a06093514348e3a8974434ae8a3676369c6be2cf90e672b343fce04ac6b22e0cf47568bc45d70a68e68c649a4830ae218590c1a437e7a23a54efe44f67086eb697b9fa57835f0b8f70f0a929226efb336c0e21833a028218cd63732c80aa477e62d141dba81854f70da68daff4a84cb6de779254e8a97e73565374af4092af05cbd6654afc3fd72f0ae232695cb6668eafecc4069bd90bb528b83efa2fbcdbd93b289929621ed74d808738fc103eeb105510851fc9319f171ea0ced0b97b5b9fb5ef985186bc52098f9eb476f67b7cc7665d47587975cb45a50fc64100719bf76345f0fdf1e09efe9fb800dc114e46be0879a195cc06870e23d2631dae71c3994481c8761c40d07c5bfca95e718b7b22585af03ed34175a46d57af3518e32a7fc1aa4482732a81a87f724f8d2e780b3a39d451a380f75c2d680cc7213eab1d4a59d394ae3810a1c90818d52f93fb203e2d8b1b5fa8f60b2d585d9135d648846f138b86953242d2bb1f2ecdf389b4de7651817b8e4e64b333f1aac523a93f2748a9c38ffbc29ced457b6f9781b08a67a1975d031ccd71545c0037434056c2434d13e6c4beebf46fc12222c0b2eccd6159d5aea8e554d7a09652b06bf7ca699a7199e716d05dd553041a8f2b303d236a9babaafb9fa528f28a2ca2aa780b940383c099aa65a0074b83fd1f0bc5b7b5e46c25e54838b3cbcfc95f87f1d471b3ba894434fa58952fdcb77f161372693306dba4e8f216d1c8e5caff0fe8360a51c60763644169fdc6a8267f2e3f909a61b2a678bce6ae90403a836b1a7b7e8cd8b54c37087a9e14446d95e6908d2eedbfcc653e02fdf771f701a79b9e5a26ed0a947842070f3b5701742211219e761762c37f0d0a1d1b9750fee577e1208115c66ac07ec091e6a3fc4aa6a253bcba868edd3154dcaf5162f615e85490a6ca342f34c43ac61a3ea6bfeefd850e190eb1d8da4d28b5eceeb1678c02433ecd5d48b2536404257e8ca7bef5855f2b813ed2f4c409445a3317c9be1a35ae2fb4d2b87921b904bf2c14db514cee045251cfc276374db15c99dea15acde197c6eb524988e39b63287beb8676865aaa3bad1b43b8cab15cbf27a498759e3203abf369e97242f0b0154149f14ac233cdb73a22b7fb8f09325bf2ace83bb6b5db8a121a2b682149a69131ccce52229840b113fc7b0bcc58405bfe87f1f95ffc2e96fc5596567e94364dfaa6d9d5a6eb99ae4ddf424
 Error = PRIVATE_KEY_WAS_NOT_SEED
 
-PublicKey = ML-DSA-87-RFC-Public
-Algorithm = ML-DSA-87
-Input = 30820a32300b060960864801650304031303820a21009792bcec2f2430686a82fccf3c2f5ff665e771d7ab41b90258cfa7e90ec97124a73b323b9ba21ab64d767c433f5a521effe18f86e46a188952c4467e048b729e7fc4d115e7e48da1896d5fe119b10dcddef62cb307954074b42336e52836de61da941f8d37ea68ac8106fabe19070679af6008537120f70793b8ea9cc0e6e7b7b4c9a5c7421c60f24451ba1e933db1a2ee16c79559f21b3d1b8305850aa42afbb13f1f4d5b9f4835f9d87dfceb162d0ef4a7fdc4cba1743cd1c87bb4967da16cc8764b6569df8ee5bdcbffe9a4e05748e6fdf225af9e4eeb7773b62e8f85f9b56b548945551844fbd89806a4ac369bed2d256100f688a6ad5e0a709826dc4449e91e23c5506e642361ef5a313712f79bc4b3186861ca85a4bab17e7f943d1b8a333aa3ae7ce16b440d6018f9e04daf5725c7f1a93fad1a5a27b67895bd249aa91685de20af32c8b7e268c7f96877d0c85001135a4f0a8f1b8264fa6ebe5a349d8aecad1a16299ccf2fd9c7b85bace2ced3aa1276ba61ee78ed7e5ca5b67cdd458a9354030e6abbbabf56a0a2316fec9dba83b51d42fd3167f1e0f90855d5c66509b210265dc1e54ec44b43ba7cf9aef118b44d80912ce75166a6651e116cebe49229a7062c09931f71abd2293f76f7efc3215ba97800037e58e470bdbbb43c1b0439eaf79c54d93b44aac9efe9fbe151874cfb2a64cbee28cc4c0fe7775e5d870f1c02e5b2e3c5004c995f24c9b779cb753a277d0e71fd425eb6bc2ca56ce129db51f70740f31e63976b50c7312e9797d78c5b1ac24a5fa347cc916e0a83f5c3b675cd30b81e3fa10b93444e07397571cce98b28da51db9056bc728c5b0b1181e2fbd387b4c79ab1a5fefece37167af772ddad14eb4c3982da5a59d0e9eb173ec6315091170027a3ab5ef6aa129cb8585727b9358a28501d713a72f3f1db31714286f9b6408013af06045d75592fc0b7dd47c73ed9c75b11e9d7c69f7cadfc3280a9062c5273c43be1c34f87448864cea7b5c97d6d32f59bd5f25384653bb5c4faa45bea8b89402843e645b6b9269e2bd988ddacb033328ffb060450f7df080053e6969b251e875ecec32cfc592840d69ab69a75e06b379c535d95266b082f4f09c93162b33b0d9f7307a4eaaa52104437fed66f8ee3eabbd45d67b25a8133f496468b52baffdbfad93eef1a9818b5e42ec722788a3d8d3529fc777d2ba570801dfae01ec88302837c1fb9e0355727645ee1046c3f915f6ae82dad4fb6b0356a46518ffc834155c3b4fe6dafa6cc8a5ccf53c73a0849d8d44f7dcf72754e70e1b7dfb447bb4ef49d1a718f6171bbce200950e0ce926106b151a3e871d5ce49731bd6650a9b0ca972da1c5f136d44820ea6383c08f3b384cf2338e789c513f618cc5694a6f0cee104511e1ed7c5f23a1ebfd8a0db8424553240156dbf622831b0c643d1c551b6f3f7a98d29b85c2de05a65fa615eee16495bd90737672115b53e91c5d90028cf3f1a93953a153de53b44084e9ccff6b736693926daefebb2d77aa5ad689b92f31686669df16d1715cc58f7a2cfb72dd1a51e92f825993a74022be7e9eb6054654457094d14928f20215e7b222ac56b51adbec8d8bdb6983979a7e3a21b44b5d1518ca97d0b5195f51ed6a24350c89747e1edea51b448e3e9147054ce927873c90db394d86888e07dff177593d6f79e152302204aeb03be2386af3e24078bd028b1689f5e147c9f452c8ceb02ec59cc9db63a03576ceeafe98239023897da0236630a53c0de7f435a19869792fab36e7b9e635760f09069e6432e700035ac2a02879fff0a1e1bec522047193d94eb5df1efd53eea1144ca78940852f5ec9727904b366ede4f5e2d331fad5fc282ea2c47e923142771c3dd75a87357487def99e5f18e9d9ed623c175d02888c51f82c07a80d54716b3c3c2bdbe2e9f0a9bbaaebeb4d52936876406f5c00e8e4bbd0a5ec05797e6207c5ab6c88f1a688421bd05a114f4d7de2ac241fa0e8bedff47f762ddcbeaa91004f8d31e85095c81054994ad3826e344ba96040810fc0b2ad1de48cfade002c62e5a49a0731ab38344bc1636df16bf607d56855e56d684003c718e4bad9e5a099979fcddeeb1c4a7776cd37a3417cb0e184e29ef9bc0e87475ba663be09e00ab562eb7c0f7165f969a9b42414198ccf1bff2a2c8d689a414ece7662927665689e94db961ebaec5615cbc1a7895c6851ac961432ff1118d4607d32ef9dc732d51333be4b4d0e30ddea784eca8be47e741be9c19631dc470a52ef4dc13a4f3633fd434d787c170977b417df598e1d0dde506bb71d6f0bc17ec70e3b03cdc1965cb36993f633b0472e50d0923ac6c66fdf1d3e6459cc121f0f5f94d09e9dbcf5d690e23233838a0bacb7c638d1b2650a4308cd171b6855126d1da672a6ed85a8d78c286fb56f4ab3d21497528045c63262c8a42af2f9802c53b7bb8be28e78fe0b5ce45fbb7a1af1a3b28a8d94b7890e3c882e39bc98e9f0ad76025bf0dd2f00298e7141a226b3d7cee414f604d1e0ba54d11d5fe58bccea6ad77ad2e8c1caacf32459014b7b91001b1efa8ad172a523fb8e365b577121bf9fd88a2c60c21e821d7b6acb47a5a995e40caced5c223b8fe6de5e18e9d2e5893aefebb7aae7ff1a146260e2f110e939528213a0025a38ec79aabc861b25ebc509a4674c132aaacb7e0146f14efd11cfcaf4caa4f775a716ce325e0a435a4d349d720bcf137450afc45046fc1a1f83a9d329777a7084e4aadae7122ce97005930528eb3c7f7f1129b372887a371155a3ba201a25cbf1dcb64e7cdee092c3141fb5550fe3d0dd82e870e578b2b46500818113b8f6569773c677385b69a42b77dcba7acffd95fd4452e23aaa1d37e1da2151ea658d40a3596b27ac9f8129dc6cf0643772624b59f4f461230df471ca26087c3942d5c6687df6082835935a3f87cb762b0c3b1d0dda4a6533965bef1b7b8292e254c014d090fed857c44c1839c694c0a64e3fad90a11f534722b6ee1574f2e149d55d744de4887024e08511431c062750e16c74ab9f3242f2db3ffb12a8d6107faa229d6f6373b07f36d3932b3bdb04c19dd64eadd7f93c3c564c358a1c81dcf1c9c31e5b06568f97544c17dc15698c5cb38983a9afc42783faa773a52c9d8260690be9e3156aa5bc1509dea3f69587695cd6ff172ba83e6a6d8a7d6bbebbbcda3672731983f89bc5831dc37c3f3c5c56facc697f3cb20bd5dbadbd702e54844ac2f626901fe159db93dfd4773d8fe73562b846c1fc856d1802762840ebc72d7988bde75cbca70d319d32ce0cc0253bb2ad455723ee0c7f4736ce6e6665c5aca32a481c53839bc259167b013d0423395eeb9aaaee3206149a7d550d67fc5fdfe4a8a5c35d2510b664379ab8f72855a2af47abce2a632048eaf89e5cb4a88debc53a595103acce4f1cff18acff07afe1eb5716aa1e40b63134c3a3ae9579fa87f515be093c2d29db6d6b65c93661e00636b592704d093cc6716c2342eb1853d48c85c63ac8a2854462c7b77e7e3bd1eac5bca28ffaa00b5d349f8a547ad875b96a8c2b2910c9301309a3f9138a5693111f55b3c009ca947c39dfc82d98eb1caa4a9cbe885f786fa86e55be062222f8ba90a974073326b31212aece0a34a60
-Bits = 20736
-RawPublic = 9792bcec2f2430686a82fccf3c2f5ff665e771d7ab41b90258cfa7e90ec97124a73b323b9ba21ab64d767c433f5a521effe18f86e46a188952c4467e048b729e7fc4d115e7e48da1896d5fe119b10dcddef62cb307954074b42336e52836de61da941f8d37ea68ac8106fabe19070679af6008537120f70793b8ea9cc0e6e7b7b4c9a5c7421c60f24451ba1e933db1a2ee16c79559f21b3d1b8305850aa42afbb13f1f4d5b9f4835f9d87dfceb162d0ef4a7fdc4cba1743cd1c87bb4967da16cc8764b6569df8ee5bdcbffe9a4e05748e6fdf225af9e4eeb7773b62e8f85f9b56b548945551844fbd89806a4ac369bed2d256100f688a6ad5e0a709826dc4449e91e23c5506e642361ef5a313712f79bc4b3186861ca85a4bab17e7f943d1b8a333aa3ae7ce16b440d6018f9e04daf5725c7f1a93fad1a5a27b67895bd249aa91685de20af32c8b7e268c7f96877d0c85001135a4f0a8f1b8264fa6ebe5a349d8aecad1a16299ccf2fd9c7b85bace2ced3aa1276ba61ee78ed7e5ca5b67cdd458a9354030e6abbbabf56a0a2316fec9dba83b51d42fd3167f1e0f90855d5c66509b210265dc1e54ec44b43ba7cf9aef118b44d80912ce75166a6651e116cebe49229a7062c09931f71abd2293f76f7efc3215ba97800037e58e470bdbbb43c1b0439eaf79c54d93b44aac9efe9fbe151874cfb2a64cbee28cc4c0fe7775e5d870f1c02e5b2e3c5004c995f24c9b779cb753a277d0e71fd425eb6bc2ca56ce129db51f70740f31e63976b50c7312e9797d78c5b1ac24a5fa347cc916e0a83f5c3b675cd30b81e3fa10b93444e07397571cce98b28da51db9056bc728c5b0b1181e2fbd387b4c79ab1a5fefece37167af772ddad14eb4c3982da5a59d0e9eb173ec6315091170027a3ab5ef6aa129cb8585727b9358a28501d713a72f3f1db31714286f9b6408013af06045d75592fc0b7dd47c73ed9c75b11e9d7c69f7cadfc3280a9062c5273c43be1c34f87448864cea7b5c97d6d32f59bd5f25384653bb5c4faa45bea8b89402843e645b6b9269e2bd988ddacb033328ffb060450f7df080053e6969b251e875ecec32cfc592840d69ab69a75e06b379c535d95266b082f4f09c93162b33b0d9f7307a4eaaa52104437fed66f8ee3eabbd45d67b25a8133f496468b52baffdbfad93eef1a9818b5e42ec722788a3d8d3529fc777d2ba570801dfae01ec88302837c1fb9e0355727645ee1046c3f915f6ae82dad4fb6b0356a46518ffc834155c3b4fe6dafa6cc8a5ccf53c73a0849d8d44f7dcf72754e70e1b7dfb447bb4ef49d1a718f6171bbce200950e0ce926106b151a3e871d5ce49731bd6650a9b0ca972da1c5f136d44820ea6383c08f3b384cf2338e789c513f618cc5694a6f0cee104511e1ed7c5f23a1ebfd8a0db8424553240156dbf622831b0c643d1c551b6f3f7a98d29b85c2de05a65fa615eee16495bd90737672115b53e91c5d90028cf3f1a93953a153de53b44084e9ccff6b736693926daefebb2d77aa5ad689b92f31686669df16d1715cc58f7a2cfb72dd1a51e92f825993a74022be7e9eb6054654457094d14928f20215e7b222ac56b51adbec8d8bdb6983979a7e3a21b44b5d1518ca97d0b5195f51ed6a24350c89747e1edea51b448e3e9147054ce927873c90db394d86888e07dff177593d6f79e152302204aeb03be2386af3e24078bd028b1689f5e147c9f452c8ceb02ec59cc9db63a03576ceeafe98239023897da0236630a53c0de7f435a19869792fab36e7b9e635760f09069e6432e700035ac2a02879fff0a1e1bec522047193d94eb5df1efd53eea1144ca78940852f5ec9727904b366ede4f5e2d331fad5fc282ea2c47e923142771c3dd75a87357487def99e5f18e9d9ed623c175d02888c51f82c07a80d54716b3c3c2bdbe2e9f0a9bbaaebeb4d52936876406f5c00e8e4bbd0a5ec05797e6207c5ab6c88f1a688421bd05a114f4d7de2ac241fa0e8bedff47f762ddcbeaa91004f8d31e85095c81054994ad3826e344ba96040810fc0b2ad1de48cfade002c62e5a49a0731ab38344bc1636df16bf607d56855e56d684003c718e4bad9e5a099979fcddeeb1c4a7776cd37a3417cb0e184e29ef9bc0e87475ba663be09e00ab562eb7c0f7165f969a9b42414198ccf1bff2a2c8d689a414ece7662927665689e94db961ebaec5615cbc1a7895c6851ac961432ff1118d4607d32ef9dc732d51333be4b4d0e30ddea784eca8be47e741be9c19631dc470a52ef4dc13a4f3633fd434d787c170977b417df598e1d0dde506bb71d6f0bc17ec70e3b03cdc1965cb36993f633b0472e50d0923ac6c66fdf1d3e6459cc121f0f5f94d09e9dbcf5d690e23233838a0bacb7c638d1b2650a4308cd171b6855126d1da672a6ed85a8d78c286fb56f4ab3d21497528045c63262c8a42af2f9802c53b7bb8be28e78fe0b5ce45fbb7a1af1a3b28a8d94b7890e3c882e39bc98e9f0ad76025bf0dd2f00298e7141a226b3d7cee414f604d1e0ba54d11d5fe58bccea6ad77ad2e8c1caacf32459014b7b91001b1efa8ad172a523fb8e365b577121bf9fd88a2c60c21e821d7b6acb47a5a995e40caced5c223b8fe6de5e18e9d2e5893aefebb7aae7ff1a146260e2f110e939528213a0025a38ec79aabc861b25ebc509a4674c132aaacb7e0146f14efd11cfcaf4caa4f775a716ce325e0a435a4d349d720bcf137450afc45046fc1a1f83a9d329777a7084e4aadae7122ce97005930528eb3c7f7f1129b372887a371155a3ba201a25cbf1dcb64e7cdee092c3141fb5550fe3d0dd82e870e578b2b46500818113b8f6569773c677385b69a42b77dcba7acffd95fd4452e23aaa1d37e1da2151ea658d40a3596b27ac9f8129dc6cf0643772624b59f4f461230df471ca26087c3942d5c6687df6082835935a3f87cb762b0c3b1d0dda4a6533965bef1b7b8292e254c014d090fed857c44c1839c694c0a64e3fad90a11f534722b6ee1574f2e149d55d744de4887024e08511431c062750e16c74ab9f3242f2db3ffb12a8d6107faa229d6f6373b07f36d3932b3bdb04c19dd64eadd7f93c3c564c358a1c81dcf1c9c31e5b06568f97544c17dc15698c5cb38983a9afc42783faa773a52c9d8260690be9e3156aa5bc1509dea3f69587695cd6ff172ba83e6a6d8a7d6bbebbbcda3672731983f89bc5831dc37c3f3c5c56facc697f3cb20bd5dbadbd702e54844ac2f626901fe159db93dfd4773d8fe73562b846c1fc856d1802762840ebc72d7988bde75cbca70d319d32ce0cc0253bb2ad455723ee0c7f4736ce6e6665c5aca32a481c53839bc259167b013d0423395eeb9aaaee3206149a7d550d67fc5fdfe4a8a5c35d2510b664379ab8f72855a2af47abce2a632048eaf89e5cb4a88debc53a595103acce4f1cff18acff07afe1eb5716aa1e40b63134c3a3ae9579fa87f515be093c2d29db6d6b65c93661e00636b592704d093cc6716c2342eb1853d48c85c63ac8a2854462c7b77e7e3bd1eac5bca28ffaa00b5d349f8a547ad875b96a8c2b2910c9301309a3f9138a5693111f55b3c009ca947c39dfc82d98eb1caa4a9cbe885f786fa86e55be062222f8ba90a974073326b31212aece0a34a60
-
 
 # Some test vectors from Wycheproof, to test the EVP API.
 #
 # TODO(crbug.com/42290453): Once we've caught up with Wycheproof, consider
 # moving Wycheproof tests to the EVP layer and replacing these.
 
-PublicKey = ML-DSA-44-Public
+Key = ML-DSA-44-Wycheproof
 Algorithm = ML-DSA-44
-Input = 30820532300b06096086480165030403110382052100db9ac67708f2ba0fac1f92bd802f9be89ecab966feef59872a1a9ac90b1111170a561290ae86b13968f2506023c014ba09fa449a26e4e9d35595e73986506cc8790e4d07a94d6c736f7ae78cc5e3e3cf025ce06a09252bef97fe92e94cbd107b1844d1a7c690d88bff9e9336f8f58e0bd5ee384de9c7ffbb149a6fcd87c77288601d8843e28e0c7a60149d02ebc57b183c39888d98b61cd8ad48135ddb8a1666743bb689f44c1a92d52017b6a8fa493eeb839dffb086a9a6c399b194a52f0e4164c96ff8a2a54337de24350a866b5fe4195257778e72511221778f1eae5fa93ed3532f696b9b0767aded85f62ea311027c7f5fc4182dcd2864b1c26bd6dcf72ebdedf70471327be0ea1c2ae53e46489c6dbefa512a78fdd7be0ad3ada16a7f7b1ece49817b44868a2cc234bfdba556c32cc92ec2c5e8a5d206f2e4ee372d41681e67d1b7e7b0061870c57f600fafca85f98aed8ce4ba76bba961f9ed56e563220d3ced853b6b28e7527da0e0912bc932a23c8bab811429bbb4d49b2770bcda44abb932b11c0a5866409fce39fed2b459c86c8f6e1ab0aefc5879503f4b21a49b4b2de6760c9b6aaf041144a656a26af39f4578e1d482ddc1360ef751d9784b860ec373d415360fe99f32e126a2ac1243430e8bed1bc90b19b3d219c2712edcf81c44b4331f6421088e662b695e1fd8fa5091f616ab60af70f159b63368f1ac60d77b279ed47ef7f24ec2044bb6c2bc76d933ecd568f7e663392afc1d335abac6c03670adf87747dde90052f5cd45f7d30f43a4dc3c500ceb658fce235c171240baca1b5a14733d774b9416c540f53eb83481afc98344b12a4309e6222b08d978430467497010314c6f6b8caf65361c216106395275a67d7500dbc120f7918c6f8db7aa63fa965b4a22c70dc88f727d768ce2bfc7597fd470184e1c59a6b2e1204cc8c3d052c594d5771e0ccc8cfb191f47038b1c0672f07caf4747562d3d76a9816fb1def1391cf0f05fcdbf2a0eb6c21ac24b26e74ee403133e80a79313ddb02c1fa386c6dd1d420195343e3a104aff6d60887f7304fa9e3bb59bb55f820dd85b1445c54e9a38dc1c7f3b88eb36a9f48d13455e51c934825ff3cd8bedb2b5422344120399eef83a360b83440ebdd8ea6e01c95159e3735bb4408500caa785ca4049891c7331c4ea31ad9060ece768fd339e6904f88e27bad3b28845687be2cc9314f300fda56fe3ff2508e54c59123b068f86fe00213d5af8da1b1735423ed688f097c306dbc121b81f532fcaf872d9f80596642295d6e4bead478644081618ab903b39e9b5e7cc0b5f2742d8337b18d4ad4788db7443e946cafc1762a5da84070e8c2fd86d6c633f0b44ee234ba11b9e1440c94a08d0437015279690405353059020fd2f58f15dab18754177244adfb81ceab79c7840bf3884a3d364afc8c453a425fd8c5378eaa7445f8c6256bfbd03a66c53e8cf27e2c52f14ef3294afe79cda408f5dff933ca0211a78a4e3be3d9a932558ed71ed19bbb57f87937fa3d4a78128491ff096a261045bdd186325c42caa8c7564195a4d2499a1c17d21a52d1aacd221d9c8a1866963a20390f2fd43dcf56b308a1c01c38091fd3e04c12b695de497d48bcc268d50cb0bed793b8e6937e8d533afd568521f1c9377a3804d38e785674d7ce868d289938e33dda6edc76d25b15fcb38852b7803cfe62f08d9fbd070957c4e6f134973964c9dc009985c8501e7d8f72e7ec285d5289fdd07f64d62acaa9737b039efa7a9d1d175577c6bcf9dddcf692877af38e75263bebe2453155be61f0723c274388a532abe29dd7023e327085f4c9dda41839b7b3357ab9d
-RawPublic = db9ac67708f2ba0fac1f92bd802f9be89ecab966feef59872a1a9ac90b1111170a561290ae86b13968f2506023c014ba09fa449a26e4e9d35595e73986506cc8790e4d07a94d6c736f7ae78cc5e3e3cf025ce06a09252bef97fe92e94cbd107b1844d1a7c690d88bff9e9336f8f58e0bd5ee384de9c7ffbb149a6fcd87c77288601d8843e28e0c7a60149d02ebc57b183c39888d98b61cd8ad48135ddb8a1666743bb689f44c1a92d52017b6a8fa493eeb839dffb086a9a6c399b194a52f0e4164c96ff8a2a54337de24350a866b5fe4195257778e72511221778f1eae5fa93ed3532f696b9b0767aded85f62ea311027c7f5fc4182dcd2864b1c26bd6dcf72ebdedf70471327be0ea1c2ae53e46489c6dbefa512a78fdd7be0ad3ada16a7f7b1ece49817b44868a2cc234bfdba556c32cc92ec2c5e8a5d206f2e4ee372d41681e67d1b7e7b0061870c57f600fafca85f98aed8ce4ba76bba961f9ed56e563220d3ced853b6b28e7527da0e0912bc932a23c8bab811429bbb4d49b2770bcda44abb932b11c0a5866409fce39fed2b459c86c8f6e1ab0aefc5879503f4b21a49b4b2de6760c9b6aaf041144a656a26af39f4578e1d482ddc1360ef751d9784b860ec373d415360fe99f32e126a2ac1243430e8bed1bc90b19b3d219c2712edcf81c44b4331f6421088e662b695e1fd8fa5091f616ab60af70f159b63368f1ac60d77b279ed47ef7f24ec2044bb6c2bc76d933ecd568f7e663392afc1d335abac6c03670adf87747dde90052f5cd45f7d30f43a4dc3c500ceb658fce235c171240baca1b5a14733d774b9416c540f53eb83481afc98344b12a4309e6222b08d978430467497010314c6f6b8caf65361c216106395275a67d7500dbc120f7918c6f8db7aa63fa965b4a22c70dc88f727d768ce2bfc7597fd470184e1c59a6b2e1204cc8c3d052c594d5771e0ccc8cfb191f47038b1c0672f07caf4747562d3d76a9816fb1def1391cf0f05fcdbf2a0eb6c21ac24b26e74ee403133e80a79313ddb02c1fa386c6dd1d420195343e3a104aff6d60887f7304fa9e3bb59bb55f820dd85b1445c54e9a38dc1c7f3b88eb36a9f48d13455e51c934825ff3cd8bedb2b5422344120399eef83a360b83440ebdd8ea6e01c95159e3735bb4408500caa785ca4049891c7331c4ea31ad9060ece768fd339e6904f88e27bad3b28845687be2cc9314f300fda56fe3ff2508e54c59123b068f86fe00213d5af8da1b1735423ed688f097c306dbc121b81f532fcaf872d9f80596642295d6e4bead478644081618ab903b39e9b5e7cc0b5f2742d8337b18d4ad4788db7443e946cafc1762a5da84070e8c2fd86d6c633f0b44ee234ba11b9e1440c94a08d0437015279690405353059020fd2f58f15dab18754177244adfb81ceab79c7840bf3884a3d364afc8c453a425fd8c5378eaa7445f8c6256bfbd03a66c53e8cf27e2c52f14ef3294afe79cda408f5dff933ca0211a78a4e3be3d9a932558ed71ed19bbb57f87937fa3d4a78128491ff096a261045bdd186325c42caa8c7564195a4d2499a1c17d21a52d1aacd221d9c8a1866963a20390f2fd43dcf56b308a1c01c38091fd3e04c12b695de497d48bcc268d50cb0bed793b8e6937e8d533afd568521f1c9377a3804d38e785674d7ce868d289938e33dda6edc76d25b15fcb38852b7803cfe62f08d9fbd070957c4e6f134973964c9dc009985c8501e7d8f72e7ec285d5289fdd07f64d62acaa9737b039efa7a9d1d175577c6bcf9dddcf692877af38e75263bebe2453155be61f0723c274388a532abe29dd7023e327085f4c9dda41839b7b3357ab9d
-
-PrivateKey = ML-DSA-44-Private
-Algorithm = ML-DSA-44
-Input = 3034020100300b0609608648016503040311042280202a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
+SPKI = 30820532300b06096086480165030403110382052100db9ac67708f2ba0fac1f92bd802f9be89ecab966feef59872a1a9ac90b1111170a561290ae86b13968f2506023c014ba09fa449a26e4e9d35595e73986506cc8790e4d07a94d6c736f7ae78cc5e3e3cf025ce06a09252bef97fe92e94cbd107b1844d1a7c690d88bff9e9336f8f58e0bd5ee384de9c7ffbb149a6fcd87c77288601d8843e28e0c7a60149d02ebc57b183c39888d98b61cd8ad48135ddb8a1666743bb689f44c1a92d52017b6a8fa493eeb839dffb086a9a6c399b194a52f0e4164c96ff8a2a54337de24350a866b5fe4195257778e72511221778f1eae5fa93ed3532f696b9b0767aded85f62ea311027c7f5fc4182dcd2864b1c26bd6dcf72ebdedf70471327be0ea1c2ae53e46489c6dbefa512a78fdd7be0ad3ada16a7f7b1ece49817b44868a2cc234bfdba556c32cc92ec2c5e8a5d206f2e4ee372d41681e67d1b7e7b0061870c57f600fafca85f98aed8ce4ba76bba961f9ed56e563220d3ced853b6b28e7527da0e0912bc932a23c8bab811429bbb4d49b2770bcda44abb932b11c0a5866409fce39fed2b459c86c8f6e1ab0aefc5879503f4b21a49b4b2de6760c9b6aaf041144a656a26af39f4578e1d482ddc1360ef751d9784b860ec373d415360fe99f32e126a2ac1243430e8bed1bc90b19b3d219c2712edcf81c44b4331f6421088e662b695e1fd8fa5091f616ab60af70f159b63368f1ac60d77b279ed47ef7f24ec2044bb6c2bc76d933ecd568f7e663392afc1d335abac6c03670adf87747dde90052f5cd45f7d30f43a4dc3c500ceb658fce235c171240baca1b5a14733d774b9416c540f53eb83481afc98344b12a4309e6222b08d978430467497010314c6f6b8caf65361c216106395275a67d7500dbc120f7918c6f8db7aa63fa965b4a22c70dc88f727d768ce2bfc7597fd470184e1c59a6b2e1204cc8c3d052c594d5771e0ccc8cfb191f47038b1c0672f07caf4747562d3d76a9816fb1def1391cf0f05fcdbf2a0eb6c21ac24b26e74ee403133e80a79313ddb02c1fa386c6dd1d420195343e3a104aff6d60887f7304fa9e3bb59bb55f820dd85b1445c54e9a38dc1c7f3b88eb36a9f48d13455e51c934825ff3cd8bedb2b5422344120399eef83a360b83440ebdd8ea6e01c95159e3735bb4408500caa785ca4049891c7331c4ea31ad9060ece768fd339e6904f88e27bad3b28845687be2cc9314f300fda56fe3ff2508e54c59123b068f86fe00213d5af8da1b1735423ed688f097c306dbc121b81f532fcaf872d9f80596642295d6e4bead478644081618ab903b39e9b5e7cc0b5f2742d8337b18d4ad4788db7443e946cafc1762a5da84070e8c2fd86d6c633f0b44ee234ba11b9e1440c94a08d0437015279690405353059020fd2f58f15dab18754177244adfb81ceab79c7840bf3884a3d364afc8c453a425fd8c5378eaa7445f8c6256bfbd03a66c53e8cf27e2c52f14ef3294afe79cda408f5dff933ca0211a78a4e3be3d9a932558ed71ed19bbb57f87937fa3d4a78128491ff096a261045bdd186325c42caa8c7564195a4d2499a1c17d21a52d1aacd221d9c8a1866963a20390f2fd43dcf56b308a1c01c38091fd3e04c12b695de497d48bcc268d50cb0bed793b8e6937e8d533afd568521f1c9377a3804d38e785674d7ce868d289938e33dda6edc76d25b15fcb38852b7803cfe62f08d9fbd070957c4e6f134973964c9dc009985c8501e7d8f72e7ec285d5289fdd07f64d62acaa9737b039efa7a9d1d175577c6bcf9dddcf692877af38e75263bebe2453155be61f0723c274388a532abe29dd7023e327085f4c9dda41839b7b3357ab9d
+PKCS8 = 3034020100300b0609608648016503040311042280202a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
 PrivateSeed = 2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
 RawPublic = db9ac67708f2ba0fac1f92bd802f9be89ecab966feef59872a1a9ac90b1111170a561290ae86b13968f2506023c014ba09fa449a26e4e9d35595e73986506cc8790e4d07a94d6c736f7ae78cc5e3e3cf025ce06a09252bef97fe92e94cbd107b1844d1a7c690d88bff9e9336f8f58e0bd5ee384de9c7ffbb149a6fcd87c77288601d8843e28e0c7a60149d02ebc57b183c39888d98b61cd8ad48135ddb8a1666743bb689f44c1a92d52017b6a8fa493eeb839dffb086a9a6c399b194a52f0e4164c96ff8a2a54337de24350a866b5fe4195257778e72511221778f1eae5fa93ed3532f696b9b0767aded85f62ea311027c7f5fc4182dcd2864b1c26bd6dcf72ebdedf70471327be0ea1c2ae53e46489c6dbefa512a78fdd7be0ad3ada16a7f7b1ece49817b44868a2cc234bfdba556c32cc92ec2c5e8a5d206f2e4ee372d41681e67d1b7e7b0061870c57f600fafca85f98aed8ce4ba76bba961f9ed56e563220d3ced853b6b28e7527da0e0912bc932a23c8bab811429bbb4d49b2770bcda44abb932b11c0a5866409fce39fed2b459c86c8f6e1ab0aefc5879503f4b21a49b4b2de6760c9b6aaf041144a656a26af39f4578e1d482ddc1360ef751d9784b860ec373d415360fe99f32e126a2ac1243430e8bed1bc90b19b3d219c2712edcf81c44b4331f6421088e662b695e1fd8fa5091f616ab60af70f159b63368f1ac60d77b279ed47ef7f24ec2044bb6c2bc76d933ecd568f7e663392afc1d335abac6c03670adf87747dde90052f5cd45f7d30f43a4dc3c500ceb658fce235c171240baca1b5a14733d774b9416c540f53eb83481afc98344b12a4309e6222b08d978430467497010314c6f6b8caf65361c216106395275a67d7500dbc120f7918c6f8db7aa63fa965b4a22c70dc88f727d768ce2bfc7597fd470184e1c59a6b2e1204cc8c3d052c594d5771e0ccc8cfb191f47038b1c0672f07caf4747562d3d76a9816fb1def1391cf0f05fcdbf2a0eb6c21ac24b26e74ee403133e80a79313ddb02c1fa386c6dd1d420195343e3a104aff6d60887f7304fa9e3bb59bb55f820dd85b1445c54e9a38dc1c7f3b88eb36a9f48d13455e51c934825ff3cd8bedb2b5422344120399eef83a360b83440ebdd8ea6e01c95159e3735bb4408500caa785ca4049891c7331c4ea31ad9060ece768fd339e6904f88e27bad3b28845687be2cc9314f300fda56fe3ff2508e54c59123b068f86fe00213d5af8da1b1735423ed688f097c306dbc121b81f532fcaf872d9f80596642295d6e4bead478644081618ab903b39e9b5e7cc0b5f2742d8337b18d4ad4788db7443e946cafc1762a5da84070e8c2fd86d6c633f0b44ee234ba11b9e1440c94a08d0437015279690405353059020fd2f58f15dab18754177244adfb81ceab79c7840bf3884a3d364afc8c453a425fd8c5378eaa7445f8c6256bfbd03a66c53e8cf27e2c52f14ef3294afe79cda408f5dff933ca0211a78a4e3be3d9a932558ed71ed19bbb57f87937fa3d4a78128491ff096a261045bdd186325c42caa8c7564195a4d2499a1c17d21a52d1aacd221d9c8a1866963a20390f2fd43dcf56b308a1c01c38091fd3e04c12b695de497d48bcc268d50cb0bed793b8e6937e8d533afd568521f1c9377a3804d38e785674d7ce868d289938e33dda6edc76d25b15fcb38852b7803cfe62f08d9fbd070957c4e6f134973964c9dc009985c8501e7d8f72e7ec285d5289fdd07f64d62acaa9737b039efa7a9d1d175577c6bcf9dddcf692877af38e75263bebe2453155be61f0723c274388a532abe29dd7023e327085f4c9dda41839b7b3357ab9d
 
-PublicKey = ML-DSA-65-Public
-Algorithm = ML-DSA-65
-Input = 308207b2300b0609608648016503040312038207a100f5408337d0fee65c28851226a5fa81b58464632c78e2a9bef70d330f2e3a5f74d9cf676aedd1067c91a5dd5d4edc46f868a93ffec9f44e254e44f682a153aeadf228e8db7c5fcfed30cc3408e261ab896876bee56660d2a7c1d7eac20c5754255206a178f7156295065ce7876f90c48f44bc37f3a00e32eefd3a4bb1e298fe283d106eaef92a33a594253a2a0790976a1d04636f8672d28c06c852ea8bb43b84bff512996e7616963d5b9a2906466a152c7ea9be178be35405683b44367af85d2daad87630c1e21ba5490154f0141780f5ed0407cb0b975dd56d5930f9b26413b843b83f3693304b0038bd3e4bb398868060ea18c9c67099376470a50deb052e4056743fbcdf0341b192663bd1c21ba3b3d5666e0d0e29c4e1ed0759ab0bd9d1d355011b94e0ff0c049b03ddb7138640667144fcacd7265f55a07e5387f1abd30c037cf14d436aa855f827049215440d8007f61460500d943f57ffb6bfee6fedd2fcec52882d7d8da1aab29e892c8beac3df3234b4a7d2eca3a45c6623c52bbdd07c1c94314b706988a52029f8f8b06e874b741d72926652c78c6ace2cfd8864eadb2e4b39cafe6e03e4edbafa2747db9bc42f92af8b031e3e380846b1bfd15ade88c285d6a6fffe91eafc8b17de6cbc68575f323cc09fc20e49e8efd76f9568bec486b78df4245428d8d0d5f53873e11de65fda4c770b521a8c67f5c51d48cc26358954514447881fd9a42e5891dac7e1db5249d7861b322111e5fb929bee9ff5e9d5a2667ba93e63fc03040d2e82648f89e89dec1d1d2dfb9efeceb7940f7dcbebeb5a239cc1c54d8f7d52cba220d0634e15df46a58280bc5a48840bd39274cfde150f9ad9a40f6398d715350925f0e0501944409f32331a362bdaaafb3d8ce71c964332d6afb7e684f99951246d88081c86744ae68133f22c53a4b5ae258f230a98491d2d43a79a6d0f4d54a3b62013965ac7c82d0507125a38a0277f81cbc1d46cef2a131c6f51b88ec0baae0c82a6a0e72831cb06f9116cff5111d597e01057d32805a008f52c9aec3311139bfb35982789ff83bdd0c31e9f1080e8ed8eb99fde66bafb29e3357389fe3785b60c78e229ef073e1b65e34d848bd4d8a4f251551e2d38d2546afbc205d3c6dab34d2b962b1afb44f1d22fc10c6744fcd6b636afd3cb414b16c2e0d708fe9f51ff19120bde693b028b6d1e6dbe37b4b8b3bc7c6f7a842701603869d3ded572500f085502efc8d3cc62b30e5cdbcb5e86d9c0d42973bf755df539cc0aea58f9148386db67bd2bf70cd12ccd96d5c66fb271416b772465228dc44b079178f9b766370b66a79b871faca246ca6f8f63be9f0668297ac446cad5cf4a83318b1b00ecbd283f0eecee60a9a37a27abdbdbe382e307970002837dfc0bd3934ebd008918fd4bd383c02c9d37f694996e989a49075767ebc4a2981ef5275455e026cb0bd70946cdd1fadaf251381d324f9efbb860d1b280c29685bab97d010676273b45cca12ac3966aae342c84e2357eccf252577743b8787967b40b07ef2d3d9e6c1a3bcb059cba0fdb7f0d4f815c242b8e14acd3375e608e9230ba3cf8718f43882a3e1e661a2bbe81830d34741f33473e263b3790abe67acf29f5df44865b2ffbc96975fd62738a64112deda5a2534fb0a23b3b3024df986391badf9041c593c313a7ca1e1fcffcb65b07b9a99337b4a4acf616cbe1553eb9541f38aa6247342905995233a28172ca13396b2a9662970120f82b92a213f43de7a232ccca3268265c9ce042d50915430a6c455f32277da42f9962fb9163b623231ebc080fa7b8e9f9021fcf85b98f9c483e4d2226b9326a5bcb2e7449ef029ae142d3a0f0c28bd4f7e9c51a12e1336f24dfacbc3f808a8f7dd683027bc948763b808fb0037394b8b41bc9b2ec7887e67584e03d11b15ca203b2bcb43f8881638c4e4eee7f846d09c7f89b7739df22b2c3acc235032ba8f7ae27b5b9d25733143e80a4cdde6770719c1e66ec2ce683612233e88fafff84c0745a98aa1254c8219c6c556348c2b5d1beeb61532d6bf7bde153271dc647460beb65fe0055b33fd6480dcbb9d7d471952cfa5be260c39721a8c5c89b9e966ae2dc9036451ec9f2c49433b2225e13f23e20c2bfba81a7b3a555883449238f7d48213e9f10ce19e76f1bdcfc73ee5524bd7d8be0a4b46784e238233c04fb99383ec7726f9717e1179dd14fba9ad6c2ebd1699f0ab0e57e6cad23875b029e89cfda06f51266ecd2eed4edafb51e82f2a506d57ba74da611774ca5fa2fff4a976519de425885e7d09219cf815b1767d4fc5a72c18918991a285086a6a766614a4d245387da50f28dd778fb33ab88c0918feba3768c55bb1f07aec33cfeed33d6faa4d34fd7227b365533c1e67dbc89f0b20195cf1cbd480d333ade1c9bb28308085b72ced430268c1492a27050c43668adc9cf8b8509447cfcd3c8f8d8eb554f704101786aa9ebca86991d250776a37a1f56fbf7d08e591f978da49c3870625879f70e2418aec5cba32fa8c346fa9038baebc35ad0068a4d03537aee14c2e71570a87490377fa8dd66f995aa044a522f0c7025a7ab2dd5ad30a64268dc112b7f9fa156df64d631f55f1d6edc55cec570a9c7372e29e02c8d4867bae249431dcf6ed2794a0183f0f7501201feca4a81d334c642fc8d38e9a90fa77429665e09e214797dfa455ff47c4f219d3a2cb0176bc2236455123c1c5da714ad29d580fb194f87173a18dc
-RawPublic = f5408337d0fee65c28851226a5fa81b58464632c78e2a9bef70d330f2e3a5f74d9cf676aedd1067c91a5dd5d4edc46f868a93ffec9f44e254e44f682a153aeadf228e8db7c5fcfed30cc3408e261ab896876bee56660d2a7c1d7eac20c5754255206a178f7156295065ce7876f90c48f44bc37f3a00e32eefd3a4bb1e298fe283d106eaef92a33a594253a2a0790976a1d04636f8672d28c06c852ea8bb43b84bff512996e7616963d5b9a2906466a152c7ea9be178be35405683b44367af85d2daad87630c1e21ba5490154f0141780f5ed0407cb0b975dd56d5930f9b26413b843b83f3693304b0038bd3e4bb398868060ea18c9c67099376470a50deb052e4056743fbcdf0341b192663bd1c21ba3b3d5666e0d0e29c4e1ed0759ab0bd9d1d355011b94e0ff0c049b03ddb7138640667144fcacd7265f55a07e5387f1abd30c037cf14d436aa855f827049215440d8007f61460500d943f57ffb6bfee6fedd2fcec52882d7d8da1aab29e892c8beac3df3234b4a7d2eca3a45c6623c52bbdd07c1c94314b706988a52029f8f8b06e874b741d72926652c78c6ace2cfd8864eadb2e4b39cafe6e03e4edbafa2747db9bc42f92af8b031e3e380846b1bfd15ade88c285d6a6fffe91eafc8b17de6cbc68575f323cc09fc20e49e8efd76f9568bec486b78df4245428d8d0d5f53873e11de65fda4c770b521a8c67f5c51d48cc26358954514447881fd9a42e5891dac7e1db5249d7861b322111e5fb929bee9ff5e9d5a2667ba93e63fc03040d2e82648f89e89dec1d1d2dfb9efeceb7940f7dcbebeb5a239cc1c54d8f7d52cba220d0634e15df46a58280bc5a48840bd39274cfde150f9ad9a40f6398d715350925f0e0501944409f32331a362bdaaafb3d8ce71c964332d6afb7e684f99951246d88081c86744ae68133f22c53a4b5ae258f230a98491d2d43a79a6d0f4d54a3b62013965ac7c82d0507125a38a0277f81cbc1d46cef2a131c6f51b88ec0baae0c82a6a0e72831cb06f9116cff5111d597e01057d32805a008f52c9aec3311139bfb35982789ff83bdd0c31e9f1080e8ed8eb99fde66bafb29e3357389fe3785b60c78e229ef073e1b65e34d848bd4d8a4f251551e2d38d2546afbc205d3c6dab34d2b962b1afb44f1d22fc10c6744fcd6b636afd3cb414b16c2e0d708fe9f51ff19120bde693b028b6d1e6dbe37b4b8b3bc7c6f7a842701603869d3ded572500f085502efc8d3cc62b30e5cdbcb5e86d9c0d42973bf755df539cc0aea58f9148386db67bd2bf70cd12ccd96d5c66fb271416b772465228dc44b079178f9b766370b66a79b871faca246ca6f8f63be9f0668297ac446cad5cf4a83318b1b00ecbd283f0eecee60a9a37a27abdbdbe382e307970002837dfc0bd3934ebd008918fd4bd383c02c9d37f694996e989a49075767ebc4a2981ef5275455e026cb0bd70946cdd1fadaf251381d324f9efbb860d1b280c29685bab97d010676273b45cca12ac3966aae342c84e2357eccf252577743b8787967b40b07ef2d3d9e6c1a3bcb059cba0fdb7f0d4f815c242b8e14acd3375e608e9230ba3cf8718f43882a3e1e661a2bbe81830d34741f33473e263b3790abe67acf29f5df44865b2ffbc96975fd62738a64112deda5a2534fb0a23b3b3024df986391badf9041c593c313a7ca1e1fcffcb65b07b9a99337b4a4acf616cbe1553eb9541f38aa6247342905995233a28172ca13396b2a9662970120f82b92a213f43de7a232ccca3268265c9ce042d50915430a6c455f32277da42f9962fb9163b623231ebc080fa7b8e9f9021fcf85b98f9c483e4d2226b9326a5bcb2e7449ef029ae142d3a0f0c28bd4f7e9c51a12e1336f24dfacbc3f808a8f7dd683027bc948763b808fb0037394b8b41bc9b2ec7887e67584e03d11b15ca203b2bcb43f8881638c4e4eee7f846d09c7f89b7739df22b2c3acc235032ba8f7ae27b5b9d25733143e80a4cdde6770719c1e66ec2ce683612233e88fafff84c0745a98aa1254c8219c6c556348c2b5d1beeb61532d6bf7bde153271dc647460beb65fe0055b33fd6480dcbb9d7d471952cfa5be260c39721a8c5c89b9e966ae2dc9036451ec9f2c49433b2225e13f23e20c2bfba81a7b3a555883449238f7d48213e9f10ce19e76f1bdcfc73ee5524bd7d8be0a4b46784e238233c04fb99383ec7726f9717e1179dd14fba9ad6c2ebd1699f0ab0e57e6cad23875b029e89cfda06f51266ecd2eed4edafb51e82f2a506d57ba74da611774ca5fa2fff4a976519de425885e7d09219cf815b1767d4fc5a72c18918991a285086a6a766614a4d245387da50f28dd778fb33ab88c0918feba3768c55bb1f07aec33cfeed33d6faa4d34fd7227b365533c1e67dbc89f0b20195cf1cbd480d333ade1c9bb28308085b72ced430268c1492a27050c43668adc9cf8b8509447cfcd3c8f8d8eb554f704101786aa9ebca86991d250776a37a1f56fbf7d08e591f978da49c3870625879f70e2418aec5cba32fa8c346fa9038baebc35ad0068a4d03537aee14c2e71570a87490377fa8dd66f995aa044a522f0c7025a7ab2dd5ad30a64268dc112b7f9fa156df64d631f55f1d6edc55cec570a9c7372e29e02c8d4867bae249431dcf6ed2794a0183f0f7501201feca4a81d334c642fc8d38e9a90fa77429665e09e214797dfa455ff47c4f219d3a2cb0176bc2236455123c1c5da714ad29d580fb194f87173a18dc
-
-PrivateKey = ML-DSA-65-Private
+Key = ML-DSA-65-Wycheproof
 Algorithm = ML-DSA-65
-Input = 3034020100300b0609608648016503040312042280202a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
+SPKI = 308207b2300b0609608648016503040312038207a100f5408337d0fee65c28851226a5fa81b58464632c78e2a9bef70d330f2e3a5f74d9cf676aedd1067c91a5dd5d4edc46f868a93ffec9f44e254e44f682a153aeadf228e8db7c5fcfed30cc3408e261ab896876bee56660d2a7c1d7eac20c5754255206a178f7156295065ce7876f90c48f44bc37f3a00e32eefd3a4bb1e298fe283d106eaef92a33a594253a2a0790976a1d04636f8672d28c06c852ea8bb43b84bff512996e7616963d5b9a2906466a152c7ea9be178be35405683b44367af85d2daad87630c1e21ba5490154f0141780f5ed0407cb0b975dd56d5930f9b26413b843b83f3693304b0038bd3e4bb398868060ea18c9c67099376470a50deb052e4056743fbcdf0341b192663bd1c21ba3b3d5666e0d0e29c4e1ed0759ab0bd9d1d355011b94e0ff0c049b03ddb7138640667144fcacd7265f55a07e5387f1abd30c037cf14d436aa855f827049215440d8007f61460500d943f57ffb6bfee6fedd2fcec52882d7d8da1aab29e892c8beac3df3234b4a7d2eca3a45c6623c52bbdd07c1c94314b706988a52029f8f8b06e874b741d72926652c78c6ace2cfd8864eadb2e4b39cafe6e03e4edbafa2747db9bc42f92af8b031e3e380846b1bfd15ade88c285d6a6fffe91eafc8b17de6cbc68575f323cc09fc20e49e8efd76f9568bec486b78df4245428d8d0d5f53873e11de65fda4c770b521a8c67f5c51d48cc26358954514447881fd9a42e5891dac7e1db5249d7861b322111e5fb929bee9ff5e9d5a2667ba93e63fc03040d2e82648f89e89dec1d1d2dfb9efeceb7940f7dcbebeb5a239cc1c54d8f7d52cba220d0634e15df46a58280bc5a48840bd39274cfde150f9ad9a40f6398d715350925f0e0501944409f32331a362bdaaafb3d8ce71c964332d6afb7e684f99951246d88081c86744ae68133f22c53a4b5ae258f230a98491d2d43a79a6d0f4d54a3b62013965ac7c82d0507125a38a0277f81cbc1d46cef2a131c6f51b88ec0baae0c82a6a0e72831cb06f9116cff5111d597e01057d32805a008f52c9aec3311139bfb35982789ff83bdd0c31e9f1080e8ed8eb99fde66bafb29e3357389fe3785b60c78e229ef073e1b65e34d848bd4d8a4f251551e2d38d2546afbc205d3c6dab34d2b962b1afb44f1d22fc10c6744fcd6b636afd3cb414b16c2e0d708fe9f51ff19120bde693b028b6d1e6dbe37b4b8b3bc7c6f7a842701603869d3ded572500f085502efc8d3cc62b30e5cdbcb5e86d9c0d42973bf755df539cc0aea58f9148386db67bd2bf70cd12ccd96d5c66fb271416b772465228dc44b079178f9b766370b66a79b871faca246ca6f8f63be9f0668297ac446cad5cf4a83318b1b00ecbd283f0eecee60a9a37a27abdbdbe382e307970002837dfc0bd3934ebd008918fd4bd383c02c9d37f694996e989a49075767ebc4a2981ef5275455e026cb0bd70946cdd1fadaf251381d324f9efbb860d1b280c29685bab97d010676273b45cca12ac3966aae342c84e2357eccf252577743b8787967b40b07ef2d3d9e6c1a3bcb059cba0fdb7f0d4f815c242b8e14acd3375e608e9230ba3cf8718f43882a3e1e661a2bbe81830d34741f33473e263b3790abe67acf29f5df44865b2ffbc96975fd62738a64112deda5a2534fb0a23b3b3024df986391badf9041c593c313a7ca1e1fcffcb65b07b9a99337b4a4acf616cbe1553eb9541f38aa6247342905995233a28172ca13396b2a9662970120f82b92a213f43de7a232ccca3268265c9ce042d50915430a6c455f32277da42f9962fb9163b623231ebc080fa7b8e9f9021fcf85b98f9c483e4d2226b9326a5bcb2e7449ef029ae142d3a0f0c28bd4f7e9c51a12e1336f24dfacbc3f808a8f7dd683027bc948763b808fb0037394b8b41bc9b2ec7887e67584e03d11b15ca203b2bcb43f8881638c4e4eee7f846d09c7f89b7739df22b2c3acc235032ba8f7ae27b5b9d25733143e80a4cdde6770719c1e66ec2ce683612233e88fafff84c0745a98aa1254c8219c6c556348c2b5d1beeb61532d6bf7bde153271dc647460beb65fe0055b33fd6480dcbb9d7d471952cfa5be260c39721a8c5c89b9e966ae2dc9036451ec9f2c49433b2225e13f23e20c2bfba81a7b3a555883449238f7d48213e9f10ce19e76f1bdcfc73ee5524bd7d8be0a4b46784e238233c04fb99383ec7726f9717e1179dd14fba9ad6c2ebd1699f0ab0e57e6cad23875b029e89cfda06f51266ecd2eed4edafb51e82f2a506d57ba74da611774ca5fa2fff4a976519de425885e7d09219cf815b1767d4fc5a72c18918991a285086a6a766614a4d245387da50f28dd778fb33ab88c0918feba3768c55bb1f07aec33cfeed33d6faa4d34fd7227b365533c1e67dbc89f0b20195cf1cbd480d333ade1c9bb28308085b72ced430268c1492a27050c43668adc9cf8b8509447cfcd3c8f8d8eb554f704101786aa9ebca86991d250776a37a1f56fbf7d08e591f978da49c3870625879f70e2418aec5cba32fa8c346fa9038baebc35ad0068a4d03537aee14c2e71570a87490377fa8dd66f995aa044a522f0c7025a7ab2dd5ad30a64268dc112b7f9fa156df64d631f55f1d6edc55cec570a9c7372e29e02c8d4867bae249431dcf6ed2794a0183f0f7501201feca4a81d334c642fc8d38e9a90fa77429665e09e214797dfa455ff47c4f219d3a2cb0176bc2236455123c1c5da714ad29d580fb194f87173a18dc
+PKCS8 = 3034020100300b0609608648016503040312042280202a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
 RawPublic = f5408337d0fee65c28851226a5fa81b58464632c78e2a9bef70d330f2e3a5f74d9cf676aedd1067c91a5dd5d4edc46f868a93ffec9f44e254e44f682a153aeadf228e8db7c5fcfed30cc3408e261ab896876bee56660d2a7c1d7eac20c5754255206a178f7156295065ce7876f90c48f44bc37f3a00e32eefd3a4bb1e298fe283d106eaef92a33a594253a2a0790976a1d04636f8672d28c06c852ea8bb43b84bff512996e7616963d5b9a2906466a152c7ea9be178be35405683b44367af85d2daad87630c1e21ba5490154f0141780f5ed0407cb0b975dd56d5930f9b26413b843b83f3693304b0038bd3e4bb398868060ea18c9c67099376470a50deb052e4056743fbcdf0341b192663bd1c21ba3b3d5666e0d0e29c4e1ed0759ab0bd9d1d355011b94e0ff0c049b03ddb7138640667144fcacd7265f55a07e5387f1abd30c037cf14d436aa855f827049215440d8007f61460500d943f57ffb6bfee6fedd2fcec52882d7d8da1aab29e892c8beac3df3234b4a7d2eca3a45c6623c52bbdd07c1c94314b706988a52029f8f8b06e874b741d72926652c78c6ace2cfd8864eadb2e4b39cafe6e03e4edbafa2747db9bc42f92af8b031e3e380846b1bfd15ade88c285d6a6fffe91eafc8b17de6cbc68575f323cc09fc20e49e8efd76f9568bec486b78df4245428d8d0d5f53873e11de65fda4c770b521a8c67f5c51d48cc26358954514447881fd9a42e5891dac7e1db5249d7861b322111e5fb929bee9ff5e9d5a2667ba93e63fc03040d2e82648f89e89dec1d1d2dfb9efeceb7940f7dcbebeb5a239cc1c54d8f7d52cba220d0634e15df46a58280bc5a48840bd39274cfde150f9ad9a40f6398d715350925f0e0501944409f32331a362bdaaafb3d8ce71c964332d6afb7e684f99951246d88081c86744ae68133f22c53a4b5ae258f230a98491d2d43a79a6d0f4d54a3b62013965ac7c82d0507125a38a0277f81cbc1d46cef2a131c6f51b88ec0baae0c82a6a0e72831cb06f9116cff5111d597e01057d32805a008f52c9aec3311139bfb35982789ff83bdd0c31e9f1080e8ed8eb99fde66bafb29e3357389fe3785b60c78e229ef073e1b65e34d848bd4d8a4f251551e2d38d2546afbc205d3c6dab34d2b962b1afb44f1d22fc10c6744fcd6b636afd3cb414b16c2e0d708fe9f51ff19120bde693b028b6d1e6dbe37b4b8b3bc7c6f7a842701603869d3ded572500f085502efc8d3cc62b30e5cdbcb5e86d9c0d42973bf755df539cc0aea58f9148386db67bd2bf70cd12ccd96d5c66fb271416b772465228dc44b079178f9b766370b66a79b871faca246ca6f8f63be9f0668297ac446cad5cf4a83318b1b00ecbd283f0eecee60a9a37a27abdbdbe382e307970002837dfc0bd3934ebd008918fd4bd383c02c9d37f694996e989a49075767ebc4a2981ef5275455e026cb0bd70946cdd1fadaf251381d324f9efbb860d1b280c29685bab97d010676273b45cca12ac3966aae342c84e2357eccf252577743b8787967b40b07ef2d3d9e6c1a3bcb059cba0fdb7f0d4f815c242b8e14acd3375e608e9230ba3cf8718f43882a3e1e661a2bbe81830d34741f33473e263b3790abe67acf29f5df44865b2ffbc96975fd62738a64112deda5a2534fb0a23b3b3024df986391badf9041c593c313a7ca1e1fcffcb65b07b9a99337b4a4acf616cbe1553eb9541f38aa6247342905995233a28172ca13396b2a9662970120f82b92a213f43de7a232ccca3268265c9ce042d50915430a6c455f32277da42f9962fb9163b623231ebc080fa7b8e9f9021fcf85b98f9c483e4d2226b9326a5bcb2e7449ef029ae142d3a0f0c28bd4f7e9c51a12e1336f24dfacbc3f808a8f7dd683027bc948763b808fb0037394b8b41bc9b2ec7887e67584e03d11b15ca203b2bcb43f8881638c4e4eee7f846d09c7f89b7739df22b2c3acc235032ba8f7ae27b5b9d25733143e80a4cdde6770719c1e66ec2ce683612233e88fafff84c0745a98aa1254c8219c6c556348c2b5d1beeb61532d6bf7bde153271dc647460beb65fe0055b33fd6480dcbb9d7d471952cfa5be260c39721a8c5c89b9e966ae2dc9036451ec9f2c49433b2225e13f23e20c2bfba81a7b3a555883449238f7d48213e9f10ce19e76f1bdcfc73ee5524bd7d8be0a4b46784e238233c04fb99383ec7726f9717e1179dd14fba9ad6c2ebd1699f0ab0e57e6cad23875b029e89cfda06f51266ecd2eed4edafb51e82f2a506d57ba74da611774ca5fa2fff4a976519de425885e7d09219cf815b1767d4fc5a72c18918991a285086a6a766614a4d245387da50f28dd778fb33ab88c0918feba3768c55bb1f07aec33cfeed33d6faa4d34fd7227b365533c1e67dbc89f0b20195cf1cbd480d333ade1c9bb28308085b72ced430268c1492a27050c43668adc9cf8b8509447cfcd3c8f8d8eb554f704101786aa9ebca86991d250776a37a1f56fbf7d08e591f978da49c3870625879f70e2418aec5cba32fa8c346fa9038baebc35ad0068a4d03537aee14c2e71570a87490377fa8dd66f995aa044a522f0c7025a7ab2dd5ad30a64268dc112b7f9fa156df64d631f55f1d6edc55cec570a9c7372e29e02c8d4867bae249431dcf6ed2794a0183f0f7501201feca4a81d334c642fc8d38e9a90fa77429665e09e214797dfa455ff47c4f219d3a2cb0176bc2236455123c1c5da714ad29d580fb194f87173a18dc
 PrivateSeed = 2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
 
-PublicKey = ML-DSA-87-Public
+Key = ML-DSA-87-Wycheproof
 Algorithm = ML-DSA-87
-Input = 30820a32300b060960864801650304031303820a210017a508179b35057099111733da28fd1a2265de7d8ab22d5279f13bca84cc42a5b8c9644c121e7e1b81723c5295be288fb6c36bfa188b6e08d913a152350947fa2c8ccc3fd01b319f65a2058a1dff54133946cfeb408d0b6dfde6bbebd7e0591cfe83b8b5452ceef6c855f7d33e06a0d269345089ed0d3ad67d84d8a4a34d16836004cff125469e8c3387abd788b620e30c1fc23909117a0e34c42a6631d9791347b1b2a3c9ab3082416211afb7bc3f6ce630a7019af19f736cdfacb1e7db66b65ef56844d2a2b0753d09283a7a0b66f77596384e95f7ceddd1c4ba20edc11f1eaab695bb963f6eda1c383754aa372a0d7729bfa6e0f142131c2367ba3f89ce3de6c357f9a7225b7cb85f6b3e8a3a122e8501fd1446b8152a415c19dda1d2e4590cd994f6664b4d1abd7381468c3a085abe2741a0cfbb81880664b271677245c4a471bf8bb8e0192eb32e4fb5e8560f3c50d6b19a353e486d0fcc2a35ac046286e707e095f61786d92212686a65d39b6863e0f8cec1e1997f2f845e4878ca9df650c746765296790863e51d012d32dffcbd746aa2276d04c0a57cd1b3d6ed06c0d66a0897aae5c49c97b6f19ae829baaafbfed28a52c05963c6eea9eff69528294207f8cda75280f7c486e6848791c8e37015479f2e13c28a9fe654dbde11689875203aaec51be3da7cab1cf31e4ec476c0c830cbdd04ac02167c0a6fbfdd6548b1fa525d235c7e3fca8d63e6427503b0a45c0bfddb428b837c32e8755441077bfe1c0142bac357b012a46545bf4148d465472dcf89c9d73b62357087e229f53a450d3cce41c8ee21a9d54b61e34a794f5b1406a70724ab0c3712c49df231ef30a956075e907c51b63dd1f9453dbe60e25b0f3cc0354dfd7c9119313919e77cb2c92f544d3e5302b8827603e936b567e99bfe9904932585a9f01a5a1b5bce07565f1d84c6b1c5c86259e1fefcff18cd06861122be6836be21e40be4eaf6bcabee8f634f95520aa914bb51c54dbd67d1b9dc5e38831e786c283979a963a3206b98e339edec4128b0502d4d47813869713e431a529a03c7f54b50123680f2b7f256f5d2b40642203259b9e85c62253d5670ce372193f28b5aa48ddd643c54756a2cff808c109f74772961d8db6bb8a17547c8f29c7f5ff3ea06740b867d84917e07f3978ad0281a20689eef58467e768b6178a9b36a567289fd39762bb3e4254031b2798a4550857f6af369d484392cddd7b48eaa2942e2cbfe754d5ee2da2b7fa71222e4a525ff5224d551a778ebd828e4e0499adc74ff0d59a5abc78ad6a8abafeedb3c99045a14423507f85597b1a7f540982f7d72ea13449110b442d54b78029b4c7fe3b49396dc6c3b7d58792538fa907963de10a4b724548142541cdf1512e0f7ff1b10a93de63541b8cc3268b4de20ed26739ee8973b6507ebe48965602c35fa3f7d4278146b598d7d7044e16e97e9351f7c51ac25573b7232ae2432638e9166190e7f7a7dcb5096ecb5d10017cdea2a82b4f56c7385041c6919a7e36e11beac77ec3f25df44e7b596c1542c1e376de3667c0e903fe25b57c338e9d93c5570c484f0ddab4f57d38f292b23599d9efc7a9fd9e078aaddca0acb1a196d6c45d3c8be6f39e8cdbe3299e370b262e0bf6fb5f005cae2b12879289d00bd8039de6a571c310d87557f5c9a4f64a0bde7177a8464722a04bf87fa2cb0e312d4fa6e536c61d65dc2c1baf144b0d1d1d75f4c860626ff773933efa9941d105c53a1d92c4f7c7bba4aa969590acef1e50901870f59715ac14d9846d83871a77367be57c63f88bc2c02eabafe678f44925a3e605979282fcd3f284736a1d346c033cb782dd615e886683fc37cd87a91422857774c63c6659096eba393c56225ed8c3485b4f89ecb07d53526281a6426ae7d67cda52fec5ac32320caae9b96000bcbe9e8782be88cb1ca6dcaffb74ef04c77e03a994bea2c89e4fcfa44cd0c9f4e30705a8b7b20df8c76b05a4479400e07db03d243e9fe4c90d34e9245f1e574be9a388f5355482077e4e98b919de024e666fdd7d51ed2a0d58a823e7497eb07303cf1d6d5f10a536be980220de5856727e5c13981839cfa19740988e7771a2b984f53ae3a5916ed881a4a90fe524f0bb3778355882864f8961fade32e656fcf9f524e748c8196a1f1bbc57bf8da7b36de9b0080f0c7bb8487a2b7bb7a81a8ff43a2539b367c9a48c70041520f05ca3dae316dbbe3118218216f52b7bcdba7557c4c9d861803a5e2ee01d3682e1261d7cae0a99fb8de909eb2bc1e112aa43cc2fa9c76a222bd85faaaba5d9ec2198ac45a295181a324a0592632b89e2752582cd5e01e1a610e7563faee10b76d853109e257e7c0c248a9fb7933f514b07b4f4e3a4a3d2cd22e8cc45ebda3bef5948aa050f01eff85ae98d19f69c51e67ff89f2df0c5268acfdd325e84591317e05cab4f9e6358f249c4ddf4019fbc8f511549a733898a50efa9e0793083de0b15b5bf78d9f63d8df830d42df2fefa27b89e0ede2a702eb9467118fc0ed44edc63ad1b1935877c34843fea06fdf388bbf83e501723a13cc6cc2efbb9691fe28fc1d45270591e5bdf7aa1c82673544ee29d9e6c9da3328f21e9729bffd7f4e56de585909679a74037105fdac3f51ae35f69d9763d2e4cfeb1d4a8fdce99bf1aa21f866a9f523b2a9549e12258a4d19900cf5db37b67da19b23563bd1d701c6106fccb28e4689c62e1a6cf1abd763d7239c2258b765610d4478be9f1650cb8d18923592ad0024076e52f9bd0a3894fe97bc0a1646b4c37f62c27f32d0df270260f47c49a5caf110e4cf80168a7d54b1c70bed9bd5d9a143ce869a05cd44ee266aecd6bfedb39be79e7c7d5c11a99575ebc0f389cc55a4fe1469a2d61b70bfe4b74e3e27521a037d2b9f4fdb377231e2ceb214ba90f6953865c683215203ce963875c6524c01b789e0389a9f0c386eb236f0dfba6c95df4f28ccc7ae7cd473f9dcd20817cccdd211bcbc78b064e936e4ba2813df531128428ddf410e6ca07044aeb4cfcc0a16c995ec51c8af16a541ce18dbeb69a26635632dcc24ee52a5eedce38c502cd0e356ec31341c893f92e6063c3a160a53d34b85e92357a8ebaaad8f206771be43ee48cc409825a7094bda529ee18776d9e67f1fa1c1419514309d70ba2443be2f63b6943478d6c0f56dd058731e53de4c30bfc7d915e9284a56248e81944392881666680d4991f04269ec9a83b24b458ed59a6c274de452ab3013c103a4920543e6a7d22dadfd764f6ea39d49b910ee0dc216e547aa5fb4382a72a568ebe83ec00416fb5830dc21c24ae72416602870cb52c3a8a1c4c12a4b287b9b800d31c287ca161f404a9e598a5358d28b3aae43e534846bcd0d7a9c7652ae01e6698c79e315aca8198f36de45af7084b1cb21ca2ba0ee3a547a7343a10ef9e3fd17b0a4060badd1409a0562cba25b84fd578268fac53cfbca08e6cf6e5419f57262eb5813c1d1324e0df1d483ade08d8f6c62498e262485ac7c2872b11b42e5c1b797fc12e838b38a711d364d45cd1ed35f7faffdf4b0fb0eaa312fc3d5af77909b0649cbbacea10c9831273922b5b05172face9ce6cf324edf6e2f5f5fa0a9f0463eee938b30adf3e55664f94d274cd87dea901a7e08e805
-RawPublic = 17a508179b35057099111733da28fd1a2265de7d8ab22d5279f13bca84cc42a5b8c9644c121e7e1b81723c5295be288fb6c36bfa188b6e08d913a152350947fa2c8ccc3fd01b319f65a2058a1dff54133946cfeb408d0b6dfde6bbebd7e0591cfe83b8b5452ceef6c855f7d33e06a0d269345089ed0d3ad67d84d8a4a34d16836004cff125469e8c3387abd788b620e30c1fc23909117a0e34c42a6631d9791347b1b2a3c9ab3082416211afb7bc3f6ce630a7019af19f736cdfacb1e7db66b65ef56844d2a2b0753d09283a7a0b66f77596384e95f7ceddd1c4ba20edc11f1eaab695bb963f6eda1c383754aa372a0d7729bfa6e0f142131c2367ba3f89ce3de6c357f9a7225b7cb85f6b3e8a3a122e8501fd1446b8152a415c19dda1d2e4590cd994f6664b4d1abd7381468c3a085abe2741a0cfbb81880664b271677245c4a471bf8bb8e0192eb32e4fb5e8560f3c50d6b19a353e486d0fcc2a35ac046286e707e095f61786d92212686a65d39b6863e0f8cec1e1997f2f845e4878ca9df650c746765296790863e51d012d32dffcbd746aa2276d04c0a57cd1b3d6ed06c0d66a0897aae5c49c97b6f19ae829baaafbfed28a52c05963c6eea9eff69528294207f8cda75280f7c486e6848791c8e37015479f2e13c28a9fe654dbde11689875203aaec51be3da7cab1cf31e4ec476c0c830cbdd04ac02167c0a6fbfdd6548b1fa525d235c7e3fca8d63e6427503b0a45c0bfddb428b837c32e8755441077bfe1c0142bac357b012a46545bf4148d465472dcf89c9d73b62357087e229f53a450d3cce41c8ee21a9d54b61e34a794f5b1406a70724ab0c3712c49df231ef30a956075e907c51b63dd1f9453dbe60e25b0f3cc0354dfd7c9119313919e77cb2c92f544d3e5302b8827603e936b567e99bfe9904932585a9f01a5a1b5bce07565f1d84c6b1c5c86259e1fefcff18cd06861122be6836be21e40be4eaf6bcabee8f634f95520aa914bb51c54dbd67d1b9dc5e38831e786c283979a963a3206b98e339edec4128b0502d4d47813869713e431a529a03c7f54b50123680f2b7f256f5d2b40642203259b9e85c62253d5670ce372193f28b5aa48ddd643c54756a2cff808c109f74772961d8db6bb8a17547c8f29c7f5ff3ea06740b867d84917e07f3978ad0281a20689eef58467e768b6178a9b36a567289fd39762bb3e4254031b2798a4550857f6af369d484392cddd7b48eaa2942e2cbfe754d5ee2da2b7fa71222e4a525ff5224d551a778ebd828e4e0499adc74ff0d59a5abc78ad6a8abafeedb3c99045a14423507f85597b1a7f540982f7d72ea13449110b442d54b78029b4c7fe3b49396dc6c3b7d58792538fa907963de10a4b724548142541cdf1512e0f7ff1b10a93de63541b8cc3268b4de20ed26739ee8973b6507ebe48965602c35fa3f7d4278146b598d7d7044e16e97e9351f7c51ac25573b7232ae2432638e9166190e7f7a7dcb5096ecb5d10017cdea2a82b4f56c7385041c6919a7e36e11beac77ec3f25df44e7b596c1542c1e376de3667c0e903fe25b57c338e9d93c5570c484f0ddab4f57d38f292b23599d9efc7a9fd9e078aaddca0acb1a196d6c45d3c8be6f39e8cdbe3299e370b262e0bf6fb5f005cae2b12879289d00bd8039de6a571c310d87557f5c9a4f64a0bde7177a8464722a04bf87fa2cb0e312d4fa6e536c61d65dc2c1baf144b0d1d1d75f4c860626ff773933efa9941d105c53a1d92c4f7c7bba4aa969590acef1e50901870f59715ac14d9846d83871a77367be57c63f88bc2c02eabafe678f44925a3e605979282fcd3f284736a1d346c033cb782dd615e886683fc37cd87a91422857774c63c6659096eba393c56225ed8c3485b4f89ecb07d53526281a6426ae7d67cda52fec5ac32320caae9b96000bcbe9e8782be88cb1ca6dcaffb74ef04c77e03a994bea2c89e4fcfa44cd0c9f4e30705a8b7b20df8c76b05a4479400e07db03d243e9fe4c90d34e9245f1e574be9a388f5355482077e4e98b919de024e666fdd7d51ed2a0d58a823e7497eb07303cf1d6d5f10a536be980220de5856727e5c13981839cfa19740988e7771a2b984f53ae3a5916ed881a4a90fe524f0bb3778355882864f8961fade32e656fcf9f524e748c8196a1f1bbc57bf8da7b36de9b0080f0c7bb8487a2b7bb7a81a8ff43a2539b367c9a48c70041520f05ca3dae316dbbe3118218216f52b7bcdba7557c4c9d861803a5e2ee01d3682e1261d7cae0a99fb8de909eb2bc1e112aa43cc2fa9c76a222bd85faaaba5d9ec2198ac45a295181a324a0592632b89e2752582cd5e01e1a610e7563faee10b76d853109e257e7c0c248a9fb7933f514b07b4f4e3a4a3d2cd22e8cc45ebda3bef5948aa050f01eff85ae98d19f69c51e67ff89f2df0c5268acfdd325e84591317e05cab4f9e6358f249c4ddf4019fbc8f511549a733898a50efa9e0793083de0b15b5bf78d9f63d8df830d42df2fefa27b89e0ede2a702eb9467118fc0ed44edc63ad1b1935877c34843fea06fdf388bbf83e501723a13cc6cc2efbb9691fe28fc1d45270591e5bdf7aa1c82673544ee29d9e6c9da3328f21e9729bffd7f4e56de585909679a74037105fdac3f51ae35f69d9763d2e4cfeb1d4a8fdce99bf1aa21f866a9f523b2a9549e12258a4d19900cf5db37b67da19b23563bd1d701c6106fccb28e4689c62e1a6cf1abd763d7239c2258b765610d4478be9f1650cb8d18923592ad0024076e52f9bd0a3894fe97bc0a1646b4c37f62c27f32d0df270260f47c49a5caf110e4cf80168a7d54b1c70bed9bd5d9a143ce869a05cd44ee266aecd6bfedb39be79e7c7d5c11a99575ebc0f389cc55a4fe1469a2d61b70bfe4b74e3e27521a037d2b9f4fdb377231e2ceb214ba90f6953865c683215203ce963875c6524c01b789e0389a9f0c386eb236f0dfba6c95df4f28ccc7ae7cd473f9dcd20817cccdd211bcbc78b064e936e4ba2813df531128428ddf410e6ca07044aeb4cfcc0a16c995ec51c8af16a541ce18dbeb69a26635632dcc24ee52a5eedce38c502cd0e356ec31341c893f92e6063c3a160a53d34b85e92357a8ebaaad8f206771be43ee48cc409825a7094bda529ee18776d9e67f1fa1c1419514309d70ba2443be2f63b6943478d6c0f56dd058731e53de4c30bfc7d915e9284a56248e81944392881666680d4991f04269ec9a83b24b458ed59a6c274de452ab3013c103a4920543e6a7d22dadfd764f6ea39d49b910ee0dc216e547aa5fb4382a72a568ebe83ec00416fb5830dc21c24ae72416602870cb52c3a8a1c4c12a4b287b9b800d31c287ca161f404a9e598a5358d28b3aae43e534846bcd0d7a9c7652ae01e6698c79e315aca8198f36de45af7084b1cb21ca2ba0ee3a547a7343a10ef9e3fd17b0a4060badd1409a0562cba25b84fd578268fac53cfbca08e6cf6e5419f57262eb5813c1d1324e0df1d483ade08d8f6c62498e262485ac7c2872b11b42e5c1b797fc12e838b38a711d364d45cd1ed35f7faffdf4b0fb0eaa312fc3d5af77909b0649cbbacea10c9831273922b5b05172face9ce6cf324edf6e2f5f5fa0a9f0463eee938b30adf3e55664f94d274cd87dea901a7e08e805
-
-PrivateKey = ML-DSA-87-Private
-Algorithm = ML-DSA-87
-Input = 3034020100300b0609608648016503040313042280202a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
+SPKI = 30820a32300b060960864801650304031303820a210017a508179b35057099111733da28fd1a2265de7d8ab22d5279f13bca84cc42a5b8c9644c121e7e1b81723c5295be288fb6c36bfa188b6e08d913a152350947fa2c8ccc3fd01b319f65a2058a1dff54133946cfeb408d0b6dfde6bbebd7e0591cfe83b8b5452ceef6c855f7d33e06a0d269345089ed0d3ad67d84d8a4a34d16836004cff125469e8c3387abd788b620e30c1fc23909117a0e34c42a6631d9791347b1b2a3c9ab3082416211afb7bc3f6ce630a7019af19f736cdfacb1e7db66b65ef56844d2a2b0753d09283a7a0b66f77596384e95f7ceddd1c4ba20edc11f1eaab695bb963f6eda1c383754aa372a0d7729bfa6e0f142131c2367ba3f89ce3de6c357f9a7225b7cb85f6b3e8a3a122e8501fd1446b8152a415c19dda1d2e4590cd994f6664b4d1abd7381468c3a085abe2741a0cfbb81880664b271677245c4a471bf8bb8e0192eb32e4fb5e8560f3c50d6b19a353e486d0fcc2a35ac046286e707e095f61786d92212686a65d39b6863e0f8cec1e1997f2f845e4878ca9df650c746765296790863e51d012d32dffcbd746aa2276d04c0a57cd1b3d6ed06c0d66a0897aae5c49c97b6f19ae829baaafbfed28a52c05963c6eea9eff69528294207f8cda75280f7c486e6848791c8e37015479f2e13c28a9fe654dbde11689875203aaec51be3da7cab1cf31e4ec476c0c830cbdd04ac02167c0a6fbfdd6548b1fa525d235c7e3fca8d63e6427503b0a45c0bfddb428b837c32e8755441077bfe1c0142bac357b012a46545bf4148d465472dcf89c9d73b62357087e229f53a450d3cce41c8ee21a9d54b61e34a794f5b1406a70724ab0c3712c49df231ef30a956075e907c51b63dd1f9453dbe60e25b0f3cc0354dfd7c9119313919e77cb2c92f544d3e5302b8827603e936b567e99bfe9904932585a9f01a5a1b5bce07565f1d84c6b1c5c86259e1fefcff18cd06861122be6836be21e40be4eaf6bcabee8f634f95520aa914bb51c54dbd67d1b9dc5e38831e786c283979a963a3206b98e339edec4128b0502d4d47813869713e431a529a03c7f54b50123680f2b7f256f5d2b40642203259b9e85c62253d5670ce372193f28b5aa48ddd643c54756a2cff808c109f74772961d8db6bb8a17547c8f29c7f5ff3ea06740b867d84917e07f3978ad0281a20689eef58467e768b6178a9b36a567289fd39762bb3e4254031b2798a4550857f6af369d484392cddd7b48eaa2942e2cbfe754d5ee2da2b7fa71222e4a525ff5224d551a778ebd828e4e0499adc74ff0d59a5abc78ad6a8abafeedb3c99045a14423507f85597b1a7f540982f7d72ea13449110b442d54b78029b4c7fe3b49396dc6c3b7d58792538fa907963de10a4b724548142541cdf1512e0f7ff1b10a93de63541b8cc3268b4de20ed26739ee8973b6507ebe48965602c35fa3f7d4278146b598d7d7044e16e97e9351f7c51ac25573b7232ae2432638e9166190e7f7a7dcb5096ecb5d10017cdea2a82b4f56c7385041c6919a7e36e11beac77ec3f25df44e7b596c1542c1e376de3667c0e903fe25b57c338e9d93c5570c484f0ddab4f57d38f292b23599d9efc7a9fd9e078aaddca0acb1a196d6c45d3c8be6f39e8cdbe3299e370b262e0bf6fb5f005cae2b12879289d00bd8039de6a571c310d87557f5c9a4f64a0bde7177a8464722a04bf87fa2cb0e312d4fa6e536c61d65dc2c1baf144b0d1d1d75f4c860626ff773933efa9941d105c53a1d92c4f7c7bba4aa969590acef1e50901870f59715ac14d9846d83871a77367be57c63f88bc2c02eabafe678f44925a3e605979282fcd3f284736a1d346c033cb782dd615e886683fc37cd87a91422857774c63c6659096eba393c56225ed8c3485b4f89ecb07d53526281a6426ae7d67cda52fec5ac32320caae9b96000bcbe9e8782be88cb1ca6dcaffb74ef04c77e03a994bea2c89e4fcfa44cd0c9f4e30705a8b7b20df8c76b05a4479400e07db03d243e9fe4c90d34e9245f1e574be9a388f5355482077e4e98b919de024e666fdd7d51ed2a0d58a823e7497eb07303cf1d6d5f10a536be980220de5856727e5c13981839cfa19740988e7771a2b984f53ae3a5916ed881a4a90fe524f0bb3778355882864f8961fade32e656fcf9f524e748c8196a1f1bbc57bf8da7b36de9b0080f0c7bb8487a2b7bb7a81a8ff43a2539b367c9a48c70041520f05ca3dae316dbbe3118218216f52b7bcdba7557c4c9d861803a5e2ee01d3682e1261d7cae0a99fb8de909eb2bc1e112aa43cc2fa9c76a222bd85faaaba5d9ec2198ac45a295181a324a0592632b89e2752582cd5e01e1a610e7563faee10b76d853109e257e7c0c248a9fb7933f514b07b4f4e3a4a3d2cd22e8cc45ebda3bef5948aa050f01eff85ae98d19f69c51e67ff89f2df0c5268acfdd325e84591317e05cab4f9e6358f249c4ddf4019fbc8f511549a733898a50efa9e0793083de0b15b5bf78d9f63d8df830d42df2fefa27b89e0ede2a702eb9467118fc0ed44edc63ad1b1935877c34843fea06fdf388bbf83e501723a13cc6cc2efbb9691fe28fc1d45270591e5bdf7aa1c82673544ee29d9e6c9da3328f21e9729bffd7f4e56de585909679a74037105fdac3f51ae35f69d9763d2e4cfeb1d4a8fdce99bf1aa21f866a9f523b2a9549e12258a4d19900cf5db37b67da19b23563bd1d701c6106fccb28e4689c62e1a6cf1abd763d7239c2258b765610d4478be9f1650cb8d18923592ad0024076e52f9bd0a3894fe97bc0a1646b4c37f62c27f32d0df270260f47c49a5caf110e4cf80168a7d54b1c70bed9bd5d9a143ce869a05cd44ee266aecd6bfedb39be79e7c7d5c11a99575ebc0f389cc55a4fe1469a2d61b70bfe4b74e3e27521a037d2b9f4fdb377231e2ceb214ba90f6953865c683215203ce963875c6524c01b789e0389a9f0c386eb236f0dfba6c95df4f28ccc7ae7cd473f9dcd20817cccdd211bcbc78b064e936e4ba2813df531128428ddf410e6ca07044aeb4cfcc0a16c995ec51c8af16a541ce18dbeb69a26635632dcc24ee52a5eedce38c502cd0e356ec31341c893f92e6063c3a160a53d34b85e92357a8ebaaad8f206771be43ee48cc409825a7094bda529ee18776d9e67f1fa1c1419514309d70ba2443be2f63b6943478d6c0f56dd058731e53de4c30bfc7d915e9284a56248e81944392881666680d4991f04269ec9a83b24b458ed59a6c274de452ab3013c103a4920543e6a7d22dadfd764f6ea39d49b910ee0dc216e547aa5fb4382a72a568ebe83ec00416fb5830dc21c24ae72416602870cb52c3a8a1c4c12a4b287b9b800d31c287ca161f404a9e598a5358d28b3aae43e534846bcd0d7a9c7652ae01e6698c79e315aca8198f36de45af7084b1cb21ca2ba0ee3a547a7343a10ef9e3fd17b0a4060badd1409a0562cba25b84fd578268fac53cfbca08e6cf6e5419f57262eb5813c1d1324e0df1d483ade08d8f6c62498e262485ac7c2872b11b42e5c1b797fc12e838b38a711d364d45cd1ed35f7faffdf4b0fb0eaa312fc3d5af77909b0649cbbacea10c9831273922b5b05172face9ce6cf324edf6e2f5f5fa0a9f0463eee938b30adf3e55664f94d274cd87dea901a7e08e805
+PKCS8 = 3034020100300b0609608648016503040313042280202a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
 RawPublic = 17a508179b35057099111733da28fd1a2265de7d8ab22d5279f13bca84cc42a5b8c9644c121e7e1b81723c5295be288fb6c36bfa188b6e08d913a152350947fa2c8ccc3fd01b319f65a2058a1dff54133946cfeb408d0b6dfde6bbebd7e0591cfe83b8b5452ceef6c855f7d33e06a0d269345089ed0d3ad67d84d8a4a34d16836004cff125469e8c3387abd788b620e30c1fc23909117a0e34c42a6631d9791347b1b2a3c9ab3082416211afb7bc3f6ce630a7019af19f736cdfacb1e7db66b65ef56844d2a2b0753d09283a7a0b66f77596384e95f7ceddd1c4ba20edc11f1eaab695bb963f6eda1c383754aa372a0d7729bfa6e0f142131c2367ba3f89ce3de6c357f9a7225b7cb85f6b3e8a3a122e8501fd1446b8152a415c19dda1d2e4590cd994f6664b4d1abd7381468c3a085abe2741a0cfbb81880664b271677245c4a471bf8bb8e0192eb32e4fb5e8560f3c50d6b19a353e486d0fcc2a35ac046286e707e095f61786d92212686a65d39b6863e0f8cec1e1997f2f845e4878ca9df650c746765296790863e51d012d32dffcbd746aa2276d04c0a57cd1b3d6ed06c0d66a0897aae5c49c97b6f19ae829baaafbfed28a52c05963c6eea9eff69528294207f8cda75280f7c486e6848791c8e37015479f2e13c28a9fe654dbde11689875203aaec51be3da7cab1cf31e4ec476c0c830cbdd04ac02167c0a6fbfdd6548b1fa525d235c7e3fca8d63e6427503b0a45c0bfddb428b837c32e8755441077bfe1c0142bac357b012a46545bf4148d465472dcf89c9d73b62357087e229f53a450d3cce41c8ee21a9d54b61e34a794f5b1406a70724ab0c3712c49df231ef30a956075e907c51b63dd1f9453dbe60e25b0f3cc0354dfd7c9119313919e77cb2c92f544d3e5302b8827603e936b567e99bfe9904932585a9f01a5a1b5bce07565f1d84c6b1c5c86259e1fefcff18cd06861122be6836be21e40be4eaf6bcabee8f634f95520aa914bb51c54dbd67d1b9dc5e38831e786c283979a963a3206b98e339edec4128b0502d4d47813869713e431a529a03c7f54b50123680f2b7f256f5d2b40642203259b9e85c62253d5670ce372193f28b5aa48ddd643c54756a2cff808c109f74772961d8db6bb8a17547c8f29c7f5ff3ea06740b867d84917e07f3978ad0281a20689eef58467e768b6178a9b36a567289fd39762bb3e4254031b2798a4550857f6af369d484392cddd7b48eaa2942e2cbfe754d5ee2da2b7fa71222e4a525ff5224d551a778ebd828e4e0499adc74ff0d59a5abc78ad6a8abafeedb3c99045a14423507f85597b1a7f540982f7d72ea13449110b442d54b78029b4c7fe3b49396dc6c3b7d58792538fa907963de10a4b724548142541cdf1512e0f7ff1b10a93de63541b8cc3268b4de20ed26739ee8973b6507ebe48965602c35fa3f7d4278146b598d7d7044e16e97e9351f7c51ac25573b7232ae2432638e9166190e7f7a7dcb5096ecb5d10017cdea2a82b4f56c7385041c6919a7e36e11beac77ec3f25df44e7b596c1542c1e376de3667c0e903fe25b57c338e9d93c5570c484f0ddab4f57d38f292b23599d9efc7a9fd9e078aaddca0acb1a196d6c45d3c8be6f39e8cdbe3299e370b262e0bf6fb5f005cae2b12879289d00bd8039de6a571c310d87557f5c9a4f64a0bde7177a8464722a04bf87fa2cb0e312d4fa6e536c61d65dc2c1baf144b0d1d1d75f4c860626ff773933efa9941d105c53a1d92c4f7c7bba4aa969590acef1e50901870f59715ac14d9846d83871a77367be57c63f88bc2c02eabafe678f44925a3e605979282fcd3f284736a1d346c033cb782dd615e886683fc37cd87a91422857774c63c6659096eba393c56225ed8c3485b4f89ecb07d53526281a6426ae7d67cda52fec5ac32320caae9b96000bcbe9e8782be88cb1ca6dcaffb74ef04c77e03a994bea2c89e4fcfa44cd0c9f4e30705a8b7b20df8c76b05a4479400e07db03d243e9fe4c90d34e9245f1e574be9a388f5355482077e4e98b919de024e666fdd7d51ed2a0d58a823e7497eb07303cf1d6d5f10a536be980220de5856727e5c13981839cfa19740988e7771a2b984f53ae3a5916ed881a4a90fe524f0bb3778355882864f8961fade32e656fcf9f524e748c8196a1f1bbc57bf8da7b36de9b0080f0c7bb8487a2b7bb7a81a8ff43a2539b367c9a48c70041520f05ca3dae316dbbe3118218216f52b7bcdba7557c4c9d861803a5e2ee01d3682e1261d7cae0a99fb8de909eb2bc1e112aa43cc2fa9c76a222bd85faaaba5d9ec2198ac45a295181a324a0592632b89e2752582cd5e01e1a610e7563faee10b76d853109e257e7c0c248a9fb7933f514b07b4f4e3a4a3d2cd22e8cc45ebda3bef5948aa050f01eff85ae98d19f69c51e67ff89f2df0c5268acfdd325e84591317e05cab4f9e6358f249c4ddf4019fbc8f511549a733898a50efa9e0793083de0b15b5bf78d9f63d8df830d42df2fefa27b89e0ede2a702eb9467118fc0ed44edc63ad1b1935877c34843fea06fdf388bbf83e501723a13cc6cc2efbb9691fe28fc1d45270591e5bdf7aa1c82673544ee29d9e6c9da3328f21e9729bffd7f4e56de585909679a74037105fdac3f51ae35f69d9763d2e4cfeb1d4a8fdce99bf1aa21f866a9f523b2a9549e12258a4d19900cf5db37b67da19b23563bd1d701c6106fccb28e4689c62e1a6cf1abd763d7239c2258b765610d4478be9f1650cb8d18923592ad0024076e52f9bd0a3894fe97bc0a1646b4c37f62c27f32d0df270260f47c49a5caf110e4cf80168a7d54b1c70bed9bd5d9a143ce869a05cd44ee266aecd6bfedb39be79e7c7d5c11a99575ebc0f389cc55a4fe1469a2d61b70bfe4b74e3e27521a037d2b9f4fdb377231e2ceb214ba90f6953865c683215203ce963875c6524c01b789e0389a9f0c386eb236f0dfba6c95df4f28ccc7ae7cd473f9dcd20817cccdd211bcbc78b064e936e4ba2813df531128428ddf410e6ca07044aeb4cfcc0a16c995ec51c8af16a541ce18dbeb69a26635632dcc24ee52a5eedce38c502cd0e356ec31341c893f92e6063c3a160a53d34b85e92357a8ebaaad8f206771be43ee48cc409825a7094bda529ee18776d9e67f1fa1c1419514309d70ba2443be2f63b6943478d6c0f56dd058731e53de4c30bfc7d915e9284a56248e81944392881666680d4991f04269ec9a83b24b458ed59a6c274de452ab3013c103a4920543e6a7d22dadfd764f6ea39d49b910ee0dc216e547aa5fb4382a72a568ebe83ec00416fb5830dc21c24ae72416602870cb52c3a8a1c4c12a4b287b9b800d31c287ca161f404a9e598a5358d28b3aae43e534846bcd0d7a9c7652ae01e6698c79e315aca8198f36de45af7084b1cb21ca2ba0ee3a547a7343a10ef9e3fd17b0a4060badd1409a0562cba25b84fd578268fac53cfbca08e6cf6e5419f57262eb5813c1d1324e0df1d483ade08d8f6c62498e262485ac7c2872b11b42e5c1b797fc12e838b38a711d364d45cd1ed35f7faffdf4b0fb0eaa312fc3d5af77909b0649cbbacea10c9831273922b5b05172face9ce6cf324edf6e2f5f5fa0a9f0463eee938b30adf3e55664f94d274cd87dea901a7e08e805
 PrivateSeed = 2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a
 
 # Valid signature
-VerifyMessage = ML-DSA-44-Public
+VerifyMessage = ML-DSA-44-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = 1aa69cb5ed35204534f25f40a17eb0d767f8981f5e7cec46d3bf3252bfc78e09d02ef0c82da6dde973611c849472890106158cb15ffa6ca891615e888efa0d2d8a121b75ca440228ad32991be34249620f158ffd6f74d7b03bf919218ce259b500808ec157ead67b56b79e9e6607eafb9227b8a30adbec087d35bc1aec2f1a0c4dd126dfcfb9fbf0bd74fb1e092495fa994ab5a7cd1333281aafe834694a6dc11e889c762b5645638e172dfab3060031ebcdc1fd455d5de6050bf71b074a4dd34af5ebf15487651f0f13e5d3cee231b9b347810bfc418196df9d7231780c09171b9aae732bea27a1649d8c03220f417e30a016b08ccb1d55c9337b4812e20e04523f5d29a760a01b3a80d76285521206481ee1e44df09a76913ba54ae50c8eb973a3ced73950fbf39c4c0c1262a216821a442072c10cc82839ac57b898411be9e810f893272a2546ff7d1d920f146210efc2b4528bc98a099a398302d301fc1dea31b3d8ff78246a66f690ef536b68e02bd7ea23a5378930dde7f1beb51749896a7944e5a40e6fbbb1f76c3fda09e32e0a58062c24cac7ddb8c1d2cbb352a81e336425c5f551246db45ecd0ab29dac88cdebf51c60bebc2e27c974f56da12c1fec4f5745850429b607f5ed7cd821f2c91fc2dda8c2c8e8ec278d1b2a5bf50ec70c5623fc681b4d1dccff96b324cb53ff97470f9de177c2006a89af8f18603a6d4ea2625794695fe79cd30318a1e76307a4c2a353db1e076ad9b609a2489b94cb6dd821c3af31046bb7a5d43d190e09fce4969fe4e93c8393975e64cb2d9c2294fc427ef5191c40937929b3b0e1b037e6b84cc0299d5af2b5410118bfd88ef6491af6f21233390ca7a19f1576e6c5a10a673796905562075047896e3a2379f64dfbbc12b9bfe64939c2d05efbc5f6e4b5ca69ce1ed4b7d25e8c835b0612b33e13ed7a8a7233b4b3d58eead0bc4c841acb65a5ec0ed45e2584c23c2a162392b5789c62358e4038864e20c10e10c67d940ce78993178dbeb3de1fea1e50e7c29f4d7d938c3bfe50229ea040102f30d5b3a64cb8e13420065d54a1ac50a77383bdff3cae2340ebf15a1557fde897007c1b67d04f19431ca00cb0f08db87e90e166e0f4ce6fd69c6ecef1b3f70d9eb601b57a7bf931057c2afe2d3567b6bbec7891c664713385122fdd789c1d5a8a9cfd491f407c16d0b0c5dfc53a6862208e264b981bf2ddbdd1d7db9729b5265c4c3868a947c982880bc55b786153b89ef3324067b35a928c51236bcbe9f860ad9eee5644478f894a9fe78d26a5a17d482612f1cb9983b864e6fba84591c0f73b7b27918819d2121d4af640f533e2939d3da0f0aa6b9df80837a80165ae8b7579715192eb0f6cca78a43d8ad8d7abb56d816e3af2de59b88bfdcf6767abfb043d3ae24223d05001953faa292671c57ade1fe28988075ab8d14ac98363412bd694c40ae85b1f104afcd0f25aa590f57ba4f5dfdf613bf8594e3f54baadfdf50c0881af2475590758a23b7eee725513e4d1ea9f4630159c424a289f18a9879e5e173390f8e630f6ee2a6043d82a1983dc97c7acfea3b0c03e27e865d810d012daeec28dc454f59334edf24627d435701d329ff5e68d19bbdca5ef7d5e00204fa947d08f81cb6484cabe60989d2f61fbe70940f7e4f449b3fcb103a89143d74b15d72e7913dce9193a0b9c5a7b2a97bde6d7f396ae80b4b566f9f2e7345bc42ce3b002818e19f0f16416b850832cd02279ee8d58a381deaac09b1b4d4613f4d066805d2faea6716e015fe361c0526c6e4617a389ffdf930213c1dc0c4c905c3106a7517dce7abea7a9341132f8ad98de3e42f6b75809fff38f6eeafb97398e79d50a5622338763c4e45a88ddda7fb87ab7f5cec61109fdc1c5d4a16310275241fc34178028a49fd79581a05c3b6984eecd6cb9bd60a44da72600f8f2604a4ff4578126194fb2269c8e6e71447445e8e80bf8c6063dbbf29c7ded58abbc0d2eed347bf495b6a9cbe68585a594aa0e65834bfbcccc3f6bf42fe4ef42d86232c3fb1412dd0b5f8a0489958f5c3b883bf7851337a35b13dd2b6517626ff2d1064cd189beb402497dd6b8893d414dde7d1d51018c7a83766a2d8a29b80e8f428237732f7ee5ba878163f0aa8af5b60533b4d4621a38fdc54383acb3325b5e876e21483eddcc64c419596e656d1557be31b530ea66054f79d4f4a755f9ee33c84fed5d552ec5e2eccd061cf4c4b5c3c16a70a7baecccfc208d2430e78621c9ae5b0d080973b4e1df0a1f5c0415db6d3c85f9ea9041e9a9abdde71d6776a522aa957f708b14a33eda10ebbab93bb8ec2b7a04679f38eb44fc558ee698d3c6937e0e647dce898d7599fef6de32ae4d52adc722443610b2126559756aa36f3c79696b99be3d908f780fcbaef33b215693634d63ce2a0777dfbbc899d2be72efdbafbc10aefb26a1a63cdcfda00235b34db723c91624ee5f939024dfedba0863ad08f648767d41fc7fd6b317c51f4b1b87e21e07d488c9423581f9bbdae43e4d32b37e8283960524f9a601ab69f5cd7fb01c9a8a5c64fe863519a1e9f3426398f691a96e1748491b4e209fca2ab29481a674621c797614ba16fbfdfd1a4184e7f84667e720e6bcd9debef32c2b9e891a6e3c0423158f539838d8413e9fc707d5c65b23368b6edc95d9c3f8e20bbb844499311614945606c1487ef4015d1e260fa8239abaa071be572163132bdb06ef21e31be0f9d4b6747134e4842bedcd3bf53b0d6f054693bc428e9a715d5a32a79e6a3cb8b81faf2c04087d8816752637a2fe11eacb38341e024848562a29d4585e4ee56552ce9b1fad43b965a37bff8558921790ef0f4ac55bcac4327d1783f5e1e79bf01e96934bb4a8f5dd06c83bb70b2377189d622a106100f0cbdd38e34c0565900c616561161b3261859133f83893feb22b0bafc82cf4f0dbafde0648e2f86260e6e747034e5cb3ece98087fbf74179c6306f0c460b5d609b9b3a66761472ee0b9dabb5dfa872d5c6bc9b33461a27b5427bd8833f874f479ecc5f0a20304b9a75aacc82420a87af6469daaef53391ae8a25468e717dc47f464fce45a31147c0c4e12ac2f834567e4005b0827d13b3ec80cd8b7a907436e6624c6c8ac6a80add35cfa1a28872fb65cb3fa46894d116a052f19b5fe20c7ead10bd24d27ad2b5683f299d1193ec6d9ff3379f3b3e39cb9991831f194af2041085508da4dcb7b8785cbdc4e04cf4d826d1ef4a11036e4c5803c3aaa7669b4dd3bc12ff888984e9bbdace0e772ab59332b47300334757677578808e90929697a9cecfd6ed1b303d4250738a97a0aabac6d91e283a4b696f7181828493aec8cdcfe1eaecfc0227484957595badbcbfc8fa000000000000000000000000000000000000121f323e
 
-VerifyMessage = ML-DSA-65-Public
+VerifyMessage = ML-DSA-65-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = 69da5aec6d5f58fbf29439c520bd68b966e3dd2ca633b68351c2862344713a1e9c086a44f9a870a3ccc14de62d6c12b278c354d7197c4d6d7f83d1422b29b250f5ee3fec118311d905e5db2b4b8b23b8d542202d6652f6dc3f9d7ed51f2463082d3f145cfd0fa7ac548a47e91c1ccb1a55b215e90ab355bfc6d67154287b1dfae0fb530264dbb841a7684b396e5ca0459d795216416a9d232bc89b32e0f9461f53107c78e66c8e876554e8ddd501867b55dcfc1fb33f102e03373cdd192640f1027a08ce277b468f6ed0fe80a9d6cd2d6b2f7a3738c8325d95b0ccc6e7b9fb000c923b92298e0867d4a9f6dd5513e8001033c633bb1641ee66349487224dd43386c7fcc29916332066a868100d46e2c5b8354c28f087a024cba27694afc4c1665e0d72b37686919ad55052cc63a144febe4e2a0c9ae416e064e289f9f69cbb883665d1130826b7b74e30c94a2b98b67b471663e3d66326db3b43bebf958e8665b68eda90e8c5d9494b0c7c9ec48800910dd6d906b1fcd47a0aac462ac87b126d21b5ba150df61f752257ddf5a063b4a5b150371d625535e3b2874b9fe548960ff67931cd6c12496e8213e2ace6fff48e6bdc60310e49389f62579db26b92ad73e9d3f23942cab51784f48b3660b6450caecbb0df2aa4c8e56577f5ea450d2f7f51aacc0b304a62250bf2cae7b99dcd955b6596625d06da1c67f730b706fdba630f00fd891830d251484640b7258ab364d6fd9986878fffa69b7c44b92e43143affae8b098e1d27716850f37553bf266cdfb561abbcdbfeb80752b364434e64b80429b54cc88693ce03dc0fa147f0741b215f0728499bdc25140aafc976ac99e910ba8a8a50d21b7bddaa28626b3b90a93fd44077068357c81d36e735eda4362930adead4951a0baa104f384fc70e842a9f329e1868b07b455e9cc3fecd54805c9052e70f88c3b92fe0fc6a4d7dda18cf5694e5398860e439a1e19d5a66f2fbc0aacdd1a498711bb16054796c015a715395ef6174e37b04eda589b673c4d5dda737817fb52f392caf7a72d7a3e84b2180cb5b75bc8af065bdc05c3e4040435a1b160081352ac43e09cbf2ead6e09c2b0be0e37894888fe2812f68806f957c13fce6ff167bcee21d4f412ec95a4847f3db7bf441223a4d4ca9ed69adb4de8a4b5b01c775f2721226e6c59ff26fc38e1bb78a384b30e7b55f082e264d8f25e31518619ddd6b6a9faf8aa6cdb5eab75ed59a33825d5ef8b93bde5d120ada773fcc0852b918f4f03e2d2a543b15363adb823eb1f6c533b98d940411e1f5c1cf521f9f63d5454697608326625fffe01bf87f44187dad631df2898effd2c291d98222e564abe3b042b75e90c9c54667842fa8ebb68a1244bf8e0c3ae3ee5f97d5ddeefd986c4bd3f99d877c2cc2381a89abdc61713d38cee58bf69805a485c288d21b15843147066b4a74c69dc25de878e21d35fdfe6746feb4c166606bf3219e42cf63581e7e6bd6570f40f8fae590cedf5106fe57037ccb2324b74fca6500f6ed3d0736cdcc67d04f8fa9e80054a5bd7c8459fc1abb1c4c78677d7f6b325af94a0e5c9c7db0a748e12c5265e8724947d9b5c4bab1a8b6faec827cc41ec115ef3c2d7348cddabddfbc8436f3b41765e13f3762b3b45ed23156f085831e726a55d4b83848b3d1d3352aab9edcc0ac2388f2383f6301ad813b917ee3f23734e057832ae4cf65e668c9ddd0bdd0f9d8b6693254649668aa91a1fa5eb7c59859bb6ddd36c25f4a2223f5d688b480d0388fa307ea69298f9bf7737f6b3dbfda87b331affd75cd8d88f0460e98ebc2890b217bd6d11000a3a088cd837f4f8859a43f76afaaab05a0c3007a149d4d6b9155cadc2c9b55003efdec5012b6272b87183694c505f0446ede55f35b8ab201f9eda974ff840eccb0f004fa3acf753acd0613f66e2a6ac82e322199d37b4af83cbb3d98371c31be79bb42331e819644cbad2ce27a04e4c517998692cd8331552892e199a01a6922bda4d38ac4c01f708809e529c3216eaab399ef25b350ea213ba47126f278140e17391ca7139bd13c56f415e6b74aed8dbfbf38c95dc6db366fd72aa863a27fa1ebf198716400b978a3709e35039731930406588ebdffd35fa230a9b75fce41d7acd214ca4f0029896c137495eade0cf4d10fe621c73f01061acb077de72177ff5dbc6f0c5bec681aa34668ca4fcdd727525068b0b0e9072971b84ef6ce11d5c3c6024da40966703dcc2b33ae04f677677635a55db508f34f1403cdbe37960c8577dac3d848b29f3b5c5c6c56fb74f34c8f4634c04b8cce9b218f1760ca00e6de87efd14087c633469c892bf3e319443336733bb60cfb44941bfa25229aa24384d812db90fe74e0f93fda005eea87400736cabc036f71421b6657b1674d4a8f76cbbf3a8b1c0af82f72973927752257c532db439d96762ad64f102551a9d03f9ce3d8cc850c393c128bf8054bb55bb92ea31ec0706f083a9cf90424c617f8ad2a21225d1913c30e8f47a6b7131304d536a85596ebfd987b64b6bf3c51638d6c839214b53c3c10aa52bd9c6eb77fcf80b5e3b724dec1381d0e02207a6adc73ff53d9d1ffcee1c4a28fa5445ce518eee937074ff7a402f5bbcb362ff090415f9dbd93b62ee56dc8c50e4d2e34c6c621650c0dffe311484e95d68de77170c909c815828946aeeec7ede56bcf433e22fc63a33f764ced1f9242f3d26dc7558686e471f30fbe9304d3d56af8b23e72a4088970b24b2f7e968c1d0392eeeb0b0f0ac8c176547a5383d948ed15484b79e21314a1f28ed624f61e5aaecf2269e5b027e1910ffddede52fad4e8da224e8a10b079548fa7cd44172f4991adfd7623d13e5a19c812824bcf990c07c9721ded9093be6ce7bc7da3ac8c932133a64396b822be92b088844991596df893625a4ef24543bf75a10d7d17ff70350ef62ce3a7758aebbf9b3977b08becb9ea28376082f607965f2cded28bbdb39dab7e00833b0488370d221742b66e27d9ee2d9dd07f401bc22a62c8a9d8d3a290c63804991496aafa47a32578f583cfb53d0c2199055973440d7535e0da6cb2957f4e04002ecea68f9c3ff76cade27ed15fd7835989d0abb197fe32f68636139a42710644bb25860ff33f539200e3ccb8a7738422ca0fa0c744b4c19d15c5d4a3cb082e20a78e20b5a4965b043595cbcacad500b5adbb6cd597e6a4b9c5ea6a1f2e653b5474da277f1818048094ac9e0e1e0b20068d1c1ce5a114a4db7195057a6ce4d221c336fdc29190fee8ff855cae8b7f7c02eec21f972c827066d9c6dcc4a4179bc44ea9b88abe5124bf78b071e09e9af43f739a6e1030091fc091e73edc447f25c68bf84b8df7aa8f091ab42662b93e02c27003afc7b0ca69efcfa60bd53d4d78ceb7c4d2c8fd5ed7e8b35024de849e06400ad145fdb28348d22b317ccec704c401f88db1af2a5348223f5cefd914e404c9d73805d0de77211881486f1bf4aadacadd3ae2588f0db7b5e6957fed50a374f541cfe5e4e923c82ec47e5b3d2c70ad6760c79cd5080b490bdc75f9ef5e1d17f0978b1e8770775f902b9463e6980e1683b2454751ba2dad4a2e6460924bd60ff49b03230cb11fcd04a0388e60874c35d3f6cfc4dd487665e1b16578751eaea89e126bf58044596e3188c7a9631017be1f2dcd7d612331832ff8755460dc496aa99a61ea053c78e72607a18213ff9ef4bb880903b91e9a43e0b1f0ed1511b2eca2f4253fcfbd7d0faebf3680fbf0a45df231544882c9c46505c726d56905d02fd046c1652d8fd06d15286a1a8f8b69fbd825ca421fd80f5e9ba1a23f924937ad049adeec60c78fea1adf9b1ef7e8ac4d1ded18f1a801b0bda8fe9a88098825ff3eef5c1fc68cbea143310b39543293f3f5fbcf4773b02054c0bc79f00554947c7604b36389c0c45f597a88f3713456b4cfd83b30cb6520b624aa09c812066a8cd542dc67e19e4c92b562b4e0f6799fe57d9d4f4f3e0b6fabff4b1fc190bf1e78775ebcbe3655d370ca6c08f48decf6153a4989eeab6921f8475f85197f51d651e563994257df57977e5f219b4879751de57ab0374b407a21adb4ba520bb35e7b7508675bf49f4e432190451423cbd529fc79b22baae9cb1d8660c3a49c456ac03bc06c0ef3b02f7d8acd40919315206fb38e715139c9bd6f89a58634fe683df03f5bda719764f6c38131bc5ba1c53244472ef73834ade04b86ca08dd753141ac0a9a230e246735060a044018bc9b75d50134b20e6219c13f8325b5a0201e9453f6f012fe72e829ee1c637fe30037a9212a31c6e713726a6cd4cf2dd66ffdba77f1e2800e717940f231d04aa2e4e88dea084754947d848c0271856bfe659922408449858a81fa6583f062d96898d18ec53664f0067eb9b9c40ad2579ba9802abd8d1bf287e49d94ae397e784db14b5f7010ee4fc42e6e3c8ba80370afc188fcecaf466ea830d7b16362e5c9329980b981decc7174f3ff70a35d8a180ee12ed0cbffd4e8d14eb503387e4959f702d4293109e922eb561371f9ab21475821f8555d92f0aa1c3d841a6f1eabd4e663993636c754ce2b3c3f6a6b6d0b161e777b8296d7dce7fd162970496494d4f60716244a5a7fb7cee40e1d565e6566697e8f9300000000000000000000000005101318212b
 
-VerifyMessage = ML-DSA-87-Public
+VerifyMessage = ML-DSA-87-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = ba4275ff54c22d2d09ea1937a0667362acd44925c6d6965fad350b111d1cbcce68ddbd0e576d1a8810eb4e71623781f32f747d44c8e693749df191682f588906949d97617a4b0ec54ad966818dee88b95f0f28ca24bfc5bfe0c316140b0662c43093ae48b899cc71e5739e9d67095ed987a79b6a0e7aac960c3c4125f0e92bc9435d10bfffae34bb3af05e977ebe0bafcbeb2381c5afe3379667b4c201aebf162dbd0a4bd1baa88fb2f88fa970499a848737d3cf94cc8ce278880a169cad91f304e4e8f1091d4cf39d9a3ab9f88dcc6f3bc4df311a5be0cba290365b3e879527e2a77f0cb6eccc9d85a5e592fb00f3a2e925a26d295a6b82746d7f534c83c35bc4826ee4910216b9a2867032698996fb0e1669b539ccd2ec74d181f4844e8f4d28f9c174316c12dadb54cb1dde7338238a20731c2565bb959f8e3086273ed03abc7ac515728750633083c0b397b29d385d13f5afd2529b32f00dce66c9dc8ea93d99c8b61c5e0ab2fc70de2a8dabdcaf290d53e8fca7561bda8c516ad475e4ec6c7cd2603aa3c8a71d9fa5dc7efc33cf318bebc1f1594e6ea25c69b8f9ce34a65b8ab0ae8dd3538bd267d86c584b8f354d7e4776ed4dd59a73f9e70a1df572f033b69b3eafa5a901e02515472e37258608875ca469de07db71cd6b8dc7edeb3d866ed2d219e44fcb133a066e89d8e3013569ca6f1fee7bf4ae56a6d32a5f3e5a530819c31aadabc8a88503edbea9cdfa3171762e1e8bcebaf9bb6af7e540102d5fc810bbcf1e02ae564e04d9dc55dab0a9392d6c95a317730d9793954da2cb16544d15403d0db01e85881e2d4f1b9b98458e1af0985f98b014f08f200558f2fed7a70c352a27423bedeebb3775c0a1ede9d461d2aea303c09c8b1f73fc37a5b3a01fb24a131574f7eac90c78baa38cebe81e2335dafda20299f76d6a0ba77d2954d11381674f4069f45e133886d64222d92583d5908e3ab6eb6a72cfb41f7dc3e71c1383888f61624bdcaf12fb716de98232ee329af1dd045f30d377234db7bfd11ddab0b3108329e16ce568c8bada39a98df5a5f72a72f063fa4253313a806013f61ce5adbe54cf42180ebf6e496bd4b42aeacf069aaa8e1c231fd037b394d78a69d1742b45bc5784ab8593a198077423c4c357d734f9899cfe9b3b62b6b9c3f4d781b8484a3fd0eea7e8d6945f4ba2b046fee079b7f032bebbc402918daa2aa1c9433dc3bcfbd7f49a5d7a293833c21c1bade3e8a7ec3c83d485529de51b5993cdffe23b770e25acab0ab9fb3059f14952d9464ebfa36a6274d8da317a7b07c2afe38ba28ca942cf7bfaee4020e59911c047b2aa24d1787baae1bc3546364b782358676d75c7698769f1d4a0d5dccade7fcf80e308437f7fc24fdfbf72625abf1b0f534da62cf860da1efd986950e3e19a085999f4d008fce38459c673befcdf2287c1766e106beb4f3175e97812da141330dcb2beb3265e38c8423c19dd50a655c9e8dc969f6367f3383b644d53a26875d53cea26de429266b506e70e7e6832886ed06d81738b0b482bd23bda396eb674ddfdb64803d6c4fae2f040170b5a28923279838b7b876220d02dc7478666f7c3287b1ba4a2f8228e8c491a55ba459805c601b986caea27ee9436f63383351c74d673643b15f6007fc6dc49e337a65a8a96ecd7eef4ad730bf3dc1972fc396703ee26af1156dc4beb46c47d99bb69ebdaf81c2d738d0f70e57a2c7162f5a55242255675f22082aa43f5b3dd862b535b2a15bb815b4e9faf16a302552cd6098d40930dfad7a7c609d6aeade814242a8bf0721c1c26d0d3daa7a638880a6411c6538d80c259d31b639aadaea49563a8d7f5ddb64291d6b086c80d72bfe7d26802cbd20fd6ba5495011e42da1c82483cbe8e37838e73c48f79f65b205476bee600399feda6aaaa939eee12cb34be4e6bdbd18032c85b54a2713551de677a16ca0142ff97b77bc963e8f3c57d91df9b49474b01ca514641842893abc3181caee3f49b635d17daf41bcc4aeb1116ec4b3e78ff1480cf3a5d9c6a154384b88516834d19196976e2ba97cee91f7a0d73f7f8146e58dc0fc8f510511d39d82a7ba531a4abcce6b624035d753a37c5980343cfc7724cf83efb0c33fc4abb5b002241bf57a46b67cb5a4cbd637b2f19bc93b368d97e13c6a62c8443c8222e0a90c3ed1972cc739b824fdf729ed8eca02ad96bd78bf6d2b3d2853e24fa93199ff41635176b31aab2207013d0a9317fa49668dfeb672b8129e6175a2998642ab8e74f0823e3b5480ae80180ca395f5348744a3c7b344891f008aab65914760b5fe852615ad6425216b1c5e777db1a46517cd01a77b277cfa2c6f250c2d68c495fef28feee6e0716817d6b30716f5ca48001805042133eca17a41c2219784ce0f12858ccfd371c77b90966ea04c3996851edf31aef962946628007de5531b06fddf3449f6c552eaf6e16b3e9160e265900b8c8e414732505e02660e123d45a3d6f1b15e56fd759d38e821e27e84967e95c4b0d2a48e008897e655d1b65b76299f1e3074209abe44b37f8786b02df23aa4dcebe512e6312f1a3d6d781d749635247aca897626f5ee688f517df6cfe947ddead820f07fed4bcbe7f1bee3f19117b5666dc123d528f2bf03db346d6afb53804b0681aea98a9479fc6de5ae974d2c0d2055f07ba8a1d2d8b6a7e08a6805bd8634cc190c4988b502f475c36d78c7b3dda0057c818835bbf21c5a7c13bb6fd91cd3cfd76abe4c2ff908a08a3000b9021500ff94b297cec0fb3e51b1cae7026ab4347bfd5b6a641a3d347f45a2a2aacd22e521e00da0c3986c67672c5d7d7e61e7edafc15d42aa42cb37fa8621f79e9096b092efe853ab318b3e4bbd90f20165a1be1d3aa5b3de43751b65abbd952599869778393c4351ab8f534fd49e16547df01c40bfaf56de60b4fb0019bc34177cc8e2236d219fb3c0b84dedae6b88e134280eabd1823420cd1afe6d929774967fd7d885fbad33d89ed9dc5e0eb978eab5d96c50bed5887aa8277880c7b06bf2780cee82ce639a1e3344c88a25102edcc17a4cb48989c4ad6a998726ede31deb0b98107f40858bad7864983f6ecdf0c9761a42751b19d5360daa7fddbbd2e2292638b95c763ca1e747eedef0dd387e9d9ec9e5afee207d8c45703c5befc2de3878d313655ce85ad984250cdf054360f33d41dc193060d42cf9528b1fb91d6ca3395199e25a1a7739eba9a6a4ac2c417ae615940b3eb1b746dd0ecc7b2f7acdff887110115629f70877dafcd7a6625fa1b9e256bc8fe1d66005dbcf12fde0a5fcda5d4f23d58ece91d60eb91274df8d9d17d4a39e63533acf1b317db979b04ca3ab9a0bcba652d0010ca3fcd33ed8f8a62faf42f78b37912d3adb410f20bf16b31359cacc25fb783083a3f065f0a2dd6fe58b8f594e11a87bf0f4c5f5493f334c18b03ebdefebce50228937ec13a8c221b617450486291071f3c14f64f66c927dd4bd623c214ac35433b8a6875cdf00916476eac0f196858aa1484bc1cd45b726d33a965619829b8deaa9d9fa0c3c210f23967ce26a4bdd939cff8aa662f70fb0af97ee44bcb9e2755000a195741d8919e4dcb1a5caae21009f686fa1489c72f16f9fee76b5410ece7f406947f4a19f394a5121da79f3216777b0fee5423328156ecf0b4548dbd5b3f7b526d6b9cfd57576f67dd521c314c2d37474ed0cf732c3b073a101c735a4c4e6b33c9aaa12c91d147ad1075a20287d36c388657614a9c648d8e49cce8cfa282b2a2e8e9da6e4444e4b6aed1bd0ada5009a335cd0500bdae9a01b97f7e8cfe8372398e750de92ee4a524393a19826d19de5e762fb53a88b9b4657e9c6d7d01a4124e3e39532f614aec5cb88d982b78b2ff568017c92f6a1ce5298b5f323b5ee61695038ef0c3a7a339cfac31cf7875a4563046a40e7b35cef1d37d811b342fcbb5373122415befc23cb656a619f7c262c443403b23ba20e341a079918dec6f4f801b92781179ad7ac1951f39ddb0b1f1fb95b28c0f4593a04486f0e0e86bb3b014674879aad10f41e0bad34d40bc817b6fd43c1dde8547882d82e5111e208107e9c9736d16ca77ac7453d7b6c7976a7dd6a4c6c0252185bc9948660a07b66151b09b980d8572ae829ab2f6d900cc63066c4ecb3a0317e8a9acaa8e22a216721f3d69c67843df2fbedd88bc424f761cdf420de4ff2c55b6925b1826c1c4134090d2aae82a7f64a8d428efe1b21097a6fdbc9b8a31c4d46c7b32d478bf5b9181bef8af4d3486958d7c198c46a5ad771090bb64e7fc2bd7677ae7618b861c83c13177075063517eff40cfd52ae56650e9e7035f783bfe8920c754e98470b327909ac2a407e07864710544b8adbc075502c75b5f0fdbca0cde5d94b013141c96b55ae1b60ab63f9e792641690af41b05a78233935fd7f82852ebb2602a10459a709256c41d108c2aeb71925089cc79b121eabd5edc54f3f7c8929685b88ab29700c7fb2f247cd7962c8ce6dc9f79f9358d6a7989d24ccc17d0dbaa0b7fbe73479164181ae7d6b6a02678cce46f74ea2bd387ecb73041817b429a0220e1c3635fe492f5f3a8e2b65c086fe24c375563d7220856dd8f970716d548492964a156554dc88810c3c4f81dcc3ae80243e19679a3be9c9b1b8c707b416e9166c54a568bb9d84728c1a283d9231a12b13688ce2362901342652d66bf44cec223f561d2735d977c6adcf57e9066220d0770fc77fdf6ff367a2f36ae20062887beb88d1b453f267aef9bc763ab716bacb9214c38b95f4f2f3f6c236aa71aef83c1ae4b26133678884476c1d7c6d3e7b99f13e028ac6cebddfae4793f9ae975f3d66b725b500e7c7d2f664eaa0c358deb91cb2d6173394b306749d2bfb2684b985769bdb682e922b75555d38dad1899057a64ef6ea361e4712244d02d0dfec8c3d40770122770c2538d6a14a8462ef18eb705c16e5ba30aa5366447c94869060e4df155f7d01ffda04c1ced0ad5fbe5fdd85856e1e49320319687d31a6e4c7145479f45f43a9b8e9ffe4cbacfad4a21e5445e119df2996cce8b11d0f224efb4f18b544d456e2fb1d96fcd99fc319dbd86720621ac25b490f3611f7e5655bb3940a503c07dbf41f4b87593595a66008808744668371a54ce1b9dfdaa16f90415e57470bc23898d13d8351ba34369e96347da13d012b4eab32ada90668654c5ed2b433716b1b4170f640cf4b40659efcf4150237bbc25f72b248be85cd482b55ce2f5f73e8f02efd2465805b37d12487465ec1085bc6602b71862771af13e13baece4916b1ddef9ce016c92db9fb9e82aee5e1c4e22c45090ad1c19801ce1c541ff3902baea7a12dbcac6ec2d128ac7acb203463921ca6ce1d182d60d553ddecc4a3175eec2e924e9191e0d69aa49ca0b653495b8c62b802e443e669220f2a4047a56ed5cb7431a3387a435070795e6e63d242a74555e97371989c6d0040748e89ac316618d5d6eb7bff8d91e953afbe00464df4e4f6380c273b7ac5934cacb6c3be4da6649c8a5ea12bdf9afa1ec1e5053db7668c10ae2df75c4b3b14525369bf33741525a7630158aca3d3c7da5c1d71d3f63c0c2948a43236968d623c6c163eb757f0c78d6ae682ff4e4b673be07193e8d6c106c92851b393f0523491d5152e06de675fa22ae7bded329836a8ca0b955a59cb575395952c6ea0cb1644f2cada196b96b44ee12115ff9668e32886103d8f8109fac4a2287738ee1d2d4c1c19dab94eaa2757ea32016df60d7286099eb010ba570b5791ce4c54d860b15d56c53a5ddb543b0b602b3a87ca5213aa9647e51b1cb1736697506081240f4f7163a646f2be30e62c617d7572d820a113f96320834a2f43842160511923bd1ef4f723a2ab9b242fffe97cf0199c9f2ebca266a63beea0af279f2d18651b2ea9789d03025857c8aefc5f8bc6ee92ab7c6ffed2606f9c7ef25cb6c96140256a08cc58218869c52f3e5074fe5ace87a86057cc29fc845ff275f1b2dbc5991cbebe4c556b29ce3da3415958f0c9c68a5c664a1da60365ce56b9a4df24ec5d69c6f5a2e685885f6973c0ccd4caf7e000346bdea502b1418c8819e05bb7bee31bbd235819b49c892f7dadade576cb8ca68bda916a598c32ec03cceba2d01a7960f38680facccdaaf05e254dd8c3631a7222d1561c998c54b16f17a425f3247232dca035d545202e1b180340219ce31c66987bc86f983240e7fd2c926e8af77e6ea9f4139ff1edc0c323b67ceadead8f64a8004164d942f6aa65a28544d7205d41aafe62c5bfc6fd9fc322e2a8b620532d00d1add7a0d25a9dbaff90e19de14ac2ca97e83a2d77e63888ba0f7eaf9b18a7f2e5f148d16887580e55e894ae79024385f439acd071494e6469b77d07e763553652a470f3b4bd8bb7968052f3a969dacced51572bd125870849ce3e55359b2e17eabc3153b5f62868ea0ca1f40738488dbe0020c103f53678b9eb1c10000000000000000000000000000000000000000000000000000070a111518202731
 
 # Valid signature with context
-VerifyMessage = ML-DSA-44-Public
+VerifyMessage = ML-DSA-44-Wycheproof
 Input = 48656c6c6f20776f726c64
 Context = 436f6e74657874
 Output = e11d24772c24efc107ae3abb0149817436f11684d3548748cba19fc0b373ddcb7c8f68f00407d964570c155a9a34823d5b33345a2bb4dfc43d2e178331bc6573f39d634239230cfc160bf03f41d176854dfee5be915ed6c3f4112fff50d8effcc457708261e715fdf0676831989a15cbd16b92fc97bec06c75919c114c167d2bfae8d7dfa384068c0d96a8e6039e755f9b90cb57b4b0e678854a88a8fada69b91bbbea873f81a7489c0e3612774e8a00370b9b9650331bd2184b9037ce340d82b39436dab990f0c176b90421e71fd182bc07ed70e54587bf2b92c038e8794aded666a6c9cdb29d8747c223967c5a283d3be2946584202a021c5264e04587b3c60bb5ec7a73e2d4d7caf4619e388d1beff4ec4bf7d104fee34765ab6a51108660f052a05d16aa46efc49d46ff42d65bbc6521d8a18c8cbe104de453367bae5c72b43854def8222480746003fc8ec4efa2d122965ef9e0e5b3d68c9069af54ef4511036a079d9bb67a43eabec138d37eeaa918bf14815159b0216352a354110d5c835ea9631075317ba617085f2d86215c09c288a584add2809bcc7f50f9071fee5ea2fc08020f2a106fad222155155018f67162855ce624328724b659c645cc30c6382c6fdf48e1c9e8499bf6f8ccd63f06113e3262efd0800d2619d59cd8966d847c2de3854634f3b5e83f84e66cac84e1013b93fe3869f270380ccf8c26591a2635cfa048d1955516560c95ce0c39b0cd7c12c3234b13939386adcf557118f21811c3595151919da2bce155f9c6300703a7209fcd893305486df90a828bc551f23878b72f04fe471ed75982175b74ce135fbdf0c786acdefb09829afdaf7eab308cd8c181345e8f713afd5b433a6be59a4e70b421c216a02a16bf0e927630992211d48d71ac0aec3d0626d84456303c3f35c132571eeafa0106cc7ff333e0d2dcd9352b3cdf36a8fec2a750e5c8ebfeed52a94e5f41c1d295ddc01de6ddbf9df9970460f33fb362b0b94fac9b496459c6ca989e90d53ec8944d1518d7fcc21f1adca0bac93df266820dfbe9c7cbce4b762340ef8ea6464d26c5fd4f2b67b9776548b567d7426511aa9c2fdd19d85206130ab6cf6d7f5115dcb7f53b628b99ed8fa1bd6055764f950deeabae276b419370c4700cd37ca2a34b387d644d4e0ef6a380a5e2d2f32376b4b8752bfc3003c2b67111105b775fd21c3e5ae678f79975097e6c63e759eae6b14d60c9778b4bc31aaa4c9f4fa4911688dc390047aa11f9a998baa652eb9be561cb4039bd9801fd62eedb6f568ff4189dffa4c9a7bc11d9faf26499285098043fe699b565545a930d9ce8f5247eea4c5f6df27f3e050b8d01eee5dd1058efe65190eebeaa0742515d9f8f36bd29e6d84e56d9e41c1a551d3ce6ad7e8967872abd60488d4172c56006eb2db95cb25743287a1d73fb3a36ca4d7f7dce22fd2baf10ad47aeacf82b37dafad7c06a6795be40bd6abfc8f998219f2a0e58531c8ccd1bf3ce66b960741a2da9d36971bad67ee4d75e660e0805e889eab0f0be62b38439476ec289e77176341461b474f66f44120f784de5490529a1f6f013eac2dfbdea11275733f1b1723357740a903085e09e8d61a2e2c84f26ddf95fe630a398329e48cd58cbf358b98b839c7f17893b6e913ee286c976bea3a0bbc58177ce0a35a28c5bb4ac6d9d5ffdb9dc626555a55bea17386237d8ccf2ef60a31393b1f49a37329598f706eeeca9c2d0b02ef13dfa6bb9f1e84517aa51d7d7e85ffbdacf23892962d231f67c142df49d6236630bdb50dad047bc84fec4f517758c3f54c77f5f25fe78a12db9e4dd766198d6014b35cdbab0257cc50c7f9dfa5ac0a88c7d107c8f6bb50dee4d7a3e35cc54fb12572d901f02f4e8bf15cb6fef1910fcd5d54530dbca4046bd9ba3039c4ff97bcbfb6d00a16c1f902a25005c30d3d0d96a9d7116b15f81699614afe0aa448973b6da55c18f20395a15d2ac53c5725e45711f9b3050ca8f409d4776b568afa8d6657668e7d6d3553d23bdbe09cd1957fc5c76fb733b237e60073dfff5d64ad3f03d3116fe1db0ee27c36b9671b0efa079cb0ae0558023ac6a0aa36f1f2d887805658131398f78b4c2fb2e0bfc4a37e444015879f0db10abd5b56d5993a3ccc0798651c0b85b658285cd00e898be4406a431e29d861379c26ed26cee7f23c05fba0519fa6d0336120dffd6d441d7de14233ff6c345425b852e1cbef6ac4d442e6f121975b912b9e60538b5efe74c3df3861671b54d96d1d512725fe63b511c4d90261577f8a992746cfe6a4e1426a3d9fcbdb3098a626681ed5c41c3158667708c321a515a978c47c337b1d9cdf6be83fae368d57843baaea2b8b7a94398a8fcdb3b3e39c55a8feceae53f4b2b8967f5a7f671d7cff584596682ed7436979ee9e8610bdcdd0c065b39e22b3fefdb8ebbe7ea59ddb2058980f8c186ec95428a8cea2c41376312a073543283f2c8a970b11f1f31dc531748292cf198c63b2f21996f2bf769d397083f5f7c2da8952b38a199a2fa2698e156cc5550f123d99d4f65852fab97e184f0f615ac419af60c236f4e1c3c209b4eda22ec47c963d6b5318031cda0b1ce9dd0876b0a011d9d1a8a1233c38538581401dcb8766c4c9147d257828a0068a91e458e3a312e398c2b1affcbd7a702efdcb3f79a28d131667545f2ac3d04fefee0228f257e689a85fb92f528d901768a2dfda51f65ad31e1b781759cde2a44adf0a4b84639a8160bf863445f94a04ab7885fa247fe057c161246f1202bad84345aea9e34b77ef93fe01d090f49e1ba3e214acfea26bc04e4bb2ef2f4fa2af4751a873573ee273d8ab7f1d59aad74c8da98232e2562966b6816f01c1db37c0b5a55710011656ff76f8eb4bbba1e5875e954f1dc43bbd0d77b09cfbc57890acedf796507d31fee63305cc97209964cc7897befd20db3d6203a317bc8769b8b0081016f2180eb3b40d24ac1458d0afb8034b8babe87c91ead17f25715104be58a526409e8f5053b67e48d7de17a2f81f68a679a6d9192120eda7564c7970c88d4aa266f7063d6b24de7b402c69d9d14f8d51b3bdff45e952c45ead4e729d195f930870fda380f64085011fff63caca5e79d1dae0b2b0dad7e01c4b7b2714b20d3bb69dcee4fe9e0412420b55abba95bacbc1b1fe498474d8d3a5396968b057b8b5081ddb57eaae581da0a1b482879cdc1bda82fe83d4007375831cf06bcd334ac42c780cb91121eb4021f39f9292a6a023b1010b35d378a798601cd4a6cfebc0f45b1e7879a8f884e3d465a6680a0b8cbd5e0f210111a40464a586184859299a5e329384751b5c5c6eceef1ff1d3864879398a1b5b7cbd80000000000000000000000000000000000000000000000000000000000000000000b19242f
 
-VerifyMessage = ML-DSA-65-Public
+VerifyMessage = ML-DSA-65-Wycheproof
 Input = 48656c6c6f20776f726c64
 Context = 436f6e74657874
 Output = 3a1f0e89fa72e489e2c4c1607b0f22ad03513725660d1ed7cc9a6b83580247a101ff45480e4ba49b1feb3bde46952139d3e1d34d7da0124e8ffa05bd19698be57ffbd5c2411f01a0588898cf4af2b3f3e1fd83e8befe03806d91869eb496c8ce989761da7190e036eb2bd14a8f9e195d5ab8a1b2b11dd56a098c1e7ec6d508856aec98b74850e1b934600b8b7d33cea5f79877cb9b1452a2fbf5fe09651c83c2b965aeb496a2a4edacd4f6f39d56cde44c2f99c2f0b548501220f553a1ad14c6d8a970d1cd6dabd4356568621d22c70dbbb21dab61c10876e34fb20d3f012eec956cdc9ed81c98e2810c218dfbe1de709ceec9dc2eb2590d31fe9855f8a1d14849f9df5120bda5a0392fd6cd93e2e8e5f80e6b30f45e9b409f9e251a0ca2aa8ab99394e9190f3c2cbd1bda77b49f9ac887e7ceefc333cbc49d080726cf373753addfd13fd4204f12c07a21fe2ae5d513eff664c0ae4780f4d4f87a807ec63efe098e7d196223276f4564efdd574402c77390d2cd72f4785501f89175f6d38768b6c77838723cfa66d42e3556077039ee8fb363b67c174fb70f78008229263350c14b54fd9361a9cdb29fdc57909c757f96f9f2c13905f44c3e40a16a92b0fe509ae9cc3647afeedb032464b176b6a1afa78df4fd6bb765e37071172bef2b6d045b9a51701d111b60d0a639c0ba034d5c6b4c146d079a340fe53e9cace778a995ceb2d39f302f066097eec6f65f775a5e803f10af031dcb3eecb2bc4939f478c5fdb96e0513d9ea90ee2cd46ba7fd45f88e8c38a23e06fc5b2c624708a5dee0d00bcd976a8f75e35c80caec5531ff4ef8bb735cbe7ffce86290eef23248b19272692b758bba1de7a66c63a58315e48f5b127849c759d185908a730f1f29272003e6491a0b4aa9446da297338e04a60bd5f8413778aa08cc0d146ba76a5ebadc775af2b0b3976acb54de8910417f857499d8395be90d207615dd061317e5385b886281699e484a7f958715dfdf3ec30d5423d94e0d1657a24478967513fc741fce01f848f9fdb8fa407b7cda2f7a0eed64d9795a2bcc9e12c1d09b4d71cdc9dc3fd2ba82251f0a9fe5ff32732d2306900184e4296bf4b5b92c106d72a638c5f6713f49a7099786b32ba7a8081aaf0ca40f9919e0645fb255c8a7f4aa672999ab84a19b9d759ce478b7492b48a83eb9bde46e7c5ea1883d03487ba01c8a9c4c798a765b18b311115d02911dbaa5566190006ba40f5ee86bc22eda4ca3d0e8fee49b1a61c4057d95cf797c30a7e06d1012c1af3622629de1765d3bd928df0cb9cc7e30299c5148f782af4871556a0ec4358019ef6a434ea3e0292e97c714fbdb3ab14837257947eb7adc9c1d682123a016432e1eea5afd039bfbade397a9360b674832d2c55d521820c0cbe68bdfbba6eab8189aeeec781362fb289883d2a2fe87e287b8d940ad6a4136b7b388b38b0913f2fba42dd079cac04a071636b7e5bca67b44860cdd9e5f9cd77f07e524e9491addac1c6a66dedf5a4f814fa54eb9586bfcb1a6d4a1a166b1074d28a9915167ac4cf279e8d22555df57cfba8bde251483d9b2aef08a180ff74edcbc1bc2219f01fef23d77fcdc1d41ebe683ec96a75a4784945335736770f63a5f000da542958558b5ee375c1c16a109d488d8b17daf2450f35e0ae08fecc139bf8d5f51f1d9a1cd738ac3bb1e91a3bcdbf79c6bcc9a09eb11bc97a7062fc4e4e1c2e796241dc42481d3dc89b31d2337e8cf727c43dd393bb738710ef7ff96521dd92be410f295c765a823e1984e63c534d5f040753715edee4c3f0c78cd468eb9322ae8d5aa92b88bb172082cd08148a8d208d21dac81f0cc516d08f9c0b7097d91bf73badf049b62085328e347e20cd6ac26c64be5271f4761a16ce90ec9c58b2b71c998404e1411f1a1c5c6a6fcbf260eb3e325d1f70132b5f41a279b082712005347fc7d8a6a960ac1ffefb33de83cd6bc704eedd8ee937487635b696975a7156473937d7c301579c4e531170a6d109d50185693d9dbea24781f391fdc1baca492f00867d362797392af50da481552b86f323bd297b6a0cdce20287f0ee6119be14905ec55851768ef95d50130965c6877ee8d91e1fe19fdbef7c80ef7f93968a0d717c354f071bc8cde4d69c84a6e876a261e620a0f7c959da0c638b32d58325b13ddc9fbf566e1f411edc9b38a2bd031a7225551c4bc596958b1c22d5ecfabd2c09448417ba8568938a1cd02068d4ae3e0821dc96247ca6b704a0af99acbe5ec66b28b7c461da48743ccf387771a15eaca6392341dc4657d5c4c986b0648e712ec50f22e3d68b272dd9c34b63aec5686daa5a0f9bd259138b6d967cfa368c04c48657b2de2133b4c47147877e080d5588b09ab0b19d947b6554aaf43601b1c7384707f3091331a0583abc41bf448283eaa4bb001a44836de63e66eef64b04d82ad32c4369bdca012df554097e493e77e1b26acd103b564b6e8134012aec9cdc52eea80955a76d1beb2cb87782157adeadf2ae6c6a4b49c031d6769be9b42e6f85c8c5a6d61947f931c321b45dc34822c8523408c77bfe32048719537361fe6a1c9a8f3467cf5529dd597e19285304c716f9144debdfbeeb16ed742fa17440e02cdae4816699faab22cec162054df5d6ceb6394cadadf5d60abfe5c1dbb3790e4a98bcd9a84f6d4aa8e5934d80b40d8da632ce6640ceb070ee6034947a094337c013075c1a1267a95c820b7eb5f2aaaf20736f09502faa043cecc39f2ce7ebc0a14f846e38fbd514b935d2a46dbeb778223f20694985d27273a9be7e1be3c7dc9b8af87c58d35f4cf6559f48d27cc7eb1c050c76d85edd69995ea3b2e54868556758014ea18e18c11db61c56436ca2ac66260635d927a72cd707ff5e533704477bf9f578848196e311369842846588febd3a229d0b4fc04a5848d98ca55c3996e34d2154efe73a63f052da1ceb72bcd844dad8a4a4546cc6f94b2029b4e2c8a65d2b50673668e7abce6f054d50145b744b8103592bcb4804b446e1b7f4910843f5cba5a34e5b17309eb287c39bb98f6c220024e7582367d3e5e83737ef64944437c9d462c94f61c754a887ae4e5f1d2d64497d2b7fe8e885af00e8e8ad2d998b921a654616866e492a32742f319efef91df3f2e3d2697a4a12b107ad94da1d64ee6c67f0e9cf5aadae3eef52a22ebe342199cbcad564cd11685e0678ea3c91bcb67278ae4a6ce5664e39e86c3233cbdaf812516aa824754f6493cd5559848a71275b35f503ac84ccec4fd172b09f9ac40543a54059eed72f77eaa8d56645986ec8767e78c2df76f33e549b561b977fc5daec7436735a46956077b661fd05dfa124fc30165d5a14d9215e75c3134cae2a7a8fa490dad2fa745003c2d74d83ed13db927f4dc5cfd856c758b39915ccfb695c915c3ec5f3257ec38a0ddfa1401c3527ca271c856f2b00fc4f44416f7a387aae1e88ca212d81a6b4ca1e61c1ed2809e41e78ad8fb170ba1e0b138f061fde62eb7cce2eb8ae434b37fd4eb78b85990e7f6d21b32b4cf9dc57fd9b46fdbaaaf25139315a99419cfca963b19c3fc2923c041bf43ccc6147c3f9736a162a20152ee40effd6a3a29523d77dcb14a70b4ab512bfd11980e30bfd77304eec045d50b5923e22def0c83439e4d0326d9a20e53c43797dcbf17014f80ebc2b66fa6045a8b402b7fb182b43bb8ed6d569568732723b0f7807ac79bb676f35221258fb1283bf7c275b2872f2c625b7e1211b381454ce044a3e8a634488ece71e6fc58b84668aa744302b8a061b5674cdad160c2d9ef600385998c9f002fde9c829a6be84fd27b8cdb8f328064210918f28189e0dba18535d978efa8a8157cd5a477db7e3c909a54ae886008a65ebdc3eb3f06b89ca21ac3981d064fa15f01b1ce801a2c515af3298c4fd5979e6a651cec9ca50476773a755f96478397dda65db9fc32b2166dec033bb46fbad0edfd03f3c543e144c15dbdca9b83f2c3f0d5357cab1180472c7264317b319ad50dbd476b8f6545d86e5e399cf6177461141ce2e438db3100a0bdf957266c9758f7039817141bab0b3ea234c317554a1b30081eeaa6ccf3406a2a3e38d0376d2c50ff03e770be90cc3bb1c05ae9ab546e21d5f1cad5a4df5b53684789e534f2983bdf41bf9244d9594e889a2eef8a64789b0e327d3b48a06229ff0e48d669cabd64b7d0aeaeb4990571e275c3026a75106083b32dd1f33511877c7bf78fa415243d59474044bad21c773e39bf48619a7bec8b55b951b79f097cac697860b20c09bacde7a5e8054774db8da54742c32264f62246ad1945be13f1f7c856810e9205fa8dd797fbd4def035107f85ea309c1565f0ee1fc1e312d0bf753aed6a8b7704d8a1b2e88703511e6ec48c17ad33cac96aced306c8c08dbfc12c242d6fa52c4e51faf4cd3b331f57544f371fdfeff6c2d5abd7a38ef1abeef3a003aaa7ad6d4dbca80cde878cee6c46429d86c64c73671093e9567cc807f9f3cd9dc501878051166220c2d90915ef8e5eb46c0c07befd7a63cb38f5e9b4a8f32483d998b67fba733e7888c6297359fd32791beda81f7e8cb5d8ee05124b646db4ebee1e477c86bbbdc8d9f2151d99b8e6f0f23250649faadbe7ed2642505d7c89919bc10000000000000000060e171e262f
 
-VerifyMessage = ML-DSA-87-Public
+VerifyMessage = ML-DSA-87-Wycheproof
 Input = 48656c6c6f20776f726c64
 Context = 436f6e74657874
 Output = 62217e84cf857b184906ba906b223394356d695808a3beac5c9df51dee7b21500679e5b9ca4e4abc35c150ed56356d3050f559d54c176f57139afaedf4b688d440f5db3eb9e5fc6adfdf9767a53ca1db1e74b9072bcfefae88b4d0f2c6de415ef52621f4adb28ef54a0c6e86049548a5b2152f56d4c394114bd088ffdae4fcbecc2ada3b0ed796b5c5e4e46ba101d4082137d93c9d0ad31c5e6117cf4bccdcff664b0d284c994d9ad7a523c9eb202df60c5a1213489af6a13cf4870d60825e41ee282f1012cec3a69edab1c7ab5747c357fb084c699a6f02ba11728b25de7fa9de00cefefe82a62127dbed26a94c4618ddd47e8f781c21c38d42c5c29ae7e0e4250646396bdbb9537327e1f13fde1e4e5ec2aacfbab95204f9a623a625bb4bdcf04acb1c26f36c77909468c733bc379e7c5d9aabdbcbe21ec13c955d461a6721936d7850e2b13bd72947493af86d7dc955fadf1963dff6ae298606ca365f9f89d32c405d8783cd9450a0263733d13dc71223a019fc23b0bd9f80b031961b4088f50b04eab8000bf76a550f28058e6f6b9f5464d8c83d3114223dd29803ec0e4a7af815e21d97a6613bbd21476bd383792b3d3d65eb7cb87b3e18a883ab2051e7d8856237859eb352a24525f48258374615ed9983d3a9f0a30295d6f2e43919ce321d8508796646834d16803eb2185de0374bd61f3f0875e569635380bd063e5a66145289a80ed002c0474b4dfa8e0a2d7e3659684e2a3298fed67e53dd75f3024326076d3df7bf0b8554b46e271fd2c1075fd86df402fa2069964d1748f44f0fa79931335cf2855724f50ff62d72e316a06a82d85a7a1a588291aeeaadcead38c53f1cda880bd441caae66b2588bb93c18dc5db8bad4eecd43859ab2038e5eb151061fb78c6efd9476c0fe2ce070d0b0d832d46a3dff0d52d585c71add41e3a62f4f8b0f70818064bc4b06ce7cb239186b50fa687271056786b52a1f37be5454550091591aa5cc84971c5d8f1e4b894e31e2108907d0be93a4497bdbc668efd6abc9ca9daf86413a4746288200486f2d2c607d5f09c8cd7a1bf9484cf9335fe5d06f60412563e79c41b80f3e56ea3e02391f1c4aeaca8622694cc26bb1fb6101b199f263ca81db6a75d335a814389e5df5c12fd00d510feea725a9109a1adf00912ec7f2356e55b96ee7303561f0fed9548487fe3633442df5cdb61ffc33080803a8962f413159859345871b17183e783cec8db3a2ada8ea3d55eb7ec73161073d88c654e56754d2f8d1f421048f1046672017e2229e17df61f03109e993a02102e6807f8756b0d1ee499131ea0ca8d4156004a6a0637788bca407093ac59052edfe0de9dfc53f50f545777d2bdc0bccd985013143fc464595f084e67e342271741ce38a96d4c4e3c4f6f9239aba9d2ad5c23f1fa8d7bfb60b83beb67436ad3881ff481543febebbee46f9e56b6eae7df3ce8b1f1203c38fbee440d6a51edbd10e4c8894df60312ef3261949c9d79244e47d5e98c4ec23c10eef7459d01d485df2d13403a16949df5a6603c73925eaba5fcfb49d70acbdb3742f45725f50224fd4062516b04dffe6845f78051f94366b0f78e9daa12cdbc6afe81434b7bdf9a66a81a2b68c5aa91f8dd6f02a49ede5f4e5947b33ea072790dd77159d7caa71ff67670eff0d164b1cacefbe5af46c68cc124e680f74760064df229905c670bb573a61c74dc8d948b87dc948d5b12d6327cfa3ac48270c3713f4b96ce7b9e00185ef74effca6a4994dba8a3712a986d72f8b95d00f4c17022c1ef97deea0346402723d62f8550037a604d8aafe6cd0a5063892449e94693e53b3a71dcbd9c94d8f78b1eaabdae982a5c7a23aef2b7e055851ff53206785c6270aa10c3f12df291bf61140b38603dfe75179a47736bc069abe2d115bb74585b86e2a449ad51445123eabc54070a42719e67f75c2fc411ce3d05141353cb33da779b0fa6e2aa6f9a55da5edbc85952832a39ccdd973fc7fe0fdc5c5ec4bdb68913ce8f2580507e3b5e16c4c981a14c027b8becda417cb1a9428693e9505e5a0cf5d9afc1ea715abecb49b083d05a4efd5e717bde7cbcc4eb74f3011ccc28ff31b9a74459d9fcf1d036eb78c1c85b4e56729c1d7e5135b99b89a8f238ab69b7d730b3a47da559ab45e004d844ddf7c9444241df1291e00e89e91b42d93a1bfa1168042819e28758c5d2b45c50870ae4e1d3f7a05510e72f422e684a29d71a7ba484afbc24026263078bc152446cedf142102d3395ecc6d32e98e5e6e3cab52918cbd86c11b86dd3d80c4b75035e62ad78474f5870f0fb9f421e109f0c3152891c070989d5ecc660f3c9b1bfe86694b7712c4b63cdda78380710268a72c87275641c7236e3c7c40b368f53c98d708794b469b1e19c728d2ceb836262d15f975d14ae5c822b13c3a450e5c0a4784b7b93949084597ecc4f86a06960619e92fc3f5ba1e71270f0f5f8ca6fb35aa9fad66e93c3b169af95572022900a3ac4507c005d518b7727639cbd6e315ca0473ec98cf2975df8bbf7f2ede7090801cf5931c396a5eb123a1c73471c5483fee67948dd28e5a9e6fffd612f59323a39cc3630b43c0b66a74d610236aceb442cce8c67c051cd1b56af5f299c3e90a82848eca945602289cae9ba4065e86b502147c06e8c7b76fc18f6ae33a27a1661f60cebc713802f43ebed8ea8867c69e97d4fedae2679f88579f7bd9cface5ccc1bc48eb0095659dff03f1b0babeff8a09f36e7a29a9afc69965e7b70f63c8e7a0c5da68ef6bcd074a427941045fd96c18497c124f5fcdf34b0f17b29b22110fad3d42a6399cbe6d7db7e3b0a93c3b9e71c068a9f52aa70f677147689fc79e367edd5abefe23252a4536ad1458abd91916c28fec848ebe1add87a9e5b63460a04163dc8af8051b24193b1d38ad64740d10ee2bd426e36548edb8183e8a2bf788b0a8323217ec286054647d1996f4f88772f11f4eb64b64d0a240c332de938756a442ebce2a6602c01bd382f5c532a574c5cb3401187590c83f84708b72600e87abc0e77a1093b5d0a70c8bd62067a7bb7a2ad7350c1543817c62c5bfbb6fd3b45fee0d77496ff7e3a8b5945da9990fca764849257f4b95f1e266b8fdf433fba3815c250253def569dae59a366d6cfec2b4b07c907fd48dec46be900505b1cf58f0c43e47bfc9976368887ad85bcab920f3d5ca37bf28b4a14b463a61f71f5705607077d8eb7a21d111bff390508367c05caf85bfa6b91fdbb78902b1cc27e24ed274c456f77e8c08fa6086c5473c4097241377d579e0661a0e5d0c220c2f1c133019e9cbab3d49804d0e1e51379926d65dc28a2a77e3227b3c8574978845d68bc8e3a2009c1f78cab1a56a5bdf0e7101c2069e9f450aa2d671a24f8c22a97b7c505e58a8d0f584adca28e082826c6b35b0510966fd7d8d654bf73f55392eb3c29f51a34156f94e63fb563c1707fe4f0ec99e06e2d6e61c7390084aed4334b74a24b690f4b3078bc88ca62c29f10065cf23100c9fc9a74ac389b2ccb112cfd9c7f244e306d7c18ad64112a7fb97721b256fd4a740841a26a4682f34c4b739f734389598bd4c03d910c3e3ecaab5846dc3f7a6cd4c04f8e75ad7a7ebbbbdd7c88856c0d9508c4fd17e4348b8b6d37b3baa849c1bfe14ff7e616d3cf8fb9f25e41a9c364a77ffd47e17eb69285bd1e1d1588e7101a52cc67ff28d49f3f679958f1f6557b02ac52d459d9402ce167ae510f07d6823b12c5ab53ea2ff3e8b808e14e7617886cabd14eefbd5240170acdead50e240a259c026812454c242f63a9705ab4b25edd5f7234ccfdbaacc1bbaee7326666e4829010723c0bbab7ee0b4adf4f063e1b71f531f7847ea1c336d42358b37d398795a0fc5f239aa36131af6488eb6c032f2f2985073a4ec1b2ee7820c53ca42c5bc3dc8fa2fca0b460b4e4ee927885004fd2776670b5ae12c927c6a6b9067132e71eaba5d28981620534c6f97086a747eb8489aa0fb33b42ed74aacc0c01fa5619f48d8cc35af60e4d28608f4de93798905b3755c20931b9b190baeabb2f66d40684124ec44d467b474c55e4eb7cb8d6ffb31fed60f431da8ff665da4f8bb878570964a412d72e74720fa1fbfbfe11dfa6795dadc7db02f9ad62e6f93d3da8c1948f6664cf0f723f944741b83565cc2a78a82631a806026db5c4ea68f322c03b722812aacd56379833a14b288725502603bd540628808f9b6b0d085aeb3190a42a4b8d2d61b7ee4da8d68b5f8cc21d822a3413fa21497f0700b41b98fb6ea0ae570572a4b8a851dc8f8075cc2add19485271278d9f3d8ac4aa04175e65bb3278e33276afe0373f55e8fe67ece00a11de6ce42eafff13b56d14edbff5025c6a170f592e45608c8d0651e5026dda50df3afdf680486e5db5529834bf338d580df00f3f14d5e59565575eeb1aaea2521415a6926fa4963b16488b17767a279d457877cc71c6bbf77a636507baa85954bf889fac3823a3e6350e48d151b30311f5f08376f4d153fbba6dde1556ee9cacd47137f20112196f99e33a2a8fc2334e10b561c02ec70eb863adca5d7a988f33c00fa21473c8c2eecc8332e0b05ac4c6407e5987b94985b72531dd945391e4720fd0b33199e35866c9b68d88664cd81c9073af42c796d29fa8b575379c44336dc12a18d9faf7934d767cd156fed42c204c1f0739fb76fe11ee69a766be3257cd3cefe40af817797662e4424cb9fc7226eb23f14249bde2ae7bff15313d47208d72722b46a7042bddad08522b77c0e04c200cff19dcf78ecf34ce8763ddc95f67c01284887a3b3b45adaebe97040ff871f336e37d86f27be5dca7b8c98e95f0f6eded509a4337ea8a2ef3d8313fe8b413fe06199542f8cac04433f02775cd4df62a412d26613977ad7870daeb8f2fa50f7340dda3fe8490858ae686de7ed19068818b57ca9d31beb413368b0a31a247a5d22775c33e1e684aec3f4b696311f2d1cca69f09ff7bc98c4f2e67184affcf8dfc2e8f55a643ffc2666f13d669dc7f999dd75f722824fdb2cdf388147be3c1b72853160214d1b4eb0fc4c3563df53f6f848161de8643979853c32eaad84e9abaca21d896aacfba9c10f79f709afe4845395a5a6114a9b8424ea67a5de6493c295c1c6df434fae8a017163c7e355d46dd7cfe4a2ae8035900c280c2f347faf62fb503d90673e812081296117f1195e67121c6c03893ed3a784a0a0c2104838c8d179e07df7803528ab6186034c68e24b362b752284f7c22a73d73189af93c4cee07c87ef2bfa84f47d04ab111bb684808722e6aeba4b7cf593af4a0cd05057419d2752618d4f5a0a84b7a75864dbeacb8c78d6c6c94bfebcf29eed3e543c941f1a912616db4551b39a12a84f6f43f89244893a489b15c1af5e3a2f7af01975101fc6321564561d056740d0898a1597e8795fb53eb7cd9f126a992e136ed014ff506287e3d2599cb520204696508bd00c66eb4c70a78e24df1802db88448519eebc4f3d09cadccd4c15b0bad8edfb8181de86bbca1cf0f8b07974676fc5662911398a5168a9eecef932f0eadd9a6bcc26c1ba5640e6a539f6b64692dedc96f44629e74f1ea8bfd23bd66e6666c06b7146ac947d9147b724a1f2c0adee7e86ac1110baaf3c430d1e1d892047c5bebfc3fe47b0bef928141213b943b1ec1ddafaca1b0bd48275e9258ec9449ce4fd1e7d2491ca4a6fb2bae37d6a9e8f67581c6bcbb611a8653383518d565287218c53f250c3e7c40649815f6413c0740b1be6021c4c7b2eaa19a0314355175f39b07c695e83cc1da41cdcbe1e7851db91814f8c3fc2ed9f5c192d696e75109c366e426e4486a707cf27f2cf48fbf1acc38879cc846ae09cf63ebe84698601df4def027b080eedf4f173dbb0282a6028b99042ddd36e27f78fa05bd279ae776f50d83f802bd39e6b4201c02f753186eb105f00fa089d57d25983798610b51358cd9c344dfc57f254bc9af3f34b0ee56913fcfef914f14f97a91387238bd2bd328ff37c2c9d71603fdbde89014a3cb0f2ea39ae86988d6762f99669b70fab81b353a73e6731c60f70f35a8a1da777f760441a1b24981e1cd98ef070d8b4d095f200ecfc3a085f6fa5cf6b2346ed90d8e96e21fa207dbd8facb146e8a3f23964aa6c7c1b7f124ffc2f77306fc6a504bcba9ae2dde7b12ecf77b4370a4afaca183e353b966345d092d254b5ba34e9afc3460fae9f4413bbd58e2ec8518bf243d50f737feec6d167914410218be4e2f9e83de9cf822039bcc4696b282fb4a6d33a6f93570133ca5e1d1f54d14025a1813fd74aa587ba7db0f0974170f28ae378f5d2b2dcaf8d412b75e8310f2c0a92498d4e0211b1327b96cdfd648b3548e342a96cf3770681981d20dd69b2bb404bf615946c0de26cde04666f8ea0b3bbdae5f5f61b25515cb9e7f244496d72536c6db2c7c9db093339418a95deebec3337445391989cf60306101220b4e3ebfafd3a464b577f88b3c700000000000000000000000b12161d262e3840
 
 # Context string too long
-VerifyMessage = ML-DSA-44-Public
+VerifyMessage = ML-DSA-44-Wycheproof
 Input = 48656c6c6f20776f726c64
 Context = 41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
 Output = 709f29109a222d7b6d7940b47871f1df24848d52ca384eeaabbdcc4a885429eb21ff9365296045fb58ce67df5385e91a3410e156bd08afcbee41651a9cc82206a73e4101a97d14b7d047be924e63f7cffd15110f6ca3449bd49471691d2d1837c6c60a6663214227d3f929f395f032ab2e902731b3ed1a9f7f914dd01ba1bed18aafd3b3e7ffb754e6c7379d1b1380ec6d4e8b48450d8017ae70e689692e7485d54bd12c89a3c5f03232dc76c36f0f2f817d844879be68f6b894417691de393a1b3be56e9c55b353ade6c59c31a6e92deaba02e2acb0b2d71fcfadcb7c28c4b5ac7544c23376a348cec1459b6ef65e03cfb5bc94254a2f9999b08e7fc4a3cdb821e77762b5204125e676eadca4522b578469587f2411da7ab058c12bdd8bd9bc8c1fc7fa20f9c32d9f152e56cd1668c772dfaed02190c10ca6c5972a068b029ef40e65a0bb5728b188b1a4ff892e5ae825f76e5e145f52b63ab137867830be43ad47f33801ce3f92ec53d6b2fc2a9e50d73aa01776bd75d82abeccf7e42d7fd62ede9ff7d7d8075c1fd6a6c9feb0141b8d0500e21e093059dff78791a52da4fd11bd74603ce0eb8b407f8e4cbdd905f0535e851bf3b554b1e9cc21e5f8ed83574c96bf12090a5d5bd094012b9cc63d01bf74e755a7c40f72c0fac2a01dc630a308b01e8397569dc956f3a461193ac6b8559ee3ba3d36ff1424a5cf930a873ed1120d8a85bbd910b6ec1d6d98c4785707d55ff764feb7cf3891673c4c76ebc569f5c6dc317d1e28dff0a81db366fd0b5035b7860876dbacf88349425448f37e344c260ff922bebe0e596cf5a437b4547f0389eaf1eaf23c6e247d19006a53a25a5f71b965c99d78c4939ad7228da729a43edc333c559de94bdc620d1d6814bde11e8473bd65be8fc76b2b57e7b3610afc8351551b1de5c1b853e6c022a61b2a46a5ce5a86d3e781218531c2d1869bb9b316d0034faa51dd6ea6c97fda52500dfec10dbf207f4a6aad067cee25e55bf53dea3b74a684fc42f42715b7bee9d3532039cc829197fad6b23dc8ec102987ce09dc6aaaa49e1e6c5a23b09701a1e51c2f299938ab2a6c3f40aecf0e2b88441d1a23174e8711e05113dca5e3b937bcd53cbd8906e977170233b15149a020b8e6c74374ca4ab4cbb97d22f25922fdebed31aacb512fc2a83731a7f691c92196943b35a151ed961e53f4e7df7a57b13b60886a0a9aa4dcc6c3a661ac4b8f2ee823c5efd9d3d19a0c3129bb0732be910a448017b53248ad012e83877fb1885e9709063cd0e960240b2ee32f5921deca2f919b9f8c1a461774813ac5904dd1cc46305196332f6947f13ef115e139611fc9379bb51d1bdf686dfd99d86c5178b80c6c5bb1f32d8b66f4591cbb4e3647907ff6621f3377bddfd577410a5f0aecfc7d0ea46906145d02542e16526468642868bf3ab9c22a06a041abf75ae14b09d4612a89fe2b0c0a9d7958fecfc411ecb7516f04b67d0dc51bede29f3708918d7ebe82f0d6f53179cd5843d0e157353282a2e58efe44c40adab9dbb67bf73d43abae62c6f7b2f7a7cb03a56cc7360c59ac89712829bcf4b346417835df4652e370ef8b6fc76b53405d75b985e0c3b7368ec3c9bf5002ff9424cbda0fc3f117e6cebdda7332ac272a708c83545e77bec5b4f1292d56df80f9c318b80ce6f6ece05ea1b922bec11e0d287a22c0c938ea5088961c3c584151edf865557a2db9ef86da8cfb7fa8f306f5037621c1324034874cb531fb81d8cd50410e80ccabea6a48d106129bc6005459579325a42b064244b03b3bb770cc4a9eac34fc12e77b99c6d5b832a6fea29ebb6087173001717835997a341c7a5d94613a0d739d0c1bfb77e7325e783e3a97fea3f0962e8d71e0de2b5dae36005436db0c0df0ef807b6cf11eb9baf695eceaaa49afcfb5511fed0ce4a5eff8b33a5464ae79ac33ebb30ddb3a37313ecd0eb575b77d057d13130e3fc482c55863f068f4b2fc1d9723ca103f168b7bfaa468ee77f46f30aed8f69c06669835dbf525ee65ef19c6bf3928ba9faf2576e266955cd6a9c9561a9c0825a9828f1362aa4ed55d7d6c5140629c0d9492742b0dd4417e5baf15361fe559b62a56708f6d1013b035a4960b0c015953196ccb6ae2378c689d7f22681576e7635ac56b84201451c9425cdd13e5e2b5160c6087f6923df890a7288cd0433e4e3d670184e722bab7db889805350a5d55cc51bce195a734b4f2cbe28fc5eb738fd77a4abee5b3604ea5eb62f71df5dec11efffd1d521129a7649b0d121aad8bc0b347ddc36dcf38f781b7112771bb814a4c40885bb86a8c05bde18417994e6a3bd245bcfb2bdd2eee5f0b82d8a86c7367d5b212686e980b95f0504d7c5d8162785e3d3405d31c5dfa923fbacc41544fd00c903eb8b9b71d28923250c0372a155a50f2c116a13e54417411722dea560c82cee8d086077fbeff0aade138ac721a637b0de485bc36cfca5b21bf59d71f2ac54a58eee767f40bc2066a954fd14d37e20883e2a8d13f8834983f9c342ac43a30408af7599be7de83b8ac12bbf94405b1fa55daad5d4b603d75ecf53a3a0a8293240be2ffce09890e20a0c7dacf923fa2f562be21649873e160934f8d627ae05c33a75a920fcdcfea0c7b8a960033adafc46ace3f112f3c094e09671bd3d57e2e98b1f57f207a255ffd53e7a695cb5487024da2a119679220ff69f7db3c9d0bec657980cf490f4f2f3a6572288ad74758a91c51001340e2ffb95e020fa498770c423fc712611cef8b2cccf3764336b98616819113ea0e9339433da6fa8bc5526d013e037551cb0836bfb91338a3781d0436d5d3d04a9dcb0978d9348543bbb7d8f9ccbc3d8272fdc7d1c611eedaabf573352a32c66b49276782ed153f5e16226bbadb929a2b431cb7b311ad0bd89c550f7df283bcad576af4075fbb5a15707322f2d6541154d9e2c589c4332c38115f84f24a31323dbd77c64a624871482dc13da4a6276b52b4342bf3fbbb3ab86ca199900998181b9c8ae6c84f0d1debd72a74f5d0fbdfec3990a897ff4f2328d0f3f1de853bdbfb40e7a954a17d452339705e0680988c635a903595d5f5da97c7a8d7173e084aa7f4d22f21e505b7492f5c073c0fe4f8283a4e1147dceeeeb2cb1b284922f27ad62386f852fceb0210ef49dc6a523aaedaa91388fcfab4a8efa202d1ddfae6030fe1675d52e721a9eeb62aef75cc19f60dcdda75c5f3b3b86ade0e1b6c85638272effdd24e7c75df507888ef5f14688ff852500e966e2e726674b24e29c98663d783081c2b324e6574838b91e6ff1f223c4748a2d8ec06293e47485256768ecbee092933393c6f73799aa6c0c7c8f4fb000000000000000000000000000000000000000000000000000000000000000000000c141f2e
 Error = INVALID_PARAMETERS
 
-VerifyMessage = ML-DSA-65-Public
+VerifyMessage = ML-DSA-65-Wycheproof
 Input = 48656c6c6f20776f726c64
 Context = 41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
 Output = d75d495e0aff760275e801ab0c6ed1ac7f180c51b112122fc0fcf303a999261efd3473bb1e46c7298a2d49b2b11934301145799e58cd91cb24f052e90b7bdc1cf590b6736abe772f211d8deef50fafab63033bd04411534c233de584ea1bb0a73d6cda890c1f0206891d55e9b1aa3352c0365dc56449356732e74b599ce33724ffef2a97897ada2a37cfe178a3ee47f8002fd2e02873afd935890f1e31043a7d17aea570285b94024c7fd8ab135e515799e1b2816d4131e3c5a5e1199eeee82f292cdf3a1c290838db1c46baaa2dc75c379342016b06ef1768cd30989bf5297ebd57adb6d6e0b4edbc685a2258ad3393c555bedf933c566f0f848960ab6c2036b7a1eb971a4519898e2b25d8a9fe0aaba7620e580d1c1a6cd6826b70c155b4135831986126613c2a78cc4ca93d900b56f77db9c7214d46420ebe9be0995f9615a73f74b66a4ad1d5570e07f2f9a690750852426f1ed0e61c3c7467ef8af0301b4e4caf01b7eb96f8ffdae739cae1ccbb39631520709e70494c36f9e15610eee5b479eaca35028c1f7ae1da78e4e9bb03dc8f228687f414c4d3ef427fc25ce44c1a06a8437e12974478d84bc566f752a0ea08101ae60c49facda27481d52038fefe5eba5db3dab643bcd7b00b8f9237937bba76df5adb3139a605bf52ef93c2e9a56631b0f86e7be961e0b1e42e8ea4401be99af9b45b01104f5b879b81ce07ac4732eb5c937e7a017c430eefd4cc8baeaf57eab48042f3fbb2a290628873702a9196cc8fa793466e8d381f28f5c050deaeaced44889520af258b897e5427c3deb74760e9557fbaaa80d721f21792a5e8c97e536ad3319f58d2f1089a82e35aa77101aa8e8e8b249a608cffb921987e16dfb2a34ba8590f0c9c2a6c879c59fce2ddf8b2d9747136a81749698b7ba4f5d56f12718dd7c9e296fd2fc52a0a33c9bc7fa5632cbb8c73bf0f4ef427c28aa7e57ad5c069d4b68095c539b1f16623aedaa1f30d43897380cbd1d8b9f6699a38c7dbea893457937aca16aacab67db5bb60195dfa1c0cf02e3d368854ce2191b59b05c6005a1fa09b275966035ff68e91f3c820d8f3473748557904206ab6af36a343ef93e3e121f9490e8770f0b2a703b932b16d4ea19629b7c2b26bf2ca7a07ec6fea8cfd4db85d185d39731b0f3df6cb07d152cd960640facf1c3856cf5b47937644ff9ae17f2037bc7b2a31619273d012afa35b331f78cfb50d23efeab8525be11e313cfd9ce731696a558cce05a68fff8c55bd103af1b6b1b13c8bfe9bfb9d0e86da12b5d9d5385829490a89bdf4e4cbae80be22ffb624ef729917d849c572c44e35ec5cd8354d770bffa5b031ee1f2a76b077b241767f384092a21b016b5687752f23199f0a09e5fd701090fa9c289ea50d26bd3a8676f49b29ba54785b3d20431cfeb519ccbbc0141266a77e7d5bf4bf3299497c8b1d1b40c2f00cfcb29c3a99876a43076a89a13cc58b5af1d72f87e1171d2b6ec9fe4fd318e95590cee63f1a2a6a2090ba3eea95061222db4c8b7cbffc10b450bdae10c0f82fc6861cbd24b9e4d18e4a477f7491586ae23f7ff10e1963a874e0ec97779cb33b4d3262c504cc59bf2c518b7a6de0744297fdbafd8be05bcda2b2e8fc98808594e2a204bb72aa9a425c493ec3433ef5af84208c7c47105a7ba7b936f189a64002a0bf07aaa16b449f79b32e7bf238fe72ab2bdb3e3b2a64c6f325e8486318c50bd905d23afd2988cc92ec26078b2fe9e6fdc5e27fca279c5ad535a70e66b5a55efffa1583b8011b084bbb9b028d2154f2aeac02ca66ec8fba4cec93feea0291e0017c8ec14e49c0cc2e5eac9276f64ffff107dfdda08baa8aa43df97c6adb792e7b781d2edf79763b9656794f0910fc0c17c45cad7f7173401da1f7fb9697b571fa6bb23fb687b71dffd21092e78966ff61fd385f0a236c93aa2d550305e183eca91d284f161d5d2a18824e7148c2c615e939fc4299e84b686e3577f16e8489ec0cd1ed80e8edceef398d007957b571d6e1680e641fa1cda305f993b92ee77f5dfa2e2b4bacecebaee0085c1c87762554c76c5db6d9515647ed615b42366c05d77bd0c7cc37da56a52374f1c4a01ffdbb50a05956f5a5c9082b1de4bf9e7abc3bf8f6bbf983a49108ece5f68ad07b3f309757e26e9bee76ea44223210422ad192f1d1102cbdd0047f07146be860860c28fbf5aa9b401b96cedb9097d9c95fa71524a5827fd562d600655e7ad3e4c592c67faf8a71dae5094e4beb188197ea635cb8d9b25f91f5df2e192b55d991dfcb7d696129e956e13e5518cb7f126b5d0cc9e87c5ed00c2a15eb0d343f283f658001f1addef1043ec46885099278477de6d329506659fe29f7d192feb93a39d3dc8d06913d4b7b621c300d8c01efbc37740d15d6c8f2087c2db3a2f6dff819e8b2af5f5ec52718c970df9e5694e7390cbf7999d5c739845f2ca98d5a4789887f0a6648134c518172ff62b6e85852dedf351d3c5a2727c7e0a9460d595df70961730ebd283519668cedd430621b9af7e04a54058dd6c04770262a75455f7c5f477a4f339ab6d4293a02eee565e3c7ac464db588a64d0bfe1e1b9f3f1977ddeb57e20449153da8881db0565a37be1506f551b8d0490353b799dcdf3003c4ee378dc16d76592310135c3879c2d05e69ba1f9aeb58c6187945617691e5872a0f322506408d5434818cde200e60fb6f40aaea77b94e4c30ee295e8e49b26ddc69c54b5f12bae4186b2e7e886585f0cd14b6475fb37a217ae79f87ae3303d67968f3ce82a40c6590b6cb7a6f764c1f6f69642f67459fa1f53f04eb73142351f0249f4970d3828ed7cc6f7cbd74fdcff388b98ca3a9747d1b70de11694a5e8fe1bb81f37445c6b53933b47a1102818ce623f914be67f51da77f8d666d6d77162aa323c5673749bbb01555d3d204de2c4053989348fd2cf61e185ec8a453d91b09d08a10ef3762a630c53adec121af51958cedba5f82b8b0ea755e74197a61a09c7350547767c2ece07dca5737a97b885bb1dfcc9030838acb4c356224af7672ef9cc0435b404be37f74ed3f042d00f05be35781e977abbbd46e594831c07b3ee45c0e170f2040e543743503262a59c9880c1603c79f316587cde475d6236279a194986db710216f1169a6c7b42e987a9ed7b4fb4212b8bb25bee469ec96d0af41a2e794ab54ba72326069cacf2f5e49b2eeba2ed0177c2ac71816d9f6e2c893fb54369d901e6716d2d04fea85c809cdd9d2fc4cdca6ebcb10d810f764f1792f4a557652da371a3ad6f039d14bd9f5235c8b9c5b5a48333c798ec000fe44ad6c9e7c9e5f57d406e5e8ee8154574b7c76a2f7521947c54a67ec44807622aad566df4d463b3bc0ddafd0fc017f1392cdcfee32e96ea8cdc42cb6e4587cc72d03ac789070c210a1278abcf286e23225ebbdb5bdf917938047e9ec980434ea6566d3aea655ca8a1ea9651d2f0c30169c29cb73a975bf69510e1b6ef8db72e3bb7892e2991488627f716fb7b5ff194757de8a2479a4497f6da76a421b988534b78f8571b4d7c3a2493c2b7b8b02a07eb43fb2fb1d203b02bab2125e7ce41db5b1ce0bc2c7f0706837715223ddb0dd2ba58a98db96e79fa28b1ca14be60058b2ff7b15ae2cdfd38f1d63b77ecd0de4c6e0342b6535724231e797bb717111dc0f0714c40e786a55a2dadaf853bc3cfa324063147802dc2a3bd6a881d3072fb8addf1f8607a7b4d4dc8386c40593ee6e5651c90786077128c9f6ea10aff3fff1e524b3ac1ae1cfb2cc6f659f70c718a821b25e31d7393eb5f5b95c06f0958770cd1b3ca5a6b882aa5c3bc0e300560426c4194b00e4dff3d300c8a47f6c5139bade447b1357eee0164414d75379ea6f696bf15e7a47c31cb47fa4b5608eb0593ce58b61199955e243a8b12cf26e21e05390c2a61b562de5d70f0113f1adc3f3a4d2de7fd5994f6360a3566128104a886e27b349671087c348a101e6f6ed673699962c96f699fbd3aa37a95517a6c99d83c69c16aab974d144b3dae33c9fb850b20ed6153a212ab940d63fb546154a0a377ac16eaa58e97e1a1a5bb4c9e845ed098755bed89abe251e8898f3aa9fe22ecf8b780f32e741b59e4c56a6db067aae97db9cedefb39fe580af8f218bb13bebd51ccdff133fda9d696bffef58f0a46013a31ec1a75918ab5d8e9cbd6a79421ebaea74007240a6ee379f1fedd904e8af829a2dc92ced035f60e8831c73bd1070ad4d5068ec3b2d58069adc6166231ccde5a49a779340c52032cc9434fa479270216037807f37ad0875bcc509ff183c9c518ac22ab527e01eb5dfeeca74c78a400d1ebd2e0fdc1ec19acce8e53352b8ce154e2f671e930cffa1a3a388739f73824eb085ad54aac583dc0d2624e07da1e0c32f61dcb83e632d260fe9c453cb957ee54d1437b1c1c1c6f919916146fd4c91d7ce0e25ee7209fce21c7a6f77abb91dbe9c6d9e3993897965f1cc2fac0e4acb768eaafdaec0c1b1f6e16517be4a7b946f422e61896eb4a368297dd222b8a2f0ef0f80a9cdf168e5e13ef7eb974bc73768655352271e4c38eca8ac5210a4724e5ea0c0e18aa2cd101f216872cadefb05133062c9ee39567a868dacb2c1c43e4e5d6aadf4000000000000000000000000000000000000050810161f25
 Error = INVALID_PARAMETERS
 
-VerifyMessage = ML-DSA-87-Public
+VerifyMessage = ML-DSA-87-Wycheproof
 Input = 48656c6c6f20776f726c64
 Context = 41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
 Output = fd544d3e34ffe17c347a27e09141e80251e7dca1e8f3d226f3d0afe48bccccb0a2029724a25942de396d66d7d62b8cac638e131bdef8908dae9d0cce2dfec34e912e772cd28cfbb8f5c92bd05552da7bf0e06a3623ae1f2b02beb16c4df832d74c48e8c27fd6b7e67a9ebc71bca5139f5b614e49e7220544ed930f4918c5262eb26217246edfb50eea73eaa85676127bb9bfebf34239e8f6a159be3630e02ad810ccaeaee9035b6b7f464e3f70c2cb0ae60748c1b38201e5f4126ed19964fe960aabebdee7bf5bc00125ca9d04570691dbb037dc6db940d5689b16828d73db1098776905f679d5cda58e67448e8bc8d7215a81353d4657fd478ff19efbe5315b29f94193ecfeed43b0beba9c4d06255764bd980d34661902f58854c58f07ea4677f6cd9c348601d76e66f2ecf9c86a321f06dd585fb5b9cac17a50d18f28bad74b2749c1a143fb35053a546ef5e68394d0024a0587eafa35a23791418ed0c8e14e572bb1c0002ba65ca01b0e08b0e054c8f4611bd73d8888a2c6dc380f384705058f62ddb7d0b8f4844d4125fc4bd286fb513ebf4f1152d225792954a482172a4f33fd57a9f7302bdf59b3ee19e42cdcd3ae27b981b0b902e91eb9e84623f3bb9436a7463253e5d2e2e0cb8a11065d78ede565866758ce5202f2e46ac259e566e9d18b607dc8a6e1440264549df73945cd2df996570bc0a12fd9ee4faf5555896b25e413a5a1aa545d27bdb0bb2759c5f798304010d21b6b4b1d83bfd55ee022e6987b05ae498970990cef890927be6f76b5c7aa1ec3567444334c0a7a9e4f3adb321d5ccc24013552352cb4dc5295ad61c7548a0fccae215192896cc15b96f65fc3ea83cabb505a63ced78ca7cfa1d2e8a12e91d31f10d763373a438cb6e527ec2cbd06cfbd6033895f71ace2c2f091401e420259978e73729aabd6cad8da4e9eb6c8d8e39a789cf9b37e84d1b38c8baf13758dd5a29a6797baef2b54756dd3ad68cae4f7638a803fa6783e8d830a42e454a13e8393d8e7c631ab8680fd5822dde3073f4d2f2e9bcba12a8c1f7282e8a4f19ab4c0ef1f7ebd52f6d1bc278c7d6d1440b2ff2b706893aafefbd2d46bb6e4b49c0c0c1617541b90968876df160373dab50e8e8605415d7b9a509ee8bab502e5144b884ef45b05f64d96cb70a3428ee0842c78220f8e5407bee35c2f2aeba68052b1dcd053c57f1a88e7709ccbb667603317fe9fcc40afb58cd38badc4f0136c2f60848270c6ea8afd4be9ff1d214a8dda6256dfd9d18d793984915120a489eedf31eb82550dae3b7c6878f0e79e4512ed19f0b67d08145627b069a36ddd80fa4a380aa92e6b0e591a96755a783c91d2e9611424ad9f0f3cb66ff3e79cdbf77dcf80c3701e1da0cd1e70a33d5754ce9a3a9843e9d2cdde47f11c65d430399cb41401f86cc78959b42f7b7463de3e6cad24066b6a6c25fe41a75ddecdb8f7d24eba99adbabc864e4d6372cf1a88c09a44eeffd6886a3505835685e13f0c70b63b6906462a9027541172b35b2fa9868249232f97f2d7dcfe48d1f890f77f14f6f16a5072de8c417331952d96f093734e562520d4643f3289e5f276fc3466d3ceaba92fee67b21a2eededfa31f3b5aa47777b2cf53b27afdac507b95ab59760cb284ef231f4558b251f7549f13e48a90876979c71f189ff34fb69f2c08a02259586feef717635d7d10ea7934376a50d8c212d4429392f6235241d0d7ff084c866c3fd76ef73abdb40769cd9b965016beef582f765feab3175e0fdde8b71d207f641d5ed8efa56f9fa8970e472b2f5eb6b98e928493ff2b5ce118bd04d155450f768612515d4809e93ea006a41e881e98b66a99683cf4449e92582ab70059a8963abe5989c3a10301152df95b2d17132dbc62043bfdfc38bdbed6c0eb02c2d2057dd495f7040c6b4446f9d63015ca9013d3519cbe4ef8ebf53490b9336daa650c7bdca437789cd30c63d9a094c1ab6cc7545c615284a6739873fd1cfce2a959b9896031eb9241c6d0db0c7085617fd6512c6e5aea2532600bfc9365b2f9f74774406712cd99d6c2dbe898064e999996616781c9841cb23ea913ebd1d0127f96273ee8cf63f915bb5578852bf02a9a79366e59567f98a438906db881f6ebad5d6f091fe302f5ee5ea36ce3341259b479b847da892a16d67550550a58471bfa880fe341366e882d644e2ae209ee69d1817ad5350cddf65247a57a1a8ed75b1edab2c63550a1c694eb1eb8ef30df4f8be2c0785e13752700fc1bbea959a712bf77272bd77ab46aef133a9e3812139017cb94e19148df5288182ca756c7fde5ae6a62879a72f2120b54f9717703002e71a6d28468f0926f514554420f42feea8c7c797b477080a355d911114cdd0ef6d6119fb617da1ff648228c2f8d54508235a0dc53091d362aaeae84bca933591c146e2e59819b70829559828b6ae4da5b615a01056edb55b99799b1c20539332f82d06ef58784e6d07743134a7b9727e75450d474182b49b2af4d2565cca8082be7ac48c1b17f519a76f1d13928062af34a9be27ba1d6a4c4ae6b4ac0dec08f11cc55f8e1b81191c301166b2fe73ed6c576d31575b6361e8394f7f0a30faf2e312adadf4789c7b045ed7258bdb0776601c3fea21fada1d154650ed05743e7f08201120c2f96fb131af0954594710cb5b9c7eb3dd0690fac1477ce913df7c2ac36e4a60d0d6cade2634499291d85f2a758bf65c202fb627dfa1f35f40699f3f3ae7be271302aa06461d10dd3690aff17ee62e717c5fd9a7f33ba328465fd107c4a3aae688672ccefb069af98046513956ade8b4e20829819ff502d0665e99a421f8d53782a73901a879996e538e8bd650518bcc2cd1e0b1457ccdb0c4eefca13b3045543e8b67fc9025f05c827537e827959577513fc48be9918e0f9f4595acf3563a97215473d3181353a211762c178efb6a900e782c50b38827a7b34d52f0aa3d2e398232a685899ca4520f7bae1f00471477e6ea2e844871587a5c6003445639dd699d7d30c01237bbde78b820af92e86d60c3de634fd56ed9502b22796cc363b4c113b2f2f2a6823ebd3c097c73e4b2de5f775da5414d22ab7da0a76bd34b5b792237571f94b24c55ae101e68902ab77fefed78bb554c51a3667d9039ff61b708643d32b6e9aa79d601a1daf7a3d5b37ec815ddc6836b08966b4b8d87d3f6d0e48eaa951ba10caebe2eb0cb1c9793b3d3ad0c965fa44fc7e951c34d4018ce82e4b5a317b3a580b4eee2c7637a3d3f38c317249adb497f6c7088c1cffea17f6b871f8c8e3d11ac8a060e7b74d6358cc741b18f19cb0cf5df052f66ceffba1e7e13f4eec0779fd68bf390b91c150f623faaa7d5e4bc6edc86f9a23fe6fdf7dbfd9a8e005b3ed1c046a74ce48263f60e7e576c1ae9a4faeda5d0dfa1ccf8ca7dbaeb9043a10e5aa3c8c86d13923821aeded744785a3201687d151cd1890bebb099e07387c1b4d57195679e081bd8167f34f3ede016a9a72e367931e1e92546de6194f0510f647f374a0c9bb3e5f5b422efdafa51fc233dc7acb49063858888f00f1cd5fbf2f61e71809145fe73add2030644159ff46e5dde146728b47be6e43ca1f82da7d396002d285a67b03588a6503c86fadc5193ddc684f7fc222f627ae4223ba133bb2728a3a93d0f2da29c8b22a2b6c3c97e0a1f496b07c2a451c27aa8fdaaa77b7d73c98a6f2363a8ed2811c597d187684bba9acc41ea9686542a93cd0d27084590b9e455aa4cf1af1198ef73ebdd2f32cd15b37d89f14f67a28e32f6fdd94d91cdaef7d40a90de57eb505ef6397a0944accdcd32dae49eb7543859cf49222014385a902ad497b9cf4a2f0516aa0e229ca836f7f2565a03c268800346615665823e7d3ecb5b40f328c0d8e307287b0f630acfb9c672c323af43a4476658601b782173dcac214ca63a7c022260cd737b3ef050b3b22c787441c1a1c3c82ae27766ee839aee4c80578556204908a2abebe7f0d1cdedbb863bf6e705f8862e15e100fc9e30cf0e4f8f5a16e985b5ad3efb589341107470bef1b781a49fb0bd5b7c5b4b396fb76bed3210ab1ec6e43e479555154d2fedebcab14c9d0b8010a2fc989123fb83c29fff3f6796af8d9c1ea3ad7c647a3271dd1aa797a435c95925b3aa09a5cf46d7dc24896d24fa7cc0747903a215c80e98de08ba4b30bf72b100cac0a1051656dfa2d3d791acdeb08d328ceae4d342fae72f8c914105ad6aa40510418e953f6f48b1e8823e1e4d5193bb6d52370d2baac0832d856123cc7dfcff6e7da5aa294a1ff51944ee3a3732208dd4c31b8008a63f560d8dae0e06a1c78e163fcb35045603039c54f5791c2df849ff3844a88e1af0b3835cb91a9fc55be34d4e9a5271d7eda26709ad6671cdf9f5fa0de9525748750d220e6f16fca88dfb1f0555bbdf28f31885febc85f8554b309bc74e902284229782c6d8ce74b9194a1b0e9e6efe256f8f529ca5d278fba3fe8f2232f9a261b91b7374fec05fadb734bb0b04f1327846c78b827beeda11d041386734d90f62d2884f8295d1866b7e549eff754cf22f28e9406f05a35dd46df3d04da7b1b8774976e208db649a517410818562e0f2535a0f49942d0fced3f73aa2da7b35c687f6cd5d488f9793b33be9d1de2410d6bd349e9197744cb5ff888c8fb307fa162bdd67034876b820957e41bc8bdb5ca49d0bd7ed18f55714de21304f826e6139908d30052e6c0947a056bc02fe18bff11e451b839be02602c3e71803a880abad17e7480a4dcf3656adef880d6520eb7f9a1366a1703b924a5f556fb74fce39c22a74cdef3d186aa38ea64c76937a5cf9ead53ac654c3947635b4571f85b8284aa0571251fd0b3a6883fcf0503ff8ea64700ab27f941190c399160462e210eb0e303bd01f7eea29f1c3dd4b604d84fc73243627e56718d732a9c6cfa89b642dd1b63307410f31787fe91a65ce9e666d5afe5cfedb0e5f1e0467731707120f078ce84840e33fdaba507a7f682fa3d6669fd668ac0571e532582a4dd29778ce0c31012ef749f3764a60479d46a8c913575ca737d4d541237aa39736b76a81723957b6be87c682e021faf0e8ba33333bd00893bfc3118c4785d7871abf5eac490fc01834dea1bb9146efadc4815b86fbf358038643b269afaed4294ed7dbbe2b47c1d669dc3af99439188d115fccee7f585d4b9c3b41c39ddb01405c5b17de27d2d00d8092a54fcac65360d84f52cc1b2b9fb246eb231aa0e06e45224dec2184f86c6ef9ebb94409618a504299c5e4fc6c3760299c6d7f07533ad1fb22da2fcaaf2b40506c063e0be29432b80b0758d1a03af33e1158b0b5df7583fa2facaa3094a700feff30c5b13d692e779a181bb05b8902a6020187b526d36356aaf9f2835810db587255f9b8a9442862dba873d3c8bcaf546253653d888577c75d8965f2c576a7f8754294e5cf458d3ace97b976ccc29fec5863e171153353d26364a9f10f5da18977e24985ad1231d61cf4f3ca1b15355f28dce005be928a2dd21f4d6fc0d8b71c26830e59f16927889be99c6fd78b72d9e7a8c0cf7fcb4f098a80bf1433b9875cc5cfe60a5a86e763bbb0f501e7c24070c90d196129105cc17a0d870291fcbffd9db6a028787beb5be2425ea819764c9906a444c097cde65939d6341d174bf493d6c98893c51fefb1f4b180366544dd8936f61abf7203520bb0dc2551c6cd935932402fa1413c9893392be23a0383d56b5e6b5e14fcdf95f8712afa4f995afd9c9702c7125b48dbfc35a036ff6297488d7f588b1353fbabec3bd2fcd449fec1fed66c53391172db8f642c8ae14fbe90b2795ff650cca5df0c278d1416d576850663ad4c836099f4d9dd4327fb48daeb958366572b886eb0bdb1db66f826dea7750b1d6947cc91900cefdf1ce308874e0fc8f3eb1d21f867e4100b025217487d1aa51b97e23caa41ca0cdde05df8128dd990404efbac0bf54e36ded9378e27de624a70b3ad711237e106641a80ad4394c5b68d497dc5fcfb9ca7cf868f6396a542d57524566bb967c759dc7aaea6e076b97e78b2e70e6186e305fad825a9ca1a42fd84fda502e7089495d300c8903b7eade093dba09d1706839f69e7c37c40f143c8990c29940ec3862f122606c621d113d33f34769f6934bd8b5c96ba19848937fa343647bfab5a51a8c92f6c5b5ca8f548c22bfda729e0bb8d8a53b99f23b5a9abaaaa3e8f41824e33e5b8fecf9fc1331300de2627100f66340ac330c210b44f773ad98a481a205fa2eb3e4e5aee1ee1fa1aa17688bf648f8131b18d42b7cfdbee75e76a03cf476be83f094907333f46a60eabb3b7f32d51f40044d513558b7b0c6a77421c0024fa161abc64239d308d97b183782bc50f6e90d22841b66035ac8ec448a4f3c2bbeb475296000b1443585d61717987a5295168d2f33659789e8485a3fb868d144f66868f90bdcbd7020e1b2b383e4b5c6f88ddea0710383b467bb9bcdeeb0000000000000000000000000000000000000b1014181a232f39
 Error = INVALID_PARAMETERS
 
 # Short signature
-VerifyMessage = ML-DSA-44-Public
+VerifyMessage = ML-DSA-44-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = 1aa69cb5ed35204534f25f40a17eb0d767f8981f5e7cec46d3bf3252bfc78e09d02ef0c82da6dde973611c849472890106158cb15ffa6ca891615e888efa0d2d8a121b75ca440228ad32991be34249620f158ffd6f74d7b03bf919218ce259b500808ec157ead67b56b79e9e6607eafb9227b8a30adbec087d35bc1aec2f1a0c4dd126dfcfb9fbf0bd74fb1e092495fa994ab5a7cd1333281aafe834694a6dc11e889c762b5645638e172dfab3060031ebcdc1fd455d5de6050bf71b074a4dd34af5ebf15487651f0f13e5d3cee231b9b347810bfc418196df9d7231780c09171b9aae732bea27a1649d8c03220f417e30a016b08ccb1d55c9337b4812e20e04523f5d29a760a01b3a80d76285521206481ee1e44df09a76913ba54ae50c8eb973a3ced73950fbf39c4c0c1262a216821a442072c10cc82839ac57b898411be9e810f893272a2546ff7d1d920f146210efc2b4528bc98a099a398302d301fc1dea31b3d8ff78246a66f690ef536b68e02bd7ea23a5378930dde7f1beb51749896a7944e5a40e6fbbb1f76c3fda09e32e0a58062c24cac7ddb8c1d2cbb352a81e336425c5f551246db45ecd0ab29dac88cdebf51c60bebc2e27c974f56da12c1fec4f5745850429b607f5ed7cd821f2c91fc2dda8c2c8e8ec278d1b2a5bf50ec70c5623fc681b4d1dccff96b324cb53ff97470f9de177c2006a89af8f18603a6d4ea2625794695fe79cd30318a1e76307a4c2a353db1e076ad9b609a2489b94cb6dd821c3af31046bb7a5d43d190e09fce4969fe4e93c8393975e64cb2d9c2294fc427ef5191c40937929b3b0e1b037e6b84cc0299d5af2b5410118bfd88ef6491af6f21233390ca7a19f1576e6c5a10a673796905562075047896e3a2379f64dfbbc12b9bfe64939c2d05efbc5f6e4b5ca69ce1ed4b7d25e8c835b0612b33e13ed7a8a7233b4b3d58eead0bc4c841acb65a5ec0ed45e2584c23c2a162392b5789c62358e4038864e20c10e10c67d940ce78993178dbeb3de1fea1e50e7c29f4d7d938c3bfe50229ea040102f30d5b3a64cb8e13420065d54a1ac50a77383bdff3cae2340ebf15a1557fde897007c1b67d04f19431ca00cb0f08db87e90e166e0f4ce6fd69c6ecef1b3f70d9eb601b57a7bf931057c2afe2d3567b6bbec7891c664713385122fdd789c1d5a8a9cfd491f407c16d0b0c5dfc53a6862208e264b981bf2ddbdd1d7db9729b5265c4c3868a947c982880bc55b786153b89ef3324067b35a928c51236bcbe9f860ad9eee5644478f894a9fe78d26a5a17d482612f1cb9983b864e6fba84591c0f73b7b27918819d2121d4af640f533e2939d3da0f0aa6b9df80837a80165ae8b7579715192eb0f6cca78a43d8ad8d7abb56d816e3af2de59b88bfdcf6767abfb043d3ae24223d05001953faa292671c57ade1fe28988075ab8d14ac98363412bd694c40ae85b1f104afcd0f25aa590f57ba4f5dfdf613bf8594e3f54baadfdf50c0881af2475590758a23b7eee725513e4d1ea9f4630159c424a289f18a9879e5e173390f8e630f6ee2a6043d82a1983dc97c7acfea3b0c03e27e865d810d012daeec28dc454f59334edf24627d435701d329ff5e68d19bbdca5ef7d5e00204fa947d08f81cb6484cabe60989d2f61fbe70940f7e4f449b3fcb103a89143d74b15d72e7913dce9193a0b9c5a7b2a97bde6d7f396ae80b4b566f9f2e7345bc42ce3b002818e19f0f16416b850832cd02279ee8d58a381deaac09b1b4d4613f4d066805d2faea6716e015fe361c0526c6e4617a389ffdf930213c1dc0c4c905c3106a7517dce7abea7a9341132f8ad98de3e42f6b75809fff38f6eeafb97398e79d50a5622338763c4e45a88ddda7fb87ab7f5cec61109fdc1c5d4a16310275241fc34178028a49fd79581a05c3b6984eecd6cb9bd60a44da72600f8f2604a4ff4578126194fb2269c8e6e71447445e8e80bf8c6063dbbf29c7ded58abbc0d2eed347bf495b6a9cbe68585a594aa0e65834bfbcccc3f6bf42fe4ef42d86232c3fb1412dd0b5f8a0489958f5c3b883bf7851337a35b13dd2b6517626ff2d1064cd189beb402497dd6b8893d414dde7d1d51018c7a83766a2d8a29b80e8f428237732f7ee5ba878163f0aa8af5b60533b4d4621a38fdc54383acb3325b5e876e21483eddcc64c419596e656d1557be31b530ea66054f79d4f4a755f9ee33c84fed5d552ec5e2eccd061cf4c4b5c3c16a70a7baecccfc208d2430e78621c9ae5b0d080973b4e1df0a1f5c0415db6d3c85f9ea9041e9a9abdde71d6776a522aa957f708b14a33eda10ebbab93bb8ec2b7a04679f38eb44fc558ee698d3c6937e0e647dce898d7599fef6de32ae4d52adc722443610b2126559756aa36f3c79696b99be3d908f780fcbaef33b215693634d63ce2a0777dfbbc899d2be72efdbafbc10aefb26a1a63cdcfda00235b34db723c91624ee5f939024dfedba0863ad08f648767d41fc7fd6b317c51f4b1b87e21e07d488c9423581f9bbdae43e4d32b37e8283960524f9a601ab69f5cd7fb01c9a8a5c64fe863519a1e9f3426398f691a96e1748491b4e209fca2ab29481a674621c797614ba16fbfdfd1a4184e7f84667e720e6bcd9debef32c2b9e891a6e3c0423158f539838d8413e9fc707d5c65b23368b6edc95d9c3f8e20bbb844499311614945606c1487ef4015d1e260fa8239abaa071be572163132bdb06ef21e31be0f9d4b6747134e4842bedcd3bf53b0d6f054693bc428e9a715d5a32a79e6a3cb8b81faf2c04087d8816752637a2fe11eacb38341e024848562a29d4585e4ee56552ce9b1fad43b965a37bff8558921790ef0f4ac55bcac4327d1783f5e1e79bf01e96934bb4a8f5dd06c83bb70b2377189d622a106100f0cbdd38e34c0565900c616561161b3261859133f83893feb22b0bafc82cf4f0dbafde0648e2f86260e6e747034e5cb3ece98087fbf74179c6306f0c460b5d609b9b3a66761472ee0b9dabb5dfa872d5c6bc9b33461a27b5427bd8833f874f479ecc5f0a20304b9a75aacc82420a87af6469daaef53391ae8a25468e717dc47f464fce45a31147c0c4e12ac2f834567e4005b0827d13b3ec80cd8b7a907436e6624c6c8ac6a80add35cfa1a28872fb65cb3fa46894d116a052f19b5fe20c7ead10bd24d27ad2b5683f299d1193ec6d9ff3379f3b3e39cb9991831f194af2041085508da4dcb7b8785cbdc4e04cf4d826d1ef4a11036e4c5803c3aaa7669b4dd3bc12ff888984e9bbdace0e772ab59332b47300334757677578808e90929697a9cecfd6ed1b303d4250738a97a0aabac6d91e283a4b696f7181828493aec8cdcfe1eaecfc0227484957595badbcbfc8fa000000000000000000000000000000000000121f32
 Error = INVALID_SIGNATURE
 
-VerifyMessage = ML-DSA-65-Public
+VerifyMessage = ML-DSA-65-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = 69da5aec6d5f58fbf29439c520bd68b966e3dd2ca633b68351c2862344713a1e9c086a44f9a870a3ccc14de62d6c12b278c354d7197c4d6d7f83d1422b29b250f5ee3fec118311d905e5db2b4b8b23b8d542202d6652f6dc3f9d7ed51f2463082d3f145cfd0fa7ac548a47e91c1ccb1a55b215e90ab355bfc6d67154287b1dfae0fb530264dbb841a7684b396e5ca0459d795216416a9d232bc89b32e0f9461f53107c78e66c8e876554e8ddd501867b55dcfc1fb33f102e03373cdd192640f1027a08ce277b468f6ed0fe80a9d6cd2d6b2f7a3738c8325d95b0ccc6e7b9fb000c923b92298e0867d4a9f6dd5513e8001033c633bb1641ee66349487224dd43386c7fcc29916332066a868100d46e2c5b8354c28f087a024cba27694afc4c1665e0d72b37686919ad55052cc63a144febe4e2a0c9ae416e064e289f9f69cbb883665d1130826b7b74e30c94a2b98b67b471663e3d66326db3b43bebf958e8665b68eda90e8c5d9494b0c7c9ec48800910dd6d906b1fcd47a0aac462ac87b126d21b5ba150df61f752257ddf5a063b4a5b150371d625535e3b2874b9fe548960ff67931cd6c12496e8213e2ace6fff48e6bdc60310e49389f62579db26b92ad73e9d3f23942cab51784f48b3660b6450caecbb0df2aa4c8e56577f5ea450d2f7f51aacc0b304a62250bf2cae7b99dcd955b6596625d06da1c67f730b706fdba630f00fd891830d251484640b7258ab364d6fd9986878fffa69b7c44b92e43143affae8b098e1d27716850f37553bf266cdfb561abbcdbfeb80752b364434e64b80429b54cc88693ce03dc0fa147f0741b215f0728499bdc25140aafc976ac99e910ba8a8a50d21b7bddaa28626b3b90a93fd44077068357c81d36e735eda4362930adead4951a0baa104f384fc70e842a9f329e1868b07b455e9cc3fecd54805c9052e70f88c3b92fe0fc6a4d7dda18cf5694e5398860e439a1e19d5a66f2fbc0aacdd1a498711bb16054796c015a715395ef6174e37b04eda589b673c4d5dda737817fb52f392caf7a72d7a3e84b2180cb5b75bc8af065bdc05c3e4040435a1b160081352ac43e09cbf2ead6e09c2b0be0e37894888fe2812f68806f957c13fce6ff167bcee21d4f412ec95a4847f3db7bf441223a4d4ca9ed69adb4de8a4b5b01c775f2721226e6c59ff26fc38e1bb78a384b30e7b55f082e264d8f25e31518619ddd6b6a9faf8aa6cdb5eab75ed59a33825d5ef8b93bde5d120ada773fcc0852b918f4f03e2d2a543b15363adb823eb1f6c533b98d940411e1f5c1cf521f9f63d5454697608326625fffe01bf87f44187dad631df2898effd2c291d98222e564abe3b042b75e90c9c54667842fa8ebb68a1244bf8e0c3ae3ee5f97d5ddeefd986c4bd3f99d877c2cc2381a89abdc61713d38cee58bf69805a485c288d21b15843147066b4a74c69dc25de878e21d35fdfe6746feb4c166606bf3219e42cf63581e7e6bd6570f40f8fae590cedf5106fe57037ccb2324b74fca6500f6ed3d0736cdcc67d04f8fa9e80054a5bd7c8459fc1abb1c4c78677d7f6b325af94a0e5c9c7db0a748e12c5265e8724947d9b5c4bab1a8b6faec827cc41ec115ef3c2d7348cddabddfbc8436f3b41765e13f3762b3b45ed23156f085831e726a55d4b83848b3d1d3352aab9edcc0ac2388f2383f6301ad813b917ee3f23734e057832ae4cf65e668c9ddd0bdd0f9d8b6693254649668aa91a1fa5eb7c59859bb6ddd36c25f4a2223f5d688b480d0388fa307ea69298f9bf7737f6b3dbfda87b331affd75cd8d88f0460e98ebc2890b217bd6d11000a3a088cd837f4f8859a43f76afaaab05a0c3007a149d4d6b9155cadc2c9b55003efdec5012b6272b87183694c505f0446ede55f35b8ab201f9eda974ff840eccb0f004fa3acf753acd0613f66e2a6ac82e322199d37b4af83cbb3d98371c31be79bb42331e819644cbad2ce27a04e4c517998692cd8331552892e199a01a6922bda4d38ac4c01f708809e529c3216eaab399ef25b350ea213ba47126f278140e17391ca7139bd13c56f415e6b74aed8dbfbf38c95dc6db366fd72aa863a27fa1ebf198716400b978a3709e35039731930406588ebdffd35fa230a9b75fce41d7acd214ca4f0029896c137495eade0cf4d10fe621c73f01061acb077de72177ff5dbc6f0c5bec681aa34668ca4fcdd727525068b0b0e9072971b84ef6ce11d5c3c6024da40966703dcc2b33ae04f677677635a55db508f34f1403cdbe37960c8577dac3d848b29f3b5c5c6c56fb74f34c8f4634c04b8cce9b218f1760ca00e6de87efd14087c633469c892bf3e319443336733bb60cfb44941bfa25229aa24384d812db90fe74e0f93fda005eea87400736cabc036f71421b6657b1674d4a8f76cbbf3a8b1c0af82f72973927752257c532db439d96762ad64f102551a9d03f9ce3d8cc850c393c128bf8054bb55bb92ea31ec0706f083a9cf90424c617f8ad2a21225d1913c30e8f47a6b7131304d536a85596ebfd987b64b6bf3c51638d6c839214b53c3c10aa52bd9c6eb77fcf80b5e3b724dec1381d0e02207a6adc73ff53d9d1ffcee1c4a28fa5445ce518eee937074ff7a402f5bbcb362ff090415f9dbd93b62ee56dc8c50e4d2e34c6c621650c0dffe311484e95d68de77170c909c815828946aeeec7ede56bcf433e22fc63a33f764ced1f9242f3d26dc7558686e471f30fbe9304d3d56af8b23e72a4088970b24b2f7e968c1d0392eeeb0b0f0ac8c176547a5383d948ed15484b79e21314a1f28ed624f61e5aaecf2269e5b027e1910ffddede52fad4e8da224e8a10b079548fa7cd44172f4991adfd7623d13e5a19c812824bcf990c07c9721ded9093be6ce7bc7da3ac8c932133a64396b822be92b088844991596df893625a4ef24543bf75a10d7d17ff70350ef62ce3a7758aebbf9b3977b08becb9ea28376082f607965f2cded28bbdb39dab7e00833b0488370d221742b66e27d9ee2d9dd07f401bc22a62c8a9d8d3a290c63804991496aafa47a32578f583cfb53d0c2199055973440d7535e0da6cb2957f4e04002ecea68f9c3ff76cade27ed15fd7835989d0abb197fe32f68636139a42710644bb25860ff33f539200e3ccb8a7738422ca0fa0c744b4c19d15c5d4a3cb082e20a78e20b5a4965b043595cbcacad500b5adbb6cd597e6a4b9c5ea6a1f2e653b5474da277f1818048094ac9e0e1e0b20068d1c1ce5a114a4db7195057a6ce4d221c336fdc29190fee8ff855cae8b7f7c02eec21f972c827066d9c6dcc4a4179bc44ea9b88abe5124bf78b071e09e9af43f739a6e1030091fc091e73edc447f25c68bf84b8df7aa8f091ab42662b93e02c27003afc7b0ca69efcfa60bd53d4d78ceb7c4d2c8fd5ed7e8b35024de849e06400ad145fdb28348d22b317ccec704c401f88db1af2a5348223f5cefd914e404c9d73805d0de77211881486f1bf4aadacadd3ae2588f0db7b5e6957fed50a374f541cfe5e4e923c82ec47e5b3d2c70ad6760c79cd5080b490bdc75f9ef5e1d17f0978b1e8770775f902b9463e6980e1683b2454751ba2dad4a2e6460924bd60ff49b03230cb11fcd04a0388e60874c35d3f6cfc4dd487665e1b16578751eaea89e126bf58044596e3188c7a9631017be1f2dcd7d612331832ff8755460dc496aa99a61ea053c78e72607a18213ff9ef4bb880903b91e9a43e0b1f0ed1511b2eca2f4253fcfbd7d0faebf3680fbf0a45df231544882c9c46505c726d56905d02fd046c1652d8fd06d15286a1a8f8b69fbd825ca421fd80f5e9ba1a23f924937ad049adeec60c78fea1adf9b1ef7e8ac4d1ded18f1a801b0bda8fe9a88098825ff3eef5c1fc68cbea143310b39543293f3f5fbcf4773b02054c0bc79f00554947c7604b36389c0c45f597a88f3713456b4cfd83b30cb6520b624aa09c812066a8cd542dc67e19e4c92b562b4e0f6799fe57d9d4f4f3e0b6fabff4b1fc190bf1e78775ebcbe3655d370ca6c08f48decf6153a4989eeab6921f8475f85197f51d651e563994257df57977e5f219b4879751de57ab0374b407a21adb4ba520bb35e7b7508675bf49f4e432190451423cbd529fc79b22baae9cb1d8660c3a49c456ac03bc06c0ef3b02f7d8acd40919315206fb38e715139c9bd6f89a58634fe683df03f5bda719764f6c38131bc5ba1c53244472ef73834ade04b86ca08dd753141ac0a9a230e246735060a044018bc9b75d50134b20e6219c13f8325b5a0201e9453f6f012fe72e829ee1c637fe30037a9212a31c6e713726a6cd4cf2dd66ffdba77f1e2800e717940f231d04aa2e4e88dea084754947d848c0271856bfe659922408449858a81fa6583f062d96898d18ec53664f0067eb9b9c40ad2579ba9802abd8d1bf287e49d94ae397e784db14b5f7010ee4fc42e6e3c8ba80370afc188fcecaf466ea830d7b16362e5c9329980b981decc7174f3ff70a35d8a180ee12ed0cbffd4e8d14eb503387e4959f702d4293109e922eb561371f9ab21475821f8555d92f0aa1c3d841a6f1eabd4e663993636c754ce2b3c3f6a6b6d0b161e777b8296d7dce7fd162970496494d4f60716244a5a7fb7cee40e1d565e6566697e8f930000000000000000000000000510131821
 Error = INVALID_SIGNATURE
 
-VerifyMessage = ML-DSA-87-Public
+VerifyMessage = ML-DSA-87-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = ba4275ff54c22d2d09ea1937a0667362acd44925c6d6965fad350b111d1cbcce68ddbd0e576d1a8810eb4e71623781f32f747d44c8e693749df191682f588906949d97617a4b0ec54ad966818dee88b95f0f28ca24bfc5bfe0c316140b0662c43093ae48b899cc71e5739e9d67095ed987a79b6a0e7aac960c3c4125f0e92bc9435d10bfffae34bb3af05e977ebe0bafcbeb2381c5afe3379667b4c201aebf162dbd0a4bd1baa88fb2f88fa970499a848737d3cf94cc8ce278880a169cad91f304e4e8f1091d4cf39d9a3ab9f88dcc6f3bc4df311a5be0cba290365b3e879527e2a77f0cb6eccc9d85a5e592fb00f3a2e925a26d295a6b82746d7f534c83c35bc4826ee4910216b9a2867032698996fb0e1669b539ccd2ec74d181f4844e8f4d28f9c174316c12dadb54cb1dde7338238a20731c2565bb959f8e3086273ed03abc7ac515728750633083c0b397b29d385d13f5afd2529b32f00dce66c9dc8ea93d99c8b61c5e0ab2fc70de2a8dabdcaf290d53e8fca7561bda8c516ad475e4ec6c7cd2603aa3c8a71d9fa5dc7efc33cf318bebc1f1594e6ea25c69b8f9ce34a65b8ab0ae8dd3538bd267d86c584b8f354d7e4776ed4dd59a73f9e70a1df572f033b69b3eafa5a901e02515472e37258608875ca469de07db71cd6b8dc7edeb3d866ed2d219e44fcb133a066e89d8e3013569ca6f1fee7bf4ae56a6d32a5f3e5a530819c31aadabc8a88503edbea9cdfa3171762e1e8bcebaf9bb6af7e540102d5fc810bbcf1e02ae564e04d9dc55dab0a9392d6c95a317730d9793954da2cb16544d15403d0db01e85881e2d4f1b9b98458e1af0985f98b014f08f200558f2fed7a70c352a27423bedeebb3775c0a1ede9d461d2aea303c09c8b1f73fc37a5b3a01fb24a131574f7eac90c78baa38cebe81e2335dafda20299f76d6a0ba77d2954d11381674f4069f45e133886d64222d92583d5908e3ab6eb6a72cfb41f7dc3e71c1383888f61624bdcaf12fb716de98232ee329af1dd045f30d377234db7bfd11ddab0b3108329e16ce568c8bada39a98df5a5f72a72f063fa4253313a806013f61ce5adbe54cf42180ebf6e496bd4b42aeacf069aaa8e1c231fd037b394d78a69d1742b45bc5784ab8593a198077423c4c357d734f9899cfe9b3b62b6b9c3f4d781b8484a3fd0eea7e8d6945f4ba2b046fee079b7f032bebbc402918daa2aa1c9433dc3bcfbd7f49a5d7a293833c21c1bade3e8a7ec3c83d485529de51b5993cdffe23b770e25acab0ab9fb3059f14952d9464ebfa36a6274d8da317a7b07c2afe38ba28ca942cf7bfaee4020e59911c047b2aa24d1787baae1bc3546364b782358676d75c7698769f1d4a0d5dccade7fcf80e308437f7fc24fdfbf72625abf1b0f534da62cf860da1efd986950e3e19a085999f4d008fce38459c673befcdf2287c1766e106beb4f3175e97812da141330dcb2beb3265e38c8423c19dd50a655c9e8dc969f6367f3383b644d53a26875d53cea26de429266b506e70e7e6832886ed06d81738b0b482bd23bda396eb674ddfdb64803d6c4fae2f040170b5a28923279838b7b876220d02dc7478666f7c3287b1ba4a2f8228e8c491a55ba459805c601b986caea27ee9436f63383351c74d673643b15f6007fc6dc49e337a65a8a96ecd7eef4ad730bf3dc1972fc396703ee26af1156dc4beb46c47d99bb69ebdaf81c2d738d0f70e57a2c7162f5a55242255675f22082aa43f5b3dd862b535b2a15bb815b4e9faf16a302552cd6098d40930dfad7a7c609d6aeade814242a8bf0721c1c26d0d3daa7a638880a6411c6538d80c259d31b639aadaea49563a8d7f5ddb64291d6b086c80d72bfe7d26802cbd20fd6ba5495011e42da1c82483cbe8e37838e73c48f79f65b205476bee600399feda6aaaa939eee12cb34be4e6bdbd18032c85b54a2713551de677a16ca0142ff97b77bc963e8f3c57d91df9b49474b01ca514641842893abc3181caee3f49b635d17daf41bcc4aeb1116ec4b3e78ff1480cf3a5d9c6a154384b88516834d19196976e2ba97cee91f7a0d73f7f8146e58dc0fc8f510511d39d82a7ba531a4abcce6b624035d753a37c5980343cfc7724cf83efb0c33fc4abb5b002241bf57a46b67cb5a4cbd637b2f19bc93b368d97e13c6a62c8443c8222e0a90c3ed1972cc739b824fdf729ed8eca02ad96bd78bf6d2b3d2853e24fa93199ff41635176b31aab2207013d0a9317fa49668dfeb672b8129e6175a2998642ab8e74f0823e3b5480ae80180ca395f5348744a3c7b344891f008aab65914760b5fe852615ad6425216b1c5e777db1a46517cd01a77b277cfa2c6f250c2d68c495fef28feee6e0716817d6b30716f5ca48001805042133eca17a41c2219784ce0f12858ccfd371c77b90966ea04c3996851edf31aef962946628007de5531b06fddf3449f6c552eaf6e16b3e9160e265900b8c8e414732505e02660e123d45a3d6f1b15e56fd759d38e821e27e84967e95c4b0d2a48e008897e655d1b65b76299f1e3074209abe44b37f8786b02df23aa4dcebe512e6312f1a3d6d781d749635247aca897626f5ee688f517df6cfe947ddead820f07fed4bcbe7f1bee3f19117b5666dc123d528f2bf03db346d6afb53804b0681aea98a9479fc6de5ae974d2c0d2055f07ba8a1d2d8b6a7e08a6805bd8634cc190c4988b502f475c36d78c7b3dda0057c818835bbf21c5a7c13bb6fd91cd3cfd76abe4c2ff908a08a3000b9021500ff94b297cec0fb3e51b1cae7026ab4347bfd5b6a641a3d347f45a2a2aacd22e521e00da0c3986c67672c5d7d7e61e7edafc15d42aa42cb37fa8621f79e9096b092efe853ab318b3e4bbd90f20165a1be1d3aa5b3de43751b65abbd952599869778393c4351ab8f534fd49e16547df01c40bfaf56de60b4fb0019bc34177cc8e2236d219fb3c0b84dedae6b88e134280eabd1823420cd1afe6d929774967fd7d885fbad33d89ed9dc5e0eb978eab5d96c50bed5887aa8277880c7b06bf2780cee82ce639a1e3344c88a25102edcc17a4cb48989c4ad6a998726ede31deb0b98107f40858bad7864983f6ecdf0c9761a42751b19d5360daa7fddbbd2e2292638b95c763ca1e747eedef0dd387e9d9ec9e5afee207d8c45703c5befc2de3878d313655ce85ad984250cdf054360f33d41dc193060d42cf9528b1fb91d6ca3395199e25a1a7739eba9a6a4ac2c417ae615940b3eb1b746dd0ecc7b2f7acdff887110115629f70877dafcd7a6625fa1b9e256bc8fe1d66005dbcf12fde0a5fcda5d4f23d58ece91d60eb91274df8d9d17d4a39e63533acf1b317db979b04ca3ab9a0bcba652d0010ca3fcd33ed8f8a62faf42f78b37912d3adb410f20bf16b31359cacc25fb783083a3f065f0a2dd6fe58b8f594e11a87bf0f4c5f5493f334c18b03ebdefebce50228937ec13a8c221b617450486291071f3c14f64f66c927dd4bd623c214ac35433b8a6875cdf00916476eac0f196858aa1484bc1cd45b726d33a965619829b8deaa9d9fa0c3c210f23967ce26a4bdd939cff8aa662f70fb0af97ee44bcb9e2755000a195741d8919e4dcb1a5caae21009f686fa1489c72f16f9fee76b5410ece7f406947f4a19f394a5121da79f3216777b0fee5423328156ecf0b4548dbd5b3f7b526d6b9cfd57576f67dd521c314c2d37474ed0cf732c3b073a101c735a4c4e6b33c9aaa12c91d147ad1075a20287d36c388657614a9c648d8e49cce8cfa282b2a2e8e9da6e4444e4b6aed1bd0ada5009a335cd0500bdae9a01b97f7e8cfe8372398e750de92ee4a524393a19826d19de5e762fb53a88b9b4657e9c6d7d01a4124e3e39532f614aec5cb88d982b78b2ff568017c92f6a1ce5298b5f323b5ee61695038ef0c3a7a339cfac31cf7875a4563046a40e7b35cef1d37d811b342fcbb5373122415befc23cb656a619f7c262c443403b23ba20e341a079918dec6f4f801b92781179ad7ac1951f39ddb0b1f1fb95b28c0f4593a04486f0e0e86bb3b014674879aad10f41e0bad34d40bc817b6fd43c1dde8547882d82e5111e208107e9c9736d16ca77ac7453d7b6c7976a7dd6a4c6c0252185bc9948660a07b66151b09b980d8572ae829ab2f6d900cc63066c4ecb3a0317e8a9acaa8e22a216721f3d69c67843df2fbedd88bc424f761cdf420de4ff2c55b6925b1826c1c4134090d2aae82a7f64a8d428efe1b21097a6fdbc9b8a31c4d46c7b32d478bf5b9181bef8af4d3486958d7c198c46a5ad771090bb64e7fc2bd7677ae7618b861c83c13177075063517eff40cfd52ae56650e9e7035f783bfe8920c754e98470b327909ac2a407e07864710544b8adbc075502c75b5f0fdbca0cde5d94b013141c96b55ae1b60ab63f9e792641690af41b05a78233935fd7f82852ebb2602a10459a709256c41d108c2aeb71925089cc79b121eabd5edc54f3f7c8929685b88ab29700c7fb2f247cd7962c8ce6dc9f79f9358d6a7989d24ccc17d0dbaa0b7fbe73479164181ae7d6b6a02678cce46f74ea2bd387ecb73041817b429a0220e1c3635fe492f5f3a8e2b65c086fe24c375563d7220856dd8f970716d548492964a156554dc88810c3c4f81dcc3ae80243e19679a3be9c9b1b8c707b416e9166c54a568bb9d84728c1a283d9231a12b13688ce2362901342652d66bf44cec223f561d2735d977c6adcf57e9066220d0770fc77fdf6ff367a2f36ae20062887beb88d1b453f267aef9bc763ab716bacb9214c38b95f4f2f3f6c236aa71aef83c1ae4b26133678884476c1d7c6d3e7b99f13e028ac6cebddfae4793f9ae975f3d66b725b500e7c7d2f664eaa0c358deb91cb2d6173394b306749d2bfb2684b985769bdb682e922b75555d38dad1899057a64ef6ea361e4712244d02d0dfec8c3d40770122770c2538d6a14a8462ef18eb705c16e5ba30aa5366447c94869060e4df155f7d01ffda04c1ced0ad5fbe5fdd85856e1e49320319687d31a6e4c7145479f45f43a9b8e9ffe4cbacfad4a21e5445e119df2996cce8b11d0f224efb4f18b544d456e2fb1d96fcd99fc319dbd86720621ac25b490f3611f7e5655bb3940a503c07dbf41f4b87593595a66008808744668371a54ce1b9dfdaa16f90415e57470bc23898d13d8351ba34369e96347da13d012b4eab32ada90668654c5ed2b433716b1b4170f640cf4b40659efcf4150237bbc25f72b248be85cd482b55ce2f5f73e8f02efd2465805b37d12487465ec1085bc6602b71862771af13e13baece4916b1ddef9ce016c92db9fb9e82aee5e1c4e22c45090ad1c19801ce1c541ff3902baea7a12dbcac6ec2d128ac7acb203463921ca6ce1d182d60d553ddecc4a3175eec2e924e9191e0d69aa49ca0b653495b8c62b802e443e669220f2a4047a56ed5cb7431a3387a435070795e6e63d242a74555e97371989c6d0040748e89ac316618d5d6eb7bff8d91e953afbe00464df4e4f6380c273b7ac5934cacb6c3be4da6649c8a5ea12bdf9afa1ec1e5053db7668c10ae2df75c4b3b14525369bf33741525a7630158aca3d3c7da5c1d71d3f63c0c2948a43236968d623c6c163eb757f0c78d6ae682ff4e4b673be07193e8d6c106c92851b393f0523491d5152e06de675fa22ae7bded329836a8ca0b955a59cb575395952c6ea0cb1644f2cada196b96b44ee12115ff9668e32886103d8f8109fac4a2287738ee1d2d4c1c19dab94eaa2757ea32016df60d7286099eb010ba570b5791ce4c54d860b15d56c53a5ddb543b0b602b3a87ca5213aa9647e51b1cb1736697506081240f4f7163a646f2be30e62c617d7572d820a113f96320834a2f43842160511923bd1ef4f723a2ab9b242fffe97cf0199c9f2ebca266a63beea0af279f2d18651b2ea9789d03025857c8aefc5f8bc6ee92ab7c6ffed2606f9c7ef25cb6c96140256a08cc58218869c52f3e5074fe5ace87a86057cc29fc845ff275f1b2dbc5991cbebe4c556b29ce3da3415958f0c9c68a5c664a1da60365ce56b9a4df24ec5d69c6f5a2e685885f6973c0ccd4caf7e000346bdea502b1418c8819e05bb7bee31bbd235819b49c892f7dadade576cb8ca68bda916a598c32ec03cceba2d01a7960f38680facccdaaf05e254dd8c3631a7222d1561c998c54b16f17a425f3247232dca035d545202e1b180340219ce31c66987bc86f983240e7fd2c926e8af77e6ea9f4139ff1edc0c323b67ceadead8f64a8004164d942f6aa65a28544d7205d41aafe62c5bfc6fd9fc322e2a8b620532d00d1add7a0d25a9dbaff90e19de14ac2ca97e83a2d77e63888ba0f7eaf9b18a7f2e5f148d16887580e55e894ae79024385f439acd071494e6469b77d07e763553652a470f3b4bd8bb7968052f3a969dacced51572bd125870849ce3e55359b2e17eabc3153b5f62868ea0ca1f40738488dbe0020c103f53678b9eb1c10000000000000000000000000000000000000000000000000000070a1115182027
 Error = INVALID_SIGNATURE
 
 # Long signature
-VerifyMessage = ML-DSA-44-Public
+VerifyMessage = ML-DSA-44-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = 1aa69cb5ed35204534f25f40a17eb0d767f8981f5e7cec46d3bf3252bfc78e09d02ef0c82da6dde973611c849472890106158cb15ffa6ca891615e888efa0d2d8a121b75ca440228ad32991be34249620f158ffd6f74d7b03bf919218ce259b500808ec157ead67b56b79e9e6607eafb9227b8a30adbec087d35bc1aec2f1a0c4dd126dfcfb9fbf0bd74fb1e092495fa994ab5a7cd1333281aafe834694a6dc11e889c762b5645638e172dfab3060031ebcdc1fd455d5de6050bf71b074a4dd34af5ebf15487651f0f13e5d3cee231b9b347810bfc418196df9d7231780c09171b9aae732bea27a1649d8c03220f417e30a016b08ccb1d55c9337b4812e20e04523f5d29a760a01b3a80d76285521206481ee1e44df09a76913ba54ae50c8eb973a3ced73950fbf39c4c0c1262a216821a442072c10cc82839ac57b898411be9e810f893272a2546ff7d1d920f146210efc2b4528bc98a099a398302d301fc1dea31b3d8ff78246a66f690ef536b68e02bd7ea23a5378930dde7f1beb51749896a7944e5a40e6fbbb1f76c3fda09e32e0a58062c24cac7ddb8c1d2cbb352a81e336425c5f551246db45ecd0ab29dac88cdebf51c60bebc2e27c974f56da12c1fec4f5745850429b607f5ed7cd821f2c91fc2dda8c2c8e8ec278d1b2a5bf50ec70c5623fc681b4d1dccff96b324cb53ff97470f9de177c2006a89af8f18603a6d4ea2625794695fe79cd30318a1e76307a4c2a353db1e076ad9b609a2489b94cb6dd821c3af31046bb7a5d43d190e09fce4969fe4e93c8393975e64cb2d9c2294fc427ef5191c40937929b3b0e1b037e6b84cc0299d5af2b5410118bfd88ef6491af6f21233390ca7a19f1576e6c5a10a673796905562075047896e3a2379f64dfbbc12b9bfe64939c2d05efbc5f6e4b5ca69ce1ed4b7d25e8c835b0612b33e13ed7a8a7233b4b3d58eead0bc4c841acb65a5ec0ed45e2584c23c2a162392b5789c62358e4038864e20c10e10c67d940ce78993178dbeb3de1fea1e50e7c29f4d7d938c3bfe50229ea040102f30d5b3a64cb8e13420065d54a1ac50a77383bdff3cae2340ebf15a1557fde897007c1b67d04f19431ca00cb0f08db87e90e166e0f4ce6fd69c6ecef1b3f70d9eb601b57a7bf931057c2afe2d3567b6bbec7891c664713385122fdd789c1d5a8a9cfd491f407c16d0b0c5dfc53a6862208e264b981bf2ddbdd1d7db9729b5265c4c3868a947c982880bc55b786153b89ef3324067b35a928c51236bcbe9f860ad9eee5644478f894a9fe78d26a5a17d482612f1cb9983b864e6fba84591c0f73b7b27918819d2121d4af640f533e2939d3da0f0aa6b9df80837a80165ae8b7579715192eb0f6cca78a43d8ad8d7abb56d816e3af2de59b88bfdcf6767abfb043d3ae24223d05001953faa292671c57ade1fe28988075ab8d14ac98363412bd694c40ae85b1f104afcd0f25aa590f57ba4f5dfdf613bf8594e3f54baadfdf50c0881af2475590758a23b7eee725513e4d1ea9f4630159c424a289f18a9879e5e173390f8e630f6ee2a6043d82a1983dc97c7acfea3b0c03e27e865d810d012daeec28dc454f59334edf24627d435701d329ff5e68d19bbdca5ef7d5e00204fa947d08f81cb6484cabe60989d2f61fbe70940f7e4f449b3fcb103a89143d74b15d72e7913dce9193a0b9c5a7b2a97bde6d7f396ae80b4b566f9f2e7345bc42ce3b002818e19f0f16416b850832cd02279ee8d58a381deaac09b1b4d4613f4d066805d2faea6716e015fe361c0526c6e4617a389ffdf930213c1dc0c4c905c3106a7517dce7abea7a9341132f8ad98de3e42f6b75809fff38f6eeafb97398e79d50a5622338763c4e45a88ddda7fb87ab7f5cec61109fdc1c5d4a16310275241fc34178028a49fd79581a05c3b6984eecd6cb9bd60a44da72600f8f2604a4ff4578126194fb2269c8e6e71447445e8e80bf8c6063dbbf29c7ded58abbc0d2eed347bf495b6a9cbe68585a594aa0e65834bfbcccc3f6bf42fe4ef42d86232c3fb1412dd0b5f8a0489958f5c3b883bf7851337a35b13dd2b6517626ff2d1064cd189beb402497dd6b8893d414dde7d1d51018c7a83766a2d8a29b80e8f428237732f7ee5ba878163f0aa8af5b60533b4d4621a38fdc54383acb3325b5e876e21483eddcc64c419596e656d1557be31b530ea66054f79d4f4a755f9ee33c84fed5d552ec5e2eccd061cf4c4b5c3c16a70a7baecccfc208d2430e78621c9ae5b0d080973b4e1df0a1f5c0415db6d3c85f9ea9041e9a9abdde71d6776a522aa957f708b14a33eda10ebbab93bb8ec2b7a04679f38eb44fc558ee698d3c6937e0e647dce898d7599fef6de32ae4d52adc722443610b2126559756aa36f3c79696b99be3d908f780fcbaef33b215693634d63ce2a0777dfbbc899d2be72efdbafbc10aefb26a1a63cdcfda00235b34db723c91624ee5f939024dfedba0863ad08f648767d41fc7fd6b317c51f4b1b87e21e07d488c9423581f9bbdae43e4d32b37e8283960524f9a601ab69f5cd7fb01c9a8a5c64fe863519a1e9f3426398f691a96e1748491b4e209fca2ab29481a674621c797614ba16fbfdfd1a4184e7f84667e720e6bcd9debef32c2b9e891a6e3c0423158f539838d8413e9fc707d5c65b23368b6edc95d9c3f8e20bbb844499311614945606c1487ef4015d1e260fa8239abaa071be572163132bdb06ef21e31be0f9d4b6747134e4842bedcd3bf53b0d6f054693bc428e9a715d5a32a79e6a3cb8b81faf2c04087d8816752637a2fe11eacb38341e024848562a29d4585e4ee56552ce9b1fad43b965a37bff8558921790ef0f4ac55bcac4327d1783f5e1e79bf01e96934bb4a8f5dd06c83bb70b2377189d622a106100f0cbdd38e34c0565900c616561161b3261859133f83893feb22b0bafc82cf4f0dbafde0648e2f86260e6e747034e5cb3ece98087fbf74179c6306f0c460b5d609b9b3a66761472ee0b9dabb5dfa872d5c6bc9b33461a27b5427bd8833f874f479ecc5f0a20304b9a75aacc82420a87af6469daaef53391ae8a25468e717dc47f464fce45a31147c0c4e12ac2f834567e4005b0827d13b3ec80cd8b7a907436e6624c6c8ac6a80add35cfa1a28872fb65cb3fa46894d116a052f19b5fe20c7ead10bd24d27ad2b5683f299d1193ec6d9ff3379f3b3e39cb9991831f194af2041085508da4dcb7b8785cbdc4e04cf4d826d1ef4a11036e4c5803c3aaa7669b4dd3bc12ff888984e9bbdace0e772ab59332b47300334757677578808e90929697a9cecfd6ed1b303d4250738a97a0aabac6d91e283a4b696f7181828493aec8cdcfe1eaecfc0227484957595badbcbfc8fa000000000000000000000000000000000000121f323e00
 Error = INVALID_SIGNATURE
 
-VerifyMessage = ML-DSA-65-Public
+VerifyMessage = ML-DSA-65-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = 69da5aec6d5f58fbf29439c520bd68b966e3dd2ca633b68351c2862344713a1e9c086a44f9a870a3ccc14de62d6c12b278c354d7197c4d6d7f83d1422b29b250f5ee3fec118311d905e5db2b4b8b23b8d542202d6652f6dc3f9d7ed51f2463082d3f145cfd0fa7ac548a47e91c1ccb1a55b215e90ab355bfc6d67154287b1dfae0fb530264dbb841a7684b396e5ca0459d795216416a9d232bc89b32e0f9461f53107c78e66c8e876554e8ddd501867b55dcfc1fb33f102e03373cdd192640f1027a08ce277b468f6ed0fe80a9d6cd2d6b2f7a3738c8325d95b0ccc6e7b9fb000c923b92298e0867d4a9f6dd5513e8001033c633bb1641ee66349487224dd43386c7fcc29916332066a868100d46e2c5b8354c28f087a024cba27694afc4c1665e0d72b37686919ad55052cc63a144febe4e2a0c9ae416e064e289f9f69cbb883665d1130826b7b74e30c94a2b98b67b471663e3d66326db3b43bebf958e8665b68eda90e8c5d9494b0c7c9ec48800910dd6d906b1fcd47a0aac462ac87b126d21b5ba150df61f752257ddf5a063b4a5b150371d625535e3b2874b9fe548960ff67931cd6c12496e8213e2ace6fff48e6bdc60310e49389f62579db26b92ad73e9d3f23942cab51784f48b3660b6450caecbb0df2aa4c8e56577f5ea450d2f7f51aacc0b304a62250bf2cae7b99dcd955b6596625d06da1c67f730b706fdba630f00fd891830d251484640b7258ab364d6fd9986878fffa69b7c44b92e43143affae8b098e1d27716850f37553bf266cdfb561abbcdbfeb80752b364434e64b80429b54cc88693ce03dc0fa147f0741b215f0728499bdc25140aafc976ac99e910ba8a8a50d21b7bddaa28626b3b90a93fd44077068357c81d36e735eda4362930adead4951a0baa104f384fc70e842a9f329e1868b07b455e9cc3fecd54805c9052e70f88c3b92fe0fc6a4d7dda18cf5694e5398860e439a1e19d5a66f2fbc0aacdd1a498711bb16054796c015a715395ef6174e37b04eda589b673c4d5dda737817fb52f392caf7a72d7a3e84b2180cb5b75bc8af065bdc05c3e4040435a1b160081352ac43e09cbf2ead6e09c2b0be0e37894888fe2812f68806f957c13fce6ff167bcee21d4f412ec95a4847f3db7bf441223a4d4ca9ed69adb4de8a4b5b01c775f2721226e6c59ff26fc38e1bb78a384b30e7b55f082e264d8f25e31518619ddd6b6a9faf8aa6cdb5eab75ed59a33825d5ef8b93bde5d120ada773fcc0852b918f4f03e2d2a543b15363adb823eb1f6c533b98d940411e1f5c1cf521f9f63d5454697608326625fffe01bf87f44187dad631df2898effd2c291d98222e564abe3b042b75e90c9c54667842fa8ebb68a1244bf8e0c3ae3ee5f97d5ddeefd986c4bd3f99d877c2cc2381a89abdc61713d38cee58bf69805a485c288d21b15843147066b4a74c69dc25de878e21d35fdfe6746feb4c166606bf3219e42cf63581e7e6bd6570f40f8fae590cedf5106fe57037ccb2324b74fca6500f6ed3d0736cdcc67d04f8fa9e80054a5bd7c8459fc1abb1c4c78677d7f6b325af94a0e5c9c7db0a748e12c5265e8724947d9b5c4bab1a8b6faec827cc41ec115ef3c2d7348cddabddfbc8436f3b41765e13f3762b3b45ed23156f085831e726a55d4b83848b3d1d3352aab9edcc0ac2388f2383f6301ad813b917ee3f23734e057832ae4cf65e668c9ddd0bdd0f9d8b6693254649668aa91a1fa5eb7c59859bb6ddd36c25f4a2223f5d688b480d0388fa307ea69298f9bf7737f6b3dbfda87b331affd75cd8d88f0460e98ebc2890b217bd6d11000a3a088cd837f4f8859a43f76afaaab05a0c3007a149d4d6b9155cadc2c9b55003efdec5012b6272b87183694c505f0446ede55f35b8ab201f9eda974ff840eccb0f004fa3acf753acd0613f66e2a6ac82e322199d37b4af83cbb3d98371c31be79bb42331e819644cbad2ce27a04e4c517998692cd8331552892e199a01a6922bda4d38ac4c01f708809e529c3216eaab399ef25b350ea213ba47126f278140e17391ca7139bd13c56f415e6b74aed8dbfbf38c95dc6db366fd72aa863a27fa1ebf198716400b978a3709e35039731930406588ebdffd35fa230a9b75fce41d7acd214ca4f0029896c137495eade0cf4d10fe621c73f01061acb077de72177ff5dbc6f0c5bec681aa34668ca4fcdd727525068b0b0e9072971b84ef6ce11d5c3c6024da40966703dcc2b33ae04f677677635a55db508f34f1403cdbe37960c8577dac3d848b29f3b5c5c6c56fb74f34c8f4634c04b8cce9b218f1760ca00e6de87efd14087c633469c892bf3e319443336733bb60cfb44941bfa25229aa24384d812db90fe74e0f93fda005eea87400736cabc036f71421b6657b1674d4a8f76cbbf3a8b1c0af82f72973927752257c532db439d96762ad64f102551a9d03f9ce3d8cc850c393c128bf8054bb55bb92ea31ec0706f083a9cf90424c617f8ad2a21225d1913c30e8f47a6b7131304d536a85596ebfd987b64b6bf3c51638d6c839214b53c3c10aa52bd9c6eb77fcf80b5e3b724dec1381d0e02207a6adc73ff53d9d1ffcee1c4a28fa5445ce518eee937074ff7a402f5bbcb362ff090415f9dbd93b62ee56dc8c50e4d2e34c6c621650c0dffe311484e95d68de77170c909c815828946aeeec7ede56bcf433e22fc63a33f764ced1f9242f3d26dc7558686e471f30fbe9304d3d56af8b23e72a4088970b24b2f7e968c1d0392eeeb0b0f0ac8c176547a5383d948ed15484b79e21314a1f28ed624f61e5aaecf2269e5b027e1910ffddede52fad4e8da224e8a10b079548fa7cd44172f4991adfd7623d13e5a19c812824bcf990c07c9721ded9093be6ce7bc7da3ac8c932133a64396b822be92b088844991596df893625a4ef24543bf75a10d7d17ff70350ef62ce3a7758aebbf9b3977b08becb9ea28376082f607965f2cded28bbdb39dab7e00833b0488370d221742b66e27d9ee2d9dd07f401bc22a62c8a9d8d3a290c63804991496aafa47a32578f583cfb53d0c2199055973440d7535e0da6cb2957f4e04002ecea68f9c3ff76cade27ed15fd7835989d0abb197fe32f68636139a42710644bb25860ff33f539200e3ccb8a7738422ca0fa0c744b4c19d15c5d4a3cb082e20a78e20b5a4965b043595cbcacad500b5adbb6cd597e6a4b9c5ea6a1f2e653b5474da277f1818048094ac9e0e1e0b20068d1c1ce5a114a4db7195057a6ce4d221c336fdc29190fee8ff855cae8b7f7c02eec21f972c827066d9c6dcc4a4179bc44ea9b88abe5124bf78b071e09e9af43f739a6e1030091fc091e73edc447f25c68bf84b8df7aa8f091ab42662b93e02c27003afc7b0ca69efcfa60bd53d4d78ceb7c4d2c8fd5ed7e8b35024de849e06400ad145fdb28348d22b317ccec704c401f88db1af2a5348223f5cefd914e404c9d73805d0de77211881486f1bf4aadacadd3ae2588f0db7b5e6957fed50a374f541cfe5e4e923c82ec47e5b3d2c70ad6760c79cd5080b490bdc75f9ef5e1d17f0978b1e8770775f902b9463e6980e1683b2454751ba2dad4a2e6460924bd60ff49b03230cb11fcd04a0388e60874c35d3f6cfc4dd487665e1b16578751eaea89e126bf58044596e3188c7a9631017be1f2dcd7d612331832ff8755460dc496aa99a61ea053c78e72607a18213ff9ef4bb880903b91e9a43e0b1f0ed1511b2eca2f4253fcfbd7d0faebf3680fbf0a45df231544882c9c46505c726d56905d02fd046c1652d8fd06d15286a1a8f8b69fbd825ca421fd80f5e9ba1a23f924937ad049adeec60c78fea1adf9b1ef7e8ac4d1ded18f1a801b0bda8fe9a88098825ff3eef5c1fc68cbea143310b39543293f3f5fbcf4773b02054c0bc79f00554947c7604b36389c0c45f597a88f3713456b4cfd83b30cb6520b624aa09c812066a8cd542dc67e19e4c92b562b4e0f6799fe57d9d4f4f3e0b6fabff4b1fc190bf1e78775ebcbe3655d370ca6c08f48decf6153a4989eeab6921f8475f85197f51d651e563994257df57977e5f219b4879751de57ab0374b407a21adb4ba520bb35e7b7508675bf49f4e432190451423cbd529fc79b22baae9cb1d8660c3a49c456ac03bc06c0ef3b02f7d8acd40919315206fb38e715139c9bd6f89a58634fe683df03f5bda719764f6c38131bc5ba1c53244472ef73834ade04b86ca08dd753141ac0a9a230e246735060a044018bc9b75d50134b20e6219c13f8325b5a0201e9453f6f012fe72e829ee1c637fe30037a9212a31c6e713726a6cd4cf2dd66ffdba77f1e2800e717940f231d04aa2e4e88dea084754947d848c0271856bfe659922408449858a81fa6583f062d96898d18ec53664f0067eb9b9c40ad2579ba9802abd8d1bf287e49d94ae397e784db14b5f7010ee4fc42e6e3c8ba80370afc188fcecaf466ea830d7b16362e5c9329980b981decc7174f3ff70a35d8a180ee12ed0cbffd4e8d14eb503387e4959f702d4293109e922eb561371f9ab21475821f8555d92f0aa1c3d841a6f1eabd4e663993636c754ce2b3c3f6a6b6d0b161e777b8296d7dce7fd162970496494d4f60716244a5a7fb7cee40e1d565e6566697e8f9300000000000000000000000005101318212b00
 Error = INVALID_SIGNATURE
 
-VerifyMessage = ML-DSA-87-Public
+VerifyMessage = ML-DSA-87-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = ba4275ff54c22d2d09ea1937a0667362acd44925c6d6965fad350b111d1cbcce68ddbd0e576d1a8810eb4e71623781f32f747d44c8e693749df191682f588906949d97617a4b0ec54ad966818dee88b95f0f28ca24bfc5bfe0c316140b0662c43093ae48b899cc71e5739e9d67095ed987a79b6a0e7aac960c3c4125f0e92bc9435d10bfffae34bb3af05e977ebe0bafcbeb2381c5afe3379667b4c201aebf162dbd0a4bd1baa88fb2f88fa970499a848737d3cf94cc8ce278880a169cad91f304e4e8f1091d4cf39d9a3ab9f88dcc6f3bc4df311a5be0cba290365b3e879527e2a77f0cb6eccc9d85a5e592fb00f3a2e925a26d295a6b82746d7f534c83c35bc4826ee4910216b9a2867032698996fb0e1669b539ccd2ec74d181f4844e8f4d28f9c174316c12dadb54cb1dde7338238a20731c2565bb959f8e3086273ed03abc7ac515728750633083c0b397b29d385d13f5afd2529b32f00dce66c9dc8ea93d99c8b61c5e0ab2fc70de2a8dabdcaf290d53e8fca7561bda8c516ad475e4ec6c7cd2603aa3c8a71d9fa5dc7efc33cf318bebc1f1594e6ea25c69b8f9ce34a65b8ab0ae8dd3538bd267d86c584b8f354d7e4776ed4dd59a73f9e70a1df572f033b69b3eafa5a901e02515472e37258608875ca469de07db71cd6b8dc7edeb3d866ed2d219e44fcb133a066e89d8e3013569ca6f1fee7bf4ae56a6d32a5f3e5a530819c31aadabc8a88503edbea9cdfa3171762e1e8bcebaf9bb6af7e540102d5fc810bbcf1e02ae564e04d9dc55dab0a9392d6c95a317730d9793954da2cb16544d15403d0db01e85881e2d4f1b9b98458e1af0985f98b014f08f200558f2fed7a70c352a27423bedeebb3775c0a1ede9d461d2aea303c09c8b1f73fc37a5b3a01fb24a131574f7eac90c78baa38cebe81e2335dafda20299f76d6a0ba77d2954d11381674f4069f45e133886d64222d92583d5908e3ab6eb6a72cfb41f7dc3e71c1383888f61624bdcaf12fb716de98232ee329af1dd045f30d377234db7bfd11ddab0b3108329e16ce568c8bada39a98df5a5f72a72f063fa4253313a806013f61ce5adbe54cf42180ebf6e496bd4b42aeacf069aaa8e1c231fd037b394d78a69d1742b45bc5784ab8593a198077423c4c357d734f9899cfe9b3b62b6b9c3f4d781b8484a3fd0eea7e8d6945f4ba2b046fee079b7f032bebbc402918daa2aa1c9433dc3bcfbd7f49a5d7a293833c21c1bade3e8a7ec3c83d485529de51b5993cdffe23b770e25acab0ab9fb3059f14952d9464ebfa36a6274d8da317a7b07c2afe38ba28ca942cf7bfaee4020e59911c047b2aa24d1787baae1bc3546364b782358676d75c7698769f1d4a0d5dccade7fcf80e308437f7fc24fdfbf72625abf1b0f534da62cf860da1efd986950e3e19a085999f4d008fce38459c673befcdf2287c1766e106beb4f3175e97812da141330dcb2beb3265e38c8423c19dd50a655c9e8dc969f6367f3383b644d53a26875d53cea26de429266b506e70e7e6832886ed06d81738b0b482bd23bda396eb674ddfdb64803d6c4fae2f040170b5a28923279838b7b876220d02dc7478666f7c3287b1ba4a2f8228e8c491a55ba459805c601b986caea27ee9436f63383351c74d673643b15f6007fc6dc49e337a65a8a96ecd7eef4ad730bf3dc1972fc396703ee26af1156dc4beb46c47d99bb69ebdaf81c2d738d0f70e57a2c7162f5a55242255675f22082aa43f5b3dd862b535b2a15bb815b4e9faf16a302552cd6098d40930dfad7a7c609d6aeade814242a8bf0721c1c26d0d3daa7a638880a6411c6538d80c259d31b639aadaea49563a8d7f5ddb64291d6b086c80d72bfe7d26802cbd20fd6ba5495011e42da1c82483cbe8e37838e73c48f79f65b205476bee600399feda6aaaa939eee12cb34be4e6bdbd18032c85b54a2713551de677a16ca0142ff97b77bc963e8f3c57d91df9b49474b01ca514641842893abc3181caee3f49b635d17daf41bcc4aeb1116ec4b3e78ff1480cf3a5d9c6a154384b88516834d19196976e2ba97cee91f7a0d73f7f8146e58dc0fc8f510511d39d82a7ba531a4abcce6b624035d753a37c5980343cfc7724cf83efb0c33fc4abb5b002241bf57a46b67cb5a4cbd637b2f19bc93b368d97e13c6a62c8443c8222e0a90c3ed1972cc739b824fdf729ed8eca02ad96bd78bf6d2b3d2853e24fa93199ff41635176b31aab2207013d0a9317fa49668dfeb672b8129e6175a2998642ab8e74f0823e3b5480ae80180ca395f5348744a3c7b344891f008aab65914760b5fe852615ad6425216b1c5e777db1a46517cd01a77b277cfa2c6f250c2d68c495fef28feee6e0716817d6b30716f5ca48001805042133eca17a41c2219784ce0f12858ccfd371c77b90966ea04c3996851edf31aef962946628007de5531b06fddf3449f6c552eaf6e16b3e9160e265900b8c8e414732505e02660e123d45a3d6f1b15e56fd759d38e821e27e84967e95c4b0d2a48e008897e655d1b65b76299f1e3074209abe44b37f8786b02df23aa4dcebe512e6312f1a3d6d781d749635247aca897626f5ee688f517df6cfe947ddead820f07fed4bcbe7f1bee3f19117b5666dc123d528f2bf03db346d6afb53804b0681aea98a9479fc6de5ae974d2c0d2055f07ba8a1d2d8b6a7e08a6805bd8634cc190c4988b502f475c36d78c7b3dda0057c818835bbf21c5a7c13bb6fd91cd3cfd76abe4c2ff908a08a3000b9021500ff94b297cec0fb3e51b1cae7026ab4347bfd5b6a641a3d347f45a2a2aacd22e521e00da0c3986c67672c5d7d7e61e7edafc15d42aa42cb37fa8621f79e9096b092efe853ab318b3e4bbd90f20165a1be1d3aa5b3de43751b65abbd952599869778393c4351ab8f534fd49e16547df01c40bfaf56de60b4fb0019bc34177cc8e2236d219fb3c0b84dedae6b88e134280eabd1823420cd1afe6d929774967fd7d885fbad33d89ed9dc5e0eb978eab5d96c50bed5887aa8277880c7b06bf2780cee82ce639a1e3344c88a25102edcc17a4cb48989c4ad6a998726ede31deb0b98107f40858bad7864983f6ecdf0c9761a42751b19d5360daa7fddbbd2e2292638b95c763ca1e747eedef0dd387e9d9ec9e5afee207d8c45703c5befc2de3878d313655ce85ad984250cdf054360f33d41dc193060d42cf9528b1fb91d6ca3395199e25a1a7739eba9a6a4ac2c417ae615940b3eb1b746dd0ecc7b2f7acdff887110115629f70877dafcd7a6625fa1b9e256bc8fe1d66005dbcf12fde0a5fcda5d4f23d58ece91d60eb91274df8d9d17d4a39e63533acf1b317db979b04ca3ab9a0bcba652d0010ca3fcd33ed8f8a62faf42f78b37912d3adb410f20bf16b31359cacc25fb783083a3f065f0a2dd6fe58b8f594e11a87bf0f4c5f5493f334c18b03ebdefebce50228937ec13a8c221b617450486291071f3c14f64f66c927dd4bd623c214ac35433b8a6875cdf00916476eac0f196858aa1484bc1cd45b726d33a965619829b8deaa9d9fa0c3c210f23967ce26a4bdd939cff8aa662f70fb0af97ee44bcb9e2755000a195741d8919e4dcb1a5caae21009f686fa1489c72f16f9fee76b5410ece7f406947f4a19f394a5121da79f3216777b0fee5423328156ecf0b4548dbd5b3f7b526d6b9cfd57576f67dd521c314c2d37474ed0cf732c3b073a101c735a4c4e6b33c9aaa12c91d147ad1075a20287d36c388657614a9c648d8e49cce8cfa282b2a2e8e9da6e4444e4b6aed1bd0ada5009a335cd0500bdae9a01b97f7e8cfe8372398e750de92ee4a524393a19826d19de5e762fb53a88b9b4657e9c6d7d01a4124e3e39532f614aec5cb88d982b78b2ff568017c92f6a1ce5298b5f323b5ee61695038ef0c3a7a339cfac31cf7875a4563046a40e7b35cef1d37d811b342fcbb5373122415befc23cb656a619f7c262c443403b23ba20e341a079918dec6f4f801b92781179ad7ac1951f39ddb0b1f1fb95b28c0f4593a04486f0e0e86bb3b014674879aad10f41e0bad34d40bc817b6fd43c1dde8547882d82e5111e208107e9c9736d16ca77ac7453d7b6c7976a7dd6a4c6c0252185bc9948660a07b66151b09b980d8572ae829ab2f6d900cc63066c4ecb3a0317e8a9acaa8e22a216721f3d69c67843df2fbedd88bc424f761cdf420de4ff2c55b6925b1826c1c4134090d2aae82a7f64a8d428efe1b21097a6fdbc9b8a31c4d46c7b32d478bf5b9181bef8af4d3486958d7c198c46a5ad771090bb64e7fc2bd7677ae7618b861c83c13177075063517eff40cfd52ae56650e9e7035f783bfe8920c754e98470b327909ac2a407e07864710544b8adbc075502c75b5f0fdbca0cde5d94b013141c96b55ae1b60ab63f9e792641690af41b05a78233935fd7f82852ebb2602a10459a709256c41d108c2aeb71925089cc79b121eabd5edc54f3f7c8929685b88ab29700c7fb2f247cd7962c8ce6dc9f79f9358d6a7989d24ccc17d0dbaa0b7fbe73479164181ae7d6b6a02678cce46f74ea2bd387ecb73041817b429a0220e1c3635fe492f5f3a8e2b65c086fe24c375563d7220856dd8f970716d548492964a156554dc88810c3c4f81dcc3ae80243e19679a3be9c9b1b8c707b416e9166c54a568bb9d84728c1a283d9231a12b13688ce2362901342652d66bf44cec223f561d2735d977c6adcf57e9066220d0770fc77fdf6ff367a2f36ae20062887beb88d1b453f267aef9bc763ab716bacb9214c38b95f4f2f3f6c236aa71aef83c1ae4b26133678884476c1d7c6d3e7b99f13e028ac6cebddfae4793f9ae975f3d66b725b500e7c7d2f664eaa0c358deb91cb2d6173394b306749d2bfb2684b985769bdb682e922b75555d38dad1899057a64ef6ea361e4712244d02d0dfec8c3d40770122770c2538d6a14a8462ef18eb705c16e5ba30aa5366447c94869060e4df155f7d01ffda04c1ced0ad5fbe5fdd85856e1e49320319687d31a6e4c7145479f45f43a9b8e9ffe4cbacfad4a21e5445e119df2996cce8b11d0f224efb4f18b544d456e2fb1d96fcd99fc319dbd86720621ac25b490f3611f7e5655bb3940a503c07dbf41f4b87593595a66008808744668371a54ce1b9dfdaa16f90415e57470bc23898d13d8351ba34369e96347da13d012b4eab32ada90668654c5ed2b433716b1b4170f640cf4b40659efcf4150237bbc25f72b248be85cd482b55ce2f5f73e8f02efd2465805b37d12487465ec1085bc6602b71862771af13e13baece4916b1ddef9ce016c92db9fb9e82aee5e1c4e22c45090ad1c19801ce1c541ff3902baea7a12dbcac6ec2d128ac7acb203463921ca6ce1d182d60d553ddecc4a3175eec2e924e9191e0d69aa49ca0b653495b8c62b802e443e669220f2a4047a56ed5cb7431a3387a435070795e6e63d242a74555e97371989c6d0040748e89ac316618d5d6eb7bff8d91e953afbe00464df4e4f6380c273b7ac5934cacb6c3be4da6649c8a5ea12bdf9afa1ec1e5053db7668c10ae2df75c4b3b14525369bf33741525a7630158aca3d3c7da5c1d71d3f63c0c2948a43236968d623c6c163eb757f0c78d6ae682ff4e4b673be07193e8d6c106c92851b393f0523491d5152e06de675fa22ae7bded329836a8ca0b955a59cb575395952c6ea0cb1644f2cada196b96b44ee12115ff9668e32886103d8f8109fac4a2287738ee1d2d4c1c19dab94eaa2757ea32016df60d7286099eb010ba570b5791ce4c54d860b15d56c53a5ddb543b0b602b3a87ca5213aa9647e51b1cb1736697506081240f4f7163a646f2be30e62c617d7572d820a113f96320834a2f43842160511923bd1ef4f723a2ab9b242fffe97cf0199c9f2ebca266a63beea0af279f2d18651b2ea9789d03025857c8aefc5f8bc6ee92ab7c6ffed2606f9c7ef25cb6c96140256a08cc58218869c52f3e5074fe5ace87a86057cc29fc845ff275f1b2dbc5991cbebe4c556b29ce3da3415958f0c9c68a5c664a1da60365ce56b9a4df24ec5d69c6f5a2e685885f6973c0ccd4caf7e000346bdea502b1418c8819e05bb7bee31bbd235819b49c892f7dadade576cb8ca68bda916a598c32ec03cceba2d01a7960f38680facccdaaf05e254dd8c3631a7222d1561c998c54b16f17a425f3247232dca035d545202e1b180340219ce31c66987bc86f983240e7fd2c926e8af77e6ea9f4139ff1edc0c323b67ceadead8f64a8004164d942f6aa65a28544d7205d41aafe62c5bfc6fd9fc322e2a8b620532d00d1add7a0d25a9dbaff90e19de14ac2ca97e83a2d77e63888ba0f7eaf9b18a7f2e5f148d16887580e55e894ae79024385f439acd071494e6469b77d07e763553652a470f3b4bd8bb7968052f3a969dacced51572bd125870849ce3e55359b2e17eabc3153b5f62868ea0ca1f40738488dbe0020c103f53678b9eb1c10000000000000000000000000000000000000000000000000000070a11151820273100
 Error = INVALID_SIGNATURE
 
 # Signature with bitflip
-VerifyMessage = ML-DSA-44-Public
+VerifyMessage = ML-DSA-44-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = 1ba69cb5ed35204534f25f40a17eb0d767f8981f5e7cec46d3bf3252bfc78e09d02ef0c82da6dde973611c849472890106158cb15ffa6ca891615e888efa0d2d8a121b75ca440228ad32991be34249620f158ffd6f74d7b03bf919218ce259b500808ec157ead67b56b79e9e6607eafb9227b8a30adbec087d35bc1aec2f1a0c4dd126dfcfb9fbf0bd74fb1e092495fa994ab5a7cd1333281aafe834694a6dc11e889c762b5645638e172dfab3060031ebcdc1fd455d5de6050bf71b074a4dd34af5ebf15487651f0f13e5d3cee231b9b347810bfc418196df9d7231780c09171b9aae732bea27a1649d8c03220f417e30a016b08ccb1d55c9337b4812e20e04523f5d29a760a01b3a80d76285521206481ee1e44df09a76913ba54ae50c8eb973a3ced73950fbf39c4c0c1262a216821a442072c10cc82839ac57b898411be9e810f893272a2546ff7d1d920f146210efc2b4528bc98a099a398302d301fc1dea31b3d8ff78246a66f690ef536b68e02bd7ea23a5378930dde7f1beb51749896a7944e5a40e6fbbb1f76c3fda09e32e0a58062c24cac7ddb8c1d2cbb352a81e336425c5f551246db45ecd0ab29dac88cdebf51c60bebc2e27c974f56da12c1fec4f5745850429b607f5ed7cd821f2c91fc2dda8c2c8e8ec278d1b2a5bf50ec70c5623fc681b4d1dccff96b324cb53ff97470f9de177c2006a89af8f18603a6d4ea2625794695fe79cd30318a1e76307a4c2a353db1e076ad9b609a2489b94cb6dd821c3af31046bb7a5d43d190e09fce4969fe4e93c8393975e64cb2d9c2294fc427ef5191c40937929b3b0e1b037e6b84cc0299d5af2b5410118bfd88ef6491af6f21233390ca7a19f1576e6c5a10a673796905562075047896e3a2379f64dfbbc12b9bfe64939c2d05efbc5f6e4b5ca69ce1ed4b7d25e8c835b0612b33e13ed7a8a7233b4b3d58eead0bc4c841acb65a5ec0ed45e2584c23c2a162392b5789c62358e4038864e20c10e10c67d940ce78993178dbeb3de1fea1e50e7c29f4d7d938c3bfe50229ea040102f30d5b3a64cb8e13420065d54a1ac50a77383bdff3cae2340ebf15a1557fde897007c1b67d04f19431ca00cb0f08db87e90e166e0f4ce6fd69c6ecef1b3f70d9eb601b57a7bf931057c2afe2d3567b6bbec7891c664713385122fdd789c1d5a8a9cfd491f407c16d0b0c5dfc53a6862208e264b981bf2ddbdd1d7db9729b5265c4c3868a947c982880bc55b786153b89ef3324067b35a928c51236bcbe9f860ad9eee5644478f894a9fe78d26a5a17d482612f1cb9983b864e6fba84591c0f73b7b27918819d2121d4af640f533e2939d3da0f0aa6b9df80837a80165ae8b7579715192eb0f6cca78a43d8ad8d7abb56d816e3af2de59b88bfdcf6767abfb043d3ae24223d05001953faa292671c57ade1fe28988075ab8d14ac98363412bd694c40ae85b1f104afcd0f25aa590f57ba4f5dfdf613bf8594e3f54baadfdf50c0881af2475590758a23b7eee725513e4d1ea9f4630159c424a289f18a9879e5e173390f8e630f6ee2a6043d82a1983dc97c7acfea3b0c03e27e865d810d012daeec28dc454f59334edf24627d435701d329ff5e68d19bbdca5ef7d5e00204fa947d08f81cb6484cabe60989d2f61fbe70940f7e4f449b3fcb103a89143d74b15d72e7913dce9193a0b9c5a7b2a97bde6d7f396ae80b4b566f9f2e7345bc42ce3b002818e19f0f16416b850832cd02279ee8d58a381deaac09b1b4d4613f4d066805d2faea6716e015fe361c0526c6e4617a389ffdf930213c1dc0c4c905c3106a7517dce7abea7a9341132f8ad98de3e42f6b75809fff38f6eeafb97398e79d50a5622338763c4e45a88ddda7fb87ab7f5cec61109fdc1c5d4a16310275241fc34178028a49fd79581a05c3b6984eecd6cb9bd60a44da72600f8f2604a4ff4578126194fb2269c8e6e71447445e8e80bf8c6063dbbf29c7ded58abbc0d2eed347bf495b6a9cbe68585a594aa0e65834bfbcccc3f6bf42fe4ef42d86232c3fb1412dd0b5f8a0489958f5c3b883bf7851337a35b13dd2b6517626ff2d1064cd189beb402497dd6b8893d414dde7d1d51018c7a83766a2d8a29b80e8f428237732f7ee5ba878163f0aa8af5b60533b4d4621a38fdc54383acb3325b5e876e21483eddcc64c419596e656d1557be31b530ea66054f79d4f4a755f9ee33c84fed5d552ec5e2eccd061cf4c4b5c3c16a70a7baecccfc208d2430e78621c9ae5b0d080973b4e1df0a1f5c0415db6d3c85f9ea9041e9a9abdde71d6776a522aa957f708b14a33eda10ebbab93bb8ec2b7a04679f38eb44fc558ee698d3c6937e0e647dce898d7599fef6de32ae4d52adc722443610b2126559756aa36f3c79696b99be3d908f780fcbaef33b215693634d63ce2a0777dfbbc899d2be72efdbafbc10aefb26a1a63cdcfda00235b34db723c91624ee5f939024dfedba0863ad08f648767d41fc7fd6b317c51f4b1b87e21e07d488c9423581f9bbdae43e4d32b37e8283960524f9a601ab69f5cd7fb01c9a8a5c64fe863519a1e9f3426398f691a96e1748491b4e209fca2ab29481a674621c797614ba16fbfdfd1a4184e7f84667e720e6bcd9debef32c2b9e891a6e3c0423158f539838d8413e9fc707d5c65b23368b6edc95d9c3f8e20bbb844499311614945606c1487ef4015d1e260fa8239abaa071be572163132bdb06ef21e31be0f9d4b6747134e4842bedcd3bf53b0d6f054693bc428e9a715d5a32a79e6a3cb8b81faf2c04087d8816752637a2fe11eacb38341e024848562a29d4585e4ee56552ce9b1fad43b965a37bff8558921790ef0f4ac55bcac4327d1783f5e1e79bf01e96934bb4a8f5dd06c83bb70b2377189d622a106100f0cbdd38e34c0565900c616561161b3261859133f83893feb22b0bafc82cf4f0dbafde0648e2f86260e6e747034e5cb3ece98087fbf74179c6306f0c460b5d609b9b3a66761472ee0b9dabb5dfa872d5c6bc9b33461a27b5427bd8833f874f479ecc5f0a20304b9a75aacc82420a87af6469daaef53391ae8a25468e717dc47f464fce45a31147c0c4e12ac2f834567e4005b0827d13b3ec80cd8b7a907436e6624c6c8ac6a80add35cfa1a28872fb65cb3fa46894d116a052f19b5fe20c7ead10bd24d27ad2b5683f299d1193ec6d9ff3379f3b3e39cb9991831f194af2041085508da4dcb7b8785cbdc4e04cf4d826d1ef4a11036e4c5803c3aaa7669b4dd3bc12ff888984e9bbdace0e772ab59332b47300334757677578808e90929697a9cecfd6ed1b303d4250738a97a0aabac6d91e283a4b696f7181828493aec8cdcfe1eaecfc0227484957595badbcbfc8fa000000000000000000000000000000000000121f323e
 Error = INVALID_SIGNATURE
 
-VerifyMessage = ML-DSA-65-Public
+VerifyMessage = ML-DSA-65-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = 68da5aec6d5f58fbf29439c520bd68b966e3dd2ca633b68351c2862344713a1e9c086a44f9a870a3ccc14de62d6c12b278c354d7197c4d6d7f83d1422b29b250f5ee3fec118311d905e5db2b4b8b23b8d542202d6652f6dc3f9d7ed51f2463082d3f145cfd0fa7ac548a47e91c1ccb1a55b215e90ab355bfc6d67154287b1dfae0fb530264dbb841a7684b396e5ca0459d795216416a9d232bc89b32e0f9461f53107c78e66c8e876554e8ddd501867b55dcfc1fb33f102e03373cdd192640f1027a08ce277b468f6ed0fe80a9d6cd2d6b2f7a3738c8325d95b0ccc6e7b9fb000c923b92298e0867d4a9f6dd5513e8001033c633bb1641ee66349487224dd43386c7fcc29916332066a868100d46e2c5b8354c28f087a024cba27694afc4c1665e0d72b37686919ad55052cc63a144febe4e2a0c9ae416e064e289f9f69cbb883665d1130826b7b74e30c94a2b98b67b471663e3d66326db3b43bebf958e8665b68eda90e8c5d9494b0c7c9ec48800910dd6d906b1fcd47a0aac462ac87b126d21b5ba150df61f752257ddf5a063b4a5b150371d625535e3b2874b9fe548960ff67931cd6c12496e8213e2ace6fff48e6bdc60310e49389f62579db26b92ad73e9d3f23942cab51784f48b3660b6450caecbb0df2aa4c8e56577f5ea450d2f7f51aacc0b304a62250bf2cae7b99dcd955b6596625d06da1c67f730b706fdba630f00fd891830d251484640b7258ab364d6fd9986878fffa69b7c44b92e43143affae8b098e1d27716850f37553bf266cdfb561abbcdbfeb80752b364434e64b80429b54cc88693ce03dc0fa147f0741b215f0728499bdc25140aafc976ac99e910ba8a8a50d21b7bddaa28626b3b90a93fd44077068357c81d36e735eda4362930adead4951a0baa104f384fc70e842a9f329e1868b07b455e9cc3fecd54805c9052e70f88c3b92fe0fc6a4d7dda18cf5694e5398860e439a1e19d5a66f2fbc0aacdd1a498711bb16054796c015a715395ef6174e37b04eda589b673c4d5dda737817fb52f392caf7a72d7a3e84b2180cb5b75bc8af065bdc05c3e4040435a1b160081352ac43e09cbf2ead6e09c2b0be0e37894888fe2812f68806f957c13fce6ff167bcee21d4f412ec95a4847f3db7bf441223a4d4ca9ed69adb4de8a4b5b01c775f2721226e6c59ff26fc38e1bb78a384b30e7b55f082e264d8f25e31518619ddd6b6a9faf8aa6cdb5eab75ed59a33825d5ef8b93bde5d120ada773fcc0852b918f4f03e2d2a543b15363adb823eb1f6c533b98d940411e1f5c1cf521f9f63d5454697608326625fffe01bf87f44187dad631df2898effd2c291d98222e564abe3b042b75e90c9c54667842fa8ebb68a1244bf8e0c3ae3ee5f97d5ddeefd986c4bd3f99d877c2cc2381a89abdc61713d38cee58bf69805a485c288d21b15843147066b4a74c69dc25de878e21d35fdfe6746feb4c166606bf3219e42cf63581e7e6bd6570f40f8fae590cedf5106fe57037ccb2324b74fca6500f6ed3d0736cdcc67d04f8fa9e80054a5bd7c8459fc1abb1c4c78677d7f6b325af94a0e5c9c7db0a748e12c5265e8724947d9b5c4bab1a8b6faec827cc41ec115ef3c2d7348cddabddfbc8436f3b41765e13f3762b3b45ed23156f085831e726a55d4b83848b3d1d3352aab9edcc0ac2388f2383f6301ad813b917ee3f23734e057832ae4cf65e668c9ddd0bdd0f9d8b6693254649668aa91a1fa5eb7c59859bb6ddd36c25f4a2223f5d688b480d0388fa307ea69298f9bf7737f6b3dbfda87b331affd75cd8d88f0460e98ebc2890b217bd6d11000a3a088cd837f4f8859a43f76afaaab05a0c3007a149d4d6b9155cadc2c9b55003efdec5012b6272b87183694c505f0446ede55f35b8ab201f9eda974ff840eccb0f004fa3acf753acd0613f66e2a6ac82e322199d37b4af83cbb3d98371c31be79bb42331e819644cbad2ce27a04e4c517998692cd8331552892e199a01a6922bda4d38ac4c01f708809e529c3216eaab399ef25b350ea213ba47126f278140e17391ca7139bd13c56f415e6b74aed8dbfbf38c95dc6db366fd72aa863a27fa1ebf198716400b978a3709e35039731930406588ebdffd35fa230a9b75fce41d7acd214ca4f0029896c137495eade0cf4d10fe621c73f01061acb077de72177ff5dbc6f0c5bec681aa34668ca4fcdd727525068b0b0e9072971b84ef6ce11d5c3c6024da40966703dcc2b33ae04f677677635a55db508f34f1403cdbe37960c8577dac3d848b29f3b5c5c6c56fb74f34c8f4634c04b8cce9b218f1760ca00e6de87efd14087c633469c892bf3e319443336733bb60cfb44941bfa25229aa24384d812db90fe74e0f93fda005eea87400736cabc036f71421b6657b1674d4a8f76cbbf3a8b1c0af82f72973927752257c532db439d96762ad64f102551a9d03f9ce3d8cc850c393c128bf8054bb55bb92ea31ec0706f083a9cf90424c617f8ad2a21225d1913c30e8f47a6b7131304d536a85596ebfd987b64b6bf3c51638d6c839214b53c3c10aa52bd9c6eb77fcf80b5e3b724dec1381d0e02207a6adc73ff53d9d1ffcee1c4a28fa5445ce518eee937074ff7a402f5bbcb362ff090415f9dbd93b62ee56dc8c50e4d2e34c6c621650c0dffe311484e95d68de77170c909c815828946aeeec7ede56bcf433e22fc63a33f764ced1f9242f3d26dc7558686e471f30fbe9304d3d56af8b23e72a4088970b24b2f7e968c1d0392eeeb0b0f0ac8c176547a5383d948ed15484b79e21314a1f28ed624f61e5aaecf2269e5b027e1910ffddede52fad4e8da224e8a10b079548fa7cd44172f4991adfd7623d13e5a19c812824bcf990c07c9721ded9093be6ce7bc7da3ac8c932133a64396b822be92b088844991596df893625a4ef24543bf75a10d7d17ff70350ef62ce3a7758aebbf9b3977b08becb9ea28376082f607965f2cded28bbdb39dab7e00833b0488370d221742b66e27d9ee2d9dd07f401bc22a62c8a9d8d3a290c63804991496aafa47a32578f583cfb53d0c2199055973440d7535e0da6cb2957f4e04002ecea68f9c3ff76cade27ed15fd7835989d0abb197fe32f68636139a42710644bb25860ff33f539200e3ccb8a7738422ca0fa0c744b4c19d15c5d4a3cb082e20a78e20b5a4965b043595cbcacad500b5adbb6cd597e6a4b9c5ea6a1f2e653b5474da277f1818048094ac9e0e1e0b20068d1c1ce5a114a4db7195057a6ce4d221c336fdc29190fee8ff855cae8b7f7c02eec21f972c827066d9c6dcc4a4179bc44ea9b88abe5124bf78b071e09e9af43f739a6e1030091fc091e73edc447f25c68bf84b8df7aa8f091ab42662b93e02c27003afc7b0ca69efcfa60bd53d4d78ceb7c4d2c8fd5ed7e8b35024de849e06400ad145fdb28348d22b317ccec704c401f88db1af2a5348223f5cefd914e404c9d73805d0de77211881486f1bf4aadacadd3ae2588f0db7b5e6957fed50a374f541cfe5e4e923c82ec47e5b3d2c70ad6760c79cd5080b490bdc75f9ef5e1d17f0978b1e8770775f902b9463e6980e1683b2454751ba2dad4a2e6460924bd60ff49b03230cb11fcd04a0388e60874c35d3f6cfc4dd487665e1b16578751eaea89e126bf58044596e3188c7a9631017be1f2dcd7d612331832ff8755460dc496aa99a61ea053c78e72607a18213ff9ef4bb880903b91e9a43e0b1f0ed1511b2eca2f4253fcfbd7d0faebf3680fbf0a45df231544882c9c46505c726d56905d02fd046c1652d8fd06d15286a1a8f8b69fbd825ca421fd80f5e9ba1a23f924937ad049adeec60c78fea1adf9b1ef7e8ac4d1ded18f1a801b0bda8fe9a88098825ff3eef5c1fc68cbea143310b39543293f3f5fbcf4773b02054c0bc79f00554947c7604b36389c0c45f597a88f3713456b4cfd83b30cb6520b624aa09c812066a8cd542dc67e19e4c92b562b4e0f6799fe57d9d4f4f3e0b6fabff4b1fc190bf1e78775ebcbe3655d370ca6c08f48decf6153a4989eeab6921f8475f85197f51d651e563994257df57977e5f219b4879751de57ab0374b407a21adb4ba520bb35e7b7508675bf49f4e432190451423cbd529fc79b22baae9cb1d8660c3a49c456ac03bc06c0ef3b02f7d8acd40919315206fb38e715139c9bd6f89a58634fe683df03f5bda719764f6c38131bc5ba1c53244472ef73834ade04b86ca08dd753141ac0a9a230e246735060a044018bc9b75d50134b20e6219c13f8325b5a0201e9453f6f012fe72e829ee1c637fe30037a9212a31c6e713726a6cd4cf2dd66ffdba77f1e2800e717940f231d04aa2e4e88dea084754947d848c0271856bfe659922408449858a81fa6583f062d96898d18ec53664f0067eb9b9c40ad2579ba9802abd8d1bf287e49d94ae397e784db14b5f7010ee4fc42e6e3c8ba80370afc188fcecaf466ea830d7b16362e5c9329980b981decc7174f3ff70a35d8a180ee12ed0cbffd4e8d14eb503387e4959f702d4293109e922eb561371f9ab21475821f8555d92f0aa1c3d841a6f1eabd4e663993636c754ce2b3c3f6a6b6d0b161e777b8296d7dce7fd162970496494d4f60716244a5a7fb7cee40e1d565e6566697e8f9300000000000000000000000005101318212b
 Error = INVALID_SIGNATURE
 
-VerifyMessage = ML-DSA-87-Public
+VerifyMessage = ML-DSA-87-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = bb4275ff54c22d2d09ea1937a0667362acd44925c6d6965fad350b111d1cbcce68ddbd0e576d1a8810eb4e71623781f32f747d44c8e693749df191682f588906949d97617a4b0ec54ad966818dee88b95f0f28ca24bfc5bfe0c316140b0662c43093ae48b899cc71e5739e9d67095ed987a79b6a0e7aac960c3c4125f0e92bc9435d10bfffae34bb3af05e977ebe0bafcbeb2381c5afe3379667b4c201aebf162dbd0a4bd1baa88fb2f88fa970499a848737d3cf94cc8ce278880a169cad91f304e4e8f1091d4cf39d9a3ab9f88dcc6f3bc4df311a5be0cba290365b3e879527e2a77f0cb6eccc9d85a5e592fb00f3a2e925a26d295a6b82746d7f534c83c35bc4826ee4910216b9a2867032698996fb0e1669b539ccd2ec74d181f4844e8f4d28f9c174316c12dadb54cb1dde7338238a20731c2565bb959f8e3086273ed03abc7ac515728750633083c0b397b29d385d13f5afd2529b32f00dce66c9dc8ea93d99c8b61c5e0ab2fc70de2a8dabdcaf290d53e8fca7561bda8c516ad475e4ec6c7cd2603aa3c8a71d9fa5dc7efc33cf318bebc1f1594e6ea25c69b8f9ce34a65b8ab0ae8dd3538bd267d86c584b8f354d7e4776ed4dd59a73f9e70a1df572f033b69b3eafa5a901e02515472e37258608875ca469de07db71cd6b8dc7edeb3d866ed2d219e44fcb133a066e89d8e3013569ca6f1fee7bf4ae56a6d32a5f3e5a530819c31aadabc8a88503edbea9cdfa3171762e1e8bcebaf9bb6af7e540102d5fc810bbcf1e02ae564e04d9dc55dab0a9392d6c95a317730d9793954da2cb16544d15403d0db01e85881e2d4f1b9b98458e1af0985f98b014f08f200558f2fed7a70c352a27423bedeebb3775c0a1ede9d461d2aea303c09c8b1f73fc37a5b3a01fb24a131574f7eac90c78baa38cebe81e2335dafda20299f76d6a0ba77d2954d11381674f4069f45e133886d64222d92583d5908e3ab6eb6a72cfb41f7dc3e71c1383888f61624bdcaf12fb716de98232ee329af1dd045f30d377234db7bfd11ddab0b3108329e16ce568c8bada39a98df5a5f72a72f063fa4253313a806013f61ce5adbe54cf42180ebf6e496bd4b42aeacf069aaa8e1c231fd037b394d78a69d1742b45bc5784ab8593a198077423c4c357d734f9899cfe9b3b62b6b9c3f4d781b8484a3fd0eea7e8d6945f4ba2b046fee079b7f032bebbc402918daa2aa1c9433dc3bcfbd7f49a5d7a293833c21c1bade3e8a7ec3c83d485529de51b5993cdffe23b770e25acab0ab9fb3059f14952d9464ebfa36a6274d8da317a7b07c2afe38ba28ca942cf7bfaee4020e59911c047b2aa24d1787baae1bc3546364b782358676d75c7698769f1d4a0d5dccade7fcf80e308437f7fc24fdfbf72625abf1b0f534da62cf860da1efd986950e3e19a085999f4d008fce38459c673befcdf2287c1766e106beb4f3175e97812da141330dcb2beb3265e38c8423c19dd50a655c9e8dc969f6367f3383b644d53a26875d53cea26de429266b506e70e7e6832886ed06d81738b0b482bd23bda396eb674ddfdb64803d6c4fae2f040170b5a28923279838b7b876220d02dc7478666f7c3287b1ba4a2f8228e8c491a55ba459805c601b986caea27ee9436f63383351c74d673643b15f6007fc6dc49e337a65a8a96ecd7eef4ad730bf3dc1972fc396703ee26af1156dc4beb46c47d99bb69ebdaf81c2d738d0f70e57a2c7162f5a55242255675f22082aa43f5b3dd862b535b2a15bb815b4e9faf16a302552cd6098d40930dfad7a7c609d6aeade814242a8bf0721c1c26d0d3daa7a638880a6411c6538d80c259d31b639aadaea49563a8d7f5ddb64291d6b086c80d72bfe7d26802cbd20fd6ba5495011e42da1c82483cbe8e37838e73c48f79f65b205476bee600399feda6aaaa939eee12cb34be4e6bdbd18032c85b54a2713551de677a16ca0142ff97b77bc963e8f3c57d91df9b49474b01ca514641842893abc3181caee3f49b635d17daf41bcc4aeb1116ec4b3e78ff1480cf3a5d9c6a154384b88516834d19196976e2ba97cee91f7a0d73f7f8146e58dc0fc8f510511d39d82a7ba531a4abcce6b624035d753a37c5980343cfc7724cf83efb0c33fc4abb5b002241bf57a46b67cb5a4cbd637b2f19bc93b368d97e13c6a62c8443c8222e0a90c3ed1972cc739b824fdf729ed8eca02ad96bd78bf6d2b3d2853e24fa93199ff41635176b31aab2207013d0a9317fa49668dfeb672b8129e6175a2998642ab8e74f0823e3b5480ae80180ca395f5348744a3c7b344891f008aab65914760b5fe852615ad6425216b1c5e777db1a46517cd01a77b277cfa2c6f250c2d68c495fef28feee6e0716817d6b30716f5ca48001805042133eca17a41c2219784ce0f12858ccfd371c77b90966ea04c3996851edf31aef962946628007de5531b06fddf3449f6c552eaf6e16b3e9160e265900b8c8e414732505e02660e123d45a3d6f1b15e56fd759d38e821e27e84967e95c4b0d2a48e008897e655d1b65b76299f1e3074209abe44b37f8786b02df23aa4dcebe512e6312f1a3d6d781d749635247aca897626f5ee688f517df6cfe947ddead820f07fed4bcbe7f1bee3f19117b5666dc123d528f2bf03db346d6afb53804b0681aea98a9479fc6de5ae974d2c0d2055f07ba8a1d2d8b6a7e08a6805bd8634cc190c4988b502f475c36d78c7b3dda0057c818835bbf21c5a7c13bb6fd91cd3cfd76abe4c2ff908a08a3000b9021500ff94b297cec0fb3e51b1cae7026ab4347bfd5b6a641a3d347f45a2a2aacd22e521e00da0c3986c67672c5d7d7e61e7edafc15d42aa42cb37fa8621f79e9096b092efe853ab318b3e4bbd90f20165a1be1d3aa5b3de43751b65abbd952599869778393c4351ab8f534fd49e16547df01c40bfaf56de60b4fb0019bc34177cc8e2236d219fb3c0b84dedae6b88e134280eabd1823420cd1afe6d929774967fd7d885fbad33d89ed9dc5e0eb978eab5d96c50bed5887aa8277880c7b06bf2780cee82ce639a1e3344c88a25102edcc17a4cb48989c4ad6a998726ede31deb0b98107f40858bad7864983f6ecdf0c9761a42751b19d5360daa7fddbbd2e2292638b95c763ca1e747eedef0dd387e9d9ec9e5afee207d8c45703c5befc2de3878d313655ce85ad984250cdf054360f33d41dc193060d42cf9528b1fb91d6ca3395199e25a1a7739eba9a6a4ac2c417ae615940b3eb1b746dd0ecc7b2f7acdff887110115629f70877dafcd7a6625fa1b9e256bc8fe1d66005dbcf12fde0a5fcda5d4f23d58ece91d60eb91274df8d9d17d4a39e63533acf1b317db979b04ca3ab9a0bcba652d0010ca3fcd33ed8f8a62faf42f78b37912d3adb410f20bf16b31359cacc25fb783083a3f065f0a2dd6fe58b8f594e11a87bf0f4c5f5493f334c18b03ebdefebce50228937ec13a8c221b617450486291071f3c14f64f66c927dd4bd623c214ac35433b8a6875cdf00916476eac0f196858aa1484bc1cd45b726d33a965619829b8deaa9d9fa0c3c210f23967ce26a4bdd939cff8aa662f70fb0af97ee44bcb9e2755000a195741d8919e4dcb1a5caae21009f686fa1489c72f16f9fee76b5410ece7f406947f4a19f394a5121da79f3216777b0fee5423328156ecf0b4548dbd5b3f7b526d6b9cfd57576f67dd521c314c2d37474ed0cf732c3b073a101c735a4c4e6b33c9aaa12c91d147ad1075a20287d36c388657614a9c648d8e49cce8cfa282b2a2e8e9da6e4444e4b6aed1bd0ada5009a335cd0500bdae9a01b97f7e8cfe8372398e750de92ee4a524393a19826d19de5e762fb53a88b9b4657e9c6d7d01a4124e3e39532f614aec5cb88d982b78b2ff568017c92f6a1ce5298b5f323b5ee61695038ef0c3a7a339cfac31cf7875a4563046a40e7b35cef1d37d811b342fcbb5373122415befc23cb656a619f7c262c443403b23ba20e341a079918dec6f4f801b92781179ad7ac1951f39ddb0b1f1fb95b28c0f4593a04486f0e0e86bb3b014674879aad10f41e0bad34d40bc817b6fd43c1dde8547882d82e5111e208107e9c9736d16ca77ac7453d7b6c7976a7dd6a4c6c0252185bc9948660a07b66151b09b980d8572ae829ab2f6d900cc63066c4ecb3a0317e8a9acaa8e22a216721f3d69c67843df2fbedd88bc424f761cdf420de4ff2c55b6925b1826c1c4134090d2aae82a7f64a8d428efe1b21097a6fdbc9b8a31c4d46c7b32d478bf5b9181bef8af4d3486958d7c198c46a5ad771090bb64e7fc2bd7677ae7618b861c83c13177075063517eff40cfd52ae56650e9e7035f783bfe8920c754e98470b327909ac2a407e07864710544b8adbc075502c75b5f0fdbca0cde5d94b013141c96b55ae1b60ab63f9e792641690af41b05a78233935fd7f82852ebb2602a10459a709256c41d108c2aeb71925089cc79b121eabd5edc54f3f7c8929685b88ab29700c7fb2f247cd7962c8ce6dc9f79f9358d6a7989d24ccc17d0dbaa0b7fbe73479164181ae7d6b6a02678cce46f74ea2bd387ecb73041817b429a0220e1c3635fe492f5f3a8e2b65c086fe24c375563d7220856dd8f970716d548492964a156554dc88810c3c4f81dcc3ae80243e19679a3be9c9b1b8c707b416e9166c54a568bb9d84728c1a283d9231a12b13688ce2362901342652d66bf44cec223f561d2735d977c6adcf57e9066220d0770fc77fdf6ff367a2f36ae20062887beb88d1b453f267aef9bc763ab716bacb9214c38b95f4f2f3f6c236aa71aef83c1ae4b26133678884476c1d7c6d3e7b99f13e028ac6cebddfae4793f9ae975f3d66b725b500e7c7d2f664eaa0c358deb91cb2d6173394b306749d2bfb2684b985769bdb682e922b75555d38dad1899057a64ef6ea361e4712244d02d0dfec8c3d40770122770c2538d6a14a8462ef18eb705c16e5ba30aa5366447c94869060e4df155f7d01ffda04c1ced0ad5fbe5fdd85856e1e49320319687d31a6e4c7145479f45f43a9b8e9ffe4cbacfad4a21e5445e119df2996cce8b11d0f224efb4f18b544d456e2fb1d96fcd99fc319dbd86720621ac25b490f3611f7e5655bb3940a503c07dbf41f4b87593595a66008808744668371a54ce1b9dfdaa16f90415e57470bc23898d13d8351ba34369e96347da13d012b4eab32ada90668654c5ed2b433716b1b4170f640cf4b40659efcf4150237bbc25f72b248be85cd482b55ce2f5f73e8f02efd2465805b37d12487465ec1085bc6602b71862771af13e13baece4916b1ddef9ce016c92db9fb9e82aee5e1c4e22c45090ad1c19801ce1c541ff3902baea7a12dbcac6ec2d128ac7acb203463921ca6ce1d182d60d553ddecc4a3175eec2e924e9191e0d69aa49ca0b653495b8c62b802e443e669220f2a4047a56ed5cb7431a3387a435070795e6e63d242a74555e97371989c6d0040748e89ac316618d5d6eb7bff8d91e953afbe00464df4e4f6380c273b7ac5934cacb6c3be4da6649c8a5ea12bdf9afa1ec1e5053db7668c10ae2df75c4b3b14525369bf33741525a7630158aca3d3c7da5c1d71d3f63c0c2948a43236968d623c6c163eb757f0c78d6ae682ff4e4b673be07193e8d6c106c92851b393f0523491d5152e06de675fa22ae7bded329836a8ca0b955a59cb575395952c6ea0cb1644f2cada196b96b44ee12115ff9668e32886103d8f8109fac4a2287738ee1d2d4c1c19dab94eaa2757ea32016df60d7286099eb010ba570b5791ce4c54d860b15d56c53a5ddb543b0b602b3a87ca5213aa9647e51b1cb1736697506081240f4f7163a646f2be30e62c617d7572d820a113f96320834a2f43842160511923bd1ef4f723a2ab9b242fffe97cf0199c9f2ebca266a63beea0af279f2d18651b2ea9789d03025857c8aefc5f8bc6ee92ab7c6ffed2606f9c7ef25cb6c96140256a08cc58218869c52f3e5074fe5ace87a86057cc29fc845ff275f1b2dbc5991cbebe4c556b29ce3da3415958f0c9c68a5c664a1da60365ce56b9a4df24ec5d69c6f5a2e685885f6973c0ccd4caf7e000346bdea502b1418c8819e05bb7bee31bbd235819b49c892f7dadade576cb8ca68bda916a598c32ec03cceba2d01a7960f38680facccdaaf05e254dd8c3631a7222d1561c998c54b16f17a425f3247232dca035d545202e1b180340219ce31c66987bc86f983240e7fd2c926e8af77e6ea9f4139ff1edc0c323b67ceadead8f64a8004164d942f6aa65a28544d7205d41aafe62c5bfc6fd9fc322e2a8b620532d00d1add7a0d25a9dbaff90e19de14ac2ca97e83a2d77e63888ba0f7eaf9b18a7f2e5f148d16887580e55e894ae79024385f439acd071494e6469b77d07e763553652a470f3b4bd8bb7968052f3a969dacced51572bd125870849ce3e55359b2e17eabc3153b5f62868ea0ca1f40738488dbe0020c103f53678b9eb1c10000000000000000000000000000000000000000000000000000070a111518202731
 Error = INVALID_SIGNATURE
 
-# Verifying messages with the private key works as well.
-VerifyMessage = ML-DSA-44-Private
-Input = 48656c6c6f20776f726c64
-Output = 1aa69cb5ed35204534f25f40a17eb0d767f8981f5e7cec46d3bf3252bfc78e09d02ef0c82da6dde973611c849472890106158cb15ffa6ca891615e888efa0d2d8a121b75ca440228ad32991be34249620f158ffd6f74d7b03bf919218ce259b500808ec157ead67b56b79e9e6607eafb9227b8a30adbec087d35bc1aec2f1a0c4dd126dfcfb9fbf0bd74fb1e092495fa994ab5a7cd1333281aafe834694a6dc11e889c762b5645638e172dfab3060031ebcdc1fd455d5de6050bf71b074a4dd34af5ebf15487651f0f13e5d3cee231b9b347810bfc418196df9d7231780c09171b9aae732bea27a1649d8c03220f417e30a016b08ccb1d55c9337b4812e20e04523f5d29a760a01b3a80d76285521206481ee1e44df09a76913ba54ae50c8eb973a3ced73950fbf39c4c0c1262a216821a442072c10cc82839ac57b898411be9e810f893272a2546ff7d1d920f146210efc2b4528bc98a099a398302d301fc1dea31b3d8ff78246a66f690ef536b68e02bd7ea23a5378930dde7f1beb51749896a7944e5a40e6fbbb1f76c3fda09e32e0a58062c24cac7ddb8c1d2cbb352a81e336425c5f551246db45ecd0ab29dac88cdebf51c60bebc2e27c974f56da12c1fec4f5745850429b607f5ed7cd821f2c91fc2dda8c2c8e8ec278d1b2a5bf50ec70c5623fc681b4d1dccff96b324cb53ff97470f9de177c2006a89af8f18603a6d4ea2625794695fe79cd30318a1e76307a4c2a353db1e076ad9b609a2489b94cb6dd821c3af31046bb7a5d43d190e09fce4969fe4e93c8393975e64cb2d9c2294fc427ef5191c40937929b3b0e1b037e6b84cc0299d5af2b5410118bfd88ef6491af6f21233390ca7a19f1576e6c5a10a673796905562075047896e3a2379f64dfbbc12b9bfe64939c2d05efbc5f6e4b5ca69ce1ed4b7d25e8c835b0612b33e13ed7a8a7233b4b3d58eead0bc4c841acb65a5ec0ed45e2584c23c2a162392b5789c62358e4038864e20c10e10c67d940ce78993178dbeb3de1fea1e50e7c29f4d7d938c3bfe50229ea040102f30d5b3a64cb8e13420065d54a1ac50a77383bdff3cae2340ebf15a1557fde897007c1b67d04f19431ca00cb0f08db87e90e166e0f4ce6fd69c6ecef1b3f70d9eb601b57a7bf931057c2afe2d3567b6bbec7891c664713385122fdd789c1d5a8a9cfd491f407c16d0b0c5dfc53a6862208e264b981bf2ddbdd1d7db9729b5265c4c3868a947c982880bc55b786153b89ef3324067b35a928c51236bcbe9f860ad9eee5644478f894a9fe78d26a5a17d482612f1cb9983b864e6fba84591c0f73b7b27918819d2121d4af640f533e2939d3da0f0aa6b9df80837a80165ae8b7579715192eb0f6cca78a43d8ad8d7abb56d816e3af2de59b88bfdcf6767abfb043d3ae24223d05001953faa292671c57ade1fe28988075ab8d14ac98363412bd694c40ae85b1f104afcd0f25aa590f57ba4f5dfdf613bf8594e3f54baadfdf50c0881af2475590758a23b7eee725513e4d1ea9f4630159c424a289f18a9879e5e173390f8e630f6ee2a6043d82a1983dc97c7acfea3b0c03e27e865d810d012daeec28dc454f59334edf24627d435701d329ff5e68d19bbdca5ef7d5e00204fa947d08f81cb6484cabe60989d2f61fbe70940f7e4f449b3fcb103a89143d74b15d72e7913dce9193a0b9c5a7b2a97bde6d7f396ae80b4b566f9f2e7345bc42ce3b002818e19f0f16416b850832cd02279ee8d58a381deaac09b1b4d4613f4d066805d2faea6716e015fe361c0526c6e4617a389ffdf930213c1dc0c4c905c3106a7517dce7abea7a9341132f8ad98de3e42f6b75809fff38f6eeafb97398e79d50a5622338763c4e45a88ddda7fb87ab7f5cec61109fdc1c5d4a16310275241fc34178028a49fd79581a05c3b6984eecd6cb9bd60a44da72600f8f2604a4ff4578126194fb2269c8e6e71447445e8e80bf8c6063dbbf29c7ded58abbc0d2eed347bf495b6a9cbe68585a594aa0e65834bfbcccc3f6bf42fe4ef42d86232c3fb1412dd0b5f8a0489958f5c3b883bf7851337a35b13dd2b6517626ff2d1064cd189beb402497dd6b8893d414dde7d1d51018c7a83766a2d8a29b80e8f428237732f7ee5ba878163f0aa8af5b60533b4d4621a38fdc54383acb3325b5e876e21483eddcc64c419596e656d1557be31b530ea66054f79d4f4a755f9ee33c84fed5d552ec5e2eccd061cf4c4b5c3c16a70a7baecccfc208d2430e78621c9ae5b0d080973b4e1df0a1f5c0415db6d3c85f9ea9041e9a9abdde71d6776a522aa957f708b14a33eda10ebbab93bb8ec2b7a04679f38eb44fc558ee698d3c6937e0e647dce898d7599fef6de32ae4d52adc722443610b2126559756aa36f3c79696b99be3d908f780fcbaef33b215693634d63ce2a0777dfbbc899d2be72efdbafbc10aefb26a1a63cdcfda00235b34db723c91624ee5f939024dfedba0863ad08f648767d41fc7fd6b317c51f4b1b87e21e07d488c9423581f9bbdae43e4d32b37e8283960524f9a601ab69f5cd7fb01c9a8a5c64fe863519a1e9f3426398f691a96e1748491b4e209fca2ab29481a674621c797614ba16fbfdfd1a4184e7f84667e720e6bcd9debef32c2b9e891a6e3c0423158f539838d8413e9fc707d5c65b23368b6edc95d9c3f8e20bbb844499311614945606c1487ef4015d1e260fa8239abaa071be572163132bdb06ef21e31be0f9d4b6747134e4842bedcd3bf53b0d6f054693bc428e9a715d5a32a79e6a3cb8b81faf2c04087d8816752637a2fe11eacb38341e024848562a29d4585e4ee56552ce9b1fad43b965a37bff8558921790ef0f4ac55bcac4327d1783f5e1e79bf01e96934bb4a8f5dd06c83bb70b2377189d622a106100f0cbdd38e34c0565900c616561161b3261859133f83893feb22b0bafc82cf4f0dbafde0648e2f86260e6e747034e5cb3ece98087fbf74179c6306f0c460b5d609b9b3a66761472ee0b9dabb5dfa872d5c6bc9b33461a27b5427bd8833f874f479ecc5f0a20304b9a75aacc82420a87af6469daaef53391ae8a25468e717dc47f464fce45a31147c0c4e12ac2f834567e4005b0827d13b3ec80cd8b7a907436e6624c6c8ac6a80add35cfa1a28872fb65cb3fa46894d116a052f19b5fe20c7ead10bd24d27ad2b5683f299d1193ec6d9ff3379f3b3e39cb9991831f194af2041085508da4dcb7b8785cbdc4e04cf4d826d1ef4a11036e4c5803c3aaa7669b4dd3bc12ff888984e9bbdace0e772ab59332b47300334757677578808e90929697a9cecfd6ed1b303d4250738a97a0aabac6d91e283a4b696f7181828493aec8cdcfe1eaecfc0227484957595badbcbfc8fa000000000000000000000000000000000000121f323e
-
-VerifyMessage = ML-DSA-65-Private
-Input = 48656c6c6f20776f726c64
-Output = 69da5aec6d5f58fbf29439c520bd68b966e3dd2ca633b68351c2862344713a1e9c086a44f9a870a3ccc14de62d6c12b278c354d7197c4d6d7f83d1422b29b250f5ee3fec118311d905e5db2b4b8b23b8d542202d6652f6dc3f9d7ed51f2463082d3f145cfd0fa7ac548a47e91c1ccb1a55b215e90ab355bfc6d67154287b1dfae0fb530264dbb841a7684b396e5ca0459d795216416a9d232bc89b32e0f9461f53107c78e66c8e876554e8ddd501867b55dcfc1fb33f102e03373cdd192640f1027a08ce277b468f6ed0fe80a9d6cd2d6b2f7a3738c8325d95b0ccc6e7b9fb000c923b92298e0867d4a9f6dd5513e8001033c633bb1641ee66349487224dd43386c7fcc29916332066a868100d46e2c5b8354c28f087a024cba27694afc4c1665e0d72b37686919ad55052cc63a144febe4e2a0c9ae416e064e289f9f69cbb883665d1130826b7b74e30c94a2b98b67b471663e3d66326db3b43bebf958e8665b68eda90e8c5d9494b0c7c9ec48800910dd6d906b1fcd47a0aac462ac87b126d21b5ba150df61f752257ddf5a063b4a5b150371d625535e3b2874b9fe548960ff67931cd6c12496e8213e2ace6fff48e6bdc60310e49389f62579db26b92ad73e9d3f23942cab51784f48b3660b6450caecbb0df2aa4c8e56577f5ea450d2f7f51aacc0b304a62250bf2cae7b99dcd955b6596625d06da1c67f730b706fdba630f00fd891830d251484640b7258ab364d6fd9986878fffa69b7c44b92e43143affae8b098e1d27716850f37553bf266cdfb561abbcdbfeb80752b364434e64b80429b54cc88693ce03dc0fa147f0741b215f0728499bdc25140aafc976ac99e910ba8a8a50d21b7bddaa28626b3b90a93fd44077068357c81d36e735eda4362930adead4951a0baa104f384fc70e842a9f329e1868b07b455e9cc3fecd54805c9052e70f88c3b92fe0fc6a4d7dda18cf5694e5398860e439a1e19d5a66f2fbc0aacdd1a498711bb16054796c015a715395ef6174e37b04eda589b673c4d5dda737817fb52f392caf7a72d7a3e84b2180cb5b75bc8af065bdc05c3e4040435a1b160081352ac43e09cbf2ead6e09c2b0be0e37894888fe2812f68806f957c13fce6ff167bcee21d4f412ec95a4847f3db7bf441223a4d4ca9ed69adb4de8a4b5b01c775f2721226e6c59ff26fc38e1bb78a384b30e7b55f082e264d8f25e31518619ddd6b6a9faf8aa6cdb5eab75ed59a33825d5ef8b93bde5d120ada773fcc0852b918f4f03e2d2a543b15363adb823eb1f6c533b98d940411e1f5c1cf521f9f63d5454697608326625fffe01bf87f44187dad631df2898effd2c291d98222e564abe3b042b75e90c9c54667842fa8ebb68a1244bf8e0c3ae3ee5f97d5ddeefd986c4bd3f99d877c2cc2381a89abdc61713d38cee58bf69805a485c288d21b15843147066b4a74c69dc25de878e21d35fdfe6746feb4c166606bf3219e42cf63581e7e6bd6570f40f8fae590cedf5106fe57037ccb2324b74fca6500f6ed3d0736cdcc67d04f8fa9e80054a5bd7c8459fc1abb1c4c78677d7f6b325af94a0e5c9c7db0a748e12c5265e8724947d9b5c4bab1a8b6faec827cc41ec115ef3c2d7348cddabddfbc8436f3b41765e13f3762b3b45ed23156f085831e726a55d4b83848b3d1d3352aab9edcc0ac2388f2383f6301ad813b917ee3f23734e057832ae4cf65e668c9ddd0bdd0f9d8b6693254649668aa91a1fa5eb7c59859bb6ddd36c25f4a2223f5d688b480d0388fa307ea69298f9bf7737f6b3dbfda87b331affd75cd8d88f0460e98ebc2890b217bd6d11000a3a088cd837f4f8859a43f76afaaab05a0c3007a149d4d6b9155cadc2c9b55003efdec5012b6272b87183694c505f0446ede55f35b8ab201f9eda974ff840eccb0f004fa3acf753acd0613f66e2a6ac82e322199d37b4af83cbb3d98371c31be79bb42331e819644cbad2ce27a04e4c517998692cd8331552892e199a01a6922bda4d38ac4c01f708809e529c3216eaab399ef25b350ea213ba47126f278140e17391ca7139bd13c56f415e6b74aed8dbfbf38c95dc6db366fd72aa863a27fa1ebf198716400b978a3709e35039731930406588ebdffd35fa230a9b75fce41d7acd214ca4f0029896c137495eade0cf4d10fe621c73f01061acb077de72177ff5dbc6f0c5bec681aa34668ca4fcdd727525068b0b0e9072971b84ef6ce11d5c3c6024da40966703dcc2b33ae04f677677635a55db508f34f1403cdbe37960c8577dac3d848b29f3b5c5c6c56fb74f34c8f4634c04b8cce9b218f1760ca00e6de87efd14087c633469c892bf3e319443336733bb60cfb44941bfa25229aa24384d812db90fe74e0f93fda005eea87400736cabc036f71421b6657b1674d4a8f76cbbf3a8b1c0af82f72973927752257c532db439d96762ad64f102551a9d03f9ce3d8cc850c393c128bf8054bb55bb92ea31ec0706f083a9cf90424c617f8ad2a21225d1913c30e8f47a6b7131304d536a85596ebfd987b64b6bf3c51638d6c839214b53c3c10aa52bd9c6eb77fcf80b5e3b724dec1381d0e02207a6adc73ff53d9d1ffcee1c4a28fa5445ce518eee937074ff7a402f5bbcb362ff090415f9dbd93b62ee56dc8c50e4d2e34c6c621650c0dffe311484e95d68de77170c909c815828946aeeec7ede56bcf433e22fc63a33f764ced1f9242f3d26dc7558686e471f30fbe9304d3d56af8b23e72a4088970b24b2f7e968c1d0392eeeb0b0f0ac8c176547a5383d948ed15484b79e21314a1f28ed624f61e5aaecf2269e5b027e1910ffddede52fad4e8da224e8a10b079548fa7cd44172f4991adfd7623d13e5a19c812824bcf990c07c9721ded9093be6ce7bc7da3ac8c932133a64396b822be92b088844991596df893625a4ef24543bf75a10d7d17ff70350ef62ce3a7758aebbf9b3977b08becb9ea28376082f607965f2cded28bbdb39dab7e00833b0488370d221742b66e27d9ee2d9dd07f401bc22a62c8a9d8d3a290c63804991496aafa47a32578f583cfb53d0c2199055973440d7535e0da6cb2957f4e04002ecea68f9c3ff76cade27ed15fd7835989d0abb197fe32f68636139a42710644bb25860ff33f539200e3ccb8a7738422ca0fa0c744b4c19d15c5d4a3cb082e20a78e20b5a4965b043595cbcacad500b5adbb6cd597e6a4b9c5ea6a1f2e653b5474da277f1818048094ac9e0e1e0b20068d1c1ce5a114a4db7195057a6ce4d221c336fdc29190fee8ff855cae8b7f7c02eec21f972c827066d9c6dcc4a4179bc44ea9b88abe5124bf78b071e09e9af43f739a6e1030091fc091e73edc447f25c68bf84b8df7aa8f091ab42662b93e02c27003afc7b0ca69efcfa60bd53d4d78ceb7c4d2c8fd5ed7e8b35024de849e06400ad145fdb28348d22b317ccec704c401f88db1af2a5348223f5cefd914e404c9d73805d0de77211881486f1bf4aadacadd3ae2588f0db7b5e6957fed50a374f541cfe5e4e923c82ec47e5b3d2c70ad6760c79cd5080b490bdc75f9ef5e1d17f0978b1e8770775f902b9463e6980e1683b2454751ba2dad4a2e6460924bd60ff49b03230cb11fcd04a0388e60874c35d3f6cfc4dd487665e1b16578751eaea89e126bf58044596e3188c7a9631017be1f2dcd7d612331832ff8755460dc496aa99a61ea053c78e72607a18213ff9ef4bb880903b91e9a43e0b1f0ed1511b2eca2f4253fcfbd7d0faebf3680fbf0a45df231544882c9c46505c726d56905d02fd046c1652d8fd06d15286a1a8f8b69fbd825ca421fd80f5e9ba1a23f924937ad049adeec60c78fea1adf9b1ef7e8ac4d1ded18f1a801b0bda8fe9a88098825ff3eef5c1fc68cbea143310b39543293f3f5fbcf4773b02054c0bc79f00554947c7604b36389c0c45f597a88f3713456b4cfd83b30cb6520b624aa09c812066a8cd542dc67e19e4c92b562b4e0f6799fe57d9d4f4f3e0b6fabff4b1fc190bf1e78775ebcbe3655d370ca6c08f48decf6153a4989eeab6921f8475f85197f51d651e563994257df57977e5f219b4879751de57ab0374b407a21adb4ba520bb35e7b7508675bf49f4e432190451423cbd529fc79b22baae9cb1d8660c3a49c456ac03bc06c0ef3b02f7d8acd40919315206fb38e715139c9bd6f89a58634fe683df03f5bda719764f6c38131bc5ba1c53244472ef73834ade04b86ca08dd753141ac0a9a230e246735060a044018bc9b75d50134b20e6219c13f8325b5a0201e9453f6f012fe72e829ee1c637fe30037a9212a31c6e713726a6cd4cf2dd66ffdba77f1e2800e717940f231d04aa2e4e88dea084754947d848c0271856bfe659922408449858a81fa6583f062d96898d18ec53664f0067eb9b9c40ad2579ba9802abd8d1bf287e49d94ae397e784db14b5f7010ee4fc42e6e3c8ba80370afc188fcecaf466ea830d7b16362e5c9329980b981decc7174f3ff70a35d8a180ee12ed0cbffd4e8d14eb503387e4959f702d4293109e922eb561371f9ab21475821f8555d92f0aa1c3d841a6f1eabd4e663993636c754ce2b3c3f6a6b6d0b161e777b8296d7dce7fd162970496494d4f60716244a5a7fb7cee40e1d565e6566697e8f9300000000000000000000000005101318212b
-
-VerifyMessage = ML-DSA-87-Private
-Input = 48656c6c6f20776f726c64
-Output = ba4275ff54c22d2d09ea1937a0667362acd44925c6d6965fad350b111d1cbcce68ddbd0e576d1a8810eb4e71623781f32f747d44c8e693749df191682f588906949d97617a4b0ec54ad966818dee88b95f0f28ca24bfc5bfe0c316140b0662c43093ae48b899cc71e5739e9d67095ed987a79b6a0e7aac960c3c4125f0e92bc9435d10bfffae34bb3af05e977ebe0bafcbeb2381c5afe3379667b4c201aebf162dbd0a4bd1baa88fb2f88fa970499a848737d3cf94cc8ce278880a169cad91f304e4e8f1091d4cf39d9a3ab9f88dcc6f3bc4df311a5be0cba290365b3e879527e2a77f0cb6eccc9d85a5e592fb00f3a2e925a26d295a6b82746d7f534c83c35bc4826ee4910216b9a2867032698996fb0e1669b539ccd2ec74d181f4844e8f4d28f9c174316c12dadb54cb1dde7338238a20731c2565bb959f8e3086273ed03abc7ac515728750633083c0b397b29d385d13f5afd2529b32f00dce66c9dc8ea93d99c8b61c5e0ab2fc70de2a8dabdcaf290d53e8fca7561bda8c516ad475e4ec6c7cd2603aa3c8a71d9fa5dc7efc33cf318bebc1f1594e6ea25c69b8f9ce34a65b8ab0ae8dd3538bd267d86c584b8f354d7e4776ed4dd59a73f9e70a1df572f033b69b3eafa5a901e02515472e37258608875ca469de07db71cd6b8dc7edeb3d866ed2d219e44fcb133a066e89d8e3013569ca6f1fee7bf4ae56a6d32a5f3e5a530819c31aadabc8a88503edbea9cdfa3171762e1e8bcebaf9bb6af7e540102d5fc810bbcf1e02ae564e04d9dc55dab0a9392d6c95a317730d9793954da2cb16544d15403d0db01e85881e2d4f1b9b98458e1af0985f98b014f08f200558f2fed7a70c352a27423bedeebb3775c0a1ede9d461d2aea303c09c8b1f73fc37a5b3a01fb24a131574f7eac90c78baa38cebe81e2335dafda20299f76d6a0ba77d2954d11381674f4069f45e133886d64222d92583d5908e3ab6eb6a72cfb41f7dc3e71c1383888f61624bdcaf12fb716de98232ee329af1dd045f30d377234db7bfd11ddab0b3108329e16ce568c8bada39a98df5a5f72a72f063fa4253313a806013f61ce5adbe54cf42180ebf6e496bd4b42aeacf069aaa8e1c231fd037b394d78a69d1742b45bc5784ab8593a198077423c4c357d734f9899cfe9b3b62b6b9c3f4d781b8484a3fd0eea7e8d6945f4ba2b046fee079b7f032bebbc402918daa2aa1c9433dc3bcfbd7f49a5d7a293833c21c1bade3e8a7ec3c83d485529de51b5993cdffe23b770e25acab0ab9fb3059f14952d9464ebfa36a6274d8da317a7b07c2afe38ba28ca942cf7bfaee4020e59911c047b2aa24d1787baae1bc3546364b782358676d75c7698769f1d4a0d5dccade7fcf80e308437f7fc24fdfbf72625abf1b0f534da62cf860da1efd986950e3e19a085999f4d008fce38459c673befcdf2287c1766e106beb4f3175e97812da141330dcb2beb3265e38c8423c19dd50a655c9e8dc969f6367f3383b644d53a26875d53cea26de429266b506e70e7e6832886ed06d81738b0b482bd23bda396eb674ddfdb64803d6c4fae2f040170b5a28923279838b7b876220d02dc7478666f7c3287b1ba4a2f8228e8c491a55ba459805c601b986caea27ee9436f63383351c74d673643b15f6007fc6dc49e337a65a8a96ecd7eef4ad730bf3dc1972fc396703ee26af1156dc4beb46c47d99bb69ebdaf81c2d738d0f70e57a2c7162f5a55242255675f22082aa43f5b3dd862b535b2a15bb815b4e9faf16a302552cd6098d40930dfad7a7c609d6aeade814242a8bf0721c1c26d0d3daa7a638880a6411c6538d80c259d31b639aadaea49563a8d7f5ddb64291d6b086c80d72bfe7d26802cbd20fd6ba5495011e42da1c82483cbe8e37838e73c48f79f65b205476bee600399feda6aaaa939eee12cb34be4e6bdbd18032c85b54a2713551de677a16ca0142ff97b77bc963e8f3c57d91df9b49474b01ca514641842893abc3181caee3f49b635d17daf41bcc4aeb1116ec4b3e78ff1480cf3a5d9c6a154384b88516834d19196976e2ba97cee91f7a0d73f7f8146e58dc0fc8f510511d39d82a7ba531a4abcce6b624035d753a37c5980343cfc7724cf83efb0c33fc4abb5b002241bf57a46b67cb5a4cbd637b2f19bc93b368d97e13c6a62c8443c8222e0a90c3ed1972cc739b824fdf729ed8eca02ad96bd78bf6d2b3d2853e24fa93199ff41635176b31aab2207013d0a9317fa49668dfeb672b8129e6175a2998642ab8e74f0823e3b5480ae80180ca395f5348744a3c7b344891f008aab65914760b5fe852615ad6425216b1c5e777db1a46517cd01a77b277cfa2c6f250c2d68c495fef28feee6e0716817d6b30716f5ca48001805042133eca17a41c2219784ce0f12858ccfd371c77b90966ea04c3996851edf31aef962946628007de5531b06fddf3449f6c552eaf6e16b3e9160e265900b8c8e414732505e02660e123d45a3d6f1b15e56fd759d38e821e27e84967e95c4b0d2a48e008897e655d1b65b76299f1e3074209abe44b37f8786b02df23aa4dcebe512e6312f1a3d6d781d749635247aca897626f5ee688f517df6cfe947ddead820f07fed4bcbe7f1bee3f19117b5666dc123d528f2bf03db346d6afb53804b0681aea98a9479fc6de5ae974d2c0d2055f07ba8a1d2d8b6a7e08a6805bd8634cc190c4988b502f475c36d78c7b3dda0057c818835bbf21c5a7c13bb6fd91cd3cfd76abe4c2ff908a08a3000b9021500ff94b297cec0fb3e51b1cae7026ab4347bfd5b6a641a3d347f45a2a2aacd22e521e00da0c3986c67672c5d7d7e61e7edafc15d42aa42cb37fa8621f79e9096b092efe853ab318b3e4bbd90f20165a1be1d3aa5b3de43751b65abbd952599869778393c4351ab8f534fd49e16547df01c40bfaf56de60b4fb0019bc34177cc8e2236d219fb3c0b84dedae6b88e134280eabd1823420cd1afe6d929774967fd7d885fbad33d89ed9dc5e0eb978eab5d96c50bed5887aa8277880c7b06bf2780cee82ce639a1e3344c88a25102edcc17a4cb48989c4ad6a998726ede31deb0b98107f40858bad7864983f6ecdf0c9761a42751b19d5360daa7fddbbd2e2292638b95c763ca1e747eedef0dd387e9d9ec9e5afee207d8c45703c5befc2de3878d313655ce85ad984250cdf054360f33d41dc193060d42cf9528b1fb91d6ca3395199e25a1a7739eba9a6a4ac2c417ae615940b3eb1b746dd0ecc7b2f7acdff887110115629f70877dafcd7a6625fa1b9e256bc8fe1d66005dbcf12fde0a5fcda5d4f23d58ece91d60eb91274df8d9d17d4a39e63533acf1b317db979b04ca3ab9a0bcba652d0010ca3fcd33ed8f8a62faf42f78b37912d3adb410f20bf16b31359cacc25fb783083a3f065f0a2dd6fe58b8f594e11a87bf0f4c5f5493f334c18b03ebdefebce50228937ec13a8c221b617450486291071f3c14f64f66c927dd4bd623c214ac35433b8a6875cdf00916476eac0f196858aa1484bc1cd45b726d33a965619829b8deaa9d9fa0c3c210f23967ce26a4bdd939cff8aa662f70fb0af97ee44bcb9e2755000a195741d8919e4dcb1a5caae21009f686fa1489c72f16f9fee76b5410ece7f406947f4a19f394a5121da79f3216777b0fee5423328156ecf0b4548dbd5b3f7b526d6b9cfd57576f67dd521c314c2d37474ed0cf732c3b073a101c735a4c4e6b33c9aaa12c91d147ad1075a20287d36c388657614a9c648d8e49cce8cfa282b2a2e8e9da6e4444e4b6aed1bd0ada5009a335cd0500bdae9a01b97f7e8cfe8372398e750de92ee4a524393a19826d19de5e762fb53a88b9b4657e9c6d7d01a4124e3e39532f614aec5cb88d982b78b2ff568017c92f6a1ce5298b5f323b5ee61695038ef0c3a7a339cfac31cf7875a4563046a40e7b35cef1d37d811b342fcbb5373122415befc23cb656a619f7c262c443403b23ba20e341a079918dec6f4f801b92781179ad7ac1951f39ddb0b1f1fb95b28c0f4593a04486f0e0e86bb3b014674879aad10f41e0bad34d40bc817b6fd43c1dde8547882d82e5111e208107e9c9736d16ca77ac7453d7b6c7976a7dd6a4c6c0252185bc9948660a07b66151b09b980d8572ae829ab2f6d900cc63066c4ecb3a0317e8a9acaa8e22a216721f3d69c67843df2fbedd88bc424f761cdf420de4ff2c55b6925b1826c1c4134090d2aae82a7f64a8d428efe1b21097a6fdbc9b8a31c4d46c7b32d478bf5b9181bef8af4d3486958d7c198c46a5ad771090bb64e7fc2bd7677ae7618b861c83c13177075063517eff40cfd52ae56650e9e7035f783bfe8920c754e98470b327909ac2a407e07864710544b8adbc075502c75b5f0fdbca0cde5d94b013141c96b55ae1b60ab63f9e792641690af41b05a78233935fd7f82852ebb2602a10459a709256c41d108c2aeb71925089cc79b121eabd5edc54f3f7c8929685b88ab29700c7fb2f247cd7962c8ce6dc9f79f9358d6a7989d24ccc17d0dbaa0b7fbe73479164181ae7d6b6a02678cce46f74ea2bd387ecb73041817b429a0220e1c3635fe492f5f3a8e2b65c086fe24c375563d7220856dd8f970716d548492964a156554dc88810c3c4f81dcc3ae80243e19679a3be9c9b1b8c707b416e9166c54a568bb9d84728c1a283d9231a12b13688ce2362901342652d66bf44cec223f561d2735d977c6adcf57e9066220d0770fc77fdf6ff367a2f36ae20062887beb88d1b453f267aef9bc763ab716bacb9214c38b95f4f2f3f6c236aa71aef83c1ae4b26133678884476c1d7c6d3e7b99f13e028ac6cebddfae4793f9ae975f3d66b725b500e7c7d2f664eaa0c358deb91cb2d6173394b306749d2bfb2684b985769bdb682e922b75555d38dad1899057a64ef6ea361e4712244d02d0dfec8c3d40770122770c2538d6a14a8462ef18eb705c16e5ba30aa5366447c94869060e4df155f7d01ffda04c1ced0ad5fbe5fdd85856e1e49320319687d31a6e4c7145479f45f43a9b8e9ffe4cbacfad4a21e5445e119df2996cce8b11d0f224efb4f18b544d456e2fb1d96fcd99fc319dbd86720621ac25b490f3611f7e5655bb3940a503c07dbf41f4b87593595a66008808744668371a54ce1b9dfdaa16f90415e57470bc23898d13d8351ba34369e96347da13d012b4eab32ada90668654c5ed2b433716b1b4170f640cf4b40659efcf4150237bbc25f72b248be85cd482b55ce2f5f73e8f02efd2465805b37d12487465ec1085bc6602b71862771af13e13baece4916b1ddef9ce016c92db9fb9e82aee5e1c4e22c45090ad1c19801ce1c541ff3902baea7a12dbcac6ec2d128ac7acb203463921ca6ce1d182d60d553ddecc4a3175eec2e924e9191e0d69aa49ca0b653495b8c62b802e443e669220f2a4047a56ed5cb7431a3387a435070795e6e63d242a74555e97371989c6d0040748e89ac316618d5d6eb7bff8d91e953afbe00464df4e4f6380c273b7ac5934cacb6c3be4da6649c8a5ea12bdf9afa1ec1e5053db7668c10ae2df75c4b3b14525369bf33741525a7630158aca3d3c7da5c1d71d3f63c0c2948a43236968d623c6c163eb757f0c78d6ae682ff4e4b673be07193e8d6c106c92851b393f0523491d5152e06de675fa22ae7bded329836a8ca0b955a59cb575395952c6ea0cb1644f2cada196b96b44ee12115ff9668e32886103d8f8109fac4a2287738ee1d2d4c1c19dab94eaa2757ea32016df60d7286099eb010ba570b5791ce4c54d860b15d56c53a5ddb543b0b602b3a87ca5213aa9647e51b1cb1736697506081240f4f7163a646f2be30e62c617d7572d820a113f96320834a2f43842160511923bd1ef4f723a2ab9b242fffe97cf0199c9f2ebca266a63beea0af279f2d18651b2ea9789d03025857c8aefc5f8bc6ee92ab7c6ffed2606f9c7ef25cb6c96140256a08cc58218869c52f3e5074fe5ace87a86057cc29fc845ff275f1b2dbc5991cbebe4c556b29ce3da3415958f0c9c68a5c664a1da60365ce56b9a4df24ec5d69c6f5a2e685885f6973c0ccd4caf7e000346bdea502b1418c8819e05bb7bee31bbd235819b49c892f7dadade576cb8ca68bda916a598c32ec03cceba2d01a7960f38680facccdaaf05e254dd8c3631a7222d1561c998c54b16f17a425f3247232dca035d545202e1b180340219ce31c66987bc86f983240e7fd2c926e8af77e6ea9f4139ff1edc0c323b67ceadead8f64a8004164d942f6aa65a28544d7205d41aafe62c5bfc6fd9fc322e2a8b620532d00d1add7a0d25a9dbaff90e19de14ac2ca97e83a2d77e63888ba0f7eaf9b18a7f2e5f148d16887580e55e894ae79024385f439acd071494e6469b77d07e763553652a470f3b4bd8bb7968052f3a969dacced51572bd125870849ce3e55359b2e17eabc3153b5f62868ea0ca1f40738488dbe0020c103f53678b9eb1c10000000000000000000000000000000000000000000000000000070a111518202731
-
 # Signing is non-deterministic and EVP does not expose the sign_internal
 # function, so we only test that signatures can be verified here.
-SignMessage = ML-DSA-44-Private
+SignMessage = ML-DSA-44-Wycheproof/Private
 Input = 48656c6c6f20776f726c64
 CheckVerify
 
-SignMessage = ML-DSA-65-Private
+SignMessage = ML-DSA-65-Wycheproof/Private
 Input = 48656c6c6f20776f726c64
 CheckVerify
 
-SignMessage = ML-DSA-87-Private
+SignMessage = ML-DSA-87-Wycheproof/Private
 Input = 48656c6c6f20776f726c64
 CheckVerify
 
 # CheckVerify with a correct context string
-SignMessage = ML-DSA-44-Private
+SignMessage = ML-DSA-44-Wycheproof/Private
 Input = 48656c6c6f20776f726c64
 Context = 436f6e74657874
 CheckVerify
 
-SignMessage = ML-DSA-65-Private
+SignMessage = ML-DSA-65-Wycheproof/Private
 Input = 48656c6c6f20776f726c64
 Context = 436f6e74657874
 CheckVerify
 
-SignMessage = ML-DSA-87-Private
+SignMessage = ML-DSA-87-Wycheproof/Private
 Input = 48656c6c6f20776f726c64
 Context = 436f6e74657874
 CheckVerify
 
+# Public keys cannot generate signatures.
+SignMessage = ML-DSA-44-Wycheproof/PublicOnly
+Input = 48656c6c6f20776f726c64
+Error = NOT_A_PRIVATE_KEY
+
+SignMessage = ML-DSA-65-Wycheproof/PublicOnly
+Input = 48656c6c6f20776f726c64
+Error = NOT_A_PRIVATE_KEY
+
+SignMessage = ML-DSA-87-Wycheproof/PublicOnly
+Input = 48656c6c6f20776f726c64
+Error = NOT_A_PRIVATE_KEY
+
 # CheckVerify with a too long context string
-SignMessage = ML-DSA-44-Private
+SignMessage = ML-DSA-44-Wycheproof/Private
 Input = 48656c6c6f20776f726c64
 Context = 41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
 Error = INVALID_PARAMETERS
 
-SignMessage = ML-DSA-65-Private
+SignMessage = ML-DSA-65-Wycheproof/Private
 Input = 48656c6c6f20776f726c64
 Context = 41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
 Error = INVALID_PARAMETERS
 
-SignMessage = ML-DSA-87-Private
+SignMessage = ML-DSA-87-Wycheproof/Private
 Input = 48656c6c6f20776f726c64
 Context = 41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141
 Error = INVALID_PARAMETERS
 
 # ML-DSA does not support signing a pre-hashed value.
-Sign = ML-DSA-44-Private
+Sign = ML-DSA-44-Wycheproof/Private
 Input = 48656c6c6f20776f726c64
 Error = OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE
 
-Sign = ML-DSA-65-Private
+Sign = ML-DSA-65-Wycheproof/Private
 Input = 48656c6c6f20776f726c64
 Error = OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE
 
-Sign = ML-DSA-87-Private
+Sign = ML-DSA-87-Wycheproof/Private
 Input = 48656c6c6f20776f726c64
 Error = OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE
 
-Verify = ML-DSA-44-Public
+Verify = ML-DSA-44-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = 1aa69cb5ed35204534f25f40a17eb0d767f8981f5e7cec46d3bf3252bfc78e09d02ef0c82da6dde973611c849472890106158cb15ffa6ca891615e888efa0d2d8a121b75ca440228ad32991be34249620f158ffd6f74d7b03bf919218ce259b500808ec157ead67b56b79e9e6607eafb9227b8a30adbec087d35bc1aec2f1a0c4dd126dfcfb9fbf0bd74fb1e092495fa994ab5a7cd1333281aafe834694a6dc11e889c762b5645638e172dfab3060031ebcdc1fd455d5de6050bf71b074a4dd34af5ebf15487651f0f13e5d3cee231b9b347810bfc418196df9d7231780c09171b9aae732bea27a1649d8c03220f417e30a016b08ccb1d55c9337b4812e20e04523f5d29a760a01b3a80d76285521206481ee1e44df09a76913ba54ae50c8eb973a3ced73950fbf39c4c0c1262a216821a442072c10cc82839ac57b898411be9e810f893272a2546ff7d1d920f146210efc2b4528bc98a099a398302d301fc1dea31b3d8ff78246a66f690ef536b68e02bd7ea23a5378930dde7f1beb51749896a7944e5a40e6fbbb1f76c3fda09e32e0a58062c24cac7ddb8c1d2cbb352a81e336425c5f551246db45ecd0ab29dac88cdebf51c60bebc2e27c974f56da12c1fec4f5745850429b607f5ed7cd821f2c91fc2dda8c2c8e8ec278d1b2a5bf50ec70c5623fc681b4d1dccff96b324cb53ff97470f9de177c2006a89af8f18603a6d4ea2625794695fe79cd30318a1e76307a4c2a353db1e076ad9b609a2489b94cb6dd821c3af31046bb7a5d43d190e09fce4969fe4e93c8393975e64cb2d9c2294fc427ef5191c40937929b3b0e1b037e6b84cc0299d5af2b5410118bfd88ef6491af6f21233390ca7a19f1576e6c5a10a673796905562075047896e3a2379f64dfbbc12b9bfe64939c2d05efbc5f6e4b5ca69ce1ed4b7d25e8c835b0612b33e13ed7a8a7233b4b3d58eead0bc4c841acb65a5ec0ed45e2584c23c2a162392b5789c62358e4038864e20c10e10c67d940ce78993178dbeb3de1fea1e50e7c29f4d7d938c3bfe50229ea040102f30d5b3a64cb8e13420065d54a1ac50a77383bdff3cae2340ebf15a1557fde897007c1b67d04f19431ca00cb0f08db87e90e166e0f4ce6fd69c6ecef1b3f70d9eb601b57a7bf931057c2afe2d3567b6bbec7891c664713385122fdd789c1d5a8a9cfd491f407c16d0b0c5dfc53a6862208e264b981bf2ddbdd1d7db9729b5265c4c3868a947c982880bc55b786153b89ef3324067b35a928c51236bcbe9f860ad9eee5644478f894a9fe78d26a5a17d482612f1cb9983b864e6fba84591c0f73b7b27918819d2121d4af640f533e2939d3da0f0aa6b9df80837a80165ae8b7579715192eb0f6cca78a43d8ad8d7abb56d816e3af2de59b88bfdcf6767abfb043d3ae24223d05001953faa292671c57ade1fe28988075ab8d14ac98363412bd694c40ae85b1f104afcd0f25aa590f57ba4f5dfdf613bf8594e3f54baadfdf50c0881af2475590758a23b7eee725513e4d1ea9f4630159c424a289f18a9879e5e173390f8e630f6ee2a6043d82a1983dc97c7acfea3b0c03e27e865d810d012daeec28dc454f59334edf24627d435701d329ff5e68d19bbdca5ef7d5e00204fa947d08f81cb6484cabe60989d2f61fbe70940f7e4f449b3fcb103a89143d74b15d72e7913dce9193a0b9c5a7b2a97bde6d7f396ae80b4b566f9f2e7345bc42ce3b002818e19f0f16416b850832cd02279ee8d58a381deaac09b1b4d4613f4d066805d2faea6716e015fe361c0526c6e4617a389ffdf930213c1dc0c4c905c3106a7517dce7abea7a9341132f8ad98de3e42f6b75809fff38f6eeafb97398e79d50a5622338763c4e45a88ddda7fb87ab7f5cec61109fdc1c5d4a16310275241fc34178028a49fd79581a05c3b6984eecd6cb9bd60a44da72600f8f2604a4ff4578126194fb2269c8e6e71447445e8e80bf8c6063dbbf29c7ded58abbc0d2eed347bf495b6a9cbe68585a594aa0e65834bfbcccc3f6bf42fe4ef42d86232c3fb1412dd0b5f8a0489958f5c3b883bf7851337a35b13dd2b6517626ff2d1064cd189beb402497dd6b8893d414dde7d1d51018c7a83766a2d8a29b80e8f428237732f7ee5ba878163f0aa8af5b60533b4d4621a38fdc54383acb3325b5e876e21483eddcc64c419596e656d1557be31b530ea66054f79d4f4a755f9ee33c84fed5d552ec5e2eccd061cf4c4b5c3c16a70a7baecccfc208d2430e78621c9ae5b0d080973b4e1df0a1f5c0415db6d3c85f9ea9041e9a9abdde71d6776a522aa957f708b14a33eda10ebbab93bb8ec2b7a04679f38eb44fc558ee698d3c6937e0e647dce898d7599fef6de32ae4d52adc722443610b2126559756aa36f3c79696b99be3d908f780fcbaef33b215693634d63ce2a0777dfbbc899d2be72efdbafbc10aefb26a1a63cdcfda00235b34db723c91624ee5f939024dfedba0863ad08f648767d41fc7fd6b317c51f4b1b87e21e07d488c9423581f9bbdae43e4d32b37e8283960524f9a601ab69f5cd7fb01c9a8a5c64fe863519a1e9f3426398f691a96e1748491b4e209fca2ab29481a674621c797614ba16fbfdfd1a4184e7f84667e720e6bcd9debef32c2b9e891a6e3c0423158f539838d8413e9fc707d5c65b23368b6edc95d9c3f8e20bbb844499311614945606c1487ef4015d1e260fa8239abaa071be572163132bdb06ef21e31be0f9d4b6747134e4842bedcd3bf53b0d6f054693bc428e9a715d5a32a79e6a3cb8b81faf2c04087d8816752637a2fe11eacb38341e024848562a29d4585e4ee56552ce9b1fad43b965a37bff8558921790ef0f4ac55bcac4327d1783f5e1e79bf01e96934bb4a8f5dd06c83bb70b2377189d622a106100f0cbdd38e34c0565900c616561161b3261859133f83893feb22b0bafc82cf4f0dbafde0648e2f86260e6e747034e5cb3ece98087fbf74179c6306f0c460b5d609b9b3a66761472ee0b9dabb5dfa872d5c6bc9b33461a27b5427bd8833f874f479ecc5f0a20304b9a75aacc82420a87af6469daaef53391ae8a25468e717dc47f464fce45a31147c0c4e12ac2f834567e4005b0827d13b3ec80cd8b7a907436e6624c6c8ac6a80add35cfa1a28872fb65cb3fa46894d116a052f19b5fe20c7ead10bd24d27ad2b5683f299d1193ec6d9ff3379f3b3e39cb9991831f194af2041085508da4dcb7b8785cbdc4e04cf4d826d1ef4a11036e4c5803c3aaa7669b4dd3bc12ff888984e9bbdace0e772ab59332b47300334757677578808e90929697a9cecfd6ed1b303d4250738a97a0aabac6d91e283a4b696f7181828493aec8cdcfe1eaecfc0227484957595badbcbfc8fa000000000000000000000000000000000000121f323e
 Error = OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE
 
-Verify = ML-DSA-65-Public
+Verify = ML-DSA-65-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = 69da5aec6d5f58fbf29439c520bd68b966e3dd2ca633b68351c2862344713a1e9c086a44f9a870a3ccc14de62d6c12b278c354d7197c4d6d7f83d1422b29b250f5ee3fec118311d905e5db2b4b8b23b8d542202d6652f6dc3f9d7ed51f2463082d3f145cfd0fa7ac548a47e91c1ccb1a55b215e90ab355bfc6d67154287b1dfae0fb530264dbb841a7684b396e5ca0459d795216416a9d232bc89b32e0f9461f53107c78e66c8e876554e8ddd501867b55dcfc1fb33f102e03373cdd192640f1027a08ce277b468f6ed0fe80a9d6cd2d6b2f7a3738c8325d95b0ccc6e7b9fb000c923b92298e0867d4a9f6dd5513e8001033c633bb1641ee66349487224dd43386c7fcc29916332066a868100d46e2c5b8354c28f087a024cba27694afc4c1665e0d72b37686919ad55052cc63a144febe4e2a0c9ae416e064e289f9f69cbb883665d1130826b7b74e30c94a2b98b67b471663e3d66326db3b43bebf958e8665b68eda90e8c5d9494b0c7c9ec48800910dd6d906b1fcd47a0aac462ac87b126d21b5ba150df61f752257ddf5a063b4a5b150371d625535e3b2874b9fe548960ff67931cd6c12496e8213e2ace6fff48e6bdc60310e49389f62579db26b92ad73e9d3f23942cab51784f48b3660b6450caecbb0df2aa4c8e56577f5ea450d2f7f51aacc0b304a62250bf2cae7b99dcd955b6596625d06da1c67f730b706fdba630f00fd891830d251484640b7258ab364d6fd9986878fffa69b7c44b92e43143affae8b098e1d27716850f37553bf266cdfb561abbcdbfeb80752b364434e64b80429b54cc88693ce03dc0fa147f0741b215f0728499bdc25140aafc976ac99e910ba8a8a50d21b7bddaa28626b3b90a93fd44077068357c81d36e735eda4362930adead4951a0baa104f384fc70e842a9f329e1868b07b455e9cc3fecd54805c9052e70f88c3b92fe0fc6a4d7dda18cf5694e5398860e439a1e19d5a66f2fbc0aacdd1a498711bb16054796c015a715395ef6174e37b04eda589b673c4d5dda737817fb52f392caf7a72d7a3e84b2180cb5b75bc8af065bdc05c3e4040435a1b160081352ac43e09cbf2ead6e09c2b0be0e37894888fe2812f68806f957c13fce6ff167bcee21d4f412ec95a4847f3db7bf441223a4d4ca9ed69adb4de8a4b5b01c775f2721226e6c59ff26fc38e1bb78a384b30e7b55f082e264d8f25e31518619ddd6b6a9faf8aa6cdb5eab75ed59a33825d5ef8b93bde5d120ada773fcc0852b918f4f03e2d2a543b15363adb823eb1f6c533b98d940411e1f5c1cf521f9f63d5454697608326625fffe01bf87f44187dad631df2898effd2c291d98222e564abe3b042b75e90c9c54667842fa8ebb68a1244bf8e0c3ae3ee5f97d5ddeefd986c4bd3f99d877c2cc2381a89abdc61713d38cee58bf69805a485c288d21b15843147066b4a74c69dc25de878e21d35fdfe6746feb4c166606bf3219e42cf63581e7e6bd6570f40f8fae590cedf5106fe57037ccb2324b74fca6500f6ed3d0736cdcc67d04f8fa9e80054a5bd7c8459fc1abb1c4c78677d7f6b325af94a0e5c9c7db0a748e12c5265e8724947d9b5c4bab1a8b6faec827cc41ec115ef3c2d7348cddabddfbc8436f3b41765e13f3762b3b45ed23156f085831e726a55d4b83848b3d1d3352aab9edcc0ac2388f2383f6301ad813b917ee3f23734e057832ae4cf65e668c9ddd0bdd0f9d8b6693254649668aa91a1fa5eb7c59859bb6ddd36c25f4a2223f5d688b480d0388fa307ea69298f9bf7737f6b3dbfda87b331affd75cd8d88f0460e98ebc2890b217bd6d11000a3a088cd837f4f8859a43f76afaaab05a0c3007a149d4d6b9155cadc2c9b55003efdec5012b6272b87183694c505f0446ede55f35b8ab201f9eda974ff840eccb0f004fa3acf753acd0613f66e2a6ac82e322199d37b4af83cbb3d98371c31be79bb42331e819644cbad2ce27a04e4c517998692cd8331552892e199a01a6922bda4d38ac4c01f708809e529c3216eaab399ef25b350ea213ba47126f278140e17391ca7139bd13c56f415e6b74aed8dbfbf38c95dc6db366fd72aa863a27fa1ebf198716400b978a3709e35039731930406588ebdffd35fa230a9b75fce41d7acd214ca4f0029896c137495eade0cf4d10fe621c73f01061acb077de72177ff5dbc6f0c5bec681aa34668ca4fcdd727525068b0b0e9072971b84ef6ce11d5c3c6024da40966703dcc2b33ae04f677677635a55db508f34f1403cdbe37960c8577dac3d848b29f3b5c5c6c56fb74f34c8f4634c04b8cce9b218f1760ca00e6de87efd14087c633469c892bf3e319443336733bb60cfb44941bfa25229aa24384d812db90fe74e0f93fda005eea87400736cabc036f71421b6657b1674d4a8f76cbbf3a8b1c0af82f72973927752257c532db439d96762ad64f102551a9d03f9ce3d8cc850c393c128bf8054bb55bb92ea31ec0706f083a9cf90424c617f8ad2a21225d1913c30e8f47a6b7131304d536a85596ebfd987b64b6bf3c51638d6c839214b53c3c10aa52bd9c6eb77fcf80b5e3b724dec1381d0e02207a6adc73ff53d9d1ffcee1c4a28fa5445ce518eee937074ff7a402f5bbcb362ff090415f9dbd93b62ee56dc8c50e4d2e34c6c621650c0dffe311484e95d68de77170c909c815828946aeeec7ede56bcf433e22fc63a33f764ced1f9242f3d26dc7558686e471f30fbe9304d3d56af8b23e72a4088970b24b2f7e968c1d0392eeeb0b0f0ac8c176547a5383d948ed15484b79e21314a1f28ed624f61e5aaecf2269e5b027e1910ffddede52fad4e8da224e8a10b079548fa7cd44172f4991adfd7623d13e5a19c812824bcf990c07c9721ded9093be6ce7bc7da3ac8c932133a64396b822be92b088844991596df893625a4ef24543bf75a10d7d17ff70350ef62ce3a7758aebbf9b3977b08becb9ea28376082f607965f2cded28bbdb39dab7e00833b0488370d221742b66e27d9ee2d9dd07f401bc22a62c8a9d8d3a290c63804991496aafa47a32578f583cfb53d0c2199055973440d7535e0da6cb2957f4e04002ecea68f9c3ff76cade27ed15fd7835989d0abb197fe32f68636139a42710644bb25860ff33f539200e3ccb8a7738422ca0fa0c744b4c19d15c5d4a3cb082e20a78e20b5a4965b043595cbcacad500b5adbb6cd597e6a4b9c5ea6a1f2e653b5474da277f1818048094ac9e0e1e0b20068d1c1ce5a114a4db7195057a6ce4d221c336fdc29190fee8ff855cae8b7f7c02eec21f972c827066d9c6dcc4a4179bc44ea9b88abe5124bf78b071e09e9af43f739a6e1030091fc091e73edc447f25c68bf84b8df7aa8f091ab42662b93e02c27003afc7b0ca69efcfa60bd53d4d78ceb7c4d2c8fd5ed7e8b35024de849e06400ad145fdb28348d22b317ccec704c401f88db1af2a5348223f5cefd914e404c9d73805d0de77211881486f1bf4aadacadd3ae2588f0db7b5e6957fed50a374f541cfe5e4e923c82ec47e5b3d2c70ad6760c79cd5080b490bdc75f9ef5e1d17f0978b1e8770775f902b9463e6980e1683b2454751ba2dad4a2e6460924bd60ff49b03230cb11fcd04a0388e60874c35d3f6cfc4dd487665e1b16578751eaea89e126bf58044596e3188c7a9631017be1f2dcd7d612331832ff8755460dc496aa99a61ea053c78e72607a18213ff9ef4bb880903b91e9a43e0b1f0ed1511b2eca2f4253fcfbd7d0faebf3680fbf0a45df231544882c9c46505c726d56905d02fd046c1652d8fd06d15286a1a8f8b69fbd825ca421fd80f5e9ba1a23f924937ad049adeec60c78fea1adf9b1ef7e8ac4d1ded18f1a801b0bda8fe9a88098825ff3eef5c1fc68cbea143310b39543293f3f5fbcf4773b02054c0bc79f00554947c7604b36389c0c45f597a88f3713456b4cfd83b30cb6520b624aa09c812066a8cd542dc67e19e4c92b562b4e0f6799fe57d9d4f4f3e0b6fabff4b1fc190bf1e78775ebcbe3655d370ca6c08f48decf6153a4989eeab6921f8475f85197f51d651e563994257df57977e5f219b4879751de57ab0374b407a21adb4ba520bb35e7b7508675bf49f4e432190451423cbd529fc79b22baae9cb1d8660c3a49c456ac03bc06c0ef3b02f7d8acd40919315206fb38e715139c9bd6f89a58634fe683df03f5bda719764f6c38131bc5ba1c53244472ef73834ade04b86ca08dd753141ac0a9a230e246735060a044018bc9b75d50134b20e6219c13f8325b5a0201e9453f6f012fe72e829ee1c637fe30037a9212a31c6e713726a6cd4cf2dd66ffdba77f1e2800e717940f231d04aa2e4e88dea084754947d848c0271856bfe659922408449858a81fa6583f062d96898d18ec53664f0067eb9b9c40ad2579ba9802abd8d1bf287e49d94ae397e784db14b5f7010ee4fc42e6e3c8ba80370afc188fcecaf466ea830d7b16362e5c9329980b981decc7174f3ff70a35d8a180ee12ed0cbffd4e8d14eb503387e4959f702d4293109e922eb561371f9ab21475821f8555d92f0aa1c3d841a6f1eabd4e663993636c754ce2b3c3f6a6b6d0b161e777b8296d7dce7fd162970496494d4f60716244a5a7fb7cee40e1d565e6566697e8f9300000000000000000000000005101318212b
 Error = OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE
 
-Verify = ML-DSA-87-Public
+Verify = ML-DSA-87-Wycheproof
 Input = 48656c6c6f20776f726c64
 Output = ba4275ff54c22d2d09ea1937a0667362acd44925c6d6965fad350b111d1cbcce68ddbd0e576d1a8810eb4e71623781f32f747d44c8e693749df191682f588906949d97617a4b0ec54ad966818dee88b95f0f28ca24bfc5bfe0c316140b0662c43093ae48b899cc71e5739e9d67095ed987a79b6a0e7aac960c3c4125f0e92bc9435d10bfffae34bb3af05e977ebe0bafcbeb2381c5afe3379667b4c201aebf162dbd0a4bd1baa88fb2f88fa970499a848737d3cf94cc8ce278880a169cad91f304e4e8f1091d4cf39d9a3ab9f88dcc6f3bc4df311a5be0cba290365b3e879527e2a77f0cb6eccc9d85a5e592fb00f3a2e925a26d295a6b82746d7f534c83c35bc4826ee4910216b9a2867032698996fb0e1669b539ccd2ec74d181f4844e8f4d28f9c174316c12dadb54cb1dde7338238a20731c2565bb959f8e3086273ed03abc7ac515728750633083c0b397b29d385d13f5afd2529b32f00dce66c9dc8ea93d99c8b61c5e0ab2fc70de2a8dabdcaf290d53e8fca7561bda8c516ad475e4ec6c7cd2603aa3c8a71d9fa5dc7efc33cf318bebc1f1594e6ea25c69b8f9ce34a65b8ab0ae8dd3538bd267d86c584b8f354d7e4776ed4dd59a73f9e70a1df572f033b69b3eafa5a901e02515472e37258608875ca469de07db71cd6b8dc7edeb3d866ed2d219e44fcb133a066e89d8e3013569ca6f1fee7bf4ae56a6d32a5f3e5a530819c31aadabc8a88503edbea9cdfa3171762e1e8bcebaf9bb6af7e540102d5fc810bbcf1e02ae564e04d9dc55dab0a9392d6c95a317730d9793954da2cb16544d15403d0db01e85881e2d4f1b9b98458e1af0985f98b014f08f200558f2fed7a70c352a27423bedeebb3775c0a1ede9d461d2aea303c09c8b1f73fc37a5b3a01fb24a131574f7eac90c78baa38cebe81e2335dafda20299f76d6a0ba77d2954d11381674f4069f45e133886d64222d92583d5908e3ab6eb6a72cfb41f7dc3e71c1383888f61624bdcaf12fb716de98232ee329af1dd045f30d377234db7bfd11ddab0b3108329e16ce568c8bada39a98df5a5f72a72f063fa4253313a806013f61ce5adbe54cf42180ebf6e496bd4b42aeacf069aaa8e1c231fd037b394d78a69d1742b45bc5784ab8593a198077423c4c357d734f9899cfe9b3b62b6b9c3f4d781b8484a3fd0eea7e8d6945f4ba2b046fee079b7f032bebbc402918daa2aa1c9433dc3bcfbd7f49a5d7a293833c21c1bade3e8a7ec3c83d485529de51b5993cdffe23b770e25acab0ab9fb3059f14952d9464ebfa36a6274d8da317a7b07c2afe38ba28ca942cf7bfaee4020e59911c047b2aa24d1787baae1bc3546364b782358676d75c7698769f1d4a0d5dccade7fcf80e308437f7fc24fdfbf72625abf1b0f534da62cf860da1efd986950e3e19a085999f4d008fce38459c673befcdf2287c1766e106beb4f3175e97812da141330dcb2beb3265e38c8423c19dd50a655c9e8dc969f6367f3383b644d53a26875d53cea26de429266b506e70e7e6832886ed06d81738b0b482bd23bda396eb674ddfdb64803d6c4fae2f040170b5a28923279838b7b876220d02dc7478666f7c3287b1ba4a2f8228e8c491a55ba459805c601b986caea27ee9436f63383351c74d673643b15f6007fc6dc49e337a65a8a96ecd7eef4ad730bf3dc1972fc396703ee26af1156dc4beb46c47d99bb69ebdaf81c2d738d0f70e57a2c7162f5a55242255675f22082aa43f5b3dd862b535b2a15bb815b4e9faf16a302552cd6098d40930dfad7a7c609d6aeade814242a8bf0721c1c26d0d3daa7a638880a6411c6538d80c259d31b639aadaea49563a8d7f5ddb64291d6b086c80d72bfe7d26802cbd20fd6ba5495011e42da1c82483cbe8e37838e73c48f79f65b205476bee600399feda6aaaa939eee12cb34be4e6bdbd18032c85b54a2713551de677a16ca0142ff97b77bc963e8f3c57d91df9b49474b01ca514641842893abc3181caee3f49b635d17daf41bcc4aeb1116ec4b3e78ff1480cf3a5d9c6a154384b88516834d19196976e2ba97cee91f7a0d73f7f8146e58dc0fc8f510511d39d82a7ba531a4abcce6b624035d753a37c5980343cfc7724cf83efb0c33fc4abb5b002241bf57a46b67cb5a4cbd637b2f19bc93b368d97e13c6a62c8443c8222e0a90c3ed1972cc739b824fdf729ed8eca02ad96bd78bf6d2b3d2853e24fa93199ff41635176b31aab2207013d0a9317fa49668dfeb672b8129e6175a2998642ab8e74f0823e3b5480ae80180ca395f5348744a3c7b344891f008aab65914760b5fe852615ad6425216b1c5e777db1a46517cd01a77b277cfa2c6f250c2d68c495fef28feee6e0716817d6b30716f5ca48001805042133eca17a41c2219784ce0f12858ccfd371c77b90966ea04c3996851edf31aef962946628007de5531b06fddf3449f6c552eaf6e16b3e9160e265900b8c8e414732505e02660e123d45a3d6f1b15e56fd759d38e821e27e84967e95c4b0d2a48e008897e655d1b65b76299f1e3074209abe44b37f8786b02df23aa4dcebe512e6312f1a3d6d781d749635247aca897626f5ee688f517df6cfe947ddead820f07fed4bcbe7f1bee3f19117b5666dc123d528f2bf03db346d6afb53804b0681aea98a9479fc6de5ae974d2c0d2055f07ba8a1d2d8b6a7e08a6805bd8634cc190c4988b502f475c36d78c7b3dda0057c818835bbf21c5a7c13bb6fd91cd3cfd76abe4c2ff908a08a3000b9021500ff94b297cec0fb3e51b1cae7026ab4347bfd5b6a641a3d347f45a2a2aacd22e521e00da0c3986c67672c5d7d7e61e7edafc15d42aa42cb37fa8621f79e9096b092efe853ab318b3e4bbd90f20165a1be1d3aa5b3de43751b65abbd952599869778393c4351ab8f534fd49e16547df01c40bfaf56de60b4fb0019bc34177cc8e2236d219fb3c0b84dedae6b88e134280eabd1823420cd1afe6d929774967fd7d885fbad33d89ed9dc5e0eb978eab5d96c50bed5887aa8277880c7b06bf2780cee82ce639a1e3344c88a25102edcc17a4cb48989c4ad6a998726ede31deb0b98107f40858bad7864983f6ecdf0c9761a42751b19d5360daa7fddbbd2e2292638b95c763ca1e747eedef0dd387e9d9ec9e5afee207d8c45703c5befc2de3878d313655ce85ad984250cdf054360f33d41dc193060d42cf9528b1fb91d6ca3395199e25a1a7739eba9a6a4ac2c417ae615940b3eb1b746dd0ecc7b2f7acdff887110115629f70877dafcd7a6625fa1b9e256bc8fe1d66005dbcf12fde0a5fcda5d4f23d58ece91d60eb91274df8d9d17d4a39e63533acf1b317db979b04ca3ab9a0bcba652d0010ca3fcd33ed8f8a62faf42f78b37912d3adb410f20bf16b31359cacc25fb783083a3f065f0a2dd6fe58b8f594e11a87bf0f4c5f5493f334c18b03ebdefebce50228937ec13a8c221b617450486291071f3c14f64f66c927dd4bd623c214ac35433b8a6875cdf00916476eac0f196858aa1484bc1cd45b726d33a965619829b8deaa9d9fa0c3c210f23967ce26a4bdd939cff8aa662f70fb0af97ee44bcb9e2755000a195741d8919e4dcb1a5caae21009f686fa1489c72f16f9fee76b5410ece7f406947f4a19f394a5121da79f3216777b0fee5423328156ecf0b4548dbd5b3f7b526d6b9cfd57576f67dd521c314c2d37474ed0cf732c3b073a101c735a4c4e6b33c9aaa12c91d147ad1075a20287d36c388657614a9c648d8e49cce8cfa282b2a2e8e9da6e4444e4b6aed1bd0ada5009a335cd0500bdae9a01b97f7e8cfe8372398e750de92ee4a524393a19826d19de5e762fb53a88b9b4657e9c6d7d01a4124e3e39532f614aec5cb88d982b78b2ff568017c92f6a1ce5298b5f323b5ee61695038ef0c3a7a339cfac31cf7875a4563046a40e7b35cef1d37d811b342fcbb5373122415befc23cb656a619f7c262c443403b23ba20e341a079918dec6f4f801b92781179ad7ac1951f39ddb0b1f1fb95b28c0f4593a04486f0e0e86bb3b014674879aad10f41e0bad34d40bc817b6fd43c1dde8547882d82e5111e208107e9c9736d16ca77ac7453d7b6c7976a7dd6a4c6c0252185bc9948660a07b66151b09b980d8572ae829ab2f6d900cc63066c4ecb3a0317e8a9acaa8e22a216721f3d69c67843df2fbedd88bc424f761cdf420de4ff2c55b6925b1826c1c4134090d2aae82a7f64a8d428efe1b21097a6fdbc9b8a31c4d46c7b32d478bf5b9181bef8af4d3486958d7c198c46a5ad771090bb64e7fc2bd7677ae7618b861c83c13177075063517eff40cfd52ae56650e9e7035f783bfe8920c754e98470b327909ac2a407e07864710544b8adbc075502c75b5f0fdbca0cde5d94b013141c96b55ae1b60ab63f9e792641690af41b05a78233935fd7f82852ebb2602a10459a709256c41d108c2aeb71925089cc79b121eabd5edc54f3f7c8929685b88ab29700c7fb2f247cd7962c8ce6dc9f79f9358d6a7989d24ccc17d0dbaa0b7fbe73479164181ae7d6b6a02678cce46f74ea2bd387ecb73041817b429a0220e1c3635fe492f5f3a8e2b65c086fe24c375563d7220856dd8f970716d548492964a156554dc88810c3c4f81dcc3ae80243e19679a3be9c9b1b8c707b416e9166c54a568bb9d84728c1a283d9231a12b13688ce2362901342652d66bf44cec223f561d2735d977c6adcf57e9066220d0770fc77fdf6ff367a2f36ae20062887beb88d1b453f267aef9bc763ab716bacb9214c38b95f4f2f3f6c236aa71aef83c1ae4b26133678884476c1d7c6d3e7b99f13e028ac6cebddfae4793f9ae975f3d66b725b500e7c7d2f664eaa0c358deb91cb2d6173394b306749d2bfb2684b985769bdb682e922b75555d38dad1899057a64ef6ea361e4712244d02d0dfec8c3d40770122770c2538d6a14a8462ef18eb705c16e5ba30aa5366447c94869060e4df155f7d01ffda04c1ced0ad5fbe5fdd85856e1e49320319687d31a6e4c7145479f45f43a9b8e9ffe4cbacfad4a21e5445e119df2996cce8b11d0f224efb4f18b544d456e2fb1d96fcd99fc319dbd86720621ac25b490f3611f7e5655bb3940a503c07dbf41f4b87593595a66008808744668371a54ce1b9dfdaa16f90415e57470bc23898d13d8351ba34369e96347da13d012b4eab32ada90668654c5ed2b433716b1b4170f640cf4b40659efcf4150237bbc25f72b248be85cd482b55ce2f5f73e8f02efd2465805b37d12487465ec1085bc6602b71862771af13e13baece4916b1ddef9ce016c92db9fb9e82aee5e1c4e22c45090ad1c19801ce1c541ff3902baea7a12dbcac6ec2d128ac7acb203463921ca6ce1d182d60d553ddecc4a3175eec2e924e9191e0d69aa49ca0b653495b8c62b802e443e669220f2a4047a56ed5cb7431a3387a435070795e6e63d242a74555e97371989c6d0040748e89ac316618d5d6eb7bff8d91e953afbe00464df4e4f6380c273b7ac5934cacb6c3be4da6649c8a5ea12bdf9afa1ec1e5053db7668c10ae2df75c4b3b14525369bf33741525a7630158aca3d3c7da5c1d71d3f63c0c2948a43236968d623c6c163eb757f0c78d6ae682ff4e4b673be07193e8d6c106c92851b393f0523491d5152e06de675fa22ae7bded329836a8ca0b955a59cb575395952c6ea0cb1644f2cada196b96b44ee12115ff9668e32886103d8f8109fac4a2287738ee1d2d4c1c19dab94eaa2757ea32016df60d7286099eb010ba570b5791ce4c54d860b15d56c53a5ddb543b0b602b3a87ca5213aa9647e51b1cb1736697506081240f4f7163a646f2be30e62c617d7572d820a113f96320834a2f43842160511923bd1ef4f723a2ab9b242fffe97cf0199c9f2ebca266a63beea0af279f2d18651b2ea9789d03025857c8aefc5f8bc6ee92ab7c6ffed2606f9c7ef25cb6c96140256a08cc58218869c52f3e5074fe5ace87a86057cc29fc845ff275f1b2dbc5991cbebe4c556b29ce3da3415958f0c9c68a5c664a1da60365ce56b9a4df24ec5d69c6f5a2e685885f6973c0ccd4caf7e000346bdea502b1418c8819e05bb7bee31bbd235819b49c892f7dadade576cb8ca68bda916a598c32ec03cceba2d01a7960f38680facccdaaf05e254dd8c3631a7222d1561c998c54b16f17a425f3247232dca035d545202e1b180340219ce31c66987bc86f983240e7fd2c926e8af77e6ea9f4139ff1edc0c323b67ceadead8f64a8004164d942f6aa65a28544d7205d41aafe62c5bfc6fd9fc322e2a8b620532d00d1add7a0d25a9dbaff90e19de14ac2ca97e83a2d77e63888ba0f7eaf9b18a7f2e5f148d16887580e55e894ae79024385f439acd071494e6469b77d07e763553652a470f3b4bd8bb7968052f3a969dacced51572bd125870849ce3e55359b2e17eabc3153b5f62868ea0ca1f40738488dbe0020c103f53678b9eb1c10000000000000000000000000000000000000000000000000000070a111518202731
 Error = OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE

boringssl-0.20260708.tar.xz/crypto/evp/test/mlkem_tests.txt -> boringssl-0.20260813.tar.xz/crypto/evp/test/mlkem_tests.txt Changed

@@ -4,58 +4,48 @@
 # correspond to the same key. We support only the "seed" format, and not the
 # "expanded" or "both" formats.
 
-PrivateKey = ML-KEM-768-RFC-Seed
+Key = ML-KEM-768-RFC
 Algorithm = ML-KEM-768
-Input = 3054020100300b060960864801650304040204428040000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
 Bits = 9472
+SPKI = 308204b2300b0609608648016503040402038204a100298aa10d423c8dda069d02bc59e6cdf03a096b8b3da4cab9b80ca4a14907672ccef1ec4faf234a0bc5b7e9d473f2b3133b3b26a1d175cb67a7805919699c02f76531b99c5f89180704bb4ca4535c5b8972679c660a07c5e514b87009c862eb8f5157695efb3fc40a9def6b81c1cc02a249ae4f094ad0d9bd3485c1c1c68080520a7c8c632032cee738154e5c5176c07da56024776a430fe76eacf665a3f7b832102215bc82f10939c8355704336a8fac1d81e4bb0485aa5d7c74d6b59bbe5c5e972a0d8bac411b55b5d5557cd680a1a8f71b4eb86bc48c9a0509731a54bd9d7290b27963e4372dc9b199cfdcac0b01acd28a62395112e4c43648d622c48c8234d01440e8cc376c927f23a5afc9ac0474c662274e424525c8552ece3b3fe26516de901bc7d515bde89558e626c95c80b93342f8010004f39e6c6c94871c5e344cab3966c835f9a96a59afd31c40286b38b1c1a78470bab947518934453ce86736a919f1f5a6d510a86f5454fc3980cb5c765bd2bd5f7b36b1410d6635c8ceb47c4dda0d76a28eac939c71c3024804866c71626658442163c2c22117e50acefce6378a985652302a4ef0c2ce0cc716b7796e2b6b2e3777dfa1ac3da259a31b5a9b530f8cb638a81a62ac301849abaf95a7301bda30068909bfdb7e67dbccbb38a5551a25b1a3a0f685748ad5753d8880f0016c627486166384c5571fe2365900364d038311e2d875db366686932b5ec602430a369e87a6ef5c338786657825bd4c057aceb923eb0935e6905e63b4ced7f80857a773dd64b150d26612ea9ac12052db2017bf1843ccb4b3281b690dc728adfa85c00281b8e3c09287335f856b4fc2892f69a2f57921ada01914c40988662d57769662a786351b9b66493dab79594d986de2100d65ba0ff4ea58b81538d24a4435a258fac25404aa7f41f658b1385065e158dcb60115732720f40459aaac15e406953a90ac52997d1ccd070060efc65db9e653354467fad56ec713c86e7540c423acf2669f52fa6f4ac6888d871ef3e847c029a8aafbb92e17b24aa079b1f419ba6175b442afb11909d4a56b70a0335b28739218aa7c9348e2c3c2f3eb3d15a41e6417c0dd94bfeb21419b311a7bb13a180bbe833218a9a6b17447cc85f225859587a73077049acbcfd44d0f025438e15d1538270d586e1bf83192a9459cf63c0e972f85297679831ecf121509851cb8340f6f107b0fa1a0efd1b36a8189bc085c4f5cb784e553f41b918f80397ce1956f785bee377ca9aa8be6998ada30c26b7c3d8c6b55254cc96203b20c42aee0ac4e1ebb408e49a9e3f879d0ab0785eb7025425d1305a2299c015e120d163b0e19494ce57253d0246d182745cb8197ab7438b3c1bb7972bec5a306eba3567855c014699fef65ae54c770a0d85c18400cf642aedc660777ba4b138502bd5a7812f621f84a48296b98dd4322b6f15828b8a8f0e00a8ba44a53c3a8b143571b0740abd567daf1cde9c79c204b6d5e259d1766a31bbbcb4e6a05cf4502176b301c1c2f41247750157bcec85e809b30a4d60d7747cdd0f5b99aa8c826987517793aaa8080a0b124a8558df72bbe37b75f4edbb6be8216d6c633fb2b2280e25113d8695e43481c3eeb397eb192505229b67a201ea893c3e2cb32da8bc342fa4dea0578
+PKCS8 = 3054020100300b060960864801650304040204428040000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
 RawPublic = 298aa10d423c8dda069d02bc59e6cdf03a096b8b3da4cab9b80ca4a14907672ccef1ec4faf234a0bc5b7e9d473f2b3133b3b26a1d175cb67a7805919699c02f76531b99c5f89180704bb4ca4535c5b8972679c660a07c5e514b87009c862eb8f5157695efb3fc40a9def6b81c1cc02a249ae4f094ad0d9bd3485c1c1c68080520a7c8c632032cee738154e5c5176c07da56024776a430fe76eacf665a3f7b832102215bc82f10939c8355704336a8fac1d81e4bb0485aa5d7c74d6b59bbe5c5e972a0d8bac411b55b5d5557cd680a1a8f71b4eb86bc48c9a0509731a54bd9d7290b27963e4372dc9b199cfdcac0b01acd28a62395112e4c43648d622c48c8234d01440e8cc376c927f23a5afc9ac0474c662274e424525c8552ece3b3fe26516de901bc7d515bde89558e626c95c80b93342f8010004f39e6c6c94871c5e344cab3966c835f9a96a59afd31c40286b38b1c1a78470bab947518934453ce86736a919f1f5a6d510a86f5454fc3980cb5c765bd2bd5f7b36b1410d6635c8ceb47c4dda0d76a28eac939c71c3024804866c71626658442163c2c22117e50acefce6378a985652302a4ef0c2ce0cc716b7796e2b6b2e3777dfa1ac3da259a31b5a9b530f8cb638a81a62ac301849abaf95a7301bda30068909bfdb7e67dbccbb38a5551a25b1a3a0f685748ad5753d8880f0016c627486166384c5571fe2365900364d038311e2d875db366686932b5ec602430a369e87a6ef5c338786657825bd4c057aceb923eb0935e6905e63b4ced7f80857a773dd64b150d26612ea9ac12052db2017bf1843ccb4b3281b690dc728adfa85c00281b8e3c09287335f856b4fc2892f69a2f57921ada01914c40988662d57769662a786351b9b66493dab79594d986de2100d65ba0ff4ea58b81538d24a4435a258fac25404aa7f41f658b1385065e158dcb60115732720f40459aaac15e406953a90ac52997d1ccd070060efc65db9e653354467fad56ec713c86e7540c423acf2669f52fa6f4ac6888d871ef3e847c029a8aafbb92e17b24aa079b1f419ba6175b442afb11909d4a56b70a0335b28739218aa7c9348e2c3c2f3eb3d15a41e6417c0dd94bfeb21419b311a7bb13a180bbe833218a9a6b17447cc85f225859587a73077049acbcfd44d0f025438e15d1538270d586e1bf83192a9459cf63c0e972f85297679831ecf121509851cb8340f6f107b0fa1a0efd1b36a8189bc085c4f5cb784e553f41b918f80397ce1956f785bee377ca9aa8be6998ada30c26b7c3d8c6b55254cc96203b20c42aee0ac4e1ebb408e49a9e3f879d0ab0785eb7025425d1305a2299c015e120d163b0e19494ce57253d0246d182745cb8197ab7438b3c1bb7972bec5a306eba3567855c014699fef65ae54c770a0d85c18400cf642aedc660777ba4b138502bd5a7812f621f84a48296b98dd4322b6f15828b8a8f0e00a8ba44a53c3a8b143571b0740abd567daf1cde9c79c204b6d5e259d1766a31bbbcb4e6a05cf4502176b301c1c2f41247750157bcec85e809b30a4d60d7747cdd0f5b99aa8c826987517793aaa8080a0b124a8558df72bbe37b75f4edbb6be8216d6c633fb2b2280e25113d8695e43481c3eeb397eb192505229b67a201ea893c3e2cb32da8bc342fa4dea0578
 PrivateSeed = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
 
-EncapsulateDecapsulate = ML-KEM-768-RFC-Seed
-Algorithm = ML-KEM-768
-
-PrivateKey = ML-KEM-768-RFC-Expanded
-Input = 30820978020100300b0609608648016503040402048209640482096027d2a77f33756f61208ef113abe82595873d4abc730e5b5d679529bf6a4ceb6383427231a8612f41550515acba52e48ead8b942833bbe6865d13d14a79d2c5c3e07f0a056d8de7aadfcaba058c493c80b37cab8c562753bb3ba6b6ec8297f885eaa7540d530015a84406e55b1366b577e236ce58a26d8a1eb5a44d542323c2167d9bf4a47f985699ca05bae43b8dec617f02380a3890afd4b8c7ec7ede26553a025f3ce5bc5d7a62130304235cb1ad4836b566b5b863bd9bdb45a2844a7047b6c8d383e448525e040b4dc8a2b48c6c37c96d62d43f3fd88e2881c40a205c9e248f652b592781a779f86880f2a147b67863f391cc1a5a908c0095e07212291e2ef8a36eb9a9c0c6073225b34703a4af049382c47573da68fde9245ad444e31b1fbdb521f1f61f37bc0cef292067e670d28a1ffd904f6f1190a996918a13037a6cabf3c373bf8296cd37ab33ba7746809cc3f8ade1b3639bd57bfcc69650aaaf1de198fc4c0463299e52c461780cc428fc5d04a5c51850cba6c2a5274340675793dda09be44c29e6395c65f85d2a0a7c6df411e6911b1f2cb6c351cd2e875f51b638be776097e93e2f2b2f83da0beef4aa85ba9e763ab64502a0ca5222e9eab5b3b7088ed52060e8c8269b943a71ab0ae1c5b1b687d2e019cf8036bcf9bf6e7bac3aaa36e41660faa4540f2648cd93a189ec5c2dea70bacaaa4ffc906f90810ea1b67bf24f2c78cf6ba881aaea61c0652bff95b1bae4426d1773b9cc2ca82c21e38c636e3b1c523244986b0be8a83f5dd5cf2d54762fb3c5ebf59b8e885302b1ce47033edf760f4e029be40b6d566b19dd758acd5c7412878131244f90172c53f26663c21d905301d48baf91c917cc7779e9d8802cc10d89a3705099a2ad3a3a8896743c1144698093be257dacb66dc785228b912c8d965d14aa28342c3ac4a93fefa532b20945ddc1020139c14d638b908c4ddde9a0645b95b2e4414d40bb79f04413830f15a873c28bb7059c2741002015f20408f058e715b0bf995b5380b7dd325a056ab97e659a2be0cdf6c33731c683a634b771e8c92a139aee4bb0e49c7077321d42fc199f7c1f298ca625d223a5c263a03cc48159b7812665b78637e4e18720b2c29a6b99f42766a4cbc4dc508ba94ba83b89c3a5c78f8bb26bbd9b79beb8c8182490f5793ee5b96013b74b7e169e29d162f1315464ea7d72436d89b755161192c81cc2dd1c8b8bba795ef426ee1cc01c37aaa37b2cff8b0a378b47cbd0b4d49398cfc2712959699fa0bd8cd84666acc61f541b84fa96b9c854e4e75e9144addb44b8566a57dfbb545ce423c03346f2b2c1a91780d152a8de1a4d4c9cacde7392c996888cc2399c02c38b3353adf8acab283924da00a05b76e738c72c930d6cba09ae168990faa1fef2226e780861d416eff402f4f759fc648ab1f97100109087f96e4b148d2cb31e4805314ea0cd95fb023eac0d989474ba4201d7b41d26f5394b217eea5b34b71a8b37931c0e594271e0b7c733257240233e7ba735603e425a87dee77079e37cb28a21764594ce5350d8da2b62a07174943032ec89c98809c73b6423d30c1d283a766a64d89703c3d629b497828d48320c346210797a298aa10d423c8dda069d02bc59e6cdf03a096b8b3da4cab9b80ca4a14907672ccef1ec4faf234a0bc5b7e9d473f2b3133b3b26a1d175cb67a7805919699c02f76531b99c5f89180704bb4ca4535c5b8972679c660a07c5e514b87009c862eb8f5157695efb3fc40a9def6b81c1cc02a249ae4f094ad0d9bd3485c1c1c68080520a7c8c632032cee738154e5c5176c07da56024776a430fe76eacf665a3f7b832102215bc82f10939c8355704336a8fac1d81e4bb0485aa5d7c74d6b59bbe5c5e972a0d8bac411b55b5d5557cd680a1a8f71b4eb86bc48c9a0509731a54bd9d7290b27963e4372dc9b199cfdcac0b01acd28a62395112e4c43648d622c48c8234d01440e8cc376c927f23a5afc9ac0474c662274e424525c8552ece3b3fe26516de901bc7d515bde89558e626c95c80b93342f8010004f39e6c6c94871c5e344cab3966c835f9a96a59afd31c40286b38b1c1a78470bab947518934453ce86736a919f1f5a6d510a86f5454fc3980cb5c765bd2bd5f7b36b1410d6635c8ceb47c4dda0d76a28eac939c71c3024804866c71626658442163c2c22117e50acefce6378a985652302a4ef0c2ce0cc716b7796e2b6b2e3777dfa1ac3da259a31b5a9b530f8cb638a81a62ac301849abaf95a7301bda30068909bfdb7e67dbccbb38a5551a25b1a3a0f685748ad5753d8880f0016c627486166384c5571fe2365900364d038311e2d875db366686932b5ec602430a369e87a6ef5c338786657825bd4c057aceb923eb0935e6905e63b4ced7f80857a773dd64b150d26612ea9ac12052db2017bf1843ccb4b3281b690dc728adfa85c00281b8e3c09287335f856b4fc2892f69a2f57921ada01914c40988662d57769662a786351b9b66493dab79594d986de2100d65ba0ff4ea58b81538d24a4435a258fac25404aa7f41f658b1385065e158dcb60115732720f40459aaac15e406953a90ac52997d1ccd070060efc65db9e653354467fad56ec713c86e7540c423acf2669f52fa6f4ac6888d871ef3e847c029a8aafbb92e17b24aa079b1f419ba6175b442afb11909d4a56b70a0335b28739218aa7c9348e2c3c2f3eb3d15a41e6417c0dd94bfeb21419b311a7bb13a180bbe833218a9a6b17447cc85f225859587a73077049acbcfd44d0f025438e15d1538270d586e1bf83192a9459cf63c0e972f85297679831ecf121509851cb8340f6f107b0fa1a0efd1b36a8189bc085c4f5cb784e553f41b918f80397ce1956f785bee377ca9aa8be6998ada30c26b7c3d8c6b55254cc96203b20c42aee0ac4e1ebb408e49a9e3f879d0ab0785eb7025425d1305a2299c015e120d163b0e19494ce57253d0246d182745cb8197ab7438b3c1bb7972bec5a306eba3567855c014699fef65ae54c770a0d85c18400cf642aedc660777ba4b138502bd5a7812f621f84a48296b98dd4322b6f15828b8a8f0e00a8ba44a53c3a8b143571b0740abd567daf1cde9c79c204b6d5e259d1766a31bbbcb4e6a05cf4502176b301c1c2f41247750157bcec85e809b30a4d60d7747cdd0f5b99aa8c826987517793aaa8080a0b124a8558df72bbe37b75f4edbb6be8216d6c633fb2b2280e25113d8695e43481c3eeb397eb192505229b67a201ea893c3e2cb32da8bc342fa4dea0578a24e16d8f8f9383a95b77050f4d9fd2f5733eec1d63ef3c23ebf9918173669a7202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
+Key = ML-KEM-768-RFC-Expanded
+PKCS8 = 30820978020100300b0609608648016503040402048209640482096027d2a77f33756f61208ef113abe82595873d4abc730e5b5d679529bf6a4ceb6383427231a8612f41550515acba52e48ead8b942833bbe6865d13d14a79d2c5c3e07f0a056d8de7aadfcaba058c493c80b37cab8c562753bb3ba6b6ec8297f885eaa7540d530015a84406e55b1366b577e236ce58a26d8a1eb5a44d542323c2167d9bf4a47f985699ca05bae43b8dec617f02380a3890afd4b8c7ec7ede26553a025f3ce5bc5d7a62130304235cb1ad4836b566b5b863bd9bdb45a2844a7047b6c8d383e448525e040b4dc8a2b48c6c37c96d62d43f3fd88e2881c40a205c9e248f652b592781a779f86880f2a147b67863f391cc1a5a908c0095e07212291e2ef8a36eb9a9c0c6073225b34703a4af049382c47573da68fde9245ad444e31b1fbdb521f1f61f37bc0cef292067e670d28a1ffd904f6f1190a996918a13037a6cabf3c373bf8296cd37ab33ba7746809cc3f8ade1b3639bd57bfcc69650aaaf1de198fc4c0463299e52c461780cc428fc5d04a5c51850cba6c2a5274340675793dda09be44c29e6395c65f85d2a0a7c6df411e6911b1f2cb6c351cd2e875f51b638be776097e93e2f2b2f83da0beef4aa85ba9e763ab64502a0ca5222e9eab5b3b7088ed52060e8c8269b943a71ab0ae1c5b1b687d2e019cf8036bcf9bf6e7bac3aaa36e41660faa4540f2648cd93a189ec5c2dea70bacaaa4ffc906f90810ea1b67bf24f2c78cf6ba881aaea61c0652bff95b1bae4426d1773b9cc2ca82c21e38c636e3b1c523244986b0be8a83f5dd5cf2d54762fb3c5ebf59b8e885302b1ce47033edf760f4e029be40b6d566b19dd758acd5c7412878131244f90172c53f26663c21d905301d48baf91c917cc7779e9d8802cc10d89a3705099a2ad3a3a8896743c1144698093be257dacb66dc785228b912c8d965d14aa28342c3ac4a93fefa532b20945ddc1020139c14d638b908c4ddde9a0645b95b2e4414d40bb79f04413830f15a873c28bb7059c2741002015f20408f058e715b0bf995b5380b7dd325a056ab97e659a2be0cdf6c33731c683a634b771e8c92a139aee4bb0e49c7077321d42fc199f7c1f298ca625d223a5c263a03cc48159b7812665b78637e4e18720b2c29a6b99f42766a4cbc4dc508ba94ba83b89c3a5c78f8bb26bbd9b79beb8c8182490f5793ee5b96013b74b7e169e29d162f1315464ea7d72436d89b755161192c81cc2dd1c8b8bba795ef426ee1cc01c37aaa37b2cff8b0a378b47cbd0b4d49398cfc2712959699fa0bd8cd84666acc61f541b84fa96b9c854e4e75e9144addb44b8566a57dfbb545ce423c03346f2b2c1a91780d152a8de1a4d4c9cacde7392c996888cc2399c02c38b3353adf8acab283924da00a05b76e738c72c930d6cba09ae168990faa1fef2226e780861d416eff402f4f759fc648ab1f97100109087f96e4b148d2cb31e4805314ea0cd95fb023eac0d989474ba4201d7b41d26f5394b217eea5b34b71a8b37931c0e594271e0b7c733257240233e7ba735603e425a87dee77079e37cb28a21764594ce5350d8da2b62a07174943032ec89c98809c73b6423d30c1d283a766a64d89703c3d629b497828d48320c346210797a298aa10d423c8dda069d02bc59e6cdf03a096b8b3da4cab9b80ca4a14907672ccef1ec4faf234a0bc5b7e9d473f2b3133b3b26a1d175cb67a7805919699c02f76531b99c5f89180704bb4ca4535c5b8972679c660a07c5e514b87009c862eb8f5157695efb3fc40a9def6b81c1cc02a249ae4f094ad0d9bd3485c1c1c68080520a7c8c632032cee738154e5c5176c07da56024776a430fe76eacf665a3f7b832102215bc82f10939c8355704336a8fac1d81e4bb0485aa5d7c74d6b59bbe5c5e972a0d8bac411b55b5d5557cd680a1a8f71b4eb86bc48c9a0509731a54bd9d7290b27963e4372dc9b199cfdcac0b01acd28a62395112e4c43648d622c48c8234d01440e8cc376c927f23a5afc9ac0474c662274e424525c8552ece3b3fe26516de901bc7d515bde89558e626c95c80b93342f8010004f39e6c6c94871c5e344cab3966c835f9a96a59afd31c40286b38b1c1a78470bab947518934453ce86736a919f1f5a6d510a86f5454fc3980cb5c765bd2bd5f7b36b1410d6635c8ceb47c4dda0d76a28eac939c71c3024804866c71626658442163c2c22117e50acefce6378a985652302a4ef0c2ce0cc716b7796e2b6b2e3777dfa1ac3da259a31b5a9b530f8cb638a81a62ac301849abaf95a7301bda30068909bfdb7e67dbccbb38a5551a25b1a3a0f685748ad5753d8880f0016c627486166384c5571fe2365900364d038311e2d875db366686932b5ec602430a369e87a6ef5c338786657825bd4c057aceb923eb0935e6905e63b4ced7f80857a773dd64b150d26612ea9ac12052db2017bf1843ccb4b3281b690dc728adfa85c00281b8e3c09287335f856b4fc2892f69a2f57921ada01914c40988662d57769662a786351b9b66493dab79594d986de2100d65ba0ff4ea58b81538d24a4435a258fac25404aa7f41f658b1385065e158dcb60115732720f40459aaac15e406953a90ac52997d1ccd070060efc65db9e653354467fad56ec713c86e7540c423acf2669f52fa6f4ac6888d871ef3e847c029a8aafbb92e17b24aa079b1f419ba6175b442afb11909d4a56b70a0335b28739218aa7c9348e2c3c2f3eb3d15a41e6417c0dd94bfeb21419b311a7bb13a180bbe833218a9a6b17447cc85f225859587a73077049acbcfd44d0f025438e15d1538270d586e1bf83192a9459cf63c0e972f85297679831ecf121509851cb8340f6f107b0fa1a0efd1b36a8189bc085c4f5cb784e553f41b918f80397ce1956f785bee377ca9aa8be6998ada30c26b7c3d8c6b55254cc96203b20c42aee0ac4e1ebb408e49a9e3f879d0ab0785eb7025425d1305a2299c015e120d163b0e19494ce57253d0246d182745cb8197ab7438b3c1bb7972bec5a306eba3567855c014699fef65ae54c770a0d85c18400cf642aedc660777ba4b138502bd5a7812f621f84a48296b98dd4322b6f15828b8a8f0e00a8ba44a53c3a8b143571b0740abd567daf1cde9c79c204b6d5e259d1766a31bbbcb4e6a05cf4502176b301c1c2f41247750157bcec85e809b30a4d60d7747cdd0f5b99aa8c826987517793aaa8080a0b124a8558df72bbe37b75f4edbb6be8216d6c633fb2b2280e25113d8695e43481c3eeb397eb192505229b67a201ea893c3e2cb32da8bc342fa4dea0578a24e16d8f8f9383a95b77050f4d9fd2f5733eec1d63ef3c23ebf9918173669a7202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
 Error = PRIVATE_KEY_WAS_NOT_SEED
 
-PrivateKey = ML-KEM-768-RFC-Both
-Input = 308209be020100300b0609608648016503040402048209aa308209a60440000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f0482096027d2a77f33756f61208ef113abe82595873d4abc730e5b5d679529bf6a4ceb6383427231a8612f41550515acba52e48ead8b942833bbe6865d13d14a79d2c5c3e07f0a056d8de7aadfcaba058c493c80b37cab8c562753bb3ba6b6ec8297f885eaa7540d530015a84406e55b1366b577e236ce58a26d8a1eb5a44d542323c2167d9bf4a47f985699ca05bae43b8dec617f02380a3890afd4b8c7ec7ede26553a025f3ce5bc5d7a62130304235cb1ad4836b566b5b863bd9bdb45a2844a7047b6c8d383e448525e040b4dc8a2b48c6c37c96d62d43f3fd88e2881c40a205c9e248f652b592781a779f86880f2a147b67863f391cc1a5a908c0095e07212291e2ef8a36eb9a9c0c6073225b34703a4af049382c47573da68fde9245ad444e31b1fbdb521f1f61f37bc0cef292067e670d28a1ffd904f6f1190a996918a13037a6cabf3c373bf8296cd37ab33ba7746809cc3f8ade1b3639bd57bfcc69650aaaf1de198fc4c0463299e52c461780cc428fc5d04a5c51850cba6c2a5274340675793dda09be44c29e6395c65f85d2a0a7c6df411e6911b1f2cb6c351cd2e875f51b638be776097e93e2f2b2f83da0beef4aa85ba9e763ab64502a0ca5222e9eab5b3b7088ed52060e8c8269b943a71ab0ae1c5b1b687d2e019cf8036bcf9bf6e7bac3aaa36e41660faa4540f2648cd93a189ec5c2dea70bacaaa4ffc906f90810ea1b67bf24f2c78cf6ba881aaea61c0652bff95b1bae4426d1773b9cc2ca82c21e38c636e3b1c523244986b0be8a83f5dd5cf2d54762fb3c5ebf59b8e885302b1ce47033edf760f4e029be40b6d566b19dd758acd5c7412878131244f90172c53f26663c21d905301d48baf91c917cc7779e9d8802cc10d89a3705099a2ad3a3a8896743c1144698093be257dacb66dc785228b912c8d965d14aa28342c3ac4a93fefa532b20945ddc1020139c14d638b908c4ddde9a0645b95b2e4414d40bb79f04413830f15a873c28bb7059c2741002015f20408f058e715b0bf995b5380b7dd325a056ab97e659a2be0cdf6c33731c683a634b771e8c92a139aee4bb0e49c7077321d42fc199f7c1f298ca625d223a5c263a03cc48159b7812665b78637e4e18720b2c29a6b99f42766a4cbc4dc508ba94ba83b89c3a5c78f8bb26bbd9b79beb8c8182490f5793ee5b96013b74b7e169e29d162f1315464ea7d72436d89b755161192c81cc2dd1c8b8bba795ef426ee1cc01c37aaa37b2cff8b0a378b47cbd0b4d49398cfc2712959699fa0bd8cd84666acc61f541b84fa96b9c854e4e75e9144addb44b8566a57dfbb545ce423c03346f2b2c1a91780d152a8de1a4d4c9cacde7392c996888cc2399c02c38b3353adf8acab283924da00a05b76e738c72c930d6cba09ae168990faa1fef2226e780861d416eff402f4f759fc648ab1f97100109087f96e4b148d2cb31e4805314ea0cd95fb023eac0d989474ba4201d7b41d26f5394b217eea5b34b71a8b37931c0e594271e0b7c733257240233e7ba735603e425a87dee77079e37cb28a21764594ce5350d8da2b62a07174943032ec89c98809c73b6423d30c1d283a766a64d89703c3d629b497828d48320c346210797a298aa10d423c8dda069d02bc59e6cdf03a096b8b3da4cab9b80ca4a14907672ccef1ec4faf234a0bc5b7e9d473f2b3133b3b26a1d175cb67a7805919699c02f76531b99c5f89180704bb4ca4535c5b8972679c660a07c5e514b87009c862eb8f5157695efb3fc40a9def6b81c1cc02a249ae4f094ad0d9bd3485c1c1c68080520a7c8c632032cee738154e5c5176c07da56024776a430fe76eacf665a3f7b832102215bc82f10939c8355704336a8fac1d81e4bb0485aa5d7c74d6b59bbe5c5e972a0d8bac411b55b5d5557cd680a1a8f71b4eb86bc48c9a0509731a54bd9d7290b27963e4372dc9b199cfdcac0b01acd28a62395112e4c43648d622c48c8234d01440e8cc376c927f23a5afc9ac0474c662274e424525c8552ece3b3fe26516de901bc7d515bde89558e626c95c80b93342f8010004f39e6c6c94871c5e344cab3966c835f9a96a59afd31c40286b38b1c1a78470bab947518934453ce86736a919f1f5a6d510a86f5454fc3980cb5c765bd2bd5f7b36b1410d6635c8ceb47c4dda0d76a28eac939c71c3024804866c71626658442163c2c22117e50acefce6378a985652302a4ef0c2ce0cc716b7796e2b6b2e3777dfa1ac3da259a31b5a9b530f8cb638a81a62ac301849abaf95a7301bda30068909bfdb7e67dbccbb38a5551a25b1a3a0f685748ad5753d8880f0016c627486166384c5571fe2365900364d038311e2d875db366686932b5ec602430a369e87a6ef5c338786657825bd4c057aceb923eb0935e6905e63b4ced7f80857a773dd64b150d26612ea9ac12052db2017bf1843ccb4b3281b690dc728adfa85c00281b8e3c09287335f856b4fc2892f69a2f57921ada01914c40988662d57769662a786351b9b66493dab79594d986de2100d65ba0ff4ea58b81538d24a4435a258fac25404aa7f41f658b1385065e158dcb60115732720f40459aaac15e406953a90ac52997d1ccd070060efc65db9e653354467fad56ec713c86e7540c423acf2669f52fa6f4ac6888d871ef3e847c029a8aafbb92e17b24aa079b1f419ba6175b442afb11909d4a56b70a0335b28739218aa7c9348e2c3c2f3eb3d15a41e6417c0dd94bfeb21419b311a7bb13a180bbe833218a9a6b17447cc85f225859587a73077049acbcfd44d0f025438e15d1538270d586e1bf83192a9459cf63c0e972f85297679831ecf121509851cb8340f6f107b0fa1a0efd1b36a8189bc085c4f5cb784e553f41b918f80397ce1956f785bee377ca9aa8be6998ada30c26b7c3d8c6b55254cc96203b20c42aee0ac4e1ebb408e49a9e3f879d0ab0785eb7025425d1305a2299c015e120d163b0e19494ce57253d0246d182745cb8197ab7438b3c1bb7972bec5a306eba3567855c014699fef65ae54c770a0d85c18400cf642aedc660777ba4b138502bd5a7812f621f84a48296b98dd4322b6f15828b8a8f0e00a8ba44a53c3a8b143571b0740abd567daf1cde9c79c204b6d5e259d1766a31bbbcb4e6a05cf4502176b301c1c2f41247750157bcec85e809b30a4d60d7747cdd0f5b99aa8c826987517793aaa8080a0b124a8558df72bbe37b75f4edbb6be8216d6c633fb2b2280e25113d8695e43481c3eeb397eb192505229b67a201ea893c3e2cb32da8bc342fa4dea0578a24e16d8f8f9383a95b77050f4d9fd2f5733eec1d63ef3c23ebf9918173669a7202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
+Key = ML-KEM-768-RFC-Both
+PKCS8 = 308209be020100300b0609608648016503040402048209aa308209a60440000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f0482096027d2a77f33756f61208ef113abe82595873d4abc730e5b5d679529bf6a4ceb6383427231a8612f41550515acba52e48ead8b942833bbe6865d13d14a79d2c5c3e07f0a056d8de7aadfcaba058c493c80b37cab8c562753bb3ba6b6ec8297f885eaa7540d530015a84406e55b1366b577e236ce58a26d8a1eb5a44d542323c2167d9bf4a47f985699ca05bae43b8dec617f02380a3890afd4b8c7ec7ede26553a025f3ce5bc5d7a62130304235cb1ad4836b566b5b863bd9bdb45a2844a7047b6c8d383e448525e040b4dc8a2b48c6c37c96d62d43f3fd88e2881c40a205c9e248f652b592781a779f86880f2a147b67863f391cc1a5a908c0095e07212291e2ef8a36eb9a9c0c6073225b34703a4af049382c47573da68fde9245ad444e31b1fbdb521f1f61f37bc0cef292067e670d28a1ffd904f6f1190a996918a13037a6cabf3c373bf8296cd37ab33ba7746809cc3f8ade1b3639bd57bfcc69650aaaf1de198fc4c0463299e52c461780cc428fc5d04a5c51850cba6c2a5274340675793dda09be44c29e6395c65f85d2a0a7c6df411e6911b1f2cb6c351cd2e875f51b638be776097e93e2f2b2f83da0beef4aa85ba9e763ab64502a0ca5222e9eab5b3b7088ed52060e8c8269b943a71ab0ae1c5b1b687d2e019cf8036bcf9bf6e7bac3aaa36e41660faa4540f2648cd93a189ec5c2dea70bacaaa4ffc906f90810ea1b67bf24f2c78cf6ba881aaea61c0652bff95b1bae4426d1773b9cc2ca82c21e38c636e3b1c523244986b0be8a83f5dd5cf2d54762fb3c5ebf59b8e885302b1ce47033edf760f4e029be40b6d566b19dd758acd5c7412878131244f90172c53f26663c21d905301d48baf91c917cc7779e9d8802cc10d89a3705099a2ad3a3a8896743c1144698093be257dacb66dc785228b912c8d965d14aa28342c3ac4a93fefa532b20945ddc1020139c14d638b908c4ddde9a0645b95b2e4414d40bb79f04413830f15a873c28bb7059c2741002015f20408f058e715b0bf995b5380b7dd325a056ab97e659a2be0cdf6c33731c683a634b771e8c92a139aee4bb0e49c7077321d42fc199f7c1f298ca625d223a5c263a03cc48159b7812665b78637e4e18720b2c29a6b99f42766a4cbc4dc508ba94ba83b89c3a5c78f8bb26bbd9b79beb8c8182490f5793ee5b96013b74b7e169e29d162f1315464ea7d72436d89b755161192c81cc2dd1c8b8bba795ef426ee1cc01c37aaa37b2cff8b0a378b47cbd0b4d49398cfc2712959699fa0bd8cd84666acc61f541b84fa96b9c854e4e75e9144addb44b8566a57dfbb545ce423c03346f2b2c1a91780d152a8de1a4d4c9cacde7392c996888cc2399c02c38b3353adf8acab283924da00a05b76e738c72c930d6cba09ae168990faa1fef2226e780861d416eff402f4f759fc648ab1f97100109087f96e4b148d2cb31e4805314ea0cd95fb023eac0d989474ba4201d7b41d26f5394b217eea5b34b71a8b37931c0e594271e0b7c733257240233e7ba735603e425a87dee77079e37cb28a21764594ce5350d8da2b62a07174943032ec89c98809c73b6423d30c1d283a766a64d89703c3d629b497828d48320c346210797a298aa10d423c8dda069d02bc59e6cdf03a096b8b3da4cab9b80ca4a14907672ccef1ec4faf234a0bc5b7e9d473f2b3133b3b26a1d175cb67a7805919699c02f76531b99c5f89180704bb4ca4535c5b8972679c660a07c5e514b87009c862eb8f5157695efb3fc40a9def6b81c1cc02a249ae4f094ad0d9bd3485c1c1c68080520a7c8c632032cee738154e5c5176c07da56024776a430fe76eacf665a3f7b832102215bc82f10939c8355704336a8fac1d81e4bb0485aa5d7c74d6b59bbe5c5e972a0d8bac411b55b5d5557cd680a1a8f71b4eb86bc48c9a0509731a54bd9d7290b27963e4372dc9b199cfdcac0b01acd28a62395112e4c43648d622c48c8234d01440e8cc376c927f23a5afc9ac0474c662274e424525c8552ece3b3fe26516de901bc7d515bde89558e626c95c80b93342f8010004f39e6c6c94871c5e344cab3966c835f9a96a59afd31c40286b38b1c1a78470bab947518934453ce86736a919f1f5a6d510a86f5454fc3980cb5c765bd2bd5f7b36b1410d6635c8ceb47c4dda0d76a28eac939c71c3024804866c71626658442163c2c22117e50acefce6378a985652302a4ef0c2ce0cc716b7796e2b6b2e3777dfa1ac3da259a31b5a9b530f8cb638a81a62ac301849abaf95a7301bda30068909bfdb7e67dbccbb38a5551a25b1a3a0f685748ad5753d8880f0016c627486166384c5571fe2365900364d038311e2d875db366686932b5ec602430a369e87a6ef5c338786657825bd4c057aceb923eb0935e6905e63b4ced7f80857a773dd64b150d26612ea9ac12052db2017bf1843ccb4b3281b690dc728adfa85c00281b8e3c09287335f856b4fc2892f69a2f57921ada01914c40988662d57769662a786351b9b66493dab79594d986de2100d65ba0ff4ea58b81538d24a4435a258fac25404aa7f41f658b1385065e158dcb60115732720f40459aaac15e406953a90ac52997d1ccd070060efc65db9e653354467fad56ec713c86e7540c423acf2669f52fa6f4ac6888d871ef3e847c029a8aafbb92e17b24aa079b1f419ba6175b442afb11909d4a56b70a0335b28739218aa7c9348e2c3c2f3eb3d15a41e6417c0dd94bfeb21419b311a7bb13a180bbe833218a9a6b17447cc85f225859587a73077049acbcfd44d0f025438e15d1538270d586e1bf83192a9459cf63c0e972f85297679831ecf121509851cb8340f6f107b0fa1a0efd1b36a8189bc085c4f5cb784e553f41b918f80397ce1956f785bee377ca9aa8be6998ada30c26b7c3d8c6b55254cc96203b20c42aee0ac4e1ebb408e49a9e3f879d0ab0785eb7025425d1305a2299c015e120d163b0e19494ce57253d0246d182745cb8197ab7438b3c1bb7972bec5a306eba3567855c014699fef65ae54c770a0d85c18400cf642aedc660777ba4b138502bd5a7812f621f84a48296b98dd4322b6f15828b8a8f0e00a8ba44a53c3a8b143571b0740abd567daf1cde9c79c204b6d5e259d1766a31bbbcb4e6a05cf4502176b301c1c2f41247750157bcec85e809b30a4d60d7747cdd0f5b99aa8c826987517793aaa8080a0b124a8558df72bbe37b75f4edbb6be8216d6c633fb2b2280e25113d8695e43481c3eeb397eb192505229b67a201ea893c3e2cb32da8bc342fa4dea0578a24e16d8f8f9383a95b77050f4d9fd2f5733eec1d63ef3c23ebf9918173669a7202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
 Error = PRIVATE_KEY_WAS_NOT_SEED
 
-PublicKey = ML-KEM-768-RFC-Public
+EncapsulateDecapsulate = ML-KEM-768-RFC/Private
 Algorithm = ML-KEM-768
-Input = 308204b2300b0609608648016503040402038204a100298aa10d423c8dda069d02bc59e6cdf03a096b8b3da4cab9b80ca4a14907672ccef1ec4faf234a0bc5b7e9d473f2b3133b3b26a1d175cb67a7805919699c02f76531b99c5f89180704bb4ca4535c5b8972679c660a07c5e514b87009c862eb8f5157695efb3fc40a9def6b81c1cc02a249ae4f094ad0d9bd3485c1c1c68080520a7c8c632032cee738154e5c5176c07da56024776a430fe76eacf665a3f7b832102215bc82f10939c8355704336a8fac1d81e4bb0485aa5d7c74d6b59bbe5c5e972a0d8bac411b55b5d5557cd680a1a8f71b4eb86bc48c9a0509731a54bd9d7290b27963e4372dc9b199cfdcac0b01acd28a62395112e4c43648d622c48c8234d01440e8cc376c927f23a5afc9ac0474c662274e424525c8552ece3b3fe26516de901bc7d515bde89558e626c95c80b93342f8010004f39e6c6c94871c5e344cab3966c835f9a96a59afd31c40286b38b1c1a78470bab947518934453ce86736a919f1f5a6d510a86f5454fc3980cb5c765bd2bd5f7b36b1410d6635c8ceb47c4dda0d76a28eac939c71c3024804866c71626658442163c2c22117e50acefce6378a985652302a4ef0c2ce0cc716b7796e2b6b2e3777dfa1ac3da259a31b5a9b530f8cb638a81a62ac301849abaf95a7301bda30068909bfdb7e67dbccbb38a5551a25b1a3a0f685748ad5753d8880f0016c627486166384c5571fe2365900364d038311e2d875db366686932b5ec602430a369e87a6ef5c338786657825bd4c057aceb923eb0935e6905e63b4ced7f80857a773dd64b150d26612ea9ac12052db2017bf1843ccb4b3281b690dc728adfa85c00281b8e3c09287335f856b4fc2892f69a2f57921ada01914c40988662d57769662a786351b9b66493dab79594d986de2100d65ba0ff4ea58b81538d24a4435a258fac25404aa7f41f658b1385065e158dcb60115732720f40459aaac15e406953a90ac52997d1ccd070060efc65db9e653354467fad56ec713c86e7540c423acf2669f52fa6f4ac6888d871ef3e847c029a8aafbb92e17b24aa079b1f419ba6175b442afb11909d4a56b70a0335b28739218aa7c9348e2c3c2f3eb3d15a41e6417c0dd94bfeb21419b311a7bb13a180bbe833218a9a6b17447cc85f225859587a73077049acbcfd44d0f025438e15d1538270d586e1bf83192a9459cf63c0e972f85297679831ecf121509851cb8340f6f107b0fa1a0efd1b36a8189bc085c4f5cb784e553f41b918f80397ce1956f785bee377ca9aa8be6998ada30c26b7c3d8c6b55254cc96203b20c42aee0ac4e1ebb408e49a9e3f879d0ab0785eb7025425d1305a2299c015e120d163b0e19494ce57253d0246d182745cb8197ab7438b3c1bb7972bec5a306eba3567855c014699fef65ae54c770a0d85c18400cf642aedc660777ba4b138502bd5a7812f621f84a48296b98dd4322b6f15828b8a8f0e00a8ba44a53c3a8b143571b0740abd567daf1cde9c79c204b6d5e259d1766a31bbbcb4e6a05cf4502176b301c1c2f41247750157bcec85e809b30a4d60d7747cdd0f5b99aa8c826987517793aaa8080a0b124a8558df72bbe37b75f4edbb6be8216d6c633fb2b2280e25113d8695e43481c3eeb397eb192505229b67a201ea893c3e2cb32da8bc342fa4dea0578
-Bits = 9472
-RawPublic = 298aa10d423c8dda069d02bc59e6cdf03a096b8b3da4cab9b80ca4a14907672ccef1ec4faf234a0bc5b7e9d473f2b3133b3b26a1d175cb67a7805919699c02f76531b99c5f89180704bb4ca4535c5b8972679c660a07c5e514b87009c862eb8f5157695efb3fc40a9def6b81c1cc02a249ae4f094ad0d9bd3485c1c1c68080520a7c8c632032cee738154e5c5176c07da56024776a430fe76eacf665a3f7b832102215bc82f10939c8355704336a8fac1d81e4bb0485aa5d7c74d6b59bbe5c5e972a0d8bac411b55b5d5557cd680a1a8f71b4eb86bc48c9a0509731a54bd9d7290b27963e4372dc9b199cfdcac0b01acd28a62395112e4c43648d622c48c8234d01440e8cc376c927f23a5afc9ac0474c662274e424525c8552ece3b3fe26516de901bc7d515bde89558e626c95c80b93342f8010004f39e6c6c94871c5e344cab3966c835f9a96a59afd31c40286b38b1c1a78470bab947518934453ce86736a919f1f5a6d510a86f5454fc3980cb5c765bd2bd5f7b36b1410d6635c8ceb47c4dda0d76a28eac939c71c3024804866c71626658442163c2c22117e50acefce6378a985652302a4ef0c2ce0cc716b7796e2b6b2e3777dfa1ac3da259a31b5a9b530f8cb638a81a62ac301849abaf95a7301bda30068909bfdb7e67dbccbb38a5551a25b1a3a0f685748ad5753d8880f0016c627486166384c5571fe2365900364d038311e2d875db366686932b5ec602430a369e87a6ef5c338786657825bd4c057aceb923eb0935e6905e63b4ced7f80857a773dd64b150d26612ea9ac12052db2017bf1843ccb4b3281b690dc728adfa85c00281b8e3c09287335f856b4fc2892f69a2f57921ada01914c40988662d57769662a786351b9b66493dab79594d986de2100d65ba0ff4ea58b81538d24a4435a258fac25404aa7f41f658b1385065e158dcb60115732720f40459aaac15e406953a90ac52997d1ccd070060efc65db9e653354467fad56ec713c86e7540c423acf2669f52fa6f4ac6888d871ef3e847c029a8aafbb92e17b24aa079b1f419ba6175b442afb11909d4a56b70a0335b28739218aa7c9348e2c3c2f3eb3d15a41e6417c0dd94bfeb21419b311a7bb13a180bbe833218a9a6b17447cc85f225859587a73077049acbcfd44d0f025438e15d1538270d586e1bf83192a9459cf63c0e972f85297679831ecf121509851cb8340f6f107b0fa1a0efd1b36a8189bc085c4f5cb784e553f41b918f80397ce1956f785bee377ca9aa8be6998ada30c26b7c3d8c6b55254cc96203b20c42aee0ac4e1ebb408e49a9e3f879d0ab0785eb7025425d1305a2299c015e120d163b0e19494ce57253d0246d182745cb8197ab7438b3c1bb7972bec5a306eba3567855c014699fef65ae54c770a0d85c18400cf642aedc660777ba4b138502bd5a7812f621f84a48296b98dd4322b6f15828b8a8f0e00a8ba44a53c3a8b143571b0740abd567daf1cde9c79c204b6d5e259d1766a31bbbcb4e6a05cf4502176b301c1c2f41247750157bcec85e809b30a4d60d7747cdd0f5b99aa8c826987517793aaa8080a0b124a8558df72bbe37b75f4edbb6be8216d6c633fb2b2280e25113d8695e43481c3eeb397eb192505229b67a201ea893c3e2cb32da8bc342fa4dea0578
 
-Encapsulate = ML-KEM-768-RFC-Public
+Encapsulate = ML-KEM-768-RFC
 Algorithm = ML-KEM-768
 
-PrivateKey = ML-KEM-1024-RFC-Seed
+Key = ML-KEM-1024-RFC
 Algorithm = ML-KEM-1024
-Input = 3054020100300b060960864801650304040304428040000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
 Bits = 12544
+SPKI = 30820632300b060960864801650304040303820621004b94c29450111191823b3514c9ac1ea3d9825ccb86393a2dfb04654fa2192d37bfad1c497c6502eee5ca80a73bfce0baf5a54a88585a401397a3d232f426a7afb082bc21a44317090eaac7592c2ea88a653c4491ea193931335f52e989a3c4cc56d9c553732d57c470fb41ab759b65d2d04445382fcd9c4e344a1128fa9e11e04358e192ed014b23232a7ee2b22e23717f44111ee33575399c37646da9813ec9b212afe94e5dc5c2330a7294cc1f4234a6d3fbb4f1685ab8892c04acb17cd1c170d7b0611b6a7176c794cc8c67f55fc923c2ad203100f365991882c30243d77813843b5ec7c964032263706092ecf00c7516be64e4598ca4226c069bb5e67e4175cf2286c8dd5c488a6c5861f31baa0bd0269470e8b551dd3bcd38c86c12f9cdb176c77dc8b6c02a701f478902c8553f694c0d82727b4c4a5c2c1041212aa1274808b82111b377ec75214e9b1978f76004d4139d98613f4b8e98d20af7b534073a509a959b7a7564f9b40ca218bf61829320a8502017954d328d7ac6c769ec29700756e7b0685b340d5e118059504a49a9a50a10198eb10a5784678eb427d7b4babb9552933b062897973e1318eaf0a0eac37584a65401b1703e042accd837531483f241cadcd1c1d378119e694429db199ac891e4c5343757085bb3ae783667350c4458d97672e861e80b1d2679510ea3a6f2360c77a46942c7a06a554d228080c84b47aef14db17620cb16c06ab30a1be4cda7082be9f87e9c211c46916349a5ba8eaa5201c7294a3c0885b53b657452108825ec646c90a04612324ee7d031afe5343132cbef67b6efb1a5ec2809b773538ce77b3d8b04eb0b3c2256011e4c716c19a8ba0752bf71492117649f0615c3290fc29a46fde4bd52db9286d603388244259c15a7ac2b640a60cc03376a5841a3fb8a473568fa9b1a267215f34c01697b0f0e627175d72105b7707c29b9e614bdc33a6f6c818a95370b427882d7b476796a9ec6eb993274cd9b2391a82ba45e3393d2e9ae9721ca9d6c1b988b5827713f90a6585de9433528c02b03ce10bb5f720138d0fbb4c30c1266b918e52925dfe17b37f95d22bca54f475919ac859098c0f0d08ac5875ef29b56fd141e6ef15f700a0b66f39595c588177373c4669b21bc071e4c3aa5f0b4a31b6258f35da24ac3cd29c7f2092410c5078355b138fb53a6b9ae6e0b9c08243e7baa45c47376eb8c7f13d4cf51aa736fa31540c9241f370da544bf9f9c28d9a57e2f2a7ca95a4e4b466e641ab3bcc76adf1139d567a6f12b52f3a65e7ec0aae26bcaa8c55833b04e59998ebc9a1930fbb6d2233c53d2c1f8b9518e3c2de73a19dee6b380a5b32971cf64e129fd6c1fa6e75d4a234501e966dd3a540af5c8f4f34a6b4a253ee28492566d5e67c6f55855fcb0506fb06c156744d9a03a31a26fa94cad14f157b7f303d07a69c773768fcb4d079c09059703a0c3a94de4b99ea3a2f16583d0f9170a3950db07b4f0bc30802927f9f7961b6259892636a9502a2705303637799dd344da451c1cf7bf67840ceb3079ab8c6b8c1927f64053c612450c45c9e603bc16666e596b3471e103b6f15447424d17022048111ffbd37e1c670f64f14b8a7b32b94c1a49b45dd2fc38cd5289d910ad63602cf5e13042c64ac6797b89fb551ad08e05a92d200cccb7e712ef23c9312cb350f029ab537e287347fd3075ac10906a783f1c6c07ccb88f41228c4be1c640f790b5c3a5d5d3ca792495d74bc461562658c07ac600276b924ab5bc9be1f0494cb76f82f460a7480972663381e169996061d799859ec54d4f5ca5c411c01db1597b165977669de13a928a34afbac258fea8c4764239c9421dc3119bf5b47699206978327b1c5345ef746a7983841f056e2534100ab24d4e9abbd0b17c6a95bd4c3c0e40f69e1612aceeb28b99086c95116e7204273893390bf46b899b36286b0ebf1947bb9884f732ca27da82b19b5dc0cc7f8885714910888b2310c4f9319d410b34e6433b9003e2176bb995257456106e8952163b8ba592530cc5aa0aeb43ad398fe9e97baa523d7a4431677c3d3af0719e475db85ca95af5089beabeb05b2faab4896ba60f81c88472a57b46a828826a0cdfb446f8189182d2bf5eac4ec1cc5deaf599c8a13e48235406d17ffddc8344b6c66984a868aa92fa02227a086950eb0c8701ed58dc628776b983882e1175
+PKCS8 = 3054020100300b060960864801650304040304428040000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
 RawPublic = 4b94c29450111191823b3514c9ac1ea3d9825ccb86393a2dfb04654fa2192d37bfad1c497c6502eee5ca80a73bfce0baf5a54a88585a401397a3d232f426a7afb082bc21a44317090eaac7592c2ea88a653c4491ea193931335f52e989a3c4cc56d9c553732d57c470fb41ab759b65d2d04445382fcd9c4e344a1128fa9e11e04358e192ed014b23232a7ee2b22e23717f44111ee33575399c37646da9813ec9b212afe94e5dc5c2330a7294cc1f4234a6d3fbb4f1685ab8892c04acb17cd1c170d7b0611b6a7176c794cc8c67f55fc923c2ad203100f365991882c30243d77813843b5ec7c964032263706092ecf00c7516be64e4598ca4226c069bb5e67e4175cf2286c8dd5c488a6c5861f31baa0bd0269470e8b551dd3bcd38c86c12f9cdb176c77dc8b6c02a701f478902c8553f694c0d82727b4c4a5c2c1041212aa1274808b82111b377ec75214e9b1978f76004d4139d98613f4b8e98d20af7b534073a509a959b7a7564f9b40ca218bf61829320a8502017954d328d7ac6c769ec29700756e7b0685b340d5e118059504a49a9a50a10198eb10a5784678eb427d7b4babb9552933b062897973e1318eaf0a0eac37584a65401b1703e042accd837531483f241cadcd1c1d378119e694429db199ac891e4c5343757085bb3ae783667350c4458d97672e861e80b1d2679510ea3a6f2360c77a46942c7a06a554d228080c84b47aef14db17620cb16c06ab30a1be4cda7082be9f87e9c211c46916349a5ba8eaa5201c7294a3c0885b53b657452108825ec646c90a04612324ee7d031afe5343132cbef67b6efb1a5ec2809b773538ce77b3d8b04eb0b3c2256011e4c716c19a8ba0752bf71492117649f0615c3290fc29a46fde4bd52db9286d603388244259c15a7ac2b640a60cc03376a5841a3fb8a473568fa9b1a267215f34c01697b0f0e627175d72105b7707c29b9e614bdc33a6f6c818a95370b427882d7b476796a9ec6eb993274cd9b2391a82ba45e3393d2e9ae9721ca9d6c1b988b5827713f90a6585de9433528c02b03ce10bb5f720138d0fbb4c30c1266b918e52925dfe17b37f95d22bca54f475919ac859098c0f0d08ac5875ef29b56fd141e6ef15f700a0b66f39595c588177373c4669b21bc071e4c3aa5f0b4a31b6258f35da24ac3cd29c7f2092410c5078355b138fb53a6b9ae6e0b9c08243e7baa45c47376eb8c7f13d4cf51aa736fa31540c9241f370da544bf9f9c28d9a57e2f2a7ca95a4e4b466e641ab3bcc76adf1139d567a6f12b52f3a65e7ec0aae26bcaa8c55833b04e59998ebc9a1930fbb6d2233c53d2c1f8b9518e3c2de73a19dee6b380a5b32971cf64e129fd6c1fa6e75d4a234501e966dd3a540af5c8f4f34a6b4a253ee28492566d5e67c6f55855fcb0506fb06c156744d9a03a31a26fa94cad14f157b7f303d07a69c773768fcb4d079c09059703a0c3a94de4b99ea3a2f16583d0f9170a3950db07b4f0bc30802927f9f7961b6259892636a9502a2705303637799dd344da451c1cf7bf67840ceb3079ab8c6b8c1927f64053c612450c45c9e603bc16666e596b3471e103b6f15447424d17022048111ffbd37e1c670f64f14b8a7b32b94c1a49b45dd2fc38cd5289d910ad63602cf5e13042c64ac6797b89fb551ad08e05a92d200cccb7e712ef23c9312cb350f029ab537e287347fd3075ac10906a783f1c6c07ccb88f41228c4be1c640f790b5c3a5d5d3ca792495d74bc461562658c07ac600276b924ab5bc9be1f0494cb76f82f460a7480972663381e169996061d799859ec54d4f5ca5c411c01db1597b165977669de13a928a34afbac258fea8c4764239c9421dc3119bf5b47699206978327b1c5345ef746a7983841f056e2534100ab24d4e9abbd0b17c6a95bd4c3c0e40f69e1612aceeb28b99086c95116e7204273893390bf46b899b36286b0ebf1947bb9884f732ca27da82b19b5dc0cc7f8885714910888b2310c4f9319d410b34e6433b9003e2176bb995257456106e8952163b8ba592530cc5aa0aeb43ad398fe9e97baa523d7a4431677c3d3af0719e475db85ca95af5089beabeb05b2faab4896ba60f81c88472a57b46a828826a0cdfb446f8189182d2bf5eac4ec1cc5deaf599c8a13e48235406d17ffddc8344b6c66984a868aa92fa02227a086950eb0c8701ed58dc628776b983882e1175
 PrivateSeed = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
 
-EncapsulateDecapsulate = ML-KEM-1024-RFC-Seed
-Algorithm = ML-KEM-1024
-
-PrivateKey = ML-KEM-1024-RFC-Expanded
-Input = 30820c78020100300b060960864801650304040304820c6404820c60f77b7f6b15c73fe2cc546b67fb774ca19b42cd463ea9fbb984ca477a77b6c71087cbf051abe4736a9072c6e870c8311c55963f500a3c7b1b8f2a58558f49c62527b6c594b5e7acb3bcf597273a5743517d151208bd4aa61e75ba67b0bd594a994919627ac0a804d489e171336bc339f4666706e5134412b366823d50318c8bf261ab120a28a04fec01cc15f2b71912cee54aa8eed854694b6ba886b5eb7661e6d56aac213cc1d814d592b395554fae74476d34371163129bf864527250606cc21a53746b20997077bba155733b28a4e7fa0776399524763eb481ceaa11366c3474a04685f40c3f08b0424f40bff949a0ac92704c3ba0c6eb36f1f5b621d8bf2b6327beb57cd3facb94186fe3fc9ab0a1434bb291d2c9bb70723057e2254059656f565919a32cf74579de89681cd2c5a935a52b4aaa2d24cb5d5c9e20729ec5492ec36961efb8a28cbc00ac303523295f3d8036abc1603307ce70d7848a35657a5687dd589927ea63731626abb26ec4e431b8eb6b3b0bc1e82573ee73b1a021183183528108ae2eacaddb95b464a0b98469c319cc27bfa01bc31054a68c05502b1662b879fe98a1711c3426f6436cb0214cea379ac3a7e5fb60184a37c1da1eda61c6c39c1dd4e847845811f2a358a43731528536d4a3291b04158c2c3dc641624882678bc7805f58a9d94c7104567846a2044e65aece2a225372b6024799a5477d60237504aa5c0ac57bc70a3558c08c4de687ef1302b4fcb5594413d22cb959bc31be423450403c6bc57dc411b3fefac1052ac4bb162c44545a4ca80892657fa13a0b2c482ced629cc4999d969c593d4aadf073cc3e3a458e78a8aa039408e652be93b20c8b42ec5b0e50239dac726052851a6d15312ec39ed208b72209a577c6b2770112895749d5260e7dd446c0b0118c1000be6801d2611fcf00792a9cc4f4b49922f9a2d4b9c8fa5a5d0d60506631a7e971cee840b08fa63c13729d7ea5aac70352a984cdb669331cba758fe87ec3931b3e3161fcc747aa749424689feae14bf7c9a2ffba1302b212b80372d8e9049db69a3a1261d0a2859a9b4d57899e0ba41607a1b67a7c0e12923689f8c6395377d970c7490a4129611a1d05c3b7813bed945420723f7f9525a87793fafbbfca982e66bb80681c83248a89da084c19882f48f31e7fc09093a49e9fd09691b021edf463afc519b62853816118346115fb0b882cc6482f3c5cbcc1c1894697e1239598b34b2a9a7acd15244d0690c88194097a9beda585e87c437124624c210768e6215d376482653eb89947877c118d370c696a6ffcc1018ae413a08a8d0ffaa819945da7a167c229913290cad1c80a369258762610ea253e62dc24226a30c892c12136c326f13f4446664712b0b90bc063b4028593cbde06cdc22289e240c7e296b59172c1aeda8c99e0512d1a0163a942ea33148e6937c026029424b81b996b1df22ea0623ec65c6bf093500cf3bf35374adc392035ca7c583b99685bca541a0807b163acd0888be0385dea820da46e4dbb44d2e462c734b83a473fed1364273159257cc259a8c5676c1c76d41d56b9907ec1c3599c9e8907403a27a705e3619b04b0ad046e8ec8169c17b460d44c0c0c4464d044c946186bc725965083a892bcc495c0540311ff9b3e5192c303d88f8ba46a901c782ef02388f1b2addab6a5350fc3639700e3154337337e4a178d351cd2b56ee1f0bfea34aacfa33d2ec791e50752d4d034cb1c951572caaa5c4d90947b6b175a6dd3c62a77bb8f7ac9ae24719b53c2b120a2876986e217b72bd7cee44a7265b11cee1ab2261762b31a3738386969c0825fb79452e652e1142fc73c9df6fba411795b4717922b29ba2d53abe5a8c0dcc1601b096c96d7938fd5a68a8797c7b9477a86a472eb5da250cb2fec318d83c8f43bbe8e11c35e377d349366c85c4382597f6fc27a0051c0fb00b02c01ca20f9a427f172599477ca690cc1327e0f025f80ec338a80a159e308c12a27db1a7e1b960a99d37dfc22872e51930f28c651ab221f53abaee20bad9a3eabcbab913251bf135beb29617b5754333c4daadb2238341c2ad9378186280f6449440b784ba78f5dac44d8f65b3b7421950397c3913a2dd23ec6d1cb717b36a5fc95af191e278296948c1254ea86b4ec004b94c29450111191823b3514c9ac1ea3d9825ccb86393a2dfb04654fa2192d37bfad1c497c6502eee5ca80a73bfce0baf5a54a88585a401397a3d232f426a7afb082bc21a44317090eaac7592c2ea88a653c4491ea193931335f52e989a3c4cc56d9c553732d57c470fb41ab759b65d2d04445382fcd9c4e344a1128fa9e11e04358e192ed014b23232a7ee2b22e23717f44111ee33575399c37646da9813ec9b212afe94e5dc5c2330a7294cc1f4234a6d3fbb4f1685ab8892c04acb17cd1c170d7b0611b6a7176c794cc8c67f55fc923c2ad203100f365991882c30243d77813843b5ec7c964032263706092ecf00c7516be64e4598ca4226c069bb5e67e4175cf2286c8dd5c488a6c5861f31baa0bd0269470e8b551dd3bcd38c86c12f9cdb176c77dc8b6c02a701f478902c8553f694c0d82727b4c4a5c2c1041212aa1274808b82111b377ec75214e9b1978f76004d4139d98613f4b8e98d20af7b534073a509a959b7a7564f9b40ca218bf61829320a8502017954d328d7ac6c769ec29700756e7b0685b340d5e118059504a49a9a50a10198eb10a5784678eb427d7b4babb9552933b062897973e1318eaf0a0eac37584a65401b1703e042accd837531483f241cadcd1c1d378119e694429db199ac891e4c5343757085bb3ae783667350c4458d97672e861e80b1d2679510ea3a6f2360c77a46942c7a06a554d228080c84b47aef14db17620cb16c06ab30a1be4cda7082be9f87e9c211c46916349a5ba8eaa5201c7294a3c0885b53b657452108825ec646c90a04612324ee7d031afe5343132cbef67b6efb1a5ec2809b773538ce77b3d8b04eb0b3c2256011e4c716c19a8ba0752bf71492117649f0615c3290fc29a46fde4bd52db9286d603388244259c15a7ac2b640a60cc03376a5841a3fb8a473568fa9b1a267215f34c01697b0f0e627175d72105b7707c29b9e614bdc33a6f6c818a95370b427882d7b476796a9ec6eb993274cd9b2391a82ba45e3393d2e9ae9721ca9d6c1b988b5827713f90a6585de9433528c02b03ce10bb5f720138d0fbb4c30c1266b918e52925dfe17b37f95d22bca54f475919ac859098c0f0d08ac5875ef29b56fd141e6ef15f700a0b66f39595c588177373c4669b21bc071e4c3aa5f0b4a31b6258f35da24ac3cd29c7f2092410c5078355b138fb53a6b9ae6e0b9c08243e7baa45c47376eb8c7f13d4cf51aa736fa31540c9241f370da544bf9f9c28d9a57e2f2a7ca95a4e4b466e641ab3bcc76adf1139d567a6f12b52f3a65e7ec0aae26bcaa8c55833b04e59998ebc9a1930fbb6d2233c53d2c1f8b9518e3c2de73a19dee6b380a5b32971cf64e129fd6c1fa6e75d4a234501e966dd3a540af5c8f4f34a6b4a253ee28492566d5e67c6f55855fcb0506fb06c156744d9a03a31a26fa94cad14f157b7f303d07a69c773768fcb4d079c09059703a0c3a94de4b99ea3a2f16583d0f9170a3950db07b4f0bc30802927f9f7961b6259892636a9502a2705303637799dd344da451c1cf7bf67840ceb3079ab8c6b8c1927f64053c612450c45c9e603bc16666e596b3471e103b6f15447424d17022048111ffbd37e1c670f64f14b8a7b32b94c1a49b45dd2fc38cd5289d910ad63602cf5e13042c64ac6797b89fb551ad08e05a92d200cccb7e712ef23c9312cb350f029ab537e287347fd3075ac10906a783f1c6c07ccb88f41228c4be1c640f790b5c3a5d5d3ca792495d74bc461562658c07ac600276b924ab5bc9be1f0494cb76f82f460a7480972663381e169996061d799859ec54d4f5ca5c411c01db1597b165977669de13a928a34afbac258fea8c4764239c9421dc3119bf5b47699206978327b1c5345ef746a7983841f056e2534100ab24d4e9abbd0b17c6a95bd4c3c0e40f69e1612aceeb28b99086c95116e7204273893390bf46b899b36286b0ebf1947bb9884f732ca27da82b19b5dc0cc7f8885714910888b2310c4f9319d410b34e6433b9003e2176bb995257456106e8952163b8ba592530cc5aa0aeb43ad398fe9e97baa523d7a4431677c3d3af0719e475db85ca95af5089beabeb05b2faab4896ba60f81c88472a57b46a828826a0cdfb446f8189182d2bf5eac4ec1cc5deaf599c8a13e48235406d17ffddc8344b6c66984a868aa92fa02227a086950eb0c8701ed58dc628776b983882e117561349e5c131a7e116a0463861d7d18663c5627c38c7147ddaadfd48acd7a4535202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
+Key = ML-KEM-1024-RFC-Expanded
+PKCS8 = 30820c78020100300b060960864801650304040304820c6404820c60f77b7f6b15c73fe2cc546b67fb774ca19b42cd463ea9fbb984ca477a77b6c71087cbf051abe4736a9072c6e870c8311c55963f500a3c7b1b8f2a58558f49c62527b6c594b5e7acb3bcf597273a5743517d151208bd4aa61e75ba67b0bd594a994919627ac0a804d489e171336bc339f4666706e5134412b366823d50318c8bf261ab120a28a04fec01cc15f2b71912cee54aa8eed854694b6ba886b5eb7661e6d56aac213cc1d814d592b395554fae74476d34371163129bf864527250606cc21a53746b20997077bba155733b28a4e7fa0776399524763eb481ceaa11366c3474a04685f40c3f08b0424f40bff949a0ac92704c3ba0c6eb36f1f5b621d8bf2b6327beb57cd3facb94186fe3fc9ab0a1434bb291d2c9bb70723057e2254059656f565919a32cf74579de89681cd2c5a935a52b4aaa2d24cb5d5c9e20729ec5492ec36961efb8a28cbc00ac303523295f3d8036abc1603307ce70d7848a35657a5687dd589927ea63731626abb26ec4e431b8eb6b3b0bc1e82573ee73b1a021183183528108ae2eacaddb95b464a0b98469c319cc27bfa01bc31054a68c05502b1662b879fe98a1711c3426f6436cb0214cea379ac3a7e5fb60184a37c1da1eda61c6c39c1dd4e847845811f2a358a43731528536d4a3291b04158c2c3dc641624882678bc7805f58a9d94c7104567846a2044e65aece2a225372b6024799a5477d60237504aa5c0ac57bc70a3558c08c4de687ef1302b4fcb5594413d22cb959bc31be423450403c6bc57dc411b3fefac1052ac4bb162c44545a4ca80892657fa13a0b2c482ced629cc4999d969c593d4aadf073cc3e3a458e78a8aa039408e652be93b20c8b42ec5b0e50239dac726052851a6d15312ec39ed208b72209a577c6b2770112895749d5260e7dd446c0b0118c1000be6801d2611fcf00792a9cc4f4b49922f9a2d4b9c8fa5a5d0d60506631a7e971cee840b08fa63c13729d7ea5aac70352a984cdb669331cba758fe87ec3931b3e3161fcc747aa749424689feae14bf7c9a2ffba1302b212b80372d8e9049db69a3a1261d0a2859a9b4d57899e0ba41607a1b67a7c0e12923689f8c6395377d970c7490a4129611a1d05c3b7813bed945420723f7f9525a87793fafbbfca982e66bb80681c83248a89da084c19882f48f31e7fc09093a49e9fd09691b021edf463afc519b62853816118346115fb0b882cc6482f3c5cbcc1c1894697e1239598b34b2a9a7acd15244d0690c88194097a9beda585e87c437124624c210768e6215d376482653eb89947877c118d370c696a6ffcc1018ae413a08a8d0ffaa819945da7a167c229913290cad1c80a369258762610ea253e62dc24226a30c892c12136c326f13f4446664712b0b90bc063b4028593cbde06cdc22289e240c7e296b59172c1aeda8c99e0512d1a0163a942ea33148e6937c026029424b81b996b1df22ea0623ec65c6bf093500cf3bf35374adc392035ca7c583b99685bca541a0807b163acd0888be0385dea820da46e4dbb44d2e462c734b83a473fed1364273159257cc259a8c5676c1c76d41d56b9907ec1c3599c9e8907403a27a705e3619b04b0ad046e8ec8169c17b460d44c0c0c4464d044c946186bc725965083a892bcc495c0540311ff9b3e5192c303d88f8ba46a901c782ef02388f1b2addab6a5350fc3639700e3154337337e4a178d351cd2b56ee1f0bfea34aacfa33d2ec791e50752d4d034cb1c951572caaa5c4d90947b6b175a6dd3c62a77bb8f7ac9ae24719b53c2b120a2876986e217b72bd7cee44a7265b11cee1ab2261762b31a3738386969c0825fb79452e652e1142fc73c9df6fba411795b4717922b29ba2d53abe5a8c0dcc1601b096c96d7938fd5a68a8797c7b9477a86a472eb5da250cb2fec318d83c8f43bbe8e11c35e377d349366c85c4382597f6fc27a0051c0fb00b02c01ca20f9a427f172599477ca690cc1327e0f025f80ec338a80a159e308c12a27db1a7e1b960a99d37dfc22872e51930f28c651ab221f53abaee20bad9a3eabcbab913251bf135beb29617b5754333c4daadb2238341c2ad9378186280f6449440b784ba78f5dac44d8f65b3b7421950397c3913a2dd23ec6d1cb717b36a5fc95af191e278296948c1254ea86b4ec004b94c29450111191823b3514c9ac1ea3d9825ccb86393a2dfb04654fa2192d37bfad1c497c6502eee5ca80a73bfce0baf5a54a88585a401397a3d232f426a7afb082bc21a44317090eaac7592c2ea88a653c4491ea193931335f52e989a3c4cc56d9c553732d57c470fb41ab759b65d2d04445382fcd9c4e344a1128fa9e11e04358e192ed014b23232a7ee2b22e23717f44111ee33575399c37646da9813ec9b212afe94e5dc5c2330a7294cc1f4234a6d3fbb4f1685ab8892c04acb17cd1c170d7b0611b6a7176c794cc8c67f55fc923c2ad203100f365991882c30243d77813843b5ec7c964032263706092ecf00c7516be64e4598ca4226c069bb5e67e4175cf2286c8dd5c488a6c5861f31baa0bd0269470e8b551dd3bcd38c86c12f9cdb176c77dc8b6c02a701f478902c8553f694c0d82727b4c4a5c2c1041212aa1274808b82111b377ec75214e9b1978f76004d4139d98613f4b8e98d20af7b534073a509a959b7a7564f9b40ca218bf61829320a8502017954d328d7ac6c769ec29700756e7b0685b340d5e118059504a49a9a50a10198eb10a5784678eb427d7b4babb9552933b062897973e1318eaf0a0eac37584a65401b1703e042accd837531483f241cadcd1c1d378119e694429db199ac891e4c5343757085bb3ae783667350c4458d97672e861e80b1d2679510ea3a6f2360c77a46942c7a06a554d228080c84b47aef14db17620cb16c06ab30a1be4cda7082be9f87e9c211c46916349a5ba8eaa5201c7294a3c0885b53b657452108825ec646c90a04612324ee7d031afe5343132cbef67b6efb1a5ec2809b773538ce77b3d8b04eb0b3c2256011e4c716c19a8ba0752bf71492117649f0615c3290fc29a46fde4bd52db9286d603388244259c15a7ac2b640a60cc03376a5841a3fb8a473568fa9b1a267215f34c01697b0f0e627175d72105b7707c29b9e614bdc33a6f6c818a95370b427882d7b476796a9ec6eb993274cd9b2391a82ba45e3393d2e9ae9721ca9d6c1b988b5827713f90a6585de9433528c02b03ce10bb5f720138d0fbb4c30c1266b918e52925dfe17b37f95d22bca54f475919ac859098c0f0d08ac5875ef29b56fd141e6ef15f700a0b66f39595c588177373c4669b21bc071e4c3aa5f0b4a31b6258f35da24ac3cd29c7f2092410c5078355b138fb53a6b9ae6e0b9c08243e7baa45c47376eb8c7f13d4cf51aa736fa31540c9241f370da544bf9f9c28d9a57e2f2a7ca95a4e4b466e641ab3bcc76adf1139d567a6f12b52f3a65e7ec0aae26bcaa8c55833b04e59998ebc9a1930fbb6d2233c53d2c1f8b9518e3c2de73a19dee6b380a5b32971cf64e129fd6c1fa6e75d4a234501e966dd3a540af5c8f4f34a6b4a253ee28492566d5e67c6f55855fcb0506fb06c156744d9a03a31a26fa94cad14f157b7f303d07a69c773768fcb4d079c09059703a0c3a94de4b99ea3a2f16583d0f9170a3950db07b4f0bc30802927f9f7961b6259892636a9502a2705303637799dd344da451c1cf7bf67840ceb3079ab8c6b8c1927f64053c612450c45c9e603bc16666e596b3471e103b6f15447424d17022048111ffbd37e1c670f64f14b8a7b32b94c1a49b45dd2fc38cd5289d910ad63602cf5e13042c64ac6797b89fb551ad08e05a92d200cccb7e712ef23c9312cb350f029ab537e287347fd3075ac10906a783f1c6c07ccb88f41228c4be1c640f790b5c3a5d5d3ca792495d74bc461562658c07ac600276b924ab5bc9be1f0494cb76f82f460a7480972663381e169996061d799859ec54d4f5ca5c411c01db1597b165977669de13a928a34afbac258fea8c4764239c9421dc3119bf5b47699206978327b1c5345ef746a7983841f056e2534100ab24d4e9abbd0b17c6a95bd4c3c0e40f69e1612aceeb28b99086c95116e7204273893390bf46b899b36286b0ebf1947bb9884f732ca27da82b19b5dc0cc7f8885714910888b2310c4f9319d410b34e6433b9003e2176bb995257456106e8952163b8ba592530cc5aa0aeb43ad398fe9e97baa523d7a4431677c3d3af0719e475db85ca95af5089beabeb05b2faab4896ba60f81c88472a57b46a828826a0cdfb446f8189182d2bf5eac4ec1cc5deaf599c8a13e48235406d17ffddc8344b6c66984a868aa92fa02227a086950eb0c8701ed58dc628776b983882e117561349e5c131a7e116a0463861d7d18663c5627c38c7147ddaadfd48acd7a4535202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
 Error = PRIVATE_KEY_WAS_NOT_SEED
 
-PrivateKey = ML-KEM-1024-RFC-Both
-Input = 30820cbe020100300b060960864801650304040304820caa30820ca60440000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f04820c60f77b7f6b15c73fe2cc546b67fb774ca19b42cd463ea9fbb984ca477a77b6c71087cbf051abe4736a9072c6e870c8311c55963f500a3c7b1b8f2a58558f49c62527b6c594b5e7acb3bcf597273a5743517d151208bd4aa61e75ba67b0bd594a994919627ac0a804d489e171336bc339f4666706e5134412b366823d50318c8bf261ab120a28a04fec01cc15f2b71912cee54aa8eed854694b6ba886b5eb7661e6d56aac213cc1d814d592b395554fae74476d34371163129bf864527250606cc21a53746b20997077bba155733b28a4e7fa0776399524763eb481ceaa11366c3474a04685f40c3f08b0424f40bff949a0ac92704c3ba0c6eb36f1f5b621d8bf2b6327beb57cd3facb94186fe3fc9ab0a1434bb291d2c9bb70723057e2254059656f565919a32cf74579de89681cd2c5a935a52b4aaa2d24cb5d5c9e20729ec5492ec36961efb8a28cbc00ac303523295f3d8036abc1603307ce70d7848a35657a5687dd589927ea63731626abb26ec4e431b8eb6b3b0bc1e82573ee73b1a021183183528108ae2eacaddb95b464a0b98469c319cc27bfa01bc31054a68c05502b1662b879fe98a1711c3426f6436cb0214cea379ac3a7e5fb60184a37c1da1eda61c6c39c1dd4e847845811f2a358a43731528536d4a3291b04158c2c3dc641624882678bc7805f58a9d94c7104567846a2044e65aece2a225372b6024799a5477d60237504aa5c0ac57bc70a3558c08c4de687ef1302b4fcb5594413d22cb959bc31be423450403c6bc57dc411b3fefac1052ac4bb162c44545a4ca80892657fa13a0b2c482ced629cc4999d969c593d4aadf073cc3e3a458e78a8aa039408e652be93b20c8b42ec5b0e50239dac726052851a6d15312ec39ed208b72209a577c6b2770112895749d5260e7dd446c0b0118c1000be6801d2611fcf00792a9cc4f4b49922f9a2d4b9c8fa5a5d0d60506631a7e971cee840b08fa63c13729d7ea5aac70352a984cdb669331cba758fe87ec3931b3e3161fcc747aa749424689feae14bf7c9a2ffba1302b212b80372d8e9049db69a3a1261d0a2859a9b4d57899e0ba41607a1b67a7c0e12923689f8c6395377d970c7490a4129611a1d05c3b7813bed945420723f7f9525a87793fafbbfca982e66bb80681c83248a89da084c19882f48f31e7fc09093a49e9fd09691b021edf463afc519b62853816118346115fb0b882cc6482f3c5cbcc1c1894697e1239598b34b2a9a7acd15244d0690c88194097a9beda585e87c437124624c210768e6215d376482653eb89947877c118d370c696a6ffcc1018ae413a08a8d0ffaa819945da7a167c229913290cad1c80a369258762610ea253e62dc24226a30c892c12136c326f13f4446664712b0b90bc063b4028593cbde06cdc22289e240c7e296b59172c1aeda8c99e0512d1a0163a942ea33148e6937c026029424b81b996b1df22ea0623ec65c6bf093500cf3bf35374adc392035ca7c583b99685bca541a0807b163acd0888be0385dea820da46e4dbb44d2e462c734b83a473fed1364273159257cc259a8c5676c1c76d41d56b9907ec1c3599c9e8907403a27a705e3619b04b0ad046e8ec8169c17b460d44c0c0c4464d044c946186bc725965083a892bcc495c0540311ff9b3e5192c303d88f8ba46a901c782ef02388f1b2addab6a5350fc3639700e3154337337e4a178d351cd2b56ee1f0bfea34aacfa33d2ec791e50752d4d034cb1c951572caaa5c4d90947b6b175a6dd3c62a77bb8f7ac9ae24719b53c2b120a2876986e217b72bd7cee44a7265b11cee1ab2261762b31a3738386969c0825fb79452e652e1142fc73c9df6fba411795b4717922b29ba2d53abe5a8c0dcc1601b096c96d7938fd5a68a8797c7b9477a86a472eb5da250cb2fec318d83c8f43bbe8e11c35e377d349366c85c4382597f6fc27a0051c0fb00b02c01ca20f9a427f172599477ca690cc1327e0f025f80ec338a80a159e308c12a27db1a7e1b960a99d37dfc22872e51930f28c651ab221f53abaee20bad9a3eabcbab913251bf135beb29617b5754333c4daadb2238341c2ad9378186280f6449440b784ba78f5dac44d8f65b3b7421950397c3913a2dd23ec6d1cb717b36a5fc95af191e278296948c1254ea86b4ec004b94c29450111191823b3514c9ac1ea3d9825ccb86393a2dfb04654fa2192d37bfad1c497c6502eee5ca80a73bfce0baf5a54a88585a401397a3d232f426a7afb082bc21a44317090eaac7592c2ea88a653c4491ea193931335f52e989a3c4cc56d9c553732d57c470fb41ab759b65d2d04445382fcd9c4e344a1128fa9e11e04358e192ed014b23232a7ee2b22e23717f44111ee33575399c37646da9813ec9b212afe94e5dc5c2330a7294cc1f4234a6d3fbb4f1685ab8892c04acb17cd1c170d7b0611b6a7176c794cc8c67f55fc923c2ad203100f365991882c30243d77813843b5ec7c964032263706092ecf00c7516be64e4598ca4226c069bb5e67e4175cf2286c8dd5c488a6c5861f31baa0bd0269470e8b551dd3bcd38c86c12f9cdb176c77dc8b6c02a701f478902c8553f694c0d82727b4c4a5c2c1041212aa1274808b82111b377ec75214e9b1978f76004d4139d98613f4b8e98d20af7b534073a509a959b7a7564f9b40ca218bf61829320a8502017954d328d7ac6c769ec29700756e7b0685b340d5e118059504a49a9a50a10198eb10a5784678eb427d7b4babb9552933b062897973e1318eaf0a0eac37584a65401b1703e042accd837531483f241cadcd1c1d378119e694429db199ac891e4c5343757085bb3ae783667350c4458d97672e861e80b1d2679510ea3a6f2360c77a46942c7a06a554d228080c84b47aef14db17620cb16c06ab30a1be4cda7082be9f87e9c211c46916349a5ba8eaa5201c7294a3c0885b53b657452108825ec646c90a04612324ee7d031afe5343132cbef67b6efb1a5ec2809b773538ce77b3d8b04eb0b3c2256011e4c716c19a8ba0752bf71492117649f0615c3290fc29a46fde4bd52db9286d603388244259c15a7ac2b640a60cc03376a5841a3fb8a473568fa9b1a267215f34c01697b0f0e627175d72105b7707c29b9e614bdc33a6f6c818a95370b427882d7b476796a9ec6eb993274cd9b2391a82ba45e3393d2e9ae9721ca9d6c1b988b5827713f90a6585de9433528c02b03ce10bb5f720138d0fbb4c30c1266b918e52925dfe17b37f95d22bca54f475919ac859098c0f0d08ac5875ef29b56fd141e6ef15f700a0b66f39595c588177373c4669b21bc071e4c3aa5f0b4a31b6258f35da24ac3cd29c7f2092410c5078355b138fb53a6b9ae6e0b9c08243e7baa45c47376eb8c7f13d4cf51aa736fa31540c9241f370da544bf9f9c28d9a57e2f2a7ca95a4e4b466e641ab3bcc76adf1139d567a6f12b52f3a65e7ec0aae26bcaa8c55833b04e59998ebc9a1930fbb6d2233c53d2c1f8b9518e3c2de73a19dee6b380a5b32971cf64e129fd6c1fa6e75d4a234501e966dd3a540af5c8f4f34a6b4a253ee28492566d5e67c6f55855fcb0506fb06c156744d9a03a31a26fa94cad14f157b7f303d07a69c773768fcb4d079c09059703a0c3a94de4b99ea3a2f16583d0f9170a3950db07b4f0bc30802927f9f7961b6259892636a9502a2705303637799dd344da451c1cf7bf67840ceb3079ab8c6b8c1927f64053c612450c45c9e603bc16666e596b3471e103b6f15447424d17022048111ffbd37e1c670f64f14b8a7b32b94c1a49b45dd2fc38cd5289d910ad63602cf5e13042c64ac6797b89fb551ad08e05a92d200cccb7e712ef23c9312cb350f029ab537e287347fd3075ac10906a783f1c6c07ccb88f41228c4be1c640f790b5c3a5d5d3ca792495d74bc461562658c07ac600276b924ab5bc9be1f0494cb76f82f460a7480972663381e169996061d799859ec54d4f5ca5c411c01db1597b165977669de13a928a34afbac258fea8c4764239c9421dc3119bf5b47699206978327b1c5345ef746a7983841f056e2534100ab24d4e9abbd0b17c6a95bd4c3c0e40f69e1612aceeb28b99086c95116e7204273893390bf46b899b36286b0ebf1947bb9884f732ca27da82b19b5dc0cc7f8885714910888b2310c4f9319d410b34e6433b9003e2176bb995257456106e8952163b8ba592530cc5aa0aeb43ad398fe9e97baa523d7a4431677c3d3af0719e475db85ca95af5089beabeb05b2faab4896ba60f81c88472a57b46a828826a0cdfb446f8189182d2bf5eac4ec1cc5deaf599c8a13e48235406d17ffddc8344b6c66984a868aa92fa02227a086950eb0c8701ed58dc628776b983882e117561349e5c131a7e116a0463861d7d18663c5627c38c7147ddaadfd48acd7a4535202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
+Key = ML-KEM-1024-RFC-Both
+PKCS8 = 30820cbe020100300b060960864801650304040304820caa30820ca60440000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f04820c60f77b7f6b15c73fe2cc546b67fb774ca19b42cd463ea9fbb984ca477a77b6c71087cbf051abe4736a9072c6e870c8311c55963f500a3c7b1b8f2a58558f49c62527b6c594b5e7acb3bcf597273a5743517d151208bd4aa61e75ba67b0bd594a994919627ac0a804d489e171336bc339f4666706e5134412b366823d50318c8bf261ab120a28a04fec01cc15f2b71912cee54aa8eed854694b6ba886b5eb7661e6d56aac213cc1d814d592b395554fae74476d34371163129bf864527250606cc21a53746b20997077bba155733b28a4e7fa0776399524763eb481ceaa11366c3474a04685f40c3f08b0424f40bff949a0ac92704c3ba0c6eb36f1f5b621d8bf2b6327beb57cd3facb94186fe3fc9ab0a1434bb291d2c9bb70723057e2254059656f565919a32cf74579de89681cd2c5a935a52b4aaa2d24cb5d5c9e20729ec5492ec36961efb8a28cbc00ac303523295f3d8036abc1603307ce70d7848a35657a5687dd589927ea63731626abb26ec4e431b8eb6b3b0bc1e82573ee73b1a021183183528108ae2eacaddb95b464a0b98469c319cc27bfa01bc31054a68c05502b1662b879fe98a1711c3426f6436cb0214cea379ac3a7e5fb60184a37c1da1eda61c6c39c1dd4e847845811f2a358a43731528536d4a3291b04158c2c3dc641624882678bc7805f58a9d94c7104567846a2044e65aece2a225372b6024799a5477d60237504aa5c0ac57bc70a3558c08c4de687ef1302b4fcb5594413d22cb959bc31be423450403c6bc57dc411b3fefac1052ac4bb162c44545a4ca80892657fa13a0b2c482ced629cc4999d969c593d4aadf073cc3e3a458e78a8aa039408e652be93b20c8b42ec5b0e50239dac726052851a6d15312ec39ed208b72209a577c6b2770112895749d5260e7dd446c0b0118c1000be6801d2611fcf00792a9cc4f4b49922f9a2d4b9c8fa5a5d0d60506631a7e971cee840b08fa63c13729d7ea5aac70352a984cdb669331cba758fe87ec3931b3e3161fcc747aa749424689feae14bf7c9a2ffba1302b212b80372d8e9049db69a3a1261d0a2859a9b4d57899e0ba41607a1b67a7c0e12923689f8c6395377d970c7490a4129611a1d05c3b7813bed945420723f7f9525a87793fafbbfca982e66bb80681c83248a89da084c19882f48f31e7fc09093a49e9fd09691b021edf463afc519b62853816118346115fb0b882cc6482f3c5cbcc1c1894697e1239598b34b2a9a7acd15244d0690c88194097a9beda585e87c437124624c210768e6215d376482653eb89947877c118d370c696a6ffcc1018ae413a08a8d0ffaa819945da7a167c229913290cad1c80a369258762610ea253e62dc24226a30c892c12136c326f13f4446664712b0b90bc063b4028593cbde06cdc22289e240c7e296b59172c1aeda8c99e0512d1a0163a942ea33148e6937c026029424b81b996b1df22ea0623ec65c6bf093500cf3bf35374adc392035ca7c583b99685bca541a0807b163acd0888be0385dea820da46e4dbb44d2e462c734b83a473fed1364273159257cc259a8c5676c1c76d41d56b9907ec1c3599c9e8907403a27a705e3619b04b0ad046e8ec8169c17b460d44c0c0c4464d044c946186bc725965083a892bcc495c0540311ff9b3e5192c303d88f8ba46a901c782ef02388f1b2addab6a5350fc3639700e3154337337e4a178d351cd2b56ee1f0bfea34aacfa33d2ec791e50752d4d034cb1c951572caaa5c4d90947b6b175a6dd3c62a77bb8f7ac9ae24719b53c2b120a2876986e217b72bd7cee44a7265b11cee1ab2261762b31a3738386969c0825fb79452e652e1142fc73c9df6fba411795b4717922b29ba2d53abe5a8c0dcc1601b096c96d7938fd5a68a8797c7b9477a86a472eb5da250cb2fec318d83c8f43bbe8e11c35e377d349366c85c4382597f6fc27a0051c0fb00b02c01ca20f9a427f172599477ca690cc1327e0f025f80ec338a80a159e308c12a27db1a7e1b960a99d37dfc22872e51930f28c651ab221f53abaee20bad9a3eabcbab913251bf135beb29617b5754333c4daadb2238341c2ad9378186280f6449440b784ba78f5dac44d8f65b3b7421950397c3913a2dd23ec6d1cb717b36a5fc95af191e278296948c1254ea86b4ec004b94c29450111191823b3514c9ac1ea3d9825ccb86393a2dfb04654fa2192d37bfad1c497c6502eee5ca80a73bfce0baf5a54a88585a401397a3d232f426a7afb082bc21a44317090eaac7592c2ea88a653c4491ea193931335f52e989a3c4cc56d9c553732d57c470fb41ab759b65d2d04445382fcd9c4e344a1128fa9e11e04358e192ed014b23232a7ee2b22e23717f44111ee33575399c37646da9813ec9b212afe94e5dc5c2330a7294cc1f4234a6d3fbb4f1685ab8892c04acb17cd1c170d7b0611b6a7176c794cc8c67f55fc923c2ad203100f365991882c30243d77813843b5ec7c964032263706092ecf00c7516be64e4598ca4226c069bb5e67e4175cf2286c8dd5c488a6c5861f31baa0bd0269470e8b551dd3bcd38c86c12f9cdb176c77dc8b6c02a701f478902c8553f694c0d82727b4c4a5c2c1041212aa1274808b82111b377ec75214e9b1978f76004d4139d98613f4b8e98d20af7b534073a509a959b7a7564f9b40ca218bf61829320a8502017954d328d7ac6c769ec29700756e7b0685b340d5e118059504a49a9a50a10198eb10a5784678eb427d7b4babb9552933b062897973e1318eaf0a0eac37584a65401b1703e042accd837531483f241cadcd1c1d378119e694429db199ac891e4c5343757085bb3ae783667350c4458d97672e861e80b1d2679510ea3a6f2360c77a46942c7a06a554d228080c84b47aef14db17620cb16c06ab30a1be4cda7082be9f87e9c211c46916349a5ba8eaa5201c7294a3c0885b53b657452108825ec646c90a04612324ee7d031afe5343132cbef67b6efb1a5ec2809b773538ce77b3d8b04eb0b3c2256011e4c716c19a8ba0752bf71492117649f0615c3290fc29a46fde4bd52db9286d603388244259c15a7ac2b640a60cc03376a5841a3fb8a473568fa9b1a267215f34c01697b0f0e627175d72105b7707c29b9e614bdc33a6f6c818a95370b427882d7b476796a9ec6eb993274cd9b2391a82ba45e3393d2e9ae9721ca9d6c1b988b5827713f90a6585de9433528c02b03ce10bb5f720138d0fbb4c30c1266b918e52925dfe17b37f95d22bca54f475919ac859098c0f0d08ac5875ef29b56fd141e6ef15f700a0b66f39595c588177373c4669b21bc071e4c3aa5f0b4a31b6258f35da24ac3cd29c7f2092410c5078355b138fb53a6b9ae6e0b9c08243e7baa45c47376eb8c7f13d4cf51aa736fa31540c9241f370da544bf9f9c28d9a57e2f2a7ca95a4e4b466e641ab3bcc76adf1139d567a6f12b52f3a65e7ec0aae26bcaa8c55833b04e59998ebc9a1930fbb6d2233c53d2c1f8b9518e3c2de73a19dee6b380a5b32971cf64e129fd6c1fa6e75d4a234501e966dd3a540af5c8f4f34a6b4a253ee28492566d5e67c6f55855fcb0506fb06c156744d9a03a31a26fa94cad14f157b7f303d07a69c773768fcb4d079c09059703a0c3a94de4b99ea3a2f16583d0f9170a3950db07b4f0bc30802927f9f7961b6259892636a9502a2705303637799dd344da451c1cf7bf67840ceb3079ab8c6b8c1927f64053c612450c45c9e603bc16666e596b3471e103b6f15447424d17022048111ffbd37e1c670f64f14b8a7b32b94c1a49b45dd2fc38cd5289d910ad63602cf5e13042c64ac6797b89fb551ad08e05a92d200cccb7e712ef23c9312cb350f029ab537e287347fd3075ac10906a783f1c6c07ccb88f41228c4be1c640f790b5c3a5d5d3ca792495d74bc461562658c07ac600276b924ab5bc9be1f0494cb76f82f460a7480972663381e169996061d799859ec54d4f5ca5c411c01db1597b165977669de13a928a34afbac258fea8c4764239c9421dc3119bf5b47699206978327b1c5345ef746a7983841f056e2534100ab24d4e9abbd0b17c6a95bd4c3c0e40f69e1612aceeb28b99086c95116e7204273893390bf46b899b36286b0ebf1947bb9884f732ca27da82b19b5dc0cc7f8885714910888b2310c4f9319d410b34e6433b9003e2176bb995257456106e8952163b8ba592530cc5aa0aeb43ad398fe9e97baa523d7a4431677c3d3af0719e475db85ca95af5089beabeb05b2faab4896ba60f81c88472a57b46a828826a0cdfb446f8189182d2bf5eac4ec1cc5deaf599c8a13e48235406d17ffddc8344b6c66984a868aa92fa02227a086950eb0c8701ed58dc628776b983882e117561349e5c131a7e116a0463861d7d18663c5627c38c7147ddaadfd48acd7a4535202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f
 Error = PRIVATE_KEY_WAS_NOT_SEED
 
-PublicKey = ML-KEM-1024-RFC-Public
+EncapsulateDecapsulate = ML-KEM-1024-RFC/Private
 Algorithm = ML-KEM-1024
-Input = 30820632300b060960864801650304040303820621004b94c29450111191823b3514c9ac1ea3d9825ccb86393a2dfb04654fa2192d37bfad1c497c6502eee5ca80a73bfce0baf5a54a88585a401397a3d232f426a7afb082bc21a44317090eaac7592c2ea88a653c4491ea193931335f52e989a3c4cc56d9c553732d57c470fb41ab759b65d2d04445382fcd9c4e344a1128fa9e11e04358e192ed014b23232a7ee2b22e23717f44111ee33575399c37646da9813ec9b212afe94e5dc5c2330a7294cc1f4234a6d3fbb4f1685ab8892c04acb17cd1c170d7b0611b6a7176c794cc8c67f55fc923c2ad203100f365991882c30243d77813843b5ec7c964032263706092ecf00c7516be64e4598ca4226c069bb5e67e4175cf2286c8dd5c488a6c5861f31baa0bd0269470e8b551dd3bcd38c86c12f9cdb176c77dc8b6c02a701f478902c8553f694c0d82727b4c4a5c2c1041212aa1274808b82111b377ec75214e9b1978f76004d4139d98613f4b8e98d20af7b534073a509a959b7a7564f9b40ca218bf61829320a8502017954d328d7ac6c769ec29700756e7b0685b340d5e118059504a49a9a50a10198eb10a5784678eb427d7b4babb9552933b062897973e1318eaf0a0eac37584a65401b1703e042accd837531483f241cadcd1c1d378119e694429db199ac891e4c5343757085bb3ae783667350c4458d97672e861e80b1d2679510ea3a6f2360c77a46942c7a06a554d228080c84b47aef14db17620cb16c06ab30a1be4cda7082be9f87e9c211c46916349a5ba8eaa5201c7294a3c0885b53b657452108825ec646c90a04612324ee7d031afe5343132cbef67b6efb1a5ec2809b773538ce77b3d8b04eb0b3c2256011e4c716c19a8ba0752bf71492117649f0615c3290fc29a46fde4bd52db9286d603388244259c15a7ac2b640a60cc03376a5841a3fb8a473568fa9b1a267215f34c01697b0f0e627175d72105b7707c29b9e614bdc33a6f6c818a95370b427882d7b476796a9ec6eb993274cd9b2391a82ba45e3393d2e9ae9721ca9d6c1b988b5827713f90a6585de9433528c02b03ce10bb5f720138d0fbb4c30c1266b918e52925dfe17b37f95d22bca54f475919ac859098c0f0d08ac5875ef29b56fd141e6ef15f700a0b66f39595c588177373c4669b21bc071e4c3aa5f0b4a31b6258f35da24ac3cd29c7f2092410c5078355b138fb53a6b9ae6e0b9c08243e7baa45c47376eb8c7f13d4cf51aa736fa31540c9241f370da544bf9f9c28d9a57e2f2a7ca95a4e4b466e641ab3bcc76adf1139d567a6f12b52f3a65e7ec0aae26bcaa8c55833b04e59998ebc9a1930fbb6d2233c53d2c1f8b9518e3c2de73a19dee6b380a5b32971cf64e129fd6c1fa6e75d4a234501e966dd3a540af5c8f4f34a6b4a253ee28492566d5e67c6f55855fcb0506fb06c156744d9a03a31a26fa94cad14f157b7f303d07a69c773768fcb4d079c09059703a0c3a94de4b99ea3a2f16583d0f9170a3950db07b4f0bc30802927f9f7961b6259892636a9502a2705303637799dd344da451c1cf7bf67840ceb3079ab8c6b8c1927f64053c612450c45c9e603bc16666e596b3471e103b6f15447424d17022048111ffbd37e1c670f64f14b8a7b32b94c1a49b45dd2fc38cd5289d910ad63602cf5e13042c64ac6797b89fb551ad08e05a92d200cccb7e712ef23c9312cb350f029ab537e287347fd3075ac10906a783f1c6c07ccb88f41228c4be1c640f790b5c3a5d5d3ca792495d74bc461562658c07ac600276b924ab5bc9be1f0494cb76f82f460a7480972663381e169996061d799859ec54d4f5ca5c411c01db1597b165977669de13a928a34afbac258fea8c4764239c9421dc3119bf5b47699206978327b1c5345ef746a7983841f056e2534100ab24d4e9abbd0b17c6a95bd4c3c0e40f69e1612aceeb28b99086c95116e7204273893390bf46b899b36286b0ebf1947bb9884f732ca27da82b19b5dc0cc7f8885714910888b2310c4f9319d410b34e6433b9003e2176bb995257456106e8952163b8ba592530cc5aa0aeb43ad398fe9e97baa523d7a4431677c3d3af0719e475db85ca95af5089beabeb05b2faab4896ba60f81c88472a57b46a828826a0cdfb446f8189182d2bf5eac4ec1cc5deaf599c8a13e48235406d17ffddc8344b6c66984a868aa92fa02227a086950eb0c8701ed58dc628776b983882e1175
-Bits = 12544
-RawPublic = 4b94c29450111191823b3514c9ac1ea3d9825ccb86393a2dfb04654fa2192d37bfad1c497c6502eee5ca80a73bfce0baf5a54a88585a401397a3d232f426a7afb082bc21a44317090eaac7592c2ea88a653c4491ea193931335f52e989a3c4cc56d9c553732d57c470fb41ab759b65d2d04445382fcd9c4e344a1128fa9e11e04358e192ed014b23232a7ee2b22e23717f44111ee33575399c37646da9813ec9b212afe94e5dc5c2330a7294cc1f4234a6d3fbb4f1685ab8892c04acb17cd1c170d7b0611b6a7176c794cc8c67f55fc923c2ad203100f365991882c30243d77813843b5ec7c964032263706092ecf00c7516be64e4598ca4226c069bb5e67e4175cf2286c8dd5c488a6c5861f31baa0bd0269470e8b551dd3bcd38c86c12f9cdb176c77dc8b6c02a701f478902c8553f694c0d82727b4c4a5c2c1041212aa1274808b82111b377ec75214e9b1978f76004d4139d98613f4b8e98d20af7b534073a509a959b7a7564f9b40ca218bf61829320a8502017954d328d7ac6c769ec29700756e7b0685b340d5e118059504a49a9a50a10198eb10a5784678eb427d7b4babb9552933b062897973e1318eaf0a0eac37584a65401b1703e042accd837531483f241cadcd1c1d378119e694429db199ac891e4c5343757085bb3ae783667350c4458d97672e861e80b1d2679510ea3a6f2360c77a46942c7a06a554d228080c84b47aef14db17620cb16c06ab30a1be4cda7082be9f87e9c211c46916349a5ba8eaa5201c7294a3c0885b53b657452108825ec646c90a04612324ee7d031afe5343132cbef67b6efb1a5ec2809b773538ce77b3d8b04eb0b3c2256011e4c716c19a8ba0752bf71492117649f0615c3290fc29a46fde4bd52db9286d603388244259c15a7ac2b640a60cc03376a5841a3fb8a473568fa9b1a267215f34c01697b0f0e627175d72105b7707c29b9e614bdc33a6f6c818a95370b427882d7b476796a9ec6eb993274cd9b2391a82ba45e3393d2e9ae9721ca9d6c1b988b5827713f90a6585de9433528c02b03ce10bb5f720138d0fbb4c30c1266b918e52925dfe17b37f95d22bca54f475919ac859098c0f0d08ac5875ef29b56fd141e6ef15f700a0b66f39595c588177373c4669b21bc071e4c3aa5f0b4a31b6258f35da24ac3cd29c7f2092410c5078355b138fb53a6b9ae6e0b9c08243e7baa45c47376eb8c7f13d4cf51aa736fa31540c9241f370da544bf9f9c28d9a57e2f2a7ca95a4e4b466e641ab3bcc76adf1139d567a6f12b52f3a65e7ec0aae26bcaa8c55833b04e59998ebc9a1930fbb6d2233c53d2c1f8b9518e3c2de73a19dee6b380a5b32971cf64e129fd6c1fa6e75d4a234501e966dd3a540af5c8f4f34a6b4a253ee28492566d5e67c6f55855fcb0506fb06c156744d9a03a31a26fa94cad14f157b7f303d07a69c773768fcb4d079c09059703a0c3a94de4b99ea3a2f16583d0f9170a3950db07b4f0bc30802927f9f7961b6259892636a9502a2705303637799dd344da451c1cf7bf67840ceb3079ab8c6b8c1927f64053c612450c45c9e603bc16666e596b3471e103b6f15447424d17022048111ffbd37e1c670f64f14b8a7b32b94c1a49b45dd2fc38cd5289d910ad63602cf5e13042c64ac6797b89fb551ad08e05a92d200cccb7e712ef23c9312cb350f029ab537e287347fd3075ac10906a783f1c6c07ccb88f41228c4be1c640f790b5c3a5d5d3ca792495d74bc461562658c07ac600276b924ab5bc9be1f0494cb76f82f460a7480972663381e169996061d799859ec54d4f5ca5c411c01db1597b165977669de13a928a34afbac258fea8c4764239c9421dc3119bf5b47699206978327b1c5345ef746a7983841f056e2534100ab24d4e9abbd0b17c6a95bd4c3c0e40f69e1612aceeb28b99086c95116e7204273893390bf46b899b36286b0ebf1947bb9884f732ca27da82b19b5dc0cc7f8885714910888b2310c4f9319d410b34e6433b9003e2176bb995257456106e8952163b8ba592530cc5aa0aeb43ad398fe9e97baa523d7a4431677c3d3af0719e475db85ca95af5089beabeb05b2faab4896ba60f81c88472a57b46a828826a0cdfb446f8189182d2bf5eac4ec1cc5deaf599c8a13e48235406d17ffddc8344b6c66984a868aa92fa02227a086950eb0c8701ed58dc628776b983882e1175
 
-Encapsulate = ML-KEM-1024-RFC-Public
+Encapsulate = ML-KEM-1024-RFC
 Algorithm = ML-KEM-1024
 
 # Some test vectors from Wycheproof, to test the EVP API.
@@ -63,130 +53,146 @@
 # TODO(crbug.com/42290453): Once we've caught up with Wycheproof, consider
 # moving Wycheproof tests to the EVP layer and replacing these.
 
-PrivateKeyFromSeed = ML-KEM-768-PrivateSeed
-Algorithm = ML-KEM-768
-Input = 7c9935a0b07694aa0c6d10e4db6b1add2fd81a25ccb148032dcd739936737f2d8626ed79d451140800e03b59b956f8210e556067407d13dc90fa9e8b872bfb8f
-
-PublicKeyFromRaw = ML-KEM-768-Public
+Key = ML-KEM-768-Wycheproof
 Algorithm = ML-KEM-768
-Input = a8e651a1e685f22478a8954f007bc7711b930772c78f092e82878e3e937f367967532913a8d53dfdf4bfb1f8846746596705cf345142b972a3f16325c40c2952a37b25897e5ef35fbaeb73a4acbeb6a0b89942ceb195531cfc0a07993954483e6cbc87c06aa74ff0cac5207e535b260aa98d1198c07da605c4d11020f6c9f7bb68bb3456c73a01b710bc99d17739a51716aa01660c8b628b2f5602ba65f07ea993336e896e83f2c5731bbf03460c5b6c8afecb748ee391e98934a2c57d4d069f50d88b30d6966f38c37bc649b82634ce7722645ccd625063364646d6d699db57b45eb67465e16de4d406a818b9eae1ca916a2594489708a43cea88b02a4c03d09b44815c97101caf5048bbcb247ae2366cdc254ba22129f45b3b0eb399ca91a303402830ec01db7b2ca480cf350409b216094b7b0c3ae33ce10a9124e89651ab901ea253c8415bd7825f02bb229369af972028f22875ea55af16d3bc69f70c2ee8b75f28b47dd391f989ade314729c331fa04c1917b278c3eb602868512821adc825c64577ce1e63b1d9644a612948a3483c7f1b9a258000e30196944a403627609c76c7ea6b5de01764d24379117b9ea29848dc555c454bceae1ba5cc72c74ab96b9c91b910d26b88b25639d4778ae26c7c6151a19c6cd7938454372465e4c5ec29245acb3db5379de3dabfa629a7c04a8353a8530c95acb732bb4bb81932bb2ca7a848cd366801444abe23c83b366a87d6a3cf360924c002bae90af65c48060b3752f2badf1ab2722072554a5059753594e6a702761fc97684c8c4a7540a6b07fbc9de87c974aa8809d928c7f4cbbf8045aea5bc667825fd05a521f1a4bf539210c7113bc37b3e58b0cbfc53c841cbb0371de2e511b989cb7c70c023366d78f9c37ef047f8720be1c759a8d96b93f65a94114ffaf60d9a81795e995c71152a4691a5a602a9e1f3599e37c768c7bc108994c0669f3adc957d46b4b6256968e290d7892ea85464ee7a750f39c5e3152c2dfc56d8b0c924ba8a959a68096547f66423c838982a5794b9e1533771331a9a656c28828beb9126a60e95e8c5d906832c7710705576b1fb9507269ddaf8c95ce9719b2ca8dd112be10bcc9f4a37bd1b1eeeb33ecda76ae9f69a5d4b2923a86957671d619335be1c4c2c77ce87c41f98a8cc466460fa300aaf5b301f0a1d09c88e65da4d8ee64f68c02189bbb3584baff716c85db654048a004333489393a07427cd3e217e6a345f6c2c2b13c27b337271c0b27b2dbaa00d237600b5b594e8cf2dd625ea76cf0ed899122c9796b4b0187004258049a477cd11d68c49b9a0e7b00bce8cac7864cbb375140084744c93062694ca795c4f40e7acc9c5a1884072d8c38dafb501ee4184dd5a819ec24ec1651261f962b17a7215aa4a748c15836c389137678204838d7195a85b4f98a1b574c4cd7909cd1f833effd1485543229d3748d9b5cd6c17b9b3b84aef8bce13e683733659c79542d615782a71cdeee792bab51bdc4bbfe8308e663144ede8491830ad98b4634f64aba8b9c042272653920f380c1a17ca87ced7aac41c82888793181a6f76e197b7b90ef90943bb3844912911d8551e5466c5767ab0bc61a1a3f736162ec098a900b12dd8fabbfb3fe8cb1dc4e8315f2af0d32f0017ae136e19f028
+SPKI = 308204b2300b0609608648016503040402038204a100a8e651a1e685f22478a8954f007bc7711b930772c78f092e82878e3e937f367967532913a8d53dfdf4bfb1f8846746596705cf345142b972a3f16325c40c2952a37b25897e5ef35fbaeb73a4acbeb6a0b89942ceb195531cfc0a07993954483e6cbc87c06aa74ff0cac5207e535b260aa98d1198c07da605c4d11020f6c9f7bb68bb3456c73a01b710bc99d17739a51716aa01660c8b628b2f5602ba65f07ea993336e896e83f2c5731bbf03460c5b6c8afecb748ee391e98934a2c57d4d069f50d88b30d6966f38c37bc649b82634ce7722645ccd625063364646d6d699db57b45eb67465e16de4d406a818b9eae1ca916a2594489708a43cea88b02a4c03d09b44815c97101caf5048bbcb247ae2366cdc254ba22129f45b3b0eb399ca91a303402830ec01db7b2ca480cf350409b216094b7b0c3ae33ce10a9124e89651ab901ea253c8415bd7825f02bb229369af972028f22875ea55af16d3bc69f70c2ee8b75f28b47dd391f989ade314729c331fa04c1917b278c3eb602868512821adc825c64577ce1e63b1d9644a612948a3483c7f1b9a258000e30196944a403627609c76c7ea6b5de01764d24379117b9ea29848dc555c454bceae1ba5cc72c74ab96b9c91b910d26b88b25639d4778ae26c7c6151a19c6cd7938454372465e4c5ec29245acb3db5379de3dabfa629a7c04a8353a8530c95acb732bb4bb81932bb2ca7a848cd366801444abe23c83b366a87d6a3cf360924c002bae90af65c48060b3752f2badf1ab2722072554a5059753594e6a702761fc97684c8c4a7540a6b07fbc9de87c974aa8809d928c7f4cbbf8045aea5bc667825fd05a521f1a4bf539210c7113bc37b3e58b0cbfc53c841cbb0371de2e511b989cb7c70c023366d78f9c37ef047f8720be1c759a8d96b93f65a94114ffaf60d9a81795e995c71152a4691a5a602a9e1f3599e37c768c7bc108994c0669f3adc957d46b4b6256968e290d7892ea85464ee7a750f39c5e3152c2dfc56d8b0c924ba8a959a68096547f66423c838982a5794b9e1533771331a9a656c28828beb9126a60e95e8c5d906832c7710705576b1fb9507269ddaf8c95ce9719b2ca8dd112be10bcc9f4a37bd1b1eeeb33ecda76ae9f69a5d4b2923a86957671d619335be1c4c2c77ce87c41f98a8cc466460fa300aaf5b301f0a1d09c88e65da4d8ee64f68c02189bbb3584baff716c85db654048a004333489393a07427cd3e217e6a345f6c2c2b13c27b337271c0b27b2dbaa00d237600b5b594e8cf2dd625ea76cf0ed899122c9796b4b0187004258049a477cd11d68c49b9a0e7b00bce8cac7864cbb375140084744c93062694ca795c4f40e7acc9c5a1884072d8c38dafb501ee4184dd5a819ec24ec1651261f962b17a7215aa4a748c15836c389137678204838d7195a85b4f98a1b574c4cd7909cd1f833effd1485543229d3748d9b5cd6c17b9b3b84aef8bce13e683733659c79542d615782a71cdeee792bab51bdc4bbfe8308e663144ede8491830ad98b4634f64aba8b9c042272653920f380c1a17ca87ced7aac41c82888793181a6f76e197b7b90ef90943bb3844912911d8551e5466c5767ab0bc61a1a3f736162ec098a900b12dd8fabbfb3fe8cb1dc4e8315f2af0d32f0017ae136e19f028
+PKCS8 = 3054020100300b0609608648016503040402044280407c9935a0b07694aa0c6d10e4db6b1add2fd81a25ccb148032dcd739936737f2d8626ed79d451140800e03b59b956f8210e556067407d13dc90fa9e8b872bfb8f
+RawPublic = a8e651a1e685f22478a8954f007bc7711b930772c78f092e82878e3e937f367967532913a8d53dfdf4bfb1f8846746596705cf345142b972a3f16325c40c2952a37b25897e5ef35fbaeb73a4acbeb6a0b89942ceb195531cfc0a07993954483e6cbc87c06aa74ff0cac5207e535b260aa98d1198c07da605c4d11020f6c9f7bb68bb3456c73a01b710bc99d17739a51716aa01660c8b628b2f5602ba65f07ea993336e896e83f2c5731bbf03460c5b6c8afecb748ee391e98934a2c57d4d069f50d88b30d6966f38c37bc649b82634ce7722645ccd625063364646d6d699db57b45eb67465e16de4d406a818b9eae1ca916a2594489708a43cea88b02a4c03d09b44815c97101caf5048bbcb247ae2366cdc254ba22129f45b3b0eb399ca91a303402830ec01db7b2ca480cf350409b216094b7b0c3ae33ce10a9124e89651ab901ea253c8415bd7825f02bb229369af972028f22875ea55af16d3bc69f70c2ee8b75f28b47dd391f989ade314729c331fa04c1917b278c3eb602868512821adc825c64577ce1e63b1d9644a612948a3483c7f1b9a258000e30196944a403627609c76c7ea6b5de01764d24379117b9ea29848dc555c454bceae1ba5cc72c74ab96b9c91b910d26b88b25639d4778ae26c7c6151a19c6cd7938454372465e4c5ec29245acb3db5379de3dabfa629a7c04a8353a8530c95acb732bb4bb81932bb2ca7a848cd366801444abe23c83b366a87d6a3cf360924c002bae90af65c48060b3752f2badf1ab2722072554a5059753594e6a702761fc97684c8c4a7540a6b07fbc9de87c974aa8809d928c7f4cbbf8045aea5bc667825fd05a521f1a4bf539210c7113bc37b3e58b0cbfc53c841cbb0371de2e511b989cb7c70c023366d78f9c37ef047f8720be1c759a8d96b93f65a94114ffaf60d9a81795e995c71152a4691a5a602a9e1f3599e37c768c7bc108994c0669f3adc957d46b4b6256968e290d7892ea85464ee7a750f39c5e3152c2dfc56d8b0c924ba8a959a68096547f66423c838982a5794b9e1533771331a9a656c28828beb9126a60e95e8c5d906832c7710705576b1fb9507269ddaf8c95ce9719b2ca8dd112be10bcc9f4a37bd1b1eeeb33ecda76ae9f69a5d4b2923a86957671d619335be1c4c2c77ce87c41f98a8cc466460fa300aaf5b301f0a1d09c88e65da4d8ee64f68c02189bbb3584baff716c85db654048a004333489393a07427cd3e217e6a345f6c2c2b13c27b337271c0b27b2dbaa00d237600b5b594e8cf2dd625ea76cf0ed899122c9796b4b0187004258049a477cd11d68c49b9a0e7b00bce8cac7864cbb375140084744c93062694ca795c4f40e7acc9c5a1884072d8c38dafb501ee4184dd5a819ec24ec1651261f962b17a7215aa4a748c15836c389137678204838d7195a85b4f98a1b574c4cd7909cd1f833effd1485543229d3748d9b5cd6c17b9b3b84aef8bce13e683733659c79542d615782a71cdeee792bab51bdc4bbfe8308e663144ede8491830ad98b4634f64aba8b9c042272653920f380c1a17ca87ced7aac41c82888793181a6f76e197b7b90ef90943bb3844912911d8551e5466c5767ab0bc61a1a3f736162ec098a900b12dd8fabbfb3fe8cb1dc4e8315f2af0d32f0017ae136e19f028
+PrivateSeed = 7c9935a0b07694aa0c6d10e4db6b1add2fd81a25ccb148032dcd739936737f2d8626ed79d451140800e03b59b956f8210e556067407d13dc90fa9e8b872bfb8f
 
-EncapsulateDecapsulate = ML-KEM-768-PrivateSeed
+EncapsulateDecapsulate = ML-KEM-768-Wycheproof/Private
 Algorithm = ML-KEM-768
 
-Encapsulate = ML-KEM-768-Public
+Encapsulate = ML-KEM-768-Wycheproof
 Algorithm = ML-KEM-768
 
-Decapsulate = ML-KEM-768-PrivateSeed
+Decapsulate = ML-KEM-768-Wycheproof/Private
 Algorithm = ML-KEM-768
 Input = c8391085b8d3ea9794212541b2914f08964d33521d3f67ad66096ebfb1f706424b49558f755b5625bae236f2e0079601c766f7d960808f7e2bb0c7a5e066ed346de628f8c57eebabbb0c22d911548463693ef3ce52a53f7ff415f00e657ae1c5a48fa5ec6e4be5cf462daffc84d2f6d5ff55dc9bbe8bb0d725ec64fd4cd4bd8dba0a844e8b5ce4b6a28934d7f7a050991fe185b506b451dabfad52d52cb2114ca7d9a5cf986c8fdc1bc10ec0c1869e50c03c55a76192a1049aca636ba9020bdaa8d0f58c763b0b89845ca06d4c4ddc21433e16b9c62e44871fdbc05ba218af871fdd7dcfa464e60faa5265264ce1391bd9a8c5faa7626d5f159b9805b975710a3503a0b858a11c6a647cc0e19ac88b1be9056c95b4d2087d0951d1d2f4992491117e6347794ba54571ec49bba71af3413d38a30bf5872248d1f6d07c86baf782e73d2637f043d341a00921857d8b21ddf3e1d6310036ed27af49e5de1b900fe4de79808ff29f9570859612b15adc01fbb265b305b1e3a12ae419da5b74261fa284c101da3d8dca8b2e4521aca571ef44a058e844ff32b16d5aaea05f7f3af8e2ab16222e347662eddfb891d0ecc2a55c5638f9dde92d9a3d544a5f901ac501acd1ea6a010201fcb10ad702c425a94bdf5890d500a2a147eee1d1fcba8c3abe7c2dfe70f346f033d816a0b2791b4f0b2d956d9ee5971715399a5688302495e2e07c1c8c01527184bcd0c208bc159f2e13318c0bb3dd24a6a7fc849f83385ed4dba07fe1d7bd5640cc9ed5ccfdd68763cb0d0edf61b292177fc1d2d3c11dd0495056bcb12558aebcfddef9feb4aebc57afd9023c65cfe65a24e33f1b00111e92e63e011eaf0b212cf95743cd07f5189ece1f205b7f6fcb2e6b1961b5404cebe47c8cd13b8599d5b49e6d87eeda36e9b8fc4c00635896aa2b75896e336d1b612ee13db811e1f07e61748d920f4865f3f11741399dc6162c91ca168a02329dff821d58198712dd558abb099b3a0baf9da1b730b2aa73bcf58d74f357b06f7211c804b6c8af16ff3509fad1d35b14bfdced7db8a6a25c48e5956480724daa057cd660b67ee3e472574182679d485838a6476eac02141075c812af7967ba7c9185cc2abd2a4545b80f3d3104d58d654a57792dcfabbe9c0715e8de2ef81ef404c8168fd7a43efab3d448e686a088efd26a26159948926723d7eccc39e3c1b719cf8becb7be7e964f22cd8cb1b7e25e800ea97d60a64cc0bbd9cb407a3ab9f88f5e29169eeafd4e0322fde6590ae093ce8feeae98b622caa7556ff426c9e7a404ce69355830a7a67767a76c7d9a97b84bfcf50a02f75c235d2f9c671138049ffc7c8055926c03eb3fb87f9695185a42eca9a41655873d30a6b3bf428b246223484a8ff61ee3eeafff10e99c2c13a76284d063e56ab711a35a85b5383df81da23490f66e8ea3fcba067f5530c6541c2b8f74717c35023e7b9b3956c3ee2ff84ba03ccf4b4b5321b9240895481bc6d63c1693c1847852f8e97f50a133532ac3ee1e52d464
 Output = e7184a0975ee3470878d2d159ec83129c8aec253d4ee17b4810311d198cd0368
 
-PrivateKeyFromSeed = ML-KEM-1024-PrivateSeed
-Algorithm = ML-KEM-1024
-Input = 7c9935a0b07694aa0c6d10e4db6b1add2fd81a25ccb148032dcd739936737f2d8626ed79d451140800e03b59b956f8210e556067407d13dc90fa9e8b872bfb8f
-
-PublicKeyFromRaw = ML-KEM-1024-Public
+Key = ML-KEM-1024-Wycheproof
 Algorithm = ML-KEM-1024
-Input = 537911957c125148a87f41589cb222d0d19229e2cb55e1a044791e7ca61192a46460c3183d2bcd6de08a5e7651603acc349ca16cba18abb23a3e8c330d7421598a6278ec7ebfabca0ef488b2290554753499c0452e453815309955b8150fa1a1e393386dc12fdb27b38c6745f2944016ec457f39b18d604a07a1abe07bc844050ffa8a06fa154a49d88fac775452d6a7c0e589bfb5c370c2c4b6201dda80c9ab2076ecc08b44522fda3326f033806dd2693f319739f40c4f42b24aca7098fb8ff5f9ac20292d02b56ac746801acccc84863dee32878497b69438bf991776286650482c8d9d9587bc6a55b85c4d7fa74d02656b421c9e23e03a48d4b74425c26e4a20dd9562a4da0793f3a352ccc0f18217d868c7f5002abe768b1fc73f05744e7cc28f10344062c10e08eccced3c1f7d392c01d979dd718d8398374665a16a9870585c39d5589a50e133389c9b9a276c024260d9fc7711c81b6337b57da3c376d0cd74e14c73727b276656b9d8a4eb71896ff589d4b893e7110f3bb948ece291dd86c0b7468a678c746980c12aa6b95e2b0cbe4331bb24a33a270153aa472c47312382ca365c5f35259d025746fc6595fe636c767510a69c1e8a176b7949958f2697399497a2fc7364a12c8198295239c826cb5082086077282ed628651fc04c639b438522a9de309b14b086d6e923c551623bd72a733cb0dabc54a9416a99e72c9fda1cb3fb9ba06b8adb2422d68cadc553c98202a17656478ac044ef3456378abce9991e0141ba79094fa8f77a300805d2d32ffc62bf0ca4554c330c2bb7042db35102f68b1a0062583865381c74dd913af70b26cf0923d0c4cb971692222552a8f4b788b4afd1341a9df415cf203900f5ccf7f65988949a75580d049639853100854b21f4018003502bb1ba95f556a5d67c7eb52410eba288a6d0635ca8a4f6d696d0a020c826938d34943c3808c79cc007768533216bc1b29da6c812eff3340baa8d2e65344f09bd47894f5a3a4118715b3c5020679327f9189f7e10856b238bb9b0ab4ca85abf4b21f5c76bccd71850b22e045928276a0f2e951db0707c6a116dc19113fa762dc5f20bd5d2ab5be71744dc9cbdb51ea757963aac56a90a0d8023bed1f5cae8a64da047279b353a096a835b0b2b023b6aa048989233079aeb467e522fa27a5822921e5c551b4f537536e46f3a6a97e72c3b063104e09a040598940d872f6d871f5ef9b4355073b54769e45454e6a0819599408621ab4413b35507b0df578ce2d511d52058d5749df38b29d6cc58870caf92f69a75161406e71c5ff92451a77522b8b2967a2d58a49a81661aa65ac09b08c9fe45abc3851f99c730c45003aca2bf0f8424a19b7408a537d541c16f5682bfe3a7faea564f1298611a7f5f60922ba19de73b1917f1853273555199a649318b50773345c997460856972acb43fc81ab6321b1c33c2bb5098bd489d696a0f70679c1213873d08bdad42844927216047205633212310ee9a06cb10016c805503c341a36d87e56072eabe23731e34af7e2328f85cdb370ccaf00515b64c9c54bc837578447aacfaed5969aa351e7da4efa7b115c4c51f4a699779850295ca72d781ad41bc680532b89e710e2189eb3c50817ba255c7474c95ca9110cc43b8ba8e682c7fb7b0fdc265c0483a65ca4514ee4b832aac5800c3b08e74f563951c1fbb210353efa1aa866856bc1e034733b0485dab1d020c6bf765ff60b3b801984a90c2fe970bf1de97004a6cf44b4984ab58258b4af71221cd17530a700c32959c9436344b5316f09ccca7029a230d639dcb022d8ba79ba91cd6ab12ae1579c50c7bb10e30301a65cae3101d40c7ba927bb553148d1647024d4a06c8166d0b0b81269b7d5f4b34fb022f69152f514004a7c685368552343bb60360fbb9945edf446d345bdcaa7455c74ba0a551e184620fef97688773d50b6433ca7a7ac5cb6b7f671a15376e5a6747a623fa7bc6630373f5b1b512690a661377870a60a7a189683f9b0cf0466e1f750762631c4ab09f505c42dd28633569472735442851e321616d4009810777b6bd46fa7224461a5cc27405dfbac0d39b002cab33433f2a86eb8ce91c134a6386f860a1994eb4b6875a46d195581d173854b53d2293df3e9a822756cd8f212b325ca29b4f9f8cfbadf2e41869abfbad10738ad04cc752bc20c394746850e0c4847db
+SPKI = 30820632300b06096086480165030404030382062100537911957c125148a87f41589cb222d0d19229e2cb55e1a044791e7ca61192a46460c3183d2bcd6de08a5e7651603acc349ca16cba18abb23a3e8c330d7421598a6278ec7ebfabca0ef488b2290554753499c0452e453815309955b8150fa1a1e393386dc12fdb27b38c6745f2944016ec457f39b18d604a07a1abe07bc844050ffa8a06fa154a49d88fac775452d6a7c0e589bfb5c370c2c4b6201dda80c9ab2076ecc08b44522fda3326f033806dd2693f319739f40c4f42b24aca7098fb8ff5f9ac20292d02b56ac746801acccc84863dee32878497b69438bf991776286650482c8d9d9587bc6a55b85c4d7fa74d02656b421c9e23e03a48d4b74425c26e4a20dd9562a4da0793f3a352ccc0f18217d868c7f5002abe768b1fc73f05744e7cc28f10344062c10e08eccced3c1f7d392c01d979dd718d8398374665a16a9870585c39d5589a50e133389c9b9a276c024260d9fc7711c81b6337b57da3c376d0cd74e14c73727b276656b9d8a4eb71896ff589d4b893e7110f3bb948ece291dd86c0b7468a678c746980c12aa6b95e2b0cbe4331bb24a33a270153aa472c47312382ca365c5f35259d025746fc6595fe636c767510a69c1e8a176b7949958f2697399497a2fc7364a12c8198295239c826cb5082086077282ed628651fc04c639b438522a9de309b14b086d6e923c551623bd72a733cb0dabc54a9416a99e72c9fda1cb3fb9ba06b8adb2422d68cadc553c98202a17656478ac044ef3456378abce9991e0141ba79094fa8f77a300805d2d32ffc62bf0ca4554c330c2bb7042db35102f68b1a0062583865381c74dd913af70b26cf0923d0c4cb971692222552a8f4b788b4afd1341a9df415cf203900f5ccf7f65988949a75580d049639853100854b21f4018003502bb1ba95f556a5d67c7eb52410eba288a6d0635ca8a4f6d696d0a020c826938d34943c3808c79cc007768533216bc1b29da6c812eff3340baa8d2e65344f09bd47894f5a3a4118715b3c5020679327f9189f7e10856b238bb9b0ab4ca85abf4b21f5c76bccd71850b22e045928276a0f2e951db0707c6a116dc19113fa762dc5f20bd5d2ab5be71744dc9cbdb51ea757963aac56a90a0d8023bed1f5cae8a64da047279b353a096a835b0b2b023b6aa048989233079aeb467e522fa27a5822921e5c551b4f537536e46f3a6a97e72c3b063104e09a040598940d872f6d871f5ef9b4355073b54769e45454e6a0819599408621ab4413b35507b0df578ce2d511d52058d5749df38b29d6cc58870caf92f69a75161406e71c5ff92451a77522b8b2967a2d58a49a81661aa65ac09b08c9fe45abc3851f99c730c45003aca2bf0f8424a19b7408a537d541c16f5682bfe3a7faea564f1298611a7f5f60922ba19de73b1917f1853273555199a649318b50773345c997460856972acb43fc81ab6321b1c33c2bb5098bd489d696a0f70679c1213873d08bdad42844927216047205633212310ee9a06cb10016c805503c341a36d87e56072eabe23731e34af7e2328f85cdb370ccaf00515b64c9c54bc837578447aacfaed5969aa351e7da4efa7b115c4c51f4a699779850295ca72d781ad41bc680532b89e710e2189eb3c50817ba255c7474c95ca9110cc43b8ba8e682c7fb7b0fdc265c0483a65ca4514ee4b832aac5800c3b08e74f563951c1fbb210353efa1aa866856bc1e034733b0485dab1d020c6bf765ff60b3b801984a90c2fe970bf1de97004a6cf44b4984ab58258b4af71221cd17530a700c32959c9436344b5316f09ccca7029a230d639dcb022d8ba79ba91cd6ab12ae1579c50c7bb10e30301a65cae3101d40c7ba927bb553148d1647024d4a06c8166d0b0b81269b7d5f4b34fb022f69152f514004a7c685368552343bb60360fbb9945edf446d345bdcaa7455c74ba0a551e184620fef97688773d50b6433ca7a7ac5cb6b7f671a15376e5a6747a623fa7bc6630373f5b1b512690a661377870a60a7a189683f9b0cf0466e1f750762631c4ab09f505c42dd28633569472735442851e321616d4009810777b6bd46fa7224461a5cc27405dfbac0d39b002cab33433f2a86eb8ce91c134a6386f860a1994eb4b6875a46d195581d173854b53d2293df3e9a822756cd8f212b325ca29b4f9f8cfbadf2e41869abfbad10738ad04cc752bc20c394746850e0c4847db
+PKCS8 = 3054020100300b0609608648016503040403044280407c9935a0b07694aa0c6d10e4db6b1add2fd81a25ccb148032dcd739936737f2d8626ed79d451140800e03b59b956f8210e556067407d13dc90fa9e8b872bfb8f
+RawPublic = 537911957c125148a87f41589cb222d0d19229e2cb55e1a044791e7ca61192a46460c3183d2bcd6de08a5e7651603acc349ca16cba18abb23a3e8c330d7421598a6278ec7ebfabca0ef488b2290554753499c0452e453815309955b8150fa1a1e393386dc12fdb27b38c6745f2944016ec457f39b18d604a07a1abe07bc844050ffa8a06fa154a49d88fac775452d6a7c0e589bfb5c370c2c4b6201dda80c9ab2076ecc08b44522fda3326f033806dd2693f319739f40c4f42b24aca7098fb8ff5f9ac20292d02b56ac746801acccc84863dee32878497b69438bf991776286650482c8d9d9587bc6a55b85c4d7fa74d02656b421c9e23e03a48d4b74425c26e4a20dd9562a4da0793f3a352ccc0f18217d868c7f5002abe768b1fc73f05744e7cc28f10344062c10e08eccced3c1f7d392c01d979dd718d8398374665a16a9870585c39d5589a50e133389c9b9a276c024260d9fc7711c81b6337b57da3c376d0cd74e14c73727b276656b9d8a4eb71896ff589d4b893e7110f3bb948ece291dd86c0b7468a678c746980c12aa6b95e2b0cbe4331bb24a33a270153aa472c47312382ca365c5f35259d025746fc6595fe636c767510a69c1e8a176b7949958f2697399497a2fc7364a12c8198295239c826cb5082086077282ed628651fc04c639b438522a9de309b14b086d6e923c551623bd72a733cb0dabc54a9416a99e72c9fda1cb3fb9ba06b8adb2422d68cadc553c98202a17656478ac044ef3456378abce9991e0141ba79094fa8f77a300805d2d32ffc62bf0ca4554c330c2bb7042db35102f68b1a0062583865381c74dd913af70b26cf0923d0c4cb971692222552a8f4b788b4afd1341a9df415cf203900f5ccf7f65988949a75580d049639853100854b21f4018003502bb1ba95f556a5d67c7eb52410eba288a6d0635ca8a4f6d696d0a020c826938d34943c3808c79cc007768533216bc1b29da6c812eff3340baa8d2e65344f09bd47894f5a3a4118715b3c5020679327f9189f7e10856b238bb9b0ab4ca85abf4b21f5c76bccd71850b22e045928276a0f2e951db0707c6a116dc19113fa762dc5f20bd5d2ab5be71744dc9cbdb51ea757963aac56a90a0d8023bed1f5cae8a64da047279b353a096a835b0b2b023b6aa048989233079aeb467e522fa27a5822921e5c551b4f537536e46f3a6a97e72c3b063104e09a040598940d872f6d871f5ef9b4355073b54769e45454e6a0819599408621ab4413b35507b0df578ce2d511d52058d5749df38b29d6cc58870caf92f69a75161406e71c5ff92451a77522b8b2967a2d58a49a81661aa65ac09b08c9fe45abc3851f99c730c45003aca2bf0f8424a19b7408a537d541c16f5682bfe3a7faea564f1298611a7f5f60922ba19de73b1917f1853273555199a649318b50773345c997460856972acb43fc81ab6321b1c33c2bb5098bd489d696a0f70679c1213873d08bdad42844927216047205633212310ee9a06cb10016c805503c341a36d87e56072eabe23731e34af7e2328f85cdb370ccaf00515b64c9c54bc837578447aacfaed5969aa351e7da4efa7b115c4c51f4a699779850295ca72d781ad41bc680532b89e710e2189eb3c50817ba255c7474c95ca9110cc43b8ba8e682c7fb7b0fdc265c0483a65ca4514ee4b832aac5800c3b08e74f563951c1fbb210353efa1aa866856bc1e034733b0485dab1d020c6bf765ff60b3b801984a90c2fe970bf1de97004a6cf44b4984ab58258b4af71221cd17530a700c32959c9436344b5316f09ccca7029a230d639dcb022d8ba79ba91cd6ab12ae1579c50c7bb10e30301a65cae3101d40c7ba927bb553148d1647024d4a06c8166d0b0b81269b7d5f4b34fb022f69152f514004a7c685368552343bb60360fbb9945edf446d345bdcaa7455c74ba0a551e184620fef97688773d50b6433ca7a7ac5cb6b7f671a15376e5a6747a623fa7bc6630373f5b1b512690a661377870a60a7a189683f9b0cf0466e1f750762631c4ab09f505c42dd28633569472735442851e321616d4009810777b6bd46fa7224461a5cc27405dfbac0d39b002cab33433f2a86eb8ce91c134a6386f860a1994eb4b6875a46d195581d173854b53d2293df3e9a822756cd8f212b325ca29b4f9f8cfbadf2e41869abfbad10738ad04cc752bc20c394746850e0c4847db
+PrivateSeed = 7c9935a0b07694aa0c6d10e4db6b1add2fd81a25ccb148032dcd739936737f2d8626ed79d451140800e03b59b956f8210e556067407d13dc90fa9e8b872bfb8f
 
-EncapsulateDecapsulate = ML-KEM-1024-PrivateSeed
+EncapsulateDecapsulate = ML-KEM-1024-Wycheproof/Private
 Algorithm = ML-KEM-1024
 
-Encapsulate = ML-KEM-1024-Public
+Encapsulate = ML-KEM-1024-Wycheproof
 Algorithm = ML-KEM-1024
 
-Decapsulate = ML-KEM-1024-PrivateSeed
+Decapsulate = ML-KEM-1024-Wycheproof/Private
 Algorithm = ML-KEM-1024
 Input = c9bead6b0c1114389bd4761c73ab9095b5809daac9f659bb564af226173052a4a3e7f2e5fd47d2b02aaeb5189e06b9f4ae98b619cb63efbdf3989a94b36e8ea0d700633b950a0ae2a78ed92e85c85c70e13e626fb263fac9681521c3ab22fdab29173c9616a2b037083ff7b2e019b5bcde068fac257ef8f12798411693c1bdcc65420997a513a8a69502620be8e4ce7362e412a76cf51c1f2433f1ab64ce0e5d2f56d7c9ade994d0e35d0aeef3ac515b482437664d8c1d25e5a5507cf80f970d3ea7226aacdc457cbf88a0560aa35bb2c5c455867e2159910a35810befe3aa10eb04d8d57147cb8f66d2b070bac43d1f1ffdd57a9399951f64965727bcb9f66ad42309dafc799c1c540af1af93eff68a86d61f5115db662dee7ac9a362677762b6a164a0fa0a4d859e4b8c8dbdb4e183f5e6808fc52229650caf7cf3e16de3d895d148c35448ab8c2753c9831b24bd4921497eaa192565cabfd83c0c68dfe7d392abf5e5e6f84bb9f5af4b7118c0b558105f9c10c9b6d70682e1de6e0689d7106a6374bd34aed7229e6cb356f2ea65e680ce7b1e2c3704e116a38542826e8a001141baf2e34de37a03040986d4c0cd5d57f0701ce930986fd9525b58e2e59f45b8dd04c0f35b0f47970cc67079618eb9e6d91e9b0f8c6d2e165cf448a2c1ebf71b6537e0f375185dfafef698b6239bb35580b315bcb5ed408c357f192def89bc1b75cdd6aae8b5faf0c3e13803f6bdfa76fb407fcbda790c329b3ee42fd3d3b03bd5003f0bc432f7ba39631112452dfd12140433ff8980eb6a526ba85ef99477378b4dc76635a5cd5040e43b8c1fe4ee5e158e423bfc0c893c1d5613bed08da719c9073184eeb36fd357380fb1873d8cbd36e2255e985b1b76819743a6584a9b3a580996c9c2eed9bbbfff78a6204b5e5eeae5f4efd2660078b37f0754ab5da862e666b145b5f23f3d0977799929dfa2aedda53d152eda1d0d0e4ea43f6ed889bb965eefe0a7c685bb36770eaa874242c0e229cf6ce56defa5aeae64d0c40dda8aa26eaeb31458f070a3bc72e1619ee9b5f642291c56df5b7e43db6c802fc74f4f3f9b5c0d355c3aae520aa31229d12f3e7cc5d48e691191a36b283765f4133f0ff1fe2f01c6648b2798a74eb5d842a248f524a7e7f8974211297b44f0dd19f386e86be6ba782de77fde887226f37a1c77bc5eddeee5bf46b67fb7478d559865f262caa84d64a8ce59e4df0818e14861526acd3483600f3dae7959d35d8181ca6a81ce791be00752da7759446a2cfbe00b8248b93491debd520220b755416d2fc6b7c8af2ff75e5bcbb8e7537380a5721c77484957a69271d8bafce0f166735ff869232de5d381afbf0e44d69172b79a35191949de09703b94222b13c385c6081e6d2ede1e57fe184ef8f60196b9a3a7b7eff7497191ca8741b5a01e79cb69a61142e6f5d080fbb3e566f79e146f75c8a1097860841b4747df604dba954e4a8d9e0dccc1f609d05cf8d31219ecd60c312de684552f09227cb829291c645732c5f5d4d711639f42a23080aa34fe1420f219bd6bcf4e3b29b9d02293b2da81383e0a51d2bb186c7b0a211a0cd63acbfc0210401e985d436b3803d5601c24136afd1562522e45b457cb439178be4a87cce40346d34ae0f3c39103c8a3ebc9c86c8db8fc5561eb0f3a143d4e9fe93a5cba6f6fcae5650d3f43d2668a5956c922893b816647ded0afc052a6c3d9d01a3d3af0f1ba807ff10491e131dc15e165cfd0650a1f2c313d7956141edcc61cb90e9e7abf2fe35fc9dc1bde88939fa11f7bbe3eb4d8ffa643b074d74f45113586e9bb12060003d71941f2da098dc0e96cad3255cf328ea2d3308c1f4585e89c613c426b7e798e1ec4e98fe6c71e7491f5eca0cd05115861bd160e3fe73a58a026ba538e0e256b92f1d7a2497570594856860ffd06b601ac575592f4ac612b5de7866042123ebc60c55768e3a7600a3260551f2bea22bbf6b6c8246e80f9125c4bb9db354dd64ae695c15f5071f4abb9639207cac7331b310f69a05f54b995de529a023f033b055db95287a14ba30a7cc526bb724c417fba290636a996f286e3e9e939e4fe1c398b5c6599959d0b4445a327ec469a1653cfaea7552cecec085ccaa68938ae4ac3c424f7e480439ebd2c992b5f6f95ec244b657dbdeaa9ae110aaf4d68bf4e27410d43ceef3e88e9c717dd44c9ee
 Output = 489dd1e9c2be4af3482bdb35bb26ce760e6e414da6ecbe489985748a825f1cd6
 
 # Private key too short.
-PrivateKeyFromSeed = ML-KEM-768-TooShort
+Key = ML-KEM-768-TooShort
 Algorithm = ML-KEM-768
-Input = 29995944b4ad2c4a8c7120e5c581ba7c3649d309e9427ced8289072599ec98c5fe49ec6c
+PrivateSeed = 29995944b4ad2c4a8c7120e5c581ba7c3649d309e9427ced8289072599ec98c5fe49ec6c
 Error = DECODE_ERROR
 
 # Private key too long.
-PrivateKeyFromSeed = ML-KEM-768-TooLong
+Key = ML-KEM-768-TooLong
 Algorithm = ML-KEM-768
-Input = d043e3d89f9a514f84ceb3f94da9546126191bd98f2533223c07ed0a3b671ba09135c35b80d71fd7554fd765b6f64fd0ac5dcc17091af1744ff3644964c24c74f9d25ad95745e5e2be
+PrivateSeed = d043e3d89f9a514f84ceb3f94da9546126191bd98f2533223c07ed0a3b671ba09135c35b80d71fd7554fd765b6f64fd0ac5dcc17091af1744ff3644964c24c74f9d25ad95745e5e2be
 Error = DECODE_ERROR
 
 # Ciphertext too short.
-PrivateKeyFromSeed = ML-KEM-768-CiphertextTooShort
+Key = ML-KEM-768-CiphertextTooShort
 Algorithm = ML-KEM-768
-Input = 315e34ebf153d056813c44e761dd584e914c1f72910d933807ef9f098bac325f5b1d97adc2a4395c7463f9014d55b3b32b640fe4d851a83a8a94c7ced7681759
+SPKI = 308204b2300b0609608648016503040402038204a100b0d90de9e68d7b0c230476383e08c088ab678fda01a46384082a58759b09c6e450e91835cb195dac51bf8d6cc091b70f6731599649983be9c9d6674ffa90487a85005526844da5c6f4f11c85e95cd5fab29f34693e776fcf28705ad80afb93c1358b20fa536b2d5a3894c472aa88a79f75a88ad10435048faad36431d7aba5d3230573873bf34dcb7807a958bbf50592980ab659fc0e53cb45c2734347087ab0f8976a8598efe50b69610ada1ba2d6a68244276b365c957bd6262af84c3a911c9d4b639432b59fb81547b9ac6b127174c537e986088e225b2f054a0eac88b4f1bd7da3398d3327fd33a408081e9832b2fd11c8b8b03376c232fc99c8c971018c46949f2aaed32072357a91cb3469bdd9cf8e05327dec1ade345a8964834ec60606f0ad3e4b4df8221003d97893e60b6b2622c86b418a4cb41e865d341780b2b25ca8f25e802506a8d86b30c93477e83763d4687a214cff3c947ac62ce7b51e25553886a8529ab10134bc5e98dc4a171255d41cb2d6497d2924ae138466b8c62dd68ca2b00471335cc842839470b19301ec6c49c013820898e41459ff2610de74b858a019fdc8a8a1109575db7bf710cc04d10c87a97ad6158049a755b1f52751a4120e65645e2c8dc0666b0dc10e92f187f4333a38b25794f4549443bbc0f83d835c10b51b62fb58a502a0bbdb956cc6d90403761d6cdb0fa118923c4c6be9e4c89d7173912a98b61814aa1bad4dd52d6702671b4c72a8bb93357c8da8fa125f355d06ea7bd66b6d1c80721a9bcaddf21b7956c4dce867f383263a83a704c733859b88c624bf5ffb9f9dd097fa43ab81b989e97acbba06b5bda5b915c2387b5532bcf4137537362eb9a462557540862bd05c9655626877dc6c47465baa6813ba3336985169d98264d5aa5f778c853789567c304fde0164b05c43d22a5b2b53af03e78522e686f998c0cc7c43463a8ed3832c5bf8169c2ac82b156c40a98c1be8bbadb15655a03b0846c781f483e3640121bc99a595bfe849678d80c5dfe49cf04acd5eb6a901239744dc8ff2584d11a91675893db6b2771beb964a0814dd035c797792b415baa9e20051598d5ab3b3fbdc3d9d9437c53622212abd13d16ecd3743ce48803d0c0d79f82bd7d6c4e06098b3065b71ac51a4dbb43f80beb10a45df510a337462c14bb965e22a18f8872282a99eaac1af52bc467264bae91df50321563102a2bcc2f530994aa199e9067bd674312eec3fd67a8b4ab70358dc54154c5d132b37a15ca4495c36a0854abbc217ebc78d49811e2292c90d1c54c84c0af53641ba7b008ad10b6860ae0d9a998b30874ec1a920d37d0f69bc1c611508130d4b2927d60139ba378f197b88a352207bb9afeff94575c110c7a452d79a6aac11273c17880f246a947c48e8c01e73060a57d2109c846e1473164d90241c0864b8ec94642850f4903cbf5154cbd7bea61b7e4865562486282b881a26b7b707139a53a114989aa1e7526e8c8bc138f9aa5bd5b05bd1340314cd093a24f7b79dad2623b339882e68c226a31fdb7c0d948aa794b854708139e71911feb37fb6005da4b5a0e342794aabb192fc380db2767924ad648854ed2278743c1a3271cf5ef37e9d3ee3591154f83eddb24a5ab063d954a4b9b31ca23e39c87e1bfe19b9897cef
+PKCS8 = 3054020100300b060960864801650304040204428040315e34ebf153d056813c44e761dd584e914c1f72910d933807ef9f098bac325f5b1d97adc2a4395c7463f9014d55b3b32b640fe4d851a83a8a94c7ced7681759
+RawPublic = b0d90de9e68d7b0c230476383e08c088ab678fda01a46384082a58759b09c6e450e91835cb195dac51bf8d6cc091b70f6731599649983be9c9d6674ffa90487a85005526844da5c6f4f11c85e95cd5fab29f34693e776fcf28705ad80afb93c1358b20fa536b2d5a3894c472aa88a79f75a88ad10435048faad36431d7aba5d3230573873bf34dcb7807a958bbf50592980ab659fc0e53cb45c2734347087ab0f8976a8598efe50b69610ada1ba2d6a68244276b365c957bd6262af84c3a911c9d4b639432b59fb81547b9ac6b127174c537e986088e225b2f054a0eac88b4f1bd7da3398d3327fd33a408081e9832b2fd11c8b8b03376c232fc99c8c971018c46949f2aaed32072357a91cb3469bdd9cf8e05327dec1ade345a8964834ec60606f0ad3e4b4df8221003d97893e60b6b2622c86b418a4cb41e865d341780b2b25ca8f25e802506a8d86b30c93477e83763d4687a214cff3c947ac62ce7b51e25553886a8529ab10134bc5e98dc4a171255d41cb2d6497d2924ae138466b8c62dd68ca2b00471335cc842839470b19301ec6c49c013820898e41459ff2610de74b858a019fdc8a8a1109575db7bf710cc04d10c87a97ad6158049a755b1f52751a4120e65645e2c8dc0666b0dc10e92f187f4333a38b25794f4549443bbc0f83d835c10b51b62fb58a502a0bbdb956cc6d90403761d6cdb0fa118923c4c6be9e4c89d7173912a98b61814aa1bad4dd52d6702671b4c72a8bb93357c8da8fa125f355d06ea7bd66b6d1c80721a9bcaddf21b7956c4dce867f383263a83a704c733859b88c624bf5ffb9f9dd097fa43ab81b989e97acbba06b5bda5b915c2387b5532bcf4137537362eb9a462557540862bd05c9655626877dc6c47465baa6813ba3336985169d98264d5aa5f778c853789567c304fde0164b05c43d22a5b2b53af03e78522e686f998c0cc7c43463a8ed3832c5bf8169c2ac82b156c40a98c1be8bbadb15655a03b0846c781f483e3640121bc99a595bfe849678d80c5dfe49cf04acd5eb6a901239744dc8ff2584d11a91675893db6b2771beb964a0814dd035c797792b415baa9e20051598d5ab3b3fbdc3d9d9437c53622212abd13d16ecd3743ce48803d0c0d79f82bd7d6c4e06098b3065b71ac51a4dbb43f80beb10a45df510a337462c14bb965e22a18f8872282a99eaac1af52bc467264bae91df50321563102a2bcc2f530994aa199e9067bd674312eec3fd67a8b4ab70358dc54154c5d132b37a15ca4495c36a0854abbc217ebc78d49811e2292c90d1c54c84c0af53641ba7b008ad10b6860ae0d9a998b30874ec1a920d37d0f69bc1c611508130d4b2927d60139ba378f197b88a352207bb9afeff94575c110c7a452d79a6aac11273c17880f246a947c48e8c01e73060a57d2109c846e1473164d90241c0864b8ec94642850f4903cbf5154cbd7bea61b7e4865562486282b881a26b7b707139a53a114989aa1e7526e8c8bc138f9aa5bd5b05bd1340314cd093a24f7b79dad2623b339882e68c226a31fdb7c0d948aa794b854708139e71911feb37fb6005da4b5a0e342794aabb192fc380db2767924ad648854ed2278743c1a3271cf5ef37e9d3ee3591154f83eddb24a5ab063d954a4b9b31ca23e39c87e1bfe19b9897cef
+PrivateSeed = 315e34ebf153d056813c44e761dd584e914c1f72910d933807ef9f098bac325f5b1d97adc2a4395c7463f9014d55b3b32b640fe4d851a83a8a94c7ced7681759
 
-Decapsulate = ML-KEM-768-CiphertextTooShort
+Decapsulate = ML-KEM-768-CiphertextTooShort/Private
 Algorithm = ML-KEM-768
 Input = 0f9e66b3
 DecapsulateFail
 
 # Ciphertext too long.
-PrivateKeyFromSeed = ML-KEM-768-CiphertextTooLong
+Key = ML-KEM-768-CiphertextTooLong
 Algorithm = ML-KEM-768
-Input = e0568b5d897629a780311baab0f7213729bc677d89ee198dd20b92310df604ca467788301f7bcb3c00ea82454b1caaca23e58a6a2159b3a967784def2afe75ac
+SPKI = 308204b2300b0609608648016503040402038204a100168134f4d87311957af842b7edf1867d402550e7322740a977ca374c8318d7c44c69267b620818a436930043962066ac99dc861285bb1592ca3e361510e2b92808978b9627b3d9c39b872b7ca4c5a39bafa5993022a24aec365dd5d90d3bb88588457aed0275d583a68ed3c31f0a4c77562f2c0a3c190012096450facb406669a45bda0940c70d4a032d17ec33ee2492581672a4e511ce167e4233758ad27ca34b04fcd533f538b0c153b46bf5a2ea889c8ae21afa970362805fae8906de980b4c06610ef62c562401777a1e32a4726b2560220352d2d8766d6679324053f448bc99e10a9bbb3cd5e59a2dd944b4b55383e786000c84e136afae01803cac3ea3566c6748cbc5d1769cc40b34e6caa75889addba418ba8b7a9506e8b56508bc6586a2ba2135c916a009a915457234972c497b609b34a2fc84f9d19dba912e67a57338ec68a1b7ceec0114bca9760ffb3e8d7a853bfa40132330eb4300e6651edfc154f6dca773763502788501c6b7ff8c6d5fbbaa9cd6bde668c24c349998a5113b84a65fd414b6918227502c1c41ced1ac7a9241416e8c541e21c57b353e61268675ebcd86a45d786005d3cc2c841bc43f5a436ce1902edb7999dc7421324910c620c6732413d9a9be786c26c34148d33d454cb639136bb420c10dcc1ae64b62ec871aa18c041c7793a591b376e6c76754b3318990ca497d373a964c95a0105742b8d6737551357b0c8386ba2093f1646f42a00fb57b0e2b9630f3cad799376775128d12218b16583ab55d92b4bd25e4443651c19d086a7c40c37638691123203cf52f3b1bb990521a14fa0b18392b66210fef186f0f9c7030941e498b94b7e316b16aba8a0aa239ac570de57a17456648ab74c24729ea1a6b96e78abff864e3c447e0e899233b19a7665a32b114c463a8c83b487d25b66a6b180459116ab3b59f3083d8f19dfd25b4035a2d69717f9f533a9989484559b0771942e94000d11a2b13b38c49816ba2bb7a9b77a8e2310ac92709fd96505b861bcdc4362129b0d6cc02a5803cf90b62c2b900e2f0ae34d52ba5734c38e44e3b836102d5b7b81596c97368a5a3951049b26f262f3a352290e915bb3aa0d57c1617e2155b7b7b9ea405992322679a3a2466292aa46be6336375069be43c17f1c390df0c93a208a7ae8b54ece736e05876ba7184bc59a3bf0764df11b86b728aba71a24e2089eeb3710fd41491339b356a7460c15ad743bfe57a6a4e2322517377cef0ac33d88ba0521d6abc5d5a03795bbc788bcc2dc6b405f0933b746959fb815b7f184f96ea543da1a668798c0f5b6b5c98825877a1cfa263dde6ce93dab62151847f2a6c6fe68785e1ca1d7534f19579f70a49501aca7ae85e40916d03e9c20bc7029ca6b68d9b39d1b92860c30c6de235f381af9c057cf04722b4705e85562390f002ba9153bd32ce483c8ea8981ac88ac17d7bb61a6385000768f019256e35b824864c504a8494e09ac5646ceeca57796a18ced21e7075983972afdc51125eb611e9eb6df88b168af983f243c2f7dbb053886cdb087e51a3b0ba8156750b27f1e836b91107b6eb9645411944f00a985c22b23649c71c6fdba786b66803d39953104977a824ae7c7e846c55d050516417922ba25d8aad241ae32e01e970bbd27c82d506bb809e
+PKCS8 = 3054020100300b060960864801650304040204428040e0568b5d897629a780311baab0f7213729bc677d89ee198dd20b92310df604ca467788301f7bcb3c00ea82454b1caaca23e58a6a2159b3a967784def2afe75ac
+RawPublic = 168134f4d87311957af842b7edf1867d402550e7322740a977ca374c8318d7c44c69267b620818a436930043962066ac99dc861285bb1592ca3e361510e2b92808978b9627b3d9c39b872b7ca4c5a39bafa5993022a24aec365dd5d90d3bb88588457aed0275d583a68ed3c31f0a4c77562f2c0a3c190012096450facb406669a45bda0940c70d4a032d17ec33ee2492581672a4e511ce167e4233758ad27ca34b04fcd533f538b0c153b46bf5a2ea889c8ae21afa970362805fae8906de980b4c06610ef62c562401777a1e32a4726b2560220352d2d8766d6679324053f448bc99e10a9bbb3cd5e59a2dd944b4b55383e786000c84e136afae01803cac3ea3566c6748cbc5d1769cc40b34e6caa75889addba418ba8b7a9506e8b56508bc6586a2ba2135c916a009a915457234972c497b609b34a2fc84f9d19dba912e67a57338ec68a1b7ceec0114bca9760ffb3e8d7a853bfa40132330eb4300e6651edfc154f6dca773763502788501c6b7ff8c6d5fbbaa9cd6bde668c24c349998a5113b84a65fd414b6918227502c1c41ced1ac7a9241416e8c541e21c57b353e61268675ebcd86a45d786005d3cc2c841bc43f5a436ce1902edb7999dc7421324910c620c6732413d9a9be786c26c34148d33d454cb639136bb420c10dcc1ae64b62ec871aa18c041c7793a591b376e6c76754b3318990ca497d373a964c95a0105742b8d6737551357b0c8386ba2093f1646f42a00fb57b0e2b9630f3cad799376775128d12218b16583ab55d92b4bd25e4443651c19d086a7c40c37638691123203cf52f3b1bb990521a14fa0b18392b66210fef186f0f9c7030941e498b94b7e316b16aba8a0aa239ac570de57a17456648ab74c24729ea1a6b96e78abff864e3c447e0e899233b19a7665a32b114c463a8c83b487d25b66a6b180459116ab3b59f3083d8f19dfd25b4035a2d69717f9f533a9989484559b0771942e94000d11a2b13b38c49816ba2bb7a9b77a8e2310ac92709fd96505b861bcdc4362129b0d6cc02a5803cf90b62c2b900e2f0ae34d52ba5734c38e44e3b836102d5b7b81596c97368a5a3951049b26f262f3a352290e915bb3aa0d57c1617e2155b7b7b9ea405992322679a3a2466292aa46be6336375069be43c17f1c390df0c93a208a7ae8b54ece736e05876ba7184bc59a3bf0764df11b86b728aba71a24e2089eeb3710fd41491339b356a7460c15ad743bfe57a6a4e2322517377cef0ac33d88ba0521d6abc5d5a03795bbc788bcc2dc6b405f0933b746959fb815b7f184f96ea543da1a668798c0f5b6b5c98825877a1cfa263dde6ce93dab62151847f2a6c6fe68785e1ca1d7534f19579f70a49501aca7ae85e40916d03e9c20bc7029ca6b68d9b39d1b92860c30c6de235f381af9c057cf04722b4705e85562390f002ba9153bd32ce483c8ea8981ac88ac17d7bb61a6385000768f019256e35b824864c504a8494e09ac5646ceeca57796a18ced21e7075983972afdc51125eb611e9eb6df88b168af983f243c2f7dbb053886cdb087e51a3b0ba8156750b27f1e836b91107b6eb9645411944f00a985c22b23649c71c6fdba786b66803d39953104977a824ae7c7e846c55d050516417922ba25d8aad241ae32e01e970bbd27c82d506bb809e
+PrivateSeed = e0568b5d897629a780311baab0f7213729bc677d89ee198dd20b92310df604ca467788301f7bcb3c00ea82454b1caaca23e58a6a2159b3a967784def2afe75ac
 
-Decapsulate = ML-KEM-768-CiphertextTooLong
+Decapsulate = ML-KEM-768-CiphertextTooLong/Private
 Algorithm = ML-KEM-768
 Input = 9ca3e576add6b613dbec8fede58af4cd765a3b48c1f2a5a44167009eb308a0f374a59b53680edcdaaf4685e682dcba21f90f5763cd3e288e46821fa860b0a61bc210e076fecfeae4fd3561576fbac564301b8e06f4881a0020d1626ce121e3ca4713b4615cca24cb5a635dbdd46d31516bbcc9186578515f1447c026052161330407871ee7207465ffa26ea918aec6c4e1461b6f22f9f25c3248b7db701558fb6acc56ada45427657dceef41db71edc4d4da133a68892c3a19755631b97f316c41a43b49c774e076c6cda6f4fc9178007594aac22ed7ba84d6a635336ab34d6a96d1c8687c664a61e82000f4d532453a3ae0a63aaf85cd8b6577bb17bc1fcfebc624d159e7ea5cdaa91c1237cd1556ea255b416aaf4b9b8d327b31788c99ff17d9168752ff3e0cd904bc95e124d532ad6323d302a8d4ad2290548255acb0661055202c33381660da5284c421d60745f51e696a7a22ea4dbaccc4d4c65f28c5566250644879672cae1b87a25695a5890677cc54e0d38d5dbe174f939ce3a31731a96842683a123f826accbc0fe7146b3c1939eff74e28285ff1619d84d5930bb934b38566383c0bddbcfd4fb1f28cee13ebfacf49f1a974a9de836575c0b26e1a7b10404c2d45edb7ec61b81b87aa43431d72100ee6442c23e3aecf8ef6328759850529584479e2e5011b525ca3977334ad9c8480298efbbf5cad025760052c0fe8e2fc777970d35940e0f6e2a085bf0790732a797f95906a001afe693c5c37829213ebf2d0cf321097efdc371423dc1fbbc8671334351d9ddc67035d645acf107d112a4e879c47500b35245b3ae2023f03aa9ff9362563c64d0a9f24c0d71c154be4f04916d6cda598e598860d67a5eb8e38a8be3f813a2aa80962b7bf12ef8b065cadfd737061e122698e4707c48ccd99bad412f8405cfe8cc2ceb499acd461ee5cd16b32efc2d8c8998301e661d9f0ca3599210059f212181cb894a92cd16fa9720181568d612cc34a4a935c8f2714cacf901692e8f7dfc405dca2433599a6ebe9411a509c45c69b402958093af2ab65b735296dc825d703f1c126e3bce99baf408afba37c4216dfc06bddcdf4c7782f7d316020f8cc49def9bda403e8d9baa6b882978137e92f2bf6537d5366e70284f6b3582c192e17e6b01969cfe933bf8863be9d54cf6d990d235150cf1d9ef942e36f9b137b8dfc1351303152c3417c190494215ed8e82ab360bdcb7da4e3ef2e75f5f3590ab5297582c855c3a51b86522c914bb94f4071c6e2d96b8b46efbc05b04d4fb9551b765f0cf8d747385dd0821fb12f5b4a2c6c65e673fb33a13c98c8b1f9f3dccdf1499eaf8c4b2f880f00963ed271a340d156ef792fd902c103fbc1c4aa05c28b6066d2e066491088d653d2dc90eae3c3e554900a1644cc451b6006bfadbbce186823daadfe59ad1dc07cce99ecd2f3f6984d37ddde7a1d0d3a345eb032a1f263effed5f2d1c05ae7cf05209eae2bec4e537c2dbbefb72710299b7cb181b6f7931fd86b4239760c56780f5b86da8587a48874c7f66c13c854ee832875f549c708fd48267a
 DecapsulateFail
 
 # Random ciphertext.
-PrivateKeyFromSeed = ML-KEM-768-RandomCiphertext
+Key = ML-KEM-768-RandomCiphertext
 Algorithm = ML-KEM-768
-Input = 3f6f67ff01382a44c8d5dc52295311a1934f1a10f0ca6085e53af2eb524334881674047e7e7a1649482e1d9b0de92455cd14d0049bdcb7cea4b867ace5c8922b
+SPKI = 308204b2300b0609608648016503040402038204a100a8632ddaa4336e236c2109b41f72a2e9c432541376d90c13ab6c89b15698710169fadc583ddcbe54e239220a212e2998cf52aa264b553acba6341a897d06c929719558d189ffc105e9f0577cb5bd3088ba251797e3c75885c6872a13c43ffa04b8c7082c9646ccc7395d17b5075972f0220dd318977ecab921947dbd3a9f1b7c0ae155c1166384c2aa86f5a018ca8b20fc154d185a94313b2980cb4596786cc128b4c6e55da31ca48a019ed6443b781a91b50b3bfda0adb78ba095783ac73b0ec422272521cf93986ad83a108136ab5f9438b8b19d8442a43be77ef4a1c00c860687e138bb2aaf7cc39cebca70415a7e5770242c1364a672a5db569cc6e0aa50a685aef343c4465b28d55f267b8eaed658df4945d11b96c6dc38e3614b18430a5864b43234819f933bcea4569ecc9f47fa03b0b9585e3282c55c5f4af2ab4b5124325bb89fe0b5a2311e77d9b6b4f5cdc4940f807ac1d8503bb9b3615e82c4ca4255457327f7f734bf3ca188130ce2f4b95ab132d2146437a1921c3875b78ac538f79cabc4cb15dc94d4c89238f3558df2113165baa2e0cff5a889e73a9c1b949aa6b00379db3ca6667f9b0043ccd8b0e0a948cf314405d7253d54cdfab11ed7778f60198c097a46a763161dca044f90716ffa80119a3e5ff229a01b9e78f0176d407fb6329b4b66b8be35b4c5a838f39395aa744690c83b16e382879b7f6117895ec2baa24b7215580165458fab1c21b7661b1f2b92ad73a941873e68d135adf4be7eb9b23ea60908f6c3d0602330e507fc09586945672cb69c5e77806d300f4f472dddd813188280191520db2401b3b1699f7acf35196b95645be7ac4f87fa89b46862470730f1d952272a6b0508c425c97a09d010421463b8938c1f19b401da54a33b27b645aa613c0954980e9f8a161336cb79693ba645af106a7d916ca1cec284e65b2fc461c222b98a927a7643f70f087994b2b1caca0874d234625072aa9081c3dcdc3c77077a836088dc538f7a8aa1b0942c2b19522bcb6122309512059d942a25235206a82c8c10984a7a5790e7dc9e29e7bef8718dea15ba5176a318696ccfeaae6b3bb7ff68977b0588ac8b1a0932009cb029b22059dd6b8b7356b19353922a63b7ea823b8b1346b8723abb57008ed8af968ab77a2485f9a74c47d6ba5e026a20b9914e04196282a02be8a67ce77654341775dc2b5de8b5d92416b83a9d7529b333eb2ee419a83de47a37129a929c72f2b6cde0a51694128724d6bbb6b37a9a06134aab5e09652502e8b1dd16b74ed37da1b28004c33c3c5732059a0d08a5259b82208968bdaa02033ef90aa688b9bb976f0443464b5a0784c49b4e469272097f98928751b78969e81dba80a0627c887d5222a70571cfb385fc8a6bc1368484a7bb86e809b5b14a7c90b68b5cafe353998ae2666de75f3d57cf373438b7822b86b3cdbd3cb80b3b599a372220b52cbe6b57ab7610c7091f2239ad20397cc32b07560b4aa4061249859f5b86458c528acc072a9bb0956f19be82658025a6365f245b505a3ef0d925518c86d3905084519600b4c715034e0a2b309897b288eaa79ad0617a7a9858436a3472caaa9b4b1bb0b10d554f21cc0643f76105f702b0045d9b0b044093bd2f0946d77bdcf6e6e6ac9d0056f390a94f273f14
+PKCS8 = 3054020100300b0609608648016503040402044280403f6f67ff01382a44c8d5dc52295311a1934f1a10f0ca6085e53af2eb524334881674047e7e7a1649482e1d9b0de92455cd14d0049bdcb7cea4b867ace5c8922b
+RawPublic = a8632ddaa4336e236c2109b41f72a2e9c432541376d90c13ab6c89b15698710169fadc583ddcbe54e239220a212e2998cf52aa264b553acba6341a897d06c929719558d189ffc105e9f0577cb5bd3088ba251797e3c75885c6872a13c43ffa04b8c7082c9646ccc7395d17b5075972f0220dd318977ecab921947dbd3a9f1b7c0ae155c1166384c2aa86f5a018ca8b20fc154d185a94313b2980cb4596786cc128b4c6e55da31ca48a019ed6443b781a91b50b3bfda0adb78ba095783ac73b0ec422272521cf93986ad83a108136ab5f9438b8b19d8442a43be77ef4a1c00c860687e138bb2aaf7cc39cebca70415a7e5770242c1364a672a5db569cc6e0aa50a685aef343c4465b28d55f267b8eaed658df4945d11b96c6dc38e3614b18430a5864b43234819f933bcea4569ecc9f47fa03b0b9585e3282c55c5f4af2ab4b5124325bb89fe0b5a2311e77d9b6b4f5cdc4940f807ac1d8503bb9b3615e82c4ca4255457327f7f734bf3ca188130ce2f4b95ab132d2146437a1921c3875b78ac538f79cabc4cb15dc94d4c89238f3558df2113165baa2e0cff5a889e73a9c1b949aa6b00379db3ca6667f9b0043ccd8b0e0a948cf314405d7253d54cdfab11ed7778f60198c097a46a763161dca044f90716ffa80119a3e5ff229a01b9e78f0176d407fb6329b4b66b8be35b4c5a838f39395aa744690c83b16e382879b7f6117895ec2baa24b7215580165458fab1c21b7661b1f2b92ad73a941873e68d135adf4be7eb9b23ea60908f6c3d0602330e507fc09586945672cb69c5e77806d300f4f472dddd813188280191520db2401b3b1699f7acf35196b95645be7ac4f87fa89b46862470730f1d952272a6b0508c425c97a09d010421463b8938c1f19b401da54a33b27b645aa613c0954980e9f8a161336cb79693ba645af106a7d916ca1cec284e65b2fc461c222b98a927a7643f70f087994b2b1caca0874d234625072aa9081c3dcdc3c77077a836088dc538f7a8aa1b0942c2b19522bcb6122309512059d942a25235206a82c8c10984a7a5790e7dc9e29e7bef8718dea15ba5176a318696ccfeaae6b3bb7ff68977b0588ac8b1a0932009cb029b22059dd6b8b7356b19353922a63b7ea823b8b1346b8723abb57008ed8af968ab77a2485f9a74c47d6ba5e026a20b9914e04196282a02be8a67ce77654341775dc2b5de8b5d92416b83a9d7529b333eb2ee419a83de47a37129a929c72f2b6cde0a51694128724d6bbb6b37a9a06134aab5e09652502e8b1dd16b74ed37da1b28004c33c3c5732059a0d08a5259b82208968bdaa02033ef90aa688b9bb976f0443464b5a0784c49b4e469272097f98928751b78969e81dba80a0627c887d5222a70571cfb385fc8a6bc1368484a7bb86e809b5b14a7c90b68b5cafe353998ae2666de75f3d57cf373438b7822b86b3cdbd3cb80b3b599a372220b52cbe6b57ab7610c7091f2239ad20397cc32b07560b4aa4061249859f5b86458c528acc072a9bb0956f19be82658025a6365f245b505a3ef0d925518c86d3905084519600b4c715034e0a2b309897b288eaa79ad0617a7a9858436a3472caaa9b4b1bb0b10d554f21cc0643f76105f702b0045d9b0b044093bd2f0946d77bdcf6e6e6ac9d0056f390a94f273f14
+PrivateSeed = 3f6f67ff01382a44c8d5dc52295311a1934f1a10f0ca6085e53af2eb524334881674047e7e7a1649482e1d9b0de92455cd14d0049bdcb7cea4b867ace5c8922b
 
-EncapsulateDecapsulate = ML-KEM-768-RandomCiphertext
+EncapsulateDecapsulate = ML-KEM-768-RandomCiphertext/Private
 Algorithm = ML-KEM-768
 
-Decapsulate = ML-KEM-768-RandomCiphertext
+Decapsulate = ML-KEM-768-RandomCiphertext/Private
 Algorithm = ML-KEM-768
 Input = 542acf1e3c7dd990f1879ef5b5aebd32055618c4e5b958995f0b22a78f9e2bdd8dd0cda23893c56f48a20d4df878e1cdbd39f50310f2ac0cd502e761329da00d49e7b8721f53af649ef7edfe74f259ffefd492f13b1ac396eb65916e02b3348560ca426e9b93beccad58bcf0c5804f0a10532635fcb74e45c1f8eaa83d56e78d8a7ee5aadcb7e06eddef900b484632bf1bdb0e1a4ef8b6fe34789934d9baa887ec5a39dbc6416f66008751aa193a9c313ef8a57a515bfe046953fa6a1329a770e9e1bfdc33f3a68dbd5cec1c2a55a0e41093583230ac35386645e6dcd166f25706efc779fec0cc4299e8e7501b93a857378713475782cb0b31ab645940f4c875548345ca0138372719c3cf9022034f17c28bb90f6090d4b8be957ec63c297a0ba95dc02f8761c18e7a948c1c20158230e2f9ff809cfd01b9d020b7164f8a3c54a143594d7d35b8e1ad6cb25d96c11c1b7f47f62a8d90c0e2b3d1460b86a463579e7b44ff74b6a29f30521588a26887797c60d86235e0bf4c2bc7166bbeb275996e1f50cfc36641710a52fe08fb5dda30f6129d3a304e336ff0d8698515b2cc450cffb45cceea7ef51a989d036c71367a4d26cd6025479d2f7ae58e700928e176c59b3040b054a09312d9fe529ce784a71513b44c1cd4073209a93a4df73b7097da88cea0b31c3e77e70abcb4b2ba5edd8db8f47ce844750158ddc5609dde43eac393eb5909d9415ee4698d923d8ebc28612f8b0676565010360b9406091ddc881fb6a992b70645b6898d13a8e3e449be589cf17bf9312e5cc58b03d3c181f7f176b67bea210337d6c52913f8cfe145da9426434c1fad0da7911bdb35e68b86b5bc6717dccee9222c4842c28fb13115278f1249b213498791082bab15d32f59481b29b9512945602eeba8af490af99fbb841bd1aead2b4f6f57f19dc970e83bd3928ea2d33ca3c3e50cd5d68e6ef516371cbaecb6b73f57fd5ae5b38a74f20759dcf217066081fee51f0fe8a93aabeab4717f05395e304e86bedbe11d462c1cb9d4e32e75b35fb707e7b509e43b450d6025b2d3e84e00f3d92b717578e820a33788013b2bda42f2701a9c6044ac2082e0387e141bc97a60bac45e0c1f4787bb5b892cb190e4b6776f5139082850494bc5ac56a6f759a0505ed4757009c35a4d36bad276185f1fc75399043168b22cc668a4b1202e03407b9fbb6a0799ba6a396ea78e137f7c68996f18f1636037179c4b920ef68526fc9008aecbfc0a2b02432e2b15832b35a61f438e06ce977c4d447612c13eebd0549edf316f64f5e7f3ccb0b46d19b79d103c1ab8f1551b6b3d22ab75a85660af2a9eab9c734875fef1d526da819829b66d65c8459a1aa404ec83842aa97a595e0271630644ade4df047f06778fe1bd1466bd413279940f15b9b848fae294bf4964286629682abed221e1ede635f315273854d57f68872bd9cb503545ef7b949b36df853eb7a4f47805406555d361aeeec6b77a0b6030b5a124f34cc121a927740aeaa6a381083f4e645b0d
 Output = 0483742b451a5b2364318ed5cc233ce07dbb3fd4ec9386050cb8cf0adc8d41e9
 
 # Private key too short.
-PrivateKeyFromSeed = ML-KEM-1024-TooShort
+Key = ML-KEM-1024-TooShort
 Algorithm = ML-KEM-1024
-Input = 8b29f0f00ae24d62b92412ffdf6a4d848a43a248204f8d36bffca5554231e8d0c26bb09957e5435b4f
+PrivateSeed = 8b29f0f00ae24d62b92412ffdf6a4d848a43a248204f8d36bffca5554231e8d0c26bb09957e5435b4f
 Error = DECODE_ERROR
 
 # Private key too long.
-PrivateKeyFromSeed = ML-KEM-1024-TooLong
+Key = ML-KEM-1024-TooLong
 Algorithm = ML-KEM-1024
-Input = 45d33b266fe58c856ccb161278eae257e2a0196f2a103337eada46d32824ae0c00e5027c6cfd19d6bcfd7aea984d1a80a5585fe59885400d3798f07f2bd1fd30b4a537422c222c4b31cd7177be3e2dbec196ca325ccb40395decb1ffabc7
+PrivateSeed = 45d33b266fe58c856ccb161278eae257e2a0196f2a103337eada46d32824ae0c00e5027c6cfd19d6bcfd7aea984d1a80a5585fe59885400d3798f07f2bd1fd30b4a537422c222c4b31cd7177be3e2dbec196ca325ccb40395decb1ffabc7
 Error = DECODE_ERROR
 
 # Ciphertext too short.
-PrivateKeyFromSeed = ML-KEM-1024-CiphertextTooShort
+Key = ML-KEM-1024-CiphertextTooShort
 Algorithm = ML-KEM-1024
-Input = 9ca76217a0a04543609b209680efa2e6ebc37fb42520dc54805624d4bd1214e07966e4d3196958d2d5a55cfe01bbeab7812bfe7758a0590354f1ff4665289890
+SPKI = 30820632300b06096086480165030404030382062100c05630612cb39e1134796276dcabc6cf45ab908c5af9966e4f2a95f73a5e29f6ab54626bc881511c01844bfc9de74a83629193aa633b415477dc15b368e7c1d7944119826a57818998d57ccdd765668433f81b529c09c7544081cda7034c7840202985cfb9cbe3056331a6535648032e8696644c6773c6209891ac2d291724381a55fb18e8867d968b7b9452764e18877afb95cc8b53b2bb5e949667bfc425f6fc3be7ac61ca32785ddc18bbaa2c89d95acda73d3fe0991064a7c2c0706b813c581b37adf57139e82ec6aa97652b07b9e3c54d656b31e985582819737c939d618246a22443ebbc7f428b45e864943109eb48cb943630d34279a037ab15ba90e3ba572ad91e642698dbe5bb272c22f9731c7f13a17649033ee98101d92a4bd7b95bb76c0863509082727bd7726f865db679262ea52e07f9b3544a3e4ee59ebe12b07eb97aead10441f3911f978a304781a0facb2ce281852a9aaa9a8c9b034fa3159fbb291a89a2965b796045e2c3c3cca0073315c80a90830031a7d9307795cb7fc58360799ed8649dc4f56d498a1bdaf08780059b84f28e9ae338886524a5f7a51f574a314881499ba01911730077b80883709e3904915c19e9e91dafa2932726521b901c78090274d61e5ec5b5f157524837ab7017bcea8c12544cbf9aca58db5b15ebb68ca2117b25659caa088423c7238a322c15cab3273a36c1b60697e3a0ee155d66146caf85a182c2b1fa840f183b8b8e480f644055f7e83da17881dea147538a37fb21a93c6c03d6761999ca7c25804e08e028813a1e72a4ce1643a62b1a40ad79a83cfa9b25e7b33f3977b9f61a2007d02844a9c4298ff45810c53abe6492bf3ae6ced3e4683e28b9e68063fb9a1e3d1920ec78bd68341673659f6bf71381846443e3350b9a3ffffac8f20113d6799ed251b0ee86515579a89448b511b43041b7574509598963333342be0943a0228a2dc87bcc13c3b5b522a2ff0ca5479a02dc433f8792a2e7030f3eb733908a4003ab4ac0b98c97944850349b98da97b9f773c6e900910a52fb3b0cf5e84ff9f5ab6500551f65a6e00565b3f5b68298b32ce904378835c865c93e6b2ca765594848acbbd4bca30027c74bc4950263f0904e316b0313bcb0d4e9262d2257af967437db1a1e079c9fd575c34380e19939fb3c521d2750d200275e886d18c521aee77e146ab43037692ef281b2406c766ac43cca51ade558ad511fada259a02cbb8a75944b7a52977903732c865a2a099efb33a6b453ef656261f9564b22aeefa81f3632cc7ac50dccbaa579c53b7ce06e03b4c62c788b09c321e4500399e42bb0990914500032e12d0151a0e2b0436336a262499359266dcbc814c5e1b159fb002f6279843c1c15d7578ab89d2d0013aaccb844e67a08c5588ea253bbe80d7d495407102eec2a7308918c1d93b015908634fc78dfb1076f277a34811c149c3060d7249271afa49b9e0f9b898019b15e3a0f70e8ad719c09f5c255f81ac801db15f4846adc1207a4677f0693b00c049af50c569dac0dcd9712126a993d92769a6a0e024c5d10d41842d9364491931efc7b3d8308521495c376211bb03089740fc2c48527569c401a625b10400636cda4d03aa3b9af61ab98dca7bf56715f1015c4b8eb53e22b62fe2bb506a73ee1287d3a3824efb38eb6178a4461c379953d02b20f75ca83727a983493bc141a2806d254908a0b88cb1601a62569f0795ee23869f70bb899b4aa5902eaa0b5007905a674763b8763279c885987907fb03d32b0acdc3b6ec458133e383f63d131e196bff158347c0ba077c4c557d7c287a6b0c65a00229857543b432788af1053140a71b1eb51621e0429c67a723324b4c4a44fc11bbcb9513fdbc885c2239288d2197c5501036257a6111e507ab17031cf30a5addc35ba36c3ada2e320b65a9b70043f9438185d334fde896fe0b09d837448ee664f3ed943405772e52cb8ae744a0be75bb97245bab553dab330394c1ab2902c14238b46a750beb3c90f0739052b3c529a21fb03be997bb048b2930620c19eca7bac86a39082bfff3841c6096fb2e51b7fc3b4451319641060b348020847c0dfb582f246924385461dbb6252e541fa91b01388b9df6ba3ad93049ca15fb07ccc8bc50f59ba714de504994692bb76baddab9e76b6fd6df3ebeb541adc36d6c42f464126132436bb9dd7c90b158ad309
+PKCS8 = 3054020100300b0609608648016503040403044280409ca76217a0a04543609b209680efa2e6ebc37fb42520dc54805624d4bd1214e07966e4d3196958d2d5a55cfe01bbeab7812bfe7758a0590354f1ff4665289890
+RawPublic = c05630612cb39e1134796276dcabc6cf45ab908c5af9966e4f2a95f73a5e29f6ab54626bc881511c01844bfc9de74a83629193aa633b415477dc15b368e7c1d7944119826a57818998d57ccdd765668433f81b529c09c7544081cda7034c7840202985cfb9cbe3056331a6535648032e8696644c6773c6209891ac2d291724381a55fb18e8867d968b7b9452764e18877afb95cc8b53b2bb5e949667bfc425f6fc3be7ac61ca32785ddc18bbaa2c89d95acda73d3fe0991064a7c2c0706b813c581b37adf57139e82ec6aa97652b07b9e3c54d656b31e985582819737c939d618246a22443ebbc7f428b45e864943109eb48cb943630d34279a037ab15ba90e3ba572ad91e642698dbe5bb272c22f9731c7f13a17649033ee98101d92a4bd7b95bb76c0863509082727bd7726f865db679262ea52e07f9b3544a3e4ee59ebe12b07eb97aead10441f3911f978a304781a0facb2ce281852a9aaa9a8c9b034fa3159fbb291a89a2965b796045e2c3c3cca0073315c80a90830031a7d9307795cb7fc58360799ed8649dc4f56d498a1bdaf08780059b84f28e9ae338886524a5f7a51f574a314881499ba01911730077b80883709e3904915c19e9e91dafa2932726521b901c78090274d61e5ec5b5f157524837ab7017bcea8c12544cbf9aca58db5b15ebb68ca2117b25659caa088423c7238a322c15cab3273a36c1b60697e3a0ee155d66146caf85a182c2b1fa840f183b8b8e480f644055f7e83da17881dea147538a37fb21a93c6c03d6761999ca7c25804e08e028813a1e72a4ce1643a62b1a40ad79a83cfa9b25e7b33f3977b9f61a2007d02844a9c4298ff45810c53abe6492bf3ae6ced3e4683e28b9e68063fb9a1e3d1920ec78bd68341673659f6bf71381846443e3350b9a3ffffac8f20113d6799ed251b0ee86515579a89448b511b43041b7574509598963333342be0943a0228a2dc87bcc13c3b5b522a2ff0ca5479a02dc433f8792a2e7030f3eb733908a4003ab4ac0b98c97944850349b98da97b9f773c6e900910a52fb3b0cf5e84ff9f5ab6500551f65a6e00565b3f5b68298b32ce904378835c865c93e6b2ca765594848acbbd4bca30027c74bc4950263f0904e316b0313bcb0d4e9262d2257af967437db1a1e079c9fd575c34380e19939fb3c521d2750d200275e886d18c521aee77e146ab43037692ef281b2406c766ac43cca51ade558ad511fada259a02cbb8a75944b7a52977903732c865a2a099efb33a6b453ef656261f9564b22aeefa81f3632cc7ac50dccbaa579c53b7ce06e03b4c62c788b09c321e4500399e42bb0990914500032e12d0151a0e2b0436336a262499359266dcbc814c5e1b159fb002f6279843c1c15d7578ab89d2d0013aaccb844e67a08c5588ea253bbe80d7d495407102eec2a7308918c1d93b015908634fc78dfb1076f277a34811c149c3060d7249271afa49b9e0f9b898019b15e3a0f70e8ad719c09f5c255f81ac801db15f4846adc1207a4677f0693b00c049af50c569dac0dcd9712126a993d92769a6a0e024c5d10d41842d9364491931efc7b3d8308521495c376211bb03089740fc2c48527569c401a625b10400636cda4d03aa3b9af61ab98dca7bf56715f1015c4b8eb53e22b62fe2bb506a73ee1287d3a3824efb38eb6178a4461c379953d02b20f75ca83727a983493bc141a2806d254908a0b88cb1601a62569f0795ee23869f70bb899b4aa5902eaa0b5007905a674763b8763279c885987907fb03d32b0acdc3b6ec458133e383f63d131e196bff158347c0ba077c4c557d7c287a6b0c65a00229857543b432788af1053140a71b1eb51621e0429c67a723324b4c4a44fc11bbcb9513fdbc885c2239288d2197c5501036257a6111e507ab17031cf30a5addc35ba36c3ada2e320b65a9b70043f9438185d334fde896fe0b09d837448ee664f3ed943405772e52cb8ae744a0be75bb97245bab553dab330394c1ab2902c14238b46a750beb3c90f0739052b3c529a21fb03be997bb048b2930620c19eca7bac86a39082bfff3841c6096fb2e51b7fc3b4451319641060b348020847c0dfb582f246924385461dbb6252e541fa91b01388b9df6ba3ad93049ca15fb07ccc8bc50f59ba714de504994692bb76baddab9e76b6fd6df3ebeb541adc36d6c42f464126132436bb9dd7c90b158ad309
+PrivateSeed = 9ca76217a0a04543609b209680efa2e6ebc37fb42520dc54805624d4bd1214e07966e4d3196958d2d5a55cfe01bbeab7812bfe7758a0590354f1ff4665289890
 
-Decapsulate = ML-KEM-1024-CiphertextTooShort
+Decapsulate = ML-KEM-1024-CiphertextTooShort/Private
 Algorithm = ML-KEM-1024
 Input = 26e5ac048cc8cd4708d7ac282eb82fb189d92f6956ea5ef067b4c3a75b0a3d793391861dee5f3b5739e6ed590138bd5c4bcd40cb01c2cbf036505fc061c8abad2a38edcdc41b8c4c0e6517ba28998b2aa29fb26066b0b5031ebd3d09d4ceb070b1801665a1a1bc82ab83b3f27c611a94362173c67bdd904d5bc64c3e2f0434e6e4b8a419ee2e0f8fb1875dfd8aa4b969c0822fd8acdd8cf72d511f5c58bb3047e1b6279c7a9ad92904b50de55650cfb3a747d85063ec415486f8b8486ce4621ee9ab2a22f8efb700d99e569040294f484bfa630aeb786451cfefe0dfd4573440f648d16b1923dc54839b6a47039c57ead8dcee357b7303428e354183468568a2364578067d8971fdd8e366bb7ae56522c1b855b818dc7cc25fe3eb1f3a9a358b8b0a08e53f576e7ce6c67c9e7ab85d9b7bc7281e461f5f1ea045
 DecapsulateFail
 
 # Ciphertext too long.
-PrivateKeyFromSeed = ML-KEM-1024-CiphertextTooLong
+Key = ML-KEM-1024-CiphertextTooLong
 Algorithm = ML-KEM-1024
-Input = b5b5149b95504b1d750ab4aa57cc77ef2bad3cca0d5bfbb73928465098f59fc9958e2432c0093671e5fa460bcbdd34e7894d7aa6a0b4681bcae0f7a0a660d322
+SPKI = 30820632300b06096086480165030404030382062100d1c94244088a30751c1a171da90467c6a4c1fcf4410b596c0c501190e6b290726fff3b0f5306bef81b3aa93281d91b3e3b781aed488ecfe16fa21330fdfc40edc392c2a89a8e4b3ff7745b0ed96d477b22cfc9b15c2ab8ec6176bb1758b7989113e06f4ea443b48c1852868b5e274007e5a00217c3f7966c6f1628cd928a9b3aa15597cc8aa88cb042622474cf5a765630f8c2d64263dde937af2b5cbf1b26f01144710bcf4f952c40b71ced65cd55961e0a70b0b7c00291e3cad83caf56e1515f032f63da02f01872369276cd62c137958dcdb7b0460426fa958665fa6b4eb7cddce52791f5a1aee99bc2588d8d60423ed4805e71715cfbcba4c2185facc836ba8b63406bc0826568a49a0a4ba48cf77b6204bd906a674d6647f3b4a4b7d02777c41eb03432dd5b07b6179af2996fc4a2872f3b6bc56b13adeb7f62d7b12130c7352154da7b47efa82aecd24690d231be43bf88c31cca949da23067ccd5c390447f8fd51ba58a8c54c6b1085923fdf120782443d84996e54ba6323b6535306ff060a1775ba98c905ad9ea7cf8bc6c9fa3475af66e4e42265a7a6049668245c92f42710bfb0944e689190069b8f9daa0287c5b6b961d2614755780aeba8c54db8b93f7467f71a60ef1c130721c31cbb339a813c83f51003f109710301e8e6a906e2b2d2733715ee48bbca5573ce661501b6b77e414730120e687b8476a6147a79fab8752a0bb739a83494b2b0a2641b1b42c813a234e460bbbc58272cc28c58c67515886029ba01320c10fae16030835695d2b4a5180c401e22678383013629069e664c513c6beab870cd41375f9b9c4b9b4f6c15ef3023c72e490b829691cc7489be01592d80d72dba497e30524e68e8b443cc2e45e2372068e9a9572c6bfabd4c901088d9c6b4b986739b220b97739577bf35952e94df1325fe08688a344430a812d33a84855808ffc0224e55491636b7f6f6757f7bc19671c9ad2da132f287a30d5cd52fa982ca7ca80bc52e0b82ba419449c89940451a051762386fb8694fa8a717396c9624bd4aacd662534bd62757e941aa425b4280776d2487deb013fd4d24e0d201a214b419344cffc444a2ee206a7ec07aea8803a9093624270c5c76e0657142d10462b8c8543f40ce49a7a9c5cbc94459c9b583a89acc6f664959c3a90460557fc828912465d34a68de8c655562744ea99962a4119e7f639133ba516d2c6c7248fec08a37ce208e3ec2c2e2266ba8719b5f09d5c10aae1923bee15ccaa4342246219724702cfc0c7a1932da719787810921b62979c1637179b8e47953756e271c3c35adf41246af547cc4c3e77468191060eb4a8c85bf941e439be74e42129b3c7cd54421b0079cfaaa565a6552bab2fd6d61c6c92c7ab06b7abe6130cb65131628e7d665a1cc6bfd2f33dcab0012d05807b431d806176fd41abd10316c25b7431ba3942f51f0c61abb8211268e91d01824a31f5534a143cca46533fea692cf0bf2b1b0d8a904f4387a3a0ea101da0aed2f2969cac1469b8bf83f18e06d59f14c7c3b32c5f6942c3e7ba8207daaac5d45cb579475380203011cf7fcc2135986907269de0f018e17cafc66a0d698346338b422c9a205a14521c5514d2c665ae5bb6c6b607de7c58f2502f356a5a878b9da6306874031f85784c9460782683af064c6238d762e3b02d7cdb839339bf0e13268f68821216b779206d2bfb1db9919f3849844c35be9888bf56824a32c979ccd65cd1f3c61ae8b008a783bd7ab01922004d9463e4ea6d80d4789ab42873e6c507c9121986997c37a1d0f15fdcb441a92701c4d7b12093978381844e7cc71e10b165c7c38ba2acc9826dfaf3ce70904060445e9c50c51707a9d337a49992982f6b8eca0b021cb64efc8babed8a516794b3e6d3ac5713b7235632ec4536f5d21f593b7fc5597a31e242f370112818c6657a6d6a0674c3ac174847b24765c930635814a75507cb510ce19a2d7398362477d5b220fc3aa65fd6be07f1ca83d8cc17ba2587a92365c729eda0a62f500a40a56744f3b921911a4703705a620b11582c61acab5eb7a68028aca150174fe6010e6b2950082ec2cc63fce9a5cd2c3908a02b09a263ec9919d5a3873dcc089a532439a143ed436901da541ef46d604b6a0061c2daf23a292138bf2915861044c9586986fc01fdc38a42d5cad28ed2939b7b4aeba87b0e49e98e3e60e2
+PKCS8 = 3054020100300b060960864801650304040304428040b5b5149b95504b1d750ab4aa57cc77ef2bad3cca0d5bfbb73928465098f59fc9958e2432c0093671e5fa460bcbdd34e7894d7aa6a0b4681bcae0f7a0a660d322
+RawPublic = d1c94244088a30751c1a171da90467c6a4c1fcf4410b596c0c501190e6b290726fff3b0f5306bef81b3aa93281d91b3e3b781aed488ecfe16fa21330fdfc40edc392c2a89a8e4b3ff7745b0ed96d477b22cfc9b15c2ab8ec6176bb1758b7989113e06f4ea443b48c1852868b5e274007e5a00217c3f7966c6f1628cd928a9b3aa15597cc8aa88cb042622474cf5a765630f8c2d64263dde937af2b5cbf1b26f01144710bcf4f952c40b71ced65cd55961e0a70b0b7c00291e3cad83caf56e1515f032f63da02f01872369276cd62c137958dcdb7b0460426fa958665fa6b4eb7cddce52791f5a1aee99bc2588d8d60423ed4805e71715cfbcba4c2185facc836ba8b63406bc0826568a49a0a4ba48cf77b6204bd906a674d6647f3b4a4b7d02777c41eb03432dd5b07b6179af2996fc4a2872f3b6bc56b13adeb7f62d7b12130c7352154da7b47efa82aecd24690d231be43bf88c31cca949da23067ccd5c390447f8fd51ba58a8c54c6b1085923fdf120782443d84996e54ba6323b6535306ff060a1775ba98c905ad9ea7cf8bc6c9fa3475af66e4e42265a7a6049668245c92f42710bfb0944e689190069b8f9daa0287c5b6b961d2614755780aeba8c54db8b93f7467f71a60ef1c130721c31cbb339a813c83f51003f109710301e8e6a906e2b2d2733715ee48bbca5573ce661501b6b77e414730120e687b8476a6147a79fab8752a0bb739a83494b2b0a2641b1b42c813a234e460bbbc58272cc28c58c67515886029ba01320c10fae16030835695d2b4a5180c401e22678383013629069e664c513c6beab870cd41375f9b9c4b9b4f6c15ef3023c72e490b829691cc7489be01592d80d72dba497e30524e68e8b443cc2e45e2372068e9a9572c6bfabd4c901088d9c6b4b986739b220b97739577bf35952e94df1325fe08688a344430a812d33a84855808ffc0224e55491636b7f6f6757f7bc19671c9ad2da132f287a30d5cd52fa982ca7ca80bc52e0b82ba419449c89940451a051762386fb8694fa8a717396c9624bd4aacd662534bd62757e941aa425b4280776d2487deb013fd4d24e0d201a214b419344cffc444a2ee206a7ec07aea8803a9093624270c5c76e0657142d10462b8c8543f40ce49a7a9c5cbc94459c9b583a89acc6f664959c3a90460557fc828912465d34a68de8c655562744ea99962a4119e7f639133ba516d2c6c7248fec08a37ce208e3ec2c2e2266ba8719b5f09d5c10aae1923bee15ccaa4342246219724702cfc0c7a1932da719787810921b62979c1637179b8e47953756e271c3c35adf41246af547cc4c3e77468191060eb4a8c85bf941e439be74e42129b3c7cd54421b0079cfaaa565a6552bab2fd6d61c6c92c7ab06b7abe6130cb65131628e7d665a1cc6bfd2f33dcab0012d05807b431d806176fd41abd10316c25b7431ba3942f51f0c61abb8211268e91d01824a31f5534a143cca46533fea692cf0bf2b1b0d8a904f4387a3a0ea101da0aed2f2969cac1469b8bf83f18e06d59f14c7c3b32c5f6942c3e7ba8207daaac5d45cb579475380203011cf7fcc2135986907269de0f018e17cafc66a0d698346338b422c9a205a14521c5514d2c665ae5bb6c6b607de7c58f2502f356a5a878b9da6306874031f85784c9460782683af064c6238d762e3b02d7cdb839339bf0e13268f68821216b779206d2bfb1db9919f3849844c35be9888bf56824a32c979ccd65cd1f3c61ae8b008a783bd7ab01922004d9463e4ea6d80d4789ab42873e6c507c9121986997c37a1d0f15fdcb441a92701c4d7b12093978381844e7cc71e10b165c7c38ba2acc9826dfaf3ce70904060445e9c50c51707a9d337a49992982f6b8eca0b021cb64efc8babed8a516794b3e6d3ac5713b7235632ec4536f5d21f593b7fc5597a31e242f370112818c6657a6d6a0674c3ac174847b24765c930635814a75507cb510ce19a2d7398362477d5b220fc3aa65fd6be07f1ca83d8cc17ba2587a92365c729eda0a62f500a40a56744f3b921911a4703705a620b11582c61acab5eb7a68028aca150174fe6010e6b2950082ec2cc63fce9a5cd2c3908a02b09a263ec9919d5a3873dcc089a532439a143ed436901da541ef46d604b6a0061c2daf23a292138bf2915861044c9586986fc01fdc38a42d5cad28ed2939b7b4aeba87b0e49e98e3e60e2
+PrivateSeed = b5b5149b95504b1d750ab4aa57cc77ef2bad3cca0d5bfbb73928465098f59fc9958e2432c0093671e5fa460bcbdd34e7894d7aa6a0b4681bcae0f7a0a660d322
 
-Decapsulate = ML-KEM-1024-CiphertextTooLong
+Decapsulate = ML-KEM-1024-CiphertextTooLong/Private
 Algorithm = ML-KEM-1024
 Input = 52560d840c0cb5e1894a6e6a029cf491b33569abf16000f6643ad640ef7ab279721c0c5fea0f3dc25bf03722cd909f5699ab455c90dd6138f26080057daa17f0fce57a923e3b620455a0c4c06aef4fcade5641e67afe7dc49b3ebdee362dbf6cf167a89318d64467765e99ae0a8cafeab0e97cb75185e678c8a43733704728280fda4068e1ac930ac291746525b28046808307d58346927e74a048ebe23a6036d6bf47cd713f6b54ccfd2d0b2ab2e0d0902f29942edec76973ebdba31bd58d9f3b65b11abcd27e286d1bd63c5189b57ad02305129130e92afb1f7a23889da1b7c4ff6c2db9905c7463e35e54f7c5e5a4779aca1838a4c470d21788ab4b163765e67332be3e81440e5c61f78d815625616c8a49736af2c167098dce51890a8cd89b07fd693d560ba03f77d1aa69f25cf2f4037a77ce109581a88bbb325920871fa40d14db92916338ea01e0d9ae72b0fa8c79db4b6b4c7e40a6b093297f3a0ffe90ff4c0a78d85f17c0fae3073b3d3970ce618e23eb46a3d5de5564d9d2f2987dcea437be0a54c28f32c1b4b331ec751989d9533b7e04978f506b55a340e6fbe0767280d5a33cfc0c5e81012aa2cc083a2f12691c8278a54437b81a87e46a5ca20c6ec25d3587f82f7bb736f1ddc73c934e7fb6073dc781668d8403606635811881eb437153ef8e1a4dc1c5ad4ad83b4913fe109e3d6da65f5d9f39706dc38e70a3240c0fedb63bc26c746ba19463921f34924e623507c3871a034ef2a57f468c186ee19a1b8d258ef05609273b50126b75a4a5f41631095f84660293b7a12155d4d28a81daae6677a805b9bf6d4c9c4ef890784eeceb86f71c4be24ffb11e71719140324d6fa0e2c147eeb0d3486a76d6b8ab36828767db512e93c47e1e69be4d09586f7c5234867c356881e59607a18aa42533a911cec4153bf00323d492ac430e0b8bf8e3863a7e43fdc8609885ffde4354fb46376c65266874956c766b83a0c537daa13e4601a5121befa5fea8fac32a1f77ca1067e24f86988c7f81137fdd1625b970e85a68368c10d8f7822a1010f5c221802e113d356c6c5207003a5dab7377911a1f3e77ab5bdb62d75a9e95c07f107cf82cec90388ed257c18254a671728188b72ec320218eba0f0da359eb90da37ba32688eac90e7965aaa14fff71e5d0c88c8d923b95b95e3f6e8542a6a1b1e2d35a363b17e23414981081005b95e6cb34c76af468d1ea3642a6b792b7bda0537425c66b40b5e084363de69a9111757f412ea91b051b4d350176c0ced46ab431f7676a99db3e6ddb1cb494c19f30d8cff99e7d91ba86a9cd81882406b8c2863fc5f9e2b86e0af19e20176d2ef3aff1ca52b70d466c85299162240ab65ff05850ca918e34fad6cb930a576d20d694248b29d232efe2628b1f65121e7c24b0ae9b380cbd0c08b2087c8813ccef77eb9690e1721c5674f911b2cef6e332bbf57ce1405af65bb53f2384b538a48910f2d09eeb752a73dc1fb6304c1a6384dc0c4bf058190fc11516d092954c9be3438c4816b5f3e8ebd7c648768fc2852992e33a096c2dddad0a38ce755f22f6805e1adef7206436a9e1c41b2c2abd87a496da2e59bfbf1f6774765a0467127291de38b92a55412e0ef5bc8630fb57ac1c3d1922e35c5dcd0ace8d97a62e21709ddf6abdcb155c6876f1295f4ba5185c288fa7c0e637d60faab128cf15534bc314f4978e516142cac6a193f447353ed98d239fbd191c0a5df5902c8d07a824c456bf99ed48abcfb9ef63848fab994c9dc2427ec5b74147ef499909a90917670d8f2f267166d94efa6ff597bd70436e02a4623cda7334072c287799c9e308c89a86958ca43c8384959fc60c439be63eb3f83a770a8b1b684b88c4d106ec55c204419fd65299e77f6a1b07e52580347763f2b12a63076632ecd7ce0f7f53daf85b4036e1a813952fe04eebca3eae2109a878e02133f2c8e0f29e449156a9e061c70f3cd8b05c50f9e8e3387b1e0712a7f867022709b1b96fe5cf82d74f710023b29bc17696c9fddff90209e6ac0f1f9450234be87466e219b6e50b8f6a66bda58ec06357c74ffdc92da1992740131aaee0b715ba3f7de06f723c553214d079a44a33957a1cabbfa1c484e25595f7bf5f456653324751182c7c462e1a71e67451e7ad186b084a3766198edb1ec060bc27ca9265abc02a1d0608ab0b37361834a179cb720fb2e39f878c678dc95f590c91d4
 DecapsulateFail
 
 # Random ciphertext.
-PrivateKeyFromSeed = ML-KEM-1024-RandomCiphertext
+Key = ML-KEM-1024-RandomCiphertext
 Algorithm = ML-KEM-1024
-Input = 3f6f67ff01382a44c8d5dc52295311a1934f1a10f0ca6085e53af2eb524334881674047e7e7a1649482e1d9b0de92455cd14d0049bdcb7cea4b867ace5c8922b
+SPKI = 30820632300b060960864801650304040303820621002fc53aa1ab2d11ab37a1d1b40cc17074ecb9f70a89643a4b455c9f7c12854141a4fff5c03a099a4c8baddeb9aaeb36a6897712d7a5ad8970279f531666d8b66a8431aa24031f74cb754c76a3d67d8ba469994bb9262762ed072f72ebca9f6837a3962bd3733618f81bcd61358399afb4c441d22c8725cc3a66798907c52c4a14be4c851a6a9a1166119c5a3799ea60088c1a2d4aa71ad828a072f51e8f54410436799a051a5e38b207334d9ba442ad27ab39a739d3046b7d73aa94babb6108981b89aa8225c81377498e437de0a762a7798227bc17cc54a090dab0c7d548d85c6c38e2ac5798538e630bc12b00f2859defbc6c24380f28ab5bd4aa8b50c4103dd9b97f87ac57b1501e1771eb49c493e13b7719582eec85dde51eb17b5df97c50797a6325e5b22fa5bf7cc08d3555ae4123c99c6041a97692fb7278358ab69152226cbc1c4b73798c23af8738c2ff7514cbb82a004157a2857542877c5c886179fa091b23513fc1403860c3f469797c050fdf19ba8e8a9ebb2076e469309cc449d23a7320721b2727c9b29341bf04c436336d7ca34d78b8b441fcac0f10793c2bb7de5942e5fb271435824421699e67bb647bac6be1b2369b0d26e31f83e725cb0b0c43ec96a31c67e5493cc7831e9716900b726a8d1abf04b4353308be3fea5d57a99ab8300dfe55b90b1811719a18a30307f291591d8a05567bc9632a6336b688df55ab5e7375927863af652c2b1c80e0db1b8b4972b781685f9934065919abc07205ca40d3d7b96be486f0a82a4ae16b928083f333121ceb441b3c5fe76aabaf6915d7044969d2af27304c7caa2554618309884ee10b3e56f0c4013a263e27b0c6236cabc990baf5c3bd837c8f379135c1964108393bba113c208d0660b5a4065b32aa6bb95a511b93672c42af364b0ef4259b1be16c3e4c29e84c9e1da39910eb7395228227cc06c539b2017acfb69c24672b4040bc4abdd04301f54d432c8f94d2c57f087dcc0ccf3d81a6b560a463e988312841b52995f6192a142493efc16222f2cd6374b75c43cd024ca3d28c39a0ab2dae961a3fc8214b963d2ba1aa959a05fb453558251e1978b30d46a4739363e324357ad64a7ee25a96c43b1a08599192ce3ea7976f01cc643aa5f2db4772b64b662845f41a1ae3681ee451349b6502d68b261cf87ddcaa4fea2c37fed526d8db96c04c11ab852473e87e9c52b8f2db29fca4484a116829c6915f1365176110a2d5bf2155262ef79e81191c408b222e5967403b7bcfc296194a01fa179665c391d52c90ac8c9131931f7eb630c6c134fe74190e864d5e705090d687bcd8910ec1406559ad6dc7a10dc9270973b0987a1ae38603317c362993499c052546ab5e24acca143a8b8f529bc8f733e24479eee9c44647b04b6b2b7dd969f9d33236696b60d4bb88783cc16600ad1936b6599b716440b35c077c82734ba26c8302b9741044a805ba9ff21b38f3a2e7c48a2ca740373138917cb29460964108a8f83572c9b6c4979c8a084c858f47b0ad19b344d8a7ead606359770ddba420d7a9b35cc2a034865ccbb7c91839da6e29082d64a18bb3368e7a7802468ce05b75c355e9df954e579833db4a3c8019e10059c66ca91ffe31c01693bbfa5cfb32071bb26773e8378f5796e0ac082d7f3c7674b956845897739453288cc58d482f37cc45fa6ceb803a4edcac3c1211989ea89d82833b664133968cf18b6aed7b457025b2936387b81179f402479c2169787eca14ea6bb4aaa7daa4a94e825a332ca0054e8a37fd58a9e503ff44ba943d458ac3b9798cb72ac670f41e09cbd93cb6f916d94e089d6c449d3daa9be3c946d68c7df58be34f203256753242807225b9211291439847a899b4337ea1b865557bfa98c51f2072c034cbb512cc0f6a781b185d5a51c4b344a60f5244b009c49340ad713bf03ca7c22082fa8fac90f619e6732275db86b5bf54568d7348c7145d4dccc396209ec8c2c90d20308f6789877a7e31797a80b9653ecb2a4db65def895180263ca8ab72542cdf4c46af4a22e0ef4b1f61180ae04504a7848ef0b40dcac8fefd28a12d712e19968b294c9f1a1756e4c6212e9925efb7a0a777853442e941ca1aa114cf8228b0748941fdbcaa9a496a12386ce9031dafc2221885e0da28798572b038f43b89a816abba900ac97f01a31dcc630b3435f8660c89fa5e78de9aed81c
+PKCS8 = 3054020100300b0609608648016503040403044280403f6f67ff01382a44c8d5dc52295311a1934f1a10f0ca6085e53af2eb524334881674047e7e7a1649482e1d9b0de92455cd14d0049bdcb7cea4b867ace5c8922b
+RawPublic = 2fc53aa1ab2d11ab37a1d1b40cc17074ecb9f70a89643a4b455c9f7c12854141a4fff5c03a099a4c8baddeb9aaeb36a6897712d7a5ad8970279f531666d8b66a8431aa24031f74cb754c76a3d67d8ba469994bb9262762ed072f72ebca9f6837a3962bd3733618f81bcd61358399afb4c441d22c8725cc3a66798907c52c4a14be4c851a6a9a1166119c5a3799ea60088c1a2d4aa71ad828a072f51e8f54410436799a051a5e38b207334d9ba442ad27ab39a739d3046b7d73aa94babb6108981b89aa8225c81377498e437de0a762a7798227bc17cc54a090dab0c7d548d85c6c38e2ac5798538e630bc12b00f2859defbc6c24380f28ab5bd4aa8b50c4103dd9b97f87ac57b1501e1771eb49c493e13b7719582eec85dde51eb17b5df97c50797a6325e5b22fa5bf7cc08d3555ae4123c99c6041a97692fb7278358ab69152226cbc1c4b73798c23af8738c2ff7514cbb82a004157a2857542877c5c886179fa091b23513fc1403860c3f469797c050fdf19ba8e8a9ebb2076e469309cc449d23a7320721b2727c9b29341bf04c436336d7ca34d78b8b441fcac0f10793c2bb7de5942e5fb271435824421699e67bb647bac6be1b2369b0d26e31f83e725cb0b0c43ec96a31c67e5493cc7831e9716900b726a8d1abf04b4353308be3fea5d57a99ab8300dfe55b90b1811719a18a30307f291591d8a05567bc9632a6336b688df55ab5e7375927863af652c2b1c80e0db1b8b4972b781685f9934065919abc07205ca40d3d7b96be486f0a82a4ae16b928083f333121ceb441b3c5fe76aabaf6915d7044969d2af27304c7caa2554618309884ee10b3e56f0c4013a263e27b0c6236cabc990baf5c3bd837c8f379135c1964108393bba113c208d0660b5a4065b32aa6bb95a511b93672c42af364b0ef4259b1be16c3e4c29e84c9e1da39910eb7395228227cc06c539b2017acfb69c24672b4040bc4abdd04301f54d432c8f94d2c57f087dcc0ccf3d81a6b560a463e988312841b52995f6192a142493efc16222f2cd6374b75c43cd024ca3d28c39a0ab2dae961a3fc8214b963d2ba1aa959a05fb453558251e1978b30d46a4739363e324357ad64a7ee25a96c43b1a08599192ce3ea7976f01cc643aa5f2db4772b64b662845f41a1ae3681ee451349b6502d68b261cf87ddcaa4fea2c37fed526d8db96c04c11ab852473e87e9c52b8f2db29fca4484a116829c6915f1365176110a2d5bf2155262ef79e81191c408b222e5967403b7bcfc296194a01fa179665c391d52c90ac8c9131931f7eb630c6c134fe74190e864d5e705090d687bcd8910ec1406559ad6dc7a10dc9270973b0987a1ae38603317c362993499c052546ab5e24acca143a8b8f529bc8f733e24479eee9c44647b04b6b2b7dd969f9d33236696b60d4bb88783cc16600ad1936b6599b716440b35c077c82734ba26c8302b9741044a805ba9ff21b38f3a2e7c48a2ca740373138917cb29460964108a8f83572c9b6c4979c8a084c858f47b0ad19b344d8a7ead606359770ddba420d7a9b35cc2a034865ccbb7c91839da6e29082d64a18bb3368e7a7802468ce05b75c355e9df954e579833db4a3c8019e10059c66ca91ffe31c01693bbfa5cfb32071bb26773e8378f5796e0ac082d7f3c7674b956845897739453288cc58d482f37cc45fa6ceb803a4edcac3c1211989ea89d82833b664133968cf18b6aed7b457025b2936387b81179f402479c2169787eca14ea6bb4aaa7daa4a94e825a332ca0054e8a37fd58a9e503ff44ba943d458ac3b9798cb72ac670f41e09cbd93cb6f916d94e089d6c449d3daa9be3c946d68c7df58be34f203256753242807225b9211291439847a899b4337ea1b865557bfa98c51f2072c034cbb512cc0f6a781b185d5a51c4b344a60f5244b009c49340ad713bf03ca7c22082fa8fac90f619e6732275db86b5bf54568d7348c7145d4dccc396209ec8c2c90d20308f6789877a7e31797a80b9653ecb2a4db65def895180263ca8ab72542cdf4c46af4a22e0ef4b1f61180ae04504a7848ef0b40dcac8fefd28a12d712e19968b294c9f1a1756e4c6212e9925efb7a0a777853442e941ca1aa114cf8228b0748941fdbcaa9a496a12386ce9031dafc2221885e0da28798572b038f43b89a816abba900ac97f01a31dcc630b3435f8660c89fa5e78de9aed81c
+PrivateSeed = 3f6f67ff01382a44c8d5dc52295311a1934f1a10f0ca6085e53af2eb524334881674047e7e7a1649482e1d9b0de92455cd14d0049bdcb7cea4b867ace5c8922b
 
-EncapsulateDecapsulate = ML-KEM-1024-RandomCiphertext
+EncapsulateDecapsulate = ML-KEM-1024-RandomCiphertext/Private
 Algorithm = ML-KEM-1024
 
-Decapsulate = ML-KEM-1024-RandomCiphertext
+Decapsulate = ML-KEM-1024-RandomCiphertext/Private
 Algorithm = ML-KEM-1024
 Input = 542acf1e3c7dd990f1879ef5b5aebd32055618c4e5b958995f0b22a78f9e2bdd8dd0cda23893c56f48a20d4df878e1cdbd39f50310f2ac0cd502e761329da00d49e7b8721f53af649ef7edfe74f259ffefd492f13b1ac396eb65916e02b3348560ca426e9b93beccad58bcf0c5804f0a10532635fcb74e45c1f8eaa83d56e78d8a7ee5aadcb7e06eddef900b484632bf1bdb0e1a4ef8b6fe34789934d9baa887ec5a39dbc6416f66008751aa193a9c313ef8a57a515bfe046953fa6a1329a770e9e1bfdc33f3a68dbd5cec1c2a55a0e41093583230ac35386645e6dcd166f25706efc779fec0cc4299e8e7501b93a857378713475782cb0b31ab645940f4c875548345ca0138372719c3cf9022034f17c28bb90f6090d4b8be957ec63c297a0ba95dc02f8761c18e7a948c1c20158230e2f9ff809cfd01b9d020b7164f8a3c54a143594d7d35b8e1ad6cb25d96c11c1b7f47f62a8d90c0e2b3d1460b86a463579e7b44ff74b6a29f30521588a26887797c60d86235e0bf4c2bc7166bbeb275996e1f50cfc36641710a52fe08fb5dda30f6129d3a304e336ff0d8698515b2cc450cffb45cceea7ef51a989d036c71367a4d26cd6025479d2f7ae58e700928e176c59b3040b054a09312d9fe529ce784a71513b44c1cd4073209a93a4df73b7097da88cea0b31c3e77e70abcb4b2ba5edd8db8f47ce844750158ddc5609dde43eac393eb5909d9415ee4698d923d8ebc28612f8b0676565010360b9406091ddc881fb6a992b70645b6898d13a8e3e449be589cf17bf9312e5cc58b03d3c181f7f176b67bea210337d6c52913f8cfe145da9426434c1fad0da7911bdb35e68b86b5bc6717dccee9222c4842c28fb13115278f1249b213498791082bab15d32f59481b29b9512945602eeba8af490af99fbb841bd1aead2b4f6f57f19dc970e83bd3928ea2d33ca3c3e50cd5d68e6ef516371cbaecb6b73f57fd5ae5b38a74f20759dcf217066081fee51f0fe8a93aabeab4717f05395e304e86bedbe11d462c1cb9d4e32e75b35fb707e7b509e43b450d6025b2d3e84e00f3d92b717578e820a33788013b2bda42f2701a9c6044ac2082e0387e141bc97a60bac45e0c1f4787bb5b892cb190e4b6776f5139082850494bc5ac56a6f759a0505ed4757009c35a4d36bad276185f1fc75399043168b22cc668a4b1202e03407b9fbb6a0799ba6a396ea78e137f7c68996f18f1636037179c4b920ef68526fc9008aecbfc0a2b02432e2b15832b35a61f438e06ce977c4d447612c13eebd0549edf316f64f5e7f3ccb0b46d19b79d103c1ab8f1551b6b3d22ab75a85660af2a9eab9c734875fef1d526da819829b66d65c8459a1aa404ec83842aa97a595e0271630644ade4df047f06778fe1bd1466bd413279940f15b9b848fae294bf4964286629682abed221e1ede635f315273854d57f68872bd9cb503545ef7b949b36df853eb7a4f47805406555d361aeeec6b77a0b6030b5a124f34cc121a927740aeaa6a381083f4e645b0d460220a8a5961be7ef69f60d3ed3c49c3348db4924373a706d7f16a4a4c16b0e3f4cdce663d224c20cce901801c4b29f9f9ada5ea9e5facb5e9cc0621b297f94d3cc828b33c530656cdf66ba0ed27a4988eb019065c508991bfdd8af7678449353506c0202b288d4f6d5693ef3f8447e7724c9b31f7e50f54c2f0933c5d4d6b4691010f285bf58b5a6b254f2dd12936f0aa6789351c7e61f046fcff0770df8cbbf0cfe6565700bf1dfd4d7ad1dee9368e2756c6e0f7de2d0ecb0d986b2b7631ababf3c6ae3e6f4c891cdff84f7f9aab7f3ea7ddececa4608e2574904fee752f4eebe442940a688efe390dd97e576349569f83d02d4627dfc23d65a8e4b9cb6bb66070e0fdf1ced446bf9cff064f1b113bbda51c62f278226254d15f44005fa271fb9fe3613f640253206279ebff909986aec32af0bc00663e10fda8b419f766eca892763bd3c4cc349369ee97dfedf76845fdc3ef7a884531edf2cd0ac840423688feb8a0519343266c2168b3c93c17e754dc4afb47dba4ef6f31ebdabe58b10168b0857f9899f48f61b08e809809014ebad6c1336e671b9abd3c8317942589ff517c3460cf81d4f103e111c15d09b878263ab2d4b4810898d3a654123fa96b1c694ba7b212712709c9173aa34ad098f9f3dd1c075af8d47c72952bfac2a196c
 Output = 66e9331f3ed7e258aea053740f4b38f7bb53eb1221eafc8c59f5216491aeff93

boringssl-0.20260708.tar.xz/crypto/evp/test/rsa_tests.txt -> boringssl-0.20260813.tar.xz/crypto/evp/test/rsa_tests.txt Changed

@@ -1,10 +1,13 @@
 # EVP RSA tests
 
 # RSA 2048 bit key.
-PrivateKey = RSA-2048
+Key = RSA-2048
 Algorithm = RSA
 Bits = 2048
-Input = 308204bc020100300d06092a864886f70d0101010500048204a6308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
+PKCS8 = 308204bc020100300d06092a864886f70d0101010500048204a6308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
+RSAPublicKey = 3082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+RSAPrivateKey = 308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
+SPKI = 30820122300d06092a864886f70d01010105000382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
 RSAParamN = cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f
 RSAParamE = 010001
 RSAParamD = 60297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd1870531
@@ -14,38 +17,33 @@
 RSAParamDMQ1 = 1f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd59
 RSAParamIQMP = 4d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
 
-# The public half of the same key encoded as a SubjectPublicKeyInfo.
-PublicKey = RSA-2048-SPKI
-Algorithm = RSA
-Bits = 2048
-Input = 30820122300d06092a864886f70d01010105000382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
-RSAParamN = cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f
-RSAParamE = 010001
-
 # The same key but with a negative RSA modulus.
-PublicKey = RSA-2048-SPKI-Negative
-Input = 30820121300d06092a864886f70d01010105000382010e003082010902820100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+Key = RSA-2048-SPKI-Negative
+SPKI = 30820121300d06092a864886f70d01010105000382010e003082010902820100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
 Error = NEGATIVE_NUMBER
 
 # An RSA key with an even modulus
-PublicKey = RSA-2048-Even-Modulus
-Input = 30820122300d06092a864886f70d01010105000382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44e0203010001
+Key = RSA-2048-Even-Modulus
+SPKI = 30820122300d06092a864886f70d01010105000382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44e0203010001
 Error = BAD_RSA_PARAMETERS
 
 # The same key but with missing parameters rather than a NULL.
-PublicKey = RSA-2048-SPKI-Invalid
-Input = 30820120300b06092a864886f70d0101010382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+Key = RSA-2048-SPKI-Invalid
+SPKI = 30820120300b06092a864886f70d0101010382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
 Error = DECODE_ERROR
 
 # The same key but with an incorrectly-encoded length prefix.
-PublicKey = RSA-2048-SPKI-Invalid2
-Input = 3083000122300d06092a864886f70d01010105000382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+Key = RSA-2048-SPKI-Invalid2
+SPKI = 3083000122300d06092a864886f70d01010105000382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
 Error = DECODE_ERROR
 
 # The same key but constrained to PSS, SHA-256, and salt length >= 32
-PrivateKey = RSA-2048-PSS-SHA256
+Key = RSA-2048-PSS-SHA256
 Algorithm = RSA-PSS-SHA-256
-Input = 308204f0020100304106092a864886f70d01010a3034a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a203020120048204a6308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
+PKCS8 = 308204f0020100304106092a864886f70d01010a3034a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a203020120048204a6308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
+RSAPublicKey = 3082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+RSAPrivateKey = 308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
+SPKI = 30820156304106092a864886f70d01010a3034a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a2030201200382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
 RSAParamN = cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f
 RSAParamE = 010001
 RSAParamD = 60297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd1870531
@@ -54,99 +52,94 @@
 RSAParamDMP1 = 21f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec432061
 RSAParamDMQ1 = 1f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd59
 RSAParamIQMP = 4d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
-
-PublicKey = RSA-2048-SPKI-PSS-SHA256
-Algorithm = RSA-PSS-SHA-256
-Input = 30820156304106092a864886f70d01010a3034a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a2030201200382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
-RSAParamN = cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f
-RSAParamE = 010001
+# The PSS parameter parser should accept both explicit and missing NULL. See
+# Section 2.1 of RFC 4055. This encoding does not round-trip. When re-encoded,
+# we will put the NULLs in, to match the canonical PSS encoding.
+SPKINonCanonical = 30820152303d06092a864886f70d01010a3030a00d300b0609608648016503040201a11a301806092a864886f70d010108300b0609608648016503040201a2030201200382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
 
 # The same key but constrained to PSS with any parameters (not supported)
-PrivateKey = RSA-2048-PSS
-Input = 308204ba020100300b06092a864886f70d01010a048204a6308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
+Key = RSA-2048-PSS
+PKCS8 = 308204ba020100300b06092a864886f70d01010a048204a6308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
 Error = UNSUPPORTED_ALGORITHM
 
-PublicKey = RSA-2048-SPKI-PSS
-Input = 30820120300b06092a864886f70d01010a0382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+Key = RSA-2048-SPKI-PSS
+SPKI = 30820120300b06092a864886f70d01010a0382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
 Error = UNSUPPORTED_ALGORITHM
 
 # The same key but constrained to PSS, SHA-384, and salt length >= 48
-PrivateKey = RSA-2048-PSS-SHA384
-Input = 308204f0020100304106092a864886f70d01010a3034a00f300d06096086480165030402020500a11c301a06092a864886f70d010108300d06096086480165030402020500a203020130048204a6308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
-Algorithm = RSA-PSS-SHA-384
-
-PublicKey = RSA-2048-SPKI-PSS-SHA384
-Input = 30820156304106092a864886f70d01010a3034a00f300d06096086480165030402020500a11c301a06092a864886f70d010108300d06096086480165030402020500a2030201300382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+Key = RSA-2048-PSS-SHA384
 Algorithm = RSA-PSS-SHA-384
+PKCS8 = 308204f0020100304106092a864886f70d01010a3034a00f300d06096086480165030402020500a11c301a06092a864886f70d010108300d06096086480165030402020500a203020130048204a6308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
+SPKI = 30820156304106092a864886f70d01010a3034a00f300d06096086480165030402020500a11c301a06092a864886f70d010108300d06096086480165030402020500a2030201300382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+RSAPublicKey = 3082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+RSAPrivateKey = 308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
 
 # The same key but constrained to PSS, SHA-512, and salt length >= 64
-PrivateKey = RSA-2048-PSS-SHA512
-Input = 308204f0020100304106092a864886f70d01010a3034a00f300d06096086480165030402030500a11c301a06092a864886f70d010108300d06096086480165030402030500a203020140048204a6308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
-Algorithm = RSA-PSS-SHA-512
-
-PublicKey = RSA-2048-SPKI-PSS-SHA512
-Input = 30820156304106092a864886f70d01010a3034a00f300d06096086480165030402030500a11c301a06092a864886f70d010108300d06096086480165030402030500a2030201400382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+Key = RSA-2048-PSS-SHA512
 Algorithm = RSA-PSS-SHA-512
-
-# The PSS parameter parser should accept both explicit and missing NULL. See
-# Section 2.1 of RFC 4055. This encoding does not round-trip. When re-encoded,
-# we will put the NULLs in, to match the canonical PSS encoding.
-PublicKey = RSA-2048-SPKI-PSS-SHA256-NoNULL
-Algorithm = RSA-PSS-SHA-256
-Input = 30820152303d06092a864886f70d01010a3030a00d300b0609608648016503040201a11a301806092a864886f70d010108300b0609608648016503040201a2030201200382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
-Output = 30820156304106092a864886f70d01010a3034a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a2030201200382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+PKCS8 = 308204f0020100304106092a864886f70d01010a3034a00f300d06096086480165030402030500a11c301a06092a864886f70d010108300d06096086480165030402030500a203020140048204a6308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
+SPKI = 30820156304106092a864886f70d01010a3034a00f300d06096086480165030402030500a11c301a06092a864886f70d010108300d06096086480165030402030500a2030201400382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+RSAPublicKey = 3082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+RSAPrivateKey = 308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5
 
 # Although the defaults specify SHA-1, we do not allow SHA-1.
-PublicKey = RSA-2048-SPKI-PSS-SHA1-Defaults
-Input = 30820122300d06092a864886f70d01010a30000382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+Key = RSA-2048-SPKI-PSS-SHA1-Defaults
+SPKI = 30820122300d06092a864886f70d01010a30000382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
 Error = BAD_ENCODING
 
 # PSS trailer field must be the default, and thus omitted.
-PublicKey = RSA-2048-SPKI-PSS-SHA256-TrailerField
-Input = 3082015b304606092a864886f70d01010a3039a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a203020120a3030201010382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+Key = RSA-2048-SPKI-PSS-SHA256-TrailerField
+SPKI = 3082015b304606092a864886f70d01010a3039a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a203020120a3030201010382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
 Error = BAD_ENCODING
 
 # We do not support minimum salt lengths other than exactly the hash length.
-PublicKey = RSA-2048-SPKI-PSS-SHA256-Salt31
-Input = 30820156304106092a864886f70d01010a3034a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a20302011f0382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+Key = RSA-2048-SPKI-PSS-SHA256-Salt31
+SPKI = 30820156304106092a864886f70d01010a3034a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a20302011f0382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
 Error = BAD_ENCODING
 
-PublicKey = RSA-2048-SPKI-PSS-SHA256-Salt33
-Input = 30820156304106092a864886f70d01010a3034a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a2030201210382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
+Key = RSA-2048-SPKI-PSS-SHA256-Salt33
+SPKI = 30820156304106092a864886f70d01010a3034a00f300d06096086480165030402010500a11c301a06092a864886f70d010108300d06096086480165030402010500a2030201210382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001
 Error = BAD_ENCODING
 
 # RSA 512 bit key.
-PrivateKey = RSA-512
+Key = RSA-512
 Algorithm = RSA
 Bits = 512
-Input = 30820154020100300d06092a864886f70d01010105000482013e3082013a020100024100dd20403d976a38c9d79152d87b5c8e9f05033eadd7b7de709bf5b0c4a5182a97d18483526b02362b992e154a9f37faa396ca2685cdab8fec09877ebe705f4dd70203010001024055bebcca655d7e39de8a6eaa9d636db682161907064039544755c53eeb99ec618c03a210dbc61471eaba10c5c365c9726d6b7a96f54d455f7d168d49367270e1022100f21a05d9fd6817301ce49ce10448f9bdd44f5ef5b7557cd7d83155db46382ae7022100e9d1f7157783db2feab1936954ddc4e83aa365695868144cda1be6813b61d791022100d6001eb0040920860ce41fafdf23ca6dfbdf74e6e9f98cf3164cf5c16f9e727d02206f6f73f4b52b10517be6f9bc5f87fa0a3bb817e2e711636b651f9af1c85d4f21022063eff2e57f5b4ca20342cfe793e25526624e3692f192461f9e1ce7f13f2d72c8
+PKCS8 = 30820154020100300d06092a864886f70d01010105000482013e3082013a020100024100dd20403d976a38c9d79152d87b5c8e9f05033eadd7b7de709bf5b0c4a5182a97d18483526b02362b992e154a9f37faa396ca2685cdab8fec09877ebe705f4dd70203010001024055bebcca655d7e39de8a6eaa9d636db682161907064039544755c53eeb99ec618c03a210dbc61471eaba10c5c365c9726d6b7a96f54d455f7d168d49367270e1022100f21a05d9fd6817301ce49ce10448f9bdd44f5ef5b7557cd7d83155db46382ae7022100e9d1f7157783db2feab1936954ddc4e83aa365695868144cda1be6813b61d791022100d6001eb0040920860ce41fafdf23ca6dfbdf74e6e9f98cf3164cf5c16f9e727d02206f6f73f4b52b10517be6f9bc5f87fa0a3bb817e2e711636b651f9af1c85d4f21022063eff2e57f5b4ca20342cfe793e25526624e3692f192461f9e1ce7f13f2d72c8
+SPKI = 305c300d06092a864886f70d0101010500034b003048024100dd20403d976a38c9d79152d87b5c8e9f05033eadd7b7de709bf5b0c4a5182a97d18483526b02362b992e154a9f37faa396ca2685cdab8fec09877ebe705f4dd70203010001
+RSAPublicKey = 3048024100dd20403d976a38c9d79152d87b5c8e9f05033eadd7b7de709bf5b0c4a5182a97d18483526b02362b992e154a9f37faa396ca2685cdab8fec09877ebe705f4dd70203010001
+RSAPrivateKey = 3082013a020100024100dd20403d976a38c9d79152d87b5c8e9f05033eadd7b7de709bf5b0c4a5182a97d18483526b02362b992e154a9f37faa396ca2685cdab8fec09877ebe705f4dd70203010001024055bebcca655d7e39de8a6eaa9d636db682161907064039544755c53eeb99ec618c03a210dbc61471eaba10c5c365c9726d6b7a96f54d455f7d168d49367270e1022100f21a05d9fd6817301ce49ce10448f9bdd44f5ef5b7557cd7d83155db46382ae7022100e9d1f7157783db2feab1936954ddc4e83aa365695868144cda1be6813b61d791022100d6001eb0040920860ce41fafdf23ca6dfbdf74e6e9f98cf3164cf5c16f9e727d02206f6f73f4b52b10517be6f9bc5f87fa0a3bb817e2e711636b651f9af1c85d4f21022063eff2e57f5b4ca20342cfe793e25526624e3692f192461f9e1ce7f13f2d72c8
 
 # RSA 515 bit key.
-PrivateKey = RSA-515
+Key = RSA-515
 Algorithm = RSA
 Bits = 515
-Input = 30820157020100300d06092a864886f70d0101010500048201413082013d0201000241054fa166e205e658bbe8a2dc35311c0c2b75b7e4569fd9642c8bae809279271fc824f26baa1166ea46298ca63379ea76adbada2b61e5066820a35beaec1aca227f020301000102410266c972be0d30e53ac2acb1aa13b4bd0401cccf212452a66b4615f7e943831f67b4ca48560582d0ca886044aaaaf87945252a848c1947944186e6eb83969bf91102210309e631761842cc8a2ccfd372c20a9cba21de1a199c30ab440bc6b51079f4e825022101bf715c1db432627ca7c29a293b9210f2eff1e92d12f306ebaa5334f8ee03dcd30221018ac58a765f2b8f37d434081fe5ff92b81735ead2f263f4968ccf63d61fbe3d0d0221015b247a1159a2d5a25d0db049593c6405f77f3a278c521d066e290c2a2d8fb59d0221026224aa31fd95c14d24fd03b8a195bba4cc88df7c37f5370a5ab19f882f1404d6
+PKCS8 = 30820157020100300d06092a864886f70d0101010500048201413082013d0201000241054fa166e205e658bbe8a2dc35311c0c2b75b7e4569fd9642c8bae809279271fc824f26baa1166ea46298ca63379ea76adbada2b61e5066820a35beaec1aca227f020301000102410266c972be0d30e53ac2acb1aa13b4bd0401cccf212452a66b4615f7e943831f67b4ca48560582d0ca886044aaaaf87945252a848c1947944186e6eb83969bf91102210309e631761842cc8a2ccfd372c20a9cba21de1a199c30ab440bc6b51079f4e825022101bf715c1db432627ca7c29a293b9210f2eff1e92d12f306ebaa5334f8ee03dcd30221018ac58a765f2b8f37d434081fe5ff92b81735ead2f263f4968ccf63d61fbe3d0d0221015b247a1159a2d5a25d0db049593c6405f77f3a278c521d066e290c2a2d8fb59d0221026224aa31fd95c14d24fd03b8a195bba4cc88df7c37f5370a5ab19f882f1404d6
+SPKI = 305c300d06092a864886f70d0101010500034b0030480241054fa166e205e658bbe8a2dc35311c0c2b75b7e4569fd9642c8bae809279271fc824f26baa1166ea46298ca63379ea76adbada2b61e5066820a35beaec1aca227f0203010001
+RSAPublicKey = 30480241054fa166e205e658bbe8a2dc35311c0c2b75b7e4569fd9642c8bae809279271fc824f26baa1166ea46298ca63379ea76adbada2b61e5066820a35beaec1aca227f0203010001
+RSAPrivateKey = 3082013d0201000241054fa166e205e658bbe8a2dc35311c0c2b75b7e4569fd9642c8bae809279271fc824f26baa1166ea46298ca63379ea76adbada2b61e5066820a35beaec1aca227f020301000102410266c972be0d30e53ac2acb1aa13b4bd0401cccf212452a66b4615f7e943831f67b4ca48560582d0ca886044aaaaf87945252a848c1947944186e6eb83969bf91102210309e631761842cc8a2ccfd372c20a9cba21de1a199c30ab440bc6b51079f4e825022101bf715c1db432627ca7c29a293b9210f2eff1e92d12f306ebaa5334f8ee03dcd30221018ac58a765f2b8f37d434081fe5ff92b81735ead2f263f4968ccf63d61fbe3d0d0221015b247a1159a2d5a25d0db049593c6405f77f3a278c521d066e290c2a2d8fb59d0221026224aa31fd95c14d24fd03b8a195bba4cc88df7c37f5370a5ab19f882f1404d6
 
 
 # RSASSA-PKCS1-v1_5 tests
 
-Sign = RSA-2048
+Sign = RSA-2048/Private
 Digest = SHA1
 Input = "0123456789ABCDEF1234"
 Output = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad
 
-Verify = RSA-2048
+# No signing with public keys
+Sign = RSA-2048/PublicOnly
 Digest = SHA1
 Input = "0123456789ABCDEF1234"
-Output = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad
+Error = VALUE_MISSING
 
-Verify = RSA-2048-SPKI
+Verify = RSA-2048
 Digest = SHA1
 Input = "0123456789ABCDEF1234"
 Output = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad
 
 # Digest too long
-Sign = RSA-2048
+Sign = RSA-2048/Private
 Digest = SHA1
 Input = "0123456789ABCDEF12345"
 Error = INVALID_MESSAGE_LENGTH
@@ -158,7 +151,7 @@
 Error = INVALID_MESSAGE_LENGTH
 
 # Digest too short
-Sign = RSA-2048
+Sign = RSA-2048/Private
 Digest = SHA1
 Input = "0123456789ABCDEF123"
 Error = INVALID_MESSAGE_LENGTH
@@ -170,7 +163,7 @@
 Error = INVALID_MESSAGE_LENGTH
 
 # Digest too large for key.
-Sign = RSA-512
+Sign = RSA-512/Private
 Digest = SHA512
 Input = "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
 Error = DIGEST_TOO_BIG_FOR_RSA_KEY
@@ -228,7 +221,7 @@
 # RSASSA-PSS tests.
 
 # Zero salt length makes the output deterministic
-Sign = RSA-2048
+Sign = RSA-2048/Private
 RSAPadding = PSS
 PSSSaltLength = 0
 Digest = SHA256
@@ -236,7 +229,7 @@
 Output = 4de433d5844043ef08d354da03cb29068780d52706d7d1e4d50efb7d58c9d547d83a747ddd0635a96b28f854e50145518482cb49e963054621b53c60c498d07c16e9c2789c893cf38d4d86900de71bde463bd2761d1271e358c7480a1ac0bab930ddf39602ad1bc165b5d7436b516b7a7858e8eb7ab1c420eeb482f4d207f0e462b1724959320a084e13848d11d10fb593e66bf680bf6d3f345fc3e9c3de60abbac37e1c6ec80a268c8d9fc49626c679097aa690bc1aa662b95eb8db70390861aa0898229f9349b4b5fdd030d4928c47084708a933144be23bd3c6e661b85b2c0ef9ed36d498d5b7320e8194d363d4ad478c059bae804181965e0b81b663158a
 
 # Verify of above signature
-Verify = RSA-2048-SPKI
+Verify = RSA-2048
 RSAPadding = PSS
 PSSSaltLength = 0
 Digest = SHA256
@@ -244,7 +237,7 @@
 Output = 4de433d5844043ef08d354da03cb29068780d52706d7d1e4d50efb7d58c9d547d83a747ddd0635a96b28f854e50145518482cb49e963054621b53c60c498d07c16e9c2789c893cf38d4d86900de71bde463bd2761d1271e358c7480a1ac0bab930ddf39602ad1bc165b5d7436b516b7a7858e8eb7ab1c420eeb482f4d207f0e462b1724959320a084e13848d11d10fb593e66bf680bf6d3f345fc3e9c3de60abbac37e1c6ec80a268c8d9fc49626c679097aa690bc1aa662b95eb8db70390861aa0898229f9349b4b5fdd030d4928c47084708a933144be23bd3c6e661b85b2c0ef9ed36d498d5b7320e8194d363d4ad478c059bae804181965e0b81b663158a
 
 # A non-zero salt length must be checked by round-tripping.
-Sign = RSA-2048
+Sign = RSA-2048/Private
 RSAPadding = PSS
 PSSSaltLength = 32
 Digest = SHA256
@@ -255,7 +248,7 @@
 # not just working due to defaults. (The current default is a maximum salt
 # length, but the ecosystem has converged on matching the digest length, so we
 # may change this in the future.)
-Sign = RSA-2048
+Sign = RSA-2048/Private
 RSAPadding = PSS
 PSSSaltLength = 42
 Digest = SHA256
@@ -263,7 +256,7 @@
 CheckVerify
 
 # Auto-detected salt length
-Verify = RSA-2048-SPKI
+Verify = RSA-2048
 RSAPadding = PSS
 PSSSaltLength = -2
 Digest = SHA256
@@ -271,7 +264,7 @@
 Output = 4de433d5844043ef08d354da03cb29068780d52706d7d1e4d50efb7d58c9d547d83a747ddd0635a96b28f854e50145518482cb49e963054621b53c60c498d07c16e9c2789c893cf38d4d86900de71bde463bd2761d1271e358c7480a1ac0bab930ddf39602ad1bc165b5d7436b516b7a7858e8eb7ab1c420eeb482f4d207f0e462b1724959320a084e13848d11d10fb593e66bf680bf6d3f345fc3e9c3de60abbac37e1c6ec80a268c8d9fc49626c679097aa690bc1aa662b95eb8db70390861aa0898229f9349b4b5fdd030d4928c47084708a933144be23bd3c6e661b85b2c0ef9ed36d498d5b7320e8194d363d4ad478c059bae804181965e0b81b663158a
 
 # Signing with salt length -1 means to match the digest length.
-Sign = RSA-2048
+Sign = RSA-2048/Private
 RSAPadding = PSS
 PSSSaltLength = -1
 VerifyPSSSaltLength = 32
@@ -280,7 +273,7 @@
 CheckVerify
 
 # Signing with salt length -2 means to maximize the salt length.
-Sign = RSA-2048
+Sign = RSA-2048/Private
 RSAPadding = PSS
 PSSSaltLength = -2
 VerifyPSSSaltLength = 222  # 256 - 32 - 2
@@ -288,8 +281,15 @@
 Input = "0123456789ABCDEF0123456789ABCDEF"
 CheckVerify
 
+# No signing with public keys.
+Sign = RSA-2048/PublicOnly
+RSAPadding = PSS
+Digest = SHA256
+Input = "0123456789ABCDEF0123456789ABCDEF"
+Error = VALUE_MISSING
+
 # Wrong digest
-Verify = RSA-2048-SPKI
+Verify = RSA-2048
 RSAPadding = PSS
 PSSSaltLength = 0
 Digest = SHA256
@@ -298,7 +298,7 @@
 Error = BAD_SIGNATURE
 
 # Digest too short
-Verify = RSA-2048-SPKI
+Verify = RSA-2048
 RSAPadding = PSS
 PSSSaltLength = 0
 Digest = SHA256
@@ -307,7 +307,7 @@
 Error = INVALID_MESSAGE_LENGTH
 
 # Digest too long
-Verify = RSA-2048-SPKI
+Verify = RSA-2048
 RSAPadding = PSS
 PSSSaltLength = 0
 Digest = SHA256
@@ -357,7 +357,7 @@
 Error = SLEN_RECOVERY_FAILED
 
 # The salt length is too large for the modulus (signing).
-Sign = RSA-2048
+Sign = RSA-2048/Private
 RSAPadding = PSS
 PSSSaltLength = 223
 Digest = SHA256
@@ -374,14 +374,14 @@
 Error = DATA_TOO_LARGE
 
 # The hash is too large for the modulus (signing).
-Sign = RSA-512
+Sign = RSA-512/Private
 RSAPadding = PSS
 PSSSaltLength = 0
 Digest = SHA512
 Input = "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
 Error = DATA_TOO_LARGE_FOR_KEY_SIZE
 
-Sign = RSA-512
+Sign = RSA-512/Private
 RSAPadding = PSS
 PSSSaltLength = -2
 Digest = SHA512
@@ -451,7 +451,7 @@
 Error = LAST_OCTET_INVALID
 
 # Non-zero salt length.
-Verify = RSA-2048-SPKI
+Verify = RSA-2048
 RSAPadding = PSS
 PSSSaltLength = 32
 Digest = SHA256
@@ -459,7 +459,7 @@
 Output = 4065b284b0a6e98d4c41a8427007f878d8dd61599c87764fa79b8bf03f030c48127a4b1a5af5a6e0cf9055e57a1f47e5b0c0d8c600e78369cf1c39374899fac91a812692aa2216ba10900ce85a5cf7fddcafb726e4b83479c5bb7b3b84b08ffe183b4c2973aa3193ec7b7d4ea73bf1b579c6657b78ad7800e1975a4838c28ffe353fafef96be27b5c69677760a71b6f4df65ba6fe6b3565580a536f966928294c6e9ece807a90c1477779bcbfa3a250e98d685097c162c1c8c56ab02bd2e16eec7a019b51c067bdba7fa8cd5460796e22c607a8b6d12e1deb9be51c6943c46590f416800c48bb4cbb8c409d316573e59eadf7d3b9e6e5c2d0e570692e511e139
 
 # Non-zero salt length, wrong salt length.
-Verify = RSA-2048-SPKI
+Verify = RSA-2048
 RSAPadding = PSS
 PSSSaltLength = 31
 Digest = SHA256
@@ -468,7 +468,7 @@
 Error = SLEN_CHECK_FAILED
 
 # Non-zero salt length, match hash length.
-Verify = RSA-2048-SPKI
+Verify = RSA-2048
 RSAPadding = PSS
 PSSSaltLength = -1
 Digest = SHA256
@@ -476,7 +476,7 @@
 Output = 4065b284b0a6e98d4c41a8427007f878d8dd61599c87764fa79b8bf03f030c48127a4b1a5af5a6e0cf9055e57a1f47e5b0c0d8c600e78369cf1c39374899fac91a812692aa2216ba10900ce85a5cf7fddcafb726e4b83479c5bb7b3b84b08ffe183b4c2973aa3193ec7b7d4ea73bf1b579c6657b78ad7800e1975a4838c28ffe353fafef96be27b5c69677760a71b6f4df65ba6fe6b3565580a536f966928294c6e9ece807a90c1477779bcbfa3a250e98d685097c162c1c8c56ab02bd2e16eec7a019b51c067bdba7fa8cd5460796e22c607a8b6d12e1deb9be51c6943c46590f416800c48bb4cbb8c409d316573e59eadf7d3b9e6e5c2d0e570692e511e139
 
 # Non-zero salt length, auto-detected.
-Verify = RSA-2048-SPKI
+Verify = RSA-2048
 RSAPadding = PSS
 PSSSaltLength = -2
 Digest = SHA256
@@ -485,81 +485,81 @@
 
 # A constrained PSS key must use matching PSS parameters. The salt length
 # constraint is >=.
-Sign = RSA-2048-PSS-SHA256
+Sign = RSA-2048-PSS-SHA256/Private
 RSAPadding = PSS
 PSSSaltLength = 32
 Digest = SHA256
 Input = "0123456789ABCDEF0123456789ABCDEF"
 CheckVerify
 
-Sign = RSA-2048-PSS-SHA256
+Sign = RSA-2048-PSS-SHA256/Private
 RSAPadding = PSS
 PSSSaltLength = -1
 Digest = SHA256
 Input = "0123456789ABCDEF0123456789ABCDEF"
 CheckVerify
 
-Sign = RSA-2048-PSS-SHA256
+Sign = RSA-2048-PSS-SHA256/Private
 RSAPadding = PSS
 PSSSaltLength = 33
 Digest = SHA256
 Input = "0123456789ABCDEF0123456789ABCDEF"
 CheckVerify
 
-Sign = RSA-2048-PSS-SHA256
+Sign = RSA-2048-PSS-SHA256/Private
 RSAPadding = PSS
 PSSSaltLength = 31
 Digest = SHA256
 Input = "0123456789ABCDEF0123456789ABCDEF"
 Error = INVALID_PSS_SALTLEN
 
-Sign = RSA-2048-PSS-SHA256
+Sign = RSA-2048-PSS-SHA256/Private
 Digest = SHA384
 Input = "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
 Error = INVALID_DIGEST_TYPE
 
-Sign = RSA-2048-PSS-SHA256
+Sign = RSA-2048-PSS-SHA256/Private
 Digest = SHA256
 MGF1Digest = SHA384
 Input = "0123456789ABCDEF0123456789ABCDEF"
 Error = INVALID_MGF1_MD
 
-Sign = RSA-2048-PSS-SHA384
+Sign = RSA-2048-PSS-SHA384/Private
 RSAPadding = PSS
 PSSSaltLength = 48
 Digest = SHA384
 Input = "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
 CheckVerify
 
-Sign = RSA-2048-PSS-SHA384
+Sign = RSA-2048-PSS-SHA384/Private
 RSAPadding = PSS
 PSSSaltLength = 49
 Digest = SHA384
 Input = "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
 CheckVerify
 
-Sign = RSA-2048-PSS-SHA384
+Sign = RSA-2048-PSS-SHA384/Private
 RSAPadding = PSS
 PSSSaltLength = 47
 Digest = SHA384
 Input = "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
 Error = INVALID_PSS_SALTLEN
 
-Sign = RSA-2048-PSS-SHA512
+Sign = RSA-2048-PSS-SHA512/Private
 RSAPadding = PSS
 PSSSaltLength = 64
 Digest = SHA512
 Input = "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
 CheckVerify
 
-Sign = RSA-2048-PSS-SHA512
+Sign = RSA-2048-PSS-SHA512/Private
 RSAPadding = PSS
 PSSSaltLength = 65
 Digest = SHA512
 Input = "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF"
 CheckVerify
 
-Sign = RSA-2048-PSS-SHA512
+Sign = RSA-2048-PSS-SHA512/Private
 RSAPadding = PSS
 PSSSaltLength = 63
 Digest = SHA512
@@ -567,43 +567,59 @@
 Error = INVALID_PSS_SALTLEN
 
 # A constrained PSS key defaults to its constraints.
-Sign = RSA-2048-PSS-SHA256
+Sign = RSA-2048-PSS-SHA256/Private
 Input = "0123456789ABCDEF0123456789ABCDEF"
 CheckVerify
 
-Verify = RSA-2048-SPKI-PSS-SHA256
+# No signing with public keys.
+Sign = RSA-2048-PSS-SHA256/PublicOnly
+Input = "0123456789ABCDEF0123456789ABCDEF"
+Error = VALUE_MISSING
+
+Verify = RSA-2048-PSS-SHA256
 Input = "0123456789ABCDEF0123456789ABCDEF"
 Output = 3a1ccf5115b006ba94515c69df540b4780eb0e80b8880359c363a1d2d9f12251f42c60770b55d5172091b082685c84f756e7e04effcc717046adc1418cb5c25755ef53f12d0ced5fa06922d9360968868eee8a2cec75122e553f71bac46e1ccd0aad29cc63ead7d4d6c092bf0e51aeaf70a994665769a56fe9176ddb89f8db22de1bc08d4a0865aaa789cca5056806b60d8bc36b508c645e0c4e9d10d6383498421ed5f42103e77e2f50d73156a0c4fca36fe62e7b7c418c33673158582672747e3e2a75bee287b8402f051cc93c748596f7925a69928b4bcacc90398da471c114369362df8c341e1a351dc9d7c393c556caf11855a3452b16a1df14798af199
 
 # A PSS key may not be used with RSASSA-PKCS1-v1_5, or encryption.
-Sign = RSA-2048-PSS-SHA256
+Sign = RSA-2048-PSS-SHA256/Private
 RSAPadding = PKCS1
 Input = "0123456789ABCDEF0123456789ABCDEF"
 Error = ILLEGAL_OR_UNSUPPORTED_PADDING_MODE
 
-Decrypt = RSA-2048-PSS-SHA256
+Decrypt = RSA-2048-PSS-SHA256/Private
 Input = 550af55a2904e7b9762352f8fb7fa235a9cb053aacb2d5fcb8ca48453cb2ee3619746c701abf2d4cc67003471a187900b05aa812bd25ed05c675dfc8c97a24a7bf49bd6214992cad766d05a9a2b57b74f26a737e0237b8b76c45f1f226a836d7cfbc75ba999bdbe48dbc09227aa46c88f21dccba7840141ad5a5d71fd122e6bd6ac3e564780dfe623fc1ca9b995a6037bf0bbd43b205a84ac5444f34202c05ce9113087176432476576de6ffff9a52ea57c08be3ec2f49676cb8e12f762ac71fa3c321e00ac988910c85ff52f93825666ce0d40ffaa0592078919d4493f46d95ccf76364c6d57760dd0b64805f9afc76a2365a5575ca301d5103f0ea76cb9a78
 Error = OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE
 
 # RSA decrypt
 
-Decrypt = RSA-2048
+Decrypt = RSA-2048/Private
 Input = 550af55a2904e7b9762352f8fb7fa235a9cb053aacb2d5fcb8ca48453cb2ee3619746c701abf2d4cc67003471a187900b05aa812bd25ed05c675dfc8c97a24a7bf49bd6214992cad766d05a9a2b57b74f26a737e0237b8b76c45f1f226a836d7cfbc75ba999bdbe48dbc09227aa46c88f21dccba7840141ad5a5d71fd122e6bd6ac3e564780dfe623fc1ca9b995a6037bf0bbd43b205a84ac5444f34202c05ce9113087176432476576de6ffff9a52ea57c08be3ec2f49676cb8e12f762ac71fa3c321e00ac988910c85ff52f93825666ce0d40ffaa0592078919d4493f46d95ccf76364c6d57760dd0b64805f9afc76a2365a5575ca301d5103f0ea76cb9a78
 Output = "Hello World"
 
 # Corrupted ciphertext
-Decrypt = RSA-2048
+Decrypt = RSA-2048/Private
 Input = 550af55a2904e7b9762352f8fb7fa235a9cb053aacb2d5fcb8ca48453cb2ee3619746c701abf2d4cc67003471a187900b05aa812bd25ed05c675dfc8c97a24a7bf49bd6214992cad766d05a9a2b57b74f26a737e0237b8b76c45f1f226a836d7cfbc75ba999bdbe48dbc09227aa46c88f21dccba7840141ad5a5d71fd122e6bd6ac3e564780dfe623fc1ca9b995a6037bf0bbd43b205a84ac5444f34202c05ce9113087176432476576de6ffff9a52ea57c08be3ec2f49676cb8e12f762ac71fa3c321e00ac988910c85ff52f93825666ce0d40ffaa0592078919d4493f46d95ccf76364c6d57760dd0b64805f9afc76a2365a5575ca301d5103f0ea76cb9a79
 Error = PKCS_DECODING_ERROR
 
+# No decrypting with public keys
+Decrypt = RSA-2048/PublicOnly
+Input = 550af55a2904e7b9762352f8fb7fa235a9cb053aacb2d5fcb8ca48453cb2ee3619746c701abf2d4cc67003471a187900b05aa812bd25ed05c675dfc8c97a24a7bf49bd6214992cad766d05a9a2b57b74f26a737e0237b8b76c45f1f226a836d7cfbc75ba999bdbe48dbc09227aa46c88f21dccba7840141ad5a5d71fd122e6bd6ac3e564780dfe623fc1ca9b995a6037bf0bbd43b205a84ac5444f34202c05ce9113087176432476576de6ffff9a52ea57c08be3ec2f49676cb8e12f762ac71fa3c321e00ac988910c85ff52f93825666ce0d40ffaa0592078919d4493f46d95ccf76364c6d57760dd0b64805f9afc76a2365a5575ca301d5103f0ea76cb9a78
+Error = VALUE_MISSING
+
 # OAEP padding
-Decrypt = RSA-2048
+Decrypt = RSA-2048/Private
 RSAPadding = OAEP
 Input = 458708dfbd42a1297ce7a9c86c7087ab80b1754810929b89c5107ca55368587686986fce94d86cc1595b3fb736223a656ec0f34d18ba1cc5665593610f56c58e26b272d584f3d983a5c91085700755aebd921fb280bba3eda7046ec07b43e7298e52d59edc92be4639a8ce08b2f85976ecf6d98cc469eeb9d5d8e2a32ea8a6626edafe1038b3df455668a9f3c77cad8b92fb872e00058c3d2a7ede1a1f03fc5622084ae04d9d24f6bf0995c58d35b93b699b9763595e123f2ab0863cc9229eb290e2ede7715c7a8f39e0b9a3e2e1b56ebb62f1cbfbb5986fb212ebd785b83d01d968b11d1756c7337f70c1f1a63bff03608e24f3a2fd44e67f832a8701c5d5af
 Output = "Hello World"
 
+# No decrypting with public keys
+Decrypt = RSA-2048/PublicOnly
+RSAPadding = OAEP
+Input = 458708dfbd42a1297ce7a9c86c7087ab80b1754810929b89c5107ca55368587686986fce94d86cc1595b3fb736223a656ec0f34d18ba1cc5665593610f56c58e26b272d584f3d983a5c91085700755aebd921fb280bba3eda7046ec07b43e7298e52d59edc92be4639a8ce08b2f85976ecf6d98cc469eeb9d5d8e2a32ea8a6626edafe1038b3df455668a9f3c77cad8b92fb872e00058c3d2a7ede1a1f03fc5622084ae04d9d24f6bf0995c58d35b93b699b9763595e123f2ab0863cc9229eb290e2ede7715c7a8f39e0b9a3e2e1b56ebb62f1cbfbb5986fb212ebd785b83d01d968b11d1756c7337f70c1f1a63bff03608e24f3a2fd44e67f832a8701c5d5af
+Error = VALUE_MISSING
+
 # OAEP padding with label and custom hash.
-Decrypt = RSA-2048
+Decrypt = RSA-2048/Private
 RSAPadding = OAEP
 OAEPDigest = SHA512
 OAEPLabel = 00112233445566778899aabbccddeeff
@@ -611,7 +627,7 @@
 Output = "Hello World"
 
 # OAEP padding, corrupted ciphertext
-Decrypt = RSA-2048
+Decrypt = RSA-2048/Private
 RSAPadding = OAEP
 Input = 458708dfbd42a1297ce7a9c86c7087ab80b1754810929b89c5107ca55368587686986fce94d86cc1595b3fb736223a656ec0f34d18ba1cc5665593610f56c58e26b272d584f3d983a5c91085700755aebd921fb280bba3eda7046ec07b43e7298e52d59edc92be4639a8ce08b2f85976ecf6d98cc469eeb9d5d8e2a32ea8a6626edafe1038b3df455668a9f3c77cad8b92fb872e00058c3d2a7ede1a1f03fc5622084ae04d9d24f6bf0995c58d35b93b699b9763595e123f2ab0863cc9229eb290e2ede7715c7a8f39e0b9a3e2e1b56ebb62f1cbfbb5986fb212ebd785b83d01d968b11d1756c7337f70c1f1a63bff03608e24f3a2fd44e67f832a8701c5d5ac
 Error = OAEP_DECODING_ERROR
@@ -636,11 +652,14 @@
 
 # Though we will never generate such a key, test that RSA keys where p < q work
 # properly.
-PrivateKey = RSA-Swapped
+Key = RSA-Swapped
 Algorithm = RSA
-Input = 30820275020100300d06092a864886f70d01010105000482025f3082025b02010002818100ab28f98747934779011417d5bbb4095eae6f48ed09e13081616cf390aac75b10a206a98953d402647dfef7fa363be2765a303b05ec388bd9a1d75123a1205b4ecb43c33f2e37d3e30842181d694a3acfc39afc52554946e699d97d97066596a46725ce6dea322623afcafecbd2884d9a0c5eae9c4d7da8874c29c19edb762e1902030100010281800d637ea568e169f15ab6be288f6ec55edd29425c9c6dbb941b5160fa1b89cda34ef15378b5107c016d63b0f52721e71497f876dd7f3d6b1f228c4bc20c3c12384644200e91130c9195660d1e706f55b2accf00c5e2174a1d9ee289f0e763ee58860485ec97d19d7fa2df38af5b5910b1fa52087768d288e6ec4c8d5eca23c8d3024100be757a24dc2c923692d964693b2d71ca33ccb2f946f9e5232d2090b715a97dca554068fab8876105bc9ed6dccfd0917c5e0b80339306535c3eeb787e89397bc7024100e60f5c9e52434da079b8c641791a81a96daa4d9921a07e5b48292a9fce230df7c9fc2b97b5e38834ed5caaa387a0bca35c474e989a68dd65b79a6f691a74471f0240438ccf017bc5a3260ff76291a01782204136fcd344c524ebd0f997da17a8c1a09d93f6a7d602cdfa86e79f3539cfb389f4a1079b432e1f2abc762f8a51893dc9024046604ca4e1e554c9d27283b363a888219c3a8ca25b770d303f52d8872a37eefdedfc0619d2ba57e058fc0ff71676453e73ec1c4ef26d41ccebed824754a05d6102404445374d8450e753e0a42085b56b0d6d500b3e3518536dc8f12ec8fd77aa75491835327ac0e12d73b5c3f1b09d03f6a24fe63b9c551dee6559b625435ec92429
+PKCS8 = 30820275020100300d06092a864886f70d01010105000482025f3082025b02010002818100ab28f98747934779011417d5bbb4095eae6f48ed09e13081616cf390aac75b10a206a98953d402647dfef7fa363be2765a303b05ec388bd9a1d75123a1205b4ecb43c33f2e37d3e30842181d694a3acfc39afc52554946e699d97d97066596a46725ce6dea322623afcafecbd2884d9a0c5eae9c4d7da8874c29c19edb762e1902030100010281800d637ea568e169f15ab6be288f6ec55edd29425c9c6dbb941b5160fa1b89cda34ef15378b5107c016d63b0f52721e71497f876dd7f3d6b1f228c4bc20c3c12384644200e91130c9195660d1e706f55b2accf00c5e2174a1d9ee289f0e763ee58860485ec97d19d7fa2df38af5b5910b1fa52087768d288e6ec4c8d5eca23c8d3024100be757a24dc2c923692d964693b2d71ca33ccb2f946f9e5232d2090b715a97dca554068fab8876105bc9ed6dccfd0917c5e0b80339306535c3eeb787e89397bc7024100e60f5c9e52434da079b8c641791a81a96daa4d9921a07e5b48292a9fce230df7c9fc2b97b5e38834ed5caaa387a0bca35c474e989a68dd65b79a6f691a74471f0240438ccf017bc5a3260ff76291a01782204136fcd344c524ebd0f997da17a8c1a09d93f6a7d602cdfa86e79f3539cfb389f4a1079b432e1f2abc762f8a51893dc9024046604ca4e1e554c9d27283b363a888219c3a8ca25b770d303f52d8872a37eefdedfc0619d2ba57e058fc0ff71676453e73ec1c4ef26d41ccebed824754a05d6102404445374d8450e753e0a42085b56b0d6d500b3e3518536dc8f12ec8fd77aa75491835327ac0e12d73b5c3f1b09d03f6a24fe63b9c551dee6559b625435ec92429
+SPKI = 30819f300d06092a864886f70d010101050003818d0030818902818100ab28f98747934779011417d5bbb4095eae6f48ed09e13081616cf390aac75b10a206a98953d402647dfef7fa363be2765a303b05ec388bd9a1d75123a1205b4ecb43c33f2e37d3e30842181d694a3acfc39afc52554946e699d97d97066596a46725ce6dea322623afcafecbd2884d9a0c5eae9c4d7da8874c29c19edb762e190203010001
+RSAPublicKey = 30818902818100ab28f98747934779011417d5bbb4095eae6f48ed09e13081616cf390aac75b10a206a98953d402647dfef7fa363be2765a303b05ec388bd9a1d75123a1205b4ecb43c33f2e37d3e30842181d694a3acfc39afc52554946e699d97d97066596a46725ce6dea322623afcafecbd2884d9a0c5eae9c4d7da8874c29c19edb762e190203010001
+RSAPrivateKey = 3082025b02010002818100ab28f98747934779011417d5bbb4095eae6f48ed09e13081616cf390aac75b10a206a98953d402647dfef7fa363be2765a303b05ec388bd9a1d75123a1205b4ecb43c33f2e37d3e30842181d694a3acfc39afc52554946e699d97d97066596a46725ce6dea322623afcafecbd2884d9a0c5eae9c4d7da8874c29c19edb762e1902030100010281800d637ea568e169f15ab6be288f6ec55edd29425c9c6dbb941b5160fa1b89cda34ef15378b5107c016d63b0f52721e71497f876dd7f3d6b1f228c4bc20c3c12384644200e91130c9195660d1e706f55b2accf00c5e2174a1d9ee289f0e763ee58860485ec97d19d7fa2df38af5b5910b1fa52087768d288e6ec4c8d5eca23c8d3024100be757a24dc2c923692d964693b2d71ca33ccb2f946f9e5232d2090b715a97dca554068fab8876105bc9ed6dccfd0917c5e0b80339306535c3eeb787e89397bc7024100e60f5c9e52434da079b8c641791a81a96daa4d9921a07e5b48292a9fce230df7c9fc2b97b5e38834ed5caaa387a0bca35c474e989a68dd65b79a6f691a74471f0240438ccf017bc5a3260ff76291a01782204136fcd344c524ebd0f997da17a8c1a09d93f6a7d602cdfa86e79f3539cfb389f4a1079b432e1f2abc762f8a51893dc9024046604ca4e1e554c9d27283b363a888219c3a8ca25b770d303f52d8872a37eefdedfc0619d2ba57e058fc0ff71676453e73ec1c4ef26d41ccebed824754a05d6102404445374d8450e753e0a42085b56b0d6d500b3e3518536dc8f12ec8fd77aa75491835327ac0e12d73b5c3f1b09d03f6a24fe63b9c551dee6559b625435ec92429
 
-Sign = RSA-Swapped
+Sign = RSA-Swapped/Private
 Digest = SHA256
 Input = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
 Output = 07fa4e3de9c002c41c952dc292ef5a814c4c17dc1a6cf958c4c971e8089676d6661b442270ef9295c41e5385c9628aa1bdee2cc2558b8473ba212f2ba04b9ff2264c19187b9506b1d0a1cc2751844cc8dedf555d62ce81bc0e70bfe83d0184ee964593af91b9b327c0fb272c799148cd8737d412cbf36c2ad25fd66977bf805f
@@ -658,11 +677,14 @@
 
 # Though we will never generate such a key, test that RSA keys where p and q are
 # different sizes work properly.
-PrivateKey = RSA-PrimeMismatch
+Key = RSA-PrimeMismatch
 Algorithm = RSA
-Input = 30820295020100300d06092a864886f70d01010105000482027f3082027b02010002818100c766f4fef89f5e9a8e13ed500fb38523ea94d7f8be066900eee58c913b4c6fdcb13d63d39b9108feabcefd1ffd04776403dc58f968ae817977d0809e567d8af512d604a0e9cb448fa5e402204ee519712a5ebbfd002faf8169495a782f54366b4665aac0d968bfec63c5446b6f9b13061c7f3d1f3f1b6bede8fff881b410a66f0203010001028180528c062f49485c771a0b18ca747d8a47f8941ea63c305626cb3f1f067e6861c4441c432687dbd08d484aac3b01f3ffdc3b762c719167f7cb22e565aa6acd597306ef6f7828b9720e9d440816186d940c4c5a9720dddf71fe0b59483f02a751515c8c27e43c575d6725d55f5bb77e0f977773b00afc058cfab6617ec90d0b62a9026100cb8f97c37b4fbc298b645bc3dc0526f8a4274e9a193b33c3acb76499b5b96330e4b586cbaa56368ffc12644952322253bc669496d572c0980f125fd7273739cf790d24401052b13732114d397c8c16a44716dc62d2320fb1ced99290dfd53e07022100fac51ac653609cdaba53280c6b6f209052e270be0c3c68fe8b37d6bf05fbba59026038dff2f04c58d7e2e7ae6fb1469d2de954bc22cb0d77ac1be4fb0ca1a1d39d7240c4b357de4cde4bd68b30f8077e38771af1b25c7e60e48cd7d1337402e1fc460ab57046720918b8aa4589452196669119c7ba65e602d4bdc264a9fdce7c5f2b0220773af0180bdc8bb7938fa6230191bcb1e236b7d4248d347e9242e25fc0c0874102605c4894cde334889f5b52ed8f86a2ee9c1fbe4166287e24ce44f3093bff383962f08043842f6ff3e6002104b0e29442c4a4483c5d06e2254fbe5e3930de3d0e28af10e96c6e341a4b8859382dbba24536a38ae71118e3e22413a93f298a7f744c
+PKCS8 = 30820295020100300d06092a864886f70d01010105000482027f3082027b02010002818100c766f4fef89f5e9a8e13ed500fb38523ea94d7f8be066900eee58c913b4c6fdcb13d63d39b9108feabcefd1ffd04776403dc58f968ae817977d0809e567d8af512d604a0e9cb448fa5e402204ee519712a5ebbfd002faf8169495a782f54366b4665aac0d968bfec63c5446b6f9b13061c7f3d1f3f1b6bede8fff881b410a66f0203010001028180528c062f49485c771a0b18ca747d8a47f8941ea63c305626cb3f1f067e6861c4441c432687dbd08d484aac3b01f3ffdc3b762c719167f7cb22e565aa6acd597306ef6f7828b9720e9d440816186d940c4c5a9720dddf71fe0b59483f02a751515c8c27e43c575d6725d55f5bb77e0f977773b00afc058cfab6617ec90d0b62a9026100cb8f97c37b4fbc298b645bc3dc0526f8a4274e9a193b33c3acb76499b5b96330e4b586cbaa56368ffc12644952322253bc669496d572c0980f125fd7273739cf790d24401052b13732114d397c8c16a44716dc62d2320fb1ced99290dfd53e07022100fac51ac653609cdaba53280c6b6f209052e270be0c3c68fe8b37d6bf05fbba59026038dff2f04c58d7e2e7ae6fb1469d2de954bc22cb0d77ac1be4fb0ca1a1d39d7240c4b357de4cde4bd68b30f8077e38771af1b25c7e60e48cd7d1337402e1fc460ab57046720918b8aa4589452196669119c7ba65e602d4bdc264a9fdce7c5f2b0220773af0180bdc8bb7938fa6230191bcb1e236b7d4248d347e9242e25fc0c0874102605c4894cde334889f5b52ed8f86a2ee9c1fbe4166287e24ce44f3093bff383962f08043842f6ff3e6002104b0e29442c4a4483c5d06e2254fbe5e3930de3d0e28af10e96c6e341a4b8859382dbba24536a38ae71118e3e22413a93f298a7f744c
+SPKI = 30819f300d06092a864886f70d010101050003818d0030818902818100c766f4fef89f5e9a8e13ed500fb38523ea94d7f8be066900eee58c913b4c6fdcb13d63d39b9108feabcefd1ffd04776403dc58f968ae817977d0809e567d8af512d604a0e9cb448fa5e402204ee519712a5ebbfd002faf8169495a782f54366b4665aac0d968bfec63c5446b6f9b13061c7f3d1f3f1b6bede8fff881b410a66f0203010001
+RSAPublicKey = 30818902818100c766f4fef89f5e9a8e13ed500fb38523ea94d7f8be066900eee58c913b4c6fdcb13d63d39b9108feabcefd1ffd04776403dc58f968ae817977d0809e567d8af512d604a0e9cb448fa5e402204ee519712a5ebbfd002faf8169495a782f54366b4665aac0d968bfec63c5446b6f9b13061c7f3d1f3f1b6bede8fff881b410a66f0203010001
+RSAPrivateKey = 3082027b02010002818100c766f4fef89f5e9a8e13ed500fb38523ea94d7f8be066900eee58c913b4c6fdcb13d63d39b9108feabcefd1ffd04776403dc58f968ae817977d0809e567d8af512d604a0e9cb448fa5e402204ee519712a5ebbfd002faf8169495a782f54366b4665aac0d968bfec63c5446b6f9b13061c7f3d1f3f1b6bede8fff881b410a66f0203010001028180528c062f49485c771a0b18ca747d8a47f8941ea63c305626cb3f1f067e6861c4441c432687dbd08d484aac3b01f3ffdc3b762c719167f7cb22e565aa6acd597306ef6f7828b9720e9d440816186d940c4c5a9720dddf71fe0b59483f02a751515c8c27e43c575d6725d55f5bb77e0f977773b00afc058cfab6617ec90d0b62a9026100cb8f97c37b4fbc298b645bc3dc0526f8a4274e9a193b33c3acb76499b5b96330e4b586cbaa56368ffc12644952322253bc669496d572c0980f125fd7273739cf790d24401052b13732114d397c8c16a44716dc62d2320fb1ced99290dfd53e07022100fac51ac653609cdaba53280c6b6f209052e270be0c3c68fe8b37d6bf05fbba59026038dff2f04c58d7e2e7ae6fb1469d2de954bc22cb0d77ac1be4fb0ca1a1d39d7240c4b357de4cde4bd68b30f8077e38771af1b25c7e60e48cd7d1337402e1fc460ab57046720918b8aa4589452196669119c7ba65e602d4bdc264a9fdce7c5f2b0220773af0180bdc8bb7938fa6230191bcb1e236b7d4248d347e9242e25fc0c0874102605c4894cde334889f5b52ed8f86a2ee9c1fbe4166287e24ce44f3093bff383962f08043842f6ff3e6002104b0e29442c4a4483c5d06e2254fbe5e3930de3d0e28af10e96c6e341a4b8859382dbba24536a38ae71118e3e22413a93f298a7f744c
 
-Sign = RSA-PrimeMismatch
+Sign = RSA-PrimeMismatch/Private
 Digest = SHA256
 Input = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
 Output = 6192b1ce630c87d02e8245fd74d4f6ecac37eef979d188c8fa48c4d355fbe814e7dd3152f42bb020d769b540d11867af5b947387b8c99158d56901ff3708e423931178213916ae1002f162c9d497aacacdcb20e6ffe7ed40138a253fc943ddf3587433df5831a3ce46aeefce358a009bf6bad12d82d77424c2755d984d7da196
@@ -671,9 +693,10 @@
 # Additional RSA-PSS and RSA-OAEP tests converted from
 # ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip
 
-PublicKey = RSA-PSS-1
+Key = RSA-PSS-1
 Algorithm = RSA
-Input = 30819f300d06092a864886f70d010101050003818d0030818902818100a56e4a0e701017589a5187dc7ea841d156f2ec0e36ad52a44dfeb1e61f7ad991d8c51056ffedb162b4c0f283a12a88a394dff526ab7291cbb307ceabfce0b1dfd5cd9508096d5b2b8b6df5d671ef6377c0921cb23c270a70e2598e6ff89d19f105acc2d3f0cb35f29280e1386b6f64c4ef22e1e1f20d0ce8cffb2249bd9a21370203010001
+SPKI = 30819f300d06092a864886f70d010101050003818d0030818902818100a56e4a0e701017589a5187dc7ea841d156f2ec0e36ad52a44dfeb1e61f7ad991d8c51056ffedb162b4c0f283a12a88a394dff526ab7291cbb307ceabfce0b1dfd5cd9508096d5b2b8b6df5d671ef6377c0921cb23c270a70e2598e6ff89d19f105acc2d3f0cb35f29280e1386b6f64c4ef22e1e1f20d0ce8cffb2249bd9a21370203010001
+RSAPublicKey = 30818902818100a56e4a0e701017589a5187dc7ea841d156f2ec0e36ad52a44dfeb1e61f7ad991d8c51056ffedb162b4c0f283a12a88a394dff526ab7291cbb307ceabfce0b1dfd5cd9508096d5b2b8b6df5d671ef6377c0921cb23c270a70e2598e6ff89d19f105acc2d3f0cb35f29280e1386b6f64c4ef22e1e1f20d0ce8cffb2249bd9a21370203010001
 
 Verify = RSA-PSS-1
 RSAPadding = PSS
@@ -711,9 +734,10 @@
 Input = 45eef191f4f79c31fe5d2ede7e5098994e929d2d
 Output = 2a34f6125e1f6b0bf971e84fbd41c632be8f2c2ace7de8b6926e31ff93e9af987fbc06e51e9be14f5198f91f3f953bd67da60a9df59764c3dc0fe08e1cbef0b75f868d10ad3fba749fef59fb6dac46a0d6e504369331586f58e4628f39aa278982543bc0eeb537dc61958019b394fb273f215858a0a01ac4d650b955c67f4c58
 
-PublicKey = RSA-PSS-2
+Key = RSA-PSS-2
 Algorithm = RSA
-Input = 30819f300d06092a864886f70d010101050003818d0030818902818101d40c1bcf97a68ae7cdbd8a7bf3e34fa19dcca4ef75a47454375f94514d88fed006fb829f8419ff87d6315da68a1ff3a0938e9abb3464011c303ad99199cf0c7c7a8b477dce829e8844f625b115e5e9c4a59cf8f8113b6834336a2fd2689b472cbb5e5cabe674350c59b6c17e176874fb42f8fc3d176a017edc61fd326c4b33c90203010001
+SPKI = 30819f300d06092a864886f70d010101050003818d0030818902818101d40c1bcf97a68ae7cdbd8a7bf3e34fa19dcca4ef75a47454375f94514d88fed006fb829f8419ff87d6315da68a1ff3a0938e9abb3464011c303ad99199cf0c7c7a8b477dce829e8844f625b115e5e9c4a59cf8f8113b6834336a2fd2689b472cbb5e5cabe674350c59b6c17e176874fb42f8fc3d176a017edc61fd326c4b33c90203010001
+RSAPublicKey = 30818902818101d40c1bcf97a68ae7cdbd8a7bf3e34fa19dcca4ef75a47454375f94514d88fed006fb829f8419ff87d6315da68a1ff3a0938e9abb3464011c303ad99199cf0c7c7a8b477dce829e8844f625b115e5e9c4a59cf8f8113b6834336a2fd2689b472cbb5e5cabe674350c59b6c17e176874fb42f8fc3d176a017edc61fd326c4b33c90203010001
 
 Verify = RSA-PSS-2
 RSAPadding = PSS
@@ -751,9 +775,10 @@
 Input = 7a6fdc1a4e434ecbc35d657ad49a2f4fafd43bc8
 Output = 00475b1648f814a8dc0abdc37b5527f543b666bb6e39d30e5b49d3b876dccc58eac14e32a2d55c2616014456ad2f246fc8e3d560da3ddf379a1c0bd200f10221df078c219a151bc8d4ec9d2fc2564467811014ef15d8ea01c2ebbff8c2c8efab38096e55fcbe3285c7aa558851254faffa92c1c72b78758663ef4582843139d7a6
 
-PublicKey = RSA-PSS-3
+Key = RSA-PSS-3
 Algorithm = RSA
-Input = 30819f300d06092a864886f70d010101050003818d0030818902818102f246ef451ed3eebb9a310200cc25859c048e4be798302991112eb68ce6db674e280da21feded1ae74880ca522b18db249385012827c515f0e466a1ffa691d98170574e9d0eadb087586ca48933da3cc953d95bd0ed50de10ddcb6736107d6c831c7f663e833ca4c097e700ce0fb945f88fb85fe8e5a773172565b914a471a4430203010001
+SPKI = 30819f300d06092a864886f70d010101050003818d0030818902818102f246ef451ed3eebb9a310200cc25859c048e4be798302991112eb68ce6db674e280da21feded1ae74880ca522b18db249385012827c515f0e466a1ffa691d98170574e9d0eadb087586ca48933da3cc953d95bd0ed50de10ddcb6736107d6c831c7f663e833ca4c097e700ce0fb945f88fb85fe8e5a773172565b914a471a4430203010001
+RSAPublicKey = 30818902818102f246ef451ed3eebb9a310200cc25859c048e4be798302991112eb68ce6db674e280da21feded1ae74880ca522b18db249385012827c515f0e466a1ffa691d98170574e9d0eadb087586ca48933da3cc953d95bd0ed50de10ddcb6736107d6c831c7f663e833ca4c097e700ce0fb945f88fb85fe8e5a773172565b914a471a4430203010001
 
 Verify = RSA-PSS-3
 RSAPadding = PSS
@@ -791,9 +816,10 @@
 Input = f1bf6ca7b4bbdbb6bf20a4bf55728725d177154a
 Output = 012fafec862f56e9e92f60ab0c77824f4299a0ca734ed26e0644d5d222c7f0bde03964f8e70a5cb65ed44e44d56ae0edf1ff86ca032cc5dd4404dbb76ab854586c44eed8336d08d457ce6c03693b45c0f1efef93624b95b8ec169c616d20e5538ebc0b6737a6f82b4bc0570924fc6b35759a3348426279f8b3d7744e2d222426ce
 
-PublicKey = RSA-PSS-4
+Key = RSA-PSS-4
 Algorithm = RSA
-Input = 30819f300d06092a864886f70d010101050003818d00308189028181054adb7886447efe6f57e0368f06cf52b0a3370760d161cef126b91be7f89c421b62a6ec1da3c311d75ed50e0ab5fff3fd338acc3aa8a4e77ee26369acb81ba900fa83f5300cf9bb6c53ad1dc8a178b815db4235a9a9da0c06de4e615ea1277ce559e9c108de58c14a81aa77f5a6f8d1335494498848c8b95940740be7bf7c37050203010001
+SPKI = 30819f300d06092a864886f70d010101050003818d00308189028181054adb7886447efe6f57e0368f06cf52b0a3370760d161cef126b91be7f89c421b62a6ec1da3c311d75ed50e0ab5fff3fd338acc3aa8a4e77ee26369acb81ba900fa83f5300cf9bb6c53ad1dc8a178b815db4235a9a9da0c06de4e615ea1277ce559e9c108de58c14a81aa77f5a6f8d1335494498848c8b95940740be7bf7c37050203010001
+RSAPublicKey = 308189028181054adb7886447efe6f57e0368f06cf52b0a3370760d161cef126b91be7f89c421b62a6ec1da3c311d75ed50e0ab5fff3fd338acc3aa8a4e77ee26369acb81ba900fa83f5300cf9bb6c53ad1dc8a178b815db4235a9a9da0c06de4e615ea1277ce559e9c108de58c14a81aa77f5a6f8d1335494498848c8b95940740be7bf7c37050203010001
 
 Verify = RSA-PSS-4
 RSAPadding = PSS
@@ -831,9 +857,10 @@
 Input = 72ce251d17b04dd3970d6ff1fbe3624899e9e941
 Output = 00938dcb6d583046065f69c78da7a1f1757066a7fa75125a9d2929f0b79a60b627b082f11f5b196f28eb9daa6f21c05e5140f6aef1737d2023075c05ecf04a028c686a2ab3e7d5a0664f295ce12995e890908b6ad21f0839eb65b70393a7b5afd9871de0caa0cedec5b819626756209d13ab1e7bb9546a26ff37e9a51af9fd562e
 
-PublicKey = RSA-PSS-5
+Key = RSA-PSS-5
 Algorithm = RSA
-Input = 30819f300d06092a864886f70d010101050003818d003081890281810d10f661f29940f5ed39aa260966deb47843679d2b6fb25b3de370f3ac7c19916391fd25fb527ebfa6a4b4df45a1759d996c4bb4ebd18828c44fc52d0191871740525f47a4b0cc8da325ed8aa676b0d0f626e0a77f07692170acac8082f42faa7dc7cd123e730e31a87985204cabcbe6670d43a2dd2b2ddef5e05392fc213bc5070203010001
+SPKI = 30819f300d06092a864886f70d010101050003818d003081890281810d10f661f29940f5ed39aa260966deb47843679d2b6fb25b3de370f3ac7c19916391fd25fb527ebfa6a4b4df45a1759d996c4bb4ebd18828c44fc52d0191871740525f47a4b0cc8da325ed8aa676b0d0f626e0a77f07692170acac8082f42faa7dc7cd123e730e31a87985204cabcbe6670d43a2dd2b2ddef5e05392fc213bc5070203010001
+RSAPublicKey = 3081890281810d10f661f29940f5ed39aa260966deb47843679d2b6fb25b3de370f3ac7c19916391fd25fb527ebfa6a4b4df45a1759d996c4bb4ebd18828c44fc52d0191871740525f47a4b0cc8da325ed8aa676b0d0f626e0a77f07692170acac8082f42faa7dc7cd123e730e31a87985204cabcbe6670d43a2dd2b2ddef5e05392fc213bc5070203010001
 
 Verify = RSA-PSS-5
 RSAPadding = PSS
@@ -871,9 +898,10 @@
 Input = 29926bc3280c841f601acd0d6f17ea38023eddbc
 Output = 02802dccfa8dfaf5279bf0b4a29ba1b157611faeaaf419b8919d15941900c1339e7e92e6fae562c53e6cc8e84104b110bce03ad18525e3c49a0eadad5d3f28f244a8ed89edbafbb686277cfa8ae909714d6b28f4bf8e293aa04c41efe7c0a81266d5c061e2575be032aa464674ff71626219bd74cc45f0e7ed4e3ff96eee758e8f
 
-PublicKey = RSA-PSS-6
+Key = RSA-PSS-6
 Algorithm = RSA
-Input = 30819f300d06092a864886f70d010101050003818d00308189028181164ca31cff609f3a0e7101b039f2e4fe6dd37519ab98598d179e174996598071f47d3a04559158d7be373cf1aa53f0aa6ef09039e5678c2a4c63900514c8c4f8aaed5de12a5f10b09c311af8c0ffb5b7a297f2efc63b8d6b0510931f0b98e48bf5fc6ec4e7b8db1ffaeb08c38e02adb8f03a48229c99e969431f61cb8c4dc698d10203010001
+SPKI = 30819f300d06092a864886f70d010101050003818d00308189028181164ca31cff609f3a0e7101b039f2e4fe6dd37519ab98598d179e174996598071f47d3a04559158d7be373cf1aa53f0aa6ef09039e5678c2a4c63900514c8c4f8aaed5de12a5f10b09c311af8c0ffb5b7a297f2efc63b8d6b0510931f0b98e48bf5fc6ec4e7b8db1ffaeb08c38e02adb8f03a48229c99e969431f61cb8c4dc698d10203010001
+RSAPublicKey = 308189028181164ca31cff609f3a0e7101b039f2e4fe6dd37519ab98598d179e174996598071f47d3a04559158d7be373cf1aa53f0aa6ef09039e5678c2a4c63900514c8c4f8aaed5de12a5f10b09c311af8c0ffb5b7a297f2efc63b8d6b0510931f0b98e48bf5fc6ec4e7b8db1ffaeb08c38e02adb8f03a48229c99e969431f61cb8c4dc698d10203010001
 
 Verify = RSA-PSS-6
 RSAPadding = PSS
@@ -911,9 +939,10 @@
 Input = de2fa0367ef49083ff89b9905d3fd646fcc12c38
 Output = 0a40a16e2fe2b38d1df90546167cf9469c9e3c3681a3442b4b2c2f581deb385ce99fc6188bb02a841d56e76d301891e24560550fcc2a26b55f4ccb26d837d350a154bcaca8392d98fa67959e9727b78cad03269f56968fc56b68bd679926d83cc9cb215550645ccda31c760ff35888943d2d8a1d351e81e5d07b86182e751081ef
 
-PublicKey = RSA-PSS-7
+Key = RSA-PSS-7
 Algorithm = RSA
-Input = 30819f300d06092a864886f70d010101050003818d0030818902818137c9da4a66c8c408b8da27d0c9d79f8ccb1eafc1d2fe48746d940b7c4ef5dee18ad12647cefaa0c4b3188b221c515386759b93f02024b25ab9242f8357d8f3fd49640ee5e643eaf6c64deefa7089727c8ff03993333915c6ef21bf5975b6e50d118b51008ec33e9f01a0a545a10a836a43ddbca9d8b5c5d3548022d7064ea29ab30203010001
+SPKI = 30819f300d06092a864886f70d010101050003818d0030818902818137c9da4a66c8c408b8da27d0c9d79f8ccb1eafc1d2fe48746d940b7c4ef5dee18ad12647cefaa0c4b3188b221c515386759b93f02024b25ab9242f8357d8f3fd49640ee5e643eaf6c64deefa7089727c8ff03993333915c6ef21bf5975b6e50d118b51008ec33e9f01a0a545a10a836a43ddbca9d8b5c5d3548022d7064ea29ab30203010001
+RSAPublicKey = 30818902818137c9da4a66c8c408b8da27d0c9d79f8ccb1eafc1d2fe48746d940b7c4ef5dee18ad12647cefaa0c4b3188b221c515386759b93f02024b25ab9242f8357d8f3fd49640ee5e643eaf6c64deefa7089727c8ff03993333915c6ef21bf5975b6e50d118b51008ec33e9f01a0a545a10a836a43ddbca9d8b5c5d3548022d7064ea29ab30203010001
 
 Verify = RSA-PSS-7
 RSAPadding = PSS
@@ -951,9 +980,10 @@
 Input = 49f6cc58365e514e1a3f301f4de16f9fb5347ff2
 Output = 18da3cdcfe79bfb77fd9c32f377ad399146f0a8e810620233271a6e3ed3248903f5cdc92dc79b55d3e11615aa056a795853792a3998c349ca5c457e8ca7d29d796aa24f83491709befcfb1510ea513c92829a3f00b104f655634f320752e130ec0ccf6754ff893db302932bb025eb60e87822598fc619e0e981737a9a4c4152d33
 
-PublicKey = RSA-PSS-8
+Key = RSA-PSS-8
 Algorithm = RSA
-Input = 30819f300d06092a864886f70d010101050003818d00308189028181495370a1fb18543c16d3631e3163255df62be6eee890d5f25509e4f778a8ea6fbbbcdf85dff64e0d972003ab3681fbba6dd41fd541829b2e582de9f2a4a4e0a2d0900bef4753db3cee0ee06c7dfae8b1d53b5953218f9cceea695b08668edeaadced9463b1d790d5ebf27e9115b46cad4d9a2b8efab0561b0810344739ada0733f0203010001
+SPKI = 30819f300d06092a864886f70d010101050003818d00308189028181495370a1fb18543c16d3631e3163255df62be6eee890d5f25509e4f778a8ea6fbbbcdf85dff64e0d972003ab3681fbba6dd41fd541829b2e582de9f2a4a4e0a2d0900bef4753db3cee0ee06c7dfae8b1d53b5953218f9cceea695b08668edeaadced9463b1d790d5ebf27e9115b46cad4d9a2b8efab0561b0810344739ada0733f0203010001
+RSAPublicKey = 308189028181495370a1fb18543c16d3631e3163255df62be6eee890d5f25509e4f778a8ea6fbbbcdf85dff64e0d972003ab3681fbba6dd41fd541829b2e582de9f2a4a4e0a2d0900bef4753db3cee0ee06c7dfae8b1d53b5953218f9cceea695b08668edeaadced9463b1d790d5ebf27e9115b46cad4d9a2b8efab0561b0810344739ada0733f0203010001
 
 Verify = RSA-PSS-8
 RSAPadding = PSS
@@ -991,9 +1021,10 @@
 Input = 65033bc2f67d6aba7d526acb873b8d9241e5e4d9
 Output = 1ed1d848fb1edb44129bd9b354795af97a069a7a00d0151048593e0c72c3517ff9ff2a41d0cb5a0ac860d736a199704f7cb6a53986a88bbd8abcc0076a2ce847880031525d449da2ac78356374c536e343faa7cba42a5aaa6506087791c06a8e989335aed19bfab2d5e67e27fb0c2875af896c21b6e8e7309d04e4f6727e69463e
 
-PublicKey = RSA-PSS-9
+Key = RSA-PSS-9
 Algorithm = RSA
-Input = 3081df300d06092a864886f70d01010105000381cd003081c90281c100e6bd692ac96645790403fdd0f5beb8b9bf92ed10007fc365046419dd06c05c5b5b2f48ecf989e4ce269109979cbb40b4a0ad24d22483d1ee315ad4ccb1534268352691c524f6dd8e6c29d224cf246973aec86c5bf6b1401a850d1b9ad1bb8cbcec47b06f0f8c7f45d3fc8f319299c5433ddbc2b3053b47ded2ecd4a4caefd614833dc8bb622f317ed076b8057fe8de3f84480ad5e83e4a61904a4f248fb397027357e1d30e463139815c6fd4fd5ac5b8172a45230ecb6318a04f1455d84e5a8b0203010001
+SPKI = 3081df300d06092a864886f70d01010105000381cd003081c90281c100e6bd692ac96645790403fdd0f5beb8b9bf92ed10007fc365046419dd06c05c5b5b2f48ecf989e4ce269109979cbb40b4a0ad24d22483d1ee315ad4ccb1534268352691c524f6dd8e6c29d224cf246973aec86c5bf6b1401a850d1b9ad1bb8cbcec47b06f0f8c7f45d3fc8f319299c5433ddbc2b3053b47ded2ecd4a4caefd614833dc8bb622f317ed076b8057fe8de3f84480ad5e83e4a61904a4f248fb397027357e1d30e463139815c6fd4fd5ac5b8172a45230ecb6318a04f1455d84e5a8b0203010001
+RSAPublicKey = 3081c90281c100e6bd692ac96645790403fdd0f5beb8b9bf92ed10007fc365046419dd06c05c5b5b2f48ecf989e4ce269109979cbb40b4a0ad24d22483d1ee315ad4ccb1534268352691c524f6dd8e6c29d224cf246973aec86c5bf6b1401a850d1b9ad1bb8cbcec47b06f0f8c7f45d3fc8f319299c5433ddbc2b3053b47ded2ecd4a4caefd614833dc8bb622f317ed076b8057fe8de3f84480ad5e83e4a61904a4f248fb397027357e1d30e463139815c6fd4fd5ac5b8172a45230ecb6318a04f1455d84e5a8b0203010001
 
 Verify = RSA-PSS-9
 RSAPadding = PSS
@@ -1031,9 +1062,10 @@
 Input = b9dfd1df76a461c51e6576c6c8ed0a923d1c50e7
 Output = a7fdb0d259165ca2c88d00bbf1028a867d337699d061193b17a9648e14ccbbaadeacaacdec815e7571294ebb8a117af205fa078b47b0712c199e3ad05135c504c24b81705115740802487992ffd511d4afc6b854491eb3f0dd523139542ff15c3101ee85543517c6a3c79417c67e2dd9aa741e9a29b06dcb593c2336b3670ae3afbac7c3e76e215473e866e338ca244de00b62624d6b9426822ceae9f8cc460895f41250073fd45c5a1e7b425c204a423a699159f6903e710b37a7bb2bc8049f
 
-PublicKey = RSA-PSS-10
+Key = RSA-PSS-10
 Algorithm = RSA
-Input = 30820122300d06092a864886f70d01010105000382010f003082010a0282010100a5dd867ac4cb02f90b9457d48c14a770ef991c56c39c0ec65fd11afa8937cea57b9be7ac73b45c0017615b82d622e318753b6027c0fd157be12f8090fee2a7adcd0eef759f88ba4997c7a42d58c9aa12cb99ae001fe521c13bb5431445a8d5ae4f5e4c7e948ac227d3604071f20e577e905fbeb15dfaf06d1de5ae6253d63a6a2120b31a5da5dabc9550600e20f27d3739e2627925fea3cc509f21dff04e6eea4549c540d6809ff9307eede91fff58733d8385a237d6d3705a33e391900992070df7adf1357cf7e3700ce3667de83f17b8df1778db381dce09cb4ad058a511001a738198ee27cf55a13b754539906582ec8b174bd58d5d1f3d767c613721ae050203010001
+SPKI = 30820122300d06092a864886f70d01010105000382010f003082010a0282010100a5dd867ac4cb02f90b9457d48c14a770ef991c56c39c0ec65fd11afa8937cea57b9be7ac73b45c0017615b82d622e318753b6027c0fd157be12f8090fee2a7adcd0eef759f88ba4997c7a42d58c9aa12cb99ae001fe521c13bb5431445a8d5ae4f5e4c7e948ac227d3604071f20e577e905fbeb15dfaf06d1de5ae6253d63a6a2120b31a5da5dabc9550600e20f27d3739e2627925fea3cc509f21dff04e6eea4549c540d6809ff9307eede91fff58733d8385a237d6d3705a33e391900992070df7adf1357cf7e3700ce3667de83f17b8df1778db381dce09cb4ad058a511001a738198ee27cf55a13b754539906582ec8b174bd58d5d1f3d767c613721ae050203010001
+RSAPublicKey = 3082010a0282010100a5dd867ac4cb02f90b9457d48c14a770ef991c56c39c0ec65fd11afa8937cea57b9be7ac73b45c0017615b82d622e318753b6027c0fd157be12f8090fee2a7adcd0eef759f88ba4997c7a42d58c9aa12cb99ae001fe521c13bb5431445a8d5ae4f5e4c7e948ac227d3604071f20e577e905fbeb15dfaf06d1de5ae6253d63a6a2120b31a5da5dabc9550600e20f27d3739e2627925fea3cc509f21dff04e6eea4549c540d6809ff9307eede91fff58733d8385a237d6d3705a33e391900992070df7adf1357cf7e3700ce3667de83f17b8df1778db381dce09cb4ad058a511001a738198ee27cf55a13b754539906582ec8b174bd58d5d1f3d767c613721ae050203010001
 
 Verify = RSA-PSS-10
 RSAPadding = PSS
@@ -1071,401 +1103,431 @@
 Input = 122196deb5d122bd8c6fc781ff6924d7c695aade
 Output = 6d3b5b87f67ea657af21f75441977d2180f91b2c5f692de82955696a686730d9b9778d970758ccb26071c2209ffbd6125be2e96ea81b67cb9b9308239fda17f7b2b64ecda096b6b935640a5a1cb42a9155b1c9ef7a633a02c59f0d6ee59b852c43b35029e73c940ff0410e8f114eed46bbd0fae165e42be2528a401c3b28fd818ef3232dca9f4d2a0f5166ec59c42396d6c11dbc1215a56fa17169db9575343ef34f9de32a49cdc3174922f229c23e18e45df9353119ec4319cedce7a17c64088c1f6f52be29634100b3919d38f3d1ed94e6891e66a73b8fb849f5874df59459e298c7bbce2eee782a195aa66fe2d0732b25e595f57d3e061b1fc3e4063bf98f
 
-PrivateKey = RSA-OAEP-1
+Key = RSA-OAEP-1
 Algorithm = RSA
-Input = 30820276020100300d06092a864886f70d0101010500048202603082025c02010002818100a8b3b284af8eb50b387034a860f146c4919f318763cd6c5598c8ae4811a1e0abc4c7e0b082d693a5e7fced675cf4668512772c0cbc64a742c6c630f533c8cc72f62ae833c40bf25842e984bb78bdbf97c0107d55bdb662f5c4e0fab9845cb5148ef7392dd3aaff93ae1e6b667bb3d4247616d4f5ba10d4cfd226de88d39f16fb020301000102818053339cfdb79fc8466a655c7316aca85c55fd8f6dd898fdaf119517ef4f52e8fd8e258df93fee180fa0e4ab29693cd83b152a553d4ac4d1812b8b9fa5af0e7f55fe7304df41570926f3311f15c4d65a732c483116ee3d3d2d0af3549ad9bf7cbfb78ad884f84d5beb04724dc7369b31def37d0cf539e9cfcdd3de653729ead5d1024100d32737e7267ffe1341b2d5c0d150a81b586fb3132bed2f8d5262864a9cb9f30af38be448598d413a172efb802c21acf1c11c520c2f26a471dcad212eac7ca39d024100cc8853d1d54da630fac004f471f281c7b8982d8224a490edbeb33d3e3d5cc93c4765703d1dd791642f1f116a0dd852be2419b2af72bfe9a030e860b0288b5d7702400e12bf1718e9cef5599ba1c3882fe8046a90874eefce8f2ccc20e4f2741fb0a33a3848aec9c9305fbecbd2d76819967d4671acc6431e4037968db37878e695c102410095297b0f95a2fa67d00707d609dfd4fc05c89dafc2ef6d6ea55bec771ea333734d9251e79082ecda866efef13c459e1a631386b7e354c899f5f112ca85d7158302404f456c502493bdc0ed2ab756a3a6ed4d67352a697d4216e93212b127a63d5411ce6fa98d5dbefd73263e3728142743818166ed7dd63687dd2a8ca1d2f4fbd8e1
+PKCS8 = 30820276020100300d06092a864886f70d0101010500048202603082025c02010002818100a8b3b284af8eb50b387034a860f146c4919f318763cd6c5598c8ae4811a1e0abc4c7e0b082d693a5e7fced675cf4668512772c0cbc64a742c6c630f533c8cc72f62ae833c40bf25842e984bb78bdbf97c0107d55bdb662f5c4e0fab9845cb5148ef7392dd3aaff93ae1e6b667bb3d4247616d4f5ba10d4cfd226de88d39f16fb020301000102818053339cfdb79fc8466a655c7316aca85c55fd8f6dd898fdaf119517ef4f52e8fd8e258df93fee180fa0e4ab29693cd83b152a553d4ac4d1812b8b9fa5af0e7f55fe7304df41570926f3311f15c4d65a732c483116ee3d3d2d0af3549ad9bf7cbfb78ad884f84d5beb04724dc7369b31def37d0cf539e9cfcdd3de653729ead5d1024100d32737e7267ffe1341b2d5c0d150a81b586fb3132bed2f8d5262864a9cb9f30af38be448598d413a172efb802c21acf1c11c520c2f26a471dcad212eac7ca39d024100cc8853d1d54da630fac004f471f281c7b8982d8224a490edbeb33d3e3d5cc93c4765703d1dd791642f1f116a0dd852be2419b2af72bfe9a030e860b0288b5d7702400e12bf1718e9cef5599ba1c3882fe8046a90874eefce8f2ccc20e4f2741fb0a33a3848aec9c9305fbecbd2d76819967d4671acc6431e4037968db37878e695c102410095297b0f95a2fa67d00707d609dfd4fc05c89dafc2ef6d6ea55bec771ea333734d9251e79082ecda866efef13c459e1a631386b7e354c899f5f112ca85d7158302404f456c502493bdc0ed2ab756a3a6ed4d67352a697d4216e93212b127a63d5411ce6fa98d5dbefd73263e3728142743818166ed7dd63687dd2a8ca1d2f4fbd8e1
+SPKI = 30819f300d06092a864886f70d010101050003818d0030818902818100a8b3b284af8eb50b387034a860f146c4919f318763cd6c5598c8ae4811a1e0abc4c7e0b082d693a5e7fced675cf4668512772c0cbc64a742c6c630f533c8cc72f62ae833c40bf25842e984bb78bdbf97c0107d55bdb662f5c4e0fab9845cb5148ef7392dd3aaff93ae1e6b667bb3d4247616d4f5ba10d4cfd226de88d39f16fb0203010001
+RSAPublicKey = 30818902818100a8b3b284af8eb50b387034a860f146c4919f318763cd6c5598c8ae4811a1e0abc4c7e0b082d693a5e7fced675cf4668512772c0cbc64a742c6c630f533c8cc72f62ae833c40bf25842e984bb78bdbf97c0107d55bdb662f5c4e0fab9845cb5148ef7392dd3aaff93ae1e6b667bb3d4247616d4f5ba10d4cfd226de88d39f16fb0203010001
+RSAPrivateKey = 3082025c02010002818100a8b3b284af8eb50b387034a860f146c4919f318763cd6c5598c8ae4811a1e0abc4c7e0b082d693a5e7fced675cf4668512772c0cbc64a742c6c630f533c8cc72f62ae833c40bf25842e984bb78bdbf97c0107d55bdb662f5c4e0fab9845cb5148ef7392dd3aaff93ae1e6b667bb3d4247616d4f5ba10d4cfd226de88d39f16fb020301000102818053339cfdb79fc8466a655c7316aca85c55fd8f6dd898fdaf119517ef4f52e8fd8e258df93fee180fa0e4ab29693cd83b152a553d4ac4d1812b8b9fa5af0e7f55fe7304df41570926f3311f15c4d65a732c483116ee3d3d2d0af3549ad9bf7cbfb78ad884f84d5beb04724dc7369b31def37d0cf539e9cfcdd3de653729ead5d1024100d32737e7267ffe1341b2d5c0d150a81b586fb3132bed2f8d5262864a9cb9f30af38be448598d413a172efb802c21acf1c11c520c2f26a471dcad212eac7ca39d024100cc8853d1d54da630fac004f471f281c7b8982d8224a490edbeb33d3e3d5cc93c4765703d1dd791642f1f116a0dd852be2419b2af72bfe9a030e860b0288b5d7702400e12bf1718e9cef5599ba1c3882fe8046a90874eefce8f2ccc20e4f2741fb0a33a3848aec9c9305fbecbd2d76819967d4671acc6431e4037968db37878e695c102410095297b0f95a2fa67d00707d609dfd4fc05c89dafc2ef6d6ea55bec771ea333734d9251e79082ecda866efef13c459e1a631386b7e354c899f5f112ca85d7158302404f456c502493bdc0ed2ab756a3a6ed4d67352a697d4216e93212b127a63d5411ce6fa98d5dbefd73263e3728142743818166ed7dd63687dd2a8ca1d2f4fbd8e1
 
-Decrypt = RSA-OAEP-1
+Decrypt = RSA-OAEP-1/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 354fe67b4a126d5d35fe36c777791a3f7ba13def484e2d3908aff722fad468fb21696de95d0be911c2d3174f8afcc201035f7b6d8e69402de5451618c21a535fa9d7bfc5b8dd9fc243f8cf927db31322d6e881eaa91a996170e657a05a266426d98c88003f8477c1227094a0d9fa1e8c4024309ce1ecccb5210035d47ac72e8a
 Output = 6628194e12073db03ba94cda9ef9532397d50dba79b987004afefe34
 
-Decrypt = RSA-OAEP-1
+Decrypt = RSA-OAEP-1/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 640db1acc58e0568fe5407e5f9b701dff8c3c91e716c536fc7fcec6cb5b71c1165988d4a279e1577d730fc7a29932e3f00c81515236d8d8e31017a7a09df4352d904cdeb79aa583adcc31ea698a4c05283daba9089be5491f67c1a4ee48dc74bbbe6643aef846679b4cb395a352d5ed115912df696ffe0702932946d71492b44
 Output = 750c4047f547e8e41411856523298ac9bae245efaf1397fbe56f9dd5
 
-Decrypt = RSA-OAEP-1
+Decrypt = RSA-OAEP-1/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 423736ed035f6026af276c35c0b3741b365e5f76ca091b4e8c29e2f0befee603595aa8322d602d2e625e95eb81b2f1c9724e822eca76db8618cf09c5343503a4360835b5903bc637e3879fb05e0ef32685d5aec5067cd7cc96fe4b2670b6eac3066b1fcf5686b68589aafb7d629b02d8f8625ca3833624d4800fb081b1cf94eb
 Output = d94ae0832e6445ce42331cb06d531a82b1db4baad30f746dc916df24d4e3c2451fff59a6423eb0e1d02d4fe646cf699dfd818c6e97b051
 
-Decrypt = RSA-OAEP-1
+Decrypt = RSA-OAEP-1/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 45ead4ca551e662c9800f1aca8283b0525e6abae30be4b4aba762fa40fd3d38e22abefc69794f6ebbbc05ddbb11216247d2f412fd0fba87c6e3acd888813646fd0e48e785204f9c3f73d6d8239562722dddd8771fec48b83a31ee6f592c4cfd4bc88174f3b13a112aae3b9f7b80e0fc6f7255ba880dc7d8021e22ad6a85f0755
 Output = 52e650d98e7f2a048b4f86852153b97e01dd316f346a19f67a85
 
-Decrypt = RSA-OAEP-1
+Decrypt = RSA-OAEP-1/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 36f6e34d94a8d34daacba33a2139d00ad85a9345a86051e73071620056b920e219005855a213a0f23897cdcd731b45257c777fe908202befdd0b58386b1244ea0cf539a05d5d10329da44e13030fd760dcd644cfef2094d1910d3f433e1c7c6dd18bc1f2df7f643d662fb9dd37ead9059190f4fa66ca39e869c4eb449cbdc439
 Output = 8da89fd9e5f974a29feffb462b49180f6cf9e802
 
-Decrypt = RSA-OAEP-1
+Decrypt = RSA-OAEP-1/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 42cee2617b1ecea4db3f4829386fbd61dafbf038e180d837c96366df24c097b4ab0fac6bdf590d821c9f10642e681ad05b8d78b378c0f46ce2fad63f74e0ad3df06b075d7eb5f5636f8d403b9059ca761b5c62bb52aa45002ea70baace08ded243b9d8cbd62a68ade265832b56564e43a6fa42ed199a099769742df1539e8255
 Output = 26521050844271
 
-PrivateKey = RSA-OAEP-2
+Key = RSA-OAEP-2
 Algorithm = RSA
-Input = 30820276020100300d06092a864886f70d0101010500048202603082025c02010002818101947c7fce90425f47279e70851f25d5e62316fe8a1df19371e3e628e260543e4901ef6081f68c0b8141190d2ae8daba7d1250ec6db636e944ec3722877c7c1d0a67f14b1694c5f0379451a43e49a32dde83670b73da91a1c99bc23b436a60055c610f0baf99c1a079565b95a3f1526632d1d4da60f20eda25e653c4f002766f4502030100010281800823f20fadb5da89088a9d00893e21fa4a1b11fbc93c64a3be0baaea97fb3b93c3ff713704c19c963c1d107aae99054739f79e02e186de86f87a6ddefea6d8ccd1d3c81a47bfa7255be20601a4a4b2f08a167b5e279d715b1b455bdd7eab245941d9768b9acefb3ccda5952da3cee72525b4501663a8ee15c9e992d92462fe3902410159dbde04a33ef06fb608b80b190f4d3e22bcc13ac8e4a081033abfa416edb0b338aa08b57309ea5a5240e7dc6e54378c69414c31d97ddb1f406db3769cc41a430241012b652f30403b38b40995fd6ff41a1acc8ada70373236b7202d39b2ee30cfb46db09511f6f307cc61cc21606c18a75b8a62f822df031ba0df0dafd5506f568bd70240436ef508de736519c2da4c580d98c82cb7452a3fb5efadc3b9c7789a1bc6584f795addbbd32439c74686552ecb6c2c307a4d3af7f539eec157248c7b31f1a2550241012b15a89f3dfb2b39073e73f02bdd0c1a7b379dd435f05cdde2eff9e462948b7cec62ee9050d5e0816e0785a856b49108dcb75f3683874d1ca6329a19013066ff02400270db17d5914b018d76118b24389a7350ec836b0063a21721236fd8edb6d89b51e7eeb87b611b7132cb7ea7356c23151c1e7751507c786d9ee1794170a8c8e8
+PKCS8 = 30820276020100300d06092a864886f70d0101010500048202603082025c02010002818101947c7fce90425f47279e70851f25d5e62316fe8a1df19371e3e628e260543e4901ef6081f68c0b8141190d2ae8daba7d1250ec6db636e944ec3722877c7c1d0a67f14b1694c5f0379451a43e49a32dde83670b73da91a1c99bc23b436a60055c610f0baf99c1a079565b95a3f1526632d1d4da60f20eda25e653c4f002766f4502030100010281800823f20fadb5da89088a9d00893e21fa4a1b11fbc93c64a3be0baaea97fb3b93c3ff713704c19c963c1d107aae99054739f79e02e186de86f87a6ddefea6d8ccd1d3c81a47bfa7255be20601a4a4b2f08a167b5e279d715b1b455bdd7eab245941d9768b9acefb3ccda5952da3cee72525b4501663a8ee15c9e992d92462fe3902410159dbde04a33ef06fb608b80b190f4d3e22bcc13ac8e4a081033abfa416edb0b338aa08b57309ea5a5240e7dc6e54378c69414c31d97ddb1f406db3769cc41a430241012b652f30403b38b40995fd6ff41a1acc8ada70373236b7202d39b2ee30cfb46db09511f6f307cc61cc21606c18a75b8a62f822df031ba0df0dafd5506f568bd70240436ef508de736519c2da4c580d98c82cb7452a3fb5efadc3b9c7789a1bc6584f795addbbd32439c74686552ecb6c2c307a4d3af7f539eec157248c7b31f1a2550241012b15a89f3dfb2b39073e73f02bdd0c1a7b379dd435f05cdde2eff9e462948b7cec62ee9050d5e0816e0785a856b49108dcb75f3683874d1ca6329a19013066ff02400270db17d5914b018d76118b24389a7350ec836b0063a21721236fd8edb6d89b51e7eeb87b611b7132cb7ea7356c23151c1e7751507c786d9ee1794170a8c8e8
+SPKI = 30819f300d06092a864886f70d010101050003818d0030818902818101947c7fce90425f47279e70851f25d5e62316fe8a1df19371e3e628e260543e4901ef6081f68c0b8141190d2ae8daba7d1250ec6db636e944ec3722877c7c1d0a67f14b1694c5f0379451a43e49a32dde83670b73da91a1c99bc23b436a60055c610f0baf99c1a079565b95a3f1526632d1d4da60f20eda25e653c4f002766f450203010001
+RSAPublicKey = 30818902818101947c7fce90425f47279e70851f25d5e62316fe8a1df19371e3e628e260543e4901ef6081f68c0b8141190d2ae8daba7d1250ec6db636e944ec3722877c7c1d0a67f14b1694c5f0379451a43e49a32dde83670b73da91a1c99bc23b436a60055c610f0baf99c1a079565b95a3f1526632d1d4da60f20eda25e653c4f002766f450203010001
+RSAPrivateKey = 3082025c02010002818101947c7fce90425f47279e70851f25d5e62316fe8a1df19371e3e628e260543e4901ef6081f68c0b8141190d2ae8daba7d1250ec6db636e944ec3722877c7c1d0a67f14b1694c5f0379451a43e49a32dde83670b73da91a1c99bc23b436a60055c610f0baf99c1a079565b95a3f1526632d1d4da60f20eda25e653c4f002766f4502030100010281800823f20fadb5da89088a9d00893e21fa4a1b11fbc93c64a3be0baaea97fb3b93c3ff713704c19c963c1d107aae99054739f79e02e186de86f87a6ddefea6d8ccd1d3c81a47bfa7255be20601a4a4b2f08a167b5e279d715b1b455bdd7eab245941d9768b9acefb3ccda5952da3cee72525b4501663a8ee15c9e992d92462fe3902410159dbde04a33ef06fb608b80b190f4d3e22bcc13ac8e4a081033abfa416edb0b338aa08b57309ea5a5240e7dc6e54378c69414c31d97ddb1f406db3769cc41a430241012b652f30403b38b40995fd6ff41a1acc8ada70373236b7202d39b2ee30cfb46db09511f6f307cc61cc21606c18a75b8a62f822df031ba0df0dafd5506f568bd70240436ef508de736519c2da4c580d98c82cb7452a3fb5efadc3b9c7789a1bc6584f795addbbd32439c74686552ecb6c2c307a4d3af7f539eec157248c7b31f1a2550241012b15a89f3dfb2b39073e73f02bdd0c1a7b379dd435f05cdde2eff9e462948b7cec62ee9050d5e0816e0785a856b49108dcb75f3683874d1ca6329a19013066ff02400270db17d5914b018d76118b24389a7350ec836b0063a21721236fd8edb6d89b51e7eeb87b611b7132cb7ea7356c23151c1e7751507c786d9ee1794170a8c8e8
 
-Decrypt = RSA-OAEP-2
+Decrypt = RSA-OAEP-2/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 0181af8922b9fcb4d79d92ebe19815992fc0c1439d8bcd491398a0f4ad3a329a5bd9385560db532683c8b7da04e4b12aed6aacdf471c34c9cda891addcc2df3456653aa6382e9ae59b54455257eb099d562bbe10453f2b6d13c59c02e10f1f8abb5da0d0570932dacf2d0901db729d0fefcc054e70968ea540c81b04bcaefe720e
 Output = 8ff00caa605c702830634d9a6c3d42c652b58cf1d92fec570beee7
 
-Decrypt = RSA-OAEP-2
+Decrypt = RSA-OAEP-2/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 018759ff1df63b2792410562314416a8aeaf2ac634b46f940ab82d64dbf165eee33011da749d4bab6e2fcd18129c9e49277d8453112b429a222a8471b070993998e758861c4d3f6d749d91c4290d332c7a4ab3f7ea35ff3a07d497c955ff0ffc95006b62c6d296810d9bfab024196c7934012c2df978ef299aba239940cba10245
 Output = 2d
 
-Decrypt = RSA-OAEP-2
+Decrypt = RSA-OAEP-2/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 018802bab04c60325e81c4962311f2be7c2adce93041a00719c88f957575f2c79f1b7bc8ced115c706b311c08a2d986ca3b6a9336b147c29c6f229409ddec651bd1fdd5a0b7f610c9937fdb4a3a762364b8b3206b4ea485fd098d08f63d4aa8bb2697d027b750c32d7f74eaf5180d2e9b66b17cb2fa55523bc280da10d14be2053
 Output = 74fc88c51bc90f77af9d5e9a4a70133d4b4e0b34da3c37c7ef8e
 
-Decrypt = RSA-OAEP-2
+Decrypt = RSA-OAEP-2/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 00a4578cbc176318a638fba7d01df15746af44d4f6cd96d7e7c495cbf425b09c649d32bf886da48fbaf989a2117187cafb1fb580317690e3ccd446920b7af82b31db5804d87d01514acbfa9156e782f867f6bed9449e0e9a2c09bcecc6aa087636965e34b3ec766f2fe2e43018a2fddeb140616a0e9d82e5331024ee0652fc7641
 Output = a7eb2a5036931d27d4e891326d99692ffadda9bf7efd3e34e622c4adc085f721dfe885072c78a203b151739be540fa8c153a10f00a
 
-Decrypt = RSA-OAEP-2
+Decrypt = RSA-OAEP-2/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 00ebc5f5fda77cfdad3c83641a9025e77d72d8a6fb33a810f5950f8d74c73e8d931e8634d86ab1246256ae07b6005b71b7f2fb98351218331ce69b8ffbdc9da08bbc9c704f876deb9df9fc2ec065cad87f9090b07acc17aa7f997b27aca48806e897f771d95141fe4526d8a5301b678627efab707fd40fbebd6e792a25613e7aec
 Output = 2ef2b066f854c33f3bdcbb5994a435e73d6c6c
 
-Decrypt = RSA-OAEP-2
+Decrypt = RSA-OAEP-2/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 010839ec20c27b9052e55befb9b77e6fc26e9075d7a54378c646abdf51e445bd5715de81789f56f1803d9170764a9e93cb78798694023ee7393ce04bc5d8f8c5a52c171d43837e3aca62f609eb0aa5ffb0960ef04198dd754f57f7fbe6abf765cf118b4ca443b23b5aab266f952326ac4581100644325f8b721acd5d04ff14ef3a
 Output = 8a7fb344c8b6cb2cf2ef1f643f9a3218f6e19bba89c0
 
-PrivateKey = RSA-OAEP-3
+Key = RSA-OAEP-3
 Algorithm = RSA
-Input = 30820277020100300d06092a864886f70d0101010500048202613082025d02010002818102b58fec039a860700a4d7b6462f93e6cdd491161ddd74f4e810b40e3c1652006a5c277b2774c11305a4cbab5a78efa57e17a86df7a3fa36fc4b1d2249f22ec7c2dd6a463232accea906d66ebe80b5704b10729da6f833234abb5efdd4a292cbfad33b4d33fa7a14b8c397b56e3acd21203428b77cdfa33a6da706b3d8b0fc43e9020301000102818015b48a5b5683a94670e23b5718f814fa0e13f85038f50711182cba61510581f3d22c7e232ef937e22e551d68b86e2f8cb1aad8be2e488f5df7efd279e3f568d4eaf36f80cf7141ace60fcc9113fb6c4a841fd50bbc7c512ffcbeff21487aa811eb3ca8c62005346a86de86bfa1d8a948fd3f348c22eaadf333c3ce6ce13208fd024101bf01d216d73595cf0270c2beb78d40a0d8447d31da919a983f7eea781b77d85fe371b3e9373e7b69217d3150a02d8958de7fad9d555160958b4454127e0e7eaf0241018d3399658166db3829816d7b295416759e9c91987f5b2d8aecd63b04b48bd7b2fcf229bb7f8a6dc88ba13dd2e39ad55b6d1a06160708f9700be80b8fd3744ce7024006c0a249d20a6f2ee75c88b494d53f6aae99aa427c88c28b163a769445e5f390cf40c274fd6ea6329a5ce7c7ce03a2158396ee2a7845786e09e2885a9728e4e5024100d1d27c29fedd92d86c348edd0ccbfac14f746e051ce1d1811df35d61f2ee1c97d4bf2804802f6427187ba8e90a8af44243b4079b03445e602e29fa5193e64fe90241008cb2f756bd8941b1d3b770e5ad31ee373b28acda69ff9b6f40fe578b9f1afb85836f9627d37acff73c2779e634bb26011c2c8f7f3361ae2a9ea65ed689e3639a
+PKCS8 = 30820277020100300d06092a864886f70d0101010500048202613082025d02010002818102b58fec039a860700a4d7b6462f93e6cdd491161ddd74f4e810b40e3c1652006a5c277b2774c11305a4cbab5a78efa57e17a86df7a3fa36fc4b1d2249f22ec7c2dd6a463232accea906d66ebe80b5704b10729da6f833234abb5efdd4a292cbfad33b4d33fa7a14b8c397b56e3acd21203428b77cdfa33a6da706b3d8b0fc43e9020301000102818015b48a5b5683a94670e23b5718f814fa0e13f85038f50711182cba61510581f3d22c7e232ef937e22e551d68b86e2f8cb1aad8be2e488f5df7efd279e3f568d4eaf36f80cf7141ace60fcc9113fb6c4a841fd50bbc7c512ffcbeff21487aa811eb3ca8c62005346a86de86bfa1d8a948fd3f348c22eaadf333c3ce6ce13208fd024101bf01d216d73595cf0270c2beb78d40a0d8447d31da919a983f7eea781b77d85fe371b3e9373e7b69217d3150a02d8958de7fad9d555160958b4454127e0e7eaf0241018d3399658166db3829816d7b295416759e9c91987f5b2d8aecd63b04b48bd7b2fcf229bb7f8a6dc88ba13dd2e39ad55b6d1a06160708f9700be80b8fd3744ce7024006c0a249d20a6f2ee75c88b494d53f6aae99aa427c88c28b163a769445e5f390cf40c274fd6ea6329a5ce7c7ce03a2158396ee2a7845786e09e2885a9728e4e5024100d1d27c29fedd92d86c348edd0ccbfac14f746e051ce1d1811df35d61f2ee1c97d4bf2804802f6427187ba8e90a8af44243b4079b03445e602e29fa5193e64fe90241008cb2f756bd8941b1d3b770e5ad31ee373b28acda69ff9b6f40fe578b9f1afb85836f9627d37acff73c2779e634bb26011c2c8f7f3361ae2a9ea65ed689e3639a
+SPKI = 30819f300d06092a864886f70d010101050003818d0030818902818102b58fec039a860700a4d7b6462f93e6cdd491161ddd74f4e810b40e3c1652006a5c277b2774c11305a4cbab5a78efa57e17a86df7a3fa36fc4b1d2249f22ec7c2dd6a463232accea906d66ebe80b5704b10729da6f833234abb5efdd4a292cbfad33b4d33fa7a14b8c397b56e3acd21203428b77cdfa33a6da706b3d8b0fc43e90203010001
+RSAPublicKey = 30818902818102b58fec039a860700a4d7b6462f93e6cdd491161ddd74f4e810b40e3c1652006a5c277b2774c11305a4cbab5a78efa57e17a86df7a3fa36fc4b1d2249f22ec7c2dd6a463232accea906d66ebe80b5704b10729da6f833234abb5efdd4a292cbfad33b4d33fa7a14b8c397b56e3acd21203428b77cdfa33a6da706b3d8b0fc43e90203010001
+RSAPrivateKey = 3082025d02010002818102b58fec039a860700a4d7b6462f93e6cdd491161ddd74f4e810b40e3c1652006a5c277b2774c11305a4cbab5a78efa57e17a86df7a3fa36fc4b1d2249f22ec7c2dd6a463232accea906d66ebe80b5704b10729da6f833234abb5efdd4a292cbfad33b4d33fa7a14b8c397b56e3acd21203428b77cdfa33a6da706b3d8b0fc43e9020301000102818015b48a5b5683a94670e23b5718f814fa0e13f85038f50711182cba61510581f3d22c7e232ef937e22e551d68b86e2f8cb1aad8be2e488f5df7efd279e3f568d4eaf36f80cf7141ace60fcc9113fb6c4a841fd50bbc7c512ffcbeff21487aa811eb3ca8c62005346a86de86bfa1d8a948fd3f348c22eaadf333c3ce6ce13208fd024101bf01d216d73595cf0270c2beb78d40a0d8447d31da919a983f7eea781b77d85fe371b3e9373e7b69217d3150a02d8958de7fad9d555160958b4454127e0e7eaf0241018d3399658166db3829816d7b295416759e9c91987f5b2d8aecd63b04b48bd7b2fcf229bb7f8a6dc88ba13dd2e39ad55b6d1a06160708f9700be80b8fd3744ce7024006c0a249d20a6f2ee75c88b494d53f6aae99aa427c88c28b163a769445e5f390cf40c274fd6ea6329a5ce7c7ce03a2158396ee2a7845786e09e2885a9728e4e5024100d1d27c29fedd92d86c348edd0ccbfac14f746e051ce1d1811df35d61f2ee1c97d4bf2804802f6427187ba8e90a8af44243b4079b03445e602e29fa5193e64fe90241008cb2f756bd8941b1d3b770e5ad31ee373b28acda69ff9b6f40fe578b9f1afb85836f9627d37acff73c2779e634bb26011c2c8f7f3361ae2a9ea65ed689e3639a
 
-Decrypt = RSA-OAEP-3
+Decrypt = RSA-OAEP-3/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 026a0485d96aebd96b4382085099b962e6a2bdec3d90c8db625e14372de85e2d5b7baab65c8faf91bb5504fb495afce5c988b3f6a52e20e1d6cbd3566c5cd1f2b8318bb542cc0ea25c4aab9932afa20760eaddec784396a07ea0ef24d4e6f4d37e5052a7a31e146aa480a111bbe926401307e00f410033842b6d82fe5ce4dfae80
 Output = 087820b569e8fa8d
 
-Decrypt = RSA-OAEP-3
+Decrypt = RSA-OAEP-3/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 024db89c7802989be0783847863084941bf209d761987e38f97cb5f6f1bc88da72a50b73ebaf11c879c4f95df37b850b8f65d7622e25b1b889e80fe80baca2069d6e0e1d829953fc459069de98ea9798b451e557e99abf8fe3d9ccf9096ebbf3e5255d3b4e1c6d2ecadf067a359eea86405acd47d5e165517ccafd47d6dbee4bf5
 Output = 4653acaf171960b01f52a7be63a3ab21dc368ec43b50d82ec3781e04
 
-Decrypt = RSA-OAEP-3
+Decrypt = RSA-OAEP-3/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 0239bce681032441528877d6d1c8bb28aa3bc97f1df584563618995797683844ca86664732f4bed7a0aab083aaabfb7238f582e30958c2024e44e57043b97950fd543da977c90cdde5337d618442f99e60d7783ab59ce6dd9d69c47ad1e962bec22d05895cff8d3f64ed5261d92b2678510393484990ba3f7f06818ae6ffce8a3a
 Output = d94cd0e08fa404ed89
 
-Decrypt = RSA-OAEP-3
+Decrypt = RSA-OAEP-3/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 02994c62afd76f498ba1fd2cf642857fca81f4373cb08f1cbaee6f025c3b512b42c3e8779113476648039dbe0493f9246292fac28950600e7c0f32edf9c81b9dec45c3bde0cc8d8847590169907b7dc5991ceb29bb0714d613d96df0f12ec5d8d3507c8ee7ae78dd83f216fa61de100363aca48a7e914ae9f42ddfbe943b09d9a0
 Output = 6cc641b6b61e6f963974dad23a9013284ef1
 
-Decrypt = RSA-OAEP-3
+Decrypt = RSA-OAEP-3/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 0162042ff6969592a6167031811a239834ce638abf54fec8b99478122afe2ee67f8c5b18b0339805bfdbc5a4e6720b37c59cfba942464c597ff532a119821545fd2e59b114e61daf71820529f5029cf524954327c34ec5e6f5ba7efcc4de943ab8ad4ed787b1454329f70db798a3a8f4d92f8274e2b2948ade627ce8ee33e43c60
 Output = df5151832b61f4f25891fb4172f328d2eddf8371ffcfdbe997939295f30eca6918017cfda1153bf7a6af87593223
 
-Decrypt = RSA-OAEP-3
+Decrypt = RSA-OAEP-3/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 00112051e75d064943bc4478075e43482fd59cee0679de6893eec3a943daa490b9691c93dfc0464b6623b9f3dbd3e70083264f034b374f74164e1a00763725e574744ba0b9db83434f31df96f6e2a26f6d8eba348bd4686c2238ac07c37aac3785d1c7eea2f819fd91491798ed8e9cef5e43b781b0e0276e37c43ff9492d005730
 Output = 3c3bad893c544a6d520ab022319188c8d504b7a788b850903b85972eaa18552e1134a7ad6098826254ff7ab672b3d8eb3158fac6d4cbaef1
 
-PrivateKey = RSA-OAEP-4
+Key = RSA-OAEP-4
 Algorithm = RSA
-Input = 30820277020100300d06092a864886f70d0101010500048202613082025d020100028181051240b6cc0004fa48d0134671c078c7c8dec3b3e2f25bc2564467339db38853d06b85eea5b2de353bff42ac2e46bc97fae6ac9618da9537a5c8f553c1e357625991d6108dcd7885fb3a25413f53efcad948cb35cd9b9ae9c1c67626d113d57dde4c5bea76bb5bb7de96c00d07372e9685a6d75cf9d239fa148d70931b5f3fb03902030100010281800411ffca3b7ca5e9e9be7fe38a85105e353896db05c5796aecd2a725161eb3651c8629a9b862b904d7b0c7b37f8cb5a1c2b54001018a00a1eb2cafe4ee4e9492c348bc2bedab4b9ebbf064e8eff322b9009f8eec653905f40df88a3cdc49d4567f75627d41aca624129b46a0b7c698e5e65f2b7ba102c749a10135b6540d04010241027458c19ec1636919e736c9af25d609a51b8f561d19c6bf6943dd1ee1ab8a4a3f232100bd40b88decc6ba235548b6ef792a11c9de823d0a7922c7095b6eba570102410210ee9b33ab61716e27d251bd465f4b35a1a232e2da00901c294bf22350ce490d099f642b5375612db63ba1f20386492bf04d34b3c22bceb909d13441b53b5139024039fa028b826e88c1121b750a8b242fa9a35c5b66bdfd1fa637d3cc48a84a4f457a194e7727e49f7bcc6e5a5a412657fc470c7322ebc37416ef458c307a8c09010241015d99a84195943979fa9e1be2c3c1b69f432f46fd03e47d5befbbbfd6b1d1371d83efb330a3e020942b2fed115e5d02be24fd92c9019d1cecd6dd4cf1e54cc899024101f0b7015170b3f5e42223ba30301c41a6d87cbb70e30cb7d3c67d25473db1f6cbf03e3f9126e3e97968279a865b2c2b426524cfc52a683d31ed30eb984be412ba
+PKCS8 = 30820277020100300d06092a864886f70d0101010500048202613082025d020100028181051240b6cc0004fa48d0134671c078c7c8dec3b3e2f25bc2564467339db38853d06b85eea5b2de353bff42ac2e46bc97fae6ac9618da9537a5c8f553c1e357625991d6108dcd7885fb3a25413f53efcad948cb35cd9b9ae9c1c67626d113d57dde4c5bea76bb5bb7de96c00d07372e9685a6d75cf9d239fa148d70931b5f3fb03902030100010281800411ffca3b7ca5e9e9be7fe38a85105e353896db05c5796aecd2a725161eb3651c8629a9b862b904d7b0c7b37f8cb5a1c2b54001018a00a1eb2cafe4ee4e9492c348bc2bedab4b9ebbf064e8eff322b9009f8eec653905f40df88a3cdc49d4567f75627d41aca624129b46a0b7c698e5e65f2b7ba102c749a10135b6540d04010241027458c19ec1636919e736c9af25d609a51b8f561d19c6bf6943dd1ee1ab8a4a3f232100bd40b88decc6ba235548b6ef792a11c9de823d0a7922c7095b6eba570102410210ee9b33ab61716e27d251bd465f4b35a1a232e2da00901c294bf22350ce490d099f642b5375612db63ba1f20386492bf04d34b3c22bceb909d13441b53b5139024039fa028b826e88c1121b750a8b242fa9a35c5b66bdfd1fa637d3cc48a84a4f457a194e7727e49f7bcc6e5a5a412657fc470c7322ebc37416ef458c307a8c09010241015d99a84195943979fa9e1be2c3c1b69f432f46fd03e47d5befbbbfd6b1d1371d83efb330a3e020942b2fed115e5d02be24fd92c9019d1cecd6dd4cf1e54cc899024101f0b7015170b3f5e42223ba30301c41a6d87cbb70e30cb7d3c67d25473db1f6cbf03e3f9126e3e97968279a865b2c2b426524cfc52a683d31ed30eb984be412ba
+SPKI = 30819f300d06092a864886f70d010101050003818d00308189028181051240b6cc0004fa48d0134671c078c7c8dec3b3e2f25bc2564467339db38853d06b85eea5b2de353bff42ac2e46bc97fae6ac9618da9537a5c8f553c1e357625991d6108dcd7885fb3a25413f53efcad948cb35cd9b9ae9c1c67626d113d57dde4c5bea76bb5bb7de96c00d07372e9685a6d75cf9d239fa148d70931b5f3fb0390203010001
+RSAPublicKey = 308189028181051240b6cc0004fa48d0134671c078c7c8dec3b3e2f25bc2564467339db38853d06b85eea5b2de353bff42ac2e46bc97fae6ac9618da9537a5c8f553c1e357625991d6108dcd7885fb3a25413f53efcad948cb35cd9b9ae9c1c67626d113d57dde4c5bea76bb5bb7de96c00d07372e9685a6d75cf9d239fa148d70931b5f3fb0390203010001
+RSAPrivateKey = 3082025d020100028181051240b6cc0004fa48d0134671c078c7c8dec3b3e2f25bc2564467339db38853d06b85eea5b2de353bff42ac2e46bc97fae6ac9618da9537a5c8f553c1e357625991d6108dcd7885fb3a25413f53efcad948cb35cd9b9ae9c1c67626d113d57dde4c5bea76bb5bb7de96c00d07372e9685a6d75cf9d239fa148d70931b5f3fb03902030100010281800411ffca3b7ca5e9e9be7fe38a85105e353896db05c5796aecd2a725161eb3651c8629a9b862b904d7b0c7b37f8cb5a1c2b54001018a00a1eb2cafe4ee4e9492c348bc2bedab4b9ebbf064e8eff322b9009f8eec653905f40df88a3cdc49d4567f75627d41aca624129b46a0b7c698e5e65f2b7ba102c749a10135b6540d04010241027458c19ec1636919e736c9af25d609a51b8f561d19c6bf6943dd1ee1ab8a4a3f232100bd40b88decc6ba235548b6ef792a11c9de823d0a7922c7095b6eba570102410210ee9b33ab61716e27d251bd465f4b35a1a232e2da00901c294bf22350ce490d099f642b5375612db63ba1f20386492bf04d34b3c22bceb909d13441b53b5139024039fa028b826e88c1121b750a8b242fa9a35c5b66bdfd1fa637d3cc48a84a4f457a194e7727e49f7bcc6e5a5a412657fc470c7322ebc37416ef458c307a8c09010241015d99a84195943979fa9e1be2c3c1b69f432f46fd03e47d5befbbbfd6b1d1371d83efb330a3e020942b2fed115e5d02be24fd92c9019d1cecd6dd4cf1e54cc899024101f0b7015170b3f5e42223ba30301c41a6d87cbb70e30cb7d3c67d25473db1f6cbf03e3f9126e3e97968279a865b2c2b426524cfc52a683d31ed30eb984be412ba
 
-Decrypt = RSA-OAEP-4
+Decrypt = RSA-OAEP-4/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 04cce19614845e094152a3fe18e54e3330c44e5efbc64ae16886cb1869014cc5781b1f8f9e045384d0112a135ca0d12e9c88a8e4063416deaae3844f60d6e96fe155145f4525b9a34431ca3766180f70e15a5e5d8e8b1a516ff870609f13f896935ced188279a58ed13d07114277d75c6568607e0ab092fd803a223e4a8ee0b1a8
 Output = 4a86609534ee434a6cbca3f7e962e76d455e3264c19f605f6e5ff6137c65c56d7fb344cd52bc93374f3d166c9f0c6f9c506bad19330972d2
 
-Decrypt = RSA-OAEP-4
+Decrypt = RSA-OAEP-4/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 0097b698c6165645b303486fbf5a2a4479c0ee85889b541a6f0b858d6b6597b13b854eb4f839af03399a80d79bda6578c841f90d645715b280d37143992dd186c80b949b775cae97370e4ec97443136c6da484e970ffdb1323a20847821d3b18381de13bb49aaea66530c4a4b8271f3eae172cd366e07e6636f1019d2a28aed15e
 Output = b0adc4f3fe11da59ce992773d9059943c03046497ee9d9f9a06df1166db46d98f58d27ec074c02eee6cbe2449c8b9fc5080c5c3f4433092512ec46aa793743c8
 
-Decrypt = RSA-OAEP-4
+Decrypt = RSA-OAEP-4/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 0301f935e9c47abcb48acbbe09895d9f5971af14839da4ff95417ee453d1fd77319072bb7297e1b55d7561cd9d1bb24c1a9a37c619864308242804879d86ebd001dce5183975e1506989b70e5a83434154d5cbfd6a24787e60eb0c658d2ac193302d1192c6e622d4a12ad4b53923bca246df31c6395e37702c6a78ae081fb9d065
 Output = bf6d42e701707b1d0206b0c8b45a1c72641ff12889219a82bdea965b5e79a96b0d0163ed9d578ec9ada20f2fbcf1ea3c4089d83419ba81b0c60f3606da99
 
-Decrypt = RSA-OAEP-4
+Decrypt = RSA-OAEP-4/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 02d110ad30afb727beb691dd0cf17d0af1a1e7fa0cc040ec1a4ba26a42c59d0a796a2e22c8f357ccc98b6519aceb682e945e62cb734614a529407cd452bee3e44fece8423cc19e55548b8b994b849c7ecde4933e76037e1d0ce44275b08710c68e430130b929730ed77e09b015642c5593f04e4ffb9410798102a8e96ffdfe11e4
 Output = fb2ef112f5e766eb94019297934794f7be2f6fc1c58e
 
-Decrypt = RSA-OAEP-4
+Decrypt = RSA-OAEP-4/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 00dbb8a7439d90efd919a377c54fae8fe11ec58c3b858362e23ad1b8a44310799066b99347aa525691d2adc58d9b06e34f288c170390c5f0e11c0aa3645959f18ee79e8f2be8d7ac5c23d061f18dd74b8c5f2a58fcb5eb0c54f99f01a83247568292536583340948d7a8c97c4acd1e98d1e29dc320e97a260532a8aa7a758a1ec2
 Output = 28ccd447bb9e85166dabb9e5b7d1adadc4b9d39f204e96d5e440ce9ad928bc1c2284
 
-Decrypt = RSA-OAEP-4
+Decrypt = RSA-OAEP-4/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 00a5ffa4768c8bbecaee2db77e8f2eec99595933545520835e5ba7db9493d3e17cddefe6a5f567624471908db4e2d83a0fbee60608fc84049503b2234a07dc83b27b22847ad8920ff42f674ef79b76280b00233d2b51b8cb2703a9d42bfbc8250c96ec32c051e57f1b4ba528db89c37e4c54e27e6e64ac69635ae887d9541619a9
 Output = f22242751ec6b1
 
-PrivateKey = RSA-OAEP-5
+Key = RSA-OAEP-5
 Algorithm = RSA
-Input = 30820279020100300d06092a864886f70d0101010500048202633082025f0201000281810aadf3f9c125e5d891f31ac448e993defe580f802b45f9d7f22ba5021e9c47576b5a1e68031ba9db4e6dabe4d96a1d6f3d267268cff408005f118efcadb99888d1c234467166b2a2b849a05a889c060ac0da0c5fae8b55f309ba62e703742fa0326f2d10b011021489ff497770190d895fd39f52293c39efd73a698bdab9f10ed902030100010281810256eb4cba7067f2d2be540dcdff4582a36b7d31d1c9099bb214b79848466a268f80f58a49ac04c0e3648934a0206c04537c19b236643a6082732144df75fa217588f794682be89168276dc726c5c0cbdb84d31bbf26d0a43af495717f7d528acfee341561f6ff3cae05c578f8470d9682f9c0d072f9f6068b56d5880f682be2c5024103b0d3962f6d17549cbfca11294348dcf0e7e39f8c2bc6824f2164b606d687860dae1e632393cfedf513228229069e2f60e4acd7e633a436063f82385f48993707024102e4c32e2f517269b7072309f00c0e31365f7ce28b236b82912df239abf39572cf0ed604b02982e53564c52d6a05397de5c052a2fddc141ef7189836346aeb331f024101e84b119d25161fa67b00256a5bd9b645d2b232ecb05b015180029a88622adc3f09b3aeacde6161ab7cde22c2ad26e7797df54e072cbd3b2673800b3e4338dbd5024100eb90aa1a40135b4cea07197cedc8819be1e7cbff2547662116f465a4a9f487ab12f3ba4fef13822265a65297d98b7bded9372e3ffe81a38b3e9600fed055754f0241012f7f8138f9404062eb85a42924520b38f5bb886a0196f48bb8dcea60fd92cc027f18e78158a34a5c5d5f860a0f6c04071a7d01312c065062f1eb48b79d1c83cb
+PKCS8 = 30820279020100300d06092a864886f70d0101010500048202633082025f0201000281810aadf3f9c125e5d891f31ac448e993defe580f802b45f9d7f22ba5021e9c47576b5a1e68031ba9db4e6dabe4d96a1d6f3d267268cff408005f118efcadb99888d1c234467166b2a2b849a05a889c060ac0da0c5fae8b55f309ba62e703742fa0326f2d10b011021489ff497770190d895fd39f52293c39efd73a698bdab9f10ed902030100010281810256eb4cba7067f2d2be540dcdff4582a36b7d31d1c9099bb214b79848466a268f80f58a49ac04c0e3648934a0206c04537c19b236643a6082732144df75fa217588f794682be89168276dc726c5c0cbdb84d31bbf26d0a43af495717f7d528acfee341561f6ff3cae05c578f8470d9682f9c0d072f9f6068b56d5880f682be2c5024103b0d3962f6d17549cbfca11294348dcf0e7e39f8c2bc6824f2164b606d687860dae1e632393cfedf513228229069e2f60e4acd7e633a436063f82385f48993707024102e4c32e2f517269b7072309f00c0e31365f7ce28b236b82912df239abf39572cf0ed604b02982e53564c52d6a05397de5c052a2fddc141ef7189836346aeb331f024101e84b119d25161fa67b00256a5bd9b645d2b232ecb05b015180029a88622adc3f09b3aeacde6161ab7cde22c2ad26e7797df54e072cbd3b2673800b3e4338dbd5024100eb90aa1a40135b4cea07197cedc8819be1e7cbff2547662116f465a4a9f487ab12f3ba4fef13822265a65297d98b7bded9372e3ffe81a38b3e9600fed055754f0241012f7f8138f9404062eb85a42924520b38f5bb886a0196f48bb8dcea60fd92cc027f18e78158a34a5c5d5f860a0f6c04071a7d01312c065062f1eb48b79d1c83cb
+SPKI = 30819f300d06092a864886f70d010101050003818d003081890281810aadf3f9c125e5d891f31ac448e993defe580f802b45f9d7f22ba5021e9c47576b5a1e68031ba9db4e6dabe4d96a1d6f3d267268cff408005f118efcadb99888d1c234467166b2a2b849a05a889c060ac0da0c5fae8b55f309ba62e703742fa0326f2d10b011021489ff497770190d895fd39f52293c39efd73a698bdab9f10ed90203010001
+RSAPublicKey = 3081890281810aadf3f9c125e5d891f31ac448e993defe580f802b45f9d7f22ba5021e9c47576b5a1e68031ba9db4e6dabe4d96a1d6f3d267268cff408005f118efcadb99888d1c234467166b2a2b849a05a889c060ac0da0c5fae8b55f309ba62e703742fa0326f2d10b011021489ff497770190d895fd39f52293c39efd73a698bdab9f10ed90203010001
+RSAPrivateKey = 3082025f0201000281810aadf3f9c125e5d891f31ac448e993defe580f802b45f9d7f22ba5021e9c47576b5a1e68031ba9db4e6dabe4d96a1d6f3d267268cff408005f118efcadb99888d1c234467166b2a2b849a05a889c060ac0da0c5fae8b55f309ba62e703742fa0326f2d10b011021489ff497770190d895fd39f52293c39efd73a698bdab9f10ed902030100010281810256eb4cba7067f2d2be540dcdff4582a36b7d31d1c9099bb214b79848466a268f80f58a49ac04c0e3648934a0206c04537c19b236643a6082732144df75fa217588f794682be89168276dc726c5c0cbdb84d31bbf26d0a43af495717f7d528acfee341561f6ff3cae05c578f8470d9682f9c0d072f9f6068b56d5880f682be2c5024103b0d3962f6d17549cbfca11294348dcf0e7e39f8c2bc6824f2164b606d687860dae1e632393cfedf513228229069e2f60e4acd7e633a436063f82385f48993707024102e4c32e2f517269b7072309f00c0e31365f7ce28b236b82912df239abf39572cf0ed604b02982e53564c52d6a05397de5c052a2fddc141ef7189836346aeb331f024101e84b119d25161fa67b00256a5bd9b645d2b232ecb05b015180029a88622adc3f09b3aeacde6161ab7cde22c2ad26e7797df54e072cbd3b2673800b3e4338dbd5024100eb90aa1a40135b4cea07197cedc8819be1e7cbff2547662116f465a4a9f487ab12f3ba4fef13822265a65297d98b7bded9372e3ffe81a38b3e9600fed055754f0241012f7f8138f9404062eb85a42924520b38f5bb886a0196f48bb8dcea60fd92cc027f18e78158a34a5c5d5f860a0f6c04071a7d01312c065062f1eb48b79d1c83cb
 
-Decrypt = RSA-OAEP-5
+Decrypt = RSA-OAEP-5/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 036046a4a47d9ed3ba9a89139c105038eb7492b05a5d68bfd53accff4597f7a68651b47b4a4627d927e485eed7b4566420e8b409879e5d606eae251d22a5df799f7920bfc117b992572a53b1263146bcea03385cc5e853c9a101c8c3e1bda31a519807496c6cb5e5efb408823a352b8fa0661fb664efadd593deb99fff5ed000e5
 Output = af71a901e3a61d3132f0fc1fdb474f9ea6579257ffc24d164170145b3dbde8
 
-Decrypt = RSA-OAEP-5
+Decrypt = RSA-OAEP-5/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 03d6eb654edce615bc59f455265ed4e5a18223cbb9be4e4069b473804d5de96f54dcaaa603d049c5d94aa1470dfcd2254066b7c7b61ff1f6f6770e3215c51399fd4e34ec5082bc48f089840ad04354ae66dc0f1bd18e461a33cc1258b443a2837a6df26759aa2302334986f87380c9cc9d53be9f99605d2c9a97da7b0915a4a7ad
 Output = a3b844a08239a8ac41605af17a6cfda4d350136585903a417a79268760519a4b4ac3303ec73f0f87cfb32399
 
-Decrypt = RSA-OAEP-5
+Decrypt = RSA-OAEP-5/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 0770952181649f9f9f07ff626ff3a22c35c462443d905d456a9fd0bff43cac2ca7a9f554e9478b9acc3ac838b02040ffd3e1847de2e4253929f9dd9ee4044325a9b05cabb808b2ee840d34e15d105a3f1f7b27695a1a07a2d73fe08ecaaa3c9c9d4d5a89ff890d54727d7ae40c0ec1a8dd86165d8ee2c6368141016a48b55b6967
 Output = 308b0ecbd2c76cb77fc6f70c5edd233fd2f20929d629f026953bb62a8f4a3a314bde195de85b5f816da2aab074d26cb6acddf323ae3b9c678ac3cf12fbdde7
 
-Decrypt = RSA-OAEP-5
+Decrypt = RSA-OAEP-5/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 0812b76768ebcb642d040258e5f4441a018521bd96687e6c5e899fcd6c17588ff59a82cc8ae03a4b45b31299af1788c329f7dcd285f8cf4ced82606b97612671a45bedca133442144d1617d114f802857f0f9d739751c57a3f9ee400912c61e2e6992be031a43dd48fa6ba14eef7c422b5edc4e7afa04fdd38f402d1c8bb719abf
 Output = 15c5b9ee1185
 
-Decrypt = RSA-OAEP-5
+Decrypt = RSA-OAEP-5/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 07b60e14ec954bfd29e60d0047e789f51d57186c63589903306793ced3f68241c743529aba6a6374f92e19e0163efa33697e196f7661dfaaa47aac6bde5e51deb507c72c589a2ca1693d96b1460381249b2cdb9eac44769f2489c5d3d2f99f0ee3c7ee5bf64a5ac79c42bd433f149be8cb59548361640595513c97af7bc2509723
 Output = 21026e6800c7fa728fcaaba0d196ae28d7a2ac4ffd8abce794f0985f60c8a6737277365d3fea11db8923a2029a
 
-Decrypt = RSA-OAEP-5
+Decrypt = RSA-OAEP-5/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 08c36d4dda33423b2ed6830d85f6411ba1dcf470a1fae0ebefee7c089f256cef74cb96ea69c38f60f39abee44129bcb4c92de7f797623b20074e3d9c2899701ed9071e1efa0bdd84d4c3e5130302d8f0240baba4b84a71cc032f2235a5ff0fae277c3e8f9112bef44c9ae20d175fc9a4058bfc930ba31b02e2e4f444483710f24a
 Output = 541e37b68b6c8872b84c02
 
-PrivateKey = RSA-OAEP-6
+Key = RSA-OAEP-6
 Algorithm = RSA
-Input = 30820279020100300d06092a864886f70d0101010500048202633082025f02010002818112b17f6dad2ecd19ff46dc13f7860f09e0e0cfb677b38a52592305ceaf022c166db90d04ac29e33f7dd12d9faf66e0816bb63ead267cc7d46c17c37be214bca2a22d723a64e44407436b6fc965729aefc2554f376cd5dcea68293780a62bf39d0029485a160bbb9e5dc0972d21a504f52e5ee028aa416332f510b2e9cff5f722af02030100010281810295eca3560618369559cecd303aa9cfdafc1d9f06959df75ffef929aa896961bcd190dc6997eda7f5963e724d07b4dc11f3065e5ae97d96835112280b9084bb14f2a21ebd4e889d41b9c4132ec1956fcab8bb2fed0575884936522c5ff7d33261904824e7cadee4e0bb372d2457cf78e2bd1286228ff83f10731ce63c90cff3f9024104a6ce8b7358dfa69bdcf742617005afb5385f5f3a58a24ef74a22a8c05cb7cc38ebd4cc9d9a9d789a62cd0f60f0cb941d3423c9692efa4fe3adff290c4749a38b02410404c9a803371fedb4c5be39f3c00b009e5e08a63be1e40035cdaca5011cc701cf7eebcb99f0ffe17cfd0a4bf7befd2dd536ac946db797fdbc4abe8f29349b91ed024103961c8f760aa2bd5154c7aafd77225b3bacd0139ae7b5948ea3311fccd86fb95c75afa767284b9b2de559572f15d8d044c7eb83a1be5fadf2cc377c0d8475294b0241022197e066742196aabc03fa2feeb4e70b15cb787d617acd31bb75c7bc234ad706f7c48d2182d1f0ff9c228dcf41967b6c0ba6d2c0ad110a1b857831ec245e2cb102410401c4c0c53d45dbdb5e9d96d0fecf4275df0974bc4a0736b4a74c3269053efb686ace2406e22c9e058ddb4ae540627ae2fdb08261e8e7e4bcbc994daafa305c45
+PKCS8 = 30820279020100300d06092a864886f70d0101010500048202633082025f02010002818112b17f6dad2ecd19ff46dc13f7860f09e0e0cfb677b38a52592305ceaf022c166db90d04ac29e33f7dd12d9faf66e0816bb63ead267cc7d46c17c37be214bca2a22d723a64e44407436b6fc965729aefc2554f376cd5dcea68293780a62bf39d0029485a160bbb9e5dc0972d21a504f52e5ee028aa416332f510b2e9cff5f722af02030100010281810295eca3560618369559cecd303aa9cfdafc1d9f06959df75ffef929aa896961bcd190dc6997eda7f5963e724d07b4dc11f3065e5ae97d96835112280b9084bb14f2a21ebd4e889d41b9c4132ec1956fcab8bb2fed0575884936522c5ff7d33261904824e7cadee4e0bb372d2457cf78e2bd1286228ff83f10731ce63c90cff3f9024104a6ce8b7358dfa69bdcf742617005afb5385f5f3a58a24ef74a22a8c05cb7cc38ebd4cc9d9a9d789a62cd0f60f0cb941d3423c9692efa4fe3adff290c4749a38b02410404c9a803371fedb4c5be39f3c00b009e5e08a63be1e40035cdaca5011cc701cf7eebcb99f0ffe17cfd0a4bf7befd2dd536ac946db797fdbc4abe8f29349b91ed024103961c8f760aa2bd5154c7aafd77225b3bacd0139ae7b5948ea3311fccd86fb95c75afa767284b9b2de559572f15d8d044c7eb83a1be5fadf2cc377c0d8475294b0241022197e066742196aabc03fa2feeb4e70b15cb787d617acd31bb75c7bc234ad706f7c48d2182d1f0ff9c228dcf41967b6c0ba6d2c0ad110a1b857831ec245e2cb102410401c4c0c53d45dbdb5e9d96d0fecf4275df0974bc4a0736b4a74c3269053efb686ace2406e22c9e058ddb4ae540627ae2fdb08261e8e7e4bcbc994daafa305c45
+SPKI = 30819f300d06092a864886f70d010101050003818d0030818902818112b17f6dad2ecd19ff46dc13f7860f09e0e0cfb677b38a52592305ceaf022c166db90d04ac29e33f7dd12d9faf66e0816bb63ead267cc7d46c17c37be214bca2a22d723a64e44407436b6fc965729aefc2554f376cd5dcea68293780a62bf39d0029485a160bbb9e5dc0972d21a504f52e5ee028aa416332f510b2e9cff5f722af0203010001
+RSAPublicKey = 30818902818112b17f6dad2ecd19ff46dc13f7860f09e0e0cfb677b38a52592305ceaf022c166db90d04ac29e33f7dd12d9faf66e0816bb63ead267cc7d46c17c37be214bca2a22d723a64e44407436b6fc965729aefc2554f376cd5dcea68293780a62bf39d0029485a160bbb9e5dc0972d21a504f52e5ee028aa416332f510b2e9cff5f722af0203010001
+RSAPrivateKey = 3082025f02010002818112b17f6dad2ecd19ff46dc13f7860f09e0e0cfb677b38a52592305ceaf022c166db90d04ac29e33f7dd12d9faf66e0816bb63ead267cc7d46c17c37be214bca2a22d723a64e44407436b6fc965729aefc2554f376cd5dcea68293780a62bf39d0029485a160bbb9e5dc0972d21a504f52e5ee028aa416332f510b2e9cff5f722af02030100010281810295eca3560618369559cecd303aa9cfdafc1d9f06959df75ffef929aa896961bcd190dc6997eda7f5963e724d07b4dc11f3065e5ae97d96835112280b9084bb14f2a21ebd4e889d41b9c4132ec1956fcab8bb2fed0575884936522c5ff7d33261904824e7cadee4e0bb372d2457cf78e2bd1286228ff83f10731ce63c90cff3f9024104a6ce8b7358dfa69bdcf742617005afb5385f5f3a58a24ef74a22a8c05cb7cc38ebd4cc9d9a9d789a62cd0f60f0cb941d3423c9692efa4fe3adff290c4749a38b02410404c9a803371fedb4c5be39f3c00b009e5e08a63be1e40035cdaca5011cc701cf7eebcb99f0ffe17cfd0a4bf7befd2dd536ac946db797fdbc4abe8f29349b91ed024103961c8f760aa2bd5154c7aafd77225b3bacd0139ae7b5948ea3311fccd86fb95c75afa767284b9b2de559572f15d8d044c7eb83a1be5fadf2cc377c0d8475294b0241022197e066742196aabc03fa2feeb4e70b15cb787d617acd31bb75c7bc234ad706f7c48d2182d1f0ff9c228dcf41967b6c0ba6d2c0ad110a1b857831ec245e2cb102410401c4c0c53d45dbdb5e9d96d0fecf4275df0974bc4a0736b4a74c3269053efb686ace2406e22c9e058ddb4ae540627ae2fdb08261e8e7e4bcbc994daafa305c45
 
-Decrypt = RSA-OAEP-6
+Decrypt = RSA-OAEP-6/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 0630eebcd2856c24f798806e41f9e67345eda9ceda386acc9facaea1eeed06ace583709718d9d169fadf414d5c76f92996833ef305b75b1e4b95f662a20faedc3bae0c4827a8bf8a88edbd57ec203a27a841f02e43a615bab1a8cac0701de34debdef62a088089b55ec36ea7522fd3ec8d06b6a073e6df833153bc0aefd93bd1a3
 Output = 4046ca8baa3347ca27f49e0d81f9cc1d71be9ba517d4
 
-Decrypt = RSA-OAEP-6
+Decrypt = RSA-OAEP-6/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 0ebc37376173a4fd2f89cc55c2ca62b26b11d51c3c7ce49e8845f74e7607317c436bc8d23b9667dfeb9d087234b47bc6837175ae5c0559f6b81d7d22416d3e50f4ac533d8f0812f2db9e791fe9c775ac8b6ad0f535ad9ceb23a4a02014c58ab3f8d3161499a260f39348e714ae2a1d3443208fd8b722ccfdfb393e98011f99e63f
 Output = 5cc72c60231df03b3d40f9b57931bc31109f972527f28b19e7480c7288cb3c92b22512214e4be6c914792ddabdf57faa8aa7
 
-Decrypt = RSA-OAEP-6
+Decrypt = RSA-OAEP-6/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 0a98bf1093619394436cf68d8f38e2f158fde8ea54f3435f239b8d06b8321844202476aeed96009492480ce3a8d705498c4c8c68f01501dc81db608f60087350c8c3b0bd2e9ef6a81458b7c801b89f2e4fe99d4900ba6a4b5e5a96d865dc676c7755928794130d6280a8160a190f2df3ea7cf9aa0271d88e9e6905ecf1c5152d65
 Output = b20e651303092f4bccb43070c0f86d23049362ed96642fc5632c27db4a52e3d831f2ab068b23b149879c002f6bf3feee97591112562c
 
-Decrypt = RSA-OAEP-6
+Decrypt = RSA-OAEP-6/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 008e7a67cacfb5c4e24bec7dee149117f19598ce8c45808fef88c608ff9cd6e695263b9a3c0ad4b8ba4c95238e96a8422b8535629c8d5382374479ad13fa39974b242f9a759eeaf9c83ad5a8ca18940a0162ba755876df263f4bd50c6525c56090267c1f0e09ce0899a0cf359e88120abd9bf893445b3cae77d3607359ae9a52f8
 Output = 684e3038c5c041f7
 
-Decrypt = RSA-OAEP-6
+Decrypt = RSA-OAEP-6/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 00003474416c7b68bdf961c385737944d7f1f40cb395343c693cc0b4fe63b31fedf1eaeeac9ccc0678b31dc32e0977489514c4f09085f6298a9653f01aea4045ff582ee887be26ae575b73eef7f3774921e375a3d19adda0ca31aa1849887c1f42cac9677f7a2f4e923f6e5a868b38c084ef187594dc9f7f048fea2e02955384ab
 Output = 32488cb262d041d6e4dd35f987bf3ca696db1f06ac29a44693
 
-Decrypt = RSA-OAEP-6
+Decrypt = RSA-OAEP-6/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 0a026dda5fc8785f7bd9bf75327b63e85e2c0fdee5dadb65ebdcac9ae1de95c92c672ab433aa7a8e69ce6a6d8897fac4ac4a54de841ae5e5bbce7687879d79634cea7a30684065c714d52409b928256bbf53eabcd5231eb7259504537399bd29164b726d33a46da701360a4168a091ccab72d44a62fed246c0ffea5b1348ab5470
 Output = 50ba14be8462720279c306ba
 
-PrivateKey = RSA-OAEP-7
+Key = RSA-OAEP-7
 Algorithm = RSA
-Input = 30820278020100300d06092a864886f70d0101010500048202623082025e020100028181311179f0bcfc9b9d3ca315d00ef30d7bdd3a2cfae9911bfedcb948b3a4782d0732b6ab44aa4bf03741a644dc01bec3e69b01a033e675d8acd7c4925c6b1aec3119051dfd89762d215d45475ffcb59f908148623f37177156f6ae86dd7a7c5f43dc1e1f908254058a284a5f06c0021793a87f1ac5feff7dcaee69c5e51a3789e3730203010001028181070cfcff2feb8276e27432c45dfee48f49b7917d6530e1f0ca3460f32e0276174487c56e22a45d2500d7775495219d7d165a9cf3bd92c32af9a98d8dc9cc296800adc94a0a54fb40f34291bf84ee8ea12b6f109359c6d3542a50f9c767f5cfff05a681c2e656fb77caaadb4be9468d8abcd4df98f58e86d2053fa1349f748e21b102410749262c111cd470ec2566e6b3732fc09329469aa19071d3b9c01906514c6f1d26baa14beab0971c8b7e611a4f79009d6fea776928ca25285b0de3643d1a3f8c71024106bc1e50e96c02bf636e9eea8b899bbebf7651de77dd474c3e9bc23bad8182b61904c7d97dfbebfb1e00108878b6e67e415391d67942c2b2bf9b4435f88b0cb023024103bc7ea7f0aab143abc6ce8b97118636a30172e4cfe02c8fa0dda3b7baaf90f8092982985525f488bdfcb4bd726e22639ac64a3092ab7ffcbf1d5334cfa50b5bf102410262a6aa29c2a3c67dc5346c06381afd987aa3cc93cfbfecf54fdd9f9d787d7f59a523d398979da137a2f6381fe94801f7c94da21518dc34cb40870c4697994ad90240649d4c17b6ee1721e772d0389a559c3d3cdf9550d457c46b037b74641b1d52166af8a213c8396206cdfba4422f18d6f61dbcb5d214c971bf482aeb976a7370c2
+PKCS8 = 30820278020100300d06092a864886f70d0101010500048202623082025e020100028181311179f0bcfc9b9d3ca315d00ef30d7bdd3a2cfae9911bfedcb948b3a4782d0732b6ab44aa4bf03741a644dc01bec3e69b01a033e675d8acd7c4925c6b1aec3119051dfd89762d215d45475ffcb59f908148623f37177156f6ae86dd7a7c5f43dc1e1f908254058a284a5f06c0021793a87f1ac5feff7dcaee69c5e51a3789e3730203010001028181070cfcff2feb8276e27432c45dfee48f49b7917d6530e1f0ca3460f32e0276174487c56e22a45d2500d7775495219d7d165a9cf3bd92c32af9a98d8dc9cc296800adc94a0a54fb40f34291bf84ee8ea12b6f109359c6d3542a50f9c767f5cfff05a681c2e656fb77caaadb4be9468d8abcd4df98f58e86d2053fa1349f748e21b102410749262c111cd470ec2566e6b3732fc09329469aa19071d3b9c01906514c6f1d26baa14beab0971c8b7e611a4f79009d6fea776928ca25285b0de3643d1a3f8c71024106bc1e50e96c02bf636e9eea8b899bbebf7651de77dd474c3e9bc23bad8182b61904c7d97dfbebfb1e00108878b6e67e415391d67942c2b2bf9b4435f88b0cb023024103bc7ea7f0aab143abc6ce8b97118636a30172e4cfe02c8fa0dda3b7baaf90f8092982985525f488bdfcb4bd726e22639ac64a3092ab7ffcbf1d5334cfa50b5bf102410262a6aa29c2a3c67dc5346c06381afd987aa3cc93cfbfecf54fdd9f9d787d7f59a523d398979da137a2f6381fe94801f7c94da21518dc34cb40870c4697994ad90240649d4c17b6ee1721e772d0389a559c3d3cdf9550d457c46b037b74641b1d52166af8a213c8396206cdfba4422f18d6f61dbcb5d214c971bf482aeb976a7370c2
+SPKI = 30819f300d06092a864886f70d010101050003818d00308189028181311179f0bcfc9b9d3ca315d00ef30d7bdd3a2cfae9911bfedcb948b3a4782d0732b6ab44aa4bf03741a644dc01bec3e69b01a033e675d8acd7c4925c6b1aec3119051dfd89762d215d45475ffcb59f908148623f37177156f6ae86dd7a7c5f43dc1e1f908254058a284a5f06c0021793a87f1ac5feff7dcaee69c5e51a3789e3730203010001
+RSAPublicKey = 308189028181311179f0bcfc9b9d3ca315d00ef30d7bdd3a2cfae9911bfedcb948b3a4782d0732b6ab44aa4bf03741a644dc01bec3e69b01a033e675d8acd7c4925c6b1aec3119051dfd89762d215d45475ffcb59f908148623f37177156f6ae86dd7a7c5f43dc1e1f908254058a284a5f06c0021793a87f1ac5feff7dcaee69c5e51a3789e3730203010001
+RSAPrivateKey = 3082025e020100028181311179f0bcfc9b9d3ca315d00ef30d7bdd3a2cfae9911bfedcb948b3a4782d0732b6ab44aa4bf03741a644dc01bec3e69b01a033e675d8acd7c4925c6b1aec3119051dfd89762d215d45475ffcb59f908148623f37177156f6ae86dd7a7c5f43dc1e1f908254058a284a5f06c0021793a87f1ac5feff7dcaee69c5e51a3789e3730203010001028181070cfcff2feb8276e27432c45dfee48f49b7917d6530e1f0ca3460f32e0276174487c56e22a45d2500d7775495219d7d165a9cf3bd92c32af9a98d8dc9cc296800adc94a0a54fb40f34291bf84ee8ea12b6f109359c6d3542a50f9c767f5cfff05a681c2e656fb77caaadb4be9468d8abcd4df98f58e86d2053fa1349f748e21b102410749262c111cd470ec2566e6b3732fc09329469aa19071d3b9c01906514c6f1d26baa14beab0971c8b7e611a4f79009d6fea776928ca25285b0de3643d1a3f8c71024106bc1e50e96c02bf636e9eea8b899bbebf7651de77dd474c3e9bc23bad8182b61904c7d97dfbebfb1e00108878b6e67e415391d67942c2b2bf9b4435f88b0cb023024103bc7ea7f0aab143abc6ce8b97118636a30172e4cfe02c8fa0dda3b7baaf90f8092982985525f488bdfcb4bd726e22639ac64a3092ab7ffcbf1d5334cfa50b5bf102410262a6aa29c2a3c67dc5346c06381afd987aa3cc93cfbfecf54fdd9f9d787d7f59a523d398979da137a2f6381fe94801f7c94da21518dc34cb40870c4697994ad90240649d4c17b6ee1721e772d0389a559c3d3cdf9550d457c46b037b74641b1d52166af8a213c8396206cdfba4422f18d6f61dbcb5d214c971bf482aeb976a7370c2
 
-Decrypt = RSA-OAEP-7
+Decrypt = RSA-OAEP-7/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 1688e4ce7794bba6cb7014169ecd559cede2a30b56a52b68d9fe18cf1973ef97b2a03153951c755f6294aa49adbdb55845ab6875fb3986c93ecf927962840d282f9e54ce8b690f7c0cb8bbd73440d9571d1b16cd9260f9eab4783cc482e5223dc60973871783ec27b0ae0fd47732cbc286a173fc92b00fb4ba6824647cd93c85c1
 Output = 47aae909
 
-Decrypt = RSA-OAEP-7
+Decrypt = RSA-OAEP-7/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 1052ed397b2e01e1d0ee1c50bf24363f95e504f4a03434a08fd822574ed6b9736edbb5f390db10321479a8a139350e2bd4977c3778ef331f3e78ae118b268451f20a2f01d471f5d53c566937171b2dbc2d4bde459a5799f0372d6574239b2323d245d0bb81c286b63c89a361017337e4902f88a467f4c7f244bfd5ab46437ff3b6
 Output = 1d9b2e2223d9bc13bfb9f162ce735db48ba7c68f6822a0a1a7b6ae165834e7
 
-Decrypt = RSA-OAEP-7
+Decrypt = RSA-OAEP-7/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 2155cd843ff24a4ee8badb7694260028a490813ba8b369a4cbf106ec148e5298707f5965be7d101c1049ea8584c24cd63455ad9c104d686282d3fb803a4c11c1c2e9b91c7178801d1b6640f003f5728df007b8a4ccc92bce05e41a27278d7c85018c52414313a5077789001d4f01910b72aad05d220aa14a58733a7489bc54556b
 Output = d976fc
 
-Decrypt = RSA-OAEP-7
+Decrypt = RSA-OAEP-7/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 0ab14c373aeb7d4328d0aaad8c094d88b9eb098b95f21054a29082522be7c27a312878b637917e3d819e6c3c568db5d843802b06d51d9e98a2be0bf40c031423b00edfbff8320efb9171bd2044653a4cb9c5122f6c65e83cda2ec3c126027a9c1a56ba874d0fea23f380b82cf240b8cf540004758c4c77d934157a74f3fc12bfac
 Output = d4738623df223aa43843df8467534c41d013e0c803c624e263666b239bde40a5f29aeb8de79e3daa61dd0370f49bd4b013834b98212aef6b1c5ee373b3cb
 
-Decrypt = RSA-OAEP-7
+Decrypt = RSA-OAEP-7/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 028387a318277434798b4d97f460068df5298faba5041ba11761a1cb7316b24184114ec500257e2589ed3b607a1ebbe97a6cc2e02bf1b681f42312a33b7a77d8e7855c4a6de03e3c04643f786b91a264a0d6805e2cea91e68177eb7a64d9255e4f27e713b7ccec00dc200ebd21c2ea2bb890feae4942df941dc3f97890ed347478
 Output = bb47231ca5ea1d3ad46c99345d9a8a61
 
-Decrypt = RSA-OAEP-7
+Decrypt = RSA-OAEP-7/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 14c678a94ad60525ef39e959b2f3ba5c097a94ff912b67dbace80535c187abd47d075420b1872152bba08f7fc31f313bbf9273c912fc4c0149a9b0cfb79807e346eb332069611bec0ff9bcd168f1f7c33e77313cea454b94e2549eecf002e2acf7f6f2d2845d4fe0aab2e5a92ddf68c480ae11247935d1f62574842216ae674115
 Output = 2184827095d35c3f86f600e8e59754013296
 
-PrivateKey = RSA-OAEP-8
+Key = RSA-OAEP-8
 Algorithm = RSA
-Input = 30820279020100300d06092a864886f70d0101010500048202633082025f0201000281815bdf0e30d321dda5147f882408fa69195480df8f80d3f6e8bf5818504f36427ca9b1f5540b9c65a8f6974cf8447a244d9280201bb49fcbbe6378d1944cd227e230f96e3d10f819dcef276c64a00b2a4b6701e7d01de5fabde3b1e9a0df82f4631359cd22669647fbb1717246134ed7b497cfffbdc42b59c73a96ed90166212dff702030100010281810f7d1e9e5aaa25fd13e4a0663ae144e0d15f5cd18bcdb09df2cc7e64e3c5e915ad62645304161d098c715bb7ab8bd01d07eaf3fed7c7ed08af2a8a62ef44ab16b320e14af72a48f96afe262a0ae4cf65e635e910790cd4ee5cea768a4b2639f7e6f677b3f0bb6be32b75747d8909036f0264f58d401cdba131716157a75ecf633102410a02ef8448d9fad8bbd0d004c8c2aa9751ef9721c1b0d03236a54b0df947cbaed5a255ee9e8e20d491ea1723fe094704a9762e88afd16ebb5994412ca966dc4f9f0241092d362e7ed3a0bfd9e9fd0e6c0301b6df29159cf50cc83b9b0cf4d6eea71a61e002b46e0ae9f2de62d25b5d7452d498b81c9ac6fc58593d4c3fb4f5d72dfbb0a9024107c71410af103962db367404e37ae850baa4e9c29dd92145815294a67c7d1c6ded263aa030a9b633ae50303e14035d1af014123eba687820308d8ebc85b6957d7d024100ae2c75380c02c016ad05891b3301de881f28ae1171182b6b2c83bea7c515eca9ca298c7b1cab5817a597068fc85060de4da8a016378aae43c7f967bcc37904b902410598d1059e3ada4f6320752c09d805ff7d1f1ae0d017aeeee9cefa0d7dd7ff775e44b578322f6405d6211da19519666aa87fdc4cd8c88f6b6e3d67e961dcbba3d0
+PKCS8 = 30820279020100300d06092a864886f70d0101010500048202633082025f0201000281815bdf0e30d321dda5147f882408fa69195480df8f80d3f6e8bf5818504f36427ca9b1f5540b9c65a8f6974cf8447a244d9280201bb49fcbbe6378d1944cd227e230f96e3d10f819dcef276c64a00b2a4b6701e7d01de5fabde3b1e9a0df82f4631359cd22669647fbb1717246134ed7b497cfffbdc42b59c73a96ed90166212dff702030100010281810f7d1e9e5aaa25fd13e4a0663ae144e0d15f5cd18bcdb09df2cc7e64e3c5e915ad62645304161d098c715bb7ab8bd01d07eaf3fed7c7ed08af2a8a62ef44ab16b320e14af72a48f96afe262a0ae4cf65e635e910790cd4ee5cea768a4b2639f7e6f677b3f0bb6be32b75747d8909036f0264f58d401cdba131716157a75ecf633102410a02ef8448d9fad8bbd0d004c8c2aa9751ef9721c1b0d03236a54b0df947cbaed5a255ee9e8e20d491ea1723fe094704a9762e88afd16ebb5994412ca966dc4f9f0241092d362e7ed3a0bfd9e9fd0e6c0301b6df29159cf50cc83b9b0cf4d6eea71a61e002b46e0ae9f2de62d25b5d7452d498b81c9ac6fc58593d4c3fb4f5d72dfbb0a9024107c71410af103962db367404e37ae850baa4e9c29dd92145815294a67c7d1c6ded263aa030a9b633ae50303e14035d1af014123eba687820308d8ebc85b6957d7d024100ae2c75380c02c016ad05891b3301de881f28ae1171182b6b2c83bea7c515eca9ca298c7b1cab5817a597068fc85060de4da8a016378aae43c7f967bcc37904b902410598d1059e3ada4f6320752c09d805ff7d1f1ae0d017aeeee9cefa0d7dd7ff775e44b578322f6405d6211da19519666aa87fdc4cd8c88f6b6e3d67e961dcbba3d0
+SPKI = 30819f300d06092a864886f70d010101050003818d003081890281815bdf0e30d321dda5147f882408fa69195480df8f80d3f6e8bf5818504f36427ca9b1f5540b9c65a8f6974cf8447a244d9280201bb49fcbbe6378d1944cd227e230f96e3d10f819dcef276c64a00b2a4b6701e7d01de5fabde3b1e9a0df82f4631359cd22669647fbb1717246134ed7b497cfffbdc42b59c73a96ed90166212dff70203010001
+RSAPublicKey = 3081890281815bdf0e30d321dda5147f882408fa69195480df8f80d3f6e8bf5818504f36427ca9b1f5540b9c65a8f6974cf8447a244d9280201bb49fcbbe6378d1944cd227e230f96e3d10f819dcef276c64a00b2a4b6701e7d01de5fabde3b1e9a0df82f4631359cd22669647fbb1717246134ed7b497cfffbdc42b59c73a96ed90166212dff70203010001
+RSAPrivateKey = 3082025f0201000281815bdf0e30d321dda5147f882408fa69195480df8f80d3f6e8bf5818504f36427ca9b1f5540b9c65a8f6974cf8447a244d9280201bb49fcbbe6378d1944cd227e230f96e3d10f819dcef276c64a00b2a4b6701e7d01de5fabde3b1e9a0df82f4631359cd22669647fbb1717246134ed7b497cfffbdc42b59c73a96ed90166212dff702030100010281810f7d1e9e5aaa25fd13e4a0663ae144e0d15f5cd18bcdb09df2cc7e64e3c5e915ad62645304161d098c715bb7ab8bd01d07eaf3fed7c7ed08af2a8a62ef44ab16b320e14af72a48f96afe262a0ae4cf65e635e910790cd4ee5cea768a4b2639f7e6f677b3f0bb6be32b75747d8909036f0264f58d401cdba131716157a75ecf633102410a02ef8448d9fad8bbd0d004c8c2aa9751ef9721c1b0d03236a54b0df947cbaed5a255ee9e8e20d491ea1723fe094704a9762e88afd16ebb5994412ca966dc4f9f0241092d362e7ed3a0bfd9e9fd0e6c0301b6df29159cf50cc83b9b0cf4d6eea71a61e002b46e0ae9f2de62d25b5d7452d498b81c9ac6fc58593d4c3fb4f5d72dfbb0a9024107c71410af103962db367404e37ae850baa4e9c29dd92145815294a67c7d1c6ded263aa030a9b633ae50303e14035d1af014123eba687820308d8ebc85b6957d7d024100ae2c75380c02c016ad05891b3301de881f28ae1171182b6b2c83bea7c515eca9ca298c7b1cab5817a597068fc85060de4da8a016378aae43c7f967bcc37904b902410598d1059e3ada4f6320752c09d805ff7d1f1ae0d017aeeee9cefa0d7dd7ff775e44b578322f6405d6211da19519666aa87fdc4cd8c88f6b6e3d67e961dcbba3d0
 
-Decrypt = RSA-OAEP-8
+Decrypt = RSA-OAEP-8/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 09b3683d8a2eb0fb295b62ed1fb9290b714457b7825319f4647872af889b30409472020ad12912bf19b11d4819f49614824ffd84d09c0a17e7d17309d12919790410aa2995699f6a86dbe3242b5acc23af45691080d6b1ae810fb3e3057087f0970092ce00be9562ff4053b6262ce0caa93e13723d2e3a5ba075d45f0d61b54b61
 Output = 050b755e5e6880f7b9e9d692a74c37aae449b31bfea6deff83747a897f6c2c825bb1adbf850a3c96994b5de5b33cbc7d4a17913a7967
 
-Decrypt = RSA-OAEP-8
+Decrypt = RSA-OAEP-8/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 2ecf15c97c5a15b1476ae986b371b57a24284f4a162a8d0c8182e7905e792256f1812ba5f83f1f7a130e42dcc02232844edc14a31a68ee97ae564a383a3411656424c5f62ddb646093c367be1fcda426cf00a06d8acb7e57776fbbd855ac3df506fc16b1d7c3f2110f3d8068e91e186363831c8409680d8da9ecd8cf1fa20ee39d
 Output = 4eb68dcd93ca9b19df111bd43608f557026fe4aa1d5cfac227a3eb5ab9548c18a06dded23f81825986b2fcd71109ecef7eff88873f075c2aa0c469f69c92bc
 
-Decrypt = RSA-OAEP-8
+Decrypt = RSA-OAEP-8/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 4bc89130a5b2dabb7c2fcf90eb5d0eaf9e681b7146a38f3173a3d9cfec52ea9e0a41932e648a9d69344c50da763f51a03c95762131e8052254dcd2248cba40fd31667786ce05a2b7b531ac9dac9ed584a59b677c1a8aed8c5d15d68c05569e2be780bf7db638fd2bfd2a85ab276860f3777338fca989ffd743d13ee08e0ca9893f
 Output = 8604ac56328c1ab5ad917861
 
-Decrypt = RSA-OAEP-8
+Decrypt = RSA-OAEP-8/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 2e456847d8fc36ff0147d6993594b9397227d577752c79d0f904fcb039d4d812fea605a7b574dd82ca786f93752348438ee9f5b5454985d5f0e1699e3e7ad175a32e15f03deb042ab9fe1dd9db1bb86f8c089ccb45e7ef0c5ee7ca9b7290ca6b15bed47039788a8a93ff83e0e8d6244c71006362deef69b6f416fb3c684383fbd0
 Output = fdda5fbf6ec361a9d9a4ac68af216a0686f438b1e0e5c36b955f74e107f39c0dddcc
 
-Decrypt = RSA-OAEP-8
+Decrypt = RSA-OAEP-8/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 1fb9356fd5c4b1796db2ebf7d0d393cc810adf6145defc2fce714f79d93800d5e2ac211ea8bbecca4b654b94c3b18b30dd576ce34dc95436ef57a09415645923359a5d7b4171ef22c24670f1b229d3603e91f76671b7df97e7317c97734476d5f3d17d21cf82b5ba9f83df2e588d36984fd1b584468bd23b2e875f32f68953f7b2
 Output = 4a5f4914bee25de3c69341de07
 
-Decrypt = RSA-OAEP-8
+Decrypt = RSA-OAEP-8/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 3afd9c6600147b21798d818c655a0f4c9212db26d0b0dfdc2a7594ccb3d22f5bf1d7c3e112cd73fc7d509c7a8bafdd3c274d1399009f9609ec4be6477e453f075aa33db382870c1c3409aef392d7386ae3a696b99a94b4da0589447e955d16c98b17602a59bd736279fcd8fb280c4462d590bfa9bf13fed570eafde97330a2c210
 Output = 8e07d66f7b880a72563abcd3f35092bc33409fb7f88f2472be
 
-PrivateKey = RSA-OAEP-9
+Key = RSA-OAEP-9
 Algorithm = RSA
-Input = 30820397020100300d06092a864886f70d0101010500048203813082037d0201000281c100cf2cd41e34ca3a728ea5cb8aff64c36d27bdef5364e336fd68d3123c5a196a8c287013e853d5156d58d151954520fb4f6d7b17abb6817765909c576119659d902b1906ed8a2b10c155c24d124528dab9eeae379beac66e4a411786dcb8fd0062ebc030de1219a04c2a8c1b7dd3131e4d6b6caee2e31a5ed41ac1509b2ef1ee2ab18364be568ca941c25ecc84ff9d643b5ec1aaae102a20d73f479b780fd6da91075212d9eac03a0674d899eba2e431f4c44b615b6ba2232bd4b33baed73d625d02030100010281c0198c141e23715a92bccf6a119a5bc11389468d2811f548d727e17b4ab0eb986d6f211efb53b71f7ccbea87ee69c75ee615008c5332deb52bf390abdfbfe37d7205368159b2638c1de326e21d22251f0fb5848b3bf15005d2a74330f0afe916ee62ccc1344d1d83a709e60676273840f7f377424a5e0a4da75f01b31ff76819cf9cbfdd215243c3917c03ef38199312e567b3bf7aed3ab457f371ef8a1423f45b68c6e282ec111bba2833b987fd69fad83bc1b8c613c5e1ea16c11ed125ea7ec1026100fc8d6c04bec4eb9a8192ca7900cbe536e2e8b519decf33b2459798c6909df4f176db7d23190fc72b8865a718af895f1bcd9145298027423b605e70a47cf58390a8c3e88fc8c48e8b32e3da210dfbe3e881ea5674b6a348c21e93f9e55ea65efd026100d200d45e788aacea606a401d0460f87dd5c1027e12dc1a0d7586e8939d9cf789b40f51ac0442961de7d21cc21e05c83155c1f2aa9193387cfdf956cb48d153ba270406f9bbba537d4987d9e2f9942d7a14cbfffea74fecdda928d23e259f5ee1026100db16802f79a2f0d45f358d69fd33e44b81fae828622e93a54253e997d01b0743759da0e812b4aa4e6c8beab2328d5431955a418a67ff26a8c5c807a5da354e05ef31cc8cf758f463732950b03e265726fb94e39d6a572a26244ab08db75752ad026100a0a317cfe7df1423f87a6dee8451f4e2b4a67e5497f29b4f1e4e830b9fadd9401167026f5596e5a39c97817e0f5f16e27e19ec9902e01d7ea6fb9aa3c760afee1e381b69de6ac9c07585a06ad9c4ba00bf75c8ad2fa898a479e80ae294fed2a102600b21f335c353342eb44c3aa24445780c2d655b940174cae38c7c8a4e6493c0ba9fd303748267b083b9a7a6cb61e42db362b8c9896db7064e02ad5ae61587da15b4649c90594909feb37dbcb654beb7268ec801e5a8b4aa3911bebd88542f05be
+PKCS8 = 30820397020100300d06092a864886f70d0101010500048203813082037d0201000281c100cf2cd41e34ca3a728ea5cb8aff64c36d27bdef5364e336fd68d3123c5a196a8c287013e853d5156d58d151954520fb4f6d7b17abb6817765909c576119659d902b1906ed8a2b10c155c24d124528dab9eeae379beac66e4a411786dcb8fd0062ebc030de1219a04c2a8c1b7dd3131e4d6b6caee2e31a5ed41ac1509b2ef1ee2ab18364be568ca941c25ecc84ff9d643b5ec1aaae102a20d73f479b780fd6da91075212d9eac03a0674d899eba2e431f4c44b615b6ba2232bd4b33baed73d625d02030100010281c0198c141e23715a92bccf6a119a5bc11389468d2811f548d727e17b4ab0eb986d6f211efb53b71f7ccbea87ee69c75ee615008c5332deb52bf390abdfbfe37d7205368159b2638c1de326e21d22251f0fb5848b3bf15005d2a74330f0afe916ee62ccc1344d1d83a709e60676273840f7f377424a5e0a4da75f01b31ff76819cf9cbfdd215243c3917c03ef38199312e567b3bf7aed3ab457f371ef8a1423f45b68c6e282ec111bba2833b987fd69fad83bc1b8c613c5e1ea16c11ed125ea7ec1026100fc8d6c04bec4eb9a8192ca7900cbe536e2e8b519decf33b2459798c6909df4f176db7d23190fc72b8865a718af895f1bcd9145298027423b605e70a47cf58390a8c3e88fc8c48e8b32e3da210dfbe3e881ea5674b6a348c21e93f9e55ea65efd026100d200d45e788aacea606a401d0460f87dd5c1027e12dc1a0d7586e8939d9cf789b40f51ac0442961de7d21cc21e05c83155c1f2aa9193387cfdf956cb48d153ba270406f9bbba537d4987d9e2f9942d7a14cbfffea74fecdda928d23e259f5ee1026100db16802f79a2f0d45f358d69fd33e44b81fae828622e93a54253e997d01b0743759da0e812b4aa4e6c8beab2328d5431955a418a67ff26a8c5c807a5da354e05ef31cc8cf758f463732950b03e265726fb94e39d6a572a26244ab08db75752ad026100a0a317cfe7df1423f87a6dee8451f4e2b4a67e5497f29b4f1e4e830b9fadd9401167026f5596e5a39c97817e0f5f16e27e19ec9902e01d7ea6fb9aa3c760afee1e381b69de6ac9c07585a06ad9c4ba00bf75c8ad2fa898a479e80ae294fed2a102600b21f335c353342eb44c3aa24445780c2d655b940174cae38c7c8a4e6493c0ba9fd303748267b083b9a7a6cb61e42db362b8c9896db7064e02ad5ae61587da15b4649c90594909feb37dbcb654beb7268ec801e5a8b4aa3911bebd88542f05be
+SPKI = 3081df300d06092a864886f70d01010105000381cd003081c90281c100cf2cd41e34ca3a728ea5cb8aff64c36d27bdef5364e336fd68d3123c5a196a8c287013e853d5156d58d151954520fb4f6d7b17abb6817765909c576119659d902b1906ed8a2b10c155c24d124528dab9eeae379beac66e4a411786dcb8fd0062ebc030de1219a04c2a8c1b7dd3131e4d6b6caee2e31a5ed41ac1509b2ef1ee2ab18364be568ca941c25ecc84ff9d643b5ec1aaae102a20d73f479b780fd6da91075212d9eac03a0674d899eba2e431f4c44b615b6ba2232bd4b33baed73d625d0203010001
+RSAPublicKey = 3081c90281c100cf2cd41e34ca3a728ea5cb8aff64c36d27bdef5364e336fd68d3123c5a196a8c287013e853d5156d58d151954520fb4f6d7b17abb6817765909c576119659d902b1906ed8a2b10c155c24d124528dab9eeae379beac66e4a411786dcb8fd0062ebc030de1219a04c2a8c1b7dd3131e4d6b6caee2e31a5ed41ac1509b2ef1ee2ab18364be568ca941c25ecc84ff9d643b5ec1aaae102a20d73f479b780fd6da91075212d9eac03a0674d899eba2e431f4c44b615b6ba2232bd4b33baed73d625d0203010001
+RSAPrivateKey = 3082037d0201000281c100cf2cd41e34ca3a728ea5cb8aff64c36d27bdef5364e336fd68d3123c5a196a8c287013e853d5156d58d151954520fb4f6d7b17abb6817765909c576119659d902b1906ed8a2b10c155c24d124528dab9eeae379beac66e4a411786dcb8fd0062ebc030de1219a04c2a8c1b7dd3131e4d6b6caee2e31a5ed41ac1509b2ef1ee2ab18364be568ca941c25ecc84ff9d643b5ec1aaae102a20d73f479b780fd6da91075212d9eac03a0674d899eba2e431f4c44b615b6ba2232bd4b33baed73d625d02030100010281c0198c141e23715a92bccf6a119a5bc11389468d2811f548d727e17b4ab0eb986d6f211efb53b71f7ccbea87ee69c75ee615008c5332deb52bf390abdfbfe37d7205368159b2638c1de326e21d22251f0fb5848b3bf15005d2a74330f0afe916ee62ccc1344d1d83a709e60676273840f7f377424a5e0a4da75f01b31ff76819cf9cbfdd215243c3917c03ef38199312e567b3bf7aed3ab457f371ef8a1423f45b68c6e282ec111bba2833b987fd69fad83bc1b8c613c5e1ea16c11ed125ea7ec1026100fc8d6c04bec4eb9a8192ca7900cbe536e2e8b519decf33b2459798c6909df4f176db7d23190fc72b8865a718af895f1bcd9145298027423b605e70a47cf58390a8c3e88fc8c48e8b32e3da210dfbe3e881ea5674b6a348c21e93f9e55ea65efd026100d200d45e788aacea606a401d0460f87dd5c1027e12dc1a0d7586e8939d9cf789b40f51ac0442961de7d21cc21e05c83155c1f2aa9193387cfdf956cb48d153ba270406f9bbba537d4987d9e2f9942d7a14cbfffea74fecdda928d23e259f5ee1026100db16802f79a2f0d45f358d69fd33e44b81fae828622e93a54253e997d01b0743759da0e812b4aa4e6c8beab2328d5431955a418a67ff26a8c5c807a5da354e05ef31cc8cf758f463732950b03e265726fb94e39d6a572a26244ab08db75752ad026100a0a317cfe7df1423f87a6dee8451f4e2b4a67e5497f29b4f1e4e830b9fadd9401167026f5596e5a39c97817e0f5f16e27e19ec9902e01d7ea6fb9aa3c760afee1e381b69de6ac9c07585a06ad9c4ba00bf75c8ad2fa898a479e80ae294fed2a102600b21f335c353342eb44c3aa24445780c2d655b940174cae38c7c8a4e6493c0ba9fd303748267b083b9a7a6cb61e42db362b8c9896db7064e02ad5ae61587da15b4649c90594909feb37dbcb654beb7268ec801e5a8b4aa3911bebd88542f05be
 
-Decrypt = RSA-OAEP-9
+Decrypt = RSA-OAEP-9/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 267bcd118acab1fc8ba81c85d73003cb8610fa55c1d97da8d48a7c7f06896a4db751aa284255b9d36ad65f37653d829f1b37f97b8001942545b2fc2c55a7376ca7a1be4b1760c8e05a33e5aa2526b8d98e317088e7834c755b2a59b12631a182c05d5d43ab1779264f8456f515ce57dfdf512d5493dab7b7338dc4b7d78db9c091ac3baf537a69fc7f549d979f0eff9a94fda4169bd4d1d19a69c99e33c3b55490d501b39b1edae118ff6793a153261584d3a5f39f6e682e3d17c8cd1261fa72
 Output = f735fd55ba92592c3b52b8f9c4f69aaa1cbef8fe88add095595412467f9cf4ec0b896c59eda16210e7549c8abb10cdbc21a12ec9b6b5b8fd2f10399eb6
 
-Decrypt = RSA-OAEP-9
+Decrypt = RSA-OAEP-9/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 93ac9f0671ec29acbb444effc1a5741351d60fdb0e393fbf754acf0de49761a14841df7772e9bc82773966a1584c4d72baea00118f83f35cca6e537cbd4d811f5583b29783d8a6d94cd31be70d6f526c10ff09c6fa7ce069795a3fcd0511fd5fcb564bcc80ea9c78f38b80012539d8a4ddf6fe81e9cddb7f50dbbbbcc7e5d86097ccf4ec49189fb8bf318be6d5a0715d516b49af191258cd32dc833ce6eb4673c03a19bbace88cc54895f636cc0c1ec89096d11ce235a265ca1764232a689ae8
 Output = 81b906605015a63aabe42ddf11e1978912f5404c7474b26dce3ed482bf961ecc818bf420c54659
 
-Decrypt = RSA-OAEP-9
+Decrypt = RSA-OAEP-9/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 81ebdd95054b0c822ef9ad7693f5a87adfb4b4c4ce70df2df84ed49c04da58ba5fc20a19e1a6e8b7a3900b22796dc4e869ee6b42792d15a8eceb56c09c69914e813cea8f6931e4b8ed6f421af298d595c97f4789c7caa612c7ef360984c21b93edc5401068b5af4c78a8771b984d53b8ea8adf2f6a7d4a0ba76c75e1dd9f658f20ded4a46071d46d7791b56803d8fea7f0b0f8e41ae3f09383a6f9585fe7753eaaffd2bf94563108beecc207bbb535f5fcc705f0dde9f708c62f49a9c90371d3
 Output = fd326429df9b890e09b54b18b8f34f1e24
 
-Decrypt = RSA-OAEP-9
+Decrypt = RSA-OAEP-9/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = bcc35f94cde66cb1136625d625b94432a35b22f3d2fa11a613ff0fca5bd57f87b902ccdc1cd0aebcb0715ee869d1d1fe395f6793003f5eca465059c88660d446ff5f0818552022557e38c08a67ead991262254f10682975ec56397768537f4977af6d5f6aaceb7fb25dec5937230231fd8978af49119a29f29e424ab8272b47562792d5c94f774b8829d0b0d9f1a8c9eddf37574d5fa248eefa9c5271fc5ec2579c81bdd61b410fa61fe36e424221c113addb275664c801d34ca8c6351e4a858
 Output = f1459b5f0c92f01a0f723a2e5662484d8f8c0a20fc29dad6acd43bb5f3effdf4e1b63e07fdfe6628d0d74ca19bf2d69e4a0abf86d293925a796772f8088e
 
-Decrypt = RSA-OAEP-9
+Decrypt = RSA-OAEP-9/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 232afbc927fa08c2f6a27b87d4a5cb09c07dc26fae73d73a90558839f4fd66d281b87ec734bce237ba166698ed829106a7de6942cd6cdce78fed8d2e4d81428e66490d036264cef92af941d3e35055fe3981e14d29cbb9a4f67473063baec79a1179f5a17c9c1832f2838fd7d5e59bb9659d56dce8a019edef1bb3accc697cc6cc7a778f60a064c7f6f5d529c6210262e003de583e81e3167b89971fb8c0e15d44fffef89b53d8d64dd797d159b56d2b08ea5307ea12c241bd58d4ee278a1f2e
 Output = 53e6e8c729d6f9c319dd317e74b0db8e4ccca25f3c8305746e137ac63a63ef3739e7b595abb96e8d55e54f7bd41ab433378ffb911d
 
-Decrypt = RSA-OAEP-9
+Decrypt = RSA-OAEP-9/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 438cc7dc08a68da249e42505f8573ba60e2c2773d5b290f4cf9dff718e842081c383e67024a0f29594ea987b9d25e4b738f285970d195abb3a8c8054e3d79d6b9c9a8327ba596f1259e27126674766907d8d582ff3a8476154929adb1e6d1235b2ccb4ec8f663ba9cc670a92bebd853c8dbf69c6436d016f61add836e94732450434207f9fd4c43dec2a12a958efa01efe2669899b5e604c255c55fb7166de5589e369597bb09168c06dd5db177e06a1740eb2d5c82faeca6d92fcee9931ba9f
 Output = b6b28ea2198d0c1008bc64
 
-PrivateKey = RSA-OAEP-10
+Key = RSA-OAEP-10
 Algorithm = RSA
-Input = 308204bd020100300d06092a864886f70d0101010500048204a7308204a30201000282010100ae45ed5601cec6b8cc05f803935c674ddbe0d75c4c09fd7951fc6b0caec313a8df39970c518bffba5ed68f3f0d7f22a4029d413f1ae07e4ebe9e4177ce23e7f5404b569e4ee1bdcf3c1fb03ef113802d4f855eb9b5134b5a7c8085adcae6fa2fa1417ec3763be171b0c62b760ede23c12ad92b980884c641f5a8fac26bdad4a03381a22fe1b754885094c82506d4019a535a286afeb271bb9ba592de18dcf600c2aeeae56e02f7cf79fc14cf3bdc7cd84febbbf950ca90304b2219a7aa063aefa2c3c1980e560cd64afe779585b6107657b957857efde6010988ab7de417fc88d8f384c4e6e72c3f943e0c31c0c4a5cc36f879d8a3ac9d7d59860eaada6b83bb020301000102820100056b04216fe5f354ac77250a4b6b0c8525a85c59b0bd80c56450a22d5f438e596a333aa875e291dd43f48cb88b9d5fc0d499f9fcd1c397f9afc070cd9e398c8d19e61db7c7410a6b2675dfbf5d345b804d201add502d5ce2dfcb091ce9997bbebe57306f383e4d588103f036f7e85d1934d152a323e4a8db451d6f4a5b1b0f102cc150e02feee2b88dea4ad4c1baccb24d84072d14e1d24a6771f7408ee30564fb86d4393a34bcf0b788501d193303f13a2284b001f0f649eaf79328d4ac5c430ab4414920a9460ed1b7bc40ec653e876d09abc509ae45b525190116a0c26101848298509c1c3bf3a483e7274054e15e97075036e989f60932807b5257751e7902818100ecf5aecd1e5515fffacbd75a2816c6ebf49018cdfb4638e185d66a7396b6f8090f8018c7fd95cc34b857dc17f0cc6516bb1346ab4d582cadad7b4103352387b70338d084047c9d9539b6496204b3dd6ea442499207bec01f964287ff6336c3984658336846f56e46861881c10233d2176bf15a5e96ddc780bc868aa77d3ce76902818100bc46c464fc6ac4ca783b0eb08a3c841b772f7e9b2f28babd588ae885e1a0c61e4858a0fb25ac299990f35be85164c259ba1175cdd7192707135184992b6c29b746dd0d2cabe142835f7d148cc161524b4a09946d48b828473f1ce76b6cb6886c345c03e05f41d51b5c3a90a3f24073c7d74a4fe25d9cf21c75960f3fc386318302818100c73564571d00fb15d08a3de9957a50915d7126e9442dacf42bc82e862e5673ff6a008ed4d2e374617df89f17a160b43b7fda9cb6b6b74218609815f7d45ca263c159aa32d272d127faf4bc8ca2d77378e8aeb19b0ad7da3cb3de0ae7314980f62b6d4b0a875d1df03c1bae39ccd833ef6cd7e2d9528bf084d1f969e794e9f6c10281802658b37f6df9c1030be1db68117fa9d87e39ea2b693b7e6d3a2f70947413eec6142e18fb8dfcb6ac545d7c86a0ad48f8457170f0efb26bc48126c53efd1d16920198dc2a1107dc282db6a80cd3062360ba3fa13f70e4312ff1a6cd6b8fc4cd9c5c3db17c6d6a57212f73ae29f619327bad59b153858585ba4e28b60a62a45e490281806f38526b3925085534ef3e415a836ede8b86158a2c7cbfeccb0bd834304fec683ba8d4f479c433d43416e63269623cea100776d85aff401d3fff610ee65411ce3b1363d63a9709eede42647cea561493d54570a879c18682cd97710b96205ec31117d73b5f36223fadd6e8ba90dd7c0ee61d44e163251e20c7f66eb305117cb8
+PKCS8 = 308204bd020100300d06092a864886f70d0101010500048204a7308204a30201000282010100ae45ed5601cec6b8cc05f803935c674ddbe0d75c4c09fd7951fc6b0caec313a8df39970c518bffba5ed68f3f0d7f22a4029d413f1ae07e4ebe9e4177ce23e7f5404b569e4ee1bdcf3c1fb03ef113802d4f855eb9b5134b5a7c8085adcae6fa2fa1417ec3763be171b0c62b760ede23c12ad92b980884c641f5a8fac26bdad4a03381a22fe1b754885094c82506d4019a535a286afeb271bb9ba592de18dcf600c2aeeae56e02f7cf79fc14cf3bdc7cd84febbbf950ca90304b2219a7aa063aefa2c3c1980e560cd64afe779585b6107657b957857efde6010988ab7de417fc88d8f384c4e6e72c3f943e0c31c0c4a5cc36f879d8a3ac9d7d59860eaada6b83bb020301000102820100056b04216fe5f354ac77250a4b6b0c8525a85c59b0bd80c56450a22d5f438e596a333aa875e291dd43f48cb88b9d5fc0d499f9fcd1c397f9afc070cd9e398c8d19e61db7c7410a6b2675dfbf5d345b804d201add502d5ce2dfcb091ce9997bbebe57306f383e4d588103f036f7e85d1934d152a323e4a8db451d6f4a5b1b0f102cc150e02feee2b88dea4ad4c1baccb24d84072d14e1d24a6771f7408ee30564fb86d4393a34bcf0b788501d193303f13a2284b001f0f649eaf79328d4ac5c430ab4414920a9460ed1b7bc40ec653e876d09abc509ae45b525190116a0c26101848298509c1c3bf3a483e7274054e15e97075036e989f60932807b5257751e7902818100ecf5aecd1e5515fffacbd75a2816c6ebf49018cdfb4638e185d66a7396b6f8090f8018c7fd95cc34b857dc17f0cc6516bb1346ab4d582cadad7b4103352387b70338d084047c9d9539b6496204b3dd6ea442499207bec01f964287ff6336c3984658336846f56e46861881c10233d2176bf15a5e96ddc780bc868aa77d3ce76902818100bc46c464fc6ac4ca783b0eb08a3c841b772f7e9b2f28babd588ae885e1a0c61e4858a0fb25ac299990f35be85164c259ba1175cdd7192707135184992b6c29b746dd0d2cabe142835f7d148cc161524b4a09946d48b828473f1ce76b6cb6886c345c03e05f41d51b5c3a90a3f24073c7d74a4fe25d9cf21c75960f3fc386318302818100c73564571d00fb15d08a3de9957a50915d7126e9442dacf42bc82e862e5673ff6a008ed4d2e374617df89f17a160b43b7fda9cb6b6b74218609815f7d45ca263c159aa32d272d127faf4bc8ca2d77378e8aeb19b0ad7da3cb3de0ae7314980f62b6d4b0a875d1df03c1bae39ccd833ef6cd7e2d9528bf084d1f969e794e9f6c10281802658b37f6df9c1030be1db68117fa9d87e39ea2b693b7e6d3a2f70947413eec6142e18fb8dfcb6ac545d7c86a0ad48f8457170f0efb26bc48126c53efd1d16920198dc2a1107dc282db6a80cd3062360ba3fa13f70e4312ff1a6cd6b8fc4cd9c5c3db17c6d6a57212f73ae29f619327bad59b153858585ba4e28b60a62a45e490281806f38526b3925085534ef3e415a836ede8b86158a2c7cbfeccb0bd834304fec683ba8d4f479c433d43416e63269623cea100776d85aff401d3fff610ee65411ce3b1363d63a9709eede42647cea561493d54570a879c18682cd97710b96205ec31117d73b5f36223fadd6e8ba90dd7c0ee61d44e163251e20c7f66eb305117cb8
+SPKI = 30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae45ed5601cec6b8cc05f803935c674ddbe0d75c4c09fd7951fc6b0caec313a8df39970c518bffba5ed68f3f0d7f22a4029d413f1ae07e4ebe9e4177ce23e7f5404b569e4ee1bdcf3c1fb03ef113802d4f855eb9b5134b5a7c8085adcae6fa2fa1417ec3763be171b0c62b760ede23c12ad92b980884c641f5a8fac26bdad4a03381a22fe1b754885094c82506d4019a535a286afeb271bb9ba592de18dcf600c2aeeae56e02f7cf79fc14cf3bdc7cd84febbbf950ca90304b2219a7aa063aefa2c3c1980e560cd64afe779585b6107657b957857efde6010988ab7de417fc88d8f384c4e6e72c3f943e0c31c0c4a5cc36f879d8a3ac9d7d59860eaada6b83bb0203010001
+RSAPublicKey = 3082010a0282010100ae45ed5601cec6b8cc05f803935c674ddbe0d75c4c09fd7951fc6b0caec313a8df39970c518bffba5ed68f3f0d7f22a4029d413f1ae07e4ebe9e4177ce23e7f5404b569e4ee1bdcf3c1fb03ef113802d4f855eb9b5134b5a7c8085adcae6fa2fa1417ec3763be171b0c62b760ede23c12ad92b980884c641f5a8fac26bdad4a03381a22fe1b754885094c82506d4019a535a286afeb271bb9ba592de18dcf600c2aeeae56e02f7cf79fc14cf3bdc7cd84febbbf950ca90304b2219a7aa063aefa2c3c1980e560cd64afe779585b6107657b957857efde6010988ab7de417fc88d8f384c4e6e72c3f943e0c31c0c4a5cc36f879d8a3ac9d7d59860eaada6b83bb0203010001
+RSAPrivateKey = 308204a30201000282010100ae45ed5601cec6b8cc05f803935c674ddbe0d75c4c09fd7951fc6b0caec313a8df39970c518bffba5ed68f3f0d7f22a4029d413f1ae07e4ebe9e4177ce23e7f5404b569e4ee1bdcf3c1fb03ef113802d4f855eb9b5134b5a7c8085adcae6fa2fa1417ec3763be171b0c62b760ede23c12ad92b980884c641f5a8fac26bdad4a03381a22fe1b754885094c82506d4019a535a286afeb271bb9ba592de18dcf600c2aeeae56e02f7cf79fc14cf3bdc7cd84febbbf950ca90304b2219a7aa063aefa2c3c1980e560cd64afe779585b6107657b957857efde6010988ab7de417fc88d8f384c4e6e72c3f943e0c31c0c4a5cc36f879d8a3ac9d7d59860eaada6b83bb020301000102820100056b04216fe5f354ac77250a4b6b0c8525a85c59b0bd80c56450a22d5f438e596a333aa875e291dd43f48cb88b9d5fc0d499f9fcd1c397f9afc070cd9e398c8d19e61db7c7410a6b2675dfbf5d345b804d201add502d5ce2dfcb091ce9997bbebe57306f383e4d588103f036f7e85d1934d152a323e4a8db451d6f4a5b1b0f102cc150e02feee2b88dea4ad4c1baccb24d84072d14e1d24a6771f7408ee30564fb86d4393a34bcf0b788501d193303f13a2284b001f0f649eaf79328d4ac5c430ab4414920a9460ed1b7bc40ec653e876d09abc509ae45b525190116a0c26101848298509c1c3bf3a483e7274054e15e97075036e989f60932807b5257751e7902818100ecf5aecd1e5515fffacbd75a2816c6ebf49018cdfb4638e185d66a7396b6f8090f8018c7fd95cc34b857dc17f0cc6516bb1346ab4d582cadad7b4103352387b70338d084047c9d9539b6496204b3dd6ea442499207bec01f964287ff6336c3984658336846f56e46861881c10233d2176bf15a5e96ddc780bc868aa77d3ce76902818100bc46c464fc6ac4ca783b0eb08a3c841b772f7e9b2f28babd588ae885e1a0c61e4858a0fb25ac299990f35be85164c259ba1175cdd7192707135184992b6c29b746dd0d2cabe142835f7d148cc161524b4a09946d48b828473f1ce76b6cb6886c345c03e05f41d51b5c3a90a3f24073c7d74a4fe25d9cf21c75960f3fc386318302818100c73564571d00fb15d08a3de9957a50915d7126e9442dacf42bc82e862e5673ff6a008ed4d2e374617df89f17a160b43b7fda9cb6b6b74218609815f7d45ca263c159aa32d272d127faf4bc8ca2d77378e8aeb19b0ad7da3cb3de0ae7314980f62b6d4b0a875d1df03c1bae39ccd833ef6cd7e2d9528bf084d1f969e794e9f6c10281802658b37f6df9c1030be1db68117fa9d87e39ea2b693b7e6d3a2f70947413eec6142e18fb8dfcb6ac545d7c86a0ad48f8457170f0efb26bc48126c53efd1d16920198dc2a1107dc282db6a80cd3062360ba3fa13f70e4312ff1a6cd6b8fc4cd9c5c3db17c6d6a57212f73ae29f619327bad59b153858585ba4e28b60a62a45e490281806f38526b3925085534ef3e415a836ede8b86158a2c7cbfeccb0bd834304fec683ba8d4f479c433d43416e63269623cea100776d85aff401d3fff610ee65411ce3b1363d63a9709eede42647cea561493d54570a879c18682cd97710b96205ec31117d73b5f36223fadd6e8ba90dd7c0ee61d44e163251e20c7f66eb305117cb8
 
-Decrypt = RSA-OAEP-10
+Decrypt = RSA-OAEP-10/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 53ea5dc08cd260fb3b858567287fa91552c30b2febfba213f0ae87702d068d19bab07fe574523dfb42139d68c3c5afeee0bfe4cb7969cbf382b804d6e61396144e2d0e60741f8993c3014b58b9b1957a8babcd23af854f4c356fb1662aa72bfcc7e586559dc4280d160c126785a723ebeebeff71f11594440aaef87d10793a8774a239d4a04c87fe1467b9daf85208ec6c7255794a96cc29142f9a8bd418e3c1fd67344b0cd0829df3b2bec60253196293c6b34d3f75d32f213dd45c6273d505adf4cced1057cb758fc26aeefa441255ed4e64c199ee075e7f16646182fdb464739b68ab5daff0e63e9552016824f054bf4d3c8c90a97bb6b6553284eb429fcc
 Output = 8bba6bf82a6c0f86d5f1756e97956870b08953b06b4eb205bc1694ee
 
-Decrypt = RSA-OAEP-10
+Decrypt = RSA-OAEP-10/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = a2b1a430a9d657e2fa1c2bb5ed43ffb25c05a308fe9093c01031795f5874400110828ae58fb9b581ce9dddd3e549ae04a0985459bde6c626594e7b05dc4278b2a1465c1368408823c85e96dc66c3a30983c639664fc4569a37fe21e5a195b5776eed2df8d8d361af686e750229bbd663f161868a50615e0c337bec0ca35fec0bb19c36eb2e0bbcc0582fa1d93aacdb061063f59f2ce1ee43605e5d89eca183d2acdfe9f81011022ad3b43a3dd417dac94b4e11ea81b192966e966b182082e71964607b4f8002f36299844a11f2ae0faeac2eae70f8f4f98088acdcd0ac556e9fccc511521908fad26f04c64201450305778758b0538bf8b5bb144a828e629795
 Output = e6ad181f053b58a904f2457510373e57
 
-Decrypt = RSA-OAEP-10
+Decrypt = RSA-OAEP-10/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 9886c3e6764a8b9a84e84148ebd8c3b1aa8050381a78f668714c16d9cfd2a6edc56979c535d9dee3b44b85c18be8928992371711472216d95dda98d2ee8347c9b14dffdff84aa48d25ac06f7d7e65398ac967b1ce90925f67dce049b7f812db0742997a74d44fe81dbe0e7a3feaf2e5c40af888d550ddbbe3bc20657a29543f8fc2913b9bd1a61b2ab2256ec409bbd7dc0d17717ea25c43f42ed27df8738bf4afc6766ff7aff0859555ee283920f4c8a63c4a7340cbafddc339ecdb4b0515002f96c932b5b79167af699c0ad3fccfdf0f44e85a70262bf2e18fe34b850589975e867ff969d48eabf212271546cdc05a69ecb526e52870c836f307bd798780ede
 Output = 510a2cf60e866fa2340553c94ea39fbc256311e83e94454b4124
 
-Decrypt = RSA-OAEP-10
+Decrypt = RSA-OAEP-10/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 6318e9fb5c0d05e5307e1683436e903293ac4642358aaa223d7163013aba87e2dfda8e60c6860e29a1e92686163ea0b9175f329ca3b131a1edd3a77759a8b97bad6a4f8f4396f28cf6f39ca58112e48160d6e203daa5856f3aca5ffed577af499408e3dfd233e3e604dbe34a9c4c9082de65527cac6331d29dc80e0508a0fa7122e7f329f6cca5cfa34d4d1da417805457e008bec549e478ff9e12a763c477d15bbb78f5b69bd57830fc2c4ed686d79bc72a95d85f88134c6b0afe56a8ccfbc855828bb339bd17909cf1d70de3335ae07039093e606d655365de6550b872cd6de1d440ee031b61945f629ad8a353b0d40939e96a3c450d2a8d5eee9f678093c8
 Output = bcdd190da3b7d300df9a06e22caae2a75f10c91ff667b7c16bde8b53064a2649a94045c9
 
-Decrypt = RSA-OAEP-10
+Decrypt = RSA-OAEP-10/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 75290872ccfd4a4505660d651f56da6daa09ca1301d890632f6a992f3d565cee464afded40ed3b5be9356714ea5aa7655f4a1366c2f17c728f6f2c5a5d1f8e28429bc4e6f8f2cff8da8dc0e0a9808e45fd09ea2fa40cb2b6ce6ffff5c0e159d11b68d90a85f7b84e103b09e682666480c657505c0929259468a314786d74eab131573cf234bf57db7d9e66cc6748192e002dc0deea930585f0831fdcd9bc33d51f79ed2ffc16bcf4d59812fcebcaa3f9069b0e445686d644c25ccf63b456ee5fa6ffe96f19cdf751fed9eaf35957754dbf4bfea5216aa1844dc507cb2d080e722eba150308c2b5ff1193620f1766ecf4481bafb943bd292877f2136ca494aba0
 Output = a7dd6c7dc24b46f9dd5f1e91ada4c3b3df947e877232a9
 
-Decrypt = RSA-OAEP-10
+Decrypt = RSA-OAEP-10/Private
 RSAPadding = OAEP
 MGF1Digest = SHA1
 Input = 2d207a73432a8fb4c03051b3f73b28a61764098dfa34c47a20995f8115aa6816679b557e82dbee584908c6e69782d7deb34dbd65af063d57fca76a5fd069492fd6068d9984d209350565a62e5c77f23038c12cb10c6634709b547c46f6b4a709bd85ca122d74465ef97762c29763e06dbc7a9e738c78bfca0102dc5e79d65b973f28240caab2e161a78b57d262457ed8195d53e3c7ae9da021883c6db7c24afdd2322eac972ad3c354c5fcef1e146c3a0290fb67adf007066e00428d2cec18ce58f9328698defef4b2eb5ec76918fde1c198cbb38b7afc67626a9aefec4322bfd90d2563481c9a221f78c8272c82d1b62ab914e1c69f6af6ef30ca5260db4a46
@@ -1475,7 +1537,7 @@
 # RSA with no padding implements raw public and private transforms. This is not
 # a real signature scheme, but might be used to construct one.
 
-Sign = RSA-2048
+Sign = RSA-2048/Private
 RSAPadding = None
 Input = 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002
 Output = 93d0bae8ad0d94de400eb078dd10edd7418ef1bf11b8e8b5d2b86b142e77d603e108fbcca2b976aa7b5326e5369db3bb73bf74f8d47c36a6318e913888c873502a561fc69329e7c24a0a016d81310449a52b29e49a6a41bdfe6c10a8d90072d64b4486756fd007c0071da2a8c7107a904621c11f0d81aa80b655a713c28170594ece28133dfbfddd61d4e4dad0d6781f6145a351a994054993fd57cd1330966ce97d7ac259b15616fd7235e2cac29fdc1c05f1612c61785614b80e7b650c03ef77d64163d75fa637cc2a9a7e570b3176fdcfb6ad6d25e8515f6ced02cfb3a441c87220044110fd27dcb53888f0377e1797bf297b7da27d3f033cd8b5d60ececc
@@ -1491,7 +1553,7 @@
 Output = 93d0bae8ad0d94de400eb078dd10edd7418ef1bf11b8e8b5d2b86b142e77d603e108fbcca2b976aa7b5326e5369db3bb73bf74f8d47c36a6318e913888c873502a561fc69329e7c24a0a016d81310449a52b29e49a6a41bdfe6c10a8d90072d64b4486756fd007c0071da2a8c7107a904621c11f0d81aa80b655a713c28170594ece28133dfbfddd61d4e4dad0d6781f6145a351a994054993fd57cd1330966ce97d7ac259b15616fd7235e2cac29fdc1c05f1612c61785614b80e7b650c03ef77d64163d75fa637cc2a9a7e570b3176fdcfb6ad6d25e8515f6ced02cfb3a441c87220044110fd27dcb53888f0377e1797bf297b7da27d3f033cd8b5d60ececc
 Error = BAD_SIGNATURE
 
-Sign = RSA-2048
+Sign = RSA-2048/Private
 RSAPadding = None
 Input = "Too short"
 Error = DATA_TOO_SMALL
@@ -1502,7 +1564,7 @@
 Output = 93d0bae8ad0d94de400eb078dd10edd7418ef1bf11b8e8b5d2b86b142e77d603e108fbcca2b976aa7b5326e5369db3bb73bf74f8d47c36a6318e913888c873502a561fc69329e7c24a0a016d81310449a52b29e49a6a41bdfe6c10a8d90072d64b4486756fd007c0071da2a8c7107a904621c11f0d81aa80b655a713c28170594ece28133dfbfddd61d4e4dad0d6781f6145a351a994054993fd57cd1330966ce97d7ac259b15616fd7235e2cac29fdc1c05f1612c61785614b80e7b650c03ef77d64163d75fa637cc2a9a7e570b3176fdcfb6ad6d25e8515f6ced02cfb3a441c87220044110fd27dcb53888f0377e1797bf297b7da27d3f033cd8b5d60ececc
 Error = BAD_SIGNATURE
 
-Sign = RSA-2048
+Sign = RSA-2048/Private
 Digest = SHA256
 RSAPadding = None
 Input = 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002
@@ -1514,7 +1576,7 @@
 # string instead of the serialized DigestInfo. This is not a real signature
 # scheme, but might be used to construct one.
 
-Sign = RSA-2048
+Sign = RSA-2048/Private
 Input = 01234567
 Output = 9925a048eb9e225819dea311be206ea1287ad90bdf77218bb1348829ef7072e7b4a772b6cb1df1480d4ede4140feb84e03c4c99c851f91cf293ed3259a6ef8f567130164465a39e83306b69a22b74ec26adca77da8e1cc625c3721269b410819298f1c6399eb8c68bcc8df16ab149eae0959947a5918b4fd49396af80b557124712f27f760cc69d09d6d1db0883decf05ee072e98f15b153bd74e2ec98a00ea514a4c9c2a98a0813cb5b53381e030779612e3de972f8029cf363bec7098ecda568eee6371ecb10f6448e707e08b47f557a9f7e87024a2a1249d1f8dc540b35a79f9e6c0188cbc406cc434cefd83538c3cffb7663f9e46a7787a6a630c5a1c675
 
@@ -1530,7 +1592,7 @@
 
 # Single-shot signing tests.
 
-SignMessage = RSA-2048
+SignMessage = RSA-2048/Private
 Digest = SHA256
 Input = "Hello world"
 Output = 301894798b49d6ec55d32dcc74314f04230591a515781f3eb4492f5324b56046836c4bc3e25942af341e88558cb4c3814a849207575d343189147989b16e296b5138dbbc717116dc416f201dfa35943d15060493953cda1f04a13ff89845cf7fd69e1a78d5d38522a77bb234e5d0ba2ae17ada6e22fdae27a4052fdb8ac267507dfe06ed7a865e61a52b530bbbf65c7caa89739613df10ae3b0e62ff6831ee0770086aad39c329462aede9f1b29a501bc3d09e0fe4034aa5d6831d44491d508111d88a1d7ba50cee5ef7e701b3a589adc09a752a974a6805956f4a1a0582f66309a1e02e9fb6b10d2c820fe98bb2eb04f435bc8a649cc9ab6c5a4c03e83800d1
@@ -1540,13 +1602,13 @@
 Input = "Hello world"
 Output = 301894798b49d6ec55d32dcc74314f04230591a515781f3eb4492f5324b56046836c4bc3e25942af341e88558cb4c3814a849207575d343189147989b16e296b5138dbbc717116dc416f201dfa35943d15060493953cda1f04a13ff89845cf7fd69e1a78d5d38522a77bb234e5d0ba2ae17ada6e22fdae27a4052fdb8ac267507dfe06ed7a865e61a52b530bbbf65c7caa89739613df10ae3b0e62ff6831ee0770086aad39c329462aede9f1b29a501bc3d09e0fe4034aa5d6831d44491d508111d88a1d7ba50cee5ef7e701b3a589adc09a752a974a6805956f4a1a0582f66309a1e02e9fb6b10d2c820fe98bb2eb04f435bc8a649cc9ab6c5a4c03e83800d1
 
-VerifyMessage = RSA-2048-SPKI
+VerifyMessage = RSA-2048
 Digest = SHA256
 Input = "Hello world"
 Output = 301894798b49d6ec55d32dcc74314f04230591a515781f3eb4492f5324b56046836c4bc3e25942af341e88558cb4c3814a849207575d343189147989b16e296b5138dbbc717116dc416f201dfa35943d15060493953cda1f04a13ff89845cf7fd69e1a78d5d38522a77bb234e5d0ba2ae17ada6e22fdae27a4052fdb8ac267507dfe06ed7a865e61a52b530bbbf65c7caa89739613df10ae3b0e62ff6831ee0770086aad39c329462aede9f1b29a501bc3d09e0fe4034aa5d6831d44491d508111d88a1d7ba50cee5ef7e701b3a589adc09a752a974a6805956f4a1a0582f66309a1e02e9fb6b10d2c820fe98bb2eb04f435bc8a649cc9ab6c5a4c03e83800d1
 
 # Digest can't be omitted in many algorithms.
-SignMessage = RSA-2048
+SignMessage = RSA-2048/Private
 Input = "Hello world"
 Error = NO_DEFAULT_DIGEST

boringssl-0.20260708.tar.xz/crypto/evp/test/x25519_tests.txt -> boringssl-0.20260813.tar.xz/crypto/evp/test/x25519_tests.txt Changed

@@ -1,25 +1,30 @@
 # EVP X25519 tests
 
-PrivateKey = X25519-Private
+Key = X25519-Ours
 Algorithm = X25519
-Input = 302e020100300506032b656e04220420a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4
-RawPublic = 1c9fd88f45606d932a80c71824ae151d15d73e77de38e8e000852e614fae7019
+PKCS8 = 302e020100300506032b656e04220420a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4
 RawPrivate = a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4
+SPKI = 302a300506032b656e0321001c9fd88f45606d932a80c71824ae151d15d73e77de38e8e000852e614fae7019
+RawPublic = 1c9fd88f45606d932a80c71824ae151d15d73e77de38e8e000852e614fae7019
 
-PublicKey = X25519-Peer
+Key = X25519-Peer
 Algorithm = X25519
-Input = 302a300506032b656e032100e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c
+SPKI = 302a300506032b656e032100e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c
 RawPublic = e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c
 
-PublicKey = X25519-SmallOrderPeer
+Key = X25519-SmallOrderPeer
 Algorithm = X25519
 RawPublic = e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800
-Input = 302a300506032b656e032100e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800
+SPKI = 302a300506032b656e032100e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800
 
-Derive = X25519-Private
+Derive = X25519-Ours/Private
 DerivePeer = X25519-Peer
 Output = c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552
 
-Derive = X25519-Private
+Derive = X25519-Ours/Private
 DerivePeer = X25519-SmallOrderPeer
 Error = INVALID_PEER_KEY
+
+Derive = X25519-Ours/PublicOnly
+DerivePeer = X25519-Peer
+Error = NOT_A_PRIVATE_KEY

boringssl-0.20260708.tar.xz/crypto/evp/test/xwing_tests.txt -> boringssl-0.20260813.tar.xz/crypto/evp/test/xwing_tests.txt Changed

@@ -4,78 +4,70 @@
 # https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-xwing-kem-06,
 # Appendix C.
 
-PrivateKeyFromSeed = X-Wing-PrivateSeed-1
+Key = X-Wing-1
 Algorithm = X-Wing
-Input = 7f9c2ba4e88f827d616045507605853ed73b8093f6efbc88eb1a6eacfa66ef26
+PrivateSeed = 7f9c2ba4e88f827d616045507605853ed73b8093f6efbc88eb1a6eacfa66ef26
 RawPublic = e2236b35a8c24b39b10aa1323a96a919a2ced88400633a7b07131713fc14b2b5b19cfc3da5fa1a92c49f25513e0fd30d6b1611c9ab9635d7086727a4b7d21d34244e66969cf15b3b2a785329f61b096b277ea037383479a6b556de7231fe4b7fa9c9ac24c0699a0018a5253401bacfa905ca816573e56a2d2e067e9b7287533ba13a937dedb31fa44baced40769923610034ae31e619a170245199b3c5c39864859fe1b4c9717a07c30495bdfb98a0a002ccf56c1286cef5041dede3c44cf16bf562c7448518026b3d8b9940680abd38a1575fd27b58da063bfac32c39c30869374c05c1aeb1898b6b303cc68be455346ee0af699636224a148ca2aea10463111c709f69b69c70ce8538746698c4c60a9aef0030c7924ceec42a5d36816f545eae13293460b3acb37ea0e13d70e4aa78686da398a8397c08eaf96882113fe4f7bad4da40b0501e1c753efe73053c87014e8661c33099afe8bede414a5b1aa27d8392b3e131e9a70c1055878240cad0f40d5fe3cdf85236ead97e2a97448363b2808caafd516cd25052c5c362543c2517e4acd0e60ec07163009b6425fc32277acee71c24bab53ed9f29e74c66a0a3564955998d76b96a9a8b50d1635a4d7a67eb42df5644d330457293a8042f53cc7a69288f17ed55827e82b28e82665a86a14fbd96645eca8172c044f83bc0d8c0b4c8626985631ca87af829068f1358963cb333664ca482763ba3b3bb208577f9ba6ac62c25f76592743b64be519317714cb4102cb7b2f9a25b2b4f0615de31decd9ca55026d6da0b65111b16fe52feed8a487e144462a6dba93728f500b6ffc49e515569ef25fed17aff520507368253525860f58be3be61c964604a6ac814e6935596402a520a4670b3d284318866593d15a4bb01c35e3e587ee0c67d2880d6f2407fb7a70712b838deb96c5d7bf2b44bcf6038ccbe33fbcf51a54a584fe90083c91c7a6d43d4fb15f48c60c2fd66e0a8aad4ad64e5c42bb8877c0ebec2b5e387c8a988fdc23beb9e16c8757781e0a1499c61e138c21f216c29d076979871caa6942bafc090544bee99b54b16cb9a9a364d6246d9f42cce53c66b59c45c8f9ae9299a75d15180c3c952151a91b7a10772429dc4cbae6fcc622fa8018c63439f890630b9928db6bb7f9438ae4065ed34d73d486f3f52f90f0807dc88dfdd8c728e954f1ac35c06c000ce41a0582580e3bb57b672972890ac5e7988e7850657116f1b57d0809aaedec0bede1ae148148311c6f7e317346e5189fb8cd635b986f8c0bdd27641c584b778b3a911a80be1c9692ab8e1bbb12839573cce19df183b45835bbb55052f9fc66a1678ef2a36dea78411e6c8d60501b4e60592d13698a943b509185db912e2ea10be06171236b327c71716094c964a68b03377f513a05bcd99c1f346583bb052977a10a12adfc758034e5617da4c1276585e5774e1f3b9978b09d0e9c44d3bc86151c43aad185712717340223ac381d21150a04294e97bb13bbda21b5a182b6da969e19a7fd072737fa8e880a53c2428e3d049b7d2197405296ddb361912a7bcf4827ced611d0c7a7da104dde4322095339f64a61d5bb108ff0bf4d780cae509fb22c256914193ff7349042581237d522828824ee3bdfd07fb03f1f942d2ea179fe722f06cc03de5b69859edb06eff389b27dce59844570216223593d4ba32d9abac8cd049040ef6534
 
-PublicKeyFromRaw = X-Wing-Public-1
+EncapsulateDecapsulate = X-Wing-1/Private
 Algorithm = X-Wing
-Input = e2236b35a8c24b39b10aa1323a96a919a2ced88400633a7b07131713fc14b2b5b19cfc3da5fa1a92c49f25513e0fd30d6b1611c9ab9635d7086727a4b7d21d34244e66969cf15b3b2a785329f61b096b277ea037383479a6b556de7231fe4b7fa9c9ac24c0699a0018a5253401bacfa905ca816573e56a2d2e067e9b7287533ba13a937dedb31fa44baced40769923610034ae31e619a170245199b3c5c39864859fe1b4c9717a07c30495bdfb98a0a002ccf56c1286cef5041dede3c44cf16bf562c7448518026b3d8b9940680abd38a1575fd27b58da063bfac32c39c30869374c05c1aeb1898b6b303cc68be455346ee0af699636224a148ca2aea10463111c709f69b69c70ce8538746698c4c60a9aef0030c7924ceec42a5d36816f545eae13293460b3acb37ea0e13d70e4aa78686da398a8397c08eaf96882113fe4f7bad4da40b0501e1c753efe73053c87014e8661c33099afe8bede414a5b1aa27d8392b3e131e9a70c1055878240cad0f40d5fe3cdf85236ead97e2a97448363b2808caafd516cd25052c5c362543c2517e4acd0e60ec07163009b6425fc32277acee71c24bab53ed9f29e74c66a0a3564955998d76b96a9a8b50d1635a4d7a67eb42df5644d330457293a8042f53cc7a69288f17ed55827e82b28e82665a86a14fbd96645eca8172c044f83bc0d8c0b4c8626985631ca87af829068f1358963cb333664ca482763ba3b3bb208577f9ba6ac62c25f76592743b64be519317714cb4102cb7b2f9a25b2b4f0615de31decd9ca55026d6da0b65111b16fe52feed8a487e144462a6dba93728f500b6ffc49e515569ef25fed17aff520507368253525860f58be3be61c964604a6ac814e6935596402a520a4670b3d284318866593d15a4bb01c35e3e587ee0c67d2880d6f2407fb7a70712b838deb96c5d7bf2b44bcf6038ccbe33fbcf51a54a584fe90083c91c7a6d43d4fb15f48c60c2fd66e0a8aad4ad64e5c42bb8877c0ebec2b5e387c8a988fdc23beb9e16c8757781e0a1499c61e138c21f216c29d076979871caa6942bafc090544bee99b54b16cb9a9a364d6246d9f42cce53c66b59c45c8f9ae9299a75d15180c3c952151a91b7a10772429dc4cbae6fcc622fa8018c63439f890630b9928db6bb7f9438ae4065ed34d73d486f3f52f90f0807dc88dfdd8c728e954f1ac35c06c000ce41a0582580e3bb57b672972890ac5e7988e7850657116f1b57d0809aaedec0bede1ae148148311c6f7e317346e5189fb8cd635b986f8c0bdd27641c584b778b3a911a80be1c9692ab8e1bbb12839573cce19df183b45835bbb55052f9fc66a1678ef2a36dea78411e6c8d60501b4e60592d13698a943b509185db912e2ea10be06171236b327c71716094c964a68b03377f513a05bcd99c1f346583bb052977a10a12adfc758034e5617da4c1276585e5774e1f3b9978b09d0e9c44d3bc86151c43aad185712717340223ac381d21150a04294e97bb13bbda21b5a182b6da969e19a7fd072737fa8e880a53c2428e3d049b7d2197405296ddb361912a7bcf4827ced611d0c7a7da104dde4322095339f64a61d5bb108ff0bf4d780cae509fb22c256914193ff7349042581237d522828824ee3bdfd07fb03f1f942d2ea179fe722f06cc03de5b69859edb06eff389b27dce59844570216223593d4ba32d9abac8cd049040ef6534
 
-EncapsulateDecapsulate = X-Wing-PrivateSeed-1
+Encapsulate = X-Wing-1
 Algorithm = X-Wing
 
-Encapsulate = X-Wing-Public-1
-Algorithm = X-Wing
-
-Decapsulate = X-Wing-PrivateSeed-1
+Decapsulate = X-Wing-1/Private
 Algorithm = X-Wing
 Input = b83aa828d4d62b9a83ceffe1d3d3bb1ef31264643c070c5798927e41fb07914a273f8f96e7826cd5375a283d7da885304c5de0516a0f0654243dc5b97f8bfeb831f68251219aabdd723bc6512041acbaef8af44265524942b902e68ffd23221cda70b1b55d776a92d1143ea3a0c475f63ee6890157c7116dae3f62bf72f60acd2bb8cc31ce2ba0de364f52b8ed38c79d719715963a5dd3842d8e8b43ab704e4759b5327bf027c63c8fa857c4908d5a8a7b88ac7f2be394d93c3706ddd4e698cc6ce370101f4d0213254238b4a2e8821b6e414a1cf20f6c1244b699046f5a01caa0a1a55516300b40d2048c77cc73afba79afeea9d2c0118bdf2adb8870dc328c5516cc45b1a2058141039e2c90a110a9e16b318dfb53bd49a126d6b73f215787517b8917cc01cabd107d06859854ee8b4f9861c226d3764c87339ab16c3667d2f49384e55456dd40414b70a6af841585f4c90c68725d57704ee8ee7ce6e2f9be582dbee985e038ffc346ebfb4e22158b6c84374a9ab4a44e1f91de5aac5197f89bc5e5442f51f9a5937b102ba3beaebf6e1c58380a4a5fedce4a4e5026f88f528f59ffd2db41752b3a3d90efabe463899b7d40870c530c8841e8712b733668ed033adbfafb2d49d37a44d4064e5863eb0af0a08d47b3cc888373bc05f7a33b841bc2587c57eb69554e8a3767b7506917b6b70498727f16eac1a36ec8d8cfaf751549f2277db277e8a55a9a5106b23a0206b4721fa9b3048552c5bd5b594d6e247f38c18c591aea7f56249c72ce7b117afcc3a8621582f9cf71787e183dee09367976e98409ad9217a497df888042384d7707a6b78f5f7fb8409e3b535175373461b776002d799cbad62860be70573ecbe13b246e0da7e93a52168e0fb6a9756b895ef7f0147a0dc81bfa644b088a9228160c0f9acf1379a2941cd28c06ebc80e44e17aa2f8177010afd78a97ce0868d1629ebb294c5151812c583daeb88685220f4da9118112e07041fcc24d5564a99fdbde28869fe0722387d7a9a4d16e1cc8555917e09944aa5ebaaaec2cf62693afad42a3f518fce67d273cc6c9fb5472b380e8573ec7de06a3ba2fd5f931d725b493026cb0acbd3fe62d00e4c790d965d7a03a3c0b4222ba8c2a9a16e2ac658f572ae0e746eafc4feba023576f08942278a041fb82a70a595d5bacbf297ce2029898a71e5c3b0d1c6228b485b1ade509b35fbca7eca97b2132e7cb6bc465375146b7dceac969308ac0c2ac89e7863eb8943015b24314cafb9c7c0e85fe543d56658c213632599efabfc1ec49dd8c88547bb2cc40c9d38cbd3099b4547840560531d0188cd1e9c23a0ebee0a03d5577d66b1d2bcb4baaf21cc7fef1e03806ca96299df0dfbc56e1b2b43e4fc20c37f834c4af62127e7dae86c3c25a2f696ac8b589dec71d595bfbe94b5ed4bc07d800b330796fda89edb77be0294136139354eb8cd37591578f9c600dd9be8ec6219fdd507adf3397ed4d68707b8d13b24ce4cd8fb22851bfe9d632407f31ed6f7cb1600de56f17576740ce2a32fc5145030145cfb97e63e0e41d354274a079d3e6fb2e15
 Output = d2df0522128f09dd8e2c92b1e905c793d8f57a54c3da25861f10bf4ca613e384
 
-PrivateKeyFromSeed = X-Wing-PrivateSeed-2
+Key = X-Wing-2
 Algorithm = X-Wing
-Input = badfd6dfaac359a5efbb7bcc4b59d538df9a04302e10c8bc1cbf1a0b3a5120ea
+PrivateSeed = badfd6dfaac359a5efbb7bcc4b59d538df9a04302e10c8bc1cbf1a0b3a5120ea
 RawPublic = 0333285fa253661508c9fb444852caa4061636cb060e69943b431400134ae1fbc02287247cb38068bbb89e6714af10a3fcda6613acc4b5e4b0d6eb960c302a0253b1f507b596f0884d351da89b01c35543214c8e542390b2bc497967961ef10286879c34316e6483b644fc27e8019d73024ba1d1cc83650bb068a5431b33d1221b3d122dc1239010a55cb13782140893f30aca7c09380255a0c621602ffbb6a9db064c1406d12723ab3bbe2950a21fe521b160b30b16724cc359754b4c88342651333ea9412d5137791cf75558ebc5c54c520dd6c622a059f6b332ccebb9f24103e59a297cd69e4a48a3bfe53a5958559e840db5c023f66c10ce23081c2c8261d744799ba078285cfa71ac51f44708d0a6212c3993340724b3ac38f63e82a889a4fc581f6b8353cc6233ac8f5394b6cca292f892360570a3031c90c4da3f02a895677390e60c24684a405f69ccf1a7b95312a47c844a4f9c2c4a37696dc10072a87bf41a2717d45b2a99ce09a4898d5a3f6b67085f9a626646bcf369982d483972b9cd7d244c4f49970f766a22507925eca7df99a491d80c27723e84c7b49b633a46b46785a16a41e02c538251622117364615d9c2cdaa1687a860c18bfc9ce8690efb2a524cb97cdfd1a4ea661fa7d08817998af838679b07c9db8455e2167a67c14d6a347522e89e8971270bec858364b1c1023b82c483cf8a8b76f040fe41c24dec2d49f6376170660605b80383391c4abad1136d874a77ef73b440758b6e7059add20873192e6e372e069c22c5425188e5c240cb3a6e29197ad17e87ec41a813af68531f262a6db25bbdb8a15d2ed9c9f35b9f2063890bd26ef09426f225aa1e6008d31600a29bcdf3b10d0bc72788d35e25f4976b3ca6ac7cbf0b442ae399b225d9714d0638a864bda7018d3b7c793bd2ace6ac68f4284d10977cc029cf203c5698f15a06b162d6c8b4fd40c6af40824f9c6101bb94e9327869ab7efd835dfc805367160d6c8571e3643ac70cbad5b96a1ad99352793f5af71705f95126cb4787392e94d808491a2245064ba5a7a30c066301392a6c315336e10dbc9c2177c7af382765b6c88eeab51588d01d6a95747f3652dc5b5c401a23863c7a0343737c737c99287a40a90896d4594730b552b910d23244684206f0eb842fb9aa316ab182282a75fb72b6806cea4774b822169c386a58773c3edc8229d85905abb87ac228f0f7a2ce9a497bb5325e17a6a82777a997c036c3b862d29c14682ad325a9600872f3913029a1588648ba590a7157809ff740b5138380015c40e9fb90f0311107946f28e5962e21666ad65092a3a60480cd16e61ff7fb5b44b70cf12201878428ef8067fceb1e1dcb49d66c773d312c7e53238cb620e126187009472d41036b702032411dc96cb750631df9d99452e495deb4300df660c8d35f32b424e98c7ed14b12d8ab11a289ac63c50a24d52925950e49ba6bf4c2c38953c92d60b6cd034e575c711ac41bfa66951f62b9392828d7b45aed377ac69c35f1c6b80f388f34e0bb9ce8167eb2bc630382825c396a407e905108081b444ac8a07c2507376a750d18248ee0a81c4318d9a38fc44c3b41e8681f87c34138442659512c41276e1cc8fc4eb66e12727bcb5a9e0e405cdea21538d6ea885ab169050e6b91e1b69f7ed34bcbb48fd4c562a576549f85b528c953926d96ea8a160b8843f1c89c62
 
-PublicKeyFromRaw = X-Wing-Public-2
+EncapsulateDecapsulate = X-Wing-2/Private
 Algorithm = X-Wing
-Input = 0333285fa253661508c9fb444852caa4061636cb060e69943b431400134ae1fbc02287247cb38068bbb89e6714af10a3fcda6613acc4b5e4b0d6eb960c302a0253b1f507b596f0884d351da89b01c35543214c8e542390b2bc497967961ef10286879c34316e6483b644fc27e8019d73024ba1d1cc83650bb068a5431b33d1221b3d122dc1239010a55cb13782140893f30aca7c09380255a0c621602ffbb6a9db064c1406d12723ab3bbe2950a21fe521b160b30b16724cc359754b4c88342651333ea9412d5137791cf75558ebc5c54c520dd6c622a059f6b332ccebb9f24103e59a297cd69e4a48a3bfe53a5958559e840db5c023f66c10ce23081c2c8261d744799ba078285cfa71ac51f44708d0a6212c3993340724b3ac38f63e82a889a4fc581f6b8353cc6233ac8f5394b6cca292f892360570a3031c90c4da3f02a895677390e60c24684a405f69ccf1a7b95312a47c844a4f9c2c4a37696dc10072a87bf41a2717d45b2a99ce09a4898d5a3f6b67085f9a626646bcf369982d483972b9cd7d244c4f49970f766a22507925eca7df99a491d80c27723e84c7b49b633a46b46785a16a41e02c538251622117364615d9c2cdaa1687a860c18bfc9ce8690efb2a524cb97cdfd1a4ea661fa7d08817998af838679b07c9db8455e2167a67c14d6a347522e89e8971270bec858364b1c1023b82c483cf8a8b76f040fe41c24dec2d49f6376170660605b80383391c4abad1136d874a77ef73b440758b6e7059add20873192e6e372e069c22c5425188e5c240cb3a6e29197ad17e87ec41a813af68531f262a6db25bbdb8a15d2ed9c9f35b9f2063890bd26ef09426f225aa1e6008d31600a29bcdf3b10d0bc72788d35e25f4976b3ca6ac7cbf0b442ae399b225d9714d0638a864bda7018d3b7c793bd2ace6ac68f4284d10977cc029cf203c5698f15a06b162d6c8b4fd40c6af40824f9c6101bb94e9327869ab7efd835dfc805367160d6c8571e3643ac70cbad5b96a1ad99352793f5af71705f95126cb4787392e94d808491a2245064ba5a7a30c066301392a6c315336e10dbc9c2177c7af382765b6c88eeab51588d01d6a95747f3652dc5b5c401a23863c7a0343737c737c99287a40a90896d4594730b552b910d23244684206f0eb842fb9aa316ab182282a75fb72b6806cea4774b822169c386a58773c3edc8229d85905abb87ac228f0f7a2ce9a497bb5325e17a6a82777a997c036c3b862d29c14682ad325a9600872f3913029a1588648ba590a7157809ff740b5138380015c40e9fb90f0311107946f28e5962e21666ad65092a3a60480cd16e61ff7fb5b44b70cf12201878428ef8067fceb1e1dcb49d66c773d312c7e53238cb620e126187009472d41036b702032411dc96cb750631df9d99452e495deb4300df660c8d35f32b424e98c7ed14b12d8ab11a289ac63c50a24d52925950e49ba6bf4c2c38953c92d60b6cd034e575c711ac41bfa66951f62b9392828d7b45aed377ac69c35f1c6b80f388f34e0bb9ce8167eb2bc630382825c396a407e905108081b444ac8a07c2507376a750d18248ee0a81c4318d9a38fc44c3b41e8681f87c34138442659512c41276e1cc8fc4eb66e12727bcb5a9e0e405cdea21538d6ea885ab169050e6b91e1b69f7ed34bcbb48fd4c562a576549f85b528c953926d96ea8a160b8843f1c89c62
 
-EncapsulateDecapsulate = X-Wing-PrivateSeed-2
+Encapsulate = X-Wing-2
 Algorithm = X-Wing
 
-Encapsulate = X-Wing-Public-2
-Algorithm = X-Wing
-
-Decapsulate = X-Wing-PrivateSeed-2
+Decapsulate = X-Wing-2/Private
 Algorithm = X-Wing
 Input = c93beb22326705699bbc3d1d0aa6339be7a405debe61a7c337e1a91453c097a6f77c130639d1aaeb193175f1a987aa1fd789a63c9cd487ebd6965f5d8389c8d7c8cfacbba4b44d2fbe0ae84de9e96fb11215d9b76acd51887b752329c1a3e0468ccc49392c1e0f1aad61a73c10831e60a9798cb2e7ec07596b5803db3e243ecbb94166feade0c9197378700f8eb65a43502bbac4605992e2de2b906ab30ba401d7e1ff3c98f42cfc4b30b974d3316f331461ac05f43e0db7b41d3da702a4f567b6ee7295199c7be92f6b4a47e7307d34278e03c872fb48647c446a64a3937dccd7c6d8de4d34b9dea45a0b065ef15b9e94d1b6df6dca7174d9bc9d14c6225e3a78a58785c3fe4e2fe6a0706f3365389e4258fbb61ecf1a1957715982b3f1844424e03acd83da7eee50573f6cd3ff396841e9a00ad679da92274129da277833d0524674feea09a98d25b888616f338412d8e65e151e65736c8c6fb448c9260fa20e7b2712148bcd3a0853865f50c1fc9e4f201aee3757120e034fd509d954b7a749ff776561382c4cb64cebcbb6aa82d04cd5c2b40395ecaf231bde8334ecfd955d09efa8c6e7935b1cb0298fb8b6740be4593360eed5f129d59d98822a6cea37c57674e919e84d6b90f695fca58e7d29092bd70f7c97c6dfb021b9f87216a6271d8b144a364d03b6bf084f972dc59800b14a2c008bbd0992b5b82801020978f2bdddb3ca3367d876cffb3548dab695a29882cae2eb5ba7c847c3c71bd0150fa9c33aac8e6240e0c269b8e295ddb7b77e9c17bd310be65e28c0802136d086777be5652d6f1ac879d3263e9c712d1af736eac048fe848a577d6afaea1428dc71db8c430edd7b584ae6e6aeaf7257aff0fd8fe25c30840e30ccfa1d95118ef0f6657367e9070f3d97a2e9a7bae19957bd707b00e31b6b0ebb9d7df4bd22e44c060830a194b5b8288353255b52954ff5905ab2b126d9aa049e44599368c27d6cb033eae5182c2e1504ee4e3745f51488997b8f958f0209064f6f44a7e4de5226d5594d1ad9b42ac59a2d100a2f190df873a2e141552f33c923b4c927e8747c6f830c441a8bd3c5b371f6b3ab8103ebcfb18543aefc1beb6f776bbfd5344779f4aa23daaf395f69ec31dc046b491f0e5cc9c651dfc306bd8f2105be7bc7a4f4e21957f87278c771528a8740a92e2daefa76a3525f1fae17ec4362a2700988001d860011d6ca3a95f79a0205bcf634cef373a8ea273ff0f4250eb8617d0fb92102a6aa09cf0c3ee2cad1ad96438c8e4dfd6ee0fcc85833c3103dd6c1600cd305bc2df4cda89b55ca237a3f9c3f82390074ff30825fc750130ebaf13d0cf7556d2c52a98a4bad39ca5d44aaadeaef775c695e64d06e966acfcd552a14e2df6c63ae541f0fa88fc48263089685704506a21a03856ce65d4f06d54f3157eeabd62491cb4ac7bf029e79f9fbd4c77e2a3588790c710e611da8b2040c76a61507a8020758dcc30894ad018fef98e401cc54106e20d94bd544a8f0e1fd0500342d123f618aa8c91bdf6e0e03200693c9651e469aee6f91c98bea4127ae66312f4ae3ea155b67
 Output = f2e86241c64d60f6649fbc6c5b7d17180b780a3f34355e64a85749949c45f150
 
 # Private key too short.
-PrivateKeyFromSeed = X-Wing-PrivateSeed-TooShort
+Key = X-Wing-PrivateSeed-TooShort
 Algorithm = X-Wing
-Input = 7f9c2ba4e88f827d616045507605853ed73b8093f6efbc88eb1a6eac
+PrivateSeed = 7f9c2ba4e88f827d616045507605853ed73b8093f6efbc88eb1a6eac
 Error = DECODE_ERROR
 
 # Private key too long.
-PrivateKeyFromSeed = X-Wing-PrivateSeed-TooLong
+Key = X-Wing-PrivateSeed-TooLong
 Algorithm = X-Wing
-Input = 7f9c2ba4e88f827d616045507605853ed73b8093f6efbc88eb1a6eacfa66ef26deadbeef
+PrivateSeed = 7f9c2ba4e88f827d616045507605853ed73b8093f6efbc88eb1a6eacfa66ef26deadbeef
 Error = DECODE_ERROR
 
 # Public key too short.
-PublicKeyFromRaw = X-Wing-Public-TooShort
+Key = X-Wing-Public-TooShort
 Algorithm = X-Wing
-Input = e2236b35a8c24b39b10aa1323a96a919a2ced88400633a7b07131713fc14b2b5b19cfc3da5fa1a92c49f25513e0fd30d6b1611c9ab9635d7086727a4b7d21d34244e66969cf15b3b2a785329f61b096b277ea037383479a6b556de7231fe4b7fa9c9ac24c0699a0018a5253401bacfa905ca816573e56a2d2e067e9b7287533ba13a937dedb31fa44baced40769923610034ae31e619a170245199b3c5c39864859fe1b4c9717a07c30495bdfb98a0a002ccf56c1286cef5041dede3c44cf16bf562c7448518026b3d8b9940680abd38a1575fd27b58da063bfac32c39c30869374c05c1aeb1898b6b303cc68be455346ee0af699636224a148ca2aea10463111c709f69b69c70ce8538746698c4c60a9aef0030c7924ceec42a5d36816f545eae13293460b3acb37ea0e13d70e4aa78686da398a8397c08eaf96882113fe4f7bad4da40b0501e1c753efe73053c87014e8661c33099afe8bede414a5b1aa27d8392b3e131e9a70c1055878240cad0f40d5fe3cdf85236ead97e2a97448363b2808caafd516cd25052c5c362543c2517e4acd0e60ec07163009b6425fc32277acee71c24bab53ed9f29e74c66a0a3564955998d76b96a9a8b50d1635a4d7a67eb42df5644d330457293a8042f53cc7a69288f17ed55827e82b28e82665a86a14fbd96645eca8172c044f83bc0d8c0b4c8626985631ca87af829068f1358963cb333664ca482763ba3b3bb208577f9ba6ac62c25f76592743b64be519317714cb4102cb7b2f9a25b2b4f0615de31decd9ca55026d6da0b65111b16fe52feed8a487e144462a6dba93728f500b6ffc49e515569ef25fed17aff520507368253525860f58be3be61c964604a6ac814e6935596402a520a4670b3d284318866593d15a4bb01c35e3e587ee0c67d2880d6f2407fb7a70712b838deb96c5d7bf2b44bcf6038ccbe33fbcf51a54a584fe90083c91c7a6d43d4fb15f48c60c2fd66e0a8aad4ad64e5c42bb8877c0ebec2b5e387c8a988fdc23beb9e16c8757781e0a1499c61e138c21f216c29d076979871caa6942bafc090544bee99b54b16cb9a9a364d6246d9f42cce53c66b59c45c8f9ae9299a75d15180c3c952151a91b7a10772429dc4cbae6fcc622fa8018c63439f890630b9928db6bb7f9438ae4065ed34d73d486f3f52f90f0807dc88dfdd8c728e954f1ac35c06c000ce41a0582580e3bb57b672972890ac5e7988e7850657116f1b57d0809aaedec0bede1ae148148311c6f7e317346e5189fb8cd635b986f8c0bdd27641c584b778b3a911a80be1c9692ab8e1bbb12839573cce19df183b45835bbb55052f9fc66a1678ef2a36dea78411e6c8d60501b4e60592d13698a943b509185db912e2ea10be06171236b327c71716094c964a68b03377f513a05bcd99c1f346583bb052977a10a12adfc758034e5617da4c1276585e5774e1f3b9978b09d0e9c44d3bc86151c43aad185712717340223ac381d21150a04294e97bb13bbda21b5a182b6da969e19a7fd072737fa8e880a53c2428e3d049b7d2197405296ddb361912a7bcf4827ced611d0c7a7da104dde4322095339f64a61d5bb108ff0bf4d780cae509fb22c256914193ff7349042581237d522828824ee3bdfd07fb03f1f942d2ea179fe722f06cc03de5b69859edb06eff389b27dce59844570216223593d4ba32d9abac8cd0490
+RawPublic = e2236b35a8c24b39b10aa1323a96a919a2ced88400633a7b07131713fc14b2b5b19cfc3da5fa1a92c49f25513e0fd30d6b1611c9ab9635d7086727a4b7d21d34244e66969cf15b3b2a785329f61b096b277ea037383479a6b556de7231fe4b7fa9c9ac24c0699a0018a5253401bacfa905ca816573e56a2d2e067e9b7287533ba13a937dedb31fa44baced40769923610034ae31e619a170245199b3c5c39864859fe1b4c9717a07c30495bdfb98a0a002ccf56c1286cef5041dede3c44cf16bf562c7448518026b3d8b9940680abd38a1575fd27b58da063bfac32c39c30869374c05c1aeb1898b6b303cc68be455346ee0af699636224a148ca2aea10463111c709f69b69c70ce8538746698c4c60a9aef0030c7924ceec42a5d36816f545eae13293460b3acb37ea0e13d70e4aa78686da398a8397c08eaf96882113fe4f7bad4da40b0501e1c753efe73053c87014e8661c33099afe8bede414a5b1aa27d8392b3e131e9a70c1055878240cad0f40d5fe3cdf85236ead97e2a97448363b2808caafd516cd25052c5c362543c2517e4acd0e60ec07163009b6425fc32277acee71c24bab53ed9f29e74c66a0a3564955998d76b96a9a8b50d1635a4d7a67eb42df5644d330457293a8042f53cc7a69288f17ed55827e82b28e82665a86a14fbd96645eca8172c044f83bc0d8c0b4c8626985631ca87af829068f1358963cb333664ca482763ba3b3bb208577f9ba6ac62c25f76592743b64be519317714cb4102cb7b2f9a25b2b4f0615de31decd9ca55026d6da0b65111b16fe52feed8a487e144462a6dba93728f500b6ffc49e515569ef25fed17aff520507368253525860f58be3be61c964604a6ac814e6935596402a520a4670b3d284318866593d15a4bb01c35e3e587ee0c67d2880d6f2407fb7a70712b838deb96c5d7bf2b44bcf6038ccbe33fbcf51a54a584fe90083c91c7a6d43d4fb15f48c60c2fd66e0a8aad4ad64e5c42bb8877c0ebec2b5e387c8a988fdc23beb9e16c8757781e0a1499c61e138c21f216c29d076979871caa6942bafc090544bee99b54b16cb9a9a364d6246d9f42cce53c66b59c45c8f9ae9299a75d15180c3c952151a91b7a10772429dc4cbae6fcc622fa8018c63439f890630b9928db6bb7f9438ae4065ed34d73d486f3f52f90f0807dc88dfdd8c728e954f1ac35c06c000ce41a0582580e3bb57b672972890ac5e7988e7850657116f1b57d0809aaedec0bede1ae148148311c6f7e317346e5189fb8cd635b986f8c0bdd27641c584b778b3a911a80be1c9692ab8e1bbb12839573cce19df183b45835bbb55052f9fc66a1678ef2a36dea78411e6c8d60501b4e60592d13698a943b509185db912e2ea10be06171236b327c71716094c964a68b03377f513a05bcd99c1f346583bb052977a10a12adfc758034e5617da4c1276585e5774e1f3b9978b09d0e9c44d3bc86151c43aad185712717340223ac381d21150a04294e97bb13bbda21b5a182b6da969e19a7fd072737fa8e880a53c2428e3d049b7d2197405296ddb361912a7bcf4827ced611d0c7a7da104dde4322095339f64a61d5bb108ff0bf4d780cae509fb22c256914193ff7349042581237d522828824ee3bdfd07fb03f1f942d2ea179fe722f06cc03de5b69859edb06eff389b27dce59844570216223593d4ba32d9abac8cd0490
 Error = DECODE_ERROR
 
-# Public key too short.
-PublicKeyFromRaw = X-Wing-Public-TooLong
+# Public key too long.
+Key = X-Wing-Public-TooLong
 Algorithm = X-Wing
-Input = e2236b35a8c24b39b10aa1323a96a919a2ced88400633a7b07131713fc14b2b5b19cfc3da5fa1a92c49f25513e0fd30d6b1611c9ab9635d7086727a4b7d21d34244e66969cf15b3b2a785329f61b096b277ea037383479a6b556de7231fe4b7fa9c9ac24c0699a0018a5253401bacfa905ca816573e56a2d2e067e9b7287533ba13a937dedb31fa44baced40769923610034ae31e619a170245199b3c5c39864859fe1b4c9717a07c30495bdfb98a0a002ccf56c1286cef5041dede3c44cf16bf562c7448518026b3d8b9940680abd38a1575fd27b58da063bfac32c39c30869374c05c1aeb1898b6b303cc68be455346ee0af699636224a148ca2aea10463111c709f69b69c70ce8538746698c4c60a9aef0030c7924ceec42a5d36816f545eae13293460b3acb37ea0e13d70e4aa78686da398a8397c08eaf96882113fe4f7bad4da40b0501e1c753efe73053c87014e8661c33099afe8bede414a5b1aa27d8392b3e131e9a70c1055878240cad0f40d5fe3cdf85236ead97e2a97448363b2808caafd516cd25052c5c362543c2517e4acd0e60ec07163009b6425fc32277acee71c24bab53ed9f29e74c66a0a3564955998d76b96a9a8b50d1635a4d7a67eb42df5644d330457293a8042f53cc7a69288f17ed55827e82b28e82665a86a14fbd96645eca8172c044f83bc0d8c0b4c8626985631ca87af829068f1358963cb333664ca482763ba3b3bb208577f9ba6ac62c25f76592743b64be519317714cb4102cb7b2f9a25b2b4f0615de31decd9ca55026d6da0b65111b16fe52feed8a487e144462a6dba93728f500b6ffc49e515569ef25fed17aff520507368253525860f58be3be61c964604a6ac814e6935596402a520a4670b3d284318866593d15a4bb01c35e3e587ee0c67d2880d6f2407fb7a70712b838deb96c5d7bf2b44bcf6038ccbe33fbcf51a54a584fe90083c91c7a6d43d4fb15f48c60c2fd66e0a8aad4ad64e5c42bb8877c0ebec2b5e387c8a988fdc23beb9e16c8757781e0a1499c61e138c21f216c29d076979871caa6942bafc090544bee99b54b16cb9a9a364d6246d9f42cce53c66b59c45c8f9ae9299a75d15180c3c952151a91b7a10772429dc4cbae6fcc622fa8018c63439f890630b9928db6bb7f9438ae4065ed34d73d486f3f52f90f0807dc88dfdd8c728e954f1ac35c06c000ce41a0582580e3bb57b672972890ac5e7988e7850657116f1b57d0809aaedec0bede1ae148148311c6f7e317346e5189fb8cd635b986f8c0bdd27641c584b778b3a911a80be1c9692ab8e1bbb12839573cce19df183b45835bbb55052f9fc66a1678ef2a36dea78411e6c8d60501b4e60592d13698a943b509185db912e2ea10be06171236b327c71716094c964a68b03377f513a05bcd99c1f346583bb052977a10a12adfc758034e5617da4c1276585e5774e1f3b9978b09d0e9c44d3bc86151c43aad185712717340223ac381d21150a04294e97bb13bbda21b5a182b6da969e19a7fd072737fa8e880a53c2428e3d049b7d2197405296ddb361912a7bcf4827ced611d0c7a7da104dde4322095339f64a61d5bb108ff0bf4d780cae509fb22c256914193ff7349042581237d522828824ee3bdfd07fb03f1f942d2ea179fe722f06cc03de5b69859edb06eff389b27dce59844570216223593d4ba32d9abac8cd049040ef6534deadbeef
+RawPublic = e2236b35a8c24b39b10aa1323a96a919a2ced88400633a7b07131713fc14b2b5b19cfc3da5fa1a92c49f25513e0fd30d6b1611c9ab9635d7086727a4b7d21d34244e66969cf15b3b2a785329f61b096b277ea037383479a6b556de7231fe4b7fa9c9ac24c0699a0018a5253401bacfa905ca816573e56a2d2e067e9b7287533ba13a937dedb31fa44baced40769923610034ae31e619a170245199b3c5c39864859fe1b4c9717a07c30495bdfb98a0a002ccf56c1286cef5041dede3c44cf16bf562c7448518026b3d8b9940680abd38a1575fd27b58da063bfac32c39c30869374c05c1aeb1898b6b303cc68be455346ee0af699636224a148ca2aea10463111c709f69b69c70ce8538746698c4c60a9aef0030c7924ceec42a5d36816f545eae13293460b3acb37ea0e13d70e4aa78686da398a8397c08eaf96882113fe4f7bad4da40b0501e1c753efe73053c87014e8661c33099afe8bede414a5b1aa27d8392b3e131e9a70c1055878240cad0f40d5fe3cdf85236ead97e2a97448363b2808caafd516cd25052c5c362543c2517e4acd0e60ec07163009b6425fc32277acee71c24bab53ed9f29e74c66a0a3564955998d76b96a9a8b50d1635a4d7a67eb42df5644d330457293a8042f53cc7a69288f17ed55827e82b28e82665a86a14fbd96645eca8172c044f83bc0d8c0b4c8626985631ca87af829068f1358963cb333664ca482763ba3b3bb208577f9ba6ac62c25f76592743b64be519317714cb4102cb7b2f9a25b2b4f0615de31decd9ca55026d6da0b65111b16fe52feed8a487e144462a6dba93728f500b6ffc49e515569ef25fed17aff520507368253525860f58be3be61c964604a6ac814e6935596402a520a4670b3d284318866593d15a4bb01c35e3e587ee0c67d2880d6f2407fb7a70712b838deb96c5d7bf2b44bcf6038ccbe33fbcf51a54a584fe90083c91c7a6d43d4fb15f48c60c2fd66e0a8aad4ad64e5c42bb8877c0ebec2b5e387c8a988fdc23beb9e16c8757781e0a1499c61e138c21f216c29d076979871caa6942bafc090544bee99b54b16cb9a9a364d6246d9f42cce53c66b59c45c8f9ae9299a75d15180c3c952151a91b7a10772429dc4cbae6fcc622fa8018c63439f890630b9928db6bb7f9438ae4065ed34d73d486f3f52f90f0807dc88dfdd8c728e954f1ac35c06c000ce41a0582580e3bb57b672972890ac5e7988e7850657116f1b57d0809aaedec0bede1ae148148311c6f7e317346e5189fb8cd635b986f8c0bdd27641c584b778b3a911a80be1c9692ab8e1bbb12839573cce19df183b45835bbb55052f9fc66a1678ef2a36dea78411e6c8d60501b4e60592d13698a943b509185db912e2ea10be06171236b327c71716094c964a68b03377f513a05bcd99c1f346583bb052977a10a12adfc758034e5617da4c1276585e5774e1f3b9978b09d0e9c44d3bc86151c43aad185712717340223ac381d21150a04294e97bb13bbda21b5a182b6da969e19a7fd072737fa8e880a53c2428e3d049b7d2197405296ddb361912a7bcf4827ced611d0c7a7da104dde4322095339f64a61d5bb108ff0bf4d780cae509fb22c256914193ff7349042581237d522828824ee3bdfd07fb03f1f942d2ea179fe722f06cc03de5b69859edb06eff389b27dce59844570216223593d4ba32d9abac8cd049040ef6534deadbeef
 Error = DECODE_ERROR
 
 # Ciphertext too short.
-Decapsulate = X-Wing-PrivateSeed-1
+Decapsulate = X-Wing-1/Private
 Algorithm = X-Wing
 Input = b83aa828d4d62b9a83ceffe1d3d3bb1ef31264643c070c5798927e41fb07914a273f8f96e7826cd5375a283d7da885304c5de0516a0f0654243dc5b97f8bfeb831f68251219aabdd723bc6512041acbaef8af44265524942b902e68ffd23221cda70b1b55d776a92d1143ea3a0c475f63ee6890157c7116dae3f62bf72f60acd2bb8cc31ce2ba0de364f52b8ed38c79d719715963a5dd3842d8e8b43ab704e4759b5327bf027c63c8fa857c4908d5a8a7b88ac7f2be394d93c3706ddd4e698cc6ce370101f4d0213254238b4a2e8821b6e414a1cf20f6c1244b699046f5a01caa0a1a55516300b40d2048c77cc73afba79afeea9d2c0118bdf2adb8870dc328c5516cc45b1a2058141039e2c90a110a9e16b318dfb53bd49a126d6b73f215787517b8917cc01cabd107d06859854ee8b4f9861c226d3764c87339ab16c3667d2f49384e55456dd40414b70a6af841585f4c90c68725d57704ee8ee7ce6e2f9be582dbee985e038ffc346ebfb4e22158b6c84374a9ab4a44e1f91de5aac5197f89bc5e5442f51f9a5937b102ba3beaebf6e1c58380a4a5fedce4a4e5026f88f528f59ffd2db41752b3a3d90efabe463899b7d40870c530c8841e8712b733668ed033adbfafb2d49d37a44d4064e5863eb0af0a08d47b3cc888373bc05f7a33b841bc2587c57eb69554e8a3767b7506917b6b70498727f16eac1a36ec8d8cfaf751549f2277db277e8a55a9a5106b23a0206b4721fa9b3048552c5bd5b594d6e247f38c18c591aea7f56249c72ce7b117afcc3a8621582f9cf71787e183dee09367976e98409ad9217a497df888042384d7707a6b78f5f7fb8409e3b535175373461b776002d799cbad62860be70573ecbe13b246e0da7e93a52168e0fb6a9756b895ef7f0147a0dc81bfa644b088a9228160c0f9acf1379a2941cd28c06ebc80e44e17aa2f8177010afd78a97ce0868d1629ebb294c5151812c583daeb88685220f4da9118112e07041fcc24d5564a99fdbde28869fe0722387d7a9a4d16e1cc8555917e09944aa5ebaaaec2cf62693afad42a3f518fce67d273cc6c9fb5472b380e8573ec7de06a3ba2fd5f931d725b493026cb0acbd3fe62d00e4c790d965d7a03a3c0b4222ba8c2a9a16e2ac658f572ae0e746eafc4feba023576f08942278a041fb82a70a595d5bacbf297ce2029898a71e5c3b0d1c6228b485b1ade509b35fbca7eca97b2132e7cb6bc465375146b7dceac969308ac0c2ac89e7863eb8943015b24314cafb9c7c0e85fe543d56658c213632599efabfc1ec49dd8c88547bb2cc40c9d38cbd3099b4547840560531d0188cd1e9c23a0ebee0a03d5577d66b1d2bcb4baaf21cc7fef1e03806ca96299df0dfbc56e1b2b43e4fc20c37f834c4af62127e7dae86c3c25a2f696ac8b589dec71d595bfbe94b5ed4bc07d800b330796fda89edb77be0294136139354eb8cd37591578f9c600dd9be8ec6219fdd507adf3397ed4d68707b8d13b24ce4cd8fb22851bfe9d632407f31ed6f7cb1600de56f17576740ce2a32fc5145030145cfb97e63e0e41d354274a079d3
 DecapsulateFail
 
 # Ciphertext too long.
-Decapsulate = X-Wing-PrivateSeed-1
+Decapsulate = X-Wing-1/Private
 Algorithm = X-Wing
 Input = b83aa828d4d62b9a83ceffe1d3d3bb1ef31264643c070c5798927e41fb07914a273f8f96e7826cd5375a283d7da885304c5de0516a0f0654243dc5b97f8bfeb831f68251219aabdd723bc6512041acbaef8af44265524942b902e68ffd23221cda70b1b55d776a92d1143ea3a0c475f63ee6890157c7116dae3f62bf72f60acd2bb8cc31ce2ba0de364f52b8ed38c79d719715963a5dd3842d8e8b43ab704e4759b5327bf027c63c8fa857c4908d5a8a7b88ac7f2be394d93c3706ddd4e698cc6ce370101f4d0213254238b4a2e8821b6e414a1cf20f6c1244b699046f5a01caa0a1a55516300b40d2048c77cc73afba79afeea9d2c0118bdf2adb8870dc328c5516cc45b1a2058141039e2c90a110a9e16b318dfb53bd49a126d6b73f215787517b8917cc01cabd107d06859854ee8b4f9861c226d3764c87339ab16c3667d2f49384e55456dd40414b70a6af841585f4c90c68725d57704ee8ee7ce6e2f9be582dbee985e038ffc346ebfb4e22158b6c84374a9ab4a44e1f91de5aac5197f89bc5e5442f51f9a5937b102ba3beaebf6e1c58380a4a5fedce4a4e5026f88f528f59ffd2db41752b3a3d90efabe463899b7d40870c530c8841e8712b733668ed033adbfafb2d49d37a44d4064e5863eb0af0a08d47b3cc888373bc05f7a33b841bc2587c57eb69554e8a3767b7506917b6b70498727f16eac1a36ec8d8cfaf751549f2277db277e8a55a9a5106b23a0206b4721fa9b3048552c5bd5b594d6e247f38c18c591aea7f56249c72ce7b117afcc3a8621582f9cf71787e183dee09367976e98409ad9217a497df888042384d7707a6b78f5f7fb8409e3b535175373461b776002d799cbad62860be70573ecbe13b246e0da7e93a52168e0fb6a9756b895ef7f0147a0dc81bfa644b088a9228160c0f9acf1379a2941cd28c06ebc80e44e17aa2f8177010afd78a97ce0868d1629ebb294c5151812c583daeb88685220f4da9118112e07041fcc24d5564a99fdbde28869fe0722387d7a9a4d16e1cc8555917e09944aa5ebaaaec2cf62693afad42a3f518fce67d273cc6c9fb5472b380e8573ec7de06a3ba2fd5f931d725b493026cb0acbd3fe62d00e4c790d965d7a03a3c0b4222ba8c2a9a16e2ac658f572ae0e746eafc4feba023576f08942278a041fb82a70a595d5bacbf297ce2029898a71e5c3b0d1c6228b485b1ade509b35fbca7eca97b2132e7cb6bc465375146b7dceac969308ac0c2ac89e7863eb8943015b24314cafb9c7c0e85fe543d56658c213632599efabfc1ec49dd8c88547bb2cc40c9d38cbd3099b4547840560531d0188cd1e9c23a0ebee0a03d5577d66b1d2bcb4baaf21cc7fef1e03806ca96299df0dfbc56e1b2b43e4fc20c37f834c4af62127e7dae86c3c25a2f696ac8b589dec71d595bfbe94b5ed4bc07d800b330796fda89edb77be0294136139354eb8cd37591578f9c600dd9be8ec6219fdd507adf3397ed4d68707b8d13b24ce4cd8fb22851bfe9d632407f31ed6f7cb1600de56f17576740ce2a32fc5145030145cfb97e63e0e41d354274a079d3e6fb2e15deadbeef
 DecapsulateFail

boringssl-0.20260708.tar.xz/crypto/fipsmodule/bn/asm/x86_64-mont5.pl -> boringssl-0.20260813.tar.xz/crypto/fipsmodule/bn/asm/x86_64-mont5.pl Changed

boringssl-0.20260708.tar.xz/crypto/fipsmodule/bn/bn_test.cc -> boringssl-0.20260813.tar.xz/crypto/fipsmodule/bn/bn_test.cc Changed

@@ -889,8 +889,10 @@
   if (!BN_is_one(gcd.get())) {
     EXPECT_FALSE(BN_mod_inverse(ret.get(), a.get(), b.get(), ctx))
         << "A^-1 (mod B) computed, but it does not exist";
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_BN, std::nullopt}}));
     EXPECT_FALSE(BN_mod_inverse(ret.get(), b.get(), a.get(), ctx))
         << "B^-1 (mod A) computed, but it does not exist";
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_BN, std::nullopt}}));
 
     if (!BN_is_zero(b.get())) {
       UniquePtr<BIGNUM> a_reduced(BN_new());
@@ -901,6 +903,7 @@
                                             a_reduced.get(), b.get(), ctx))
           << "A^-1 (mod B) computed, but it does not exist";
       EXPECT_TRUE(no_inverse);
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_BN, std::nullopt}}));
     }
 
     if (!BN_is_zero(a.get())) {
@@ -912,6 +915,7 @@
                                             b_reduced.get(), a.get(), ctx))
           << "B^-1 (mod A) computed, but it does not exist";
       EXPECT_TRUE(no_inverse);
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_BN, std::nullopt}}));
     }
   }
 
@@ -2728,19 +2732,26 @@
 }
 
 TEST_F(BNTest, ModSqrtInvalid) {
+  // The modulus. `BN_mod_sqrt` is only defined for prime moduli, but this one
+  // is 1237 * 3709.
+  UniquePtr<BIGNUM> bn4588033 = ASCIIToBIGNUM("4588033");
+  ASSERT_TRUE(bn4588033);
+
+  // Two numbers that, when trying to take their square root via
+  // Tonelli-Shanks, will lead to an endless loop.
   UniquePtr<BIGNUM> bn2140141 = ASCIIToBIGNUM("2140141");
   ASSERT_TRUE(bn2140141);
   UniquePtr<BIGNUM> bn2140142 = ASCIIToBIGNUM("2140142");
   ASSERT_TRUE(bn2140142);
-  UniquePtr<BIGNUM> bn4588033 = ASCIIToBIGNUM("4588033");
-  ASSERT_TRUE(bn4588033);
 
-  // `BN_mod_sqrt` may fail or return an arbitrary value, so we do not use
-  // `TestModSqrt` or `TestNotModSquare`. We only promise it will not crash or
-  // infinite loop. (For some invalid inputs, it may even be non-deterministic.)
-  // See CVE-2022-0778.
+  // `BN_mod_sqrt` may fail or return an arbitrary value if fed a composite
+  // `p`, so we do not use `TestModSqrt` or `TestNotModSquare`. We only promise
+  // it will not crash or infinite loop. (For some invalid inputs, it may even
+  // be non-deterministic.) See CVE-2022-0778.
   BN_free(BN_mod_sqrt(nullptr, bn2140141.get(), bn4588033.get(), ctx()));
+  ERR_clear_error();
   BN_free(BN_mod_sqrt(nullptr, bn2140142.get(), bn4588033.get(), ctx()));
+  ERR_clear_error();
 }
 
 // Test that constructing Montgomery contexts for large bignums is not possible.
@@ -2754,6 +2765,7 @@
   UniquePtr<BN_MONT_CTX> mont(
       BN_MONT_CTX_new_for_modulus(large_bignum.get(), ctx()));
   EXPECT_FALSE(mont);
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_BN, BN_R_BIGNUM_TOO_LONG}}));
 
   // The same limit should apply when `BN_mod_exp_mont_consttime` internally
   // constructs a `BN_MONT_CTX`.
@@ -2762,6 +2774,7 @@
   EXPECT_FALSE(BN_mod_exp_mont_consttime(r.get(), BN_value_one(),
                                          large_bignum.get(), large_bignum.get(),
                                          ctx(), nullptr));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_BN, BN_R_BIGNUM_TOO_LONG}}));
 }
 
 TEST_F(BNTest, FormatWord) {

boringssl-0.20260708.tar.xz/crypto/fipsmodule/cipher/cipher.cc.inc -> boringssl-0.20260813.tar.xz/crypto/fipsmodule/cipher/cipher.cc.inc Changed

@@ -66,11 +66,6 @@
     return 0;
   }
 
-  if (in->poisoned) {
-    OPENSSL_PUT_ERROR(CIPHER, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-    return 0;
-  }
-
   EVP_CIPHER_CTX_cleanup(out);
   OPENSSL_memcpy(out, in, sizeof(EVP_CIPHER_CTX));
 
@@ -190,9 +185,6 @@
 
   ctx->buf_len = 0;
   ctx->final_used = 0;
-  // Clear the poisoned flag to permit reuse of a CTX that previously had a
-  // failed operation.
-  ctx->poisoned = 0;
   return 1;
 }
 
@@ -215,6 +207,47 @@
   return len & (ctx->cipher->block_size - 1);
 }
 
+static size_t evp_cipher_ctx_max_encrypt_update(const EVP_CIPHER_CTX *ctx,
+                                                size_t in_len) {
+  if (in_len == 0) {
+    return 0;
+  }
+
+  size_t block_size = ctx->cipher->block_size;
+  // `block_size` must be a power of 2.
+  assert(block_size != 0 && (block_size & (block_size - 1)) == 0);
+  size_t buf_len = ctx->buf_len;
+
+  // Any buffered input is combined with `in_len`, then we round down to a
+  // multiple of the block size.
+  return (in_len + buf_len) & ~(block_size - 1);
+}
+
+size_t EVP_CIPHER_CTX_max_next_update(const EVP_CIPHER_CTX *ctx,
+                                      size_t in_len) {
+  if (in_len == 0) {
+    return 0;
+  }
+
+  size_t ret = evp_cipher_ctx_max_encrypt_update(ctx, in_len);
+  size_t block_size = ctx->cipher->block_size;
+  size_t buf_len = ctx->buf_len;
+  if (!ctx->encrypt && block_size > 1 && !(ctx->flags & EVP_CIPH_NO_PADDING)) {
+    if (ctx->final_used) {
+      // There was a buffered decrypted block. Now that it is known to not have
+      // padding, DecryptUpdate will output it.
+      ret += block_size;
+    }
+    if (block_remainder(ctx, in_len + buf_len) == 0) {
+      // This call ends on a block boundary. The last block will be buffered in
+      // `ctx->final` until it is known to have padding.
+      assert(ret >= block_size);
+      ret -= block_size;
+    }
+  }
+  return ret;
+}
+
 int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, uint8_t *out, int *out_len,
                       const uint8_t *in, int in_len) {
   *out_len = 0;
@@ -242,27 +275,19 @@
   return 1;
 }
 
-template <typename F>
-static int WrapWithPoison(EVP_CIPHER_CTX *ctx, F f) {
-  if (ctx->poisoned) {
-    // `ctx` has been left in an indeterminate state by a previous failed
-    // operation. Do not allow proceeding.
-    OPENSSL_PUT_ERROR(CIPHER, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-    return 0;
-  }
-  if (!f()) {
-    // Functions using `WrapWithPoison` may leave `ctx` in an indeterminate
-    // state. Mark the object as poisoned.
-    ctx->poisoned = 1;
+int EVP_EncryptUpdate_ex(EVP_CIPHER_CTX *ctx, uint8_t *out, size_t *out_len,
+                         size_t max_out_len, const uint8_t *in, size_t in_len) {
+  *out_len = 0;
+
+  // `evp_cipher_ctx_max_encrypt_update` is currently exact. Check bounds before
+  // performing any operations so that, if the output is too small, retrying the
+  // operation with a larger buffer is well-defined. This only matters when it
+  // takes two steps to process `in`.
+  size_t expected = evp_cipher_ctx_max_encrypt_update(ctx, in_len);
+  if (max_out_len < expected) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
     return 0;
   }
-  return 1;
-}
-
-static int EVP_EncryptUpdate_ex_internal(EVP_CIPHER_CTX *ctx, uint8_t *out,
-                                         size_t *out_len, size_t max_out_len,
-                                         const uint8_t *in, size_t in_len) {
-  *out_len = 0;
 
   // Ciphers that use blocks may write up to `block_size` extra bytes. Ensure
   // the output does not overflow `*out_len`.
@@ -316,18 +341,10 @@
   ctx->buf_len = in_span.size();
 
   *out_len = max_out_len - out_span.size();
+  assert(*out_len == expected);  // See `EVP_CIPHER_CTX_max_next_update` check.
   return 1;
 }
 
-int EVP_EncryptUpdate_ex(EVP_CIPHER_CTX *ctx, uint8_t *out, size_t *out_len,
-                         size_t max_out_len, const uint8_t *in, size_t in_len) {
-  *out_len = 0;
-  return WrapWithPoison(ctx, & {
-    return EVP_EncryptUpdate_ex_internal(ctx, out, out_len, max_out_len, in,
-                                         in_len);
-  });
-}
-
 int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, uint8_t *out, int *out_len) {
   size_t out_len_sz;
   int ret =
@@ -337,8 +354,8 @@
   return ret;
 }
 
-static int EVP_EncryptFinal_ex2_internal(EVP_CIPHER_CTX *ctx, uint8_t *out,
-                                         size_t *out_len, size_t max_out_len) {
+int EVP_EncryptFinal_ex2(EVP_CIPHER_CTX *ctx, uint8_t *out, size_t *out_len,
+                         size_t max_out_len) {
   *out_len = 0;
 
   size_t block_size = ctx->cipher->block_size;
@@ -347,6 +364,7 @@
     if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {
       return ctx->cipher->cipher_final(ctx);
     }
+    EVP_Cipher_verify_service_indicator(ctx);
     return 1;
   }
 
@@ -356,40 +374,30 @@
       OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH);
       return 0;
     }
+    EVP_Cipher_verify_service_indicator(ctx);
     return 1;
   }
 
-  size_t padding = block_size - buf_len;
-  for (size_t i = buf_len; i < block_size; i++) {
-    ctx->bufi = padding;
-  }
-
   Span<uint8_t> out_span(out, max_out_len);
   if (out_span.size() < block_size) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
     return 0;
   }
+
+  size_t padding = block_size - buf_len;
+  for (size_t i = buf_len; i < block_size; i++) {
+    ctx->bufi = padding;
+  }
   if (!ctx->cipher->cipher_update(ctx, out_span.data(), ctx->buf, block_size)) {
     return 0;
   }
   out_span = out_span.subspan(block_size);
 
   *out_len = max_out_len - out_span.size();
+  EVP_Cipher_verify_service_indicator(ctx);
   return 1;
 }
 
-int EVP_EncryptFinal_ex2(EVP_CIPHER_CTX *ctx, uint8_t *out, size_t *out_len,
-                         size_t max_out_len) {
-  *out_len = 0;
-  return WrapWithPoison(ctx, & {
-    if (!EVP_EncryptFinal_ex2_internal(ctx, out, out_len, max_out_len)) {
-      return 0;
-    }
-    EVP_Cipher_verify_service_indicator(ctx);
-    return 1;
-  });
-}
-
 int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, uint8_t *out, int *out_len,
                       const uint8_t *in, int in_len) {
   *out_len = 0;
@@ -417,16 +425,14 @@
   return 1;
 }
 
-static int EVP_DecryptUpdate_ex_internal(EVP_CIPHER_CTX *ctx, uint8_t *out,
-                                         size_t *out_len, size_t max_out_len,
-                                         const uint8_t *in, size_t in_len) {
+int EVP_DecryptUpdate_ex(EVP_CIPHER_CTX *ctx, uint8_t *out, size_t *out_len,
+                         size_t max_out_len, const uint8_t *in, size_t in_len) {
   *out_len = 0;
 
   // Ciphers that use blocks may write up to `block_size` extra bytes. Ensure
   // the output does not overflow `*out_len`.
   Span<const uint8_t> in_span(in, in_len);
   size_t block_size = ctx->cipher->block_size;
-
   if (in_span.empty()) {
     return 1;
   }
@@ -434,9 +440,18 @@
   Span<uint8_t> out_span(out, max_out_len);
   if (ctx->flags & EVP_CIPH_NO_PADDING) {
     // Use the shared block handling logic from encryption.
-    return EVP_EncryptUpdate_ex_internal(ctx, out_span.data(), out_len,
-                                         out_span.size(), in_span.data(),
-                                         in_span.size());
+    return EVP_EncryptUpdate_ex(ctx, out_span.data(), out_len, out_span.size(),
+                                in_span.data(), in_span.size());
+  }
+
+  // `EVP_CIPHER_CTX_max_next_update` is currently exact. Check bounds before
+  // performing any operations so that, if the output is too small, retrying the
+  // operation with a larger buffer is well-defined. This only matters when it
+  // takes two steps to process `in`.
+  size_t expected = EVP_CIPHER_CTX_max_next_update(ctx, in_len);
+  if (max_out_len < expected) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
+    return 0;
   }
 
   assert(block_size <= sizeof(ctx->final));
@@ -466,16 +481,15 @@
     // less.
     size_t head = in_span.size() > block_size ? in_span.size() - block_size : 0;
     size_t head_out_len;
-    if (!EVP_EncryptUpdate_ex_internal(ctx, out_span.data(), &head_out_len,
-                                       out_span.size(), in_span.data(), head)) {
+    if (!EVP_EncryptUpdate_ex(ctx, out_span.data(), &head_out_len,
+                              out_span.size(), in_span.data(), head)) {
       return 0;
     }
     in_span = in_span.subspan(head);
     out_span = out_span.subspan(head_out_len);
     size_t final_size;
-    if (!EVP_EncryptUpdate_ex_internal(ctx, ctx->final, &final_size,
-                                       sizeof(ctx->final), in_span.data(),
-                                       in_span.size())) {
+    if (!EVP_EncryptUpdate_ex(ctx, ctx->final, &final_size, sizeof(ctx->final),
+                              in_span.data(), in_span.size())) {
       return 0;
     }
     ctx->final_used = 1;
@@ -484,9 +498,9 @@
   } else {
     // Buffer will be non-empty.
     size_t written_out_len;
-    if (!EVP_EncryptUpdate_ex_internal(ctx, out_span.data(), &written_out_len,
-                                       out_span.size(), in_span.data(),
-                                       in_span.size())) {
+    if (!EVP_EncryptUpdate_ex(ctx, out_span.data(), &written_out_len,
+                              out_span.size(), in_span.data(),
+                              in_span.size())) {
       return 0;
     }
     assert(block_size == 1 || ctx->buf_len != 0);
@@ -494,17 +508,10 @@
   }
 
   *out_len = max_out_len - out_span.size();
+  assert(*out_len == expected);  // See `EVP_CIPHER_CTX_max_next_update` check.
   return 1;
 }
 
-int EVP_DecryptUpdate_ex(EVP_CIPHER_CTX *ctx, uint8_t *out, size_t *out_len,
-                         size_t max_out_len, const uint8_t *in, size_t in_len) {
-  return WrapWithPoison(ctx, & {
-    return EVP_DecryptUpdate_ex_internal(ctx, out, out_len, max_out_len, in,
-                                         in_len);
-  });
-}
-
 int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, uint8_t *out, int *out_len) {
   size_t out_len_sz;
   int ret =
@@ -514,9 +521,8 @@
   return ret;
 }
 
-static int EVP_DecryptFinal_ex2_internal(EVP_CIPHER_CTX *ctx,
-                                         unsigned char *out, size_t *out_len,
-                                         size_t max_out_len) {
+int EVP_DecryptFinal_ex2(EVP_CIPHER_CTX *ctx, uint8_t *out, size_t *out_len,
+                         size_t max_out_len) {
   *out_len = 0;
 
   size_t block_size = ctx->cipher->block_size;
@@ -525,6 +531,7 @@
     if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {
       return ctx->cipher->cipher_final(ctx);
     }
+    EVP_Cipher_verify_service_indicator(ctx);
     return 1;
   }
 
@@ -534,6 +541,7 @@
       OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH);
       return 0;
     }
+    EVP_Cipher_verify_service_indicator(ctx);
     return 1;
   }
 
@@ -543,8 +551,8 @@
   }
   assert(block_size <= sizeof(ctx->final));
 
-  // The following assumes that the ciphertext has been authenticated.
-  // Otherwise it provides a padding oracle.
+  // The following assumes that the ciphertext has been authenticated. Otherwise
+  // it provides a padding oracle.
   size_t padding = ctx->finalblock_size - 1;
   if (padding == 0 || padding > block_size) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
@@ -568,21 +576,10 @@
   out_span = out_span.subspan(payload);
 
   *out_len = max_out_len - out_span.size();
+  EVP_Cipher_verify_service_indicator(ctx);
   return 1;
 }
 
-int EVP_DecryptFinal_ex2(EVP_CIPHER_CTX *ctx, unsigned char *out,
-                         size_t *out_len, size_t max_out_len) {
-  *out_len = 0;
-  return WrapWithPoison(ctx, & {
-    if (!EVP_DecryptFinal_ex2_internal(ctx, out, out_len, max_out_len)) {
-      return 0;
-    }
-    EVP_Cipher_verify_service_indicator(ctx);
-    return 1;
-  });
-}
-
 int EVP_Cipher(EVP_CIPHER_CTX *ctx, uint8_t *out, const uint8_t *in,
                size_t in_len) {
   const int kError =
@@ -654,13 +651,11 @@
 }
 
 int EVP_CipherUpdateAAD(EVP_CIPHER_CTX *ctx, const uint8_t *in, size_t in_len) {
-  return WrapWithPoison(ctx, & {
-    if (!(ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER)) {
-      OPENSSL_PUT_ERROR(CIPHER, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-      return 0;
-    }
-    return ctx->cipher->update_aad(ctx, in, in_len);
-  });
+  if (!(ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER)) {
+    OPENSSL_PUT_ERROR(CIPHER, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+  return ctx->cipher->update_aad(ctx, in, in_len);
 }
 
 int EVP_CipherFinal_ex(EVP_CIPHER_CTX *ctx, uint8_t *out, int *out_len) {
@@ -680,36 +675,6 @@
   }
 }
 
-size_t EVP_CIPHER_CTX_max_next_update(const EVP_CIPHER_CTX *ctx,
-                                      size_t in_len) {
-  if (in_len == 0) {
-    return 0;
-  }
-
-  size_t block_size = ctx->cipher->block_size;
-  // |block_size| must be a power of 2.
-  assert(block_size != 0 && (block_size & (block_size - 1)) == 0);
-  size_t buf_len = ctx->buf_len;
-
-  // Any buffered input is combined with |in_len|, then we round down to a
-  // multiple of the block size.
-  size_t ret = (in_len + buf_len) & ~(block_size - 1);
-  if (!ctx->encrypt && block_size > 1 && !(ctx->flags & EVP_CIPH_NO_PADDING)) {
-    if (ctx->final_used) {
-      // There was a buffered decrypted block. Now that it is known to not have
-      // padding, DecryptUpdate will output it.
-      ret += block_size;
-    }
-    if (block_remainder(ctx, in_len + buf_len) == 0) {
-      // This call ends on a block boundary. The last block will be buffered in
-      // |ctx->final| until it is known to have padding.
-      assert(ret >= block_size);
-      ret -= block_size;
-    }
-  }
-  return ret;
-}
-
 size_t EVP_CIPHER_CTX_max_final(const EVP_CIPHER_CTX *ctx) {
   size_t block_size = ctx->cipher->block_size;
   if (block_size == 1 || (ctx->flags & EVP_CIPH_NO_PADDING)) {

boringssl-0.20260708.tar.xz/crypto/fipsmodule/ec/ec_test.cc -> boringssl-0.20260813.tar.xz/crypto/fipsmodule/ec/ec_test.cc Changed

@@ -220,6 +220,7 @@
 
   // Buffer too small.
   EXPECT_EQ(0u, EC_KEY_priv2oct(key.get(), buf, sizeof(buf) - 1));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EC, EC_R_BUFFER_TOO_SMALL}}));
 
   // Extra space in buffer.
   uint8_t large_buf33;
@@ -254,10 +255,12 @@
   ASSERT_TRUE(key);
   EXPECT_FALSE(EC_KEY_oct2priv(key.get(), kECKeyWithZerosRawPrivate + 1,
                                sizeof(kECKeyWithZerosRawPrivate) - 1));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EC, EC_R_DECODE_ERROR}}));
   uint8_t paddedsizeof(kECKeyWithZerosRawPrivate) + 1 = {0};
   memcpy(padded + 1, kECKeyWithZerosRawPrivate,
          sizeof(kECKeyWithZerosRawPrivate));
   EXPECT_FALSE(EC_KEY_oct2priv(key.get(), padded, sizeof(padded)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EC, EC_R_DECODE_ERROR}}));
 }
 
 TEST(ECTest, SpecifiedCurve) {
@@ -1494,19 +1497,24 @@
   static const uint8_t kMessage = {4, 5, 6, 7};
   EXPECT_FALSE(ec_hash_to_curve_p384_xmd_sha384_sswu(
       EC_group_p224(), &raw, kDST, sizeof(kDST), kMessage, sizeof(kMessage)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EC, EC_R_GROUP_MISMATCH}}));
   EXPECT_FALSE(EC_hash_to_curve_p384_xmd_sha384_sswu(
       EC_group_p224(), p_p224.get(), kDST, sizeof(kDST), kMessage,
       sizeof(kMessage)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EC, EC_R_GROUP_MISMATCH}}));
   EXPECT_FALSE(EC_hash_to_curve_p384_xmd_sha384_sswu(
       EC_group_p224(), p_p384.get(), kDST, sizeof(kDST), kMessage,
       sizeof(kMessage)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS}}));
   EXPECT_FALSE(EC_hash_to_curve_p384_xmd_sha384_sswu(
       EC_group_p384(), p_p224.get(), kDST, sizeof(kDST), kMessage,
       sizeof(kMessage)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS}}));
 
   // Zero-length DSTs are not allowed.
   EXPECT_FALSE(ec_hash_to_curve_p384_xmd_sha384_sswu(
       EC_group_p384(), &raw, nullptr, 0, kMessage, sizeof(kMessage)));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EC, std::nullopt}}));
 }
 
 // Test the WPA3 SAE hash-to-curve construction. Test vector from Appendix J.10

boringssl-0.20260708.tar.xz/crypto/fipsmodule/fips_shared.lds -> boringssl-0.20260813.tar.xz/crypto/fipsmodule/fips_shared.lds Changed

boringssl-0.20260708.tar.xz/crypto/fipsmodule/keccak/internal.h -> boringssl-0.20260813.tar.xz/crypto/fipsmodule/keccak/internal.h Changed

@@ -27,6 +27,10 @@
   boringssl_sha3_512,
   boringssl_shake128,
   boringssl_shake256,
+  boringssl_turboshake128,
+  boringssl_turboshake256,
+  boringssl_cshake128,
+  boringssl_cshake256,
 };
 
 enum boringssl_keccak_phase_t : int32_t {
@@ -49,7 +53,8 @@
 
 // BORINGSSL_keccak hashes `in_len` bytes from `in` and writes `out_len` bytes
 // of output to `out`. If the `config` specifies a fixed-output function, like
-// SHA3-256, then `out_len` must be the correct length for that function.
+// SHA3-256, then `out_len` must be the correct length for that function. The
+// cSHAKE configurations are only valid with the BORINGSSL_cshake functions.
 OPENSSL_EXPORT void BORINGSSL_keccak(uint8_t *out, size_t out_len,
                                      const uint8_t *in, size_t in_len,
                                      enum boringssl_keccak_config_t config);
@@ -61,6 +66,26 @@
 OPENSSL_EXPORT void BORINGSSL_keccak_init(
     struct BORINGSSL_keccak_st *ctx, enum boringssl_keccak_config_t config);
 
+// BORINGSSL_cshake_init prepares `ctx` for cSHAKE, including absorbing the
+// function-name and customization strings. `config` must be
+// `boringssl_cshake128` or `boringssl_cshake256`. The message may then be
+// absorbed and output squeezed with the usual Keccak functions.
+OPENSSL_EXPORT void BORINGSSL_cshake_init(struct BORINGSSL_keccak_st *ctx,
+                                          enum boringssl_keccak_config_t config,
+                                          const uint8_t *function_name,
+                                          size_t function_name_len,
+                                          const uint8_t *customization,
+                                          size_t customization_len);
+
+// BORINGSSL_cshake is the one-shot form of BORINGSSL_cshake_init.
+OPENSSL_EXPORT void BORINGSSL_cshake(uint8_t *out, size_t out_len,
+                                     const uint8_t *in, size_t in_len,
+                                     enum boringssl_keccak_config_t config,
+                                     const uint8_t *function_name,
+                                     size_t function_name_len,
+                                     const uint8_t *customization,
+                                     size_t customization_len);
+
 // BORINGSSL_keccak_absorb absorbs `in_len` bytes from `in`.
 OPENSSL_EXPORT void BORINGSSL_keccak_absorb(struct BORINGSSL_keccak_st *ctx,
                                             const uint8_t *in, size_t in_len);
@@ -94,12 +119,14 @@
 // BORINGSSL_keccak_squeeze_x2 performs BORINGSSL_keccak_squeeze in parallel
 // with two same-length outputs. The contexts must be in equivalent state (i.e.
 // same config, same amount of bytes absorbed and squeezed).
+// This function is not compatible with cSHAKE nor TurboSHAKE.
 OPENSSL_EXPORT void BORINGSSL_keccak_squeeze_x2(
     struct BORINGSSL_keccak_st ctx2, uint8_t *outs2, size_t out_len);
 
 // BORINGSSL_keccak_short_x2 performs BORINGSSL_keccak in parallel on two
 // same-length strings with same-length outputs. `in_len` must be less than 72
 // (or actually `rate_bytes`).
+// This function is not compatible with cSHAKE nor TurboSHAKE.
 OPENSSL_EXPORT void BORINGSSL_keccak_short_x2(
     uint8_t *outs2, size_t out_len, const uint8_t *ins2, size_t in_len,
     enum boringssl_keccak_config_t config);
@@ -108,6 +135,7 @@
 #if defined(HAVE_KECCAK_X4)
 // BORINGSSL_have_keccak_x4 needs to return true before using any of the _x4
 // variants here, as they may require additional CPU features.
+// This function is not compatible with cSHAKE nor TurboSHAKE.
 inline bool BORINGSSL_have_keccak_x4() {
 #if defined(OPENSSL_X86_64)
   return CRYPTO_is_AVX2_capable();
@@ -119,12 +147,14 @@
 // BORINGSSL_keccak_squeeze_x4 performs BORINGSSL_keccak_squeeze in parallel
 // with four same-length outputs. The contexts must be in equivalent state (i.e.
 // same config, same amount of bytes absorbed and squeezed).
+// This function is not compatible with cSHAKE nor TurboSHAKE.
 OPENSSL_EXPORT void BORINGSSL_keccak_squeeze_x4(
     struct BORINGSSL_keccak_st ctx4, uint8_t *outs4, size_t out_len);
 
 // BORINGSSL_keccak_short_x4 performs BORINGSSL_keccak in parallel on four
 // same-length strings with same-length outputs. in_len must be less than 72
-// (or actually |rate_bytes|).
+// (or actually `rate_bytes`).
+// This function is not compatible with cSHAKE nor TurboSHAKE.
 OPENSSL_EXPORT void BORINGSSL_keccak_short_x4(
     uint8_t *outs4, size_t out_len, const uint8_t *ins4, size_t in_len,
     enum boringssl_keccak_config_t config);

boringssl-0.20260708.tar.xz/crypto/fipsmodule/keccak/keccak.cc.inc -> boringssl-0.20260813.tar.xz/crypto/fipsmodule/keccak/keccak.cc.inc Changed

@@ -34,7 +34,8 @@
   *value = CRYPTO_rotl_u64(*value, shift);
 }
 
-// keccak_f implements the Keccak-1600 permutation as described at
+// keccak_f implements the last `num_rounds` of the Keccak-1600 permutation,
+// i.e. Keccak-p1600, num_rounds, as described at
 // https://keccak.team/keccak_specs_summary.html. Each lane is represented as a
 // 64-bit value and the 5×5 lanes are stored as an array in row-major order.
 //
@@ -45,9 +46,10 @@
 // are used whenever the calling function is `KECCAK_X4_TARGET`, as target
 // attributes are inherited into callees when inlining.
 template <typename U64, void (*rotl)(U64 *value, int shift) = rotl_u64>
-static inline OPENSSL_ATTR_ALWAYS_INLINE void keccak_f(U64 state25) {
+static inline OPENSSL_ATTR_ALWAYS_INLINE void keccak_f(U64 state25,
+                                                       int num_rounds = 24) {
   static const int kNumRounds = 24;
-  for (int round = 0; round < kNumRounds; round++) {
+  for (int round = kNumRounds - num_rounds; round < kNumRounds; round++) {
     // θ step
     U64 c5;
     for (int x = 0; x < 5; x++) {
@@ -208,10 +210,14 @@
       required_out_len = 64;
       break;
     case boringssl_shake128:
+    case boringssl_turboshake128:
+    case boringssl_cshake128:
       capacity_bytes = 256 / 8;
       required_out_len = 0;
       break;
     case boringssl_shake256:
+    case boringssl_turboshake256:
+    case boringssl_cshake256:
       capacity_bytes = 512 / 8;
       required_out_len = 0;
       break;
@@ -227,6 +233,23 @@
   assert(ctx->rate_bytes % 8 == 0);
 }
 
+maybe_unused static bool keccak_can_parallel(
+    enum boringssl_keccak_config_t config) {
+  return config == boringssl_sha3_256 || config == boringssl_sha3_512 ||
+         config == boringssl_shake128 || config == boringssl_shake256;
+}
+
+static bool keccak_is_cshake(enum boringssl_keccak_config_t config) {
+  return config == boringssl_cshake128 || config == boringssl_cshake256;
+}
+
+static int keccak_num_rounds(enum boringssl_keccak_config_t config) {
+  if (config == boringssl_turboshake128 || config == boringssl_turboshake256) {
+    return 12;
+  }
+  return 24;
+}
+
 void bssl::BORINGSSL_keccak(uint8_t *out, size_t out_len, const uint8_t *in,
                             size_t in_len,
                             enum boringssl_keccak_config_t config) {
@@ -241,6 +264,8 @@
 void bssl::BORINGSSL_keccak_short_x2(uint8_t *outs2, size_t out_len,
                                      const uint8_t *ins2, size_t in_len,
                                      enum boringssl_keccak_config_t config) {
+  assert(keccak_can_parallel(config));
+
   struct BORINGSSL_keccak_st ctx2;
   for (size_t i = 0; i < 2; ++i) {
     BORINGSSL_keccak_init(&ctxi, config);
@@ -263,6 +288,8 @@
 KECCAK_X4_TARGET void bssl::BORINGSSL_keccak_short_x4(
     uint8_t *outs4, size_t out_len, const uint8_t *ins4, size_t in_len,
     enum boringssl_keccak_config_t config) {
+  assert(keccak_can_parallel(config));
+
   struct BORINGSSL_keccak_st ctx4;
   for (size_t i = 0; i < 4; ++i) {
     BORINGSSL_keccak_init(&ctxi, config);
@@ -283,6 +310,7 @@
 
 void bssl::BORINGSSL_keccak_init(struct BORINGSSL_keccak_st *ctx,
                                  enum boringssl_keccak_config_t config) {
+  BSSL_CHECK(!keccak_is_cshake(config));
   keccak_init(ctx, config);
 }
 
@@ -310,7 +338,7 @@
       return;
     }
 
-    keccak_f(ctx->state);
+    keccak_f(ctx->state, keccak_num_rounds(ctx->config));
     in += first_block_len;
     in_len -= first_block_len;
   }
@@ -320,7 +348,7 @@
     for (size_t i = 0; i < rate_words; i++) {
       ctx->statei ^= CRYPTO_load_u64_le(in + 8 * i);
     }
-    keccak_f(ctx->state);
+    keccak_f(ctx->state, keccak_num_rounds(ctx->config));
     in += ctx->rate_bytes;
     in_len -= ctx->rate_bytes;
   }
@@ -333,6 +361,72 @@
   ctx->absorb_offset = in_len;
 }
 
+// left_encode implements the integer encoding from NIST SP 800-185, section
+// 2.3.1.
+static size_t left_encode(uint8_t outsizeof(size_t) + 1, size_t value) {
+  size_t num_bytes = 1;
+  for (size_t v = value; v > 0xff; v >>= 8) {
+    num_bytes++;
+  }
+  out0 = (uint8_t)num_bytes;
+  for (size_t i = 0; i < num_bytes; i++) {
+    outnum_bytes - i = (uint8_t)(value >> (8 * i));
+  }
+  return num_bytes + 1;
+}
+
+static void cshake_absorb_encode_string(struct BORINGSSL_keccak_st *ctx,
+                                        const uint8_t *in, size_t in_len) {
+  BSSL_CHECK(in_len <= SIZE_MAX / 8);
+  uint8_t encodedsizeof(size_t) + 1;
+  const size_t encoded_len = left_encode(encoded, in_len * 8);
+  BORINGSSL_keccak_absorb(ctx, encoded, encoded_len);
+  BORINGSSL_keccak_absorb(ctx, in, in_len);
+}
+
+void bssl::BORINGSSL_cshake_init(struct BORINGSSL_keccak_st *ctx,
+                                 enum boringssl_keccak_config_t config,
+                                 const uint8_t *function_name,
+                                 size_t function_name_len,
+                                 const uint8_t *customization,
+                                 size_t customization_len) {
+  BSSL_CHECK(keccak_is_cshake(config));
+
+  // SP 800-185 defines cSHAKE with two empty strings to be SHAKE.
+  if (function_name_len == 0 && customization_len == 0) {
+    BORINGSSL_keccak_init(ctx, config == boringssl_cshake128
+                                   ? boringssl_shake128
+                                   : boringssl_shake256);
+    return;
+  }
+
+  keccak_init(ctx, config);
+  uint8_t encodedsizeof(size_t) + 1;
+  const size_t encoded_len = left_encode(encoded, ctx->rate_bytes);
+  BORINGSSL_keccak_absorb(ctx, encoded, encoded_len);
+  cshake_absorb_encode_string(ctx, function_name, function_name_len);
+  cshake_absorb_encode_string(ctx, customization, customization_len);
+
+  static const uint8_t kZeros168 = {0};
+  if (ctx->absorb_offset != 0) {
+    BORINGSSL_keccak_absorb(ctx, kZeros, ctx->rate_bytes - ctx->absorb_offset);
+  }
+}
+
+void bssl::BORINGSSL_cshake(uint8_t *out, size_t out_len, const uint8_t *in,
+                            size_t in_len,
+                            enum boringssl_keccak_config_t config,
+                            const uint8_t *function_name,
+                            size_t function_name_len,
+                            const uint8_t *customization,
+                            size_t customization_len) {
+  struct BORINGSSL_keccak_st ctx;
+  BORINGSSL_cshake_init(&ctx, config, function_name, function_name_len,
+                        customization, customization_len);
+  BORINGSSL_keccak_absorb(&ctx, in, in_len);
+  BORINGSSL_keccak_squeeze(&ctx, out, out_len);
+}
+
 static uint8_t keccak_terminator(struct BORINGSSL_keccak_st *ctx) {
   switch (ctx->config) {
     case boringssl_sha3_256:
@@ -340,7 +434,12 @@
       return 0x06;
     case boringssl_shake128:
     case boringssl_shake256:
+    case boringssl_turboshake128:
+    case boringssl_turboshake256:
       return 0x1f;
+    case boringssl_cshake128:
+    case boringssl_cshake256:
+      return 0x04;
     default:
       abort();
   }
@@ -352,7 +451,7 @@
   uint8_t *state_bytes = (uint8_t *)ctx->state;
   state_bytesctx->absorb_offset ^= keccak_terminator(ctx);
   state_bytesctx->rate_bytes - 1 ^= 0x80;
-  keccak_f(ctx->state);
+  keccak_f(ctx->state, keccak_num_rounds(ctx->config));
 }
 
 #if defined(HAVE_KECCAK_X2)
@@ -370,24 +469,13 @@
 
 #if defined(HAVE_KECCAK_X4)
 static void keccak_finalize_x4(struct BORINGSSL_keccak_st ctx4) {
+  assert(keccak_can_parallel(ctx0.config));
+
   for (size_t i = 0; i < 4; ++i) {
     // XOR the terminator. Accessing `ctx->state` as a `uint8_t*` is allowed
     // by strict aliasing because we require `uint8_t` to be a character type.
-    uint8_t terminator;
-    switch (ctxi.config) {
-      case boringssl_sha3_256:
-      case boringssl_sha3_512:
-        terminator = 0x06;
-        break;
-      case boringssl_shake128:
-      case boringssl_shake256:
-        terminator = 0x1f;
-        break;
-      default:
-        abort();
-    }
     uint8_t *state_bytes = (uint8_t *)ctxi.state;
-    state_bytesctxi.absorb_offset ^= terminator;
+    state_bytesctxi.absorb_offset ^= keccak_terminator(&ctxi);
     state_bytesctxi.rate_bytes - 1 ^= 0x80;
   }
   keccak_f_x4(ctx0.state, ctx1.state, ctx2.state, ctx3.state);
@@ -412,7 +500,7 @@
   const uint8_t *state_bytes = (const uint8_t *)ctx->state;
   while (out_len) {
     if (ctx->squeeze_offset == ctx->rate_bytes) {
-      keccak_f(ctx->state);
+      keccak_f(ctx->state, keccak_num_rounds(ctx->config));
       ctx->squeeze_offset = 0;
     }
 
@@ -431,6 +519,8 @@
 #if defined(HAVE_KECCAK_X2)
 void bssl::BORINGSSL_keccak_squeeze_x2(struct BORINGSSL_keccak_st ctx2,
                                        uint8_t *outs2, size_t out_len) {
+  assert(keccak_can_parallel(ctx0.config));
+
   for (size_t i = 0; i < 2; ++i) {
     // The SHA-3 variants must be squeezed in a single call, to confirm that
     // the output length is correct.
@@ -491,6 +581,8 @@
 #if defined(HAVE_KECCAK_X4)
 KECCAK_X4_TARGET void bssl::BORINGSSL_keccak_squeeze_x4(
     struct BORINGSSL_keccak_st ctx4, uint8_t *outs4, size_t out_len) {
+  assert(keccak_can_parallel(ctx0.config));
+
   for (size_t i = 0; i < 4; ++i) {
     // The SHA-3 variants must be squeezed in a single call, to confirm that
     // the output length is correct.

boringssl-0.20260708.tar.xz/crypto/fipsmodule/keccak/keccak_test.cc -> boringssl-0.20260813.tar.xz/crypto/fipsmodule/keccak/keccak_test.cc Changed

@@ -19,6 +19,7 @@
 #include <gtest/gtest.h>
 
 #include <openssl/bytestring.h>
+#include <openssl/span.h>
 
 #include "../../test/file_test.h"
 #include "../../test/test_util.h"
@@ -212,6 +213,112 @@
   FileTestGTest("crypto/fipsmodule/keccak/keccak_tests.txt", KeccakFileTest);
 }
 
+static void ExpectKeccak(const std::vector<uint8_t> &input,
+                         enum boringssl_keccak_config_t config,
+                         const char *expected_hex) {
+  std::vector<uint8_t> expected;
+  ASSERT_TRUE(DecodeHex(&expected, expected_hex));
+  std::vector<uint8_t> out(expected.size());
+  BORINGSSL_keccak(out.data(), out.size(), input.data(), input.size(), config);
+  EXPECT_EQ(Bytes(expected), Bytes(out));
+
+  struct BORINGSSL_keccak_st ctx;
+  BORINGSSL_keccak_init(&ctx, config);
+  for (size_t i = 0; i < input.size(); i++) {
+    BORINGSSL_keccak_absorb(&ctx, &inputi, 1);
+  }
+  for (size_t i = 0; i < out.size(); i++) {
+    BORINGSSL_keccak_squeeze(&ctx, &outi, 1);
+  }
+  EXPECT_EQ(Bytes(expected), Bytes(out));
+}
+
+TEST(KeccakTest, TurboSHAKE) {
+  // https://www.rfc-editor.org/rfc/rfc9861.html#section-5
+  const std::vector<uint8_t> empty;
+  ExpectKeccak(empty, boringssl_turboshake128,
+               "1e415f1c5983aff2169217277d17bb53"
+               "8cd945a397ddec541f1ce41af2c1b74c");
+  ExpectKeccak(empty, boringssl_turboshake256,
+               "367a329dafea871c7802ec67f905ae13"
+               "c57695dc2c6663c61035f59a18f8e7db"
+               "11edc0e12e91ea60eb6b32df06dd7f00"
+               "2fbafabb6e13ec1cc20d995547600db0");
+
+  std::vector<uint8_t> input(17 * 17);
+  for (size_t i = 0; i < input.size(); i++) {
+    inputi = static_cast<uint8_t>(i % 251);
+  }
+  ExpectKeccak(input, boringssl_turboshake128,
+               "96c77c279e0126f7fc07c9b07f5cdae1"
+               "e0be60bdbe10620040e75d7223a624d2");
+  ExpectKeccak(input, boringssl_turboshake256,
+               "66b810db8e90780424c0847372fdc957"
+               "10882fde31c6df75beb9d4cd9305cfca"
+               "e35e7b83e8b7e6eb4b78605880116316"
+               "fe2c078a09b94ad7b8213c0a738b65c0");
+}
+
+static void ExpectCSHAKE(enum boringssl_keccak_config_t config,
+                         Span<const uint8_t> function_name,
+                         Span<const uint8_t> customization,
+                         const char *expected_hex) {
+  static const uint8_t kInput = {0x00, 0x01, 0x02, 0x03};
+  std::vector<uint8_t> expected;
+  ASSERT_TRUE(DecodeHex(&expected, expected_hex));
+  std::vector<uint8_t> out(expected.size());
+  BORINGSSL_cshake(out.data(), out.size(), kInput, sizeof(kInput), config,
+                   function_name.data(), function_name.size(),
+                   customization.data(), customization.size());
+  EXPECT_EQ(Bytes(expected), Bytes(out));
+}
+
+TEST(KeccakTest, CSHAKE) {
+  // These are samples #1 and #3 from NIST's cSHAKE sample vectors for
+  // SP 800-185.
+  // https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/cSHAKE_samples.pdf
+  static const char kCustomization = "Email Signature";
+  ExpectCSHAKE(boringssl_cshake128, {}, StringAsBytes(kCustomization),
+               "c1c36925b6409a04f1b504fcbca9d82b"
+               "4017277cb5ed2b2065fc1d3814d5aaf5");
+  ExpectCSHAKE(boringssl_cshake256, {}, StringAsBytes(kCustomization),
+               "d008828e2b80ac9d2218ffee1d070c48"
+               "b8e4c87bff32c9699d5b6896eee0edd1"
+               "64020e2be0560858d9c00c037e34a969"
+               "37c561a74c412bb4c746469527281c8c");
+
+  static const char kFunctionName = "Function";
+  static const char kOtherCustomization = "Customization";
+  ExpectCSHAKE(boringssl_cshake128, StringAsBytes(kFunctionName),
+               StringAsBytes(kOtherCustomization),
+               "494da17e9313dc08cef4eb25f77376f7"
+               "cae34a0d865d86789d98760f40eade0b");
+
+  // cSHAKE with empty function-name and customization strings is SHAKE.
+  static const uint8_t kInput = {0x00, 0x01, 0x02, 0x03};
+  uint8_t shake32, cshakesizeof(shake);
+  BORINGSSL_keccak(shake, sizeof(shake), kInput, sizeof(kInput),
+                   boringssl_shake128);
+  BORINGSSL_cshake(cshake, sizeof(cshake), kInput, sizeof(kInput),
+                   boringssl_cshake128, nullptr, 0, nullptr, 0);
+  EXPECT_EQ(Bytes(shake), Bytes(cshake));
+
+  std::vector<uint8_t> expected;
+  ASSERT_TRUE(DecodeHex(&expected,
+                        "c1c36925b6409a04f1b504fcbca9d82b"
+                        "4017277cb5ed2b2065fc1d3814d5aaf5"));
+  std::vector<uint8_t> out(expected.size());
+  struct BORINGSSL_keccak_st ctx;
+  BORINGSSL_cshake_init(&ctx, boringssl_cshake128, nullptr, 0,
+                        reinterpret_cast<const uint8_t *>(kCustomization),
+                        sizeof(kCustomization) - 1);
+  BORINGSSL_keccak_absorb(&ctx, kInput, 1);
+  BORINGSSL_keccak_absorb(&ctx, kInput + 1, sizeof(kInput) - 1);
+  BORINGSSL_keccak_squeeze(&ctx, out.data(), 7);
+  BORINGSSL_keccak_squeeze(&ctx, out.data() + 7, out.size() - 7);
+  EXPECT_EQ(Bytes(expected), Bytes(out));
+}
+
 // Unoptimized builds are much slower, and iterative tests run Keccak many
 // times. Disable them in unoptimized builds for now.
 // https://crbug.com/479850443

boringssl-0.20260708.tar.xz/crypto/hpke/hpke_test.cc -> boringssl-0.20260813.tar.xz/crypto/hpke/hpke_test.cc Changed

@@ -503,17 +503,20 @@
           sender_ctx.get(), enc, &enc_len, sizeof(enc),
           EVP_hpke_x25519_hkdf_sha256(), kdf(), aead(), kSmallOrderPoint,
           sizeof(kSmallOrderPoint), nullptr, 0));
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_INVALID_PEER_KEY}}));
 
       // Likewise with auth.
       EXPECT_FALSE(EVP_HPKE_CTX_setup_auth_sender(
           sender_ctx.get(), enc, &enc_len, sizeof(enc), key.get(), kdf(),
           aead(), kSmallOrderPoint, sizeof(kSmallOrderPoint), nullptr, 0));
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_INVALID_PEER_KEY}}));
 
       // Set up the recipient, passing in kSmallOrderPoint as `enc`.
       ScopedEVP_HPKE_CTX recipient_ctx;
       EXPECT_FALSE(EVP_HPKE_CTX_setup_recipient(
           recipient_ctx.get(), key.get(), kdf(), aead(), kSmallOrderPoint,
           sizeof(kSmallOrderPoint), nullptr, 0));
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_INVALID_PEER_KEY}}));
 
       // Likewise with auth. With auth, a small-order point could appear as
       // either `enc` or the peer public key.
@@ -521,10 +524,12 @@
           recipient_ctx.get(), key.get(), kdf(), aead(), kSmallOrderPoint,
           sizeof(kSmallOrderPoint), nullptr, 0, kValidPoint,
           sizeof(kValidPoint)));
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_INVALID_PEER_KEY}}));
       EXPECT_FALSE(EVP_HPKE_CTX_setup_auth_recipient(
           recipient_ctx.get(), key.get(), kdf(), aead(), kValidPoint,
           sizeof(kValidPoint), nullptr, 0, kSmallOrderPoint,
           sizeof(kSmallOrderPoint)));
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_INVALID_PEER_KEY}}));
     }
   }
 }

boringssl-0.20260708.tar.xz/crypto/internal.h -> boringssl-0.20260813.tar.xz/crypto/internal.h Changed

@@ -1025,6 +1025,60 @@
 }
 
 
+// Bit math functions.
+//
+// Polyfills for C++20.
+
+// CRYPTO_bit_width returns the smallest number of bits needed to represent `n`.
+// It returns zero if `n` is zero.
+inline int CRYPTO_bit_width(uint64_t n) {
+#if OPENSSL_HAS_BUILTIN(__builtin_clzll)
+  static_assert(sizeof(unsigned long long) >= sizeof(uint64_t));
+  return n ? (sizeof(unsigned long long) * 8 - __builtin_clzll(n)) : 0;
+#else
+  int width = 0;
+  while (n > 0) {
+    ++width;
+    n >>= 1;
+  }
+  return width;
+#endif
+}
+
+// CRYPTO_popcount returns the number of set bits in `n`'s binary
+// representation.
+inline int CRYPTO_popcount(uint64_t n) {
+#if OPENSSL_HAS_BUILTIN(__builtin_popcountll)
+  static_assert(sizeof(unsigned long long) >= sizeof(uint64_t));
+  return __builtin_popcountll(n);
+#else
+  int count = 0;
+  while (n > 0) {
+    n &= (n - 1);  // Clears the least significant bit that is set.
+    ++count;
+  }
+  return count;
+#endif
+}
+
+// CRYPTO_bit_ceil returns the smallest power of 2 that is greater than or equal
+// to `n`.
+inline uint64_t CRYPTO_bit_ceil(uint64_t n) {
+  return n ? uint64_t{1} << CRYPTO_bit_width(n - 1) : uint64_t{1};
+}
+
+// CRYPTO_bit_floor returns the largest power of 2 that is less than or equal to
+// `n`. It returns zero if `n` is zero.
+inline uint64_t CRYPTO_bit_floor(uint64_t n) {
+  return n ? (uint64_t{1} << (CRYPTO_bit_width(n) - 1)) : uint64_t{0};
+}
+
+// CRYPTO_has_single_bit returns whether `n` is an integral power of 2.
+inline bool CRYPTO_has_single_bit(uint64_t n) {
+  return CRYPTO_popcount(n) == 1;
+}
+
+
 // FIPS functions.
 
 #if defined(BORINGSSL_FIPS)

boringssl-0.20260813.tar.xz/crypto/perlasm/PQCodePackage.pm Added

@@ -0,0 +1,112 @@
+package PQCodePackage;
+
+use strict;
+use warnings;
+
+# Function to adapt assembly code from pq-code-package to BoringSSL usage.
+# Should be kept as simple as possible, and maybe even become an identity
+# function to just mark the origin of an assembly string.
+sub asm {
+    my ($asm) = @_;
+
+    # BoringSSL does not promise alignment for the key data.
+    $asm =~ s/\bvmovdqa\b/vmovdqu/g;
+
+    return $asm;
+}
+
+# TODO(crbug.com/33072965): Replace by a common approach.
+#
+# Adapter to use pq-code-package asm functions (which are red zone less SysV
+# ABI) from BoringSSL.
+#
+# Handles register saving and argument remapping.
+#
+# Function must not call any non-SysV-ABI functions, and if it calls any
+# SysV-ABI functions, $num_xmms must include the xmm registers they clobber
+# too.
+#
+# Arguments:
+#   $win64: Whether compiling for Windows.
+#   $num_xmms: Number of xmm registers starting with xmm6 that get clobbered.
+#   $num_args: Number of arguments the function takes (at most 4).
+sub abi_enter {
+    my ($win64, $num_xmms, $num_args) = @_;
+    my $out = "";
+    if ($win64) {
+        $out .= "        .seh_startproc\n";
+        # Stack layout: xmm6@rsp xmm7 xmm8 ... rdi rsi padding returnaddress.
+        # Padding needed to align the xmm registers to 16 bytes boundaries.
+        my $stack_alloc = 16 + $num_xmms * 16 + 8;
+        $out .= "        subq\t\$$stack_alloc, %rsp\n";
+        $out .= "        .seh_stackalloc\t$stack_alloc\n";
+
+        my $rdi_off = $num_xmms * 16;
+        my $rsi_off = $rdi_off + 8;
+        $out .= "        movq\t%rdi, $rdi_off(%rsp)\n";
+        $out .= "        .seh_savereg\t%rdi, $rdi_off\n";
+        $out .= "        movq\t%rsi, $rsi_off(%rsp)\n";
+        $out .= "        .seh_savereg\t%rsi, $rsi_off\n";
+
+        for (my $i = 0; $i < $num_xmms; $i++) {
+            my $reg = 6 + $i;
+            my $off = $i * 16;
+            $out .= "        vmovdqa\t%xmm$reg, $off(%rsp)\n";
+            $out .= "        .seh_savexmm\t%xmm$reg, $off\n";
+        }
+        $out .= "        .seh_endprologue\n";
+
+        # Map arguments. Funny ordering to spread out data dependencies.
+        $out .= "        movq\t%rdx, %rsi\n"
+            if $num_args >= 2;
+        $out .= "        movq\t%rcx, %rdi\n"
+            if $num_args >= 1;
+        $out .= "        movq\t%r8, %rdx\n"
+            if $num_args >= 3;
+        $out .= "        movq\t%r9, %rcx\n"
+            if $num_args >= 4;
+        die "abi_enter with invalid argument count: got $num_args, want <= 4"
+            if $num_args > 4;
+    }
+    return $out;
+}
+
+# TODO(crbug.com/33072965): Replace by a common approach.
+#
+# Adapter to use pq-code-package asm functions (which are red zone less SysV
+# ABI) from BoringSSL.
+#
+# Handles register restoring and AVX2 zeroing.
+#
+# Arguments:
+#   $win64: Whether compiling for Windows.
+#   $num_xmms: Number of xmm registers starting with xmm6 that get clobbered.
+#     Must match the argument to `abi_enter`.
+sub abi_exit {
+    my ($win64, $num_xmms) = @_;
+    my $out = "";
+    $out .= "        vzeroupper\n";
+    if ($win64) {
+        my $stack_alloc = 16 + $num_xmms * 16 + 8;
+
+        for (my $i = 0; $i < $num_xmms; $i++) {
+            my $reg = 6 + $i;
+            my $off = $i * 16;
+            $out .= "        vmovdqa\t$off(%rsp), %xmm$reg\n";
+        }
+
+        my $rdi_off = $num_xmms * 16;
+        my $rsi_off = $rdi_off + 8;
+        $out .= "        movq\t$rdi_off(%rsp), %rdi\n";
+        $out .= "        movq\t$rsi_off(%rsp), %rsi\n";
+
+        $out .= "        addq\t\$$stack_alloc, %rsp\n";
+    }
+    $out .= "        ret\n";
+    if ($win64) {
+        $out .= "        .seh_endproc\n";
+    }
+    return $out;
+}
+
+1;

boringssl-0.20260708.tar.xz/crypto/perlasm/arm-xlate.pl -> boringssl-0.20260813.tar.xz/crypto/perlasm/arm-xlate.pl Changed

@@ -215,7 +215,10 @@
 
     if ($line =~ m/^\s*(#|@|\/\/)/)	{ print $line; next; }
 
-    $line =~ s|/\*.*\*/||;	# get rid of C-style comments...
+    my @comments = ();
+
+    $line =~ s|/\*(.*)\*/||	# get rid of C-style comments...
+	and push @comments, $1;
     $line =~ s|^\s+||;		# ... and skip white spaces in beginning...
     $line =~ s|\s+$||;		# ... and at the end
 
@@ -232,6 +235,12 @@
 	}
     }
 
+    my $comments = join ' ', map { s|^\s+||; s|\s+$||; $_; } @comments;
+    my $commentprefix = @comments ? '// ' : '';
+    my $commentspace = @comments ? '  ' : '';
+
+    my $pre_line = '';
+
     {
 	$line =~ s|\b\.L(\w{2,})|L$1|g;	# common denominator for Locallabel
 	$line =~ s|\bL(\w{2,})|\.L$1|g	if ($dotinlocallabels);
@@ -258,10 +267,10 @@
 		    # may add necessary relocations. It however is invalid to
 		    # mark the _first_ symbol of a section so, as it always is
 		    # considered an entry point.
-		    printf ".alt_entry %s\n", $name;
+		    $pre_line .= sprintf ".alt_entry %s\n", $name;
 		}
 	    }
-	    printf "%s:", $name;
+	    $pre_line .= sprintf "%s:", $name;
 	}
     }
 
@@ -298,8 +307,11 @@
 	}
     }
 
-    print $line if ($line);
-    print "\n";
+    $line = $pre_line . $line;
+    $commentspace = ''
+	if $line !~ /^\n$/;
+
+    print $line, $commentspace, $commentprefix, $comments, "\n";
 }
 
 print <<___;

boringssl-0.20260708.tar.xz/crypto/perlasm/x86_64-xlate.pl -> boringssl-0.20260813.tar.xz/crypto/perlasm/x86_64-xlate.pl Changed

@@ -130,7 +130,7 @@
 		$self->{sz} = $2;
 	    } elsif ($self->{op} =~ /call|jmp|^rdrand$/) {
 		$self->{sz} = "";
-	    } elsif ($self->{op} =~ /^p/ && $' !~ /^(ush|op|insrw)/) { # SSEn
+	    } elsif ($self->{op} =~ /^p/ && $' !~ /^(ush|op|insrw|extql?$|depql?$)/) { # SSEn
 		$self->{sz} = "";
 	    } elsif ($self->{op} =~ /^vk/) { # VEX or k* such as kmov
 		$self->{sz} = "";
@@ -1062,27 +1062,6 @@
     }
 }
 { package directive;	# pick up directives, which start with .
-    my %sections;
-    sub nasm_section {
-	my ($name, $qualifiers) = @_;
-	my $ret = "section\t$name";
-	if (exists $sections{$name}) {
-	    # Work around https://bugzilla.nasm.us/show_bug.cgi?id=3392701. Only
-	    # emit section qualifiers the first time a section is referenced.
-	    # For all subsequent references, require the qualifiers match and
-	    # omit them.
-	    #
-	    # See also https://crbug.com/1422018 and b/270643835.
-	    my $old = $sections{$name};
-	    die "Inconsistent qualifiers: $qualifiers vs $old" if ($qualifiers ne "" && $qualifiers ne $old);
-	} else {
-	    $sections{$name} = $qualifiers;
-	    if ($qualifiers ne "") {
-		$ret .= " $qualifiers";
-	    }
-	}
-	return $ret;
-    }
     sub re {
 	my	($class, $line) = @_;
 	my	$self = {};
@@ -1191,7 +1170,7 @@
 	    SWITCH: for ($dir) {
 		/\.text/    && do { my $v=undef;
 				    if ($nasm) {
-					$v=nasm_section(".text", "code align=64")."\n";
+					$v="section	.text code align=64\n";
 				    } else {
 					$v="$current_segment\tENDS\n" if ($current_segment);
 					$current_segment = ".text\$";
@@ -1204,7 +1183,7 @@
 				  };
 		/\.data/    && do { my $v=undef;
 				    if ($nasm) {
-					$v=nasm_section(".data", "data align=8")."\n";
+					$v="section	.data data align=8\n";
 				    } else {
 					$v="$current_segment\tENDS\n" if ($current_segment);
 					$current_segment = "_DATA";
@@ -1218,14 +1197,13 @@
 				    $$line = ".CRT\$XCU" if ($$line eq ".init");
 				    $$line = ".rdata" if ($$line eq ".rodata");
 				    if ($nasm) {
-					my $qualifiers = "";
+					$v="section	$$line";
 					if ($$line=~/\.(prx)data/) {
-					    $qualifiers = "rdata align=";
-					    $qualifiers .= $1 eq "p"? 4 : 8;
+					    $v.=" rdata align=";
+					    $v.=$1 eq "p"? 4 : 8;
 					} elsif ($$line=~/\.CRT\$/i) {
-					    $qualifiers = "rdata align=8";
+					    $v.=" rdata align=8";
 					}
-					$v = nasm_section($$line, $qualifiers);
 				    } else {
 					$v="$current_segment\tENDS\n" if ($current_segment);
 					$v.="$$line\tSEGMENT";
@@ -1322,9 +1300,9 @@
 
 ########################################################################
 
+my $comment = "//";
+$comment = ";" if ($masm || $nasm);
 {
-  my $comment = "//";
-  $comment = ";" if ($masm || $nasm);
   print <<___;
 $comment This file is generated from a similarly-named Perl script in the BoringSSL
 $comment source tree. Do not edit by hand.
@@ -1374,24 +1352,36 @@
     my $line = shift;
     $line =~ s|\R$||;           # Better chomp
 
+    my @comments = ();
+
     if ($nasm) {
 	$line =~ s|^#ifdef |%ifdef |;
 	$line =~ s|^#ifndef |%ifndef |;
 	$line =~ s|^#endif|%endif|;
-	$line =~ s|#!.*$||;	# get rid of asm-style comments...
+	$line =~ s|#!(.*)$||  # get rid of asm-style comments...
+	    and push @comments, $1;
     } else {
 	# Get rid of asm-style comments but not preprocessor directives. The
 	# former are identified by having a letter after the '#' and starting in
 	# the first column.
 	$line =~ s|!.*$||;
-	$line =~ s|(?<=.)#.*$||;
-	$line =~ s|^#(^a-z.*)?$||;
+	$line =~ s|(?<=.)#(.*)$||
+	    and push @comments, $1;
+	$line =~ s|^#(^a-z.*)?$||
+	    and push @comments, $1;
     }
 
-    $line =~ s|/\*.*\*/||;	# ... and C-style comments...
+    $line =~ s|/\*(.*)\*/||	# ... and C-style comments...
+	and push @comments, $1;
     $line =~ s|^\s+||;		# ... and skip white spaces in beginning
     $line =~ s|\s+$||;		# ... and at the end
 
+    my $comments = join ' ', map { s|^\s+||; s|\s+$||; $_; } @comments;
+    my $commentprefix = @comments ? "$comment " : '';
+    my $commentspace = @comments ? '  ' : '';
+
+    my $pre_line = '';
+
     if (my $label=label->re(\$line)) {
 	if ($gas) {
 	    my $name = ($globals{$label->{value}} or $label->{value});
@@ -1416,16 +1406,16 @@
 		}
 	    }
 	}
-	print $label->out();
+	$pre_line .= $label->out();
     }
 
     if (my $directive=directive->re(\$line)) {
-	printf "%s",$directive->out();
+	$pre_line .= $directive->out();
     } elsif (my $opcode=opcode->re(\$line)) {
 	my $asm = eval("\$".$opcode->mnemonic());
 
 	if ((ref($asm) eq 'CODE') && scalar(my @bytes=&$asm($line))) {
-	    print $gas?".byte\t":"DB\t",join(',',@bytes),"\n";
+	    print $pre_line, $gas?".byte\t":"DB\t",join(',',@bytes),$commentspace,$commentprefix,$comment,"\n";
 	    next;
 	}
 
@@ -1453,7 +1443,7 @@
 	    if ($gas) {
 		$insn = $opcode->out($#args>=1?$args$#args->size():$sz);
 		@args = map($_->out($sz),@args);
-		printf "\t%s\t%s",$insn,join(",",@args);
+		$pre_line .= sprintf "\t%s\t%s",$insn,join(",",@args);
 	    } else {
 		$insn = $opcode->out();
 		foreach (@args) {
@@ -1466,14 +1456,18 @@
 		}
 		@args = reverse(@args);
 		undef $sz if ($nasm && $opcode->mnemonic() eq "lea");
-		printf "\t%s\t%s",$insn,join(",",map($_->out($sz),@args));
+		$pre_line .= sprintf "\t%s\t%s",$insn,join(",",map($_->out($sz),@args));
 	    }
 	} else {
-	    printf "\t%s",$opcode->out();
+	    $pre_line .= sprintf "\t%s",$opcode->out();
 	}
     }
 
-    print $line,"\n";
+    $line = $pre_line . $line;
+    $commentspace = ''
+	if $line !~ /^\n$/;
+
+    print $line, $commentspace, $commentprefix, $comments, "\n";
 }
 
 while(defined(my $line=<>)) {

boringssl-0.20260708.tar.xz/crypto/rsa/rsa_test.cc -> boringssl-0.20260813.tar.xz/crypto/rsa/rsa_test.cc Changed

@@ -1352,15 +1352,25 @@
   ASSERT_TRUE(neg_iqmp);
 
   EXPECT_FALSE(RSA_new_public_key(neg_n.get(), e));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_BAD_RSA_PARAMETERS}}));
   EXPECT_FALSE(RSA_new_public_key(n, neg_e.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_BAD_E_VALUE}}));
   EXPECT_FALSE(RSA_new_private_key(neg_n.get(), e, d, p, q, dmp1, dmq1, iqmp));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_BAD_RSA_PARAMETERS}}));
   EXPECT_FALSE(RSA_new_private_key(n, neg_e.get(), d, p, q, dmp1, dmq1, iqmp));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_BAD_E_VALUE}}));
   EXPECT_FALSE(RSA_new_private_key(n, e, neg_d.get(), p, q, dmp1, dmq1, iqmp));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_D_OUT_OF_RANGE}}));
   EXPECT_FALSE(RSA_new_private_key(n, e, d, neg_p.get(), q, dmp1, dmq1, iqmp));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_N_NOT_EQUAL_P_Q}}));
   EXPECT_FALSE(RSA_new_private_key(n, e, d, p, neg_q.get(), dmp1, dmq1, iqmp));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_N_NOT_EQUAL_P_Q}}));
   EXPECT_FALSE(RSA_new_private_key(n, e, d, p, q, neg_dmp1.get(), dmq1, iqmp));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_CRT_VALUES_INCORRECT}}));
   EXPECT_FALSE(RSA_new_private_key(n, e, d, p, q, dmp1, neg_dmq1.get(), iqmp));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_CRT_VALUES_INCORRECT}}));
   EXPECT_FALSE(RSA_new_private_key(n, e, d, p, q, dmp1, dmq1, neg_iqmp.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_CRT_VALUES_INCORRECT}}));
 }
 
 TEST(RSATest, LargeE) {
@@ -1378,9 +1388,11 @@
   // By default, the large exponent is not allowed as e.
   UniquePtr<RSA> pub(RSA_new_public_key(n, /*e=*/d));
   EXPECT_FALSE(pub);
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_BAD_E_VALUE}}));
   UniquePtr<RSA> priv(RSA_new_private_key(n, /*e=*/d, /*d=*/e, p, q,
                                           /*dmp1=*/e, /*dmq1=*/e, iqmp));
   EXPECT_FALSE(priv);
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_BAD_E_VALUE}}));
 
   // Constructing such a key piecemeal gives back an object that fails all
   // operations.
@@ -1396,6 +1408,7 @@
                                  kDigest, sizeof(kDigest), EVP_sha256(),
                                  EVP_sha256(),
                                  /*salt_len=*/32));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_BAD_E_VALUE}}));
 
   // But the "large e" APIs tolerate it.
   pub.reset(RSA_new_public_key_large_e(n, /*e=*/d));
@@ -1466,10 +1479,15 @@
   // TODO(crbug.com/42290480): Raise the lower bound. 512-bit RSA was factored
   // in 1999.
   EXPECT_FALSE(generate_key(511u));
-  EXPECT_TRUE(
-      ErrorEquals(ERR_get_error(), ERR_LIB_RSA, RSA_R_KEY_SIZE_TOO_SMALL));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_KEY_SIZE_TOO_SMALL}}));
   EXPECT_FALSE(read_private_key("crypto/rsa/test/rsa511.pem"));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_DECODE_ERROR}}));
   EXPECT_FALSE(read_public_key("crypto/rsa/test/rsa511pub.pem"));
+  EXPECT_TRUE(ErrorsAreAndClear({
+      {ERR_LIB_RSA, RSA_R_KEY_SIZE_TOO_SMALL},
+      {ERR_LIB_RSA, RSA_R_BAD_RSA_PARAMETERS},
+      {ERR_LIB_RSA, RSA_R_BAD_ENCODING},
+  }));
 
   UniquePtr<RSA> rsa = read_private_key("crypto/rsa/test/rsa512.pem");
   ASSERT_TRUE(rsa);
@@ -1504,8 +1522,15 @@
   EXPECT_EQ(RSA_bits(rsa.get()), 16384u);
 
   EXPECT_FALSE(read_private_key("crypto/rsa/test/rsa16385.pem"));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_EVP, EVP_R_DECODE_ERROR}}));
   EXPECT_FALSE(read_public_key("crypto/rsa/test/rsa16385pub.pem"));
+  EXPECT_TRUE(ErrorsAreAndClear({
+      {ERR_LIB_RSA, RSA_R_MODULUS_TOO_LARGE},
+      {ERR_LIB_RSA, RSA_R_BAD_RSA_PARAMETERS},
+      {ERR_LIB_RSA, RSA_R_BAD_ENCODING},
+  }));
   EXPECT_FALSE(generate_key(16385u));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_RSA, RSA_R_MODULUS_TOO_LARGE}}));
 }
 
 #if defined(OPENSSL_THREADS)

boringssl-0.20260708.tar.xz/crypto/slhdsa/slhdsa.cc -> boringssl-0.20260813.tar.xz/crypto/slhdsa/slhdsa.cc Changed

@@ -21,12 +21,14 @@
 
 using namespace bssl;
 
+static_assert(SLHDSA_SHA2_128S_SEED_BYTES == 3 * BCM_SLHDSA_SHA2_128S_N);
 static_assert(SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES ==
               BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES);
 static_assert(SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES ==
               BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES);
 static_assert(SLHDSA_SHA2_128S_SIGNATURE_BYTES ==
               BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES);
+static_assert(SLHDSA_SHAKE_256F_SEED_BYTES == 3 * BCM_SLHDSA_SHAKE_256F_N);
 static_assert(SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES ==
               BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES);
 static_assert(SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES ==
@@ -34,6 +36,22 @@
 static_assert(SLHDSA_SHAKE_256F_SIGNATURE_BYTES ==
               BCM_SLHDSA_SHAKE_256F_SIGNATURE_BYTES);
 
+void SLHDSA_SHA2_128S_generate_key_from_seed(
+    uint8_t out_public_keySLHDSA_SHA2_128S_PUBLIC_KEY_BYTES,
+    uint8_t out_private_keySLHDSA_SHA2_128S_PRIVATE_KEY_BYTES,
+    const uint8_t seedSLHDSA_SHA2_128S_SEED_BYTES) {
+  BCM_slhdsa_sha2_128s_generate_key_from_seed(out_public_key, out_private_key,
+                                              seed);
+}
+
+void SLHDSA_SHAKE_256F_generate_key_from_seed(
+    uint8_t out_public_keySLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES,
+    uint8_t out_private_keySLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES,
+    const uint8_t seedSLHDSA_SHAKE_256F_SEED_BYTES) {
+  BCM_slhdsa_shake_256f_generate_key_from_seed(out_public_key, out_private_key,
+                                               seed);
+}
+
 void SLHDSA_SHA2_128S_generate_key(
     uint8_t out_public_keySLHDSA_SHA2_128S_PUBLIC_KEY_BYTES,
     uint8_t out_private_keySLHDSA_SHA2_128S_PRIVATE_KEY_BYTES) {
@@ -73,8 +91,7 @@
     const uint8_t *msg, size_t msg_len, const uint8_t *context,
     size_t context_len) {
   return bcm_success(BCM_slhdsa_shake_256f_sign(out_signature, private_key, msg,
-                                                msg_len, context,
-                                                context_len));
+                                                msg_len, context, context_len));
 }
 
 int SLHDSA_SHA2_128S_verify(
@@ -83,8 +100,8 @@
     const uint8_t *msg, size_t msg_len, const uint8_t *context,
     size_t context_len) {
   return bcm_success(BCM_slhdsa_sha2_128s_verify(signature, signature_len,
-                                                public_key, msg, msg_len,
-                                                context, context_len));
+                                                 public_key, msg, msg_len,
+                                                 context, context_len));
 }
 
 int SLHDSA_SHAKE_256F_verify(
@@ -93,8 +110,8 @@
     const uint8_t *msg, size_t msg_len, const uint8_t *context,
     size_t context_len) {
   return bcm_success(BCM_slhdsa_shake_256f_verify(signature, signature_len,
-                                                 public_key, msg, msg_len,
-                                                 context, context_len));
+                                                  public_key, msg, msg_len,
+                                                  context, context_len));
 }
 
 int SLHDSA_SHA2_128S_prehash_sign(

boringssl-0.20260708.tar.xz/crypto/spake2plus/spake2plus_test.cc -> boringssl-0.20260813.tar.xz/crypto/spake2plus/spake2plus_test.cc Changed

@@ -133,8 +133,11 @@
       return false;
     }
 
-    if (repeat_invocations && prover.GenerateShare(prover_share)) {
-      return false;
+    if (repeat_invocations) {
+      if (prover.GenerateShare(prover_share)) {
+        return false;
+      }
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_CRYPTO, std::nullopt}}));
     }
 
     if (prover_corrupt_msg_bit &&
@@ -151,10 +154,12 @@
       return false;
     }
 
-    if (repeat_invocations &&
-        verifier.ProcessProverShare(verifier_share, verifier_confirm,
-                                    verifier_secret, prover_share)) {
-      return false;
+    if (repeat_invocations) {
+      if (verifier.ProcessProverShare(verifier_share, verifier_confirm,
+                                      verifier_secret, prover_share)) {
+        return false;
+      }
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_CRYPTO, std::nullopt}}));
     }
 
     uint8_t prover_confirmkConfirmSize;
@@ -164,10 +169,12 @@
       return false;
     }
 
-    if (repeat_invocations &&  //
-        prover.ComputeConfirmation(prover_confirm, prover_secret,
-                                   verifier_share, verifier_confirm)) {
-      return false;
+    if (repeat_invocations) {
+      if (prover.ComputeConfirmation(prover_confirm, prover_secret,
+                                     verifier_share, verifier_confirm)) {
+        return false;
+      }
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_CRYPTO, std::nullopt}}));
     }
 
     if (prover_corrupt_confirm_bit &&
@@ -180,9 +187,11 @@
       return false;
     }
 
-    if (repeat_invocations &&
-        verifier.VerifyProverConfirmation(prover_confirm)) {
-      return false;
+    if (repeat_invocations) {
+      if (verifier.VerifyProverConfirmation(prover_confirm)) {
+        return false;
+      }
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_CRYPTO, std::nullopt}}));
     }
 
     key_matches_ = Span(prover_secret) == Span(verifier_secret);
@@ -306,6 +315,7 @@
   SPAKEPLUSRun spake2;
   spake2.verifier_corrupt_record = true;
   ASSERT_FALSE(spake2.Run());
+  EXPECT_TRUE(ErrorsAreAndClear({{std::nullopt, std::nullopt}}));
 }
 
 TEST(SPAKEPLUSTest, WrongNames) {
@@ -321,6 +331,7 @@
     spake2.prover_corrupt_msg_bit = i;
     EXPECT_FALSE(spake2.Run())
         << "Passed after corrupting Prover's key share message, bit " << i;
+    EXPECT_TRUE(ErrorsAreAndClear({{std::nullopt, std::nullopt}}));
   }
 
   for (size_t i = 0; i < 8 * kConfirmSize; i++) {
@@ -328,6 +339,7 @@
     spake2.prover_corrupt_confirm_bit = i;
     EXPECT_FALSE(spake2.Run())
         << "Passed after corrupting Verifier's confirmation message, bit " << i;
+    EXPECT_TRUE(ErrorsAreAndClear({{std::nullopt, std::nullopt}}));
   }
 }

boringssl-0.20260708.tar.xz/crypto/test/test_util.cc -> boringssl-0.20260813.tar.xz/crypto/test/test_util.cc Changed

@@ -70,18 +70,64 @@
   return ret;
 }
 
-testing::AssertionResult ErrorEquals(uint32_t err, int lib, int reason) {
-  if (ERR_equals(err, lib, reason)) {
+testing::AssertionResult ErrorEquals(uint32_t err, std::optional<int> lib,
+                                     std::optional<int> reason) {
+  bool lib_matches = !lib.has_value() || (ERR_GET_LIB(err) == lib.value());
+  bool reason_matches =
+      !reason.has_value() || (ERR_GET_REASON(err) == reason.value());
+
+  if (lib_matches && reason_matches) {
     return testing::AssertionSuccess();
   }
 
   char buf128, expected128;
-  return testing::AssertionFailure()
-         << "Got \"" << ERR_error_string_n(err, buf, sizeof(buf))
-         << "\", wanted \""
-         << ERR_error_string_n(ERR_PACK(lib, reason), expected,
-                               sizeof(expected))
-         << "\"";
+  if (lib.has_value() && reason.has_value()) {
+    return testing::AssertionFailure()
+           << "Got \"" << ERR_error_string_n(err, buf, sizeof(buf))
+           << "\", wanted \""
+           << ERR_error_string_n(ERR_PACK(lib.value(), reason.value()),
+                                 expected, sizeof(expected))
+           << "\"";
+  } else if (lib.has_value()) {
+    return testing::AssertionFailure()
+           << "Got \"" << ERR_error_string_n(err, buf, sizeof(buf))
+           << "\", wanted something with library \""
+           << ERR_lib_error_string(ERR_PACK(lib.value(), 0)) << "\"";
+  } else if (reason.has_value()) {
+    return testing::AssertionFailure()
+           << "Got \"" << ERR_error_string_n(err, buf, sizeof(buf))
+           << "\", wanted something with reason \""
+           << ERR_reason_error_string(ERR_PACK(0, reason.value())) << "\"";
+  } else {
+    return testing::AssertionFailure()
+           << "Unreachable code: the always-true assertion failed";
+  }
+}
+
+testing::AssertionResult ErrorsAreAndClear(
+    std::initializer_list<std::pair<std::optional<int>, std::optional<int>>>
+        libs_and_reasons) {
+  if (libs_and_reasons.size() == 0) {
+    return testing::AssertionFailure()
+           << "ErrorsAreAndClear with empty list of errors is nonsensical - "
+              "just use ERR_clear_error directly!";
+  }
+  bool have_failures = false;
+  testing::AssertionResult all_failures = testing::AssertionFailure();
+  for (const auto &lib, reason : libs_and_reasons) {
+    uint32_t err = ERR_get_error();
+    testing::AssertionResult this_result = ErrorEquals(err, lib, reason);
+    if (this_result) {
+      continue;
+    }
+    all_failures << this_result.message();
+    have_failures = true;
+  }
+  if (have_failures) {
+    return all_failures;
+  }
+  ERR_clear_error();
+  return testing::AssertionSuccess();
 }
 
 bssl::UniquePtr<BIGNUM> HexToBIGNUM(const char *hex) {

boringssl-0.20260708.tar.xz/crypto/test/test_util.h -> boringssl-0.20260813.tar.xz/crypto/test/test_util.h Changed

@@ -20,8 +20,11 @@
 #include <stdio.h>
 #include <string.h>
 
+#include <initializer_list>
 #include <iosfwd>
+#include <optional>
 #include <string_view>
+#include <utility>
 #include <vector>
 
 #include <gtest/gtest.h>
@@ -73,8 +76,18 @@
 std::string EncodeHex(bssl::Span<const uint8_t> in);
 
 // ErrorEquals asserts that `err` is an error with library `lib` and reason
-// `reason`.
-testing::AssertionResult ErrorEquals(uint32_t err, int lib, int reason);
+// `reason`. Pass `std::nullopt` to either of them to not assert on it.
+testing::AssertionResult ErrorEquals(uint32_t err, std::optional<int> lib,
+                                     std::optional<int> reason);
+
+// ErrorsAreAndClear asserts that the first (i.e. least recent, and thus most
+// specific) errors on the error queue are as specified, and then clears the
+// remainder of the queue. The first entry in `libs_and_reasons` shall be the
+// error first read from `ERR_get_error`. `libs_and_reasons` is not allowed to
+// be empty; instead, to just clear and assert nothing, call `ERR_clear_error`.
+testing::AssertionResult ErrorsAreAndClear(
+    std::initializer_list<std::pair<std::optional<int>, std::optional<int>>>
+        libs_and_reasons);
 
 // HexToBignum decodes `hex` as a hexadecimal, big-endian, unsigned integer and
 // returns it as a `BIGNUM`, or nullptr on error.

boringssl-0.20260708.tar.xz/crypto/x509/a_verify.cc -> boringssl-0.20260813.tar.xz/crypto/x509/a_verify.cc Changed

@@ -34,23 +34,30 @@
 int bssl::x509_verify_signature(const X509_ALGOR *sigalg,
                                 const ASN1_BIT_STRING *signature,
                                 Span<const uint8_t> in, EVP_PKEY *pkey) {
-  if (!pkey) {
-    OPENSSL_PUT_ERROR(X509, ERR_R_PASSED_NULL_PARAMETER);
-    return 0;
-  }
-
   if (signature->type == V_ASN1_BIT_STRING &&
       ASN1_BIT_STRING_unused_bits(signature) != 0) {
     OPENSSL_PUT_ERROR(X509, X509_R_INVALID_BIT_STRING_BITS_LEFT);
     return 0;
   }
+  Span<const uint8_t> signature_bytes(ASN1_STRING_get0_data(signature),
+                                      ASN1_STRING_length(signature));
+  return x509_verify_signature_bytes(sigalg, signature_bytes, in, pkey);
+}
+
+int bssl::x509_verify_signature_bytes(const X509_ALGOR *sigalg,
+                                      Span<const uint8_t> signature,
+                                      Span<const uint8_t> in, EVP_PKEY *pkey) {
+  if (!pkey) {
+    OPENSSL_PUT_ERROR(X509, ERR_R_PASSED_NULL_PARAMETER);
+    return 0;
+  }
 
   ScopedEVP_MD_CTX ctx;
   if (!x509_digest_verify_init(ctx.get(), sigalg, pkey)) {
     return 0;
   }
-  if (!EVP_DigestVerify(ctx.get(), ASN1_STRING_get0_data(signature),
-                        ASN1_STRING_length(signature), in.data(), in.size())) {
+  if (!EVP_DigestVerify(ctx.get(), signature.data(), signature.size(),
+                        in.data(), in.size())) {
     OPENSSL_PUT_ERROR(X509, ERR_R_EVP_LIB);
     return 0;
   }

boringssl-0.20260708.tar.xz/crypto/x509/internal.h -> boringssl-0.20260813.tar.xz/crypto/x509/internal.h Changed

@@ -469,6 +469,13 @@
                           const ASN1_BIT_STRING *signature,
                           Span<const uint8_t> in, EVP_PKEY *pkey);
 
+// x509_verify_signature_bytes behaves like `x509_verify_signature` but takes in
+// a span containing the signature bytes (without ASN.1 headers). It returns one
+// if the signature is valid and zero on error.
+int x509_verify_signature_bytes(const X509_ALGOR *sigalg,
+                                Span<const uint8_t> signature,
+                                Span<const uint8_t> in, EVP_PKEY *pkey);
+
 // x509_sign_to_bit_string signs `in` using `ctx` and saves the result in `out`.
 // It returns the length of the signature on success and zero on error.
 int x509_sign_to_bit_string(EVP_MD_CTX *ctx, ASN1_BIT_STRING *out,
@@ -649,6 +656,25 @@
 int x509_name_copy(X509_NAME *dst, const X509_NAME *src);
 
 
+// Merkle Tree Certificate (MTC) verification functions.
+
+// x509_evaluate_mtc_subtree_inclusion_proof carries out the procedure in
+// section 4.3.2 of draft-ietf-plants-merkle-tree-certs to evaluate a subtree
+// inclusion proof for an entry at index `index` with hash `entry_hash` of a
+// subtree defined by `subtree_start`, `subtree_end`). The `inclusion_proof` to
+// be evaluated is passed as a byte array consisting of concatenated hashes
+// produced from the `log_hash` algorithm. This function returns true if
+// inclusion proof evaluation succeeded, and if so, writes the expected subtree
+// hash for the specified subtree containing the entry to `out`, which must be
+// the right size for `log_hash`. It returns false on error, including if the
+// inclusion proof fails to evaluate.
+bool x509_evaluate_mtc_subtree_inclusion_proof(
+    Span<uint8_t> out, const EVP_MD *log_hash,
+    Span<const uint8_t> inclusion_proof, uint64_t index,
+    Span<const uint8_t> entry_hash, uint64_t subtree_start,
+    uint64_t subtree_end);
+
+
 // Standard extensions.
 
 extern const X509V3_EXT_METHOD v3_bcons, v3_nscert, v3_key_usage, v3_ext_ku;

boringssl-0.20260708.tar.xz/crypto/x509/x509_extension_test.cc -> boringssl-0.20260813.tar.xz/crypto/x509/x509_extension_test.cc Changed

boringssl-0.20260813.tar.xz/crypto/x509/x509_mtc.cc Added

@@ -0,0 +1,131 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/base.h>
+#include <openssl/bytestring.h>
+#include <openssl/digest.h>
+#include <openssl/evp.h>
+#include <openssl/span.h>
+
+#include "../internal.h"
+#include "./internal.h"
+
+
+BSSL_NAMESPACE_BEGIN
+namespace {
+
+// Prefix for domain separation to denote a Merkle Tree interior node.
+const uint8_t kMtcNodeDomainSeparator = {0x01};
+
+// HashNode executes one hashing step in the evaluation of an inclusion proof.
+void HashNode(Span<uint8_t> out, const EVP_MD *log_hash,
+              Span<const uint8_t> left_child, Span<const uint8_t> right_child) {
+  assert(out.size() == EVP_MD_size(log_hash));
+  assert(left_child.size() == EVP_MD_size(log_hash));
+  assert(right_child.size() == EVP_MD_size(log_hash));
+  ScopedEVP_MD_CTX ctx;
+  EVP_DigestInit_ex(ctx.get(), log_hash, nullptr);
+  EVP_DigestUpdate(ctx.get(), kMtcNodeDomainSeparator,
+                   sizeof(kMtcNodeDomainSeparator));
+  EVP_DigestUpdate(ctx.get(), left_child.data(), left_child.size());
+  EVP_DigestUpdate(ctx.get(), right_child.data(), right_child.size());
+  EVP_DigestFinal_ex(ctx.get(), out.data(), nullptr);
+}
+
+// lsb returns whether the least-significant bit of `n` is set.
+inline bool lsb(uint64_t n) { return n & 1; }
+
+// Returns the first hash value (of size `log_hash_size`) remaining in
+// `inclusion_proof` and advances `inclusion_proof` past the returned value.
+// Returns an empty span if there are no more hash values of the appropriate
+// size.
+Span<const uint8_t> GetNextValueFromInclusionProof(
+    size_t log_hash_size, Span<const uint8_t> &inclusion_proof) {
+  if (inclusion_proof.size() < log_hash_size) {
+    return Span<const uint8_t>();
+  }
+  Span<const uint8_t> value = inclusion_proof.first(log_hash_size);
+  inclusion_proof = inclusion_proof.subspan(log_hash_size);
+  return value;
+}
+
+}  // namespace
+
+bool x509_evaluate_mtc_subtree_inclusion_proof(
+    Span<uint8_t> out, const EVP_MD *log_hash,
+    Span<const uint8_t> inclusion_proof, uint64_t index,
+    Span<const uint8_t> entry_hash, uint64_t subtree_start,
+    uint64_t subtree_end) {
+  const size_t log_hash_size = EVP_MD_size(log_hash);
+  if (out.size() != log_hash_size || entry_hash.size() != log_hash_size) {
+    return false;
+  }
+
+  // Check that `subtree_start` and `subtree_end` define a valid subtree.
+  if (subtree_start > subtree_end) {
+    return false;
+  }
+  // The subtree must be aligned and not have a ragged left edge, i.e. the size
+  // must not exceed the largest power of 2 that divides the start index.
+  const uint64_t subtree_size = subtree_end - subtree_start;
+  if (subtree_start != 0 &&
+      subtree_size > (subtree_start & (~subtree_start + 1))) {
+    return false;
+  }
+  // Check that `index` is in range for the subtree.
+  if (index < subtree_start || subtree_end <= index) {
+    return false;
+  }
+
+  OPENSSL_memcpy(out.data(), entry_hash.data(), log_hash_size);
+
+  // `fn` is the index of the entry if the subtree were re-numbered to start at
+  // 0, and `sn` is what the last entry of such a re-numbered subtree would be.
+  uint64_t fn = index - subtree_start;
+  uint64_t sn = subtree_size - 1;
+  while (!inclusion_proof.empty()) {
+    Span<const uint8_t> p =
+        GetNextValueFromInclusionProof(log_hash_size, inclusion_proof);
+    if (p.empty()) {
+      // Truncated hash in inclusion proof, or trailing data after last full
+      // hash.
+      return false;
+    }
+    assert(p.size() == log_hash_size);
+    if (sn == 0) {
+      // More hashes in the inclusion proof than expected.
+      return false;
+    }
+    if (lsb(fn) || fn == sn) {
+      HashNode(out, log_hash, /*left_child=*/p, /*right_child=*/out);
+      while (!lsb(fn)) {
+        fn >>= 1;
+        sn >>= 1;
+      }
+    } else {
+      HashNode(out, log_hash, /*left_child=*/out, /*right_child=*/p);
+    }
+    fn >>= 1;
+    sn >>= 1;
+  }
+
+  if (sn != 0) {
+    // Not enough hashes in inclusion proof.
+    return false;
+  }
+
+  return true;
+}
+
+BSSL_NAMESPACE_END

boringssl-0.20260708.tar.xz/crypto/x509/x509_test.cc -> boringssl-0.20260813.tar.xz/crypto/x509/x509_test.cc Changed

@@ -17,8 +17,10 @@
 #include <algorithm>
 #include <functional>
 #include <initializer_list>
+#include <iomanip>
 #include <iterator>
 #include <memory>
+#include <sstream>
 #include <string>
 #include <string_view>
 #include <utility>
@@ -2576,6 +2578,7 @@
     UniquePtr<EVP_PKEY> pkey(X509_get_pubkey(cert.get()));
     ASSERT_TRUE(pkey);
     EXPECT_FALSE(X509_verify(cert.get(), pkey.get()));
+    EXPECT_TRUE(ErrorsAreAndClear({{std::nullopt, std::nullopt}}));
   }
 }
 
@@ -3672,6 +3675,32 @@
                           X509_R_SIGNATURE_ALGORITHM_MISMATCH));
 }
 
+TEST(X509Test, VerifyUnusedBits) {
+  UniquePtr<X509> cert(CertFromPEM(kLeafPEM));
+  ASSERT_TRUE(cert);
+  UniquePtr<X509> issuer(CertFromPEM(kIntermediatePEM));
+  ASSERT_TRUE(issuer);
+  UniquePtr<EVP_PKEY> pkey(X509_get_pubkey(issuer.get()));
+  ASSERT_TRUE(pkey);
+  ASSERT_TRUE(X509_verify(cert.get(), pkey.get()));
+
+  X509Impl *impl = FromOpaque(cert.get());
+  const uint8_t *data = ASN1_STRING_get0_data(impl->signature.get());
+  int len = ASN1_STRING_length(impl->signature.get());
+  ASSERT_TRUE(data);
+  ASSERT_GT(len, 0);
+
+  std::vector<uint8_t> sig_bytes(data, data + len);
+  sig_byteslen - 1 &= 0xf0;  // Ensure lower bits are 0 for set1.
+  ASSERT_TRUE(ASN1_BIT_STRING_set1(impl->signature.get(), sig_bytes.data(),
+                                   sig_bytes.size(), 4));  // Set 4 unused bits.
+
+  ERR_clear_error();
+  EXPECT_FALSE(X509_verify(cert.get(), pkey.get()));
+  EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_X509,
+                          X509_R_INVALID_BIT_STRING_BITS_LEFT));
+}
+
 // TODO(crbug.com/387737061): Test that this function can decrypt certificates
 // and CRLs, even though it leaves encrypted private keys alone.
 TEST(X509Test, PEMX509Info) {
@@ -3811,11 +3840,13 @@
   UniquePtr<STACK_OF(X509_INFO)> infos2(
       PEM_X509_INFO_read_bio(bio.get(), nullptr, nullptr, nullptr));
   EXPECT_FALSE(infos2);
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}}));
 
   bio.reset(BIO_new_mem_buf(bad_pem.data(), bad_pem.size()));
   ASSERT_TRUE(bio);
   EXPECT_FALSE(
       PEM_X509_INFO_read_bio(bio.get(), infos.get(), nullptr, nullptr));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}}));
   EXPECT_EQ(2 * std::size(kExpected), sk_X509_INFO_num(infos.get()));
 }
 
@@ -4427,17 +4458,30 @@
   // https://crbug.com/42290225.
   EXPECT_TRUE(CertFromPEM(kExplicitDefaultVersionPEM));
   EXPECT_FALSE(CRLFromPEM(kExplicitDefaultVersionCRLPEM));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_VERSION}}));
   EXPECT_FALSE(CertFromPEM(kNegativeVersionPEM));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}}));
   EXPECT_FALSE(CertFromPEM(kFutureVersionPEM));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_VERSION}}));
   EXPECT_FALSE(CertFromPEM(kOverflowVersionPEM));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}}));
   EXPECT_FALSE(CertFromPEM(kV1WithExtensionsPEM));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}}));
   EXPECT_FALSE(CertFromPEM(kV2WithExtensionsPEM));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}}));
   EXPECT_FALSE(CertFromPEM(kV1WithIssuerUniqueIDPEM));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}}));
   EXPECT_FALSE(CertFromPEM(kV1WithSubjectUniqueIDPEM));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}}));
   EXPECT_FALSE(CRLFromPEM(kV1CRLWithExtensionsPEM));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_FIELD_FOR_VERSION}}));
   EXPECT_FALSE(CRLFromPEM(kV1CRLWithEntryExtensionsPEM));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_VERSION}}));
   EXPECT_FALSE(CRLFromPEM(kV3CRLPEM));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_VERSION}}));
   EXPECT_FALSE(CSRFromPEM(kV2CSRPEM));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_VERSION}}));
 
   // kV3CSRPEM is invalid but, for now, we accept it. See
   // https://github.com/certbot/certbot/pull/9334
@@ -4446,14 +4490,20 @@
   UniquePtr<X509> x509(X509_new());
   ASSERT_TRUE(x509);
   EXPECT_FALSE(X509_set_version(x509.get(), -1));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_VERSION}}));
   EXPECT_FALSE(X509_set_version(x509.get(), X509_VERSION_3 + 1));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_VERSION}}));
   EXPECT_FALSE(X509_set_version(x509.get(), 9999));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_VERSION}}));
 
   UniquePtr<X509_CRL> crl(X509_CRL_new());
   ASSERT_TRUE(crl);
   EXPECT_FALSE(X509_CRL_set_version(crl.get(), -1));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_VERSION}}));
   EXPECT_FALSE(X509_CRL_set_version(crl.get(), X509_CRL_VERSION_2 + 1));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_VERSION}}));
   EXPECT_FALSE(X509_CRL_set_version(crl.get(), 9999));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_INVALID_VERSION}}));
 
   UniquePtr<X509_REQ> req(X509_REQ_new());
   ASSERT_TRUE(req);
@@ -4960,6 +5010,7 @@
       // `X509_ATTRIBUTE_get0_data` requires the type match.
       EXPECT_FALSE(
           X509_ATTRIBUTE_get0_data(attr, idx, V_ASN1_OCTET_STRING, nullptr));
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_WRONG_TYPE}}));
       const ASN1_BMPSTRING *bmpstring = static_cast<const ASN1_BMPSTRING *>(
           X509_ATTRIBUTE_get0_data(attr, idx, V_ASN1_BMPSTRING, nullptr));
       ASSERT_TRUE(bmpstring);
@@ -5896,6 +5947,9 @@
       SCOPED_TRACE(dns);
       EXPECT_EQ(0, X509_check_host(cert.get(), dns.data(), dns.size(), t.flags,
                                    /*peername=*/nullptr));
+      if (t.cert_invalid_subject_alt_name) {
+        EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}}));
+      }
       EXPECT_EQ(t.cert_invalid_subject_alt_name ? X509_V_ERR_INVALID_EXTENSION
                                                 : X509_V_ERR_HOSTNAME_MISMATCH,
                 Verify(cert.get(), {root.get()}, /*intermediates=*/{},
@@ -6423,6 +6477,7 @@
   EXPECT_EQ(
       0, X509_add1_ext_i2d(x509.get(), NID_basic_constraints, basic2_obj.get(),
                            /*crit=*/0, X509V3_ADD_DEFAULT));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509V3, X509V3_R_EXTENSION_EXISTS}}));
   expect_extensions({{NID_basic_constraints, true, basic1_der},
                      {NID_subject_key_identifier, false, skid1_der}});
 
@@ -6456,12 +6511,16 @@
   // Not finding an extension to delete is an error.
   EXPECT_EQ(0, X509_add1_ext_i2d(x509.get(), NID_basic_constraints, nullptr, 0,
                                  X509V3_ADD_DELETE));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_X509V3, X509V3_R_EXTENSION_NOT_FOUND}}));
   expect_extensions({{NID_subject_key_identifier, true, skid2_der}});
 
   // `X509V3_ADD_REPLACE_EXISTING` fails if it cannot find a match.
   EXPECT_EQ(
       0, X509_add1_ext_i2d(x509.get(), NID_basic_constraints, basic1_obj.get(),
                            /*crit=*/1, X509V3_ADD_REPLACE_EXISTING));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_X509V3, X509V3_R_EXTENSION_NOT_FOUND}}));
   expect_extensions({{NID_subject_key_identifier, true, skid2_der}});
 
   // `X509V3_ADD_REPLACE` adds a new extension if not present.
@@ -8503,6 +8562,7 @@
     const uint8_t *inp = encoded.data();
     UniquePtr<X509_NAME> name(d2i_X509_NAME(nullptr, &inp, encoded.size()));
     EXPECT_FALSE(name);
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_ASN1, std::nullopt}}));
   }
 }
 
@@ -10611,5 +10671,634 @@
                          {/*self_issued=*/true, /*pathlen=*/1}}));
 }
 
+// Tests for `x509_evaluate_mtc_subtree_inclusion_proof`, which is an
+// internal-only function.
+#if !defined(BORINGSSL_SHARED_LIBRARY)
+
+// Generates a Merkle Tree for testing.
+class X509MerkleTreeTest : public ::testing::Test {
+ public:
+  using Entry = std::vector<uint8_t>;
+  using Hash = std::vector<uint8_t>;
+  using Level = std::vector<Hash>;
+
+  static bool IsValidSubtree(uint64_t start, uint64_t end) {
+    // Empty subtrees are explicitly allowed.
+    if (start == end) {
+      return true;
+    }
+    return GetCoveringSubtree(start, end) ==
+           /* possibly invalid */ Subtree{start, end};
+  }
+
+  X509MerkleTreeTest() = default;
+  ~X509MerkleTreeTest() override = default;
+
+  void SetUp() override {
+    // Default tree size and hash can be overridden by tests.
+    ASSERT_NO_FATAL_FAILURE(InitTestMerkleTree(EVP_sha256(), 256));
+  }
+
+  // This function generates a full Merkle Tree for testing (i.e. having its
+  // total entry count, `limit`, equal to a power of 2). Partial Merkle Trees,
+  // where some levels on the rightmost edge of the tree are skipped, are
+  // simulated as subsets of a complete tree.
+  void InitTestMerkleTree(const EVP_MD *hash, uint64_t limit) {
+    ASSERT_TRUE(IsPow2(limit));
+    limit_ = limit;
+    if (hash == hash_ && limit <= entries_.size()) {
+      return;
+    }
+
+    // Generate test entries compatible with the "accumulated" tests described
+    // in appendix C of draft-ietf-plants-merkle-tree-certs.
+    for (uint64_t index = entries_.size(); index < limit; ++index) {
+      Entry entry;
+      uint64_t num = index;
+      do {
+        entry.push_back(num & 0xff);
+        num >>= 8;
+      } while (num > 0);
+      entries_.push_back(std::move(entry));
+    }
+
+    hash_ = hash;
+    levels_.clear();
+
+    // Construct the Merkle tree hashes.
+    size_t level_size = entries_.size();
+    Level level0;
+    level0.reserve(level_size);
+    for (const Entry &entry : entries_) {
+      level0.push_back(HashLeaf(entry));
+    }
+    levels_.push_back(std::move(level0));
+    level_size /= 2;
+
+    for (; level_size > 0; level_size /= 2) {
+      Level level;
+      level.reserve(level_size);
+
+      const Level &prev_level = levels_.back();
+      for (size_t i = 0; i < level_size; ++i) {
+        level.push_back(HashNodes(prev_level2 * i, prev_level2 * i + 1));
+      }
+      levels_.push_back(std::move(level));
+    }
+  }
+
+  const Hash &GetEntryHash(uint64_t index) const {
+    return GetHashAtLevel(index, 0);
+  }
+
+  // Returns a bogus hash value that is the right length for the hash algorithm
+  // consisting of the given byte.
+  Hash GetBogusHash(uint8_t byte = 0xff) const {
+    return Hash(EVP_MD_size(hash_), byte);
+  }
+
+  Hash GetSubtreeHash(uint64_t subtree_start, uint64_t subtree_end) const {
+    Subtree subtree{subtree_start, subtree_end};
+    return GetSubtreeHash(subtree);
+  }
+
+  // Returns a subtree inclusion proof for entry `index` within the subtree
+  // `subtree_start`, `subtree_end`). The inclusion proof consists of the
+  // entry's "neighbor" at each level of the tree. The entry hash, together with
+  // the hashes of each element of the inclusion proof, must allow
+  // reconstruction of the subtree hash.
+  std::vector<Hash> GenerateSubtreeInclusionProof(uint64_t index,
+                                                  uint64_t subtree_start,
+                                                  uint64_t subtree_end) const {
+    Subtree subtree{subtree_start, subtree_end};
+    EXPECT_LE(subtree.start, index);
+    EXPECT_LE(index, subtree.end - 1);
+    std::vector<Hash> proof;
+    // `covered` tracks the subrange of `subtree` for which the in-progress
+    // inclusion proof includes sufficient information to reconstruct the hash.
+    Subtree covered{index, index + 1};
+
+    // Walk up the tree (from leaves to root), determine whether the entry
+    // is contained in the left or right child at that level, and collect the
+    // other one as the "neighbor".
+    uint64_t level_num = 0;
+    while (covered != subtree) {
+      bool is_right_child_of_parent = (covered.start >> level_num) % 2;
+      if (is_right_child_of_parent) {
+        // A left child that has a sibling to its right must be complete, so
+        // this left neighbor must be a complete subtree.
+        Subtree neighbor_left{
+            /*start=*/covered.start ^ (uint64_t{1} << level_num),
+            /*end=*/covered.start};
+        proof.emplace_back(GetSubtreeHash(neighbor_left));
+        covered.start = neighbor_left.start;
+      } else {
+        // A neighbor on the right may be a partial subtree on the right edge of
+        // `subtree` if not all of its would-be entries are present.
+        Subtree neighbor_right{/*start=*/covered.end,
+                               /*end=*/covered.end + covered.size()};
+        if (neighbor_right.end > subtree.end) {
+          neighbor_right.end = subtree.end;
+        }
+        // Omit the right neighbor if it's entirely empty.
+        if (neighbor_right.size() > 0) {
+          proof.emplace_back(GetSubtreeHash(neighbor_right));
+        }
+        covered.end = neighbor_right.end;
+      }
+      ++level_num;
+    }
+    return proof;
+  }
+
+  // Returns a subtree inclusion proof as a concatenated series of subtree
+  // hashes.
+  std::vector<uint8_t> GetSerializedSubtreeInclusionProof(
+      uint64_t index, uint64_t subtree_start, uint64_t subtree_end) const {
+    auto inclusion_proof =
+        GenerateSubtreeInclusionProof(index, subtree_start, subtree_end);
+    return ConcatenateHashes(inclusion_proof);
+  }
+
+  std::vector<uint8_t> ConcatenateHashes(
+      const std::vector<Hash> &hashes) const {
+    std::vector<uint8_t> ret;
+    ret.reserve(EVP_MD_size(hash_) * hashes.size());
+    for (const Hash &hash : hashes) {
+      ret.insert(ret.end(), hash.begin(), hash.end());
+    }
+    return ret;
+  }
+
+  void ExhaustivelyEvaluateInclusionProofs() const {
+    for (uint64_t end = 0; end < limit_; ++end) {
+      for (uint64_t start = 0; start < end + 1; ++start) {
+        if (!IsValidSubtree(start, end)) {
+          continue;
+        }
+        auto subtree_hash = GetSubtreeHash(start, end);
+        for (uint64_t index = start; index < end; ++index) {
+          SCOPED_TRACE("subtree: " + std::to_string(start) + ", " +
+                       std::to_string(end) +
+                       "), index: " + std::to_string(index));
+          std::vector<uint8_t> proof =
+              GetSerializedSubtreeInclusionProof(index, start, end);
+
+          std::vector<uint8_t> evaluated_subtree_hash;
+          evaluated_subtree_hash.resize(EVP_MD_size(hash_));
+          bool success = x509_evaluate_mtc_subtree_inclusion_proof(
+              Span(evaluated_subtree_hash), hash(), proof, index,
+              GetEntryHash(index), start, end);
+          EXPECT_TRUE(success);
+          EXPECT_EQ(Bytes(evaluated_subtree_hash), Bytes(subtree_hash));
+        }
+      }
+    }
+  }
+
+  uint64_t max_end_index() const {
+    return static_cast<uint64_t>(entries_.size());
+  }
+
+  const EVP_MD *hash() const { return hash_; }
+
+ private:
+  // This struct allows arbitrary `start` and `end` values that may not form a
+  // valid subtree; caller should ensure they are valid by construction if using
+  // as a subtree in further computations.
+  struct Subtree {
+    uint64_t start = 0u;
+    uint64_t end = 0u;
+
+    size_t size() const { return end - start; }
+
+    bool operator==(const Subtree &other) const {
+      return (start == other.start) && (end == other.end);
+    }
+    bool operator!=(const Subtree &other) const { return !(*this == other); }
+  };
+
+  static bool IsPow2(uint64_t n) { return CRYPTO_has_single_bit(n); }
+
+  // Returns a number containing the longest shared prefix in the binary
+  // representations of `a` and `b`, with all other less-significant bits
+  // zeroed.
+  static uint64_t LongestSharedBitPrefix(uint64_t a, uint64_t b) {
+    uint64_t suffix_bits = CRYPTO_bit_width(a ^ b);
+    if (suffix_bits == 64) {
+      return 0;
+    }
+    uint64_t mask = ~uint64_t{0} << suffix_bits;
+    return a & mask;
+  }
+
+  // Returns the nearest (aligned) subtree that completely contains the interval
+  // start, end). In other words, this finds the lowest common ancestor of
+  // `start` and `end - 1` in the original tree. The returned subtree may
+  // include additional elements before `start`.
+  static Subtree GetCoveringSubtree(uint64_t start, uint64_t end) {
+    return Subtree{LongestSharedBitPrefix(start, end - 1), end};
+  }
+
+  // Computes the hash for `subtree`, which may be a partial subtree with some
+  // levels skipped on the right edge.
+  Hash GetSubtreeHash(Subtree subtree) const {
+    if (subtree.size() == 0) {
+      return HashData({});
+    }
+    uint64_t level_num = 0;
+    uint64_t start = subtree.start;
+    uint64_t last = subtree.end - 1;
+    // Start at the largest complete subtree on the right edge.
+    while (start < last && (last & 1) == 1) {
+      ++level_num;
+      start >>= 1;
+      last >>= 1;
+    }
+    // As we iterate upwards along the right edge until we cover the whole
+    // desired subtree, `hash` is the subtree hash for last << level_num, end).
+    Hash hash = levels_level_numlast;
+    while (start < last) {
+      // Don't modify the hash if this level is skipped.
+      if (last & 1) {
+        hash = HashNodes(levels_level_numlast - 1, hash);
+      }
+      ++level_num;
+      start >>= 1;
+      last >>= 1;
+    }
+    return hash;
+  }
+
+  Hash HashData(std::initializer_list<Span<const uint8_t>> data) const {
+    Hash ret;
+    ret.resize(EVP_MD_size(hash_));
+    ScopedEVP_MD_CTX ctx;
+    EVP_DigestInit_ex(ctx.get(), hash_, nullptr);
+    for (const Span<const uint8_t> &piece : data) {
+      EVP_DigestUpdate(ctx.get(), piece.data(), piece.size());
+    }
+    EVP_DigestFinal_ex(ctx.get(), ret.data(), nullptr);
+    return ret;
+  }
+
+  Hash HashLeaf(Span<const uint8_t> leaf_data) const {
+    return HashData({std::vector<uint8_t>({0x00}), leaf_data});
+  }
+
+  Hash HashNodes(Span<const uint8_t> left_data,
+                 Span<const uint8_t> right_data) const {
+    return HashData({std::vector<uint8_t>({0x01}), left_data, right_data});
+  }
+
+  // Returns the hash containing the entry at `index` at the given level in the
+  // full Merkle tree.
+  const Hash &GetHashAtLevel(uint64_t index, uint64_t level_num) const {
+    const Level &level = levels_level_num;
+    return levelindex >> level_num;
+  }
+
+  const EVP_MD *hash_ = nullptr;
+  size_t limit_ = 0u;
+  // Entries (leaf nodes) for the test tree.
+  std::vector<Entry> entries_;
+  // Each element of `levels_` contains the Merkle tree hashes for nodes at a
+  // given level in the tree, counting from the bottom. `levels_0` contains
+  // all the leaf node hashes, `levels_1` contains half as many hashes each
+  // covering 2 leaf nodes, etc. In general, `levels_i` contains hashes each
+  // covering 2^i entries. Each `levels_ij` contains the hash value
+  // MTH(D (2^i) * j : (2^i) * (j+1) ), representing a subtree
+  //  (2^i) * j : (2^i) * (j+1) ) of size 2^i.
+  std::vector<Level> levels_;
+};
+
+// Helper to format bytes as hex.
+std::string ToHexStr(const std::vector<uint8_t> &bytes) {
+  std::stringstream hex;
+  hex << std::hex << std::setfill('0');
+  for (uint8_t b : bytes) {
+    hex << std::setw(2) << static_cast<int>(b);
+  }
+  return hex.str();
+}
+
+// This executes the "accumulated" Subtree Hashes test from appendix C.1 of
+// draft-ietf-plants-merkle-tree-certs. (This is more a test of the
+// X509MerkleTreeTest harness, to ensure that it is able to correctly test
+// the production code.)
+TEST_F(X509MerkleTreeTest, AccumulatedSubtreeHashes) {
+  ASSERT_NO_FATAL_FAILURE(InitTestMerkleTree(EVP_sha256(), 256));
+
+  ScopedEVP_MD_CTX ctx;
+  EVP_DigestInit_ex(ctx.get(), hash(), nullptr);
+
+  for (uint64_t end = 0; end < 131; ++end) {
+    for (uint64_t start = 0; start < end + 1; ++start) {
+      if (!IsValidSubtree(start, end)) {
+        continue;
+      }
+      std::stringstream ss;
+      ss << "" << std::to_string(start) << ", " << std::to_string(end) << ") "
+         << ToHexStr(GetSubtreeHash(start, end)) << "\n";
+      std::string str = ss.str();
+      EVP_DigestUpdate(ctx.get(), str.data(), str.size());
+    }
+  }
+  std::vector<uint8_t> final(EVP_MAX_MD_SIZE);
+  unsigned final_size;
+  EVP_DigestFinal_ex(ctx.get(), final.data(), &final_size);
+  final.resize(final_size);
+
+  const uint8_t kExpected = {
+      0xb8, 0x28, 0x06, 0xad, 0x42, 0x65, 0xbb, 0x15, 0x1c, 0x11, 0x19,
+      0xc0, 0xf4, 0xdb, 0x43, 0x7b, 0xb4, 0xd1, 0xa1, 0xf8, 0x87, 0xb3,
+      0xa7, 0xfb, 0xa1, 0xcd, 0x4e, 0xbf, 0x55, 0x2e, 0x3e, 0x81,
+  };
+  EXPECT_EQ(Bytes(final), Bytes(kExpected));
+}
+
+// This executes the "accumulated" Subtree Inclusion Proofs test from appendix
+// C.2 of draft-ietf-plants-merkle-tree-certs. (This is more a test of the
+// X509MerkleTreeTest harness, to ensure that it is able to correctly test
+// the production code.)
+TEST_F(X509MerkleTreeTest, AccumulatedSubtreeInclusionProofs) {
+  ASSERT_NO_FATAL_FAILURE(InitTestMerkleTree(EVP_sha256(), 256));
+
+  ScopedEVP_MD_CTX ctx;
+  EVP_DigestInit_ex(ctx.get(), hash(), nullptr);
+
+  for (uint64_t end = 0; end < 131; ++end) {
+    for (uint64_t start = 0; start < end + 1; ++start) {
+      if (!IsValidSubtree(start, end)) {
+        continue;
+      }
+      for (uint64_t index = start; index < end; ++index) {
+        std::stringstream ss;
+        ss << std::to_string(index) << " " << std::to_string(start) << ", "
+           << std::to_string(end) << ")";
+        for (const Hash &hash :
+             GenerateSubtreeInclusionProof(index, start, end)) {
+          ss << " " << ToHexStr(hash);
+        }
+        ss << "\n";
+        std::string str = ss.str();
+        EVP_DigestUpdate(ctx.get(), str.data(), str.size());
+      }
+    }
+  }
+  std::vector<uint8_t> final(EVP_MAX_MD_SIZE);
+  unsigned final_size;
+  EVP_DigestFinal_ex(ctx.get(), final.data(), &final_size);
+  final.resize(final_size);
+
+  const uint8_t kExpected = {
+      0xac, 0x2a, 0x8f, 0x98, 0x9e, 0x44, 0xd9, 0x9e, 0x39, 0x9d, 0xb4,
+      0x48, 0x05, 0x0f, 0xf5, 0xf1, 0x97, 0x57, 0xdf, 0x53, 0xcf, 0xb7,
+      0x16, 0xaa, 0x81, 0x01, 0x5d, 0x39, 0x55, 0xd8, 0x16, 0x3f,
+  };
+  EXPECT_EQ(Bytes(final), Bytes(kExpected));
+}
+
+TEST_F(X509MerkleTreeTest, EvaluateInclusionProof) {
+  ASSERT_NO_FATAL_FAILURE(InitTestMerkleTree(EVP_sha256(), 256));
+  ExhaustivelyEvaluateInclusionProofs();
+}
+
+TEST_F(X509MerkleTreeTest, EvaluateInclusionProofInvalidParams) {
+  const struct {
+    uint64_t index;
+    uint64_t start;
+    uint64_t end;
+  } kInvalidCases = {
+      // Start is greater than end.
+      {1, 1, 0},
+      // Subtree is misaligned.
+      {1, 1, 5},
+      // Subtree is misaligned. This tests the uint64_t overflow condition for
+      // valid subtrees that differ in the most significant bit.
+      // TODO(crbug.com/503746594): There should also be a test for the valid
+      // case (start = 0), but that would currently require initializing an
+      // overly large test Merkle Tree, so it is omitted.
+      {1, 1, ~uint64_t{0}},
+      // Index is not in range.
+      {0, 1, 2},
+      // Index is past-the-end.
+      {1, 1, 1},
+  };
+
+  Hash bogus = GetBogusHash();
+
+  std::vector<uint8_t> evaluated_subtree_hash;
+  evaluated_subtree_hash.resize(EVP_MD_size(hash()));
+  for (const auto &t : kInvalidCases) {
+    // Try every length of fake inclusion proof to make sure the call fails
+    // due to invalid params, rather than inclusion proof of the wrong length.
+    Hash fake_inclusion_proof;
+    for (size_t n = 0; n <= 64; ++n) {
+      EXPECT_FALSE(x509_evaluate_mtc_subtree_inclusion_proof(
+          Span(evaluated_subtree_hash), hash(), Span(fake_inclusion_proof),
+          t.index, GetEntryHash(t.index), t.start, t.end));
+      fake_inclusion_proof.insert(fake_inclusion_proof.end(), bogus.begin(),
+                                  bogus.end());
+    }
+  }
+}
+
+TEST_F(X509MerkleTreeTest, EvaluateInclusionProofBadOutputSize) {
+  uint64_t index = 1;
+  uint64_t start = 0;
+  uint64_t end = 3;
+
+  std::vector<uint8_t> evaluated_subtree_hash;
+  EXPECT_FALSE(x509_evaluate_mtc_subtree_inclusion_proof(
+      Span(evaluated_subtree_hash), hash(),
+      GetSerializedSubtreeInclusionProof(index, start, end), index,
+      GetEntryHash(index), start, end));
+
+  evaluated_subtree_hash.resize(EVP_MD_size(hash()) - 1);
+  EXPECT_FALSE(x509_evaluate_mtc_subtree_inclusion_proof(
+      Span(evaluated_subtree_hash), hash(),
+      GetSerializedSubtreeInclusionProof(index, start, end), index,
+      GetEntryHash(index), start, end));
+
+  evaluated_subtree_hash.resize(EVP_MD_size(hash()) + 1);
+  EXPECT_FALSE(x509_evaluate_mtc_subtree_inclusion_proof(
+      Span(evaluated_subtree_hash), hash(),
+      GetSerializedSubtreeInclusionProof(index, start, end), index,
+      GetEntryHash(index), start, end));
+}
+
+TEST_F(X509MerkleTreeTest, EvaluateInclusionProofBadEntryHashSize) {
+  uint64_t index = 1;
+  uint64_t start = 0;
+  uint64_t end = 3;
+
+  std::vector<uint8_t> evaluated_subtree_hash;
+  evaluated_subtree_hash.resize(EVP_MD_size(hash()));
+
+  Hash input = GetEntryHash(index);
+  input.push_back(0x12);
+
+  EXPECT_FALSE(x509_evaluate_mtc_subtree_inclusion_proof(
+      Span(evaluated_subtree_hash), hash(),
+      GetSerializedSubtreeInclusionProof(index, start, end), index, input,
+      start, end));
+
+  input.pop_back();
+  input.pop_back();
+  EXPECT_FALSE(x509_evaluate_mtc_subtree_inclusion_proof(
+      Span(evaluated_subtree_hash), hash(),
+      GetSerializedSubtreeInclusionProof(index, start, end), index, input,
+      start, end));
+}
+
+TEST_F(X509MerkleTreeTest, EvaluateInclusionProofWrong) {
+  // For entry 10 in a subtree 8, 13), the correct inclusion proof contains
+  // MTH({d11}), MTH(D8:10), and MTH({d12}).
+  const uint64_t index = 10;
+  const uint64_t subtree_start = 8;
+  const uint64_t subtree_end = 13;
+  const struct {
+    std::vector<uint8_t> proof;
+    Hash entry_hash;
+    // Whether the inclusion proof evaluation procedure should succeed.
+    bool should_succeed = false;
+    // Whether the result of inclusion proof evaluation should match the correct
+    // subtree hash.
+    bool should_match = false;
+  } kTestCases = {
+      {
+          // Correct proof.
+          ConcatenateHashes({GetSubtreeHash(11, 12), GetSubtreeHash(8, 10),
+                             GetSubtreeHash(12, 13)}),
+          GetEntryHash(index),
+          /*should_succeed=*/true,
+          /*should_match=*/true,
+      },
+      {
+          // Inclusion proof incorrectly includes the entry hash itself.
+          ConcatenateHashes({GetEntryHash(10), GetSubtreeHash(11, 12),
+                             GetSubtreeHash(8, 10), GetSubtreeHash(12, 13)}),
+          GetEntryHash(index),
+      },
+      {
+          // Inclusion proof incorrectly omits the final subtree hash covering
+          // the right edge.
+          ConcatenateHashes({GetSubtreeHash(11, 12), GetSubtreeHash(8, 10)}),
+          GetEntryHash(index),
+      },
+      {
+          // Inclusion proof incorrectly omits the level-0 hash.
+          ConcatenateHashes({GetSubtreeHash(8, 10), GetSubtreeHash(12, 13)}),
+          GetEntryHash(index),
+      },
+      {
+          // Inclusion proof incorrectly includes the level-1 hash for the entry
+          // instead of the neighboring level-0 hash.
+          ConcatenateHashes({GetSubtreeHash(10, 12), GetSubtreeHash(8, 10),
+                             GetSubtreeHash(12, 13)}),
+          GetEntryHash(index),
+          /*should_succeed=*/true,
+          /*should_match=*/false,
+      },
+      {
+          // Individual hash in the inclusion proof are corrupted.
+          ConcatenateHashes({GetBogusHash(0x01), GetSubtreeHash(8, 10),
+                             GetSubtreeHash(12, 13)}),
+          GetEntryHash(index),
+          /*should_succeed=*/true,
+          /*should_match=*/false,
+      },
+      {
+          // Individual hash in the inclusion proof are corrupted.
+          ConcatenateHashes(
+              {GetBogusHash(0x01), GetSubtreeHash(8, 10), GetBogusHash(0x02)}),
+          GetEntryHash(index),
+          /*should_succeed=*/true,
+          /*should_match=*/false,
+      },
+      {
+          // Incorrect entry hash.
+          ConcatenateHashes({GetSubtreeHash(11, 12), GetSubtreeHash(8, 10),
+                             GetSubtreeHash(12, 13)}),
+          GetBogusHash(),
+          /*should_succeed=*/true,
+          /*should_match=*/false,
+      },
+      {
+          // Inclusion proof includes an extra hash.
+          ConcatenateHashes({GetSubtreeHash(11, 12), GetSubtreeHash(8, 10),
+                             GetSubtreeHash(12, 13), GetSubtreeHash(12, 13)}),
+          GetEntryHash(index),
+      },
+      {
+          // Inclusion proof contains trailing data.
+          ConcatenateHashes({GetSubtreeHash(11, 12),
+                             GetSubtreeHash(8, 10),
+                             GetSubtreeHash(12, 13),
+                             {0x01, 0x02}}),
+          GetEntryHash(index),
+      },
+      {
+          // Inclusion proof is truncated.
+          (std::vector<uint8_t> v) -> std::vector<uint8_t> {
+            v.pop_back();
+            return v;
+          }(ConcatenateHashes({GetSubtreeHash(11, 12), GetSubtreeHash(8, 10),
+                                     GetSubtreeHash(12, 13)})),
+          GetEntryHash(index),
+      },
+  };
+  for (size_t i = 0; i < std::size(kTestCases); ++i) {
+    SCOPED_TRACE(i);
+    const auto &t = kTestCasesi;
+    std::vector<uint8_t> evaluated_subtree_hash;
+    evaluated_subtree_hash.resize(EVP_MD_size(hash()));
+    bool success = x509_evaluate_mtc_subtree_inclusion_proof(
+        Span(evaluated_subtree_hash), hash(), t.proof, index, t.entry_hash,
+        subtree_start, subtree_end);
+    EXPECT_EQ(success, t.should_succeed);
+    if (success) {
+      if (t.should_match) {
+        EXPECT_EQ(Bytes(evaluated_subtree_hash),
+                  Bytes(GetSubtreeHash(subtree_start, subtree_end)));
+      } else {
+        EXPECT_NE(Bytes(evaluated_subtree_hash),
+                  Bytes(GetSubtreeHash(subtree_start, subtree_end)));
+      }
+    }
+  }
+}
+
+TEST_F(X509MerkleTreeTest, EvaluateInclusionProofLarge) {
+  ASSERT_NO_FATAL_FAILURE(InitTestMerkleTree(EVP_sha256(), uint64_t{1 << 16}));
+  const uint64_t subtree_start = 0;
+  const uint64_t subtree_end = max_end_index();
+  auto subtree_hash = GetSubtreeHash(subtree_start, subtree_end);
+  const uint64_t nums = {0, 1, max_end_index() / 2};
+  for (uint64_t num : nums) {
+    for (uint64_t index : {num, max_end_index() - 1 - num}) {
+      SCOPED_TRACE(index);
+      std::vector<uint8_t> proof =
+          GetSerializedSubtreeInclusionProof(index, subtree_start, subtree_end);
+
+      std::vector<uint8_t> evaluated_subtree_hash;
+      evaluated_subtree_hash.resize(EVP_MD_size(hash()));
+      bool success = x509_evaluate_mtc_subtree_inclusion_proof(
+          Span(evaluated_subtree_hash), hash(), proof, index,
+          GetEntryHash(index), subtree_start, subtree_end);
+      ASSERT_TRUE(success);
+      EXPECT_EQ(Bytes(evaluated_subtree_hash), Bytes(subtree_hash));
+    }
+  }
+}
+
+TEST_F(X509MerkleTreeTest, EvaluateInclusionProofDifferentHash) {
+  InitTestMerkleTree(EVP_sha384(), 256);
+  ExhaustivelyEvaluateInclusionProofs();
+}
+
+#endif  // !defined (BORINGSSL_SHARED_LIBRARY)
+
 }  // namespace
 BSSL_NAMESPACE_END

boringssl-0.20260708.tar.xz/decrepit/cfb/cfb.cc -> boringssl-0.20260813.tar.xz/decrepit/cfb/cfb.cc Changed

boringssl-0.20260708.tar.xz/decrepit/xts/xts.cc -> boringssl-0.20260813.tar.xz/decrepit/xts/xts.cc Changed

boringssl-0.20260708.tar.xz/docs/tls_named_groups.md -> boringssl-0.20260813.tar.xz/docs/tls_named_groups.md Changed

boringssl-0.20260708.tar.xz/gen/bcm/aes-gcm-avx2-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/aes-gcm-avx2-x86_64-apple.S Changed

@@ -9,26 +9,26 @@
 .p2align	4
 aes_gcm_avx2_constants:
 
-
+// A shuffle mask that reflects the bytes of 16-byte blocks
 L$bswap_mask:
 .quad	0x08090a0b0c0d0e0f, 0x0001020304050607
 
-
-
-
-
-
-
-
+// This is the GHASH reducing polynomial without its constant term, i.e.
+// x^128 + x^7 + x^2 + x, represented using the backwards mapping
+// between bits and polynomial coefficients.
+// 
+// Alternatively, it can be interpreted as the naturally-ordered
+// representation of the polynomial x^127 + x^126 + x^121 + 1, i.e. the
+// "reversed" GHASH reducing polynomial without its x^128 term.
 L$gfpoly:
 .quad	1, 0xc200000000000000
 
-
+// Same as above, but with the (1 << 64) bit set.
 L$gfpoly_and_internal_carrybit:
 .quad	1, 0xc200000000000001
 
 .p2align	5
-
+// The below constants are used for incrementing the counter blocks.
 L$ctr_pattern:
 .quad	0, 0
 .quad	1, 0
@@ -48,14 +48,14 @@
 
 
 
-
-
+// Load the byte-reflected hash subkey.  BoringSSL provides it in
+// byte-reflected form except the two halves are in the wrong order.
 	vpshufd	$0x4e,(%rsi),%xmm3
 
-
-
-
-
+// Finish preprocessing the byte-reflected hash subkey by multiplying it by
+// x^-1 ("standard" interpretation of polynomial coefficients) or
+// equivalently x^1 (natural interpretation).  This gets the key into a
+// format that avoids having to bit-reflect the data blocks later.
 	vpshufd	$0xd3,%xmm3,%xmm0
 	vpsrad	$31,%xmm0,%xmm0
 	vpaddq	%xmm3,%xmm3,%xmm3
@@ -64,83 +64,83 @@
 
 	vbroadcasti128	L$gfpoly(%rip),%ymm6
 
-
-	vpclmulqdq	$0x00,%xmm3,%xmm3,%xmm0
-	vpclmulqdq	$0x11,%xmm3,%xmm3,%xmm5
-	vpclmulqdq	$0x01,%xmm0,%xmm6,%xmm1
-	vpshufd	$0x4e,%xmm0,%xmm0
-	vpxor	%xmm0,%xmm1,%xmm1
-	vpclmulqdq	$0x01,%xmm1,%xmm6,%xmm0
-	vpshufd	$0x4e,%xmm1,%xmm1
-	vpxor	%xmm1,%xmm5,%xmm5
-	vpxor	%xmm0,%xmm5,%xmm5
-
+// Square H^1 to get H^2.
+	vpclmulqdq	$0x00,%xmm3,%xmm3,%xmm0  // LO = a_L * a_L
+	vpclmulqdq	$0x11,%xmm3,%xmm3,%xmm5  // HI = a_H * a_H
+	vpclmulqdq	$0x01,%xmm0,%xmm6,%xmm1  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm0,%xmm0  // Swap halves of LO
+	vpxor	%xmm0,%xmm1,%xmm1  // Fold LO into MI
+	vpclmulqdq	$0x01,%xmm1,%xmm6,%xmm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm1,%xmm1  // Swap halves of MI
+	vpxor	%xmm1,%xmm5,%xmm5  // Fold MI into HI (part 1)
+	vpxor	%xmm0,%xmm5,%xmm5  // Fold MI into HI (part 2)
 
 
+// Create H_CUR = H^2, H^1 and H_INC = H^2, H^2.
 	vinserti128	$1,%xmm3,%ymm5,%ymm3
 	vinserti128	$1,%xmm5,%ymm5,%ymm5
 
-
-	vpclmulqdq	$0x00,%ymm5,%ymm3,%ymm0
-	vpclmulqdq	$0x01,%ymm5,%ymm3,%ymm1
-	vpclmulqdq	$0x10,%ymm5,%ymm3,%ymm2
-	vpxor	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x01,%ymm0,%ymm6,%ymm2
-	vpshufd	$0x4e,%ymm0,%ymm0
-	vpxor	%ymm0,%ymm1,%ymm1
-	vpxor	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x11,%ymm5,%ymm3,%ymm4
-	vpclmulqdq	$0x01,%ymm1,%ymm6,%ymm0
-	vpshufd	$0x4e,%ymm1,%ymm1
-	vpxor	%ymm1,%ymm4,%ymm4
-	vpxor	%ymm0,%ymm4,%ymm4
-
-
-
+// Compute H_CUR2 = H^4, H^3.
+	vpclmulqdq	$0x00,%ymm5,%ymm3,%ymm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%ymm5,%ymm3,%ymm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%ymm5,%ymm3,%ymm2  // MI_1 = a_H * b_L
+	vpxor	%ymm2,%ymm1,%ymm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%ymm0,%ymm6,%ymm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm0,%ymm0  // Swap halves of LO
+	vpxor	%ymm0,%ymm1,%ymm1  // Fold LO into MI (part 1)
+	vpxor	%ymm2,%ymm1,%ymm1  // Fold LO into MI (part 2)
+	vpclmulqdq	$0x11,%ymm5,%ymm3,%ymm4  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%ymm1,%ymm6,%ymm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm1,%ymm1  // Swap halves of MI
+	vpxor	%ymm1,%ymm4,%ymm4  // Fold MI into HI (part 1)
+	vpxor	%ymm0,%ymm4,%ymm4  // Fold MI into HI (part 2)
+
+
+// Store H^2, H^1 and H^4, H^3.
 	vmovdqu	%ymm3,96(%rdi)
 	vmovdqu	%ymm4,64(%rdi)
 
-
-
+// For Karatsuba multiplication: compute and store the two 64-bit halves of
+// each key power XOR'd together.  Order is 4,2,3,1.
 	vpunpcklqdq	%ymm3,%ymm4,%ymm0
 	vpunpckhqdq	%ymm3,%ymm4,%ymm1
 	vpxor	%ymm1,%ymm0,%ymm0
 	vmovdqu	%ymm0,128+32(%rdi)
 
-
-	vpclmulqdq	$0x00,%ymm5,%ymm4,%ymm0
-	vpclmulqdq	$0x01,%ymm5,%ymm4,%ymm1
-	vpclmulqdq	$0x10,%ymm5,%ymm4,%ymm2
-	vpxor	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x01,%ymm0,%ymm6,%ymm2
-	vpshufd	$0x4e,%ymm0,%ymm0
-	vpxor	%ymm0,%ymm1,%ymm1
-	vpxor	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x11,%ymm5,%ymm4,%ymm3
-	vpclmulqdq	$0x01,%ymm1,%ymm6,%ymm0
-	vpshufd	$0x4e,%ymm1,%ymm1
-	vpxor	%ymm1,%ymm3,%ymm3
-	vpxor	%ymm0,%ymm3,%ymm3
-
-	vpclmulqdq	$0x00,%ymm5,%ymm3,%ymm0
-	vpclmulqdq	$0x01,%ymm5,%ymm3,%ymm1
-	vpclmulqdq	$0x10,%ymm5,%ymm3,%ymm2
-	vpxor	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x01,%ymm0,%ymm6,%ymm2
-	vpshufd	$0x4e,%ymm0,%ymm0
-	vpxor	%ymm0,%ymm1,%ymm1
-	vpxor	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x11,%ymm5,%ymm3,%ymm4
-	vpclmulqdq	$0x01,%ymm1,%ymm6,%ymm0
-	vpshufd	$0x4e,%ymm1,%ymm1
-	vpxor	%ymm1,%ymm4,%ymm4
-	vpxor	%ymm0,%ymm4,%ymm4
+// Compute and store H_CUR = H^6, H^5 and H_CUR2 = H^8, H^7.
+	vpclmulqdq	$0x00,%ymm5,%ymm4,%ymm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%ymm5,%ymm4,%ymm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%ymm5,%ymm4,%ymm2  // MI_1 = a_H * b_L
+	vpxor	%ymm2,%ymm1,%ymm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%ymm0,%ymm6,%ymm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm0,%ymm0  // Swap halves of LO
+	vpxor	%ymm0,%ymm1,%ymm1  // Fold LO into MI (part 1)
+	vpxor	%ymm2,%ymm1,%ymm1  // Fold LO into MI (part 2)
+	vpclmulqdq	$0x11,%ymm5,%ymm4,%ymm3  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%ymm1,%ymm6,%ymm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm1,%ymm1  // Swap halves of MI
+	vpxor	%ymm1,%ymm3,%ymm3  // Fold MI into HI (part 1)
+	vpxor	%ymm0,%ymm3,%ymm3  // Fold MI into HI (part 2)
+
+	vpclmulqdq	$0x00,%ymm5,%ymm3,%ymm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%ymm5,%ymm3,%ymm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%ymm5,%ymm3,%ymm2  // MI_1 = a_H * b_L
+	vpxor	%ymm2,%ymm1,%ymm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%ymm0,%ymm6,%ymm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm0,%ymm0  // Swap halves of LO
+	vpxor	%ymm0,%ymm1,%ymm1  // Fold LO into MI (part 1)
+	vpxor	%ymm2,%ymm1,%ymm1  // Fold LO into MI (part 2)
+	vpclmulqdq	$0x11,%ymm5,%ymm3,%ymm4  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%ymm1,%ymm6,%ymm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm1,%ymm1  // Swap halves of MI
+	vpxor	%ymm1,%ymm4,%ymm4  // Fold MI into HI (part 1)
+	vpxor	%ymm0,%ymm4,%ymm4  // Fold MI into HI (part 2)
 
 	vmovdqu	%ymm3,32(%rdi)
 	vmovdqu	%ymm4,0(%rdi)
 
-
-
+// Again, compute and store the two 64-bit halves of each key power XOR'd
+// together.  Order is 8,6,7,5.
 	vpunpcklqdq	%ymm3,%ymm4,%ymm0
 	vpunpckhqdq	%ymm3,%ymm4,%ymm1
 	vpxor	%ymm1,%ymm0,%ymm0
@@ -169,25 +169,25 @@
 	vmovdqu	L$gfpoly(%rip),%xmm3
 	vpshufb	%xmm1,%xmm0,%xmm0
 
-	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm4
-	vpclmulqdq	$0x01,%xmm2,%xmm0,%xmm5
-	vpclmulqdq	$0x10,%xmm2,%xmm0,%xmm6
-	vpxor	%xmm6,%xmm5,%xmm5
-	vpclmulqdq	$0x01,%xmm4,%xmm3,%xmm6
-	vpshufd	$0x4e,%xmm4,%xmm4
-	vpxor	%xmm4,%xmm5,%xmm5
-	vpxor	%xmm6,%xmm5,%xmm5
-	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm0
-	vpclmulqdq	$0x01,%xmm5,%xmm3,%xmm4
-	vpshufd	$0x4e,%xmm5,%xmm5
-	vpxor	%xmm5,%xmm0,%xmm0
-	vpxor	%xmm4,%xmm0,%xmm0
+	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm4  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%xmm2,%xmm0,%xmm5  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%xmm2,%xmm0,%xmm6  // MI_1 = a_H * b_L
+	vpxor	%xmm6,%xmm5,%xmm5  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%xmm4,%xmm3,%xmm6  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm4,%xmm4  // Swap halves of LO
+	vpxor	%xmm4,%xmm5,%xmm5  // Fold LO into MI (part 1)
+	vpxor	%xmm6,%xmm5,%xmm5  // Fold LO into MI (part 2)
+	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm0  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%xmm5,%xmm3,%xmm4  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm5,%xmm5  // Swap halves of MI
+	vpxor	%xmm5,%xmm0,%xmm0  // Fold MI into HI (part 1)
+	vpxor	%xmm4,%xmm0,%xmm0  // Fold MI into HI (part 2)
 
 
 	vpshufb	%xmm1,%xmm0,%xmm0
 	vmovdqu	%xmm0,(%rdi)
 
-
+// No need for vzeroupper, since only xmm registers were used.
 	ret
 
 
@@ -204,33 +204,33 @@
 
 
 
-
-
-
+// Load the bswap_mask and gfpoly constants.  Since AADLEN is usually small,
+// usually only 128-bit vectors will be used.  So as an optimization, don't
+// broadcast these constants to both 128-bit lanes quite yet.
 	vmovdqu	L$bswap_mask(%rip),%xmm6
 	vmovdqu	L$gfpoly(%rip),%xmm7
 
-
+// Load the GHASH accumulator.
 	vmovdqu	(%rdi),%xmm5
 	vpshufb	%xmm6,%xmm5,%xmm5
 
-
+// Optimize for AADLEN < 32 by checking for AADLEN < 32 before AADLEN < 128.
 	cmpq	$32,%rcx
 	jb	L$ghash_lastblock
 
-
-
+// AADLEN >= 32, so we'll operate on full vectors.  Broadcast bswap_mask and
+// gfpoly to both 128-bit lanes.
 	vinserti128	$1,%xmm6,%ymm6,%ymm6
 	vinserti128	$1,%xmm7,%ymm7,%ymm7
 
 	cmpq	$127,%rcx
 	jbe	L$ghash_loop_1x
 
-
+// Update GHASH with 128 bytes of AAD at a time.
 	vmovdqu	128(%rsi),%ymm8
 	vmovdqu	128+32(%rsi),%ymm9
 L$ghash_loop_4x:
-
+// First vector
 	vmovdqu	0(%rdx),%ymm1
 	vpshufb	%ymm6,%ymm1,%ymm1
 	vmovdqu	0(%rsi),%ymm2
@@ -240,7 +240,7 @@
 	vpunpckhqdq	%ymm1,%ymm1,%ymm0
 	vpxor	%ymm1,%ymm0,%ymm0
 	vpclmulqdq	$0x00,%ymm8,%ymm0,%ymm4
-
+// Second vector
 	vmovdqu	32(%rdx),%ymm1
 	vpshufb	%ymm6,%ymm1,%ymm1
 	vmovdqu	32(%rsi),%ymm2
@@ -252,7 +252,7 @@
 	vpxor	%ymm1,%ymm0,%ymm0
 	vpclmulqdq	$0x10,%ymm8,%ymm0,%ymm0
 	vpxor	%ymm0,%ymm4,%ymm4
-
+// Third vector
 	vmovdqu	64(%rdx),%ymm1
 	vpshufb	%ymm6,%ymm1,%ymm1
 	vmovdqu	64(%rsi),%ymm2
@@ -265,7 +265,7 @@
 	vpclmulqdq	$0x00,%ymm9,%ymm0,%ymm0
 	vpxor	%ymm0,%ymm4,%ymm4
 
-
+// Fourth vector
 	vmovdqu	96(%rdx),%ymm1
 	vpshufb	%ymm6,%ymm1,%ymm1
 	vmovdqu	96(%rsi),%ymm2
@@ -277,17 +277,17 @@
 	vpxor	%ymm1,%ymm0,%ymm0
 	vpclmulqdq	$0x10,%ymm9,%ymm0,%ymm0
 	vpxor	%ymm0,%ymm4,%ymm4
-
+// Finalize 'mi' following Karatsuba multiplication.
 	vpxor	%ymm3,%ymm4,%ymm4
 	vpxor	%ymm5,%ymm4,%ymm4
 
-
+// Fold lo into mi.
 	vbroadcasti128	L$gfpoly(%rip),%ymm2
 	vpclmulqdq	$0x01,%ymm3,%ymm2,%ymm0
 	vpshufd	$0x4e,%ymm3,%ymm3
 	vpxor	%ymm3,%ymm4,%ymm4
 	vpxor	%ymm0,%ymm4,%ymm4
-
+// Fold mi into hi.
 	vpclmulqdq	$0x01,%ymm4,%ymm2,%ymm0
 	vpshufd	$0x4e,%ymm4,%ymm4
 	vpxor	%ymm4,%ymm5,%ymm5
@@ -295,12 +295,12 @@
 	vextracti128	$1,%ymm5,%xmm0
 	vpxor	%xmm0,%xmm5,%xmm5
 
-	subq	$-128,%rdx
+	subq	$-128,%rdx  // 128 is 4 bytes, -128 is 1 byte
 	addq	$-128,%rcx
 	cmpq	$127,%rcx
 	ja	L$ghash_loop_4x
 
-
+// Update GHASH with 32 bytes of AAD at a time.
 	cmpq	$32,%rcx
 	jb	L$ghash_loop_1x_done
 L$ghash_loop_1x:
@@ -308,19 +308,19 @@
 	vpshufb	%ymm6,%ymm0,%ymm0
 	vpxor	%ymm0,%ymm5,%ymm5
 	vmovdqu	128-32(%rsi),%ymm0
-	vpclmulqdq	$0x00,%ymm0,%ymm5,%ymm1
-	vpclmulqdq	$0x01,%ymm0,%ymm5,%ymm2
-	vpclmulqdq	$0x10,%ymm0,%ymm5,%ymm3
-	vpxor	%ymm3,%ymm2,%ymm2
-	vpclmulqdq	$0x01,%ymm1,%ymm7,%ymm3
-	vpshufd	$0x4e,%ymm1,%ymm1
-	vpxor	%ymm1,%ymm2,%ymm2
-	vpxor	%ymm3,%ymm2,%ymm2
-	vpclmulqdq	$0x11,%ymm0,%ymm5,%ymm5
-	vpclmulqdq	$0x01,%ymm2,%ymm7,%ymm1
-	vpshufd	$0x4e,%ymm2,%ymm2
-	vpxor	%ymm2,%ymm5,%ymm5
-	vpxor	%ymm1,%ymm5,%ymm5
+	vpclmulqdq	$0x00,%ymm0,%ymm5,%ymm1  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%ymm0,%ymm5,%ymm2  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%ymm0,%ymm5,%ymm3  // MI_1 = a_H * b_L
+	vpxor	%ymm3,%ymm2,%ymm2  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%ymm1,%ymm7,%ymm3  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm1,%ymm1  // Swap halves of LO
+	vpxor	%ymm1,%ymm2,%ymm2  // Fold LO into MI (part 1)
+	vpxor	%ymm3,%ymm2,%ymm2  // Fold LO into MI (part 2)
+	vpclmulqdq	$0x11,%ymm0,%ymm5,%ymm5  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%ymm2,%ymm7,%ymm1  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm2,%ymm2  // Swap halves of MI
+	vpxor	%ymm2,%ymm5,%ymm5  // Fold MI into HI (part 1)
+	vpxor	%ymm1,%ymm5,%ymm5  // Fold MI into HI (part 2)
 
 	vextracti128	$1,%ymm5,%xmm0
 	vpxor	%xmm0,%xmm5,%xmm5
@@ -330,7 +330,7 @@
 	jae	L$ghash_loop_1x
 L$ghash_loop_1x_done:
 
-
+// Update GHASH with the remaining 16-byte block if any.
 L$ghash_lastblock:
 	testq	%rcx,%rcx
 	jz	L$ghash_done
@@ -338,23 +338,23 @@
 	vpshufb	%xmm6,%xmm0,%xmm0
 	vpxor	%xmm0,%xmm5,%xmm5
 	vmovdqu	128-16(%rsi),%xmm0
-	vpclmulqdq	$0x00,%xmm0,%xmm5,%xmm1
-	vpclmulqdq	$0x01,%xmm0,%xmm5,%xmm2
-	vpclmulqdq	$0x10,%xmm0,%xmm5,%xmm3
-	vpxor	%xmm3,%xmm2,%xmm2
-	vpclmulqdq	$0x01,%xmm1,%xmm7,%xmm3
-	vpshufd	$0x4e,%xmm1,%xmm1
-	vpxor	%xmm1,%xmm2,%xmm2
-	vpxor	%xmm3,%xmm2,%xmm2
-	vpclmulqdq	$0x11,%xmm0,%xmm5,%xmm5
-	vpclmulqdq	$0x01,%xmm2,%xmm7,%xmm1
-	vpshufd	$0x4e,%xmm2,%xmm2
-	vpxor	%xmm2,%xmm5,%xmm5
-	vpxor	%xmm1,%xmm5,%xmm5
+	vpclmulqdq	$0x00,%xmm0,%xmm5,%xmm1  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%xmm0,%xmm5,%xmm2  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%xmm0,%xmm5,%xmm3  // MI_1 = a_H * b_L
+	vpxor	%xmm3,%xmm2,%xmm2  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%xmm1,%xmm7,%xmm3  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm1,%xmm1  // Swap halves of LO
+	vpxor	%xmm1,%xmm2,%xmm2  // Fold LO into MI (part 1)
+	vpxor	%xmm3,%xmm2,%xmm2  // Fold LO into MI (part 2)
+	vpclmulqdq	$0x11,%xmm0,%xmm5,%xmm5  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%xmm2,%xmm7,%xmm1  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm2,%xmm2  // Swap halves of MI
+	vpxor	%xmm2,%xmm5,%xmm5  // Fold MI into HI (part 1)
+	vpxor	%xmm1,%xmm5,%xmm5  // Fold MI into HI (part 2)
 
 
 L$ghash_done:
-
+// Store the updated GHASH accumulator back to memory.
 	vpshufb	%xmm6,%xmm5,%xmm5
 	vmovdqu	%xmm5,(%rdi)
 
@@ -375,45 +375,45 @@
 	pushq	%r12
 
 
-	movq	16(%rsp),%r12
+	movq	16(%rsp),%r12  // arg7
 #ifdef BORINGSSL_DISPATCH_TEST
 
 	movb	$1,_BORINGSSL_function_hit+6(%rip)
 #endif
 	vbroadcasti128	L$bswap_mask(%rip),%ymm0
 
-
-
+// Load the GHASH accumulator and the starting counter.
+// BoringSSL passes these values in big endian format.
 	vmovdqu	(%r12),%xmm1
 	vpshufb	%xmm0,%xmm1,%xmm1
 	vbroadcasti128	(%r8),%ymm11
 	vpshufb	%ymm0,%ymm11,%ymm11
 
-
-
+// Load the AES key length in bytes.  BoringSSL stores number of rounds
+// minus 1, so convert using: AESKEYLEN = 4 * aeskey->rounds - 20.
 	movl	240(%rcx),%r10d
 	leal	-20(,%r10,4),%r10d
 
-
-
-
+// Make RNDKEYLAST_PTR point to the last AES round key.  This is the
+// round key with index 10, 12, or 14 for AES-128, AES-192, or AES-256
+// respectively.  Then load the zero-th and last round keys.
 	leaq	96(%rcx,%r10,4),%r11
 	vbroadcasti128	(%rcx),%ymm9
 	vbroadcasti128	(%r11),%ymm10
 
-
+// Finish initializing LE_CTR by adding 1 to the second block.
 	vpaddd	L$ctr_pattern(%rip),%ymm11,%ymm11
 
-
-
+// If there are at least 128 bytes of data, then continue into the loop that
+// processes 128 bytes of data at a time.  Otherwise skip it.
 	cmpq	$127,%rdx
 	jbe	L$crypt_loop_4x_done__func1
 
 	vmovdqu	128(%r9),%ymm7
 	vmovdqu	128+32(%r9),%ymm8
-
-
-
+// Encrypt the first 4 vectors of plaintext blocks.
+// Increment le_ctr four times to generate four vectors of little-endian
+// counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vmovdqu	L$inc_2blocks(%rip),%ymm2
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	%ymm2,%ymm11,%ymm11
@@ -424,7 +424,7 @@
 	vpshufb	%ymm0,%ymm11,%ymm15
 	vpaddd	%ymm2,%ymm11,%ymm11
 
-
+// AES "round zero": XOR in the zero-th round key.
 	vpxor	%ymm9,%ymm12,%ymm12
 	vpxor	%ymm9,%ymm13,%ymm13
 	vpxor	%ymm9,%ymm14,%ymm14
@@ -454,16 +454,16 @@
 	vmovdqu	%ymm14,64(%rsi)
 	vmovdqu	%ymm15,96(%rsi)
 
-	subq	$-128,%rdi
+	subq	$-128,%rdi  // 128 is 4 bytes, -128 is 1 byte
 	addq	$-128,%rdx
 	cmpq	$127,%rdx
 	jbe	L$ghash_last_ciphertext_4x__func1
 .p2align	4
 L$crypt_loop_4x__func1:
 
-
-
-
+// Start the AES encryption of the counter blocks.
+// Increment le_ctr four times to generate four vectors of little-endian
+// counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vmovdqu	L$inc_2blocks(%rip),%ymm2
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	%ymm2,%ymm11,%ymm11
@@ -474,7 +474,7 @@
 	vpshufb	%ymm0,%ymm11,%ymm15
 	vpaddd	%ymm2,%ymm11,%ymm11
 
-
+// AES "round zero": XOR in the zero-th round key.
 	vpxor	%ymm9,%ymm12,%ymm12
 	vpxor	%ymm9,%ymm13,%ymm13
 	vpxor	%ymm9,%ymm14,%ymm14
@@ -483,7 +483,7 @@
 	cmpl	$24,%r10d
 	jl	L$aes128__func1
 	je	L$aes192__func1
-
+// AES-256
 	vbroadcasti128	-208(%r11),%ymm2
 	vaesenc	%ymm2,%ymm12,%ymm12
 	vaesenc	%ymm2,%ymm13,%ymm13
@@ -512,7 +512,7 @@
 L$aes128__func1:
 	prefetcht0	512(%rdi)
 	prefetcht0	512+64(%rdi)
-
+// First vector
 	vmovdqu	0(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	0(%r9),%ymm4
@@ -536,7 +536,7 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Second vector
 	vmovdqu	32(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	32(%r9),%ymm4
@@ -555,7 +555,7 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Third vector
 	vmovdqu	64(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	64(%r9),%ymm4
@@ -582,7 +582,7 @@
 	vpclmulqdq	$0x00,%ymm8,%ymm2,%ymm2
 	vpxor	%ymm2,%ymm6,%ymm6
 
-
+// Fourth vector
 	vmovdqu	96(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 
@@ -608,11 +608,11 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Finalize 'mi' following Karatsuba multiplication.
 	vpxor	%ymm5,%ymm6,%ymm6
 	vpxor	%ymm1,%ymm6,%ymm6
 
-
+// Fold lo into mi.
 	vbroadcasti128	L$gfpoly(%rip),%ymm4
 	vpclmulqdq	$0x01,%ymm5,%ymm4,%ymm2
 	vpshufd	$0x4e,%ymm5,%ymm5
@@ -625,7 +625,7 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Fold mi into hi.
 	vpclmulqdq	$0x01,%ymm6,%ymm4,%ymm2
 	vpshufd	$0x4e,%ymm6,%ymm6
 	vpxor	%ymm6,%ymm1,%ymm1
@@ -641,7 +641,7 @@
 	vpxor	%xmm2,%xmm1,%xmm1
 
 
-	subq	$-128,%rsi
+	subq	$-128,%rsi  // 128 is 4 bytes, -128 is 1 byte
 	vpxor	0(%rdi),%ymm10,%ymm2
 	vpxor	32(%rdi),%ymm10,%ymm3
 	vpxor	64(%rdi),%ymm10,%ymm5
@@ -661,7 +661,7 @@
 	cmpq	$127,%rdx
 	ja	L$crypt_loop_4x__func1
 L$ghash_last_ciphertext_4x__func1:
-
+// First vector
 	vmovdqu	0(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	0(%r9),%ymm4
@@ -671,7 +671,7 @@
 	vpunpckhqdq	%ymm3,%ymm3,%ymm2
 	vpxor	%ymm3,%ymm2,%ymm2
 	vpclmulqdq	$0x00,%ymm7,%ymm2,%ymm6
-
+// Second vector
 	vmovdqu	32(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	32(%r9),%ymm4
@@ -683,7 +683,7 @@
 	vpxor	%ymm3,%ymm2,%ymm2
 	vpclmulqdq	$0x10,%ymm7,%ymm2,%ymm2
 	vpxor	%ymm2,%ymm6,%ymm6
-
+// Third vector
 	vmovdqu	64(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	64(%r9),%ymm4
@@ -696,7 +696,7 @@
 	vpclmulqdq	$0x00,%ymm8,%ymm2,%ymm2
 	vpxor	%ymm2,%ymm6,%ymm6
 
-
+// Fourth vector
 	vmovdqu	96(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	96(%r9),%ymm4
@@ -708,17 +708,17 @@
 	vpxor	%ymm3,%ymm2,%ymm2
 	vpclmulqdq	$0x10,%ymm8,%ymm2,%ymm2
 	vpxor	%ymm2,%ymm6,%ymm6
-
+// Finalize 'mi' following Karatsuba multiplication.
 	vpxor	%ymm5,%ymm6,%ymm6
 	vpxor	%ymm1,%ymm6,%ymm6
 
-
+// Fold lo into mi.
 	vbroadcasti128	L$gfpoly(%rip),%ymm4
 	vpclmulqdq	$0x01,%ymm5,%ymm4,%ymm2
 	vpshufd	$0x4e,%ymm5,%ymm5
 	vpxor	%ymm5,%ymm6,%ymm6
 	vpxor	%ymm2,%ymm6,%ymm6
-
+// Fold mi into hi.
 	vpclmulqdq	$0x01,%ymm6,%ymm4,%ymm2
 	vpshufd	$0x4e,%ymm6,%ymm6
 	vpxor	%ymm6,%ymm1,%ymm1
@@ -728,18 +728,18 @@
 
 	subq	$-128,%rsi
 L$crypt_loop_4x_done__func1:
-
+// Check whether any data remains.
 	testq	%rdx,%rdx
 	jz	L$done__func1
 
+// DATALEN is in 16, 32, 48, 64, 80, 96, 112.
 
-
-
-
+// Make POWERS_PTR point to the key powers H^N, H^(N-1), ... where N
+// is the number of blocks that remain.
 	leaq	128(%r9),%r8
 	subq	%rdx,%r8
 
-
+// Start collecting the unreduced GHASH intermediate value LO, MI, HI.
 	vpxor	%xmm5,%xmm5,%xmm5
 	vpxor	%xmm6,%xmm6,%xmm6
 	vpxor	%xmm7,%xmm7,%xmm7
@@ -747,7 +747,7 @@
 	cmpq	$64,%rdx
 	jb	L$lessthan64bytes__func1
 
-
+// DATALEN is in 64, 80, 96, 112.  Encrypt two vectors of counter blocks.
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	L$inc_2blocks(%rip),%ymm11,%ymm11
 	vpshufb	%ymm0,%ymm11,%ymm13
@@ -765,7 +765,7 @@
 	vaesenclast	%ymm10,%ymm12,%ymm12
 	vaesenclast	%ymm10,%ymm13,%ymm13
 
-
+// XOR the data with the two vectors of keystream blocks.
 	vmovdqu	0(%rdi),%ymm2
 	vmovdqu	32(%rdi),%ymm3
 	vpxor	%ymm2,%ymm12,%ymm12
@@ -773,7 +773,7 @@
 	vmovdqu	%ymm12,0(%rsi)
 	vmovdqu	%ymm13,32(%rsi)
 
-
+// Update GHASH with two vectors of ciphertext blocks, without reducing.
 	vpshufb	%ymm0,%ymm12,%ymm12
 	vpshufb	%ymm0,%ymm13,%ymm13
 	vpxor	%ymm1,%ymm12,%ymm12
@@ -801,7 +801,7 @@
 
 	vpxor	%xmm1,%xmm1,%xmm1
 
-
+// DATALEN is in 16, 32, 48.  Encrypt two last vectors of counter blocks.
 L$lessthan64bytes__func1:
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	L$inc_2blocks(%rip),%ymm11,%ymm11
@@ -819,8 +819,8 @@
 	vaesenclast	%ymm10,%ymm12,%ymm12
 	vaesenclast	%ymm10,%ymm13,%ymm13
 
-
-
+// XOR the remaining data with the keystream blocks, and update GHASH with
+// the remaining ciphertext blocks without reducing.
 
 	cmpq	$32,%rdx
 	jb	L$xor_one_block__func1
@@ -877,7 +877,7 @@
 	vpxor	%ymm4,%ymm7,%ymm7
 
 L$reduce__func1:
-
+// Finally, do the GHASH reduction.
 	vbroadcasti128	L$gfpoly(%rip),%ymm2
 	vpclmulqdq	$0x01,%ymm5,%ymm2,%ymm3
 	vpshufd	$0x4e,%ymm5,%ymm5
@@ -891,7 +891,7 @@
 	vpxor	%xmm7,%xmm1,%xmm1
 
 L$done__func1:
-
+// Store the updated GHASH accumulator back to memory.
 	vpshufb	%xmm0,%xmm1,%xmm1
 	vmovdqu	%xmm1,(%r12)
 
@@ -914,33 +914,33 @@
 	pushq	%r12
 
 
-	movq	16(%rsp),%r12
+	movq	16(%rsp),%r12  // arg7
 	vbroadcasti128	L$bswap_mask(%rip),%ymm0
 
-
-
+// Load the GHASH accumulator and the starting counter.
+// BoringSSL passes these values in big endian format.
 	vmovdqu	(%r12),%xmm1
 	vpshufb	%xmm0,%xmm1,%xmm1
 	vbroadcasti128	(%r8),%ymm11
 	vpshufb	%ymm0,%ymm11,%ymm11
 
-
-
+// Load the AES key length in bytes.  BoringSSL stores number of rounds
+// minus 1, so convert using: AESKEYLEN = 4 * aeskey->rounds - 20.
 	movl	240(%rcx),%r10d
 	leal	-20(,%r10,4),%r10d
 
-
-
-
+// Make RNDKEYLAST_PTR point to the last AES round key.  This is the
+// round key with index 10, 12, or 14 for AES-128, AES-192, or AES-256
+// respectively.  Then load the zero-th and last round keys.
 	leaq	96(%rcx,%r10,4),%r11
 	vbroadcasti128	(%rcx),%ymm9
 	vbroadcasti128	(%r11),%ymm10
 
-
+// Finish initializing LE_CTR by adding 1 to the second block.
 	vpaddd	L$ctr_pattern(%rip),%ymm11,%ymm11
 
-
-
+// If there are at least 128 bytes of data, then continue into the loop that
+// processes 128 bytes of data at a time.  Otherwise skip it.
 	cmpq	$127,%rdx
 	jbe	L$crypt_loop_4x_done__func2
 
@@ -949,9 +949,9 @@
 .p2align	4
 L$crypt_loop_4x__func2:
 
-
-
-
+// Start the AES encryption of the counter blocks.
+// Increment le_ctr four times to generate four vectors of little-endian
+// counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vmovdqu	L$inc_2blocks(%rip),%ymm2
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	%ymm2,%ymm11,%ymm11
@@ -962,7 +962,7 @@
 	vpshufb	%ymm0,%ymm11,%ymm15
 	vpaddd	%ymm2,%ymm11,%ymm11
 
-
+// AES "round zero": XOR in the zero-th round key.
 	vpxor	%ymm9,%ymm12,%ymm12
 	vpxor	%ymm9,%ymm13,%ymm13
 	vpxor	%ymm9,%ymm14,%ymm14
@@ -971,7 +971,7 @@
 	cmpl	$24,%r10d
 	jl	L$aes128__func2
 	je	L$aes192__func2
-
+// AES-256
 	vbroadcasti128	-208(%r11),%ymm2
 	vaesenc	%ymm2,%ymm12,%ymm12
 	vaesenc	%ymm2,%ymm13,%ymm13
@@ -1000,7 +1000,7 @@
 L$aes128__func2:
 	prefetcht0	512(%rdi)
 	prefetcht0	512+64(%rdi)
-
+// First vector
 	vmovdqu	0(%rdi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	0(%r9),%ymm4
@@ -1024,7 +1024,7 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Second vector
 	vmovdqu	32(%rdi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	32(%r9),%ymm4
@@ -1043,7 +1043,7 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Third vector
 	vmovdqu	64(%rdi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	64(%r9),%ymm4
@@ -1070,7 +1070,7 @@
 	vpclmulqdq	$0x00,%ymm8,%ymm2,%ymm2
 	vpxor	%ymm2,%ymm6,%ymm6
 
-
+// Fourth vector
 	vmovdqu	96(%rdi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 
@@ -1096,11 +1096,11 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Finalize 'mi' following Karatsuba multiplication.
 	vpxor	%ymm5,%ymm6,%ymm6
 	vpxor	%ymm1,%ymm6,%ymm6
 
-
+// Fold lo into mi.
 	vbroadcasti128	L$gfpoly(%rip),%ymm4
 	vpclmulqdq	$0x01,%ymm5,%ymm4,%ymm2
 	vpshufd	$0x4e,%ymm5,%ymm5
@@ -1113,7 +1113,7 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Fold mi into hi.
 	vpclmulqdq	$0x01,%ymm6,%ymm4,%ymm2
 	vpshufd	$0x4e,%ymm6,%ymm6
 	vpxor	%ymm6,%ymm1,%ymm1
@@ -1129,7 +1129,7 @@
 	vpxor	%xmm2,%xmm1,%xmm1
 
 
-
+// 128 is 4 bytes, -128 is 1 byte
 	vpxor	0(%rdi),%ymm10,%ymm2
 	vpxor	32(%rdi),%ymm10,%ymm3
 	vpxor	64(%rdi),%ymm10,%ymm5
@@ -1149,18 +1149,18 @@
 	cmpq	$127,%rdx
 	ja	L$crypt_loop_4x__func2
 L$crypt_loop_4x_done__func2:
-
+// Check whether any data remains.
 	testq	%rdx,%rdx
 	jz	L$done__func2
 
+// DATALEN is in 16, 32, 48, 64, 80, 96, 112.
 
-
-
-
+// Make POWERS_PTR point to the key powers H^N, H^(N-1), ... where N
+// is the number of blocks that remain.
 	leaq	128(%r9),%r8
 	subq	%rdx,%r8
 
-
+// Start collecting the unreduced GHASH intermediate value LO, MI, HI.
 	vpxor	%xmm5,%xmm5,%xmm5
 	vpxor	%xmm6,%xmm6,%xmm6
 	vpxor	%xmm7,%xmm7,%xmm7
@@ -1168,7 +1168,7 @@
 	cmpq	$64,%rdx
 	jb	L$lessthan64bytes__func2
 
-
+// DATALEN is in 64, 80, 96, 112.  Encrypt two vectors of counter blocks.
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	L$inc_2blocks(%rip),%ymm11,%ymm11
 	vpshufb	%ymm0,%ymm11,%ymm13
@@ -1186,7 +1186,7 @@
 	vaesenclast	%ymm10,%ymm12,%ymm12
 	vaesenclast	%ymm10,%ymm13,%ymm13
 
-
+// XOR the data with the two vectors of keystream blocks.
 	vmovdqu	0(%rdi),%ymm2
 	vmovdqu	32(%rdi),%ymm3
 	vpxor	%ymm2,%ymm12,%ymm12
@@ -1194,7 +1194,7 @@
 	vmovdqu	%ymm12,0(%rsi)
 	vmovdqu	%ymm13,32(%rsi)
 
-
+// Update GHASH with two vectors of ciphertext blocks, without reducing.
 	vpshufb	%ymm0,%ymm2,%ymm12
 	vpshufb	%ymm0,%ymm3,%ymm13
 	vpxor	%ymm1,%ymm12,%ymm12
@@ -1222,7 +1222,7 @@
 
 	vpxor	%xmm1,%xmm1,%xmm1
 
-
+// DATALEN is in 16, 32, 48.  Encrypt two last vectors of counter blocks.
 L$lessthan64bytes__func2:
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	L$inc_2blocks(%rip),%ymm11,%ymm11
@@ -1240,8 +1240,8 @@
 	vaesenclast	%ymm10,%ymm12,%ymm12
 	vaesenclast	%ymm10,%ymm13,%ymm13
 
-
-
+// XOR the remaining data with the keystream blocks, and update GHASH with
+// the remaining ciphertext blocks without reducing.
 
 	cmpq	$32,%rdx
 	jb	L$xor_one_block__func2
@@ -1298,7 +1298,7 @@
 	vpxor	%ymm4,%ymm7,%ymm7
 
 L$reduce__func2:
-
+// Finally, do the GHASH reduction.
 	vbroadcasti128	L$gfpoly(%rip),%ymm2
 	vpclmulqdq	$0x01,%ymm5,%ymm2,%ymm3
 	vpshufd	$0x4e,%ymm5,%ymm5
@@ -1312,7 +1312,7 @@
 	vpxor	%xmm7,%xmm1,%xmm1
 
 L$done__func2:
-
+// Store the updated GHASH accumulator back to memory.
 	vpshufb	%xmm0,%xmm1,%xmm1
 	vmovdqu	%xmm1,(%r12)

boringssl-0.20260708.tar.xz/gen/bcm/aes-gcm-avx2-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/aes-gcm-avx2-x86_64-linux.S Changed

@@ -9,26 +9,26 @@
 .align	16
 aes_gcm_avx2_constants:
 
-
+// A shuffle mask that reflects the bytes of 16-byte blocks
 .Lbswap_mask:
 .quad	0x08090a0b0c0d0e0f, 0x0001020304050607
 
-
-
-
-
-
-
-
+// This is the GHASH reducing polynomial without its constant term, i.e.
+// x^128 + x^7 + x^2 + x, represented using the backwards mapping
+// between bits and polynomial coefficients.
+// 
+// Alternatively, it can be interpreted as the naturally-ordered
+// representation of the polynomial x^127 + x^126 + x^121 + 1, i.e. the
+// "reversed" GHASH reducing polynomial without its x^128 term.
 .Lgfpoly:
 .quad	1, 0xc200000000000000
 
-
+// Same as above, but with the (1 << 64) bit set.
 .Lgfpoly_and_internal_carrybit:
 .quad	1, 0xc200000000000001
 
 .align	32
-
+// The below constants are used for incrementing the counter blocks.
 .Lctr_pattern:
 .quad	0, 0
 .quad	1, 0
@@ -48,14 +48,14 @@
 
 
 
-
-
+// Load the byte-reflected hash subkey.  BoringSSL provides it in
+// byte-reflected form except the two halves are in the wrong order.
 	vpshufd	$0x4e,(%rsi),%xmm3
 
-
-
-
-
+// Finish preprocessing the byte-reflected hash subkey by multiplying it by
+// x^-1 ("standard" interpretation of polynomial coefficients) or
+// equivalently x^1 (natural interpretation).  This gets the key into a
+// format that avoids having to bit-reflect the data blocks later.
 	vpshufd	$0xd3,%xmm3,%xmm0
 	vpsrad	$31,%xmm0,%xmm0
 	vpaddq	%xmm3,%xmm3,%xmm3
@@ -64,83 +64,83 @@
 
 	vbroadcasti128	.Lgfpoly(%rip),%ymm6
 
-
-	vpclmulqdq	$0x00,%xmm3,%xmm3,%xmm0
-	vpclmulqdq	$0x11,%xmm3,%xmm3,%xmm5
-	vpclmulqdq	$0x01,%xmm0,%xmm6,%xmm1
-	vpshufd	$0x4e,%xmm0,%xmm0
-	vpxor	%xmm0,%xmm1,%xmm1
-	vpclmulqdq	$0x01,%xmm1,%xmm6,%xmm0
-	vpshufd	$0x4e,%xmm1,%xmm1
-	vpxor	%xmm1,%xmm5,%xmm5
-	vpxor	%xmm0,%xmm5,%xmm5
-
+// Square H^1 to get H^2.
+	vpclmulqdq	$0x00,%xmm3,%xmm3,%xmm0  // LO = a_L * a_L
+	vpclmulqdq	$0x11,%xmm3,%xmm3,%xmm5  // HI = a_H * a_H
+	vpclmulqdq	$0x01,%xmm0,%xmm6,%xmm1  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm0,%xmm0  // Swap halves of LO
+	vpxor	%xmm0,%xmm1,%xmm1  // Fold LO into MI
+	vpclmulqdq	$0x01,%xmm1,%xmm6,%xmm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm1,%xmm1  // Swap halves of MI
+	vpxor	%xmm1,%xmm5,%xmm5  // Fold MI into HI (part 1)
+	vpxor	%xmm0,%xmm5,%xmm5  // Fold MI into HI (part 2)
 
 
+// Create H_CUR = H^2, H^1 and H_INC = H^2, H^2.
 	vinserti128	$1,%xmm3,%ymm5,%ymm3
 	vinserti128	$1,%xmm5,%ymm5,%ymm5
 
-
-	vpclmulqdq	$0x00,%ymm5,%ymm3,%ymm0
-	vpclmulqdq	$0x01,%ymm5,%ymm3,%ymm1
-	vpclmulqdq	$0x10,%ymm5,%ymm3,%ymm2
-	vpxor	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x01,%ymm0,%ymm6,%ymm2
-	vpshufd	$0x4e,%ymm0,%ymm0
-	vpxor	%ymm0,%ymm1,%ymm1
-	vpxor	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x11,%ymm5,%ymm3,%ymm4
-	vpclmulqdq	$0x01,%ymm1,%ymm6,%ymm0
-	vpshufd	$0x4e,%ymm1,%ymm1
-	vpxor	%ymm1,%ymm4,%ymm4
-	vpxor	%ymm0,%ymm4,%ymm4
-
-
-
+// Compute H_CUR2 = H^4, H^3.
+	vpclmulqdq	$0x00,%ymm5,%ymm3,%ymm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%ymm5,%ymm3,%ymm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%ymm5,%ymm3,%ymm2  // MI_1 = a_H * b_L
+	vpxor	%ymm2,%ymm1,%ymm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%ymm0,%ymm6,%ymm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm0,%ymm0  // Swap halves of LO
+	vpxor	%ymm0,%ymm1,%ymm1  // Fold LO into MI (part 1)
+	vpxor	%ymm2,%ymm1,%ymm1  // Fold LO into MI (part 2)
+	vpclmulqdq	$0x11,%ymm5,%ymm3,%ymm4  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%ymm1,%ymm6,%ymm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm1,%ymm1  // Swap halves of MI
+	vpxor	%ymm1,%ymm4,%ymm4  // Fold MI into HI (part 1)
+	vpxor	%ymm0,%ymm4,%ymm4  // Fold MI into HI (part 2)
+
+
+// Store H^2, H^1 and H^4, H^3.
 	vmovdqu	%ymm3,96(%rdi)
 	vmovdqu	%ymm4,64(%rdi)
 
-
-
+// For Karatsuba multiplication: compute and store the two 64-bit halves of
+// each key power XOR'd together.  Order is 4,2,3,1.
 	vpunpcklqdq	%ymm3,%ymm4,%ymm0
 	vpunpckhqdq	%ymm3,%ymm4,%ymm1
 	vpxor	%ymm1,%ymm0,%ymm0
 	vmovdqu	%ymm0,128+32(%rdi)
 
-
-	vpclmulqdq	$0x00,%ymm5,%ymm4,%ymm0
-	vpclmulqdq	$0x01,%ymm5,%ymm4,%ymm1
-	vpclmulqdq	$0x10,%ymm5,%ymm4,%ymm2
-	vpxor	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x01,%ymm0,%ymm6,%ymm2
-	vpshufd	$0x4e,%ymm0,%ymm0
-	vpxor	%ymm0,%ymm1,%ymm1
-	vpxor	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x11,%ymm5,%ymm4,%ymm3
-	vpclmulqdq	$0x01,%ymm1,%ymm6,%ymm0
-	vpshufd	$0x4e,%ymm1,%ymm1
-	vpxor	%ymm1,%ymm3,%ymm3
-	vpxor	%ymm0,%ymm3,%ymm3
-
-	vpclmulqdq	$0x00,%ymm5,%ymm3,%ymm0
-	vpclmulqdq	$0x01,%ymm5,%ymm3,%ymm1
-	vpclmulqdq	$0x10,%ymm5,%ymm3,%ymm2
-	vpxor	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x01,%ymm0,%ymm6,%ymm2
-	vpshufd	$0x4e,%ymm0,%ymm0
-	vpxor	%ymm0,%ymm1,%ymm1
-	vpxor	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x11,%ymm5,%ymm3,%ymm4
-	vpclmulqdq	$0x01,%ymm1,%ymm6,%ymm0
-	vpshufd	$0x4e,%ymm1,%ymm1
-	vpxor	%ymm1,%ymm4,%ymm4
-	vpxor	%ymm0,%ymm4,%ymm4
+// Compute and store H_CUR = H^6, H^5 and H_CUR2 = H^8, H^7.
+	vpclmulqdq	$0x00,%ymm5,%ymm4,%ymm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%ymm5,%ymm4,%ymm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%ymm5,%ymm4,%ymm2  // MI_1 = a_H * b_L
+	vpxor	%ymm2,%ymm1,%ymm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%ymm0,%ymm6,%ymm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm0,%ymm0  // Swap halves of LO
+	vpxor	%ymm0,%ymm1,%ymm1  // Fold LO into MI (part 1)
+	vpxor	%ymm2,%ymm1,%ymm1  // Fold LO into MI (part 2)
+	vpclmulqdq	$0x11,%ymm5,%ymm4,%ymm3  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%ymm1,%ymm6,%ymm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm1,%ymm1  // Swap halves of MI
+	vpxor	%ymm1,%ymm3,%ymm3  // Fold MI into HI (part 1)
+	vpxor	%ymm0,%ymm3,%ymm3  // Fold MI into HI (part 2)
+
+	vpclmulqdq	$0x00,%ymm5,%ymm3,%ymm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%ymm5,%ymm3,%ymm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%ymm5,%ymm3,%ymm2  // MI_1 = a_H * b_L
+	vpxor	%ymm2,%ymm1,%ymm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%ymm0,%ymm6,%ymm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm0,%ymm0  // Swap halves of LO
+	vpxor	%ymm0,%ymm1,%ymm1  // Fold LO into MI (part 1)
+	vpxor	%ymm2,%ymm1,%ymm1  // Fold LO into MI (part 2)
+	vpclmulqdq	$0x11,%ymm5,%ymm3,%ymm4  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%ymm1,%ymm6,%ymm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm1,%ymm1  // Swap halves of MI
+	vpxor	%ymm1,%ymm4,%ymm4  // Fold MI into HI (part 1)
+	vpxor	%ymm0,%ymm4,%ymm4  // Fold MI into HI (part 2)
 
 	vmovdqu	%ymm3,32(%rdi)
 	vmovdqu	%ymm4,0(%rdi)
 
-
-
+// Again, compute and store the two 64-bit halves of each key power XOR'd
+// together.  Order is 8,6,7,5.
 	vpunpcklqdq	%ymm3,%ymm4,%ymm0
 	vpunpckhqdq	%ymm3,%ymm4,%ymm1
 	vpxor	%ymm1,%ymm0,%ymm0
@@ -168,25 +168,25 @@
 	vmovdqu	.Lgfpoly(%rip),%xmm3
 	vpshufb	%xmm1,%xmm0,%xmm0
 
-	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm4
-	vpclmulqdq	$0x01,%xmm2,%xmm0,%xmm5
-	vpclmulqdq	$0x10,%xmm2,%xmm0,%xmm6
-	vpxor	%xmm6,%xmm5,%xmm5
-	vpclmulqdq	$0x01,%xmm4,%xmm3,%xmm6
-	vpshufd	$0x4e,%xmm4,%xmm4
-	vpxor	%xmm4,%xmm5,%xmm5
-	vpxor	%xmm6,%xmm5,%xmm5
-	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm0
-	vpclmulqdq	$0x01,%xmm5,%xmm3,%xmm4
-	vpshufd	$0x4e,%xmm5,%xmm5
-	vpxor	%xmm5,%xmm0,%xmm0
-	vpxor	%xmm4,%xmm0,%xmm0
+	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm4  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%xmm2,%xmm0,%xmm5  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%xmm2,%xmm0,%xmm6  // MI_1 = a_H * b_L
+	vpxor	%xmm6,%xmm5,%xmm5  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%xmm4,%xmm3,%xmm6  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm4,%xmm4  // Swap halves of LO
+	vpxor	%xmm4,%xmm5,%xmm5  // Fold LO into MI (part 1)
+	vpxor	%xmm6,%xmm5,%xmm5  // Fold LO into MI (part 2)
+	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm0  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%xmm5,%xmm3,%xmm4  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm5,%xmm5  // Swap halves of MI
+	vpxor	%xmm5,%xmm0,%xmm0  // Fold MI into HI (part 1)
+	vpxor	%xmm4,%xmm0,%xmm0  // Fold MI into HI (part 2)
 
 
 	vpshufb	%xmm1,%xmm0,%xmm0
 	vmovdqu	%xmm0,(%rdi)
 
-
+// No need for vzeroupper, since only xmm registers were used.
 	ret
 
 .cfi_endproc	
@@ -202,33 +202,33 @@
 
 
 
-
-
-
+// Load the bswap_mask and gfpoly constants.  Since AADLEN is usually small,
+// usually only 128-bit vectors will be used.  So as an optimization, don't
+// broadcast these constants to both 128-bit lanes quite yet.
 	vmovdqu	.Lbswap_mask(%rip),%xmm6
 	vmovdqu	.Lgfpoly(%rip),%xmm7
 
-
+// Load the GHASH accumulator.
 	vmovdqu	(%rdi),%xmm5
 	vpshufb	%xmm6,%xmm5,%xmm5
 
-
+// Optimize for AADLEN < 32 by checking for AADLEN < 32 before AADLEN < 128.
 	cmpq	$32,%rcx
 	jb	.Lghash_lastblock
 
-
-
+// AADLEN >= 32, so we'll operate on full vectors.  Broadcast bswap_mask and
+// gfpoly to both 128-bit lanes.
 	vinserti128	$1,%xmm6,%ymm6,%ymm6
 	vinserti128	$1,%xmm7,%ymm7,%ymm7
 
 	cmpq	$127,%rcx
 	jbe	.Lghash_loop_1x
 
-
+// Update GHASH with 128 bytes of AAD at a time.
 	vmovdqu	128(%rsi),%ymm8
 	vmovdqu	128+32(%rsi),%ymm9
 .Lghash_loop_4x:
-
+// First vector
 	vmovdqu	0(%rdx),%ymm1
 	vpshufb	%ymm6,%ymm1,%ymm1
 	vmovdqu	0(%rsi),%ymm2
@@ -238,7 +238,7 @@
 	vpunpckhqdq	%ymm1,%ymm1,%ymm0
 	vpxor	%ymm1,%ymm0,%ymm0
 	vpclmulqdq	$0x00,%ymm8,%ymm0,%ymm4
-
+// Second vector
 	vmovdqu	32(%rdx),%ymm1
 	vpshufb	%ymm6,%ymm1,%ymm1
 	vmovdqu	32(%rsi),%ymm2
@@ -250,7 +250,7 @@
 	vpxor	%ymm1,%ymm0,%ymm0
 	vpclmulqdq	$0x10,%ymm8,%ymm0,%ymm0
 	vpxor	%ymm0,%ymm4,%ymm4
-
+// Third vector
 	vmovdqu	64(%rdx),%ymm1
 	vpshufb	%ymm6,%ymm1,%ymm1
 	vmovdqu	64(%rsi),%ymm2
@@ -263,7 +263,7 @@
 	vpclmulqdq	$0x00,%ymm9,%ymm0,%ymm0
 	vpxor	%ymm0,%ymm4,%ymm4
 
-
+// Fourth vector
 	vmovdqu	96(%rdx),%ymm1
 	vpshufb	%ymm6,%ymm1,%ymm1
 	vmovdqu	96(%rsi),%ymm2
@@ -275,17 +275,17 @@
 	vpxor	%ymm1,%ymm0,%ymm0
 	vpclmulqdq	$0x10,%ymm9,%ymm0,%ymm0
 	vpxor	%ymm0,%ymm4,%ymm4
-
+// Finalize 'mi' following Karatsuba multiplication.
 	vpxor	%ymm3,%ymm4,%ymm4
 	vpxor	%ymm5,%ymm4,%ymm4
 
-
+// Fold lo into mi.
 	vbroadcasti128	.Lgfpoly(%rip),%ymm2
 	vpclmulqdq	$0x01,%ymm3,%ymm2,%ymm0
 	vpshufd	$0x4e,%ymm3,%ymm3
 	vpxor	%ymm3,%ymm4,%ymm4
 	vpxor	%ymm0,%ymm4,%ymm4
-
+// Fold mi into hi.
 	vpclmulqdq	$0x01,%ymm4,%ymm2,%ymm0
 	vpshufd	$0x4e,%ymm4,%ymm4
 	vpxor	%ymm4,%ymm5,%ymm5
@@ -293,12 +293,12 @@
 	vextracti128	$1,%ymm5,%xmm0
 	vpxor	%xmm0,%xmm5,%xmm5
 
-	subq	$-128,%rdx
+	subq	$-128,%rdx  // 128 is 4 bytes, -128 is 1 byte
 	addq	$-128,%rcx
 	cmpq	$127,%rcx
 	ja	.Lghash_loop_4x
 
-
+// Update GHASH with 32 bytes of AAD at a time.
 	cmpq	$32,%rcx
 	jb	.Lghash_loop_1x_done
 .Lghash_loop_1x:
@@ -306,19 +306,19 @@
 	vpshufb	%ymm6,%ymm0,%ymm0
 	vpxor	%ymm0,%ymm5,%ymm5
 	vmovdqu	128-32(%rsi),%ymm0
-	vpclmulqdq	$0x00,%ymm0,%ymm5,%ymm1
-	vpclmulqdq	$0x01,%ymm0,%ymm5,%ymm2
-	vpclmulqdq	$0x10,%ymm0,%ymm5,%ymm3
-	vpxor	%ymm3,%ymm2,%ymm2
-	vpclmulqdq	$0x01,%ymm1,%ymm7,%ymm3
-	vpshufd	$0x4e,%ymm1,%ymm1
-	vpxor	%ymm1,%ymm2,%ymm2
-	vpxor	%ymm3,%ymm2,%ymm2
-	vpclmulqdq	$0x11,%ymm0,%ymm5,%ymm5
-	vpclmulqdq	$0x01,%ymm2,%ymm7,%ymm1
-	vpshufd	$0x4e,%ymm2,%ymm2
-	vpxor	%ymm2,%ymm5,%ymm5
-	vpxor	%ymm1,%ymm5,%ymm5
+	vpclmulqdq	$0x00,%ymm0,%ymm5,%ymm1  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%ymm0,%ymm5,%ymm2  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%ymm0,%ymm5,%ymm3  // MI_1 = a_H * b_L
+	vpxor	%ymm3,%ymm2,%ymm2  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%ymm1,%ymm7,%ymm3  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm1,%ymm1  // Swap halves of LO
+	vpxor	%ymm1,%ymm2,%ymm2  // Fold LO into MI (part 1)
+	vpxor	%ymm3,%ymm2,%ymm2  // Fold LO into MI (part 2)
+	vpclmulqdq	$0x11,%ymm0,%ymm5,%ymm5  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%ymm2,%ymm7,%ymm1  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm2,%ymm2  // Swap halves of MI
+	vpxor	%ymm2,%ymm5,%ymm5  // Fold MI into HI (part 1)
+	vpxor	%ymm1,%ymm5,%ymm5  // Fold MI into HI (part 2)
 
 	vextracti128	$1,%ymm5,%xmm0
 	vpxor	%xmm0,%xmm5,%xmm5
@@ -328,7 +328,7 @@
 	jae	.Lghash_loop_1x
 .Lghash_loop_1x_done:
 
-
+// Update GHASH with the remaining 16-byte block if any.
 .Lghash_lastblock:
 	testq	%rcx,%rcx
 	jz	.Lghash_done
@@ -336,23 +336,23 @@
 	vpshufb	%xmm6,%xmm0,%xmm0
 	vpxor	%xmm0,%xmm5,%xmm5
 	vmovdqu	128-16(%rsi),%xmm0
-	vpclmulqdq	$0x00,%xmm0,%xmm5,%xmm1
-	vpclmulqdq	$0x01,%xmm0,%xmm5,%xmm2
-	vpclmulqdq	$0x10,%xmm0,%xmm5,%xmm3
-	vpxor	%xmm3,%xmm2,%xmm2
-	vpclmulqdq	$0x01,%xmm1,%xmm7,%xmm3
-	vpshufd	$0x4e,%xmm1,%xmm1
-	vpxor	%xmm1,%xmm2,%xmm2
-	vpxor	%xmm3,%xmm2,%xmm2
-	vpclmulqdq	$0x11,%xmm0,%xmm5,%xmm5
-	vpclmulqdq	$0x01,%xmm2,%xmm7,%xmm1
-	vpshufd	$0x4e,%xmm2,%xmm2
-	vpxor	%xmm2,%xmm5,%xmm5
-	vpxor	%xmm1,%xmm5,%xmm5
+	vpclmulqdq	$0x00,%xmm0,%xmm5,%xmm1  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%xmm0,%xmm5,%xmm2  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%xmm0,%xmm5,%xmm3  // MI_1 = a_H * b_L
+	vpxor	%xmm3,%xmm2,%xmm2  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%xmm1,%xmm7,%xmm3  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm1,%xmm1  // Swap halves of LO
+	vpxor	%xmm1,%xmm2,%xmm2  // Fold LO into MI (part 1)
+	vpxor	%xmm3,%xmm2,%xmm2  // Fold LO into MI (part 2)
+	vpclmulqdq	$0x11,%xmm0,%xmm5,%xmm5  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%xmm2,%xmm7,%xmm1  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm2,%xmm2  // Swap halves of MI
+	vpxor	%xmm2,%xmm5,%xmm5  // Fold MI into HI (part 1)
+	vpxor	%xmm1,%xmm5,%xmm5  // Fold MI into HI (part 2)
 
 
 .Lghash_done:
-
+// Store the updated GHASH accumulator back to memory.
 	vpshufb	%xmm6,%xmm5,%xmm5
 	vmovdqu	%xmm5,(%rdi)
 
@@ -373,7 +373,7 @@
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r12,-16
 
-	movq	16(%rsp),%r12
+	movq	16(%rsp),%r12  // arg7
 #ifdef BORINGSSL_DISPATCH_TEST
 .extern	BORINGSSL_function_hit
 .hidden BORINGSSL_function_hit
@@ -381,38 +381,38 @@
 #endif
 	vbroadcasti128	.Lbswap_mask(%rip),%ymm0
 
-
-
+// Load the GHASH accumulator and the starting counter.
+// BoringSSL passes these values in big endian format.
 	vmovdqu	(%r12),%xmm1
 	vpshufb	%xmm0,%xmm1,%xmm1
 	vbroadcasti128	(%r8),%ymm11
 	vpshufb	%ymm0,%ymm11,%ymm11
 
-
-
+// Load the AES key length in bytes.  BoringSSL stores number of rounds
+// minus 1, so convert using: AESKEYLEN = 4 * aeskey->rounds - 20.
 	movl	240(%rcx),%r10d
 	leal	-20(,%r10,4),%r10d
 
-
-
-
+// Make RNDKEYLAST_PTR point to the last AES round key.  This is the
+// round key with index 10, 12, or 14 for AES-128, AES-192, or AES-256
+// respectively.  Then load the zero-th and last round keys.
 	leaq	96(%rcx,%r10,4),%r11
 	vbroadcasti128	(%rcx),%ymm9
 	vbroadcasti128	(%r11),%ymm10
 
-
+// Finish initializing LE_CTR by adding 1 to the second block.
 	vpaddd	.Lctr_pattern(%rip),%ymm11,%ymm11
 
-
-
+// If there are at least 128 bytes of data, then continue into the loop that
+// processes 128 bytes of data at a time.  Otherwise skip it.
 	cmpq	$127,%rdx
 	jbe	.Lcrypt_loop_4x_done__func1
 
 	vmovdqu	128(%r9),%ymm7
 	vmovdqu	128+32(%r9),%ymm8
-
-
-
+// Encrypt the first 4 vectors of plaintext blocks.
+// Increment le_ctr four times to generate four vectors of little-endian
+// counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vmovdqu	.Linc_2blocks(%rip),%ymm2
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	%ymm2,%ymm11,%ymm11
@@ -423,7 +423,7 @@
 	vpshufb	%ymm0,%ymm11,%ymm15
 	vpaddd	%ymm2,%ymm11,%ymm11
 
-
+// AES "round zero": XOR in the zero-th round key.
 	vpxor	%ymm9,%ymm12,%ymm12
 	vpxor	%ymm9,%ymm13,%ymm13
 	vpxor	%ymm9,%ymm14,%ymm14
@@ -453,16 +453,16 @@
 	vmovdqu	%ymm14,64(%rsi)
 	vmovdqu	%ymm15,96(%rsi)
 
-	subq	$-128,%rdi
+	subq	$-128,%rdi  // 128 is 4 bytes, -128 is 1 byte
 	addq	$-128,%rdx
 	cmpq	$127,%rdx
 	jbe	.Lghash_last_ciphertext_4x__func1
 .align	16
 .Lcrypt_loop_4x__func1:
 
-
-
-
+// Start the AES encryption of the counter blocks.
+// Increment le_ctr four times to generate four vectors of little-endian
+// counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vmovdqu	.Linc_2blocks(%rip),%ymm2
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	%ymm2,%ymm11,%ymm11
@@ -473,7 +473,7 @@
 	vpshufb	%ymm0,%ymm11,%ymm15
 	vpaddd	%ymm2,%ymm11,%ymm11
 
-
+// AES "round zero": XOR in the zero-th round key.
 	vpxor	%ymm9,%ymm12,%ymm12
 	vpxor	%ymm9,%ymm13,%ymm13
 	vpxor	%ymm9,%ymm14,%ymm14
@@ -482,7 +482,7 @@
 	cmpl	$24,%r10d
 	jl	.Laes128__func1
 	je	.Laes192__func1
-
+// AES-256
 	vbroadcasti128	-208(%r11),%ymm2
 	vaesenc	%ymm2,%ymm12,%ymm12
 	vaesenc	%ymm2,%ymm13,%ymm13
@@ -511,7 +511,7 @@
 .Laes128__func1:
 	prefetcht0	512(%rdi)
 	prefetcht0	512+64(%rdi)
-
+// First vector
 	vmovdqu	0(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	0(%r9),%ymm4
@@ -535,7 +535,7 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Second vector
 	vmovdqu	32(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	32(%r9),%ymm4
@@ -554,7 +554,7 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Third vector
 	vmovdqu	64(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	64(%r9),%ymm4
@@ -581,7 +581,7 @@
 	vpclmulqdq	$0x00,%ymm8,%ymm2,%ymm2
 	vpxor	%ymm2,%ymm6,%ymm6
 
-
+// Fourth vector
 	vmovdqu	96(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 
@@ -607,11 +607,11 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Finalize 'mi' following Karatsuba multiplication.
 	vpxor	%ymm5,%ymm6,%ymm6
 	vpxor	%ymm1,%ymm6,%ymm6
 
-
+// Fold lo into mi.
 	vbroadcasti128	.Lgfpoly(%rip),%ymm4
 	vpclmulqdq	$0x01,%ymm5,%ymm4,%ymm2
 	vpshufd	$0x4e,%ymm5,%ymm5
@@ -624,7 +624,7 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Fold mi into hi.
 	vpclmulqdq	$0x01,%ymm6,%ymm4,%ymm2
 	vpshufd	$0x4e,%ymm6,%ymm6
 	vpxor	%ymm6,%ymm1,%ymm1
@@ -640,7 +640,7 @@
 	vpxor	%xmm2,%xmm1,%xmm1
 
 
-	subq	$-128,%rsi
+	subq	$-128,%rsi  // 128 is 4 bytes, -128 is 1 byte
 	vpxor	0(%rdi),%ymm10,%ymm2
 	vpxor	32(%rdi),%ymm10,%ymm3
 	vpxor	64(%rdi),%ymm10,%ymm5
@@ -660,7 +660,7 @@
 	cmpq	$127,%rdx
 	ja	.Lcrypt_loop_4x__func1
 .Lghash_last_ciphertext_4x__func1:
-
+// First vector
 	vmovdqu	0(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	0(%r9),%ymm4
@@ -670,7 +670,7 @@
 	vpunpckhqdq	%ymm3,%ymm3,%ymm2
 	vpxor	%ymm3,%ymm2,%ymm2
 	vpclmulqdq	$0x00,%ymm7,%ymm2,%ymm6
-
+// Second vector
 	vmovdqu	32(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	32(%r9),%ymm4
@@ -682,7 +682,7 @@
 	vpxor	%ymm3,%ymm2,%ymm2
 	vpclmulqdq	$0x10,%ymm7,%ymm2,%ymm2
 	vpxor	%ymm2,%ymm6,%ymm6
-
+// Third vector
 	vmovdqu	64(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	64(%r9),%ymm4
@@ -695,7 +695,7 @@
 	vpclmulqdq	$0x00,%ymm8,%ymm2,%ymm2
 	vpxor	%ymm2,%ymm6,%ymm6
 
-
+// Fourth vector
 	vmovdqu	96(%rsi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	96(%r9),%ymm4
@@ -707,17 +707,17 @@
 	vpxor	%ymm3,%ymm2,%ymm2
 	vpclmulqdq	$0x10,%ymm8,%ymm2,%ymm2
 	vpxor	%ymm2,%ymm6,%ymm6
-
+// Finalize 'mi' following Karatsuba multiplication.
 	vpxor	%ymm5,%ymm6,%ymm6
 	vpxor	%ymm1,%ymm6,%ymm6
 
-
+// Fold lo into mi.
 	vbroadcasti128	.Lgfpoly(%rip),%ymm4
 	vpclmulqdq	$0x01,%ymm5,%ymm4,%ymm2
 	vpshufd	$0x4e,%ymm5,%ymm5
 	vpxor	%ymm5,%ymm6,%ymm6
 	vpxor	%ymm2,%ymm6,%ymm6
-
+// Fold mi into hi.
 	vpclmulqdq	$0x01,%ymm6,%ymm4,%ymm2
 	vpshufd	$0x4e,%ymm6,%ymm6
 	vpxor	%ymm6,%ymm1,%ymm1
@@ -727,18 +727,18 @@
 
 	subq	$-128,%rsi
 .Lcrypt_loop_4x_done__func1:
-
+// Check whether any data remains.
 	testq	%rdx,%rdx
 	jz	.Ldone__func1
 
+// DATALEN is in 16, 32, 48, 64, 80, 96, 112.
 
-
-
-
+// Make POWERS_PTR point to the key powers H^N, H^(N-1), ... where N
+// is the number of blocks that remain.
 	leaq	128(%r9),%r8
 	subq	%rdx,%r8
 
-
+// Start collecting the unreduced GHASH intermediate value LO, MI, HI.
 	vpxor	%xmm5,%xmm5,%xmm5
 	vpxor	%xmm6,%xmm6,%xmm6
 	vpxor	%xmm7,%xmm7,%xmm7
@@ -746,7 +746,7 @@
 	cmpq	$64,%rdx
 	jb	.Llessthan64bytes__func1
 
-
+// DATALEN is in 64, 80, 96, 112.  Encrypt two vectors of counter blocks.
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	.Linc_2blocks(%rip),%ymm11,%ymm11
 	vpshufb	%ymm0,%ymm11,%ymm13
@@ -764,7 +764,7 @@
 	vaesenclast	%ymm10,%ymm12,%ymm12
 	vaesenclast	%ymm10,%ymm13,%ymm13
 
-
+// XOR the data with the two vectors of keystream blocks.
 	vmovdqu	0(%rdi),%ymm2
 	vmovdqu	32(%rdi),%ymm3
 	vpxor	%ymm2,%ymm12,%ymm12
@@ -772,7 +772,7 @@
 	vmovdqu	%ymm12,0(%rsi)
 	vmovdqu	%ymm13,32(%rsi)
 
-
+// Update GHASH with two vectors of ciphertext blocks, without reducing.
 	vpshufb	%ymm0,%ymm12,%ymm12
 	vpshufb	%ymm0,%ymm13,%ymm13
 	vpxor	%ymm1,%ymm12,%ymm12
@@ -800,7 +800,7 @@
 
 	vpxor	%xmm1,%xmm1,%xmm1
 
-
+// DATALEN is in 16, 32, 48.  Encrypt two last vectors of counter blocks.
 .Llessthan64bytes__func1:
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	.Linc_2blocks(%rip),%ymm11,%ymm11
@@ -818,8 +818,8 @@
 	vaesenclast	%ymm10,%ymm12,%ymm12
 	vaesenclast	%ymm10,%ymm13,%ymm13
 
-
-
+// XOR the remaining data with the keystream blocks, and update GHASH with
+// the remaining ciphertext blocks without reducing.
 
 	cmpq	$32,%rdx
 	jb	.Lxor_one_block__func1
@@ -876,7 +876,7 @@
 	vpxor	%ymm4,%ymm7,%ymm7
 
 .Lreduce__func1:
-
+// Finally, do the GHASH reduction.
 	vbroadcasti128	.Lgfpoly(%rip),%ymm2
 	vpclmulqdq	$0x01,%ymm5,%ymm2,%ymm3
 	vpshufd	$0x4e,%ymm5,%ymm5
@@ -890,7 +890,7 @@
 	vpxor	%xmm7,%xmm1,%xmm1
 
 .Ldone__func1:
-
+// Store the updated GHASH accumulator back to memory.
 	vpshufb	%xmm0,%xmm1,%xmm1
 	vmovdqu	%xmm1,(%r12)
 
@@ -914,33 +914,33 @@
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r12,-16
 
-	movq	16(%rsp),%r12
+	movq	16(%rsp),%r12  // arg7
 	vbroadcasti128	.Lbswap_mask(%rip),%ymm0
 
-
-
+// Load the GHASH accumulator and the starting counter.
+// BoringSSL passes these values in big endian format.
 	vmovdqu	(%r12),%xmm1
 	vpshufb	%xmm0,%xmm1,%xmm1
 	vbroadcasti128	(%r8),%ymm11
 	vpshufb	%ymm0,%ymm11,%ymm11
 
-
-
+// Load the AES key length in bytes.  BoringSSL stores number of rounds
+// minus 1, so convert using: AESKEYLEN = 4 * aeskey->rounds - 20.
 	movl	240(%rcx),%r10d
 	leal	-20(,%r10,4),%r10d
 
-
-
-
+// Make RNDKEYLAST_PTR point to the last AES round key.  This is the
+// round key with index 10, 12, or 14 for AES-128, AES-192, or AES-256
+// respectively.  Then load the zero-th and last round keys.
 	leaq	96(%rcx,%r10,4),%r11
 	vbroadcasti128	(%rcx),%ymm9
 	vbroadcasti128	(%r11),%ymm10
 
-
+// Finish initializing LE_CTR by adding 1 to the second block.
 	vpaddd	.Lctr_pattern(%rip),%ymm11,%ymm11
 
-
-
+// If there are at least 128 bytes of data, then continue into the loop that
+// processes 128 bytes of data at a time.  Otherwise skip it.
 	cmpq	$127,%rdx
 	jbe	.Lcrypt_loop_4x_done__func2
 
@@ -949,9 +949,9 @@
 .align	16
 .Lcrypt_loop_4x__func2:
 
-
-
-
+// Start the AES encryption of the counter blocks.
+// Increment le_ctr four times to generate four vectors of little-endian
+// counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vmovdqu	.Linc_2blocks(%rip),%ymm2
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	%ymm2,%ymm11,%ymm11
@@ -962,7 +962,7 @@
 	vpshufb	%ymm0,%ymm11,%ymm15
 	vpaddd	%ymm2,%ymm11,%ymm11
 
-
+// AES "round zero": XOR in the zero-th round key.
 	vpxor	%ymm9,%ymm12,%ymm12
 	vpxor	%ymm9,%ymm13,%ymm13
 	vpxor	%ymm9,%ymm14,%ymm14
@@ -971,7 +971,7 @@
 	cmpl	$24,%r10d
 	jl	.Laes128__func2
 	je	.Laes192__func2
-
+// AES-256
 	vbroadcasti128	-208(%r11),%ymm2
 	vaesenc	%ymm2,%ymm12,%ymm12
 	vaesenc	%ymm2,%ymm13,%ymm13
@@ -1000,7 +1000,7 @@
 .Laes128__func2:
 	prefetcht0	512(%rdi)
 	prefetcht0	512+64(%rdi)
-
+// First vector
 	vmovdqu	0(%rdi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	0(%r9),%ymm4
@@ -1024,7 +1024,7 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Second vector
 	vmovdqu	32(%rdi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	32(%r9),%ymm4
@@ -1043,7 +1043,7 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Third vector
 	vmovdqu	64(%rdi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 	vmovdqu	64(%r9),%ymm4
@@ -1070,7 +1070,7 @@
 	vpclmulqdq	$0x00,%ymm8,%ymm2,%ymm2
 	vpxor	%ymm2,%ymm6,%ymm6
 
-
+// Fourth vector
 	vmovdqu	96(%rdi),%ymm3
 	vpshufb	%ymm0,%ymm3,%ymm3
 
@@ -1096,11 +1096,11 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Finalize 'mi' following Karatsuba multiplication.
 	vpxor	%ymm5,%ymm6,%ymm6
 	vpxor	%ymm1,%ymm6,%ymm6
 
-
+// Fold lo into mi.
 	vbroadcasti128	.Lgfpoly(%rip),%ymm4
 	vpclmulqdq	$0x01,%ymm5,%ymm4,%ymm2
 	vpshufd	$0x4e,%ymm5,%ymm5
@@ -1113,7 +1113,7 @@
 	vaesenc	%ymm2,%ymm14,%ymm14
 	vaesenc	%ymm2,%ymm15,%ymm15
 
-
+// Fold mi into hi.
 	vpclmulqdq	$0x01,%ymm6,%ymm4,%ymm2
 	vpshufd	$0x4e,%ymm6,%ymm6
 	vpxor	%ymm6,%ymm1,%ymm1
@@ -1129,7 +1129,7 @@
 	vpxor	%xmm2,%xmm1,%xmm1
 
 
-
+// 128 is 4 bytes, -128 is 1 byte
 	vpxor	0(%rdi),%ymm10,%ymm2
 	vpxor	32(%rdi),%ymm10,%ymm3
 	vpxor	64(%rdi),%ymm10,%ymm5
@@ -1149,18 +1149,18 @@
 	cmpq	$127,%rdx
 	ja	.Lcrypt_loop_4x__func2
 .Lcrypt_loop_4x_done__func2:
-
+// Check whether any data remains.
 	testq	%rdx,%rdx
 	jz	.Ldone__func2
 
+// DATALEN is in 16, 32, 48, 64, 80, 96, 112.
 
-
-
-
+// Make POWERS_PTR point to the key powers H^N, H^(N-1), ... where N
+// is the number of blocks that remain.
 	leaq	128(%r9),%r8
 	subq	%rdx,%r8
 
-
+// Start collecting the unreduced GHASH intermediate value LO, MI, HI.
 	vpxor	%xmm5,%xmm5,%xmm5
 	vpxor	%xmm6,%xmm6,%xmm6
 	vpxor	%xmm7,%xmm7,%xmm7
@@ -1168,7 +1168,7 @@
 	cmpq	$64,%rdx
 	jb	.Llessthan64bytes__func2
 
-
+// DATALEN is in 64, 80, 96, 112.  Encrypt two vectors of counter blocks.
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	.Linc_2blocks(%rip),%ymm11,%ymm11
 	vpshufb	%ymm0,%ymm11,%ymm13
@@ -1186,7 +1186,7 @@
 	vaesenclast	%ymm10,%ymm12,%ymm12
 	vaesenclast	%ymm10,%ymm13,%ymm13
 
-
+// XOR the data with the two vectors of keystream blocks.
 	vmovdqu	0(%rdi),%ymm2
 	vmovdqu	32(%rdi),%ymm3
 	vpxor	%ymm2,%ymm12,%ymm12
@@ -1194,7 +1194,7 @@
 	vmovdqu	%ymm12,0(%rsi)
 	vmovdqu	%ymm13,32(%rsi)
 
-
+// Update GHASH with two vectors of ciphertext blocks, without reducing.
 	vpshufb	%ymm0,%ymm2,%ymm12
 	vpshufb	%ymm0,%ymm3,%ymm13
 	vpxor	%ymm1,%ymm12,%ymm12
@@ -1222,7 +1222,7 @@
 
 	vpxor	%xmm1,%xmm1,%xmm1
 
-
+// DATALEN is in 16, 32, 48.  Encrypt two last vectors of counter blocks.
 .Llessthan64bytes__func2:
 	vpshufb	%ymm0,%ymm11,%ymm12
 	vpaddd	.Linc_2blocks(%rip),%ymm11,%ymm11
@@ -1240,8 +1240,8 @@
 	vaesenclast	%ymm10,%ymm12,%ymm12
 	vaesenclast	%ymm10,%ymm13,%ymm13
 
-
-
+// XOR the remaining data with the keystream blocks, and update GHASH with
+// the remaining ciphertext blocks without reducing.
 
 	cmpq	$32,%rdx
 	jb	.Lxor_one_block__func2
@@ -1298,7 +1298,7 @@
 	vpxor	%ymm4,%ymm7,%ymm7
 
 .Lreduce__func2:
-
+// Finally, do the GHASH reduction.
 	vbroadcasti128	.Lgfpoly(%rip),%ymm2
 	vpclmulqdq	$0x01,%ymm5,%ymm2,%ymm3
 	vpshufd	$0x4e,%ymm5,%ymm5
@@ -1312,7 +1312,7 @@
 	vpxor	%xmm7,%xmm1,%xmm1
 
 .Ldone__func2:
-
+// Store the updated GHASH accumulator back to memory.
 	vpshufb	%xmm0,%xmm1,%xmm1
 	vmovdqu	%xmm1,(%r12)

boringssl-0.20260708.tar.xz/gen/bcm/aes-gcm-avx2-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/aes-gcm-avx2-x86_64-win.asm Changed

@@ -16,26 +16,26 @@
 ALIGN	16
 aes_gcm_avx2_constants:
 
-
+; A shuffle mask that reflects the bytes of 16-byte blocks
 $L$bswap_mask:
 	DQ	0x08090a0b0c0d0e0f,0x0001020304050607
 
-
-
-
-
-
-
-
+; This is the GHASH reducing polynomial without its constant term, i.e.
+; x^128 + x^7 + x^2 + x, represented using the backwards mapping
+; between bits and polynomial coefficients.
+; 
+; Alternatively, it can be interpreted as the naturally-ordered
+; representation of the polynomial x^127 + x^126 + x^121 + 1, i.e. the
+; "reversed" GHASH reducing polynomial without its x^128 term.
 $L$gfpoly:
 	DQ	1,0xc200000000000000
 
-
+; Same as above, but with the (1 << 64) bit set.
 $L$gfpoly_and_internal_carrybit:
 	DQ	1,0xc200000000000001
 
 ALIGN	32
-
+; The below constants are used for incrementing the counter blocks.
 $L$ctr_pattern:
 	DQ	0,0
 	DQ	1,0
@@ -59,14 +59,14 @@
 
 $L$SEH_endprologue_gcm_init_vpclmulqdq_avx2_4:
 
-
-
+; Load the byte-reflected hash subkey.  BoringSSL provides it in
+; byte-reflected form except the two halves are in the wrong order.
 	vpshufd	xmm3,XMMWORDrdx,0x4e
 
-
-
-
-
+; Finish preprocessing the byte-reflected hash subkey by multiplying it by
+; x^-1 ("standard" interpretation of polynomial coefficients) or
+; equivalently x^1 (natural interpretation).  This gets the key into a
+; format that avoids having to bit-reflect the data blocks later.
 	vpshufd	xmm0,xmm3,0xd3
 	vpsrad	xmm0,xmm0,31
 	vpaddq	xmm3,xmm3,xmm3
@@ -75,83 +75,83 @@
 
 	vbroadcasti128	ymm6,XMMWORD$L$gfpoly
 
-
-	vpclmulqdq	xmm0,xmm3,xmm3,0x00
-	vpclmulqdq	xmm5,xmm3,xmm3,0x11
-	vpclmulqdq	xmm1,xmm6,xmm0,0x01
-	vpshufd	xmm0,xmm0,0x4e
-	vpxor	xmm1,xmm1,xmm0
-	vpclmulqdq	xmm0,xmm6,xmm1,0x01
-	vpshufd	xmm1,xmm1,0x4e
-	vpxor	xmm5,xmm5,xmm1
-	vpxor	xmm5,xmm5,xmm0
-
+; Square H^1 to get H^2.
+	vpclmulqdq	xmm0,xmm3,xmm3,0x00  ; LO = a_L * a_L
+	vpclmulqdq	xmm5,xmm3,xmm3,0x11  ; HI = a_H * a_H
+	vpclmulqdq	xmm1,xmm6,xmm0,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	xmm0,xmm0,0x4e  ; Swap halves of LO
+	vpxor	xmm1,xmm1,xmm0  ; Fold LO into MI
+	vpclmulqdq	xmm0,xmm6,xmm1,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	xmm1,xmm1,0x4e  ; Swap halves of MI
+	vpxor	xmm5,xmm5,xmm1  ; Fold MI into HI (part 1)
+	vpxor	xmm5,xmm5,xmm0  ; Fold MI into HI (part 2)
 
 
+; Create H_CUR = H^2, H^1 and H_INC = H^2, H^2.
 	vinserti128	ymm3,ymm5,xmm3,1
 	vinserti128	ymm5,ymm5,xmm5,1
 
-
-	vpclmulqdq	ymm0,ymm3,ymm5,0x00
-	vpclmulqdq	ymm1,ymm3,ymm5,0x01
-	vpclmulqdq	ymm2,ymm3,ymm5,0x10
-	vpxor	ymm1,ymm1,ymm2
-	vpclmulqdq	ymm2,ymm6,ymm0,0x01
-	vpshufd	ymm0,ymm0,0x4e
-	vpxor	ymm1,ymm1,ymm0
-	vpxor	ymm1,ymm1,ymm2
-	vpclmulqdq	ymm4,ymm3,ymm5,0x11
-	vpclmulqdq	ymm0,ymm6,ymm1,0x01
-	vpshufd	ymm1,ymm1,0x4e
-	vpxor	ymm4,ymm4,ymm1
-	vpxor	ymm4,ymm4,ymm0
-
-
-
+; Compute H_CUR2 = H^4, H^3.
+	vpclmulqdq	ymm0,ymm3,ymm5,0x00  ; LO = a_L * b_L
+	vpclmulqdq	ymm1,ymm3,ymm5,0x01  ; MI_0 = a_L * b_H
+	vpclmulqdq	ymm2,ymm3,ymm5,0x10  ; MI_1 = a_H * b_L
+	vpxor	ymm1,ymm1,ymm2  ; MI = MI_0 + MI_1
+	vpclmulqdq	ymm2,ymm6,ymm0,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	ymm0,ymm0,0x4e  ; Swap halves of LO
+	vpxor	ymm1,ymm1,ymm0  ; Fold LO into MI (part 1)
+	vpxor	ymm1,ymm1,ymm2  ; Fold LO into MI (part 2)
+	vpclmulqdq	ymm4,ymm3,ymm5,0x11  ; HI = a_H * b_H
+	vpclmulqdq	ymm0,ymm6,ymm1,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	ymm1,ymm1,0x4e  ; Swap halves of MI
+	vpxor	ymm4,ymm4,ymm1  ; Fold MI into HI (part 1)
+	vpxor	ymm4,ymm4,ymm0  ; Fold MI into HI (part 2)
+
+
+; Store H^2, H^1 and H^4, H^3.
 	vmovdqu	YMMWORD96+rcx,ymm3
 	vmovdqu	YMMWORD64+rcx,ymm4
 
-
-
+; For Karatsuba multiplication: compute and store the two 64-bit halves of
+; each key power XOR'd together.  Order is 4,2,3,1.
 	vpunpcklqdq	ymm0,ymm4,ymm3
 	vpunpckhqdq	ymm1,ymm4,ymm3
 	vpxor	ymm0,ymm0,ymm1
 	vmovdqu	YMMWORD(128+32)+rcx,ymm0
 
-
-	vpclmulqdq	ymm0,ymm4,ymm5,0x00
-	vpclmulqdq	ymm1,ymm4,ymm5,0x01
-	vpclmulqdq	ymm2,ymm4,ymm5,0x10
-	vpxor	ymm1,ymm1,ymm2
-	vpclmulqdq	ymm2,ymm6,ymm0,0x01
-	vpshufd	ymm0,ymm0,0x4e
-	vpxor	ymm1,ymm1,ymm0
-	vpxor	ymm1,ymm1,ymm2
-	vpclmulqdq	ymm3,ymm4,ymm5,0x11
-	vpclmulqdq	ymm0,ymm6,ymm1,0x01
-	vpshufd	ymm1,ymm1,0x4e
-	vpxor	ymm3,ymm3,ymm1
-	vpxor	ymm3,ymm3,ymm0
-
-	vpclmulqdq	ymm0,ymm3,ymm5,0x00
-	vpclmulqdq	ymm1,ymm3,ymm5,0x01
-	vpclmulqdq	ymm2,ymm3,ymm5,0x10
-	vpxor	ymm1,ymm1,ymm2
-	vpclmulqdq	ymm2,ymm6,ymm0,0x01
-	vpshufd	ymm0,ymm0,0x4e
-	vpxor	ymm1,ymm1,ymm0
-	vpxor	ymm1,ymm1,ymm2
-	vpclmulqdq	ymm4,ymm3,ymm5,0x11
-	vpclmulqdq	ymm0,ymm6,ymm1,0x01
-	vpshufd	ymm1,ymm1,0x4e
-	vpxor	ymm4,ymm4,ymm1
-	vpxor	ymm4,ymm4,ymm0
+; Compute and store H_CUR = H^6, H^5 and H_CUR2 = H^8, H^7.
+	vpclmulqdq	ymm0,ymm4,ymm5,0x00  ; LO = a_L * b_L
+	vpclmulqdq	ymm1,ymm4,ymm5,0x01  ; MI_0 = a_L * b_H
+	vpclmulqdq	ymm2,ymm4,ymm5,0x10  ; MI_1 = a_H * b_L
+	vpxor	ymm1,ymm1,ymm2  ; MI = MI_0 + MI_1
+	vpclmulqdq	ymm2,ymm6,ymm0,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	ymm0,ymm0,0x4e  ; Swap halves of LO
+	vpxor	ymm1,ymm1,ymm0  ; Fold LO into MI (part 1)
+	vpxor	ymm1,ymm1,ymm2  ; Fold LO into MI (part 2)
+	vpclmulqdq	ymm3,ymm4,ymm5,0x11  ; HI = a_H * b_H
+	vpclmulqdq	ymm0,ymm6,ymm1,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	ymm1,ymm1,0x4e  ; Swap halves of MI
+	vpxor	ymm3,ymm3,ymm1  ; Fold MI into HI (part 1)
+	vpxor	ymm3,ymm3,ymm0  ; Fold MI into HI (part 2)
+
+	vpclmulqdq	ymm0,ymm3,ymm5,0x00  ; LO = a_L * b_L
+	vpclmulqdq	ymm1,ymm3,ymm5,0x01  ; MI_0 = a_L * b_H
+	vpclmulqdq	ymm2,ymm3,ymm5,0x10  ; MI_1 = a_H * b_L
+	vpxor	ymm1,ymm1,ymm2  ; MI = MI_0 + MI_1
+	vpclmulqdq	ymm2,ymm6,ymm0,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	ymm0,ymm0,0x4e  ; Swap halves of LO
+	vpxor	ymm1,ymm1,ymm0  ; Fold LO into MI (part 1)
+	vpxor	ymm1,ymm1,ymm2  ; Fold LO into MI (part 2)
+	vpclmulqdq	ymm4,ymm3,ymm5,0x11  ; HI = a_H * b_H
+	vpclmulqdq	ymm0,ymm6,ymm1,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	ymm1,ymm1,0x4e  ; Swap halves of MI
+	vpxor	ymm4,ymm4,ymm1  ; Fold MI into HI (part 1)
+	vpxor	ymm4,ymm4,ymm0  ; Fold MI into HI (part 2)
 
 	vmovdqu	YMMWORD32+rcx,ymm3
 	vmovdqu	YMMWORDrcx,ymm4
 
-
-
+; Again, compute and store the two 64-bit halves of each key power XOR'd
+; together.  Order is 8,6,7,5.
 	vpunpcklqdq	ymm0,ymm4,ymm3
 	vpunpckhqdq	ymm1,ymm4,ymm3
 	vpxor	ymm0,ymm0,ymm1
@@ -184,25 +184,25 @@
 	vmovdqu	xmm3,XMMWORD$L$gfpoly
 	vpshufb	xmm0,xmm0,xmm1
 
-	vpclmulqdq	xmm4,xmm0,xmm2,0x00
-	vpclmulqdq	xmm5,xmm0,xmm2,0x01
-	vpclmulqdq	xmm6,xmm0,xmm2,0x10
-	vpxor	xmm5,xmm5,xmm6
-	vpclmulqdq	xmm6,xmm3,xmm4,0x01
-	vpshufd	xmm4,xmm4,0x4e
-	vpxor	xmm5,xmm5,xmm4
-	vpxor	xmm5,xmm5,xmm6
-	vpclmulqdq	xmm0,xmm0,xmm2,0x11
-	vpclmulqdq	xmm4,xmm3,xmm5,0x01
-	vpshufd	xmm5,xmm5,0x4e
-	vpxor	xmm0,xmm0,xmm5
-	vpxor	xmm0,xmm0,xmm4
+	vpclmulqdq	xmm4,xmm0,xmm2,0x00  ; LO = a_L * b_L
+	vpclmulqdq	xmm5,xmm0,xmm2,0x01  ; MI_0 = a_L * b_H
+	vpclmulqdq	xmm6,xmm0,xmm2,0x10  ; MI_1 = a_H * b_L
+	vpxor	xmm5,xmm5,xmm6  ; MI = MI_0 + MI_1
+	vpclmulqdq	xmm6,xmm3,xmm4,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	xmm4,xmm4,0x4e  ; Swap halves of LO
+	vpxor	xmm5,xmm5,xmm4  ; Fold LO into MI (part 1)
+	vpxor	xmm5,xmm5,xmm6  ; Fold LO into MI (part 2)
+	vpclmulqdq	xmm0,xmm0,xmm2,0x11  ; HI = a_H * b_H
+	vpclmulqdq	xmm4,xmm3,xmm5,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	xmm5,xmm5,0x4e  ; Swap halves of MI
+	vpxor	xmm0,xmm0,xmm5  ; Fold MI into HI (part 1)
+	vpxor	xmm0,xmm0,xmm4  ; Fold MI into HI (part 2)
 
 
 	vpshufb	xmm0,xmm0,xmm1
 	vmovdqu	XMMWORDrcx,xmm0
 
-
+; No need for vzeroupper, since only xmm registers were used.
 	vmovdqa	xmm6,XMMWORDrsp
 	add	rsp,24
 	ret
@@ -229,33 +229,33 @@
 
 $L$SEH_endprologue_gcm_ghash_vpclmulqdq_avx2_7:
 
-
-
-
+; Load the bswap_mask and gfpoly constants.  Since AADLEN is usually small,
+; usually only 128-bit vectors will be used.  So as an optimization, don't
+; broadcast these constants to both 128-bit lanes quite yet.
 	vmovdqu	xmm6,XMMWORD$L$bswap_mask
 	vmovdqu	xmm7,XMMWORD$L$gfpoly
 
-
+; Load the GHASH accumulator.
 	vmovdqu	xmm5,XMMWORDrcx
 	vpshufb	xmm5,xmm5,xmm6
 
-
+; Optimize for AADLEN < 32 by checking for AADLEN < 32 before AADLEN < 128.
 	cmp	r9,32
 	jb	NEAR $L$ghash_lastblock
 
-
-
+; AADLEN >= 32, so we'll operate on full vectors.  Broadcast bswap_mask and
+; gfpoly to both 128-bit lanes.
 	vinserti128	ymm6,ymm6,xmm6,1
 	vinserti128	ymm7,ymm7,xmm7,1
 
 	cmp	r9,127
 	jbe	NEAR $L$ghash_loop_1x
 
-
+; Update GHASH with 128 bytes of AAD at a time.
 	vmovdqu	ymm8,YMMWORD128+rdx
 	vmovdqu	ymm9,YMMWORD((128+32))+rdx
 $L$ghash_loop_4x:
-
+; First vector
 	vmovdqu	ymm1,YMMWORDr8
 	vpshufb	ymm1,ymm1,ymm6
 	vmovdqu	ymm2,YMMWORDrdx
@@ -265,7 +265,7 @@
 	vpunpckhqdq	ymm0,ymm1,ymm1
 	vpxor	ymm0,ymm0,ymm1
 	vpclmulqdq	ymm4,ymm0,ymm8,0x00
-
+; Second vector
 	vmovdqu	ymm1,YMMWORD32+r8
 	vpshufb	ymm1,ymm1,ymm6
 	vmovdqu	ymm2,YMMWORD32+rdx
@@ -277,7 +277,7 @@
 	vpxor	ymm0,ymm0,ymm1
 	vpclmulqdq	ymm0,ymm0,ymm8,0x10
 	vpxor	ymm4,ymm4,ymm0
-
+; Third vector
 	vmovdqu	ymm1,YMMWORD64+r8
 	vpshufb	ymm1,ymm1,ymm6
 	vmovdqu	ymm2,YMMWORD64+rdx
@@ -290,7 +290,7 @@
 	vpclmulqdq	ymm0,ymm0,ymm9,0x00
 	vpxor	ymm4,ymm4,ymm0
 
-
+; Fourth vector
 	vmovdqu	ymm1,YMMWORD96+r8
 	vpshufb	ymm1,ymm1,ymm6
 	vmovdqu	ymm2,YMMWORD96+rdx
@@ -302,17 +302,17 @@
 	vpxor	ymm0,ymm0,ymm1
 	vpclmulqdq	ymm0,ymm0,ymm9,0x10
 	vpxor	ymm4,ymm4,ymm0
-
+; Finalize 'mi' following Karatsuba multiplication.
 	vpxor	ymm4,ymm4,ymm3
 	vpxor	ymm4,ymm4,ymm5
 
-
+; Fold lo into mi.
 	vbroadcasti128	ymm2,XMMWORD$L$gfpoly
 	vpclmulqdq	ymm0,ymm2,ymm3,0x01
 	vpshufd	ymm3,ymm3,0x4e
 	vpxor	ymm4,ymm4,ymm3
 	vpxor	ymm4,ymm4,ymm0
-
+; Fold mi into hi.
 	vpclmulqdq	ymm0,ymm2,ymm4,0x01
 	vpshufd	ymm4,ymm4,0x4e
 	vpxor	ymm5,ymm5,ymm4
@@ -320,12 +320,12 @@
 	vextracti128	xmm0,ymm5,1
 	vpxor	xmm5,xmm5,xmm0
 
-	sub	r8,-128
+	sub	r8,-128  ; 128 is 4 bytes, -128 is 1 byte
 	add	r9,-128
 	cmp	r9,127
 	ja	NEAR $L$ghash_loop_4x
 
-
+; Update GHASH with 32 bytes of AAD at a time.
 	cmp	r9,32
 	jb	NEAR $L$ghash_loop_1x_done
 $L$ghash_loop_1x:
@@ -333,19 +333,19 @@
 	vpshufb	ymm0,ymm0,ymm6
 	vpxor	ymm5,ymm5,ymm0
 	vmovdqu	ymm0,YMMWORD((128-32))+rdx
-	vpclmulqdq	ymm1,ymm5,ymm0,0x00
-	vpclmulqdq	ymm2,ymm5,ymm0,0x01
-	vpclmulqdq	ymm3,ymm5,ymm0,0x10
-	vpxor	ymm2,ymm2,ymm3
-	vpclmulqdq	ymm3,ymm7,ymm1,0x01
-	vpshufd	ymm1,ymm1,0x4e
-	vpxor	ymm2,ymm2,ymm1
-	vpxor	ymm2,ymm2,ymm3
-	vpclmulqdq	ymm5,ymm5,ymm0,0x11
-	vpclmulqdq	ymm1,ymm7,ymm2,0x01
-	vpshufd	ymm2,ymm2,0x4e
-	vpxor	ymm5,ymm5,ymm2
-	vpxor	ymm5,ymm5,ymm1
+	vpclmulqdq	ymm1,ymm5,ymm0,0x00  ; LO = a_L * b_L
+	vpclmulqdq	ymm2,ymm5,ymm0,0x01  ; MI_0 = a_L * b_H
+	vpclmulqdq	ymm3,ymm5,ymm0,0x10  ; MI_1 = a_H * b_L
+	vpxor	ymm2,ymm2,ymm3  ; MI = MI_0 + MI_1
+	vpclmulqdq	ymm3,ymm7,ymm1,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	ymm1,ymm1,0x4e  ; Swap halves of LO
+	vpxor	ymm2,ymm2,ymm1  ; Fold LO into MI (part 1)
+	vpxor	ymm2,ymm2,ymm3  ; Fold LO into MI (part 2)
+	vpclmulqdq	ymm5,ymm5,ymm0,0x11  ; HI = a_H * b_H
+	vpclmulqdq	ymm1,ymm7,ymm2,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	ymm2,ymm2,0x4e  ; Swap halves of MI
+	vpxor	ymm5,ymm5,ymm2  ; Fold MI into HI (part 1)
+	vpxor	ymm5,ymm5,ymm1  ; Fold MI into HI (part 2)
 
 	vextracti128	xmm0,ymm5,1
 	vpxor	xmm5,xmm5,xmm0
@@ -355,7 +355,7 @@
 	jae	NEAR $L$ghash_loop_1x
 $L$ghash_loop_1x_done:
 
-
+; Update GHASH with the remaining 16-byte block if any.
 $L$ghash_lastblock:
 	test	r9,r9
 	jz	NEAR $L$ghash_done
@@ -363,23 +363,23 @@
 	vpshufb	xmm0,xmm0,xmm6
 	vpxor	xmm5,xmm5,xmm0
 	vmovdqu	xmm0,XMMWORD((128-16))+rdx
-	vpclmulqdq	xmm1,xmm5,xmm0,0x00
-	vpclmulqdq	xmm2,xmm5,xmm0,0x01
-	vpclmulqdq	xmm3,xmm5,xmm0,0x10
-	vpxor	xmm2,xmm2,xmm3
-	vpclmulqdq	xmm3,xmm7,xmm1,0x01
-	vpshufd	xmm1,xmm1,0x4e
-	vpxor	xmm2,xmm2,xmm1
-	vpxor	xmm2,xmm2,xmm3
-	vpclmulqdq	xmm5,xmm5,xmm0,0x11
-	vpclmulqdq	xmm1,xmm7,xmm2,0x01
-	vpshufd	xmm2,xmm2,0x4e
-	vpxor	xmm5,xmm5,xmm2
-	vpxor	xmm5,xmm5,xmm1
+	vpclmulqdq	xmm1,xmm5,xmm0,0x00  ; LO = a_L * b_L
+	vpclmulqdq	xmm2,xmm5,xmm0,0x01  ; MI_0 = a_L * b_H
+	vpclmulqdq	xmm3,xmm5,xmm0,0x10  ; MI_1 = a_H * b_L
+	vpxor	xmm2,xmm2,xmm3  ; MI = MI_0 + MI_1
+	vpclmulqdq	xmm3,xmm7,xmm1,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	xmm1,xmm1,0x4e  ; Swap halves of LO
+	vpxor	xmm2,xmm2,xmm1  ; Fold LO into MI (part 1)
+	vpxor	xmm2,xmm2,xmm3  ; Fold LO into MI (part 2)
+	vpclmulqdq	xmm5,xmm5,xmm0,0x11  ; HI = a_H * b_H
+	vpclmulqdq	xmm1,xmm7,xmm2,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	xmm2,xmm2,0x4e  ; Swap halves of MI
+	vpxor	xmm5,xmm5,xmm2  ; Fold MI into HI (part 1)
+	vpxor	xmm5,xmm5,xmm1  ; Fold MI into HI (part 2)
 
 
 $L$ghash_done:
-
+; Store the updated GHASH accumulator back to memory.
 	vpshufb	xmm5,xmm5,xmm6
 	vmovdqu	XMMWORDrcx,xmm5
 
@@ -407,9 +407,9 @@
 	push	r12
 $L$SEH_prologue_aes_gcm_enc_update_vaes_avx2_4:
 
-	mov	rsi,QWORD64+rsp
-	mov	rdi,QWORD72+rsp
-	mov	r12,QWORD80+rsp
+	mov	rsi,QWORD64+rsp  ; arg5
+	mov	rdi,QWORD72+rsp  ; arg6
+	mov	r12,QWORD80+rsp  ; arg7
 	sub	rsp,160
 $L$SEH_prologue_aes_gcm_enc_update_vaes_avx2_5:
 	vmovdqa	XMMWORDrsp,xmm6
@@ -440,38 +440,38 @@
 %endif
 	vbroadcasti128	ymm0,XMMWORD$L$bswap_mask
 
-
-
+; Load the GHASH accumulator and the starting counter.
+; BoringSSL passes these values in big endian format.
 	vmovdqu	xmm1,XMMWORDr12
 	vpshufb	xmm1,xmm1,xmm0
 	vbroadcasti128	ymm11,XMMWORDrsi
 	vpshufb	ymm11,ymm11,ymm0
 
-
-
+; Load the AES key length in bytes.  BoringSSL stores number of rounds
+; minus 1, so convert using: AESKEYLEN = 4 * aeskey->rounds - 20.
 	mov	r10d,DWORD240+r9
 	lea	r10d,((-20))+r10*4
 
-
-
-
+; Make RNDKEYLAST_PTR point to the last AES round key.  This is the
+; round key with index 10, 12, or 14 for AES-128, AES-192, or AES-256
+; respectively.  Then load the zero-th and last round keys.
 	lea	r11,96+r10*4+r9
 	vbroadcasti128	ymm9,XMMWORDr9
 	vbroadcasti128	ymm10,XMMWORDr11
 
-
+; Finish initializing LE_CTR by adding 1 to the second block.
 	vpaddd	ymm11,ymm11,YMMWORD$L$ctr_pattern
 
-
-
+; If there are at least 128 bytes of data, then continue into the loop that
+; processes 128 bytes of data at a time.  Otherwise skip it.
 	cmp	r8,127
 	jbe	NEAR $L$crypt_loop_4x_done__func1
 
 	vmovdqu	ymm7,YMMWORD128+rdi
 	vmovdqu	ymm8,YMMWORD((128+32))+rdi
-
-
-
+; Encrypt the first 4 vectors of plaintext blocks.
+; Increment le_ctr four times to generate four vectors of little-endian
+; counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vmovdqu	ymm2,YMMWORD$L$inc_2blocks
 	vpshufb	ymm12,ymm11,ymm0
 	vpaddd	ymm11,ymm11,ymm2
@@ -482,7 +482,7 @@
 	vpshufb	ymm15,ymm11,ymm0
 	vpaddd	ymm11,ymm11,ymm2
 
-
+; AES "round zero": XOR in the zero-th round key.
 	vpxor	ymm12,ymm12,ymm9
 	vpxor	ymm13,ymm13,ymm9
 	vpxor	ymm14,ymm14,ymm9
@@ -512,16 +512,16 @@
 	vmovdqu	YMMWORD64+rdx,ymm14
 	vmovdqu	YMMWORD96+rdx,ymm15
 
-	sub	rcx,-128
+	sub	rcx,-128  ; 128 is 4 bytes, -128 is 1 byte
 	add	r8,-128
 	cmp	r8,127
 	jbe	NEAR $L$ghash_last_ciphertext_4x__func1
 ALIGN	16
 $L$crypt_loop_4x__func1:
 
-
-
-
+; Start the AES encryption of the counter blocks.
+; Increment le_ctr four times to generate four vectors of little-endian
+; counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vmovdqu	ymm2,YMMWORD$L$inc_2blocks
 	vpshufb	ymm12,ymm11,ymm0
 	vpaddd	ymm11,ymm11,ymm2
@@ -532,7 +532,7 @@
 	vpshufb	ymm15,ymm11,ymm0
 	vpaddd	ymm11,ymm11,ymm2
 
-
+; AES "round zero": XOR in the zero-th round key.
 	vpxor	ymm12,ymm12,ymm9
 	vpxor	ymm13,ymm13,ymm9
 	vpxor	ymm14,ymm14,ymm9
@@ -541,7 +541,7 @@
 	cmp	r10d,24
 	jl	NEAR $L$aes128__func1
 	je	NEAR $L$aes192__func1
-
+; AES-256
 	vbroadcasti128	ymm2,XMMWORD((-208))+r11
 	vaesenc	ymm12,ymm12,ymm2
 	vaesenc	ymm13,ymm13,ymm2
@@ -570,7 +570,7 @@
 $L$aes128__func1:
 	prefetcht0	512+rcx
 	prefetcht0	((512+64))+rcx
-
+; First vector
 	vmovdqu	ymm3,YMMWORDrdx
 	vpshufb	ymm3,ymm3,ymm0
 	vmovdqu	ymm4,YMMWORDrdi
@@ -594,7 +594,7 @@
 	vaesenc	ymm14,ymm14,ymm2
 	vaesenc	ymm15,ymm15,ymm2
 
-
+; Second vector
 	vmovdqu	ymm3,YMMWORD32+rdx
 	vpshufb	ymm3,ymm3,ymm0
 	vmovdqu	ymm4,YMMWORD32+rdi
@@ -613,7 +613,7 @@
 	vaesenc	ymm14,ymm14,ymm2
 	vaesenc	ymm15,ymm15,ymm2
 
-
+; Third vector
 	vmovdqu	ymm3,YMMWORD64+rdx
 	vpshufb	ymm3,ymm3,ymm0
 	vmovdqu	ymm4,YMMWORD64+rdi
@@ -640,7 +640,7 @@
 	vpclmulqdq	ymm2,ymm2,ymm8,0x00
 	vpxor	ymm6,ymm6,ymm2
 
-
+; Fourth vector
 	vmovdqu	ymm3,YMMWORD96+rdx
 	vpshufb	ymm3,ymm3,ymm0
 
@@ -666,11 +666,11 @@
 	vaesenc	ymm14,ymm14,ymm2
 	vaesenc	ymm15,ymm15,ymm2
 
-
+; Finalize 'mi' following Karatsuba multiplication.
 	vpxor	ymm6,ymm6,ymm5
 	vpxor	ymm6,ymm6,ymm1
 
-
+; Fold lo into mi.
 	vbroadcasti128	ymm4,XMMWORD$L$gfpoly
 	vpclmulqdq	ymm2,ymm4,ymm5,0x01
 	vpshufd	ymm5,ymm5,0x4e
@@ -683,7 +683,7 @@
 	vaesenc	ymm14,ymm14,ymm2
 	vaesenc	ymm15,ymm15,ymm2
 
-
+; Fold mi into hi.
 	vpclmulqdq	ymm2,ymm4,ymm6,0x01
 	vpshufd	ymm6,ymm6,0x4e
 	vpxor	ymm1,ymm1,ymm6
@@ -699,7 +699,7 @@
 	vpxor	xmm1,xmm1,xmm2
 
 
-	sub	rdx,-128
+	sub	rdx,-128  ; 128 is 4 bytes, -128 is 1 byte
 	vpxor	ymm2,ymm10,YMMWORDrcx
 	vpxor	ymm3,ymm10,YMMWORD32+rcx
 	vpxor	ymm5,ymm10,YMMWORD64+rcx
@@ -719,7 +719,7 @@
 	cmp	r8,127
 	ja	NEAR $L$crypt_loop_4x__func1
 $L$ghash_last_ciphertext_4x__func1:
-
+; First vector
 	vmovdqu	ymm3,YMMWORDrdx
 	vpshufb	ymm3,ymm3,ymm0
 	vmovdqu	ymm4,YMMWORDrdi
@@ -729,7 +729,7 @@
 	vpunpckhqdq	ymm2,ymm3,ymm3
 	vpxor	ymm2,ymm2,ymm3
 	vpclmulqdq	ymm6,ymm2,ymm7,0x00
-
+; Second vector
 	vmovdqu	ymm3,YMMWORD32+rdx
 	vpshufb	ymm3,ymm3,ymm0
 	vmovdqu	ymm4,YMMWORD32+rdi
@@ -741,7 +741,7 @@
 	vpxor	ymm2,ymm2,ymm3
 	vpclmulqdq	ymm2,ymm2,ymm7,0x10
 	vpxor	ymm6,ymm6,ymm2
-
+; Third vector
 	vmovdqu	ymm3,YMMWORD64+rdx
 	vpshufb	ymm3,ymm3,ymm0
 	vmovdqu	ymm4,YMMWORD64+rdi
@@ -754,7 +754,7 @@
 	vpclmulqdq	ymm2,ymm2,ymm8,0x00
 	vpxor	ymm6,ymm6,ymm2
 
-
+; Fourth vector
 	vmovdqu	ymm3,YMMWORD96+rdx
 	vpshufb	ymm3,ymm3,ymm0
 	vmovdqu	ymm4,YMMWORD96+rdi
@@ -766,17 +766,17 @@
 	vpxor	ymm2,ymm2,ymm3
 	vpclmulqdq	ymm2,ymm2,ymm8,0x10
 	vpxor	ymm6,ymm6,ymm2
-
+; Finalize 'mi' following Karatsuba multiplication.
 	vpxor	ymm6,ymm6,ymm5
 	vpxor	ymm6,ymm6,ymm1
 
-
+; Fold lo into mi.
 	vbroadcasti128	ymm4,XMMWORD$L$gfpoly
 	vpclmulqdq	ymm2,ymm4,ymm5,0x01
 	vpshufd	ymm5,ymm5,0x4e
 	vpxor	ymm6,ymm6,ymm5
 	vpxor	ymm6,ymm6,ymm2
-
+; Fold mi into hi.
 	vpclmulqdq	ymm2,ymm4,ymm6,0x01
 	vpshufd	ymm6,ymm6,0x4e
 	vpxor	ymm1,ymm1,ymm6
@@ -786,18 +786,18 @@
 
 	sub	rdx,-128
 $L$crypt_loop_4x_done__func1:
-
+; Check whether any data remains.
 	test	r8,r8
 	jz	NEAR $L$done__func1
 
+; DATALEN is in 16, 32, 48, 64, 80, 96, 112.
 
-
-
-
+; Make POWERS_PTR point to the key powers H^N, H^(N-1), ... where N
+; is the number of blocks that remain.
 	lea	rsi,128+rdi
 	sub	rsi,r8
 
-
+; Start collecting the unreduced GHASH intermediate value LO, MI, HI.
 	vpxor	xmm5,xmm5,xmm5
 	vpxor	xmm6,xmm6,xmm6
 	vpxor	xmm7,xmm7,xmm7
@@ -805,7 +805,7 @@
 	cmp	r8,64
 	jb	NEAR $L$lessthan64bytes__func1
 
-
+; DATALEN is in 64, 80, 96, 112.  Encrypt two vectors of counter blocks.
 	vpshufb	ymm12,ymm11,ymm0
 	vpaddd	ymm11,ymm11,YMMWORD$L$inc_2blocks
 	vpshufb	ymm13,ymm11,ymm0
@@ -823,7 +823,7 @@
 	vaesenclast	ymm12,ymm12,ymm10
 	vaesenclast	ymm13,ymm13,ymm10
 
-
+; XOR the data with the two vectors of keystream blocks.
 	vmovdqu	ymm2,YMMWORDrcx
 	vmovdqu	ymm3,YMMWORD32+rcx
 	vpxor	ymm12,ymm12,ymm2
@@ -831,7 +831,7 @@
 	vmovdqu	YMMWORDrdx,ymm12
 	vmovdqu	YMMWORD32+rdx,ymm13
 
-
+; Update GHASH with two vectors of ciphertext blocks, without reducing.
 	vpshufb	ymm12,ymm12,ymm0
 	vpshufb	ymm13,ymm13,ymm0
 	vpxor	ymm12,ymm12,ymm1
@@ -859,7 +859,7 @@
 
 	vpxor	xmm1,xmm1,xmm1
 
-
+; DATALEN is in 16, 32, 48.  Encrypt two last vectors of counter blocks.
 $L$lessthan64bytes__func1:
 	vpshufb	ymm12,ymm11,ymm0
 	vpaddd	ymm11,ymm11,YMMWORD$L$inc_2blocks
@@ -877,8 +877,8 @@
 	vaesenclast	ymm12,ymm12,ymm10
 	vaesenclast	ymm13,ymm13,ymm10
 
-
-
+; XOR the remaining data with the keystream blocks, and update GHASH with
+; the remaining ciphertext blocks without reducing.
 
 	cmp	r8,32
 	jb	NEAR $L$xor_one_block__func1
@@ -935,7 +935,7 @@
 	vpxor	ymm7,ymm7,ymm4
 
 $L$reduce__func1:
-
+; Finally, do the GHASH reduction.
 	vbroadcasti128	ymm2,XMMWORD$L$gfpoly
 	vpclmulqdq	ymm3,ymm2,ymm5,0x01
 	vpshufd	ymm5,ymm5,0x4e
@@ -949,7 +949,7 @@
 	vpxor	xmm1,xmm1,xmm7
 
 $L$done__func1:
-
+; Store the updated GHASH accumulator back to memory.
 	vpshufb	xmm1,xmm1,xmm0
 	vmovdqu	XMMWORDr12,xmm1
 
@@ -986,9 +986,9 @@
 	push	r12
 $L$SEH_prologue_aes_gcm_dec_update_vaes_avx2_4:
 
-	mov	rsi,QWORD64+rsp
-	mov	rdi,QWORD72+rsp
-	mov	r12,QWORD80+rsp
+	mov	rsi,QWORD64+rsp  ; arg5
+	mov	rdi,QWORD72+rsp  ; arg6
+	mov	r12,QWORD80+rsp  ; arg7
 	sub	rsp,160
 $L$SEH_prologue_aes_gcm_dec_update_vaes_avx2_5:
 	vmovdqa	XMMWORDrsp,xmm6
@@ -1015,30 +1015,30 @@
 $L$SEH_endprologue_aes_gcm_dec_update_vaes_avx2_16:
 	vbroadcasti128	ymm0,XMMWORD$L$bswap_mask
 
-
-
+; Load the GHASH accumulator and the starting counter.
+; BoringSSL passes these values in big endian format.
 	vmovdqu	xmm1,XMMWORDr12
 	vpshufb	xmm1,xmm1,xmm0
 	vbroadcasti128	ymm11,XMMWORDrsi
 	vpshufb	ymm11,ymm11,ymm0
 
-
-
+; Load the AES key length in bytes.  BoringSSL stores number of rounds
+; minus 1, so convert using: AESKEYLEN = 4 * aeskey->rounds - 20.
 	mov	r10d,DWORD240+r9
 	lea	r10d,((-20))+r10*4
 
-
-
-
+; Make RNDKEYLAST_PTR point to the last AES round key.  This is the
+; round key with index 10, 12, or 14 for AES-128, AES-192, or AES-256
+; respectively.  Then load the zero-th and last round keys.
 	lea	r11,96+r10*4+r9
 	vbroadcasti128	ymm9,XMMWORDr9
 	vbroadcasti128	ymm10,XMMWORDr11
 
-
+; Finish initializing LE_CTR by adding 1 to the second block.
 	vpaddd	ymm11,ymm11,YMMWORD$L$ctr_pattern
 
-
-
+; If there are at least 128 bytes of data, then continue into the loop that
+; processes 128 bytes of data at a time.  Otherwise skip it.
 	cmp	r8,127
 	jbe	NEAR $L$crypt_loop_4x_done__func2
 
@@ -1047,9 +1047,9 @@
 ALIGN	16
 $L$crypt_loop_4x__func2:
 
-
-
-
+; Start the AES encryption of the counter blocks.
+; Increment le_ctr four times to generate four vectors of little-endian
+; counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vmovdqu	ymm2,YMMWORD$L$inc_2blocks
 	vpshufb	ymm12,ymm11,ymm0
 	vpaddd	ymm11,ymm11,ymm2
@@ -1060,7 +1060,7 @@
 	vpshufb	ymm15,ymm11,ymm0
 	vpaddd	ymm11,ymm11,ymm2
 
-
+; AES "round zero": XOR in the zero-th round key.
 	vpxor	ymm12,ymm12,ymm9
 	vpxor	ymm13,ymm13,ymm9
 	vpxor	ymm14,ymm14,ymm9
@@ -1069,7 +1069,7 @@
 	cmp	r10d,24
 	jl	NEAR $L$aes128__func2
 	je	NEAR $L$aes192__func2
-
+; AES-256
 	vbroadcasti128	ymm2,XMMWORD((-208))+r11
 	vaesenc	ymm12,ymm12,ymm2
 	vaesenc	ymm13,ymm13,ymm2
@@ -1098,7 +1098,7 @@
 $L$aes128__func2:
 	prefetcht0	512+rcx
 	prefetcht0	((512+64))+rcx
-
+; First vector
 	vmovdqu	ymm3,YMMWORDrcx
 	vpshufb	ymm3,ymm3,ymm0
 	vmovdqu	ymm4,YMMWORDrdi
@@ -1122,7 +1122,7 @@
 	vaesenc	ymm14,ymm14,ymm2
 	vaesenc	ymm15,ymm15,ymm2
 
-
+; Second vector
 	vmovdqu	ymm3,YMMWORD32+rcx
 	vpshufb	ymm3,ymm3,ymm0
 	vmovdqu	ymm4,YMMWORD32+rdi
@@ -1141,7 +1141,7 @@
 	vaesenc	ymm14,ymm14,ymm2
 	vaesenc	ymm15,ymm15,ymm2
 
-
+; Third vector
 	vmovdqu	ymm3,YMMWORD64+rcx
 	vpshufb	ymm3,ymm3,ymm0
 	vmovdqu	ymm4,YMMWORD64+rdi
@@ -1168,7 +1168,7 @@
 	vpclmulqdq	ymm2,ymm2,ymm8,0x00
 	vpxor	ymm6,ymm6,ymm2
 
-
+; Fourth vector
 	vmovdqu	ymm3,YMMWORD96+rcx
 	vpshufb	ymm3,ymm3,ymm0
 
@@ -1194,11 +1194,11 @@
 	vaesenc	ymm14,ymm14,ymm2
 	vaesenc	ymm15,ymm15,ymm2
 
-
+; Finalize 'mi' following Karatsuba multiplication.
 	vpxor	ymm6,ymm6,ymm5
 	vpxor	ymm6,ymm6,ymm1
 
-
+; Fold lo into mi.
 	vbroadcasti128	ymm4,XMMWORD$L$gfpoly
 	vpclmulqdq	ymm2,ymm4,ymm5,0x01
 	vpshufd	ymm5,ymm5,0x4e
@@ -1211,7 +1211,7 @@
 	vaesenc	ymm14,ymm14,ymm2
 	vaesenc	ymm15,ymm15,ymm2
 
-
+; Fold mi into hi.
 	vpclmulqdq	ymm2,ymm4,ymm6,0x01
 	vpshufd	ymm6,ymm6,0x4e
 	vpxor	ymm1,ymm1,ymm6
@@ -1227,7 +1227,7 @@
 	vpxor	xmm1,xmm1,xmm2
 
 
-
+; 128 is 4 bytes, -128 is 1 byte
 	vpxor	ymm2,ymm10,YMMWORDrcx
 	vpxor	ymm3,ymm10,YMMWORD32+rcx
 	vpxor	ymm5,ymm10,YMMWORD64+rcx
@@ -1247,18 +1247,18 @@
 	cmp	r8,127
 	ja	NEAR $L$crypt_loop_4x__func2
 $L$crypt_loop_4x_done__func2:
-
+; Check whether any data remains.
 	test	r8,r8
 	jz	NEAR $L$done__func2
 
+; DATALEN is in 16, 32, 48, 64, 80, 96, 112.
 
-
-
-
+; Make POWERS_PTR point to the key powers H^N, H^(N-1), ... where N
+; is the number of blocks that remain.
 	lea	rsi,128+rdi
 	sub	rsi,r8
 
-
+; Start collecting the unreduced GHASH intermediate value LO, MI, HI.
 	vpxor	xmm5,xmm5,xmm5
 	vpxor	xmm6,xmm6,xmm6
 	vpxor	xmm7,xmm7,xmm7
@@ -1266,7 +1266,7 @@
 	cmp	r8,64
 	jb	NEAR $L$lessthan64bytes__func2
 
-
+; DATALEN is in 64, 80, 96, 112.  Encrypt two vectors of counter blocks.
 	vpshufb	ymm12,ymm11,ymm0
 	vpaddd	ymm11,ymm11,YMMWORD$L$inc_2blocks
 	vpshufb	ymm13,ymm11,ymm0
@@ -1284,7 +1284,7 @@
 	vaesenclast	ymm12,ymm12,ymm10
 	vaesenclast	ymm13,ymm13,ymm10
 
-
+; XOR the data with the two vectors of keystream blocks.
 	vmovdqu	ymm2,YMMWORDrcx
 	vmovdqu	ymm3,YMMWORD32+rcx
 	vpxor	ymm12,ymm12,ymm2
@@ -1292,7 +1292,7 @@
 	vmovdqu	YMMWORDrdx,ymm12
 	vmovdqu	YMMWORD32+rdx,ymm13
 
-
+; Update GHASH with two vectors of ciphertext blocks, without reducing.
 	vpshufb	ymm12,ymm2,ymm0
 	vpshufb	ymm13,ymm3,ymm0
 	vpxor	ymm12,ymm12,ymm1
@@ -1320,7 +1320,7 @@
 
 	vpxor	xmm1,xmm1,xmm1
 
-
+; DATALEN is in 16, 32, 48.  Encrypt two last vectors of counter blocks.
 $L$lessthan64bytes__func2:
 	vpshufb	ymm12,ymm11,ymm0
 	vpaddd	ymm11,ymm11,YMMWORD$L$inc_2blocks
@@ -1338,8 +1338,8 @@
 	vaesenclast	ymm12,ymm12,ymm10
 	vaesenclast	ymm13,ymm13,ymm10
 
-
-
+; XOR the remaining data with the keystream blocks, and update GHASH with
+; the remaining ciphertext blocks without reducing.
 
 	cmp	r8,32
 	jb	NEAR $L$xor_one_block__func2
@@ -1396,7 +1396,7 @@
 	vpxor	ymm7,ymm7,ymm4
 
 $L$reduce__func2:
-
+; Finally, do the GHASH reduction.
 	vbroadcasti128	ymm2,XMMWORD$L$gfpoly
 	vpclmulqdq	ymm3,ymm2,ymm5,0x01
 	vpshufd	ymm5,ymm5,0x4e
@@ -1410,7 +1410,7 @@
 	vpxor	xmm1,xmm1,xmm7
 
 $L$done__func2:
-
+; Store the updated GHASH accumulator back to memory.
 	vpshufb	xmm1,xmm1,xmm0
 	vmovdqu	XMMWORDr12,xmm1
 
@@ -1459,7 +1459,7 @@
 section	.xdata rdata align=8
 ALIGN	4
 $L$SEH_info_gcm_init_vpclmulqdq_avx2_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_gcm_init_vpclmulqdq_avx2_4-$L$SEH_begin_gcm_init_vpclmulqdq_avx2_1
 	DB	3
 	DB	0
@@ -1471,7 +1471,7 @@
 
 	DW	0
 $L$SEH_info_gcm_gmult_vpclmulqdq_avx2_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_gcm_gmult_vpclmulqdq_avx2_4-$L$SEH_begin_gcm_gmult_vpclmulqdq_avx2_1
 	DB	3
 	DB	0
@@ -1483,7 +1483,7 @@
 
 	DW	0
 $L$SEH_info_gcm_ghash_vpclmulqdq_avx2_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_gcm_ghash_vpclmulqdq_avx2_7-$L$SEH_begin_gcm_ghash_vpclmulqdq_avx2_1
 	DB	9
 	DB	0
@@ -1504,7 +1504,7 @@
 
 	DW	0
 $L$SEH_info_aes_gcm_enc_update_vaes_avx2_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_aes_gcm_enc_update_vaes_avx2_16-$L$SEH_begin_aes_gcm_enc_update_vaes_avx2_1
 	DB	25
 	DB	0
@@ -1550,7 +1550,7 @@
 
 	DW	0
 $L$SEH_info_aes_gcm_dec_update_vaes_avx2_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_aes_gcm_dec_update_vaes_avx2_16-$L$SEH_begin_aes_gcm_dec_update_vaes_avx2_1
 	DB	25
 	DB	0

boringssl-0.20260708.tar.xz/gen/bcm/aes-gcm-avx512-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/aes-gcm-avx512-x86_64-apple.S Changed

@@ -9,32 +9,32 @@
 .p2align	6
 aes_gcm_avx512_constants:
 
-
+// A shuffle mask that reflects the bytes of 16-byte blocks
 L$bswap_mask:
 .quad	0x08090a0b0c0d0e0f, 0x0001020304050607
 
-
-
-
-
-
-
-
+// This is the GHASH reducing polynomial without its constant term, i.e.
+// x^128 + x^7 + x^2 + x, represented using the backwards mapping
+// between bits and polynomial coefficients.
+// 
+// Alternatively, it can be interpreted as the naturally-ordered
+// representation of the polynomial x^127 + x^126 + x^121 + 1, i.e. the
+// "reversed" GHASH reducing polynomial without its x^128 term.
 L$gfpoly:
 .quad	1, 0xc200000000000000
 
-
+// Same as above, but with the (1 << 64) bit set.
 L$gfpoly_and_internal_carrybit:
 .quad	1, 0xc200000000000001
 
-
+// Values needed to prepare the initial vector of counter blocks.
 L$ctr_pattern:
 .quad	0, 0
 .quad	1, 0
 .quad	2, 0
 .quad	3, 0
 
-
+// The number of AES blocks per vector, as a 128-bit value.
 L$inc_4blocks:
 .quad	4, 0
 
@@ -47,100 +47,100 @@
 
 
 _CET_ENDBR
-
+// Get pointer to lowest set of key powers (located at end of array).
 	leaq	256-64(%rdi),%r8
 
-
-
+// Load the byte-reflected hash subkey.  BoringSSL provides it in
+// byte-reflected form except the two halves are in the wrong order.
 	vpshufd	$0x4e,(%rsi),%xmm3
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+// Finish preprocessing the first key power, H^1.  Since this GHASH
+// implementation operates directly on values with the backwards bit
+// order specified by the GCM standard, it's necessary to preprocess the
+// raw key as follows.  First, reflect its bytes.  Second, multiply it
+// by x^-1 mod x^128 + x^7 + x^2 + x + 1 (if using the backwards
+// interpretation of polynomial coefficients), which can also be
+// interpreted as multiplication by x mod x^128 + x^127 + x^126 + x^121
+// + 1 using the alternative, natural interpretation of polynomial
+// coefficients.  For details, see the comment above _ghash_mul.
+// 
+// Either way, for the multiplication the concrete operation performed
+// is a left shift of the 128-bit value by 1 bit, then an XOR with (0xc2
+// << 120) | 1 if a 1 bit was carried out.  However, there's no 128-bit
+// wide shift instruction, so instead double each of the two 64-bit
+// halves and incorporate the internal carry bit into the value XOR'd.
 	vpshufd	$0xd3,%xmm3,%xmm0
 	vpsrad	$31,%xmm0,%xmm0
 	vpaddq	%xmm3,%xmm3,%xmm3
-
+// H_CUR_XMM ^= TMP0_XMM & gfpoly_and_internal_carrybit
 	vpternlogd	$0x78,L$gfpoly_and_internal_carrybit(%rip),%xmm0,%xmm3
 
-
+// Load the gfpoly constant.
 	vbroadcasti32x4	L$gfpoly(%rip),%zmm5
 
-
-
-
-
-
-
-
-	vpclmulqdq	$0x00,%xmm3,%xmm3,%xmm0
-	vpclmulqdq	$0x11,%xmm3,%xmm3,%xmm4
-	vpclmulqdq	$0x01,%xmm0,%xmm5,%xmm1
-	vpshufd	$0x4e,%xmm0,%xmm0
-	vpxor	%xmm0,%xmm1,%xmm1
-	vpclmulqdq	$0x01,%xmm1,%xmm5,%xmm0
-	vpshufd	$0x4e,%xmm1,%xmm1
-	vpternlogd	$0x96,%xmm0,%xmm1,%xmm4
-
-
-
+// Square H^1 to get H^2.
+// 
+// Note that as with H^1, all higher key powers also need an extra
+// factor of x^-1 (or x using the natural interpretation).  Nothing
+// special needs to be done to make this happen, though: H^1 * H^1 would
+// end up with two factors of x^-1, but the multiplication consumes one.
+// So the product H^2 ends up with the desired one factor of x^-1.
+	vpclmulqdq	$0x00,%xmm3,%xmm3,%xmm0  // LO = a_L * a_L
+	vpclmulqdq	$0x11,%xmm3,%xmm3,%xmm4  // HI = a_H * a_H
+	vpclmulqdq	$0x01,%xmm0,%xmm5,%xmm1  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm0,%xmm0  // Swap halves of LO
+	vpxor	%xmm0,%xmm1,%xmm1  // Fold LO into MI
+	vpclmulqdq	$0x01,%xmm1,%xmm5,%xmm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm1,%xmm1  // Swap halves of MI
+	vpternlogd	$0x96,%xmm0,%xmm1,%xmm4  // Fold MI into HI
+
+
+// Create H_CUR_YMM = H^2, H^1 and H_INC_YMM = H^2, H^2.
 	vinserti128	$1,%xmm3,%ymm4,%ymm3
 	vinserti128	$1,%xmm4,%ymm4,%ymm4
 
-
-	vpclmulqdq	$0x00,%ymm4,%ymm3,%ymm0
-	vpclmulqdq	$0x01,%ymm4,%ymm3,%ymm1
-	vpclmulqdq	$0x10,%ymm4,%ymm3,%ymm2
-	vpxord	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x01,%ymm0,%ymm5,%ymm2
-	vpshufd	$0x4e,%ymm0,%ymm0
-	vpternlogd	$0x96,%ymm2,%ymm0,%ymm1
-	vpclmulqdq	$0x11,%ymm4,%ymm3,%ymm4
-	vpclmulqdq	$0x01,%ymm1,%ymm5,%ymm0
-	vpshufd	$0x4e,%ymm1,%ymm1
-	vpternlogd	$0x96,%ymm0,%ymm1,%ymm4
+// Create H_CUR = H^4, H^3, H^2, H^1 and H_INC = H^4, H^4, H^4, H^4.
+	vpclmulqdq	$0x00,%ymm4,%ymm3,%ymm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%ymm4,%ymm3,%ymm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%ymm4,%ymm3,%ymm2  // MI_1 = a_H * b_L
+	vpxord	%ymm2,%ymm1,%ymm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%ymm0,%ymm5,%ymm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm0,%ymm0  // Swap halves of LO
+	vpternlogd	$0x96,%ymm2,%ymm0,%ymm1  // Fold LO into MI
+	vpclmulqdq	$0x11,%ymm4,%ymm3,%ymm4  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%ymm1,%ymm5,%ymm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm1,%ymm1  // Swap halves of MI
+	vpternlogd	$0x96,%ymm0,%ymm1,%ymm4  // Fold MI into HI
 
 	vinserti64x4	$1,%ymm3,%zmm4,%zmm3
 	vshufi64x2	$0,%zmm4,%zmm4,%zmm4
 
-
+// Store the lowest set of key powers.
 	vmovdqu8	%zmm3,(%r8)
 
-
-
-
+// Compute and store the remaining key powers.
+// Repeatedly multiply H^(i+3), H^(i+2), H^(i+1), H^i by
+// H^4, H^4, H^4, H^4 to get H^(i+7), H^(i+6), H^(i+5), H^(i+4).
 	movl	$3,%eax
 L$precompute_next:
 	subq	$64,%r8
-	vpclmulqdq	$0x00,%zmm4,%zmm3,%zmm0
-	vpclmulqdq	$0x01,%zmm4,%zmm3,%zmm1
-	vpclmulqdq	$0x10,%zmm4,%zmm3,%zmm2
-	vpxord	%zmm2,%zmm1,%zmm1
-	vpclmulqdq	$0x01,%zmm0,%zmm5,%zmm2
-	vpshufd	$0x4e,%zmm0,%zmm0
-	vpternlogd	$0x96,%zmm2,%zmm0,%zmm1
-	vpclmulqdq	$0x11,%zmm4,%zmm3,%zmm3
-	vpclmulqdq	$0x01,%zmm1,%zmm5,%zmm0
-	vpshufd	$0x4e,%zmm1,%zmm1
-	vpternlogd	$0x96,%zmm0,%zmm1,%zmm3
+	vpclmulqdq	$0x00,%zmm4,%zmm3,%zmm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%zmm4,%zmm3,%zmm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%zmm4,%zmm3,%zmm2  // MI_1 = a_H * b_L
+	vpxord	%zmm2,%zmm1,%zmm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%zmm0,%zmm5,%zmm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%zmm0,%zmm0  // Swap halves of LO
+	vpternlogd	$0x96,%zmm2,%zmm0,%zmm1  // Fold LO into MI
+	vpclmulqdq	$0x11,%zmm4,%zmm3,%zmm3  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%zmm1,%zmm5,%zmm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%zmm1,%zmm1  // Swap halves of MI
+	vpternlogd	$0x96,%zmm0,%zmm1,%zmm3  // Fold MI into HI
 
 	vmovdqu8	%zmm3,(%r8)
 	decl	%eax
 	jnz	L$precompute_next
 
-	vzeroupper
+	vzeroupper  // This is needed after using ymm or zmm registers.
 	ret
 
 
@@ -163,23 +163,23 @@
 	vmovdqu	L$gfpoly(%rip),%xmm3
 	vpshufb	%xmm1,%xmm0,%xmm0
 
-	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm4
-	vpclmulqdq	$0x01,%xmm2,%xmm0,%xmm5
-	vpclmulqdq	$0x10,%xmm2,%xmm0,%xmm6
-	vpxord	%xmm6,%xmm5,%xmm5
-	vpclmulqdq	$0x01,%xmm4,%xmm3,%xmm6
-	vpshufd	$0x4e,%xmm4,%xmm4
-	vpternlogd	$0x96,%xmm6,%xmm4,%xmm5
-	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm0
-	vpclmulqdq	$0x01,%xmm5,%xmm3,%xmm4
-	vpshufd	$0x4e,%xmm5,%xmm5
-	vpternlogd	$0x96,%xmm4,%xmm5,%xmm0
+	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm4  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%xmm2,%xmm0,%xmm5  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%xmm2,%xmm0,%xmm6  // MI_1 = a_H * b_L
+	vpxord	%xmm6,%xmm5,%xmm5  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%xmm4,%xmm3,%xmm6  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm4,%xmm4  // Swap halves of LO
+	vpternlogd	$0x96,%xmm6,%xmm4,%xmm5  // Fold LO into MI
+	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm0  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%xmm5,%xmm3,%xmm4  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm5,%xmm5  // Swap halves of MI
+	vpternlogd	$0x96,%xmm4,%xmm5,%xmm0  // Fold MI into HI
 
 
 	vpshufb	%xmm1,%xmm0,%xmm0
 	vmovdqu	%xmm0,(%rdi)
 
-
+// No need for vzeroupper, since only xmm registers were used.
 	ret
 
 
@@ -196,37 +196,37 @@
 
 
 
-
-
-
+// Load the bswap_mask and gfpoly constants.  Since AADLEN is usually small,
+// usually only 128-bit vectors will be used.  So as an optimization, don't
+// broadcast these constants to all 128-bit lanes quite yet.
 	vmovdqu	L$bswap_mask(%rip),%xmm4
 	vmovdqu	L$gfpoly(%rip),%xmm10
 
-
+// Load the GHASH accumulator.
 	vmovdqu	(%rdi),%xmm5
 	vpshufb	%xmm4,%xmm5,%xmm5
 
-
+// Optimize for AADLEN < 64 by checking for AADLEN < 64 before AADLEN < 256.
 	cmpq	$64,%rcx
 	jb	L$aad_blockbyblock
 
-
-
+// AADLEN >= 64, so we'll operate on full vectors.  Broadcast bswap_mask and
+// gfpoly to all 128-bit lanes.
 	vshufi64x2	$0,%zmm4,%zmm4,%zmm4
 	vshufi64x2	$0,%zmm10,%zmm10,%zmm10
 
-
+// Load the lowest set of key powers.
 	vmovdqu8	256-64(%rsi),%zmm9
 
 	cmpq	$256,%rcx
 	jb	L$aad_loop_1x
 
-
+// AADLEN >= 256.  Load the higher key powers.
 	vmovdqu8	256-256(%rsi),%zmm6
 	vmovdqu8	256-192(%rsi),%zmm7
 	vmovdqu8	256-128(%rsi),%zmm8
 
-
+// Update GHASH with 256 bytes of AAD at a time.
 L$aad_loop_4x:
 	vmovdqu8	0(%rdx),%zmm0
 	vmovdqu8	64(%rdx),%zmm1
@@ -237,36 +237,36 @@
 	vpshufb	%zmm4,%zmm1,%zmm1
 	vpshufb	%zmm4,%zmm2,%zmm2
 	vpshufb	%zmm4,%zmm3,%zmm3
-	vpclmulqdq	$0x00,%zmm6,%zmm0,%zmm5
-	vpclmulqdq	$0x00,%zmm7,%zmm1,%zmm11
-	vpclmulqdq	$0x00,%zmm8,%zmm2,%zmm12
-	vpxord	%zmm11,%zmm5,%zmm5
-	vpclmulqdq	$0x00,%zmm9,%zmm3,%zmm13
-	vpternlogd	$0x96,%zmm13,%zmm12,%zmm5
-	vpclmulqdq	$0x01,%zmm6,%zmm0,%zmm11
-	vpclmulqdq	$0x01,%zmm7,%zmm1,%zmm12
-	vpclmulqdq	$0x01,%zmm8,%zmm2,%zmm13
-	vpternlogd	$0x96,%zmm13,%zmm12,%zmm11
-	vpclmulqdq	$0x01,%zmm9,%zmm3,%zmm12
-	vpclmulqdq	$0x10,%zmm6,%zmm0,%zmm13
-	vpternlogd	$0x96,%zmm13,%zmm12,%zmm11
-	vpclmulqdq	$0x10,%zmm7,%zmm1,%zmm12
-	vpclmulqdq	$0x10,%zmm8,%zmm2,%zmm13
-	vpternlogd	$0x96,%zmm13,%zmm12,%zmm11
-	vpclmulqdq	$0x01,%zmm5,%zmm10,%zmm13
-	vpclmulqdq	$0x10,%zmm9,%zmm3,%zmm12
-	vpxord	%zmm12,%zmm11,%zmm11
-	vpshufd	$0x4e,%zmm5,%zmm5
-	vpclmulqdq	$0x11,%zmm6,%zmm0,%zmm0
-	vpclmulqdq	$0x11,%zmm7,%zmm1,%zmm1
-	vpclmulqdq	$0x11,%zmm8,%zmm2,%zmm2
-	vpternlogd	$0x96,%zmm13,%zmm5,%zmm11
-	vpclmulqdq	$0x11,%zmm9,%zmm3,%zmm3
-	vpternlogd	$0x96,%zmm2,%zmm1,%zmm0
-	vpclmulqdq	$0x01,%zmm11,%zmm10,%zmm12
-	vpxord	%zmm3,%zmm0,%zmm5
-	vpshufd	$0x4e,%zmm11,%zmm11
-	vpternlogd	$0x96,%zmm12,%zmm11,%zmm5
+	vpclmulqdq	$0x00,%zmm6,%zmm0,%zmm5  // LO_0
+	vpclmulqdq	$0x00,%zmm7,%zmm1,%zmm11  // LO_1
+	vpclmulqdq	$0x00,%zmm8,%zmm2,%zmm12  // LO_2
+	vpxord	%zmm11,%zmm5,%zmm5  // sum(LO_{1,0})
+	vpclmulqdq	$0x00,%zmm9,%zmm3,%zmm13  // LO_3
+	vpternlogd	$0x96,%zmm13,%zmm12,%zmm5  // LO = sum(LO_{3,2,1,0})
+	vpclmulqdq	$0x01,%zmm6,%zmm0,%zmm11  // MI_0
+	vpclmulqdq	$0x01,%zmm7,%zmm1,%zmm12  // MI_1
+	vpclmulqdq	$0x01,%zmm8,%zmm2,%zmm13  // MI_2
+	vpternlogd	$0x96,%zmm13,%zmm12,%zmm11  // sum(MI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm9,%zmm3,%zmm12  // MI_3
+	vpclmulqdq	$0x10,%zmm6,%zmm0,%zmm13  // MI_4
+	vpternlogd	$0x96,%zmm13,%zmm12,%zmm11  // sum(MI_{4,3,2,1,0})
+	vpclmulqdq	$0x10,%zmm7,%zmm1,%zmm12  // MI_5
+	vpclmulqdq	$0x10,%zmm8,%zmm2,%zmm13  // MI_6
+	vpternlogd	$0x96,%zmm13,%zmm12,%zmm11  // sum(MI_{6,5,4,3,2,1,0})
+	vpclmulqdq	$0x01,%zmm5,%zmm10,%zmm13  // LO_L*(x^63 + x^62 + x^57)
+	vpclmulqdq	$0x10,%zmm9,%zmm3,%zmm12  // MI_7
+	vpxord	%zmm12,%zmm11,%zmm11  // MI = sum(MI_{7,6,5,4,3,2,1,0})
+	vpshufd	$0x4e,%zmm5,%zmm5  // Swap halves of LO
+	vpclmulqdq	$0x11,%zmm6,%zmm0,%zmm0  // HI_0
+	vpclmulqdq	$0x11,%zmm7,%zmm1,%zmm1  // HI_1
+	vpclmulqdq	$0x11,%zmm8,%zmm2,%zmm2  // HI_2
+	vpternlogd	$0x96,%zmm13,%zmm5,%zmm11  // Fold LO into MI
+	vpclmulqdq	$0x11,%zmm9,%zmm3,%zmm3  // HI_3
+	vpternlogd	$0x96,%zmm2,%zmm1,%zmm0  // sum(HI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm11,%zmm10,%zmm12  // MI_L*(x^63 + x^62 + x^57)
+	vpxord	%zmm3,%zmm0,%zmm5  // HI = sum(HI_{3,2,1,0})
+	vpshufd	$0x4e,%zmm11,%zmm11  // Swap halves of MI
+	vpternlogd	$0x96,%zmm12,%zmm11,%zmm5  // Fold MI into HI
 	vextracti32x4	$1,%zmm5,%xmm0
 	vextracti32x4	$2,%zmm5,%xmm1
 	vextracti32x4	$3,%zmm5,%xmm2
@@ -278,24 +278,24 @@
 	cmpq	$256,%rcx
 	jae	L$aad_loop_4x
 
-
+// Update GHASH with 64 bytes of AAD at a time.
 	cmpq	$64,%rcx
 	jb	L$aad_large_done
 L$aad_loop_1x:
 	vmovdqu8	(%rdx),%zmm0
 	vpshufb	%zmm4,%zmm0,%zmm0
 	vpxord	%zmm0,%zmm5,%zmm5
-	vpclmulqdq	$0x00,%zmm9,%zmm5,%zmm0
-	vpclmulqdq	$0x01,%zmm9,%zmm5,%zmm1
-	vpclmulqdq	$0x10,%zmm9,%zmm5,%zmm2
-	vpxord	%zmm2,%zmm1,%zmm1
-	vpclmulqdq	$0x01,%zmm0,%zmm10,%zmm2
-	vpshufd	$0x4e,%zmm0,%zmm0
-	vpternlogd	$0x96,%zmm2,%zmm0,%zmm1
-	vpclmulqdq	$0x11,%zmm9,%zmm5,%zmm5
-	vpclmulqdq	$0x01,%zmm1,%zmm10,%zmm0
-	vpshufd	$0x4e,%zmm1,%zmm1
-	vpternlogd	$0x96,%zmm0,%zmm1,%zmm5
+	vpclmulqdq	$0x00,%zmm9,%zmm5,%zmm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%zmm9,%zmm5,%zmm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%zmm9,%zmm5,%zmm2  // MI_1 = a_H * b_L
+	vpxord	%zmm2,%zmm1,%zmm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%zmm0,%zmm10,%zmm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%zmm0,%zmm0  // Swap halves of LO
+	vpternlogd	$0x96,%zmm2,%zmm0,%zmm1  // Fold LO into MI
+	vpclmulqdq	$0x11,%zmm9,%zmm5,%zmm5  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%zmm1,%zmm10,%zmm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%zmm1,%zmm1  // Swap halves of MI
+	vpternlogd	$0x96,%zmm0,%zmm1,%zmm5  // Fold MI into HI
 
 	vextracti32x4	$1,%zmm5,%xmm0
 	vextracti32x4	$2,%zmm5,%xmm1
@@ -310,7 +310,7 @@
 
 L$aad_large_done:
 
-
+// GHASH the remaining data 16 bytes at a time, using xmm registers only.
 L$aad_blockbyblock:
 	testq	%rcx,%rcx
 	jz	L$aad_done
@@ -319,28 +319,28 @@
 	vmovdqu	(%rdx),%xmm0
 	vpshufb	%xmm4,%xmm0,%xmm0
 	vpxor	%xmm0,%xmm5,%xmm5
-	vpclmulqdq	$0x00,%xmm9,%xmm5,%xmm0
-	vpclmulqdq	$0x01,%xmm9,%xmm5,%xmm1
-	vpclmulqdq	$0x10,%xmm9,%xmm5,%xmm2
-	vpxord	%xmm2,%xmm1,%xmm1
-	vpclmulqdq	$0x01,%xmm0,%xmm10,%xmm2
-	vpshufd	$0x4e,%xmm0,%xmm0
-	vpternlogd	$0x96,%xmm2,%xmm0,%xmm1
-	vpclmulqdq	$0x11,%xmm9,%xmm5,%xmm5
-	vpclmulqdq	$0x01,%xmm1,%xmm10,%xmm0
-	vpshufd	$0x4e,%xmm1,%xmm1
-	vpternlogd	$0x96,%xmm0,%xmm1,%xmm5
+	vpclmulqdq	$0x00,%xmm9,%xmm5,%xmm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%xmm9,%xmm5,%xmm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%xmm9,%xmm5,%xmm2  // MI_1 = a_H * b_L
+	vpxord	%xmm2,%xmm1,%xmm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%xmm0,%xmm10,%xmm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm0,%xmm0  // Swap halves of LO
+	vpternlogd	$0x96,%xmm2,%xmm0,%xmm1  // Fold LO into MI
+	vpclmulqdq	$0x11,%xmm9,%xmm5,%xmm5  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%xmm1,%xmm10,%xmm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm1,%xmm1  // Swap halves of MI
+	vpternlogd	$0x96,%xmm0,%xmm1,%xmm5  // Fold MI into HI
 
 	addq	$16,%rdx
 	subq	$16,%rcx
 	jnz	L$aad_loop_blockbyblock
 
 L$aad_done:
-
+// Store the updated GHASH accumulator back to memory.
 	vpshufb	%xmm4,%xmm5,%xmm5
 	vmovdqu	%xmm5,(%rdi)
 
-	vzeroupper
+	vzeroupper  // This is needed after using ymm or zmm registers.
 	ret
 
 
@@ -357,54 +357,54 @@
 	pushq	%r12
 
 
-	movq	16(%rsp),%r12
+	movq	16(%rsp),%r12  // arg7
 #ifdef BORINGSSL_DISPATCH_TEST
 
 	movb	$1,_BORINGSSL_function_hit+7(%rip)
 #endif
-
+// Load some constants.
 	vbroadcasti32x4	L$bswap_mask(%rip),%zmm8
 	vbroadcasti32x4	L$gfpoly(%rip),%zmm31
 
-
-
+// Load the GHASH accumulator and the starting counter.
+// BoringSSL passes these values in big endian format.
 	vmovdqu	(%r12),%xmm10
 	vpshufb	%xmm8,%xmm10,%xmm10
 	vbroadcasti32x4	(%r8),%zmm12
 	vpshufb	%zmm8,%zmm12,%zmm12
 
-
-
+// Load the AES key length in bytes.  BoringSSL stores number of rounds
+// minus 1, so convert using: AESKEYLEN = 4 * aeskey->rounds - 20.
 	movl	240(%rcx),%r10d
 	leal	-20(,%r10,4),%r10d
 
-
-
-
+// Make RNDKEYLAST_PTR point to the last AES round key.  This is the
+// round key with index 10, 12, or 14 for AES-128, AES-192, or AES-256
+// respectively.  Then load the zero-th and last round keys.
 	leaq	96(%rcx,%r10,4),%r11
 	vbroadcasti32x4	(%rcx),%zmm13
 	vbroadcasti32x4	(%r11),%zmm14
 
-
+// Finish initializing LE_CTR by adding 0, 1, 2, 3 to its low words.
 	vpaddd	L$ctr_pattern(%rip),%zmm12,%zmm12
 
-
+// Load 4 into all 128-bit lanes of LE_CTR_INC.
 	vbroadcasti32x4	L$inc_4blocks(%rip),%zmm11
 
-
-
+// If there are at least 256 bytes of data, then continue into the loop
+// that processes 256 bytes of data at a time.  Otherwise skip it.
 	cmpq	$256,%rdx
 	jb	L$crypt_loop_4x_done__func1
 
-
+// Load powers of the hash key.
 	vmovdqu8	256-256(%r9),%zmm27
 	vmovdqu8	256-192(%r9),%zmm28
 	vmovdqu8	256-128(%r9),%zmm29
 	vmovdqu8	256-64(%r9),%zmm30
-
-
-
-
+// Encrypt the first 4 vectors of plaintext blocks.  Leave the resulting
+// ciphertext in GHASHDATA0-3 for GHASH.
+// Increment le_ctr four times to generate four vectors of little-endian
+// counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpaddd	%zmm11,%zmm12,%zmm12
 	vpshufb	%zmm8,%zmm12,%zmm1
@@ -414,7 +414,7 @@
 	vpshufb	%zmm8,%zmm12,%zmm3
 	vpaddd	%zmm11,%zmm12,%zmm12
 
-
+// AES "round zero": XOR in the zero-th round key.
 	vpxord	%zmm13,%zmm0,%zmm0
 	vpxord	%zmm13,%zmm1,%zmm1
 	vpxord	%zmm13,%zmm2,%zmm2
@@ -449,7 +449,7 @@
 	subq	$256,%rdx
 	cmpq	$256,%rdx
 	jb	L$ghash_last_ciphertext_4x__func1
-
+// Cache as many additional AES round keys as possible.
 	vbroadcasti32x4	-144(%r11),%zmm15
 	vbroadcasti32x4	-128(%r11),%zmm16
 	vbroadcasti32x4	-112(%r11),%zmm17
@@ -461,9 +461,9 @@
 	vbroadcasti32x4	-16(%r11),%zmm23
 
 L$crypt_loop_4x__func1:
-
-
-
+// Start the AES encryption of the counter blocks.
+// Increment le_ctr four times to generate four vectors of little-endian
+// counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpaddd	%zmm11,%zmm12,%zmm12
 	vpshufb	%zmm8,%zmm12,%zmm1
@@ -473,7 +473,7 @@
 	vpshufb	%zmm8,%zmm12,%zmm3
 	vpaddd	%zmm11,%zmm12,%zmm12
 
-
+// AES "round zero": XOR in the zero-th round key.
 	vpxord	%zmm13,%zmm0,%zmm0
 	vpxord	%zmm13,%zmm1,%zmm1
 	vpxord	%zmm13,%zmm2,%zmm2
@@ -482,7 +482,7 @@
 	cmpl	$24,%r10d
 	jl	L$aes128__func1
 	je	L$aes192__func1
-
+// AES-256
 	vbroadcasti32x4	-208(%r11),%zmm9
 	vaesenc	%zmm9,%zmm0,%zmm0
 	vaesenc	%zmm9,%zmm1,%zmm1
@@ -510,17 +510,17 @@
 
 L$aes128__func1:
 
-
-
-
+// Prefetch the source data 512 bytes ahead into the L1 data cache, to
+// improve performance when the hardware prefetcher is disabled.  Assumes the
+// L1 data cache line size is 64 bytes (de facto standard on x86_64).
 	prefetcht0	512+0(%rdi)
 	prefetcht0	512+64(%rdi)
 	prefetcht0	512+128(%rdi)
 	prefetcht0	512+192(%rdi)
 
-
-
-
+// Finish the AES encryption of the counter blocks in AESDATA0-3,
+// interleaved with the GHASH update of the ciphertext blocks in
+// GHASHDATA0-3.
 	vpshufb	%zmm8,%zmm4,%zmm4
 	vpxord	%zmm10,%zmm4,%zmm4
 	vpshufb	%zmm8,%zmm5,%zmm5
@@ -532,78 +532,78 @@
 	vaesenc	%zmm15,%zmm3,%zmm3
 
 	vpshufb	%zmm8,%zmm7,%zmm7
-	vpclmulqdq	$0x00,%zmm27,%zmm4,%zmm10
-	vpclmulqdq	$0x00,%zmm28,%zmm5,%zmm24
-	vpclmulqdq	$0x00,%zmm29,%zmm6,%zmm25
+	vpclmulqdq	$0x00,%zmm27,%zmm4,%zmm10  // LO_0
+	vpclmulqdq	$0x00,%zmm28,%zmm5,%zmm24  // LO_1
+	vpclmulqdq	$0x00,%zmm29,%zmm6,%zmm25  // LO_2
 
 	vaesenc	%zmm16,%zmm0,%zmm0
 	vaesenc	%zmm16,%zmm1,%zmm1
 	vaesenc	%zmm16,%zmm2,%zmm2
 	vaesenc	%zmm16,%zmm3,%zmm3
 
-	vpxord	%zmm24,%zmm10,%zmm10
-	vpclmulqdq	$0x00,%zmm30,%zmm7,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm10
-	vpclmulqdq	$0x01,%zmm27,%zmm4,%zmm24
+	vpxord	%zmm24,%zmm10,%zmm10  // sum(LO_{1,0})
+	vpclmulqdq	$0x00,%zmm30,%zmm7,%zmm26  // LO_3
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm10  // LO = sum(LO_{3,2,1,0})
+	vpclmulqdq	$0x01,%zmm27,%zmm4,%zmm24  // MI_0
 
 	vaesenc	%zmm17,%zmm0,%zmm0
 	vaesenc	%zmm17,%zmm1,%zmm1
 	vaesenc	%zmm17,%zmm2,%zmm2
 	vaesenc	%zmm17,%zmm3,%zmm3
 
-	vpclmulqdq	$0x01,%zmm28,%zmm5,%zmm25
-	vpclmulqdq	$0x01,%zmm29,%zmm6,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x01,%zmm30,%zmm7,%zmm25
+	vpclmulqdq	$0x01,%zmm28,%zmm5,%zmm25  // MI_1
+	vpclmulqdq	$0x01,%zmm29,%zmm6,%zmm26  // MI_2
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm30,%zmm7,%zmm25  // MI_3
 
 	vaesenc	%zmm18,%zmm0,%zmm0
 	vaesenc	%zmm18,%zmm1,%zmm1
 	vaesenc	%zmm18,%zmm2,%zmm2
 	vaesenc	%zmm18,%zmm3,%zmm3
 
-	vpclmulqdq	$0x10,%zmm27,%zmm4,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x10,%zmm28,%zmm5,%zmm25
-	vpclmulqdq	$0x10,%zmm29,%zmm6,%zmm26
+	vpclmulqdq	$0x10,%zmm27,%zmm4,%zmm26  // MI_4
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{4,3,2,1,0})
+	vpclmulqdq	$0x10,%zmm28,%zmm5,%zmm25  // MI_5
+	vpclmulqdq	$0x10,%zmm29,%zmm6,%zmm26  // MI_6
 
 	vaesenc	%zmm19,%zmm0,%zmm0
 	vaesenc	%zmm19,%zmm1,%zmm1
 	vaesenc	%zmm19,%zmm2,%zmm2
 	vaesenc	%zmm19,%zmm3,%zmm3
 
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x01,%zmm10,%zmm31,%zmm26
-	vpclmulqdq	$0x10,%zmm30,%zmm7,%zmm25
-	vpxord	%zmm25,%zmm24,%zmm24
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{6,5,4,3,2,1,0})
+	vpclmulqdq	$0x01,%zmm10,%zmm31,%zmm26  // LO_L*(x^63 + x^62 + x^57)
+	vpclmulqdq	$0x10,%zmm30,%zmm7,%zmm25  // MI_7
+	vpxord	%zmm25,%zmm24,%zmm24  // MI = sum(MI_{7,6,5,4,3,2,1,0})
 
 	vaesenc	%zmm20,%zmm0,%zmm0
 	vaesenc	%zmm20,%zmm1,%zmm1
 	vaesenc	%zmm20,%zmm2,%zmm2
 	vaesenc	%zmm20,%zmm3,%zmm3
 
-	vpshufd	$0x4e,%zmm10,%zmm10
-	vpclmulqdq	$0x11,%zmm27,%zmm4,%zmm4
-	vpclmulqdq	$0x11,%zmm28,%zmm5,%zmm5
-	vpclmulqdq	$0x11,%zmm29,%zmm6,%zmm6
+	vpshufd	$0x4e,%zmm10,%zmm10  // Swap halves of LO
+	vpclmulqdq	$0x11,%zmm27,%zmm4,%zmm4  // HI_0
+	vpclmulqdq	$0x11,%zmm28,%zmm5,%zmm5  // HI_1
+	vpclmulqdq	$0x11,%zmm29,%zmm6,%zmm6  // HI_2
 
 	vaesenc	%zmm21,%zmm0,%zmm0
 	vaesenc	%zmm21,%zmm1,%zmm1
 	vaesenc	%zmm21,%zmm2,%zmm2
 	vaesenc	%zmm21,%zmm3,%zmm3
 
-	vpternlogd	$0x96,%zmm26,%zmm10,%zmm24
-	vpclmulqdq	$0x11,%zmm30,%zmm7,%zmm7
-	vpternlogd	$0x96,%zmm6,%zmm5,%zmm4
-	vpclmulqdq	$0x01,%zmm24,%zmm31,%zmm25
+	vpternlogd	$0x96,%zmm26,%zmm10,%zmm24  // Fold LO into MI
+	vpclmulqdq	$0x11,%zmm30,%zmm7,%zmm7  // HI_3
+	vpternlogd	$0x96,%zmm6,%zmm5,%zmm4  // sum(HI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm24,%zmm31,%zmm25  // MI_L*(x^63 + x^62 + x^57)
 
 	vaesenc	%zmm22,%zmm0,%zmm0
 	vaesenc	%zmm22,%zmm1,%zmm1
 	vaesenc	%zmm22,%zmm2,%zmm2
 	vaesenc	%zmm22,%zmm3,%zmm3
 
-	vpxord	%zmm7,%zmm4,%zmm10
-	vpshufd	$0x4e,%zmm24,%zmm24
-	vpternlogd	$0x96,%zmm25,%zmm24,%zmm10
+	vpxord	%zmm7,%zmm4,%zmm10  // HI = sum(HI_{3,2,1,0})
+	vpshufd	$0x4e,%zmm24,%zmm24  // Swap halves of MI
+	vpternlogd	$0x96,%zmm25,%zmm24,%zmm10  // Fold MI into HI
 
 	vaesenc	%zmm23,%zmm0,%zmm0
 	vaesenc	%zmm23,%zmm1,%zmm1
@@ -641,36 +641,36 @@
 	vpshufb	%zmm8,%zmm5,%zmm5
 	vpshufb	%zmm8,%zmm6,%zmm6
 	vpshufb	%zmm8,%zmm7,%zmm7
-	vpclmulqdq	$0x00,%zmm27,%zmm4,%zmm10
-	vpclmulqdq	$0x00,%zmm28,%zmm5,%zmm24
-	vpclmulqdq	$0x00,%zmm29,%zmm6,%zmm25
-	vpxord	%zmm24,%zmm10,%zmm10
-	vpclmulqdq	$0x00,%zmm30,%zmm7,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm10
-	vpclmulqdq	$0x01,%zmm27,%zmm4,%zmm24
-	vpclmulqdq	$0x01,%zmm28,%zmm5,%zmm25
-	vpclmulqdq	$0x01,%zmm29,%zmm6,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x01,%zmm30,%zmm7,%zmm25
-	vpclmulqdq	$0x10,%zmm27,%zmm4,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x10,%zmm28,%zmm5,%zmm25
-	vpclmulqdq	$0x10,%zmm29,%zmm6,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x01,%zmm10,%zmm31,%zmm26
-	vpclmulqdq	$0x10,%zmm30,%zmm7,%zmm25
-	vpxord	%zmm25,%zmm24,%zmm24
-	vpshufd	$0x4e,%zmm10,%zmm10
-	vpclmulqdq	$0x11,%zmm27,%zmm4,%zmm4
-	vpclmulqdq	$0x11,%zmm28,%zmm5,%zmm5
-	vpclmulqdq	$0x11,%zmm29,%zmm6,%zmm6
-	vpternlogd	$0x96,%zmm26,%zmm10,%zmm24
-	vpclmulqdq	$0x11,%zmm30,%zmm7,%zmm7
-	vpternlogd	$0x96,%zmm6,%zmm5,%zmm4
-	vpclmulqdq	$0x01,%zmm24,%zmm31,%zmm25
-	vpxord	%zmm7,%zmm4,%zmm10
-	vpshufd	$0x4e,%zmm24,%zmm24
-	vpternlogd	$0x96,%zmm25,%zmm24,%zmm10
+	vpclmulqdq	$0x00,%zmm27,%zmm4,%zmm10  // LO_0
+	vpclmulqdq	$0x00,%zmm28,%zmm5,%zmm24  // LO_1
+	vpclmulqdq	$0x00,%zmm29,%zmm6,%zmm25  // LO_2
+	vpxord	%zmm24,%zmm10,%zmm10  // sum(LO_{1,0})
+	vpclmulqdq	$0x00,%zmm30,%zmm7,%zmm26  // LO_3
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm10  // LO = sum(LO_{3,2,1,0})
+	vpclmulqdq	$0x01,%zmm27,%zmm4,%zmm24  // MI_0
+	vpclmulqdq	$0x01,%zmm28,%zmm5,%zmm25  // MI_1
+	vpclmulqdq	$0x01,%zmm29,%zmm6,%zmm26  // MI_2
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm30,%zmm7,%zmm25  // MI_3
+	vpclmulqdq	$0x10,%zmm27,%zmm4,%zmm26  // MI_4
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{4,3,2,1,0})
+	vpclmulqdq	$0x10,%zmm28,%zmm5,%zmm25  // MI_5
+	vpclmulqdq	$0x10,%zmm29,%zmm6,%zmm26  // MI_6
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{6,5,4,3,2,1,0})
+	vpclmulqdq	$0x01,%zmm10,%zmm31,%zmm26  // LO_L*(x^63 + x^62 + x^57)
+	vpclmulqdq	$0x10,%zmm30,%zmm7,%zmm25  // MI_7
+	vpxord	%zmm25,%zmm24,%zmm24  // MI = sum(MI_{7,6,5,4,3,2,1,0})
+	vpshufd	$0x4e,%zmm10,%zmm10  // Swap halves of LO
+	vpclmulqdq	$0x11,%zmm27,%zmm4,%zmm4  // HI_0
+	vpclmulqdq	$0x11,%zmm28,%zmm5,%zmm5  // HI_1
+	vpclmulqdq	$0x11,%zmm29,%zmm6,%zmm6  // HI_2
+	vpternlogd	$0x96,%zmm26,%zmm10,%zmm24  // Fold LO into MI
+	vpclmulqdq	$0x11,%zmm30,%zmm7,%zmm7  // HI_3
+	vpternlogd	$0x96,%zmm6,%zmm5,%zmm4  // sum(HI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm24,%zmm31,%zmm25  // MI_L*(x^63 + x^62 + x^57)
+	vpxord	%zmm7,%zmm4,%zmm10  // HI = sum(HI_{3,2,1,0})
+	vpshufd	$0x4e,%zmm24,%zmm24  // Swap halves of MI
+	vpternlogd	$0x96,%zmm25,%zmm24,%zmm10  // Fold MI into HI
 	vextracti32x4	$1,%zmm10,%xmm4
 	vextracti32x4	$2,%zmm10,%xmm5
 	vextracti32x4	$3,%zmm10,%xmm6
@@ -678,32 +678,32 @@
 	vpternlogd	$0x96,%xmm5,%xmm6,%xmm10
 
 L$crypt_loop_4x_done__func1:
-
+// Check whether any data remains.
 	testq	%rdx,%rdx
 	jz	L$done__func1
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+// The data length isn't a multiple of 256 bytes.  Process the remaining
+// data of length 1 <= DATALEN < 256, up to one 64-byte vector at a time.
+// Going one vector at a time may seem inefficient compared to having
+// separate code paths for each possible number of vectors remaining.
+// However, using a loop keeps the code size down, and it performs
+// surprising well; modern CPUs will start executing the next iteration
+// before the previous one finishes and also predict the number of loop
+// iterations.  For a similar reason, we roll up the AES rounds.
+// 
+// On the last iteration, the remaining length may be less than 64 bytes.
+// Handle this using masking.
+// 
+// Since there are enough key powers available for all remaining data,
+// there is no need to do a GHASH reduction after each iteration.
+// Instead, multiply each remaining block by its own key power, and only
+// do a GHASH reduction at the very end.
+
+// Make POWERS_PTR point to the key powers H^N, H^(N-1), ... where N
+// is the number of blocks that remain.
 	movq	%rdx,%rax
 	negq	%rax
-	andq	$-16,%rax
+	andq	$-16,%rax  // -round_up(DATALEN, 16)
 	leaq	256(%r9,%rax,1),%r8
 	vpxor	%xmm4,%xmm4,%xmm4
 	vpxor	%xmm5,%xmm5,%xmm5
@@ -713,9 +713,9 @@
 	jb	L$partial_vec__func1
 
 L$crypt_loop_1x__func1:
+// Process a full 64-byte vector.
 
-
-
+// Encrypt a vector of counter blocks.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpaddd	%zmm11,%zmm12,%zmm12
 	vpxord	%zmm13,%zmm0,%zmm0
@@ -728,19 +728,19 @@
 	jne	L$vaesenc_loop_tail_full_vec__func1
 	vaesenclast	%zmm14,%zmm0,%zmm0
 
-
+// XOR the data with the vector of keystream blocks.
 	vmovdqu8	(%rdi),%zmm1
 	vpxord	%zmm1,%zmm0,%zmm0
 	vmovdqu8	%zmm0,(%rsi)
 
-
+// Update GHASH with the ciphertext blocks, without reducing.
 	vmovdqu8	(%r8),%zmm30
 	vpshufb	%zmm8,%zmm0,%zmm0
 	vpxord	%zmm10,%zmm0,%zmm0
-	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7
-	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1
-	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2
-	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3
+	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7  // a_L * b_L
+	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1  // a_L * b_H
+	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2  // a_H * b_L
+	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3  // a_H * b_H
 	vpxord	%zmm7,%zmm4,%zmm4
 	vpternlogd	$0x96,%zmm2,%zmm1,%zmm5
 	vpxord	%zmm3,%zmm6,%zmm6
@@ -758,10 +758,10 @@
 	jz	L$reduce__func1
 
 L$partial_vec__func1:
+// Process a partial vector of length 1 <= DATALEN < 64.
 
-
-
-
+// Set the data mask %k1 to DATALEN 1's.
+// Set the key powers mask %k2 to round_up(DATALEN, 16) 1's.
 	movq	$-1,%rax
 	bzhiq	%rdx,%rax,%rax
 	kmovq	%rax,%k1
@@ -771,8 +771,8 @@
 	bzhiq	%rdx,%rax,%rax
 	kmovq	%rax,%k2
 
-
-
+// Encrypt one last vector of counter blocks.  This does not need to be
+// masked.  The counter does not need to be incremented here.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpxord	%zmm13,%zmm0,%zmm0
 	leaq	16(%rcx),%rax
@@ -784,38 +784,38 @@
 	jne	L$vaesenc_loop_tail_partialvec__func1
 	vaesenclast	%zmm14,%zmm0,%zmm0
 
-
+// XOR the data with the appropriate number of keystream bytes.
 	vmovdqu8	(%rdi),%zmm1{%k1}{z}
 	vpxord	%zmm1,%zmm0,%zmm0
 	vmovdqu8	%zmm0,(%rsi){%k1}
 
-
-
-
-
-
-
-
-
-
-
-
-
+// Update GHASH with the ciphertext block(s), without reducing.
+// 
+// In the case of DATALEN < 64, the ciphertext is zero-padded to 64
+// bytes.  (If decrypting, it's done by the above masked load.  If
+// encrypting, it's done by the below masked register-to-register move.)
+// Note that if DATALEN <= 48, there will be additional padding beyond
+// the padding of the last block specified by GHASH itself; i.e., there
+// may be whole block(s) that get processed by the GHASH multiplication
+// and reduction instructions but should not actually be included in the
+// GHASH.  However, any such blocks are all-zeroes, and the values that
+// they're multiplied with are also all-zeroes.  Therefore they just add
+// 0 * 0 = 0 to the final GHASH result, which makes no difference.
 	vmovdqu8	(%r8),%zmm30{%k2}{z}
 	vmovdqu8	%zmm0,%zmm1{%k1}{z}
 	vpshufb	%zmm8,%zmm1,%zmm0
 	vpxord	%zmm10,%zmm0,%zmm0
-	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7
-	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1
-	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2
-	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3
+	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7  // a_L * b_L
+	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1  // a_L * b_H
+	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2  // a_H * b_L
+	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3  // a_H * b_H
 	vpxord	%zmm7,%zmm4,%zmm4
 	vpternlogd	$0x96,%zmm2,%zmm1,%zmm5
 	vpxord	%zmm3,%zmm6,%zmm6
 
 
 L$reduce__func1:
-
+// Finally, do the GHASH reduction.
 	vpclmulqdq	$0x01,%zmm4,%zmm31,%zmm0
 	vpshufd	$0x4e,%zmm4,%zmm4
 	vpternlogd	$0x96,%zmm0,%zmm4,%zmm5
@@ -831,11 +831,11 @@
 
 
 L$done__func1:
-
+// Store the updated GHASH accumulator back to memory.
 	vpshufb	%xmm8,%xmm10,%xmm10
 	vmovdqu	%xmm10,(%r12)
 
-	vzeroupper
+	vzeroupper  // This is needed after using ymm or zmm registers.
 	popq	%r12
 
 	ret
@@ -854,47 +854,47 @@
 	pushq	%r12
 
 
-	movq	16(%rsp),%r12
-
+	movq	16(%rsp),%r12  // arg7
+// Load some constants.
 	vbroadcasti32x4	L$bswap_mask(%rip),%zmm8
 	vbroadcasti32x4	L$gfpoly(%rip),%zmm31
 
-
-
+// Load the GHASH accumulator and the starting counter.
+// BoringSSL passes these values in big endian format.
 	vmovdqu	(%r12),%xmm10
 	vpshufb	%xmm8,%xmm10,%xmm10
 	vbroadcasti32x4	(%r8),%zmm12
 	vpshufb	%zmm8,%zmm12,%zmm12
 
-
-
+// Load the AES key length in bytes.  BoringSSL stores number of rounds
+// minus 1, so convert using: AESKEYLEN = 4 * aeskey->rounds - 20.
 	movl	240(%rcx),%r10d
 	leal	-20(,%r10,4),%r10d
 
-
-
-
+// Make RNDKEYLAST_PTR point to the last AES round key.  This is the
+// round key with index 10, 12, or 14 for AES-128, AES-192, or AES-256
+// respectively.  Then load the zero-th and last round keys.
 	leaq	96(%rcx,%r10,4),%r11
 	vbroadcasti32x4	(%rcx),%zmm13
 	vbroadcasti32x4	(%r11),%zmm14
 
-
+// Finish initializing LE_CTR by adding 0, 1, 2, 3 to its low words.
 	vpaddd	L$ctr_pattern(%rip),%zmm12,%zmm12
 
-
+// Load 4 into all 128-bit lanes of LE_CTR_INC.
 	vbroadcasti32x4	L$inc_4blocks(%rip),%zmm11
 
-
-
+// If there are at least 256 bytes of data, then continue into the loop
+// that processes 256 bytes of data at a time.  Otherwise skip it.
 	cmpq	$256,%rdx
 	jb	L$crypt_loop_4x_done__func2
 
-
+// Load powers of the hash key.
 	vmovdqu8	256-256(%r9),%zmm27
 	vmovdqu8	256-192(%r9),%zmm28
 	vmovdqu8	256-128(%r9),%zmm29
 	vmovdqu8	256-64(%r9),%zmm30
-
+// Cache as many additional AES round keys as possible.
 	vbroadcasti32x4	-144(%r11),%zmm15
 	vbroadcasti32x4	-128(%r11),%zmm16
 	vbroadcasti32x4	-112(%r11),%zmm17
@@ -910,9 +910,9 @@
 	vmovdqu8	64(%rdi),%zmm5
 	vmovdqu8	128(%rdi),%zmm6
 	vmovdqu8	192(%rdi),%zmm7
-
-
-
+// Start the AES encryption of the counter blocks.
+// Increment le_ctr four times to generate four vectors of little-endian
+// counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpaddd	%zmm11,%zmm12,%zmm12
 	vpshufb	%zmm8,%zmm12,%zmm1
@@ -922,7 +922,7 @@
 	vpshufb	%zmm8,%zmm12,%zmm3
 	vpaddd	%zmm11,%zmm12,%zmm12
 
-
+// AES "round zero": XOR in the zero-th round key.
 	vpxord	%zmm13,%zmm0,%zmm0
 	vpxord	%zmm13,%zmm1,%zmm1
 	vpxord	%zmm13,%zmm2,%zmm2
@@ -931,7 +931,7 @@
 	cmpl	$24,%r10d
 	jl	L$aes128__func2
 	je	L$aes192__func2
-
+// AES-256
 	vbroadcasti32x4	-208(%r11),%zmm9
 	vaesenc	%zmm9,%zmm0,%zmm0
 	vaesenc	%zmm9,%zmm1,%zmm1
@@ -959,17 +959,17 @@
 
 L$aes128__func2:
 
-
-
-
+// Prefetch the source data 512 bytes ahead into the L1 data cache, to
+// improve performance when the hardware prefetcher is disabled.  Assumes the
+// L1 data cache line size is 64 bytes (de facto standard on x86_64).
 	prefetcht0	512+0(%rdi)
 	prefetcht0	512+64(%rdi)
 	prefetcht0	512+128(%rdi)
 	prefetcht0	512+192(%rdi)
 
-
-
-
+// Finish the AES encryption of the counter blocks in AESDATA0-3,
+// interleaved with the GHASH update of the ciphertext blocks in
+// GHASHDATA0-3.
 	vpshufb	%zmm8,%zmm4,%zmm4
 	vpxord	%zmm10,%zmm4,%zmm4
 	vpshufb	%zmm8,%zmm5,%zmm5
@@ -981,78 +981,78 @@
 	vaesenc	%zmm15,%zmm3,%zmm3
 
 	vpshufb	%zmm8,%zmm7,%zmm7
-	vpclmulqdq	$0x00,%zmm27,%zmm4,%zmm10
-	vpclmulqdq	$0x00,%zmm28,%zmm5,%zmm24
-	vpclmulqdq	$0x00,%zmm29,%zmm6,%zmm25
+	vpclmulqdq	$0x00,%zmm27,%zmm4,%zmm10  // LO_0
+	vpclmulqdq	$0x00,%zmm28,%zmm5,%zmm24  // LO_1
+	vpclmulqdq	$0x00,%zmm29,%zmm6,%zmm25  // LO_2
 
 	vaesenc	%zmm16,%zmm0,%zmm0
 	vaesenc	%zmm16,%zmm1,%zmm1
 	vaesenc	%zmm16,%zmm2,%zmm2
 	vaesenc	%zmm16,%zmm3,%zmm3
 
-	vpxord	%zmm24,%zmm10,%zmm10
-	vpclmulqdq	$0x00,%zmm30,%zmm7,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm10
-	vpclmulqdq	$0x01,%zmm27,%zmm4,%zmm24
+	vpxord	%zmm24,%zmm10,%zmm10  // sum(LO_{1,0})
+	vpclmulqdq	$0x00,%zmm30,%zmm7,%zmm26  // LO_3
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm10  // LO = sum(LO_{3,2,1,0})
+	vpclmulqdq	$0x01,%zmm27,%zmm4,%zmm24  // MI_0
 
 	vaesenc	%zmm17,%zmm0,%zmm0
 	vaesenc	%zmm17,%zmm1,%zmm1
 	vaesenc	%zmm17,%zmm2,%zmm2
 	vaesenc	%zmm17,%zmm3,%zmm3
 
-	vpclmulqdq	$0x01,%zmm28,%zmm5,%zmm25
-	vpclmulqdq	$0x01,%zmm29,%zmm6,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x01,%zmm30,%zmm7,%zmm25
+	vpclmulqdq	$0x01,%zmm28,%zmm5,%zmm25  // MI_1
+	vpclmulqdq	$0x01,%zmm29,%zmm6,%zmm26  // MI_2
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm30,%zmm7,%zmm25  // MI_3
 
 	vaesenc	%zmm18,%zmm0,%zmm0
 	vaesenc	%zmm18,%zmm1,%zmm1
 	vaesenc	%zmm18,%zmm2,%zmm2
 	vaesenc	%zmm18,%zmm3,%zmm3
 
-	vpclmulqdq	$0x10,%zmm27,%zmm4,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x10,%zmm28,%zmm5,%zmm25
-	vpclmulqdq	$0x10,%zmm29,%zmm6,%zmm26
+	vpclmulqdq	$0x10,%zmm27,%zmm4,%zmm26  // MI_4
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{4,3,2,1,0})
+	vpclmulqdq	$0x10,%zmm28,%zmm5,%zmm25  // MI_5
+	vpclmulqdq	$0x10,%zmm29,%zmm6,%zmm26  // MI_6
 
 	vaesenc	%zmm19,%zmm0,%zmm0
 	vaesenc	%zmm19,%zmm1,%zmm1
 	vaesenc	%zmm19,%zmm2,%zmm2
 	vaesenc	%zmm19,%zmm3,%zmm3
 
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x01,%zmm10,%zmm31,%zmm26
-	vpclmulqdq	$0x10,%zmm30,%zmm7,%zmm25
-	vpxord	%zmm25,%zmm24,%zmm24
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{6,5,4,3,2,1,0})
+	vpclmulqdq	$0x01,%zmm10,%zmm31,%zmm26  // LO_L*(x^63 + x^62 + x^57)
+	vpclmulqdq	$0x10,%zmm30,%zmm7,%zmm25  // MI_7
+	vpxord	%zmm25,%zmm24,%zmm24  // MI = sum(MI_{7,6,5,4,3,2,1,0})
 
 	vaesenc	%zmm20,%zmm0,%zmm0
 	vaesenc	%zmm20,%zmm1,%zmm1
 	vaesenc	%zmm20,%zmm2,%zmm2
 	vaesenc	%zmm20,%zmm3,%zmm3
 
-	vpshufd	$0x4e,%zmm10,%zmm10
-	vpclmulqdq	$0x11,%zmm27,%zmm4,%zmm4
-	vpclmulqdq	$0x11,%zmm28,%zmm5,%zmm5
-	vpclmulqdq	$0x11,%zmm29,%zmm6,%zmm6
+	vpshufd	$0x4e,%zmm10,%zmm10  // Swap halves of LO
+	vpclmulqdq	$0x11,%zmm27,%zmm4,%zmm4  // HI_0
+	vpclmulqdq	$0x11,%zmm28,%zmm5,%zmm5  // HI_1
+	vpclmulqdq	$0x11,%zmm29,%zmm6,%zmm6  // HI_2
 
 	vaesenc	%zmm21,%zmm0,%zmm0
 	vaesenc	%zmm21,%zmm1,%zmm1
 	vaesenc	%zmm21,%zmm2,%zmm2
 	vaesenc	%zmm21,%zmm3,%zmm3
 
-	vpternlogd	$0x96,%zmm26,%zmm10,%zmm24
-	vpclmulqdq	$0x11,%zmm30,%zmm7,%zmm7
-	vpternlogd	$0x96,%zmm6,%zmm5,%zmm4
-	vpclmulqdq	$0x01,%zmm24,%zmm31,%zmm25
+	vpternlogd	$0x96,%zmm26,%zmm10,%zmm24  // Fold LO into MI
+	vpclmulqdq	$0x11,%zmm30,%zmm7,%zmm7  // HI_3
+	vpternlogd	$0x96,%zmm6,%zmm5,%zmm4  // sum(HI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm24,%zmm31,%zmm25  // MI_L*(x^63 + x^62 + x^57)
 
 	vaesenc	%zmm22,%zmm0,%zmm0
 	vaesenc	%zmm22,%zmm1,%zmm1
 	vaesenc	%zmm22,%zmm2,%zmm2
 	vaesenc	%zmm22,%zmm3,%zmm3
 
-	vpxord	%zmm7,%zmm4,%zmm10
-	vpshufd	$0x4e,%zmm24,%zmm24
-	vpternlogd	$0x96,%zmm25,%zmm24,%zmm10
+	vpxord	%zmm7,%zmm4,%zmm10  // HI = sum(HI_{3,2,1,0})
+	vpshufd	$0x4e,%zmm24,%zmm24  // Swap halves of MI
+	vpternlogd	$0x96,%zmm25,%zmm24,%zmm10  // Fold MI into HI
 
 	vaesenc	%zmm23,%zmm0,%zmm0
 	vaesenc	%zmm23,%zmm1,%zmm1
@@ -1085,32 +1085,32 @@
 	cmpq	$256,%rdx
 	jae	L$crypt_loop_4x__func2
 L$crypt_loop_4x_done__func2:
-
+// Check whether any data remains.
 	testq	%rdx,%rdx
 	jz	L$done__func2
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+// The data length isn't a multiple of 256 bytes.  Process the remaining
+// data of length 1 <= DATALEN < 256, up to one 64-byte vector at a time.
+// Going one vector at a time may seem inefficient compared to having
+// separate code paths for each possible number of vectors remaining.
+// However, using a loop keeps the code size down, and it performs
+// surprising well; modern CPUs will start executing the next iteration
+// before the previous one finishes and also predict the number of loop
+// iterations.  For a similar reason, we roll up the AES rounds.
+// 
+// On the last iteration, the remaining length may be less than 64 bytes.
+// Handle this using masking.
+// 
+// Since there are enough key powers available for all remaining data,
+// there is no need to do a GHASH reduction after each iteration.
+// Instead, multiply each remaining block by its own key power, and only
+// do a GHASH reduction at the very end.
+
+// Make POWERS_PTR point to the key powers H^N, H^(N-1), ... where N
+// is the number of blocks that remain.
 	movq	%rdx,%rax
 	negq	%rax
-	andq	$-16,%rax
+	andq	$-16,%rax  // -round_up(DATALEN, 16)
 	leaq	256(%r9,%rax,1),%r8
 	vpxor	%xmm4,%xmm4,%xmm4
 	vpxor	%xmm5,%xmm5,%xmm5
@@ -1120,9 +1120,9 @@
 	jb	L$partial_vec__func2
 
 L$crypt_loop_1x__func2:
+// Process a full 64-byte vector.
 
-
-
+// Encrypt a vector of counter blocks.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpaddd	%zmm11,%zmm12,%zmm12
 	vpxord	%zmm13,%zmm0,%zmm0
@@ -1135,19 +1135,19 @@
 	jne	L$vaesenc_loop_tail_full_vec__func2
 	vaesenclast	%zmm14,%zmm0,%zmm0
 
-
+// XOR the data with the vector of keystream blocks.
 	vmovdqu8	(%rdi),%zmm1
 	vpxord	%zmm1,%zmm0,%zmm0
 	vmovdqu8	%zmm0,(%rsi)
 
-
+// Update GHASH with the ciphertext blocks, without reducing.
 	vmovdqu8	(%r8),%zmm30
 	vpshufb	%zmm8,%zmm1,%zmm0
 	vpxord	%zmm10,%zmm0,%zmm0
-	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7
-	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1
-	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2
-	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3
+	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7  // a_L * b_L
+	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1  // a_L * b_H
+	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2  // a_H * b_L
+	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3  // a_H * b_H
 	vpxord	%zmm7,%zmm4,%zmm4
 	vpternlogd	$0x96,%zmm2,%zmm1,%zmm5
 	vpxord	%zmm3,%zmm6,%zmm6
@@ -1165,10 +1165,10 @@
 	jz	L$reduce__func2
 
 L$partial_vec__func2:
+// Process a partial vector of length 1 <= DATALEN < 64.
 
-
-
-
+// Set the data mask %k1 to DATALEN 1's.
+// Set the key powers mask %k2 to round_up(DATALEN, 16) 1's.
 	movq	$-1,%rax
 	bzhiq	%rdx,%rax,%rax
 	kmovq	%rax,%k1
@@ -1178,8 +1178,8 @@
 	bzhiq	%rdx,%rax,%rax
 	kmovq	%rax,%k2
 
-
-
+// Encrypt one last vector of counter blocks.  This does not need to be
+// masked.  The counter does not need to be incremented here.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpxord	%zmm13,%zmm0,%zmm0
 	leaq	16(%rcx),%rax
@@ -1191,38 +1191,38 @@
 	jne	L$vaesenc_loop_tail_partialvec__func2
 	vaesenclast	%zmm14,%zmm0,%zmm0
 
-
+// XOR the data with the appropriate number of keystream bytes.
 	vmovdqu8	(%rdi),%zmm1{%k1}{z}
 	vpxord	%zmm1,%zmm0,%zmm0
 	vmovdqu8	%zmm0,(%rsi){%k1}
 
-
-
-
-
-
-
-
-
-
-
-
-
+// Update GHASH with the ciphertext block(s), without reducing.
+// 
+// In the case of DATALEN < 64, the ciphertext is zero-padded to 64
+// bytes.  (If decrypting, it's done by the above masked load.  If
+// encrypting, it's done by the below masked register-to-register move.)
+// Note that if DATALEN <= 48, there will be additional padding beyond
+// the padding of the last block specified by GHASH itself; i.e., there
+// may be whole block(s) that get processed by the GHASH multiplication
+// and reduction instructions but should not actually be included in the
+// GHASH.  However, any such blocks are all-zeroes, and the values that
+// they're multiplied with are also all-zeroes.  Therefore they just add
+// 0 * 0 = 0 to the final GHASH result, which makes no difference.
 	vmovdqu8	(%r8),%zmm30{%k2}{z}
 
 	vpshufb	%zmm8,%zmm1,%zmm0
 	vpxord	%zmm10,%zmm0,%zmm0
-	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7
-	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1
-	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2
-	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3
+	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7  // a_L * b_L
+	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1  // a_L * b_H
+	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2  // a_H * b_L
+	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3  // a_H * b_H
 	vpxord	%zmm7,%zmm4,%zmm4
 	vpternlogd	$0x96,%zmm2,%zmm1,%zmm5
 	vpxord	%zmm3,%zmm6,%zmm6
 
 
 L$reduce__func2:
-
+// Finally, do the GHASH reduction.
 	vpclmulqdq	$0x01,%zmm4,%zmm31,%zmm0
 	vpshufd	$0x4e,%zmm4,%zmm4
 	vpternlogd	$0x96,%zmm0,%zmm4,%zmm5
@@ -1238,11 +1238,11 @@
 
 
 L$done__func2:
-
+// Store the updated GHASH accumulator back to memory.
 	vpshufb	%xmm8,%xmm10,%xmm10
 	vmovdqu	%xmm10,(%r12)
 
-	vzeroupper
+	vzeroupper  // This is needed after using ymm or zmm registers.
 	popq	%r12
 
 	ret

boringssl-0.20260708.tar.xz/gen/bcm/aes-gcm-avx512-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/aes-gcm-avx512-x86_64-linux.S Changed

@@ -9,32 +9,32 @@
 .align	64
 aes_gcm_avx512_constants:
 
-
+// A shuffle mask that reflects the bytes of 16-byte blocks
 .Lbswap_mask:
 .quad	0x08090a0b0c0d0e0f, 0x0001020304050607
 
-
-
-
-
-
-
-
+// This is the GHASH reducing polynomial without its constant term, i.e.
+// x^128 + x^7 + x^2 + x, represented using the backwards mapping
+// between bits and polynomial coefficients.
+// 
+// Alternatively, it can be interpreted as the naturally-ordered
+// representation of the polynomial x^127 + x^126 + x^121 + 1, i.e. the
+// "reversed" GHASH reducing polynomial without its x^128 term.
 .Lgfpoly:
 .quad	1, 0xc200000000000000
 
-
+// Same as above, but with the (1 << 64) bit set.
 .Lgfpoly_and_internal_carrybit:
 .quad	1, 0xc200000000000001
 
-
+// Values needed to prepare the initial vector of counter blocks.
 .Lctr_pattern:
 .quad	0, 0
 .quad	1, 0
 .quad	2, 0
 .quad	3, 0
 
-
+// The number of AES blocks per vector, as a 128-bit value.
 .Linc_4blocks:
 .quad	4, 0
 
@@ -47,100 +47,100 @@
 .cfi_startproc	
 
 _CET_ENDBR
-
+// Get pointer to lowest set of key powers (located at end of array).
 	leaq	256-64(%rdi),%r8
 
-
-
+// Load the byte-reflected hash subkey.  BoringSSL provides it in
+// byte-reflected form except the two halves are in the wrong order.
 	vpshufd	$0x4e,(%rsi),%xmm3
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+// Finish preprocessing the first key power, H^1.  Since this GHASH
+// implementation operates directly on values with the backwards bit
+// order specified by the GCM standard, it's necessary to preprocess the
+// raw key as follows.  First, reflect its bytes.  Second, multiply it
+// by x^-1 mod x^128 + x^7 + x^2 + x + 1 (if using the backwards
+// interpretation of polynomial coefficients), which can also be
+// interpreted as multiplication by x mod x^128 + x^127 + x^126 + x^121
+// + 1 using the alternative, natural interpretation of polynomial
+// coefficients.  For details, see the comment above _ghash_mul.
+// 
+// Either way, for the multiplication the concrete operation performed
+// is a left shift of the 128-bit value by 1 bit, then an XOR with (0xc2
+// << 120) | 1 if a 1 bit was carried out.  However, there's no 128-bit
+// wide shift instruction, so instead double each of the two 64-bit
+// halves and incorporate the internal carry bit into the value XOR'd.
 	vpshufd	$0xd3,%xmm3,%xmm0
 	vpsrad	$31,%xmm0,%xmm0
 	vpaddq	%xmm3,%xmm3,%xmm3
-
+// H_CUR_XMM ^= TMP0_XMM & gfpoly_and_internal_carrybit
 	vpternlogd	$0x78,.Lgfpoly_and_internal_carrybit(%rip),%xmm0,%xmm3
 
-
+// Load the gfpoly constant.
 	vbroadcasti32x4	.Lgfpoly(%rip),%zmm5
 
-
-
-
-
-
-
-
-	vpclmulqdq	$0x00,%xmm3,%xmm3,%xmm0
-	vpclmulqdq	$0x11,%xmm3,%xmm3,%xmm4
-	vpclmulqdq	$0x01,%xmm0,%xmm5,%xmm1
-	vpshufd	$0x4e,%xmm0,%xmm0
-	vpxor	%xmm0,%xmm1,%xmm1
-	vpclmulqdq	$0x01,%xmm1,%xmm5,%xmm0
-	vpshufd	$0x4e,%xmm1,%xmm1
-	vpternlogd	$0x96,%xmm0,%xmm1,%xmm4
-
-
-
+// Square H^1 to get H^2.
+// 
+// Note that as with H^1, all higher key powers also need an extra
+// factor of x^-1 (or x using the natural interpretation).  Nothing
+// special needs to be done to make this happen, though: H^1 * H^1 would
+// end up with two factors of x^-1, but the multiplication consumes one.
+// So the product H^2 ends up with the desired one factor of x^-1.
+	vpclmulqdq	$0x00,%xmm3,%xmm3,%xmm0  // LO = a_L * a_L
+	vpclmulqdq	$0x11,%xmm3,%xmm3,%xmm4  // HI = a_H * a_H
+	vpclmulqdq	$0x01,%xmm0,%xmm5,%xmm1  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm0,%xmm0  // Swap halves of LO
+	vpxor	%xmm0,%xmm1,%xmm1  // Fold LO into MI
+	vpclmulqdq	$0x01,%xmm1,%xmm5,%xmm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm1,%xmm1  // Swap halves of MI
+	vpternlogd	$0x96,%xmm0,%xmm1,%xmm4  // Fold MI into HI
+
+
+// Create H_CUR_YMM = H^2, H^1 and H_INC_YMM = H^2, H^2.
 	vinserti128	$1,%xmm3,%ymm4,%ymm3
 	vinserti128	$1,%xmm4,%ymm4,%ymm4
 
-
-	vpclmulqdq	$0x00,%ymm4,%ymm3,%ymm0
-	vpclmulqdq	$0x01,%ymm4,%ymm3,%ymm1
-	vpclmulqdq	$0x10,%ymm4,%ymm3,%ymm2
-	vpxord	%ymm2,%ymm1,%ymm1
-	vpclmulqdq	$0x01,%ymm0,%ymm5,%ymm2
-	vpshufd	$0x4e,%ymm0,%ymm0
-	vpternlogd	$0x96,%ymm2,%ymm0,%ymm1
-	vpclmulqdq	$0x11,%ymm4,%ymm3,%ymm4
-	vpclmulqdq	$0x01,%ymm1,%ymm5,%ymm0
-	vpshufd	$0x4e,%ymm1,%ymm1
-	vpternlogd	$0x96,%ymm0,%ymm1,%ymm4
+// Create H_CUR = H^4, H^3, H^2, H^1 and H_INC = H^4, H^4, H^4, H^4.
+	vpclmulqdq	$0x00,%ymm4,%ymm3,%ymm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%ymm4,%ymm3,%ymm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%ymm4,%ymm3,%ymm2  // MI_1 = a_H * b_L
+	vpxord	%ymm2,%ymm1,%ymm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%ymm0,%ymm5,%ymm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm0,%ymm0  // Swap halves of LO
+	vpternlogd	$0x96,%ymm2,%ymm0,%ymm1  // Fold LO into MI
+	vpclmulqdq	$0x11,%ymm4,%ymm3,%ymm4  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%ymm1,%ymm5,%ymm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%ymm1,%ymm1  // Swap halves of MI
+	vpternlogd	$0x96,%ymm0,%ymm1,%ymm4  // Fold MI into HI
 
 	vinserti64x4	$1,%ymm3,%zmm4,%zmm3
 	vshufi64x2	$0,%zmm4,%zmm4,%zmm4
 
-
+// Store the lowest set of key powers.
 	vmovdqu8	%zmm3,(%r8)
 
-
-
-
+// Compute and store the remaining key powers.
+// Repeatedly multiply H^(i+3), H^(i+2), H^(i+1), H^i by
+// H^4, H^4, H^4, H^4 to get H^(i+7), H^(i+6), H^(i+5), H^(i+4).
 	movl	$3,%eax
 .Lprecompute_next:
 	subq	$64,%r8
-	vpclmulqdq	$0x00,%zmm4,%zmm3,%zmm0
-	vpclmulqdq	$0x01,%zmm4,%zmm3,%zmm1
-	vpclmulqdq	$0x10,%zmm4,%zmm3,%zmm2
-	vpxord	%zmm2,%zmm1,%zmm1
-	vpclmulqdq	$0x01,%zmm0,%zmm5,%zmm2
-	vpshufd	$0x4e,%zmm0,%zmm0
-	vpternlogd	$0x96,%zmm2,%zmm0,%zmm1
-	vpclmulqdq	$0x11,%zmm4,%zmm3,%zmm3
-	vpclmulqdq	$0x01,%zmm1,%zmm5,%zmm0
-	vpshufd	$0x4e,%zmm1,%zmm1
-	vpternlogd	$0x96,%zmm0,%zmm1,%zmm3
+	vpclmulqdq	$0x00,%zmm4,%zmm3,%zmm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%zmm4,%zmm3,%zmm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%zmm4,%zmm3,%zmm2  // MI_1 = a_H * b_L
+	vpxord	%zmm2,%zmm1,%zmm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%zmm0,%zmm5,%zmm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%zmm0,%zmm0  // Swap halves of LO
+	vpternlogd	$0x96,%zmm2,%zmm0,%zmm1  // Fold LO into MI
+	vpclmulqdq	$0x11,%zmm4,%zmm3,%zmm3  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%zmm1,%zmm5,%zmm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%zmm1,%zmm1  // Swap halves of MI
+	vpternlogd	$0x96,%zmm0,%zmm1,%zmm3  // Fold MI into HI
 
 	vmovdqu8	%zmm3,(%r8)
 	decl	%eax
 	jnz	.Lprecompute_next
 
-	vzeroupper
+	vzeroupper  // This is needed after using ymm or zmm registers.
 	ret
 
 .cfi_endproc	
@@ -162,23 +162,23 @@
 	vmovdqu	.Lgfpoly(%rip),%xmm3
 	vpshufb	%xmm1,%xmm0,%xmm0
 
-	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm4
-	vpclmulqdq	$0x01,%xmm2,%xmm0,%xmm5
-	vpclmulqdq	$0x10,%xmm2,%xmm0,%xmm6
-	vpxord	%xmm6,%xmm5,%xmm5
-	vpclmulqdq	$0x01,%xmm4,%xmm3,%xmm6
-	vpshufd	$0x4e,%xmm4,%xmm4
-	vpternlogd	$0x96,%xmm6,%xmm4,%xmm5
-	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm0
-	vpclmulqdq	$0x01,%xmm5,%xmm3,%xmm4
-	vpshufd	$0x4e,%xmm5,%xmm5
-	vpternlogd	$0x96,%xmm4,%xmm5,%xmm0
+	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm4  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%xmm2,%xmm0,%xmm5  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%xmm2,%xmm0,%xmm6  // MI_1 = a_H * b_L
+	vpxord	%xmm6,%xmm5,%xmm5  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%xmm4,%xmm3,%xmm6  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm4,%xmm4  // Swap halves of LO
+	vpternlogd	$0x96,%xmm6,%xmm4,%xmm5  // Fold LO into MI
+	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm0  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%xmm5,%xmm3,%xmm4  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm5,%xmm5  // Swap halves of MI
+	vpternlogd	$0x96,%xmm4,%xmm5,%xmm0  // Fold MI into HI
 
 
 	vpshufb	%xmm1,%xmm0,%xmm0
 	vmovdqu	%xmm0,(%rdi)
 
-
+// No need for vzeroupper, since only xmm registers were used.
 	ret
 
 .cfi_endproc	
@@ -194,37 +194,37 @@
 
 
 
-
-
-
+// Load the bswap_mask and gfpoly constants.  Since AADLEN is usually small,
+// usually only 128-bit vectors will be used.  So as an optimization, don't
+// broadcast these constants to all 128-bit lanes quite yet.
 	vmovdqu	.Lbswap_mask(%rip),%xmm4
 	vmovdqu	.Lgfpoly(%rip),%xmm10
 
-
+// Load the GHASH accumulator.
 	vmovdqu	(%rdi),%xmm5
 	vpshufb	%xmm4,%xmm5,%xmm5
 
-
+// Optimize for AADLEN < 64 by checking for AADLEN < 64 before AADLEN < 256.
 	cmpq	$64,%rcx
 	jb	.Laad_blockbyblock
 
-
-
+// AADLEN >= 64, so we'll operate on full vectors.  Broadcast bswap_mask and
+// gfpoly to all 128-bit lanes.
 	vshufi64x2	$0,%zmm4,%zmm4,%zmm4
 	vshufi64x2	$0,%zmm10,%zmm10,%zmm10
 
-
+// Load the lowest set of key powers.
 	vmovdqu8	256-64(%rsi),%zmm9
 
 	cmpq	$256,%rcx
 	jb	.Laad_loop_1x
 
-
+// AADLEN >= 256.  Load the higher key powers.
 	vmovdqu8	256-256(%rsi),%zmm6
 	vmovdqu8	256-192(%rsi),%zmm7
 	vmovdqu8	256-128(%rsi),%zmm8
 
-
+// Update GHASH with 256 bytes of AAD at a time.
 .Laad_loop_4x:
 	vmovdqu8	0(%rdx),%zmm0
 	vmovdqu8	64(%rdx),%zmm1
@@ -235,36 +235,36 @@
 	vpshufb	%zmm4,%zmm1,%zmm1
 	vpshufb	%zmm4,%zmm2,%zmm2
 	vpshufb	%zmm4,%zmm3,%zmm3
-	vpclmulqdq	$0x00,%zmm6,%zmm0,%zmm5
-	vpclmulqdq	$0x00,%zmm7,%zmm1,%zmm11
-	vpclmulqdq	$0x00,%zmm8,%zmm2,%zmm12
-	vpxord	%zmm11,%zmm5,%zmm5
-	vpclmulqdq	$0x00,%zmm9,%zmm3,%zmm13
-	vpternlogd	$0x96,%zmm13,%zmm12,%zmm5
-	vpclmulqdq	$0x01,%zmm6,%zmm0,%zmm11
-	vpclmulqdq	$0x01,%zmm7,%zmm1,%zmm12
-	vpclmulqdq	$0x01,%zmm8,%zmm2,%zmm13
-	vpternlogd	$0x96,%zmm13,%zmm12,%zmm11
-	vpclmulqdq	$0x01,%zmm9,%zmm3,%zmm12
-	vpclmulqdq	$0x10,%zmm6,%zmm0,%zmm13
-	vpternlogd	$0x96,%zmm13,%zmm12,%zmm11
-	vpclmulqdq	$0x10,%zmm7,%zmm1,%zmm12
-	vpclmulqdq	$0x10,%zmm8,%zmm2,%zmm13
-	vpternlogd	$0x96,%zmm13,%zmm12,%zmm11
-	vpclmulqdq	$0x01,%zmm5,%zmm10,%zmm13
-	vpclmulqdq	$0x10,%zmm9,%zmm3,%zmm12
-	vpxord	%zmm12,%zmm11,%zmm11
-	vpshufd	$0x4e,%zmm5,%zmm5
-	vpclmulqdq	$0x11,%zmm6,%zmm0,%zmm0
-	vpclmulqdq	$0x11,%zmm7,%zmm1,%zmm1
-	vpclmulqdq	$0x11,%zmm8,%zmm2,%zmm2
-	vpternlogd	$0x96,%zmm13,%zmm5,%zmm11
-	vpclmulqdq	$0x11,%zmm9,%zmm3,%zmm3
-	vpternlogd	$0x96,%zmm2,%zmm1,%zmm0
-	vpclmulqdq	$0x01,%zmm11,%zmm10,%zmm12
-	vpxord	%zmm3,%zmm0,%zmm5
-	vpshufd	$0x4e,%zmm11,%zmm11
-	vpternlogd	$0x96,%zmm12,%zmm11,%zmm5
+	vpclmulqdq	$0x00,%zmm6,%zmm0,%zmm5  // LO_0
+	vpclmulqdq	$0x00,%zmm7,%zmm1,%zmm11  // LO_1
+	vpclmulqdq	$0x00,%zmm8,%zmm2,%zmm12  // LO_2
+	vpxord	%zmm11,%zmm5,%zmm5  // sum(LO_{1,0})
+	vpclmulqdq	$0x00,%zmm9,%zmm3,%zmm13  // LO_3
+	vpternlogd	$0x96,%zmm13,%zmm12,%zmm5  // LO = sum(LO_{3,2,1,0})
+	vpclmulqdq	$0x01,%zmm6,%zmm0,%zmm11  // MI_0
+	vpclmulqdq	$0x01,%zmm7,%zmm1,%zmm12  // MI_1
+	vpclmulqdq	$0x01,%zmm8,%zmm2,%zmm13  // MI_2
+	vpternlogd	$0x96,%zmm13,%zmm12,%zmm11  // sum(MI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm9,%zmm3,%zmm12  // MI_3
+	vpclmulqdq	$0x10,%zmm6,%zmm0,%zmm13  // MI_4
+	vpternlogd	$0x96,%zmm13,%zmm12,%zmm11  // sum(MI_{4,3,2,1,0})
+	vpclmulqdq	$0x10,%zmm7,%zmm1,%zmm12  // MI_5
+	vpclmulqdq	$0x10,%zmm8,%zmm2,%zmm13  // MI_6
+	vpternlogd	$0x96,%zmm13,%zmm12,%zmm11  // sum(MI_{6,5,4,3,2,1,0})
+	vpclmulqdq	$0x01,%zmm5,%zmm10,%zmm13  // LO_L*(x^63 + x^62 + x^57)
+	vpclmulqdq	$0x10,%zmm9,%zmm3,%zmm12  // MI_7
+	vpxord	%zmm12,%zmm11,%zmm11  // MI = sum(MI_{7,6,5,4,3,2,1,0})
+	vpshufd	$0x4e,%zmm5,%zmm5  // Swap halves of LO
+	vpclmulqdq	$0x11,%zmm6,%zmm0,%zmm0  // HI_0
+	vpclmulqdq	$0x11,%zmm7,%zmm1,%zmm1  // HI_1
+	vpclmulqdq	$0x11,%zmm8,%zmm2,%zmm2  // HI_2
+	vpternlogd	$0x96,%zmm13,%zmm5,%zmm11  // Fold LO into MI
+	vpclmulqdq	$0x11,%zmm9,%zmm3,%zmm3  // HI_3
+	vpternlogd	$0x96,%zmm2,%zmm1,%zmm0  // sum(HI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm11,%zmm10,%zmm12  // MI_L*(x^63 + x^62 + x^57)
+	vpxord	%zmm3,%zmm0,%zmm5  // HI = sum(HI_{3,2,1,0})
+	vpshufd	$0x4e,%zmm11,%zmm11  // Swap halves of MI
+	vpternlogd	$0x96,%zmm12,%zmm11,%zmm5  // Fold MI into HI
 	vextracti32x4	$1,%zmm5,%xmm0
 	vextracti32x4	$2,%zmm5,%xmm1
 	vextracti32x4	$3,%zmm5,%xmm2
@@ -276,24 +276,24 @@
 	cmpq	$256,%rcx
 	jae	.Laad_loop_4x
 
-
+// Update GHASH with 64 bytes of AAD at a time.
 	cmpq	$64,%rcx
 	jb	.Laad_large_done
 .Laad_loop_1x:
 	vmovdqu8	(%rdx),%zmm0
 	vpshufb	%zmm4,%zmm0,%zmm0
 	vpxord	%zmm0,%zmm5,%zmm5
-	vpclmulqdq	$0x00,%zmm9,%zmm5,%zmm0
-	vpclmulqdq	$0x01,%zmm9,%zmm5,%zmm1
-	vpclmulqdq	$0x10,%zmm9,%zmm5,%zmm2
-	vpxord	%zmm2,%zmm1,%zmm1
-	vpclmulqdq	$0x01,%zmm0,%zmm10,%zmm2
-	vpshufd	$0x4e,%zmm0,%zmm0
-	vpternlogd	$0x96,%zmm2,%zmm0,%zmm1
-	vpclmulqdq	$0x11,%zmm9,%zmm5,%zmm5
-	vpclmulqdq	$0x01,%zmm1,%zmm10,%zmm0
-	vpshufd	$0x4e,%zmm1,%zmm1
-	vpternlogd	$0x96,%zmm0,%zmm1,%zmm5
+	vpclmulqdq	$0x00,%zmm9,%zmm5,%zmm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%zmm9,%zmm5,%zmm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%zmm9,%zmm5,%zmm2  // MI_1 = a_H * b_L
+	vpxord	%zmm2,%zmm1,%zmm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%zmm0,%zmm10,%zmm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%zmm0,%zmm0  // Swap halves of LO
+	vpternlogd	$0x96,%zmm2,%zmm0,%zmm1  // Fold LO into MI
+	vpclmulqdq	$0x11,%zmm9,%zmm5,%zmm5  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%zmm1,%zmm10,%zmm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%zmm1,%zmm1  // Swap halves of MI
+	vpternlogd	$0x96,%zmm0,%zmm1,%zmm5  // Fold MI into HI
 
 	vextracti32x4	$1,%zmm5,%xmm0
 	vextracti32x4	$2,%zmm5,%xmm1
@@ -308,7 +308,7 @@
 
 .Laad_large_done:
 
-
+// GHASH the remaining data 16 bytes at a time, using xmm registers only.
 .Laad_blockbyblock:
 	testq	%rcx,%rcx
 	jz	.Laad_done
@@ -317,28 +317,28 @@
 	vmovdqu	(%rdx),%xmm0
 	vpshufb	%xmm4,%xmm0,%xmm0
 	vpxor	%xmm0,%xmm5,%xmm5
-	vpclmulqdq	$0x00,%xmm9,%xmm5,%xmm0
-	vpclmulqdq	$0x01,%xmm9,%xmm5,%xmm1
-	vpclmulqdq	$0x10,%xmm9,%xmm5,%xmm2
-	vpxord	%xmm2,%xmm1,%xmm1
-	vpclmulqdq	$0x01,%xmm0,%xmm10,%xmm2
-	vpshufd	$0x4e,%xmm0,%xmm0
-	vpternlogd	$0x96,%xmm2,%xmm0,%xmm1
-	vpclmulqdq	$0x11,%xmm9,%xmm5,%xmm5
-	vpclmulqdq	$0x01,%xmm1,%xmm10,%xmm0
-	vpshufd	$0x4e,%xmm1,%xmm1
-	vpternlogd	$0x96,%xmm0,%xmm1,%xmm5
+	vpclmulqdq	$0x00,%xmm9,%xmm5,%xmm0  // LO = a_L * b_L
+	vpclmulqdq	$0x01,%xmm9,%xmm5,%xmm1  // MI_0 = a_L * b_H
+	vpclmulqdq	$0x10,%xmm9,%xmm5,%xmm2  // MI_1 = a_H * b_L
+	vpxord	%xmm2,%xmm1,%xmm1  // MI = MI_0 + MI_1
+	vpclmulqdq	$0x01,%xmm0,%xmm10,%xmm2  // LO_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm0,%xmm0  // Swap halves of LO
+	vpternlogd	$0x96,%xmm2,%xmm0,%xmm1  // Fold LO into MI
+	vpclmulqdq	$0x11,%xmm9,%xmm5,%xmm5  // HI = a_H * b_H
+	vpclmulqdq	$0x01,%xmm1,%xmm10,%xmm0  // MI_L*(x^63 + x^62 + x^57)
+	vpshufd	$0x4e,%xmm1,%xmm1  // Swap halves of MI
+	vpternlogd	$0x96,%xmm0,%xmm1,%xmm5  // Fold MI into HI
 
 	addq	$16,%rdx
 	subq	$16,%rcx
 	jnz	.Laad_loop_blockbyblock
 
 .Laad_done:
-
+// Store the updated GHASH accumulator back to memory.
 	vpshufb	%xmm4,%xmm5,%xmm5
 	vmovdqu	%xmm5,(%rdi)
 
-	vzeroupper
+	vzeroupper  // This is needed after using ymm or zmm registers.
 	ret
 
 .cfi_endproc	
@@ -355,55 +355,55 @@
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r12,-16
 
-	movq	16(%rsp),%r12
+	movq	16(%rsp),%r12  // arg7
 #ifdef BORINGSSL_DISPATCH_TEST
 .extern	BORINGSSL_function_hit
 .hidden BORINGSSL_function_hit
 	movb	$1,BORINGSSL_function_hit+7(%rip)
 #endif
-
+// Load some constants.
 	vbroadcasti32x4	.Lbswap_mask(%rip),%zmm8
 	vbroadcasti32x4	.Lgfpoly(%rip),%zmm31
 
-
-
+// Load the GHASH accumulator and the starting counter.
+// BoringSSL passes these values in big endian format.
 	vmovdqu	(%r12),%xmm10
 	vpshufb	%xmm8,%xmm10,%xmm10
 	vbroadcasti32x4	(%r8),%zmm12
 	vpshufb	%zmm8,%zmm12,%zmm12
 
-
-
+// Load the AES key length in bytes.  BoringSSL stores number of rounds
+// minus 1, so convert using: AESKEYLEN = 4 * aeskey->rounds - 20.
 	movl	240(%rcx),%r10d
 	leal	-20(,%r10,4),%r10d
 
-
-
-
+// Make RNDKEYLAST_PTR point to the last AES round key.  This is the
+// round key with index 10, 12, or 14 for AES-128, AES-192, or AES-256
+// respectively.  Then load the zero-th and last round keys.
 	leaq	96(%rcx,%r10,4),%r11
 	vbroadcasti32x4	(%rcx),%zmm13
 	vbroadcasti32x4	(%r11),%zmm14
 
-
+// Finish initializing LE_CTR by adding 0, 1, 2, 3 to its low words.
 	vpaddd	.Lctr_pattern(%rip),%zmm12,%zmm12
 
-
+// Load 4 into all 128-bit lanes of LE_CTR_INC.
 	vbroadcasti32x4	.Linc_4blocks(%rip),%zmm11
 
-
-
+// If there are at least 256 bytes of data, then continue into the loop
+// that processes 256 bytes of data at a time.  Otherwise skip it.
 	cmpq	$256,%rdx
 	jb	.Lcrypt_loop_4x_done__func1
 
-
+// Load powers of the hash key.
 	vmovdqu8	256-256(%r9),%zmm27
 	vmovdqu8	256-192(%r9),%zmm28
 	vmovdqu8	256-128(%r9),%zmm29
 	vmovdqu8	256-64(%r9),%zmm30
-
-
-
-
+// Encrypt the first 4 vectors of plaintext blocks.  Leave the resulting
+// ciphertext in GHASHDATA0-3 for GHASH.
+// Increment le_ctr four times to generate four vectors of little-endian
+// counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpaddd	%zmm11,%zmm12,%zmm12
 	vpshufb	%zmm8,%zmm12,%zmm1
@@ -413,7 +413,7 @@
 	vpshufb	%zmm8,%zmm12,%zmm3
 	vpaddd	%zmm11,%zmm12,%zmm12
 
-
+// AES "round zero": XOR in the zero-th round key.
 	vpxord	%zmm13,%zmm0,%zmm0
 	vpxord	%zmm13,%zmm1,%zmm1
 	vpxord	%zmm13,%zmm2,%zmm2
@@ -448,7 +448,7 @@
 	subq	$256,%rdx
 	cmpq	$256,%rdx
 	jb	.Lghash_last_ciphertext_4x__func1
-
+// Cache as many additional AES round keys as possible.
 	vbroadcasti32x4	-144(%r11),%zmm15
 	vbroadcasti32x4	-128(%r11),%zmm16
 	vbroadcasti32x4	-112(%r11),%zmm17
@@ -460,9 +460,9 @@
 	vbroadcasti32x4	-16(%r11),%zmm23
 
 .Lcrypt_loop_4x__func1:
-
-
-
+// Start the AES encryption of the counter blocks.
+// Increment le_ctr four times to generate four vectors of little-endian
+// counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpaddd	%zmm11,%zmm12,%zmm12
 	vpshufb	%zmm8,%zmm12,%zmm1
@@ -472,7 +472,7 @@
 	vpshufb	%zmm8,%zmm12,%zmm3
 	vpaddd	%zmm11,%zmm12,%zmm12
 
-
+// AES "round zero": XOR in the zero-th round key.
 	vpxord	%zmm13,%zmm0,%zmm0
 	vpxord	%zmm13,%zmm1,%zmm1
 	vpxord	%zmm13,%zmm2,%zmm2
@@ -481,7 +481,7 @@
 	cmpl	$24,%r10d
 	jl	.Laes128__func1
 	je	.Laes192__func1
-
+// AES-256
 	vbroadcasti32x4	-208(%r11),%zmm9
 	vaesenc	%zmm9,%zmm0,%zmm0
 	vaesenc	%zmm9,%zmm1,%zmm1
@@ -509,17 +509,17 @@
 
 .Laes128__func1:
 
-
-
-
+// Prefetch the source data 512 bytes ahead into the L1 data cache, to
+// improve performance when the hardware prefetcher is disabled.  Assumes the
+// L1 data cache line size is 64 bytes (de facto standard on x86_64).
 	prefetcht0	512+0(%rdi)
 	prefetcht0	512+64(%rdi)
 	prefetcht0	512+128(%rdi)
 	prefetcht0	512+192(%rdi)
 
-
-
-
+// Finish the AES encryption of the counter blocks in AESDATA0-3,
+// interleaved with the GHASH update of the ciphertext blocks in
+// GHASHDATA0-3.
 	vpshufb	%zmm8,%zmm4,%zmm4
 	vpxord	%zmm10,%zmm4,%zmm4
 	vpshufb	%zmm8,%zmm5,%zmm5
@@ -531,78 +531,78 @@
 	vaesenc	%zmm15,%zmm3,%zmm3
 
 	vpshufb	%zmm8,%zmm7,%zmm7
-	vpclmulqdq	$0x00,%zmm27,%zmm4,%zmm10
-	vpclmulqdq	$0x00,%zmm28,%zmm5,%zmm24
-	vpclmulqdq	$0x00,%zmm29,%zmm6,%zmm25
+	vpclmulqdq	$0x00,%zmm27,%zmm4,%zmm10  // LO_0
+	vpclmulqdq	$0x00,%zmm28,%zmm5,%zmm24  // LO_1
+	vpclmulqdq	$0x00,%zmm29,%zmm6,%zmm25  // LO_2
 
 	vaesenc	%zmm16,%zmm0,%zmm0
 	vaesenc	%zmm16,%zmm1,%zmm1
 	vaesenc	%zmm16,%zmm2,%zmm2
 	vaesenc	%zmm16,%zmm3,%zmm3
 
-	vpxord	%zmm24,%zmm10,%zmm10
-	vpclmulqdq	$0x00,%zmm30,%zmm7,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm10
-	vpclmulqdq	$0x01,%zmm27,%zmm4,%zmm24
+	vpxord	%zmm24,%zmm10,%zmm10  // sum(LO_{1,0})
+	vpclmulqdq	$0x00,%zmm30,%zmm7,%zmm26  // LO_3
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm10  // LO = sum(LO_{3,2,1,0})
+	vpclmulqdq	$0x01,%zmm27,%zmm4,%zmm24  // MI_0
 
 	vaesenc	%zmm17,%zmm0,%zmm0
 	vaesenc	%zmm17,%zmm1,%zmm1
 	vaesenc	%zmm17,%zmm2,%zmm2
 	vaesenc	%zmm17,%zmm3,%zmm3
 
-	vpclmulqdq	$0x01,%zmm28,%zmm5,%zmm25
-	vpclmulqdq	$0x01,%zmm29,%zmm6,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x01,%zmm30,%zmm7,%zmm25
+	vpclmulqdq	$0x01,%zmm28,%zmm5,%zmm25  // MI_1
+	vpclmulqdq	$0x01,%zmm29,%zmm6,%zmm26  // MI_2
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm30,%zmm7,%zmm25  // MI_3
 
 	vaesenc	%zmm18,%zmm0,%zmm0
 	vaesenc	%zmm18,%zmm1,%zmm1
 	vaesenc	%zmm18,%zmm2,%zmm2
 	vaesenc	%zmm18,%zmm3,%zmm3
 
-	vpclmulqdq	$0x10,%zmm27,%zmm4,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x10,%zmm28,%zmm5,%zmm25
-	vpclmulqdq	$0x10,%zmm29,%zmm6,%zmm26
+	vpclmulqdq	$0x10,%zmm27,%zmm4,%zmm26  // MI_4
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{4,3,2,1,0})
+	vpclmulqdq	$0x10,%zmm28,%zmm5,%zmm25  // MI_5
+	vpclmulqdq	$0x10,%zmm29,%zmm6,%zmm26  // MI_6
 
 	vaesenc	%zmm19,%zmm0,%zmm0
 	vaesenc	%zmm19,%zmm1,%zmm1
 	vaesenc	%zmm19,%zmm2,%zmm2
 	vaesenc	%zmm19,%zmm3,%zmm3
 
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x01,%zmm10,%zmm31,%zmm26
-	vpclmulqdq	$0x10,%zmm30,%zmm7,%zmm25
-	vpxord	%zmm25,%zmm24,%zmm24
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{6,5,4,3,2,1,0})
+	vpclmulqdq	$0x01,%zmm10,%zmm31,%zmm26  // LO_L*(x^63 + x^62 + x^57)
+	vpclmulqdq	$0x10,%zmm30,%zmm7,%zmm25  // MI_7
+	vpxord	%zmm25,%zmm24,%zmm24  // MI = sum(MI_{7,6,5,4,3,2,1,0})
 
 	vaesenc	%zmm20,%zmm0,%zmm0
 	vaesenc	%zmm20,%zmm1,%zmm1
 	vaesenc	%zmm20,%zmm2,%zmm2
 	vaesenc	%zmm20,%zmm3,%zmm3
 
-	vpshufd	$0x4e,%zmm10,%zmm10
-	vpclmulqdq	$0x11,%zmm27,%zmm4,%zmm4
-	vpclmulqdq	$0x11,%zmm28,%zmm5,%zmm5
-	vpclmulqdq	$0x11,%zmm29,%zmm6,%zmm6
+	vpshufd	$0x4e,%zmm10,%zmm10  // Swap halves of LO
+	vpclmulqdq	$0x11,%zmm27,%zmm4,%zmm4  // HI_0
+	vpclmulqdq	$0x11,%zmm28,%zmm5,%zmm5  // HI_1
+	vpclmulqdq	$0x11,%zmm29,%zmm6,%zmm6  // HI_2
 
 	vaesenc	%zmm21,%zmm0,%zmm0
 	vaesenc	%zmm21,%zmm1,%zmm1
 	vaesenc	%zmm21,%zmm2,%zmm2
 	vaesenc	%zmm21,%zmm3,%zmm3
 
-	vpternlogd	$0x96,%zmm26,%zmm10,%zmm24
-	vpclmulqdq	$0x11,%zmm30,%zmm7,%zmm7
-	vpternlogd	$0x96,%zmm6,%zmm5,%zmm4
-	vpclmulqdq	$0x01,%zmm24,%zmm31,%zmm25
+	vpternlogd	$0x96,%zmm26,%zmm10,%zmm24  // Fold LO into MI
+	vpclmulqdq	$0x11,%zmm30,%zmm7,%zmm7  // HI_3
+	vpternlogd	$0x96,%zmm6,%zmm5,%zmm4  // sum(HI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm24,%zmm31,%zmm25  // MI_L*(x^63 + x^62 + x^57)
 
 	vaesenc	%zmm22,%zmm0,%zmm0
 	vaesenc	%zmm22,%zmm1,%zmm1
 	vaesenc	%zmm22,%zmm2,%zmm2
 	vaesenc	%zmm22,%zmm3,%zmm3
 
-	vpxord	%zmm7,%zmm4,%zmm10
-	vpshufd	$0x4e,%zmm24,%zmm24
-	vpternlogd	$0x96,%zmm25,%zmm24,%zmm10
+	vpxord	%zmm7,%zmm4,%zmm10  // HI = sum(HI_{3,2,1,0})
+	vpshufd	$0x4e,%zmm24,%zmm24  // Swap halves of MI
+	vpternlogd	$0x96,%zmm25,%zmm24,%zmm10  // Fold MI into HI
 
 	vaesenc	%zmm23,%zmm0,%zmm0
 	vaesenc	%zmm23,%zmm1,%zmm1
@@ -640,36 +640,36 @@
 	vpshufb	%zmm8,%zmm5,%zmm5
 	vpshufb	%zmm8,%zmm6,%zmm6
 	vpshufb	%zmm8,%zmm7,%zmm7
-	vpclmulqdq	$0x00,%zmm27,%zmm4,%zmm10
-	vpclmulqdq	$0x00,%zmm28,%zmm5,%zmm24
-	vpclmulqdq	$0x00,%zmm29,%zmm6,%zmm25
-	vpxord	%zmm24,%zmm10,%zmm10
-	vpclmulqdq	$0x00,%zmm30,%zmm7,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm10
-	vpclmulqdq	$0x01,%zmm27,%zmm4,%zmm24
-	vpclmulqdq	$0x01,%zmm28,%zmm5,%zmm25
-	vpclmulqdq	$0x01,%zmm29,%zmm6,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x01,%zmm30,%zmm7,%zmm25
-	vpclmulqdq	$0x10,%zmm27,%zmm4,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x10,%zmm28,%zmm5,%zmm25
-	vpclmulqdq	$0x10,%zmm29,%zmm6,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x01,%zmm10,%zmm31,%zmm26
-	vpclmulqdq	$0x10,%zmm30,%zmm7,%zmm25
-	vpxord	%zmm25,%zmm24,%zmm24
-	vpshufd	$0x4e,%zmm10,%zmm10
-	vpclmulqdq	$0x11,%zmm27,%zmm4,%zmm4
-	vpclmulqdq	$0x11,%zmm28,%zmm5,%zmm5
-	vpclmulqdq	$0x11,%zmm29,%zmm6,%zmm6
-	vpternlogd	$0x96,%zmm26,%zmm10,%zmm24
-	vpclmulqdq	$0x11,%zmm30,%zmm7,%zmm7
-	vpternlogd	$0x96,%zmm6,%zmm5,%zmm4
-	vpclmulqdq	$0x01,%zmm24,%zmm31,%zmm25
-	vpxord	%zmm7,%zmm4,%zmm10
-	vpshufd	$0x4e,%zmm24,%zmm24
-	vpternlogd	$0x96,%zmm25,%zmm24,%zmm10
+	vpclmulqdq	$0x00,%zmm27,%zmm4,%zmm10  // LO_0
+	vpclmulqdq	$0x00,%zmm28,%zmm5,%zmm24  // LO_1
+	vpclmulqdq	$0x00,%zmm29,%zmm6,%zmm25  // LO_2
+	vpxord	%zmm24,%zmm10,%zmm10  // sum(LO_{1,0})
+	vpclmulqdq	$0x00,%zmm30,%zmm7,%zmm26  // LO_3
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm10  // LO = sum(LO_{3,2,1,0})
+	vpclmulqdq	$0x01,%zmm27,%zmm4,%zmm24  // MI_0
+	vpclmulqdq	$0x01,%zmm28,%zmm5,%zmm25  // MI_1
+	vpclmulqdq	$0x01,%zmm29,%zmm6,%zmm26  // MI_2
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm30,%zmm7,%zmm25  // MI_3
+	vpclmulqdq	$0x10,%zmm27,%zmm4,%zmm26  // MI_4
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{4,3,2,1,0})
+	vpclmulqdq	$0x10,%zmm28,%zmm5,%zmm25  // MI_5
+	vpclmulqdq	$0x10,%zmm29,%zmm6,%zmm26  // MI_6
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{6,5,4,3,2,1,0})
+	vpclmulqdq	$0x01,%zmm10,%zmm31,%zmm26  // LO_L*(x^63 + x^62 + x^57)
+	vpclmulqdq	$0x10,%zmm30,%zmm7,%zmm25  // MI_7
+	vpxord	%zmm25,%zmm24,%zmm24  // MI = sum(MI_{7,6,5,4,3,2,1,0})
+	vpshufd	$0x4e,%zmm10,%zmm10  // Swap halves of LO
+	vpclmulqdq	$0x11,%zmm27,%zmm4,%zmm4  // HI_0
+	vpclmulqdq	$0x11,%zmm28,%zmm5,%zmm5  // HI_1
+	vpclmulqdq	$0x11,%zmm29,%zmm6,%zmm6  // HI_2
+	vpternlogd	$0x96,%zmm26,%zmm10,%zmm24  // Fold LO into MI
+	vpclmulqdq	$0x11,%zmm30,%zmm7,%zmm7  // HI_3
+	vpternlogd	$0x96,%zmm6,%zmm5,%zmm4  // sum(HI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm24,%zmm31,%zmm25  // MI_L*(x^63 + x^62 + x^57)
+	vpxord	%zmm7,%zmm4,%zmm10  // HI = sum(HI_{3,2,1,0})
+	vpshufd	$0x4e,%zmm24,%zmm24  // Swap halves of MI
+	vpternlogd	$0x96,%zmm25,%zmm24,%zmm10  // Fold MI into HI
 	vextracti32x4	$1,%zmm10,%xmm4
 	vextracti32x4	$2,%zmm10,%xmm5
 	vextracti32x4	$3,%zmm10,%xmm6
@@ -677,32 +677,32 @@
 	vpternlogd	$0x96,%xmm5,%xmm6,%xmm10
 
 .Lcrypt_loop_4x_done__func1:
-
+// Check whether any data remains.
 	testq	%rdx,%rdx
 	jz	.Ldone__func1
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+// The data length isn't a multiple of 256 bytes.  Process the remaining
+// data of length 1 <= DATALEN < 256, up to one 64-byte vector at a time.
+// Going one vector at a time may seem inefficient compared to having
+// separate code paths for each possible number of vectors remaining.
+// However, using a loop keeps the code size down, and it performs
+// surprising well; modern CPUs will start executing the next iteration
+// before the previous one finishes and also predict the number of loop
+// iterations.  For a similar reason, we roll up the AES rounds.
+// 
+// On the last iteration, the remaining length may be less than 64 bytes.
+// Handle this using masking.
+// 
+// Since there are enough key powers available for all remaining data,
+// there is no need to do a GHASH reduction after each iteration.
+// Instead, multiply each remaining block by its own key power, and only
+// do a GHASH reduction at the very end.
+
+// Make POWERS_PTR point to the key powers H^N, H^(N-1), ... where N
+// is the number of blocks that remain.
 	movq	%rdx,%rax
 	negq	%rax
-	andq	$-16,%rax
+	andq	$-16,%rax  // -round_up(DATALEN, 16)
 	leaq	256(%r9,%rax,1),%r8
 	vpxor	%xmm4,%xmm4,%xmm4
 	vpxor	%xmm5,%xmm5,%xmm5
@@ -712,9 +712,9 @@
 	jb	.Lpartial_vec__func1
 
 .Lcrypt_loop_1x__func1:
+// Process a full 64-byte vector.
 
-
-
+// Encrypt a vector of counter blocks.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpaddd	%zmm11,%zmm12,%zmm12
 	vpxord	%zmm13,%zmm0,%zmm0
@@ -727,19 +727,19 @@
 	jne	.Lvaesenc_loop_tail_full_vec__func1
 	vaesenclast	%zmm14,%zmm0,%zmm0
 
-
+// XOR the data with the vector of keystream blocks.
 	vmovdqu8	(%rdi),%zmm1
 	vpxord	%zmm1,%zmm0,%zmm0
 	vmovdqu8	%zmm0,(%rsi)
 
-
+// Update GHASH with the ciphertext blocks, without reducing.
 	vmovdqu8	(%r8),%zmm30
 	vpshufb	%zmm8,%zmm0,%zmm0
 	vpxord	%zmm10,%zmm0,%zmm0
-	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7
-	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1
-	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2
-	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3
+	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7  // a_L * b_L
+	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1  // a_L * b_H
+	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2  // a_H * b_L
+	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3  // a_H * b_H
 	vpxord	%zmm7,%zmm4,%zmm4
 	vpternlogd	$0x96,%zmm2,%zmm1,%zmm5
 	vpxord	%zmm3,%zmm6,%zmm6
@@ -757,10 +757,10 @@
 	jz	.Lreduce__func1
 
 .Lpartial_vec__func1:
+// Process a partial vector of length 1 <= DATALEN < 64.
 
-
-
-
+// Set the data mask %k1 to DATALEN 1's.
+// Set the key powers mask %k2 to round_up(DATALEN, 16) 1's.
 	movq	$-1,%rax
 	bzhiq	%rdx,%rax,%rax
 	kmovq	%rax,%k1
@@ -770,8 +770,8 @@
 	bzhiq	%rdx,%rax,%rax
 	kmovq	%rax,%k2
 
-
-
+// Encrypt one last vector of counter blocks.  This does not need to be
+// masked.  The counter does not need to be incremented here.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpxord	%zmm13,%zmm0,%zmm0
 	leaq	16(%rcx),%rax
@@ -783,38 +783,38 @@
 	jne	.Lvaesenc_loop_tail_partialvec__func1
 	vaesenclast	%zmm14,%zmm0,%zmm0
 
-
+// XOR the data with the appropriate number of keystream bytes.
 	vmovdqu8	(%rdi),%zmm1{%k1}{z}
 	vpxord	%zmm1,%zmm0,%zmm0
 	vmovdqu8	%zmm0,(%rsi){%k1}
 
-
-
-
-
-
-
-
-
-
-
-
-
+// Update GHASH with the ciphertext block(s), without reducing.
+// 
+// In the case of DATALEN < 64, the ciphertext is zero-padded to 64
+// bytes.  (If decrypting, it's done by the above masked load.  If
+// encrypting, it's done by the below masked register-to-register move.)
+// Note that if DATALEN <= 48, there will be additional padding beyond
+// the padding of the last block specified by GHASH itself; i.e., there
+// may be whole block(s) that get processed by the GHASH multiplication
+// and reduction instructions but should not actually be included in the
+// GHASH.  However, any such blocks are all-zeroes, and the values that
+// they're multiplied with are also all-zeroes.  Therefore they just add
+// 0 * 0 = 0 to the final GHASH result, which makes no difference.
 	vmovdqu8	(%r8),%zmm30{%k2}{z}
 	vmovdqu8	%zmm0,%zmm1{%k1}{z}
 	vpshufb	%zmm8,%zmm1,%zmm0
 	vpxord	%zmm10,%zmm0,%zmm0
-	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7
-	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1
-	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2
-	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3
+	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7  // a_L * b_L
+	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1  // a_L * b_H
+	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2  // a_H * b_L
+	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3  // a_H * b_H
 	vpxord	%zmm7,%zmm4,%zmm4
 	vpternlogd	$0x96,%zmm2,%zmm1,%zmm5
 	vpxord	%zmm3,%zmm6,%zmm6
 
 
 .Lreduce__func1:
-
+// Finally, do the GHASH reduction.
 	vpclmulqdq	$0x01,%zmm4,%zmm31,%zmm0
 	vpshufd	$0x4e,%zmm4,%zmm4
 	vpternlogd	$0x96,%zmm0,%zmm4,%zmm5
@@ -830,11 +830,11 @@
 
 
 .Ldone__func1:
-
+// Store the updated GHASH accumulator back to memory.
 	vpshufb	%xmm8,%xmm10,%xmm10
 	vmovdqu	%xmm10,(%r12)
 
-	vzeroupper
+	vzeroupper  // This is needed after using ymm or zmm registers.
 	popq	%r12
 .cfi_adjust_cfa_offset	-8
 .cfi_restore	%r12
@@ -854,47 +854,47 @@
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r12,-16
 
-	movq	16(%rsp),%r12
-
+	movq	16(%rsp),%r12  // arg7
+// Load some constants.
 	vbroadcasti32x4	.Lbswap_mask(%rip),%zmm8
 	vbroadcasti32x4	.Lgfpoly(%rip),%zmm31
 
-
-
+// Load the GHASH accumulator and the starting counter.
+// BoringSSL passes these values in big endian format.
 	vmovdqu	(%r12),%xmm10
 	vpshufb	%xmm8,%xmm10,%xmm10
 	vbroadcasti32x4	(%r8),%zmm12
 	vpshufb	%zmm8,%zmm12,%zmm12
 
-
-
+// Load the AES key length in bytes.  BoringSSL stores number of rounds
+// minus 1, so convert using: AESKEYLEN = 4 * aeskey->rounds - 20.
 	movl	240(%rcx),%r10d
 	leal	-20(,%r10,4),%r10d
 
-
-
-
+// Make RNDKEYLAST_PTR point to the last AES round key.  This is the
+// round key with index 10, 12, or 14 for AES-128, AES-192, or AES-256
+// respectively.  Then load the zero-th and last round keys.
 	leaq	96(%rcx,%r10,4),%r11
 	vbroadcasti32x4	(%rcx),%zmm13
 	vbroadcasti32x4	(%r11),%zmm14
 
-
+// Finish initializing LE_CTR by adding 0, 1, 2, 3 to its low words.
 	vpaddd	.Lctr_pattern(%rip),%zmm12,%zmm12
 
-
+// Load 4 into all 128-bit lanes of LE_CTR_INC.
 	vbroadcasti32x4	.Linc_4blocks(%rip),%zmm11
 
-
-
+// If there are at least 256 bytes of data, then continue into the loop
+// that processes 256 bytes of data at a time.  Otherwise skip it.
 	cmpq	$256,%rdx
 	jb	.Lcrypt_loop_4x_done__func2
 
-
+// Load powers of the hash key.
 	vmovdqu8	256-256(%r9),%zmm27
 	vmovdqu8	256-192(%r9),%zmm28
 	vmovdqu8	256-128(%r9),%zmm29
 	vmovdqu8	256-64(%r9),%zmm30
-
+// Cache as many additional AES round keys as possible.
 	vbroadcasti32x4	-144(%r11),%zmm15
 	vbroadcasti32x4	-128(%r11),%zmm16
 	vbroadcasti32x4	-112(%r11),%zmm17
@@ -910,9 +910,9 @@
 	vmovdqu8	64(%rdi),%zmm5
 	vmovdqu8	128(%rdi),%zmm6
 	vmovdqu8	192(%rdi),%zmm7
-
-
-
+// Start the AES encryption of the counter blocks.
+// Increment le_ctr four times to generate four vectors of little-endian
+// counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpaddd	%zmm11,%zmm12,%zmm12
 	vpshufb	%zmm8,%zmm12,%zmm1
@@ -922,7 +922,7 @@
 	vpshufb	%zmm8,%zmm12,%zmm3
 	vpaddd	%zmm11,%zmm12,%zmm12
 
-
+// AES "round zero": XOR in the zero-th round key.
 	vpxord	%zmm13,%zmm0,%zmm0
 	vpxord	%zmm13,%zmm1,%zmm1
 	vpxord	%zmm13,%zmm2,%zmm2
@@ -931,7 +931,7 @@
 	cmpl	$24,%r10d
 	jl	.Laes128__func2
 	je	.Laes192__func2
-
+// AES-256
 	vbroadcasti32x4	-208(%r11),%zmm9
 	vaesenc	%zmm9,%zmm0,%zmm0
 	vaesenc	%zmm9,%zmm1,%zmm1
@@ -959,17 +959,17 @@
 
 .Laes128__func2:
 
-
-
-
+// Prefetch the source data 512 bytes ahead into the L1 data cache, to
+// improve performance when the hardware prefetcher is disabled.  Assumes the
+// L1 data cache line size is 64 bytes (de facto standard on x86_64).
 	prefetcht0	512+0(%rdi)
 	prefetcht0	512+64(%rdi)
 	prefetcht0	512+128(%rdi)
 	prefetcht0	512+192(%rdi)
 
-
-
-
+// Finish the AES encryption of the counter blocks in AESDATA0-3,
+// interleaved with the GHASH update of the ciphertext blocks in
+// GHASHDATA0-3.
 	vpshufb	%zmm8,%zmm4,%zmm4
 	vpxord	%zmm10,%zmm4,%zmm4
 	vpshufb	%zmm8,%zmm5,%zmm5
@@ -981,78 +981,78 @@
 	vaesenc	%zmm15,%zmm3,%zmm3
 
 	vpshufb	%zmm8,%zmm7,%zmm7
-	vpclmulqdq	$0x00,%zmm27,%zmm4,%zmm10
-	vpclmulqdq	$0x00,%zmm28,%zmm5,%zmm24
-	vpclmulqdq	$0x00,%zmm29,%zmm6,%zmm25
+	vpclmulqdq	$0x00,%zmm27,%zmm4,%zmm10  // LO_0
+	vpclmulqdq	$0x00,%zmm28,%zmm5,%zmm24  // LO_1
+	vpclmulqdq	$0x00,%zmm29,%zmm6,%zmm25  // LO_2
 
 	vaesenc	%zmm16,%zmm0,%zmm0
 	vaesenc	%zmm16,%zmm1,%zmm1
 	vaesenc	%zmm16,%zmm2,%zmm2
 	vaesenc	%zmm16,%zmm3,%zmm3
 
-	vpxord	%zmm24,%zmm10,%zmm10
-	vpclmulqdq	$0x00,%zmm30,%zmm7,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm10
-	vpclmulqdq	$0x01,%zmm27,%zmm4,%zmm24
+	vpxord	%zmm24,%zmm10,%zmm10  // sum(LO_{1,0})
+	vpclmulqdq	$0x00,%zmm30,%zmm7,%zmm26  // LO_3
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm10  // LO = sum(LO_{3,2,1,0})
+	vpclmulqdq	$0x01,%zmm27,%zmm4,%zmm24  // MI_0
 
 	vaesenc	%zmm17,%zmm0,%zmm0
 	vaesenc	%zmm17,%zmm1,%zmm1
 	vaesenc	%zmm17,%zmm2,%zmm2
 	vaesenc	%zmm17,%zmm3,%zmm3
 
-	vpclmulqdq	$0x01,%zmm28,%zmm5,%zmm25
-	vpclmulqdq	$0x01,%zmm29,%zmm6,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x01,%zmm30,%zmm7,%zmm25
+	vpclmulqdq	$0x01,%zmm28,%zmm5,%zmm25  // MI_1
+	vpclmulqdq	$0x01,%zmm29,%zmm6,%zmm26  // MI_2
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm30,%zmm7,%zmm25  // MI_3
 
 	vaesenc	%zmm18,%zmm0,%zmm0
 	vaesenc	%zmm18,%zmm1,%zmm1
 	vaesenc	%zmm18,%zmm2,%zmm2
 	vaesenc	%zmm18,%zmm3,%zmm3
 
-	vpclmulqdq	$0x10,%zmm27,%zmm4,%zmm26
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x10,%zmm28,%zmm5,%zmm25
-	vpclmulqdq	$0x10,%zmm29,%zmm6,%zmm26
+	vpclmulqdq	$0x10,%zmm27,%zmm4,%zmm26  // MI_4
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{4,3,2,1,0})
+	vpclmulqdq	$0x10,%zmm28,%zmm5,%zmm25  // MI_5
+	vpclmulqdq	$0x10,%zmm29,%zmm6,%zmm26  // MI_6
 
 	vaesenc	%zmm19,%zmm0,%zmm0
 	vaesenc	%zmm19,%zmm1,%zmm1
 	vaesenc	%zmm19,%zmm2,%zmm2
 	vaesenc	%zmm19,%zmm3,%zmm3
 
-	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24
-	vpclmulqdq	$0x01,%zmm10,%zmm31,%zmm26
-	vpclmulqdq	$0x10,%zmm30,%zmm7,%zmm25
-	vpxord	%zmm25,%zmm24,%zmm24
+	vpternlogd	$0x96,%zmm26,%zmm25,%zmm24  // sum(MI_{6,5,4,3,2,1,0})
+	vpclmulqdq	$0x01,%zmm10,%zmm31,%zmm26  // LO_L*(x^63 + x^62 + x^57)
+	vpclmulqdq	$0x10,%zmm30,%zmm7,%zmm25  // MI_7
+	vpxord	%zmm25,%zmm24,%zmm24  // MI = sum(MI_{7,6,5,4,3,2,1,0})
 
 	vaesenc	%zmm20,%zmm0,%zmm0
 	vaesenc	%zmm20,%zmm1,%zmm1
 	vaesenc	%zmm20,%zmm2,%zmm2
 	vaesenc	%zmm20,%zmm3,%zmm3
 
-	vpshufd	$0x4e,%zmm10,%zmm10
-	vpclmulqdq	$0x11,%zmm27,%zmm4,%zmm4
-	vpclmulqdq	$0x11,%zmm28,%zmm5,%zmm5
-	vpclmulqdq	$0x11,%zmm29,%zmm6,%zmm6
+	vpshufd	$0x4e,%zmm10,%zmm10  // Swap halves of LO
+	vpclmulqdq	$0x11,%zmm27,%zmm4,%zmm4  // HI_0
+	vpclmulqdq	$0x11,%zmm28,%zmm5,%zmm5  // HI_1
+	vpclmulqdq	$0x11,%zmm29,%zmm6,%zmm6  // HI_2
 
 	vaesenc	%zmm21,%zmm0,%zmm0
 	vaesenc	%zmm21,%zmm1,%zmm1
 	vaesenc	%zmm21,%zmm2,%zmm2
 	vaesenc	%zmm21,%zmm3,%zmm3
 
-	vpternlogd	$0x96,%zmm26,%zmm10,%zmm24
-	vpclmulqdq	$0x11,%zmm30,%zmm7,%zmm7
-	vpternlogd	$0x96,%zmm6,%zmm5,%zmm4
-	vpclmulqdq	$0x01,%zmm24,%zmm31,%zmm25
+	vpternlogd	$0x96,%zmm26,%zmm10,%zmm24  // Fold LO into MI
+	vpclmulqdq	$0x11,%zmm30,%zmm7,%zmm7  // HI_3
+	vpternlogd	$0x96,%zmm6,%zmm5,%zmm4  // sum(HI_{2,1,0})
+	vpclmulqdq	$0x01,%zmm24,%zmm31,%zmm25  // MI_L*(x^63 + x^62 + x^57)
 
 	vaesenc	%zmm22,%zmm0,%zmm0
 	vaesenc	%zmm22,%zmm1,%zmm1
 	vaesenc	%zmm22,%zmm2,%zmm2
 	vaesenc	%zmm22,%zmm3,%zmm3
 
-	vpxord	%zmm7,%zmm4,%zmm10
-	vpshufd	$0x4e,%zmm24,%zmm24
-	vpternlogd	$0x96,%zmm25,%zmm24,%zmm10
+	vpxord	%zmm7,%zmm4,%zmm10  // HI = sum(HI_{3,2,1,0})
+	vpshufd	$0x4e,%zmm24,%zmm24  // Swap halves of MI
+	vpternlogd	$0x96,%zmm25,%zmm24,%zmm10  // Fold MI into HI
 
 	vaesenc	%zmm23,%zmm0,%zmm0
 	vaesenc	%zmm23,%zmm1,%zmm1
@@ -1085,32 +1085,32 @@
 	cmpq	$256,%rdx
 	jae	.Lcrypt_loop_4x__func2
 .Lcrypt_loop_4x_done__func2:
-
+// Check whether any data remains.
 	testq	%rdx,%rdx
 	jz	.Ldone__func2
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+// The data length isn't a multiple of 256 bytes.  Process the remaining
+// data of length 1 <= DATALEN < 256, up to one 64-byte vector at a time.
+// Going one vector at a time may seem inefficient compared to having
+// separate code paths for each possible number of vectors remaining.
+// However, using a loop keeps the code size down, and it performs
+// surprising well; modern CPUs will start executing the next iteration
+// before the previous one finishes and also predict the number of loop
+// iterations.  For a similar reason, we roll up the AES rounds.
+// 
+// On the last iteration, the remaining length may be less than 64 bytes.
+// Handle this using masking.
+// 
+// Since there are enough key powers available for all remaining data,
+// there is no need to do a GHASH reduction after each iteration.
+// Instead, multiply each remaining block by its own key power, and only
+// do a GHASH reduction at the very end.
+
+// Make POWERS_PTR point to the key powers H^N, H^(N-1), ... where N
+// is the number of blocks that remain.
 	movq	%rdx,%rax
 	negq	%rax
-	andq	$-16,%rax
+	andq	$-16,%rax  // -round_up(DATALEN, 16)
 	leaq	256(%r9,%rax,1),%r8
 	vpxor	%xmm4,%xmm4,%xmm4
 	vpxor	%xmm5,%xmm5,%xmm5
@@ -1120,9 +1120,9 @@
 	jb	.Lpartial_vec__func2
 
 .Lcrypt_loop_1x__func2:
+// Process a full 64-byte vector.
 
-
-
+// Encrypt a vector of counter blocks.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpaddd	%zmm11,%zmm12,%zmm12
 	vpxord	%zmm13,%zmm0,%zmm0
@@ -1135,19 +1135,19 @@
 	jne	.Lvaesenc_loop_tail_full_vec__func2
 	vaesenclast	%zmm14,%zmm0,%zmm0
 
-
+// XOR the data with the vector of keystream blocks.
 	vmovdqu8	(%rdi),%zmm1
 	vpxord	%zmm1,%zmm0,%zmm0
 	vmovdqu8	%zmm0,(%rsi)
 
-
+// Update GHASH with the ciphertext blocks, without reducing.
 	vmovdqu8	(%r8),%zmm30
 	vpshufb	%zmm8,%zmm1,%zmm0
 	vpxord	%zmm10,%zmm0,%zmm0
-	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7
-	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1
-	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2
-	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3
+	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7  // a_L * b_L
+	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1  // a_L * b_H
+	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2  // a_H * b_L
+	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3  // a_H * b_H
 	vpxord	%zmm7,%zmm4,%zmm4
 	vpternlogd	$0x96,%zmm2,%zmm1,%zmm5
 	vpxord	%zmm3,%zmm6,%zmm6
@@ -1165,10 +1165,10 @@
 	jz	.Lreduce__func2
 
 .Lpartial_vec__func2:
+// Process a partial vector of length 1 <= DATALEN < 64.
 
-
-
-
+// Set the data mask %k1 to DATALEN 1's.
+// Set the key powers mask %k2 to round_up(DATALEN, 16) 1's.
 	movq	$-1,%rax
 	bzhiq	%rdx,%rax,%rax
 	kmovq	%rax,%k1
@@ -1178,8 +1178,8 @@
 	bzhiq	%rdx,%rax,%rax
 	kmovq	%rax,%k2
 
-
-
+// Encrypt one last vector of counter blocks.  This does not need to be
+// masked.  The counter does not need to be incremented here.
 	vpshufb	%zmm8,%zmm12,%zmm0
 	vpxord	%zmm13,%zmm0,%zmm0
 	leaq	16(%rcx),%rax
@@ -1191,38 +1191,38 @@
 	jne	.Lvaesenc_loop_tail_partialvec__func2
 	vaesenclast	%zmm14,%zmm0,%zmm0
 
-
+// XOR the data with the appropriate number of keystream bytes.
 	vmovdqu8	(%rdi),%zmm1{%k1}{z}
 	vpxord	%zmm1,%zmm0,%zmm0
 	vmovdqu8	%zmm0,(%rsi){%k1}
 
-
-
-
-
-
-
-
-
-
-
-
-
+// Update GHASH with the ciphertext block(s), without reducing.
+// 
+// In the case of DATALEN < 64, the ciphertext is zero-padded to 64
+// bytes.  (If decrypting, it's done by the above masked load.  If
+// encrypting, it's done by the below masked register-to-register move.)
+// Note that if DATALEN <= 48, there will be additional padding beyond
+// the padding of the last block specified by GHASH itself; i.e., there
+// may be whole block(s) that get processed by the GHASH multiplication
+// and reduction instructions but should not actually be included in the
+// GHASH.  However, any such blocks are all-zeroes, and the values that
+// they're multiplied with are also all-zeroes.  Therefore they just add
+// 0 * 0 = 0 to the final GHASH result, which makes no difference.
 	vmovdqu8	(%r8),%zmm30{%k2}{z}
 
 	vpshufb	%zmm8,%zmm1,%zmm0
 	vpxord	%zmm10,%zmm0,%zmm0
-	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7
-	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1
-	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2
-	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3
+	vpclmulqdq	$0x00,%zmm30,%zmm0,%zmm7  // a_L * b_L
+	vpclmulqdq	$0x01,%zmm30,%zmm0,%zmm1  // a_L * b_H
+	vpclmulqdq	$0x10,%zmm30,%zmm0,%zmm2  // a_H * b_L
+	vpclmulqdq	$0x11,%zmm30,%zmm0,%zmm3  // a_H * b_H
 	vpxord	%zmm7,%zmm4,%zmm4
 	vpternlogd	$0x96,%zmm2,%zmm1,%zmm5
 	vpxord	%zmm3,%zmm6,%zmm6
 
 
 .Lreduce__func2:
-
+// Finally, do the GHASH reduction.
 	vpclmulqdq	$0x01,%zmm4,%zmm31,%zmm0
 	vpshufd	$0x4e,%zmm4,%zmm4
 	vpternlogd	$0x96,%zmm0,%zmm4,%zmm5
@@ -1238,11 +1238,11 @@
 
 
 .Ldone__func2:
-
+// Store the updated GHASH accumulator back to memory.
 	vpshufb	%xmm8,%xmm10,%xmm10
 	vmovdqu	%xmm10,(%r12)
 
-	vzeroupper
+	vzeroupper  // This is needed after using ymm or zmm registers.
 	popq	%r12
 .cfi_adjust_cfa_offset	-8
 .cfi_restore	%r12

boringssl-0.20260708.tar.xz/gen/bcm/aes-gcm-avx512-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/aes-gcm-avx512-x86_64-win.asm Changed

@@ -16,32 +16,32 @@
 ALIGN	64
 aes_gcm_avx512_constants:
 
-
+; A shuffle mask that reflects the bytes of 16-byte blocks
 $L$bswap_mask:
 	DQ	0x08090a0b0c0d0e0f,0x0001020304050607
 
-
-
-
-
-
-
-
+; This is the GHASH reducing polynomial without its constant term, i.e.
+; x^128 + x^7 + x^2 + x, represented using the backwards mapping
+; between bits and polynomial coefficients.
+; 
+; Alternatively, it can be interpreted as the naturally-ordered
+; representation of the polynomial x^127 + x^126 + x^121 + 1, i.e. the
+; "reversed" GHASH reducing polynomial without its x^128 term.
 $L$gfpoly:
 	DQ	1,0xc200000000000000
 
-
+; Same as above, but with the (1 << 64) bit set.
 $L$gfpoly_and_internal_carrybit:
 	DQ	1,0xc200000000000001
 
-
+; Values needed to prepare the initial vector of counter blocks.
 $L$ctr_pattern:
 	DQ	0,0
 	DQ	1,0
 	DQ	2,0
 	DQ	3,0
 
-
+; The number of AES blocks per vector, as a 128-bit value.
 $L$inc_4blocks:
 	DQ	4,0
 
@@ -54,100 +54,100 @@
 
 
 _CET_ENDBR
-
+; Get pointer to lowest set of key powers (located at end of array).
 	lea	r8,((256-64))+rcx
 
-
-
+; Load the byte-reflected hash subkey.  BoringSSL provides it in
+; byte-reflected form except the two halves are in the wrong order.
 	vpshufd	xmm3,XMMWORDrdx,0x4e
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+; Finish preprocessing the first key power, H^1.  Since this GHASH
+; implementation operates directly on values with the backwards bit
+; order specified by the GCM standard, it's necessary to preprocess the
+; raw key as follows.  First, reflect its bytes.  Second, multiply it
+; by x^-1 mod x^128 + x^7 + x^2 + x + 1 (if using the backwards
+; interpretation of polynomial coefficients), which can also be
+; interpreted as multiplication by x mod x^128 + x^127 + x^126 + x^121
+; + 1 using the alternative, natural interpretation of polynomial
+; coefficients.  For details, see the comment above _ghash_mul.
+; 
+; Either way, for the multiplication the concrete operation performed
+; is a left shift of the 128-bit value by 1 bit, then an XOR with (0xc2
+; << 120) | 1 if a 1 bit was carried out.  However, there's no 128-bit
+; wide shift instruction, so instead double each of the two 64-bit
+; halves and incorporate the internal carry bit into the value XOR'd.
 	vpshufd	xmm0,xmm3,0xd3
 	vpsrad	xmm0,xmm0,31
 	vpaddq	xmm3,xmm3,xmm3
-
+; H_CUR_XMM ^= TMP0_XMM & gfpoly_and_internal_carrybit
 	vpternlogd	xmm3,xmm0,XMMWORD$L$gfpoly_and_internal_carrybit,0x78
 
-
+; Load the gfpoly constant.
 	vbroadcasti32x4	zmm5,ZMMWORD$L$gfpoly
 
-
-
-
-
-
-
-
-	vpclmulqdq	xmm0,xmm3,xmm3,0x00
-	vpclmulqdq	xmm4,xmm3,xmm3,0x11
-	vpclmulqdq	xmm1,xmm5,xmm0,0x01
-	vpshufd	xmm0,xmm0,0x4e
-	vpxor	xmm1,xmm1,xmm0
-	vpclmulqdq	xmm0,xmm5,xmm1,0x01
-	vpshufd	xmm1,xmm1,0x4e
-	vpternlogd	xmm4,xmm1,xmm0,0x96
-
-
-
+; Square H^1 to get H^2.
+; 
+; Note that as with H^1, all higher key powers also need an extra
+; factor of x^-1 (or x using the natural interpretation).  Nothing
+; special needs to be done to make this happen, though: H^1 * H^1 would
+; end up with two factors of x^-1, but the multiplication consumes one.
+; So the product H^2 ends up with the desired one factor of x^-1.
+	vpclmulqdq	xmm0,xmm3,xmm3,0x00  ; LO = a_L * a_L
+	vpclmulqdq	xmm4,xmm3,xmm3,0x11  ; HI = a_H * a_H
+	vpclmulqdq	xmm1,xmm5,xmm0,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	xmm0,xmm0,0x4e  ; Swap halves of LO
+	vpxor	xmm1,xmm1,xmm0  ; Fold LO into MI
+	vpclmulqdq	xmm0,xmm5,xmm1,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	xmm1,xmm1,0x4e  ; Swap halves of MI
+	vpternlogd	xmm4,xmm1,xmm0,0x96  ; Fold MI into HI
+
+
+; Create H_CUR_YMM = H^2, H^1 and H_INC_YMM = H^2, H^2.
 	vinserti128	ymm3,ymm4,xmm3,1
 	vinserti128	ymm4,ymm4,xmm4,1
 
-
-	vpclmulqdq	ymm0,ymm3,ymm4,0x00
-	vpclmulqdq	ymm1,ymm3,ymm4,0x01
-	vpclmulqdq	ymm2,ymm3,ymm4,0x10
-	vpxord	ymm1,ymm1,ymm2
-	vpclmulqdq	ymm2,ymm5,ymm0,0x01
-	vpshufd	ymm0,ymm0,0x4e
-	vpternlogd	ymm1,ymm0,ymm2,0x96
-	vpclmulqdq	ymm4,ymm3,ymm4,0x11
-	vpclmulqdq	ymm0,ymm5,ymm1,0x01
-	vpshufd	ymm1,ymm1,0x4e
-	vpternlogd	ymm4,ymm1,ymm0,0x96
+; Create H_CUR = H^4, H^3, H^2, H^1 and H_INC = H^4, H^4, H^4, H^4.
+	vpclmulqdq	ymm0,ymm3,ymm4,0x00  ; LO = a_L * b_L
+	vpclmulqdq	ymm1,ymm3,ymm4,0x01  ; MI_0 = a_L * b_H
+	vpclmulqdq	ymm2,ymm3,ymm4,0x10  ; MI_1 = a_H * b_L
+	vpxord	ymm1,ymm1,ymm2  ; MI = MI_0 + MI_1
+	vpclmulqdq	ymm2,ymm5,ymm0,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	ymm0,ymm0,0x4e  ; Swap halves of LO
+	vpternlogd	ymm1,ymm0,ymm2,0x96  ; Fold LO into MI
+	vpclmulqdq	ymm4,ymm3,ymm4,0x11  ; HI = a_H * b_H
+	vpclmulqdq	ymm0,ymm5,ymm1,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	ymm1,ymm1,0x4e  ; Swap halves of MI
+	vpternlogd	ymm4,ymm1,ymm0,0x96  ; Fold MI into HI
 
 	vinserti64x4	zmm3,zmm4,ymm3,1
 	vshufi64x2	zmm4,zmm4,zmm4,0
 
-
+; Store the lowest set of key powers.
 	vmovdqu8	ZMMWORDr8,zmm3
 
-
-
-
+; Compute and store the remaining key powers.
+; Repeatedly multiply H^(i+3), H^(i+2), H^(i+1), H^i by
+; H^4, H^4, H^4, H^4 to get H^(i+7), H^(i+6), H^(i+5), H^(i+4).
 	mov	eax,3
 $L$precompute_next:
 	sub	r8,64
-	vpclmulqdq	zmm0,zmm3,zmm4,0x00
-	vpclmulqdq	zmm1,zmm3,zmm4,0x01
-	vpclmulqdq	zmm2,zmm3,zmm4,0x10
-	vpxord	zmm1,zmm1,zmm2
-	vpclmulqdq	zmm2,zmm5,zmm0,0x01
-	vpshufd	zmm0,zmm0,0x4e
-	vpternlogd	zmm1,zmm0,zmm2,0x96
-	vpclmulqdq	zmm3,zmm3,zmm4,0x11
-	vpclmulqdq	zmm0,zmm5,zmm1,0x01
-	vpshufd	zmm1,zmm1,0x4e
-	vpternlogd	zmm3,zmm1,zmm0,0x96
+	vpclmulqdq	zmm0,zmm3,zmm4,0x00  ; LO = a_L * b_L
+	vpclmulqdq	zmm1,zmm3,zmm4,0x01  ; MI_0 = a_L * b_H
+	vpclmulqdq	zmm2,zmm3,zmm4,0x10  ; MI_1 = a_H * b_L
+	vpxord	zmm1,zmm1,zmm2  ; MI = MI_0 + MI_1
+	vpclmulqdq	zmm2,zmm5,zmm0,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	zmm0,zmm0,0x4e  ; Swap halves of LO
+	vpternlogd	zmm1,zmm0,zmm2,0x96  ; Fold LO into MI
+	vpclmulqdq	zmm3,zmm3,zmm4,0x11  ; HI = a_H * b_H
+	vpclmulqdq	zmm0,zmm5,zmm1,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	zmm1,zmm1,0x4e  ; Swap halves of MI
+	vpternlogd	zmm3,zmm1,zmm0,0x96  ; Fold MI into HI
 
 	vmovdqu8	ZMMWORDr8,zmm3
 	dec	eax
 	jnz	NEAR $L$precompute_next
 
-	vzeroupper
+	vzeroupper  ; This is needed after using ymm or zmm registers.
 	ret
 
 
@@ -172,23 +172,23 @@
 	vmovdqu	xmm3,XMMWORD$L$gfpoly
 	vpshufb	xmm0,xmm0,xmm1
 
-	vpclmulqdq	xmm4,xmm0,xmm2,0x00
-	vpclmulqdq	xmm5,xmm0,xmm2,0x01
-	vpclmulqdq	xmm6,xmm0,xmm2,0x10
-	vpxord	xmm5,xmm5,xmm6
-	vpclmulqdq	xmm6,xmm3,xmm4,0x01
-	vpshufd	xmm4,xmm4,0x4e
-	vpternlogd	xmm5,xmm4,xmm6,0x96
-	vpclmulqdq	xmm0,xmm0,xmm2,0x11
-	vpclmulqdq	xmm4,xmm3,xmm5,0x01
-	vpshufd	xmm5,xmm5,0x4e
-	vpternlogd	xmm0,xmm5,xmm4,0x96
+	vpclmulqdq	xmm4,xmm0,xmm2,0x00  ; LO = a_L * b_L
+	vpclmulqdq	xmm5,xmm0,xmm2,0x01  ; MI_0 = a_L * b_H
+	vpclmulqdq	xmm6,xmm0,xmm2,0x10  ; MI_1 = a_H * b_L
+	vpxord	xmm5,xmm5,xmm6  ; MI = MI_0 + MI_1
+	vpclmulqdq	xmm6,xmm3,xmm4,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	xmm4,xmm4,0x4e  ; Swap halves of LO
+	vpternlogd	xmm5,xmm4,xmm6,0x96  ; Fold LO into MI
+	vpclmulqdq	xmm0,xmm0,xmm2,0x11  ; HI = a_H * b_H
+	vpclmulqdq	xmm4,xmm3,xmm5,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	xmm5,xmm5,0x4e  ; Swap halves of MI
+	vpternlogd	xmm0,xmm5,xmm4,0x96  ; Fold MI into HI
 
 
 	vpshufb	xmm0,xmm0,xmm1
 	vmovdqu	XMMWORDrcx,xmm0
 
-
+; No need for vzeroupper, since only xmm registers were used.
 	vmovdqa	xmm6,XMMWORDrsp
 	add	rsp,24
 	ret
@@ -223,37 +223,37 @@
 
 $L$SEH_endprologue_gcm_ghash_vpclmulqdq_avx512_11:
 
-
-
-
+; Load the bswap_mask and gfpoly constants.  Since AADLEN is usually small,
+; usually only 128-bit vectors will be used.  So as an optimization, don't
+; broadcast these constants to all 128-bit lanes quite yet.
 	vmovdqu	xmm4,XMMWORD$L$bswap_mask
 	vmovdqu	xmm10,XMMWORD$L$gfpoly
 
-
+; Load the GHASH accumulator.
 	vmovdqu	xmm5,XMMWORDrcx
 	vpshufb	xmm5,xmm5,xmm4
 
-
+; Optimize for AADLEN < 64 by checking for AADLEN < 64 before AADLEN < 256.
 	cmp	r9,64
 	jb	NEAR $L$aad_blockbyblock
 
-
-
+; AADLEN >= 64, so we'll operate on full vectors.  Broadcast bswap_mask and
+; gfpoly to all 128-bit lanes.
 	vshufi64x2	zmm4,zmm4,zmm4,0
 	vshufi64x2	zmm10,zmm10,zmm10,0
 
-
+; Load the lowest set of key powers.
 	vmovdqu8	zmm9,ZMMWORD((256-64))+rdx
 
 	cmp	r9,256
 	jb	NEAR $L$aad_loop_1x
 
-
+; AADLEN >= 256.  Load the higher key powers.
 	vmovdqu8	zmm6,ZMMWORD((256-256))+rdx
 	vmovdqu8	zmm7,ZMMWORD((256-192))+rdx
 	vmovdqu8	zmm8,ZMMWORD((256-128))+rdx
 
-
+; Update GHASH with 256 bytes of AAD at a time.
 $L$aad_loop_4x:
 	vmovdqu8	zmm0,ZMMWORDr8
 	vmovdqu8	zmm1,ZMMWORD64+r8
@@ -264,36 +264,36 @@
 	vpshufb	zmm1,zmm1,zmm4
 	vpshufb	zmm2,zmm2,zmm4
 	vpshufb	zmm3,zmm3,zmm4
-	vpclmulqdq	zmm5,zmm0,zmm6,0x00
-	vpclmulqdq	zmm11,zmm1,zmm7,0x00
-	vpclmulqdq	zmm12,zmm2,zmm8,0x00
-	vpxord	zmm5,zmm5,zmm11
-	vpclmulqdq	zmm13,zmm3,zmm9,0x00
-	vpternlogd	zmm5,zmm12,zmm13,0x96
-	vpclmulqdq	zmm11,zmm0,zmm6,0x01
-	vpclmulqdq	zmm12,zmm1,zmm7,0x01
-	vpclmulqdq	zmm13,zmm2,zmm8,0x01
-	vpternlogd	zmm11,zmm12,zmm13,0x96
-	vpclmulqdq	zmm12,zmm3,zmm9,0x01
-	vpclmulqdq	zmm13,zmm0,zmm6,0x10
-	vpternlogd	zmm11,zmm12,zmm13,0x96
-	vpclmulqdq	zmm12,zmm1,zmm7,0x10
-	vpclmulqdq	zmm13,zmm2,zmm8,0x10
-	vpternlogd	zmm11,zmm12,zmm13,0x96
-	vpclmulqdq	zmm13,zmm10,zmm5,0x01
-	vpclmulqdq	zmm12,zmm3,zmm9,0x10
-	vpxord	zmm11,zmm11,zmm12
-	vpshufd	zmm5,zmm5,0x4e
-	vpclmulqdq	zmm0,zmm0,zmm6,0x11
-	vpclmulqdq	zmm1,zmm1,zmm7,0x11
-	vpclmulqdq	zmm2,zmm2,zmm8,0x11
-	vpternlogd	zmm11,zmm5,zmm13,0x96
-	vpclmulqdq	zmm3,zmm3,zmm9,0x11
-	vpternlogd	zmm0,zmm1,zmm2,0x96
-	vpclmulqdq	zmm12,zmm10,zmm11,0x01
-	vpxord	zmm5,zmm0,zmm3
-	vpshufd	zmm11,zmm11,0x4e
-	vpternlogd	zmm5,zmm11,zmm12,0x96
+	vpclmulqdq	zmm5,zmm0,zmm6,0x00  ; LO_0
+	vpclmulqdq	zmm11,zmm1,zmm7,0x00  ; LO_1
+	vpclmulqdq	zmm12,zmm2,zmm8,0x00  ; LO_2
+	vpxord	zmm5,zmm5,zmm11  ; sum(LO_{1,0})
+	vpclmulqdq	zmm13,zmm3,zmm9,0x00  ; LO_3
+	vpternlogd	zmm5,zmm12,zmm13,0x96  ; LO = sum(LO_{3,2,1,0})
+	vpclmulqdq	zmm11,zmm0,zmm6,0x01  ; MI_0
+	vpclmulqdq	zmm12,zmm1,zmm7,0x01  ; MI_1
+	vpclmulqdq	zmm13,zmm2,zmm8,0x01  ; MI_2
+	vpternlogd	zmm11,zmm12,zmm13,0x96  ; sum(MI_{2,1,0})
+	vpclmulqdq	zmm12,zmm3,zmm9,0x01  ; MI_3
+	vpclmulqdq	zmm13,zmm0,zmm6,0x10  ; MI_4
+	vpternlogd	zmm11,zmm12,zmm13,0x96  ; sum(MI_{4,3,2,1,0})
+	vpclmulqdq	zmm12,zmm1,zmm7,0x10  ; MI_5
+	vpclmulqdq	zmm13,zmm2,zmm8,0x10  ; MI_6
+	vpternlogd	zmm11,zmm12,zmm13,0x96  ; sum(MI_{6,5,4,3,2,1,0})
+	vpclmulqdq	zmm13,zmm10,zmm5,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpclmulqdq	zmm12,zmm3,zmm9,0x10  ; MI_7
+	vpxord	zmm11,zmm11,zmm12  ; MI = sum(MI_{7,6,5,4,3,2,1,0})
+	vpshufd	zmm5,zmm5,0x4e  ; Swap halves of LO
+	vpclmulqdq	zmm0,zmm0,zmm6,0x11  ; HI_0
+	vpclmulqdq	zmm1,zmm1,zmm7,0x11  ; HI_1
+	vpclmulqdq	zmm2,zmm2,zmm8,0x11  ; HI_2
+	vpternlogd	zmm11,zmm5,zmm13,0x96  ; Fold LO into MI
+	vpclmulqdq	zmm3,zmm3,zmm9,0x11  ; HI_3
+	vpternlogd	zmm0,zmm1,zmm2,0x96  ; sum(HI_{2,1,0})
+	vpclmulqdq	zmm12,zmm10,zmm11,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpxord	zmm5,zmm0,zmm3  ; HI = sum(HI_{3,2,1,0})
+	vpshufd	zmm11,zmm11,0x4e  ; Swap halves of MI
+	vpternlogd	zmm5,zmm11,zmm12,0x96  ; Fold MI into HI
 	vextracti32x4	xmm0,zmm5,1
 	vextracti32x4	xmm1,zmm5,2
 	vextracti32x4	xmm2,zmm5,3
@@ -305,24 +305,24 @@
 	cmp	r9,256
 	jae	NEAR $L$aad_loop_4x
 
-
+; Update GHASH with 64 bytes of AAD at a time.
 	cmp	r9,64
 	jb	NEAR $L$aad_large_done
 $L$aad_loop_1x:
 	vmovdqu8	zmm0,ZMMWORDr8
 	vpshufb	zmm0,zmm0,zmm4
 	vpxord	zmm5,zmm5,zmm0
-	vpclmulqdq	zmm0,zmm5,zmm9,0x00
-	vpclmulqdq	zmm1,zmm5,zmm9,0x01
-	vpclmulqdq	zmm2,zmm5,zmm9,0x10
-	vpxord	zmm1,zmm1,zmm2
-	vpclmulqdq	zmm2,zmm10,zmm0,0x01
-	vpshufd	zmm0,zmm0,0x4e
-	vpternlogd	zmm1,zmm0,zmm2,0x96
-	vpclmulqdq	zmm5,zmm5,zmm9,0x11
-	vpclmulqdq	zmm0,zmm10,zmm1,0x01
-	vpshufd	zmm1,zmm1,0x4e
-	vpternlogd	zmm5,zmm1,zmm0,0x96
+	vpclmulqdq	zmm0,zmm5,zmm9,0x00  ; LO = a_L * b_L
+	vpclmulqdq	zmm1,zmm5,zmm9,0x01  ; MI_0 = a_L * b_H
+	vpclmulqdq	zmm2,zmm5,zmm9,0x10  ; MI_1 = a_H * b_L
+	vpxord	zmm1,zmm1,zmm2  ; MI = MI_0 + MI_1
+	vpclmulqdq	zmm2,zmm10,zmm0,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	zmm0,zmm0,0x4e  ; Swap halves of LO
+	vpternlogd	zmm1,zmm0,zmm2,0x96  ; Fold LO into MI
+	vpclmulqdq	zmm5,zmm5,zmm9,0x11  ; HI = a_H * b_H
+	vpclmulqdq	zmm0,zmm10,zmm1,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	zmm1,zmm1,0x4e  ; Swap halves of MI
+	vpternlogd	zmm5,zmm1,zmm0,0x96  ; Fold MI into HI
 
 	vextracti32x4	xmm0,zmm5,1
 	vextracti32x4	xmm1,zmm5,2
@@ -337,7 +337,7 @@
 
 $L$aad_large_done:
 
-
+; GHASH the remaining data 16 bytes at a time, using xmm registers only.
 $L$aad_blockbyblock:
 	test	r9,r9
 	jz	NEAR $L$aad_done
@@ -346,28 +346,28 @@
 	vmovdqu	xmm0,XMMWORDr8
 	vpshufb	xmm0,xmm0,xmm4
 	vpxor	xmm5,xmm5,xmm0
-	vpclmulqdq	xmm0,xmm5,xmm9,0x00
-	vpclmulqdq	xmm1,xmm5,xmm9,0x01
-	vpclmulqdq	xmm2,xmm5,xmm9,0x10
-	vpxord	xmm1,xmm1,xmm2
-	vpclmulqdq	xmm2,xmm10,xmm0,0x01
-	vpshufd	xmm0,xmm0,0x4e
-	vpternlogd	xmm1,xmm0,xmm2,0x96
-	vpclmulqdq	xmm5,xmm5,xmm9,0x11
-	vpclmulqdq	xmm0,xmm10,xmm1,0x01
-	vpshufd	xmm1,xmm1,0x4e
-	vpternlogd	xmm5,xmm1,xmm0,0x96
+	vpclmulqdq	xmm0,xmm5,xmm9,0x00  ; LO = a_L * b_L
+	vpclmulqdq	xmm1,xmm5,xmm9,0x01  ; MI_0 = a_L * b_H
+	vpclmulqdq	xmm2,xmm5,xmm9,0x10  ; MI_1 = a_H * b_L
+	vpxord	xmm1,xmm1,xmm2  ; MI = MI_0 + MI_1
+	vpclmulqdq	xmm2,xmm10,xmm0,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpshufd	xmm0,xmm0,0x4e  ; Swap halves of LO
+	vpternlogd	xmm1,xmm0,xmm2,0x96  ; Fold LO into MI
+	vpclmulqdq	xmm5,xmm5,xmm9,0x11  ; HI = a_H * b_H
+	vpclmulqdq	xmm0,xmm10,xmm1,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpshufd	xmm1,xmm1,0x4e  ; Swap halves of MI
+	vpternlogd	xmm5,xmm1,xmm0,0x96  ; Fold MI into HI
 
 	add	r8,16
 	sub	r9,16
 	jnz	NEAR $L$aad_loop_blockbyblock
 
 $L$aad_done:
-
+; Store the updated GHASH accumulator back to memory.
 	vpshufb	xmm5,xmm5,xmm4
 	vmovdqu	XMMWORDrcx,xmm5
 
-	vzeroupper
+	vzeroupper  ; This is needed after using ymm or zmm registers.
 	vmovdqa	xmm6,XMMWORDrsp
 	vmovdqa	xmm7,XMMWORD16+rsp
 	vmovdqa	xmm8,XMMWORD32+rsp
@@ -395,9 +395,9 @@
 	push	r12
 $L$SEH_prologue_aes_gcm_enc_update_vaes_avx512_4:
 
-	mov	rsi,QWORD64+rsp
-	mov	rdi,QWORD72+rsp
-	mov	r12,QWORD80+rsp
+	mov	rsi,QWORD64+rsp  ; arg5
+	mov	rdi,QWORD72+rsp  ; arg6
+	mov	r12,QWORD80+rsp  ; arg7
 	sub	rsp,160
 $L$SEH_prologue_aes_gcm_enc_update_vaes_avx512_5:
 	vmovdqa	XMMWORDrsp,xmm6
@@ -426,49 +426,49 @@
 EXTERN	BORINGSSL_function_hit
 	mov	BYTE((BORINGSSL_function_hit+7)),1
 %endif
-
+; Load some constants.
 	vbroadcasti32x4	zmm8,ZMMWORD$L$bswap_mask
 	vbroadcasti32x4	zmm31,ZMMWORD$L$gfpoly
 
-
-
+; Load the GHASH accumulator and the starting counter.
+; BoringSSL passes these values in big endian format.
 	vmovdqu	xmm10,XMMWORDr12
 	vpshufb	xmm10,xmm10,xmm8
 	vbroadcasti32x4	zmm12,ZMMWORDrsi
 	vpshufb	zmm12,zmm12,zmm8
 
-
-
+; Load the AES key length in bytes.  BoringSSL stores number of rounds
+; minus 1, so convert using: AESKEYLEN = 4 * aeskey->rounds - 20.
 	mov	r10d,DWORD240+r9
 	lea	r10d,((-20))+r10*4
 
-
-
-
+; Make RNDKEYLAST_PTR point to the last AES round key.  This is the
+; round key with index 10, 12, or 14 for AES-128, AES-192, or AES-256
+; respectively.  Then load the zero-th and last round keys.
 	lea	r11,96+r10*4+r9
 	vbroadcasti32x4	zmm13,ZMMWORDr9
 	vbroadcasti32x4	zmm14,ZMMWORDr11
 
-
+; Finish initializing LE_CTR by adding 0, 1, 2, 3 to its low words.
 	vpaddd	zmm12,zmm12,ZMMWORD$L$ctr_pattern
 
-
+; Load 4 into all 128-bit lanes of LE_CTR_INC.
 	vbroadcasti32x4	zmm11,ZMMWORD$L$inc_4blocks
 
-
-
+; If there are at least 256 bytes of data, then continue into the loop
+; that processes 256 bytes of data at a time.  Otherwise skip it.
 	cmp	r8,256
 	jb	NEAR $L$crypt_loop_4x_done__func1
 
-
+; Load powers of the hash key.
 	vmovdqu8	zmm27,ZMMWORD((256-256))+rdi
 	vmovdqu8	zmm28,ZMMWORD((256-192))+rdi
 	vmovdqu8	zmm29,ZMMWORD((256-128))+rdi
 	vmovdqu8	zmm30,ZMMWORD((256-64))+rdi
-
-
-
-
+; Encrypt the first 4 vectors of plaintext blocks.  Leave the resulting
+; ciphertext in GHASHDATA0-3 for GHASH.
+; Increment le_ctr four times to generate four vectors of little-endian
+; counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vpshufb	zmm0,zmm12,zmm8
 	vpaddd	zmm12,zmm12,zmm11
 	vpshufb	zmm1,zmm12,zmm8
@@ -478,7 +478,7 @@
 	vpshufb	zmm3,zmm12,zmm8
 	vpaddd	zmm12,zmm12,zmm11
 
-
+; AES "round zero": XOR in the zero-th round key.
 	vpxord	zmm0,zmm0,zmm13
 	vpxord	zmm1,zmm1,zmm13
 	vpxord	zmm2,zmm2,zmm13
@@ -513,7 +513,7 @@
 	sub	r8,256
 	cmp	r8,256
 	jb	NEAR $L$ghash_last_ciphertext_4x__func1
-
+; Cache as many additional AES round keys as possible.
 	vbroadcasti32x4	zmm15,ZMMWORD((-144))+r11
 	vbroadcasti32x4	zmm16,ZMMWORD((-128))+r11
 	vbroadcasti32x4	zmm17,ZMMWORD((-112))+r11
@@ -525,9 +525,9 @@
 	vbroadcasti32x4	zmm23,ZMMWORD((-16))+r11
 
 $L$crypt_loop_4x__func1:
-
-
-
+; Start the AES encryption of the counter blocks.
+; Increment le_ctr four times to generate four vectors of little-endian
+; counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vpshufb	zmm0,zmm12,zmm8
 	vpaddd	zmm12,zmm12,zmm11
 	vpshufb	zmm1,zmm12,zmm8
@@ -537,7 +537,7 @@
 	vpshufb	zmm3,zmm12,zmm8
 	vpaddd	zmm12,zmm12,zmm11
 
-
+; AES "round zero": XOR in the zero-th round key.
 	vpxord	zmm0,zmm0,zmm13
 	vpxord	zmm1,zmm1,zmm13
 	vpxord	zmm2,zmm2,zmm13
@@ -546,7 +546,7 @@
 	cmp	r10d,24
 	jl	NEAR $L$aes128__func1
 	je	NEAR $L$aes192__func1
-
+; AES-256
 	vbroadcasti32x4	zmm9,ZMMWORD((-208))+r11
 	vaesenc	zmm0,zmm0,zmm9
 	vaesenc	zmm1,zmm1,zmm9
@@ -574,17 +574,17 @@
 
 $L$aes128__func1:
 
-
-
-
+; Prefetch the source data 512 bytes ahead into the L1 data cache, to
+; improve performance when the hardware prefetcher is disabled.  Assumes the
+; L1 data cache line size is 64 bytes (de facto standard on x86_64).
 	prefetcht0	((512+0))+rcx
 	prefetcht0	((512+64))+rcx
 	prefetcht0	((512+128))+rcx
 	prefetcht0	((512+192))+rcx
 
-
-
-
+; Finish the AES encryption of the counter blocks in AESDATA0-3,
+; interleaved with the GHASH update of the ciphertext blocks in
+; GHASHDATA0-3.
 	vpshufb	zmm4,zmm4,zmm8
 	vpxord	zmm4,zmm4,zmm10
 	vpshufb	zmm5,zmm5,zmm8
@@ -596,78 +596,78 @@
 	vaesenc	zmm3,zmm3,zmm15
 
 	vpshufb	zmm7,zmm7,zmm8
-	vpclmulqdq	zmm10,zmm4,zmm27,0x00
-	vpclmulqdq	zmm24,zmm5,zmm28,0x00
-	vpclmulqdq	zmm25,zmm6,zmm29,0x00
+	vpclmulqdq	zmm10,zmm4,zmm27,0x00  ; LO_0
+	vpclmulqdq	zmm24,zmm5,zmm28,0x00  ; LO_1
+	vpclmulqdq	zmm25,zmm6,zmm29,0x00  ; LO_2
 
 	vaesenc	zmm0,zmm0,zmm16
 	vaesenc	zmm1,zmm1,zmm16
 	vaesenc	zmm2,zmm2,zmm16
 	vaesenc	zmm3,zmm3,zmm16
 
-	vpxord	zmm10,zmm10,zmm24
-	vpclmulqdq	zmm26,zmm7,zmm30,0x00
-	vpternlogd	zmm10,zmm25,zmm26,0x96
-	vpclmulqdq	zmm24,zmm4,zmm27,0x01
+	vpxord	zmm10,zmm10,zmm24  ; sum(LO_{1,0})
+	vpclmulqdq	zmm26,zmm7,zmm30,0x00  ; LO_3
+	vpternlogd	zmm10,zmm25,zmm26,0x96  ; LO = sum(LO_{3,2,1,0})
+	vpclmulqdq	zmm24,zmm4,zmm27,0x01  ; MI_0
 
 	vaesenc	zmm0,zmm0,zmm17
 	vaesenc	zmm1,zmm1,zmm17
 	vaesenc	zmm2,zmm2,zmm17
 	vaesenc	zmm3,zmm3,zmm17
 
-	vpclmulqdq	zmm25,zmm5,zmm28,0x01
-	vpclmulqdq	zmm26,zmm6,zmm29,0x01
-	vpternlogd	zmm24,zmm25,zmm26,0x96
-	vpclmulqdq	zmm25,zmm7,zmm30,0x01
+	vpclmulqdq	zmm25,zmm5,zmm28,0x01  ; MI_1
+	vpclmulqdq	zmm26,zmm6,zmm29,0x01  ; MI_2
+	vpternlogd	zmm24,zmm25,zmm26,0x96  ; sum(MI_{2,1,0})
+	vpclmulqdq	zmm25,zmm7,zmm30,0x01  ; MI_3
 
 	vaesenc	zmm0,zmm0,zmm18
 	vaesenc	zmm1,zmm1,zmm18
 	vaesenc	zmm2,zmm2,zmm18
 	vaesenc	zmm3,zmm3,zmm18
 
-	vpclmulqdq	zmm26,zmm4,zmm27,0x10
-	vpternlogd	zmm24,zmm25,zmm26,0x96
-	vpclmulqdq	zmm25,zmm5,zmm28,0x10
-	vpclmulqdq	zmm26,zmm6,zmm29,0x10
+	vpclmulqdq	zmm26,zmm4,zmm27,0x10  ; MI_4
+	vpternlogd	zmm24,zmm25,zmm26,0x96  ; sum(MI_{4,3,2,1,0})
+	vpclmulqdq	zmm25,zmm5,zmm28,0x10  ; MI_5
+	vpclmulqdq	zmm26,zmm6,zmm29,0x10  ; MI_6
 
 	vaesenc	zmm0,zmm0,zmm19
 	vaesenc	zmm1,zmm1,zmm19
 	vaesenc	zmm2,zmm2,zmm19
 	vaesenc	zmm3,zmm3,zmm19
 
-	vpternlogd	zmm24,zmm25,zmm26,0x96
-	vpclmulqdq	zmm26,zmm31,zmm10,0x01
-	vpclmulqdq	zmm25,zmm7,zmm30,0x10
-	vpxord	zmm24,zmm24,zmm25
+	vpternlogd	zmm24,zmm25,zmm26,0x96  ; sum(MI_{6,5,4,3,2,1,0})
+	vpclmulqdq	zmm26,zmm31,zmm10,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpclmulqdq	zmm25,zmm7,zmm30,0x10  ; MI_7
+	vpxord	zmm24,zmm24,zmm25  ; MI = sum(MI_{7,6,5,4,3,2,1,0})
 
 	vaesenc	zmm0,zmm0,zmm20
 	vaesenc	zmm1,zmm1,zmm20
 	vaesenc	zmm2,zmm2,zmm20
 	vaesenc	zmm3,zmm3,zmm20
 
-	vpshufd	zmm10,zmm10,0x4e
-	vpclmulqdq	zmm4,zmm4,zmm27,0x11
-	vpclmulqdq	zmm5,zmm5,zmm28,0x11
-	vpclmulqdq	zmm6,zmm6,zmm29,0x11
+	vpshufd	zmm10,zmm10,0x4e  ; Swap halves of LO
+	vpclmulqdq	zmm4,zmm4,zmm27,0x11  ; HI_0
+	vpclmulqdq	zmm5,zmm5,zmm28,0x11  ; HI_1
+	vpclmulqdq	zmm6,zmm6,zmm29,0x11  ; HI_2
 
 	vaesenc	zmm0,zmm0,zmm21
 	vaesenc	zmm1,zmm1,zmm21
 	vaesenc	zmm2,zmm2,zmm21
 	vaesenc	zmm3,zmm3,zmm21
 
-	vpternlogd	zmm24,zmm10,zmm26,0x96
-	vpclmulqdq	zmm7,zmm7,zmm30,0x11
-	vpternlogd	zmm4,zmm5,zmm6,0x96
-	vpclmulqdq	zmm25,zmm31,zmm24,0x01
+	vpternlogd	zmm24,zmm10,zmm26,0x96  ; Fold LO into MI
+	vpclmulqdq	zmm7,zmm7,zmm30,0x11  ; HI_3
+	vpternlogd	zmm4,zmm5,zmm6,0x96  ; sum(HI_{2,1,0})
+	vpclmulqdq	zmm25,zmm31,zmm24,0x01  ; MI_L*(x^63 + x^62 + x^57)
 
 	vaesenc	zmm0,zmm0,zmm22
 	vaesenc	zmm1,zmm1,zmm22
 	vaesenc	zmm2,zmm2,zmm22
 	vaesenc	zmm3,zmm3,zmm22
 
-	vpxord	zmm10,zmm4,zmm7
-	vpshufd	zmm24,zmm24,0x4e
-	vpternlogd	zmm10,zmm24,zmm25,0x96
+	vpxord	zmm10,zmm4,zmm7  ; HI = sum(HI_{3,2,1,0})
+	vpshufd	zmm24,zmm24,0x4e  ; Swap halves of MI
+	vpternlogd	zmm10,zmm24,zmm25,0x96  ; Fold MI into HI
 
 	vaesenc	zmm0,zmm0,zmm23
 	vaesenc	zmm1,zmm1,zmm23
@@ -705,36 +705,36 @@
 	vpshufb	zmm5,zmm5,zmm8
 	vpshufb	zmm6,zmm6,zmm8
 	vpshufb	zmm7,zmm7,zmm8
-	vpclmulqdq	zmm10,zmm4,zmm27,0x00
-	vpclmulqdq	zmm24,zmm5,zmm28,0x00
-	vpclmulqdq	zmm25,zmm6,zmm29,0x00
-	vpxord	zmm10,zmm10,zmm24
-	vpclmulqdq	zmm26,zmm7,zmm30,0x00
-	vpternlogd	zmm10,zmm25,zmm26,0x96
-	vpclmulqdq	zmm24,zmm4,zmm27,0x01
-	vpclmulqdq	zmm25,zmm5,zmm28,0x01
-	vpclmulqdq	zmm26,zmm6,zmm29,0x01
-	vpternlogd	zmm24,zmm25,zmm26,0x96
-	vpclmulqdq	zmm25,zmm7,zmm30,0x01
-	vpclmulqdq	zmm26,zmm4,zmm27,0x10
-	vpternlogd	zmm24,zmm25,zmm26,0x96
-	vpclmulqdq	zmm25,zmm5,zmm28,0x10
-	vpclmulqdq	zmm26,zmm6,zmm29,0x10
-	vpternlogd	zmm24,zmm25,zmm26,0x96
-	vpclmulqdq	zmm26,zmm31,zmm10,0x01
-	vpclmulqdq	zmm25,zmm7,zmm30,0x10
-	vpxord	zmm24,zmm24,zmm25
-	vpshufd	zmm10,zmm10,0x4e
-	vpclmulqdq	zmm4,zmm4,zmm27,0x11
-	vpclmulqdq	zmm5,zmm5,zmm28,0x11
-	vpclmulqdq	zmm6,zmm6,zmm29,0x11
-	vpternlogd	zmm24,zmm10,zmm26,0x96
-	vpclmulqdq	zmm7,zmm7,zmm30,0x11
-	vpternlogd	zmm4,zmm5,zmm6,0x96
-	vpclmulqdq	zmm25,zmm31,zmm24,0x01
-	vpxord	zmm10,zmm4,zmm7
-	vpshufd	zmm24,zmm24,0x4e
-	vpternlogd	zmm10,zmm24,zmm25,0x96
+	vpclmulqdq	zmm10,zmm4,zmm27,0x00  ; LO_0
+	vpclmulqdq	zmm24,zmm5,zmm28,0x00  ; LO_1
+	vpclmulqdq	zmm25,zmm6,zmm29,0x00  ; LO_2
+	vpxord	zmm10,zmm10,zmm24  ; sum(LO_{1,0})
+	vpclmulqdq	zmm26,zmm7,zmm30,0x00  ; LO_3
+	vpternlogd	zmm10,zmm25,zmm26,0x96  ; LO = sum(LO_{3,2,1,0})
+	vpclmulqdq	zmm24,zmm4,zmm27,0x01  ; MI_0
+	vpclmulqdq	zmm25,zmm5,zmm28,0x01  ; MI_1
+	vpclmulqdq	zmm26,zmm6,zmm29,0x01  ; MI_2
+	vpternlogd	zmm24,zmm25,zmm26,0x96  ; sum(MI_{2,1,0})
+	vpclmulqdq	zmm25,zmm7,zmm30,0x01  ; MI_3
+	vpclmulqdq	zmm26,zmm4,zmm27,0x10  ; MI_4
+	vpternlogd	zmm24,zmm25,zmm26,0x96  ; sum(MI_{4,3,2,1,0})
+	vpclmulqdq	zmm25,zmm5,zmm28,0x10  ; MI_5
+	vpclmulqdq	zmm26,zmm6,zmm29,0x10  ; MI_6
+	vpternlogd	zmm24,zmm25,zmm26,0x96  ; sum(MI_{6,5,4,3,2,1,0})
+	vpclmulqdq	zmm26,zmm31,zmm10,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpclmulqdq	zmm25,zmm7,zmm30,0x10  ; MI_7
+	vpxord	zmm24,zmm24,zmm25  ; MI = sum(MI_{7,6,5,4,3,2,1,0})
+	vpshufd	zmm10,zmm10,0x4e  ; Swap halves of LO
+	vpclmulqdq	zmm4,zmm4,zmm27,0x11  ; HI_0
+	vpclmulqdq	zmm5,zmm5,zmm28,0x11  ; HI_1
+	vpclmulqdq	zmm6,zmm6,zmm29,0x11  ; HI_2
+	vpternlogd	zmm24,zmm10,zmm26,0x96  ; Fold LO into MI
+	vpclmulqdq	zmm7,zmm7,zmm30,0x11  ; HI_3
+	vpternlogd	zmm4,zmm5,zmm6,0x96  ; sum(HI_{2,1,0})
+	vpclmulqdq	zmm25,zmm31,zmm24,0x01  ; MI_L*(x^63 + x^62 + x^57)
+	vpxord	zmm10,zmm4,zmm7  ; HI = sum(HI_{3,2,1,0})
+	vpshufd	zmm24,zmm24,0x4e  ; Swap halves of MI
+	vpternlogd	zmm10,zmm24,zmm25,0x96  ; Fold MI into HI
 	vextracti32x4	xmm4,zmm10,1
 	vextracti32x4	xmm5,zmm10,2
 	vextracti32x4	xmm6,zmm10,3
@@ -742,32 +742,32 @@
 	vpternlogd	xmm10,xmm6,xmm5,0x96
 
 $L$crypt_loop_4x_done__func1:
-
+; Check whether any data remains.
 	test	r8,r8
 	jz	NEAR $L$done__func1
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+; The data length isn't a multiple of 256 bytes.  Process the remaining
+; data of length 1 <= DATALEN < 256, up to one 64-byte vector at a time.
+; Going one vector at a time may seem inefficient compared to having
+; separate code paths for each possible number of vectors remaining.
+; However, using a loop keeps the code size down, and it performs
+; surprising well; modern CPUs will start executing the next iteration
+; before the previous one finishes and also predict the number of loop
+; iterations.  For a similar reason, we roll up the AES rounds.
+; 
+; On the last iteration, the remaining length may be less than 64 bytes.
+; Handle this using masking.
+; 
+; Since there are enough key powers available for all remaining data,
+; there is no need to do a GHASH reduction after each iteration.
+; Instead, multiply each remaining block by its own key power, and only
+; do a GHASH reduction at the very end.
+
+; Make POWERS_PTR point to the key powers H^N, H^(N-1), ... where N
+; is the number of blocks that remain.
 	mov	rax,r8
 	neg	rax
-	and	rax,-16
+	and	rax,-16  ; -round_up(DATALEN, 16)
 	lea	rsi,256+rax*1+rdi
 	vpxor	xmm4,xmm4,xmm4
 	vpxor	xmm5,xmm5,xmm5
@@ -777,9 +777,9 @@
 	jb	NEAR $L$partial_vec__func1
 
 $L$crypt_loop_1x__func1:
+; Process a full 64-byte vector.
 
-
-
+; Encrypt a vector of counter blocks.
 	vpshufb	zmm0,zmm12,zmm8
 	vpaddd	zmm12,zmm12,zmm11
 	vpxord	zmm0,zmm0,zmm13
@@ -792,19 +792,19 @@
 	jne	NEAR $L$vaesenc_loop_tail_full_vec__func1
 	vaesenclast	zmm0,zmm0,zmm14
 
-
+; XOR the data with the vector of keystream blocks.
 	vmovdqu8	zmm1,ZMMWORDrcx
 	vpxord	zmm0,zmm0,zmm1
 	vmovdqu8	ZMMWORDrdx,zmm0
 
-
+; Update GHASH with the ciphertext blocks, without reducing.
 	vmovdqu8	zmm30,ZMMWORDrsi
 	vpshufb	zmm0,zmm0,zmm8
 	vpxord	zmm0,zmm0,zmm10
-	vpclmulqdq	zmm7,zmm0,zmm30,0x00
-	vpclmulqdq	zmm1,zmm0,zmm30,0x01
-	vpclmulqdq	zmm2,zmm0,zmm30,0x10
-	vpclmulqdq	zmm3,zmm0,zmm30,0x11
+	vpclmulqdq	zmm7,zmm0,zmm30,0x00  ; a_L * b_L
+	vpclmulqdq	zmm1,zmm0,zmm30,0x01  ; a_L * b_H
+	vpclmulqdq	zmm2,zmm0,zmm30,0x10  ; a_H * b_L
+	vpclmulqdq	zmm3,zmm0,zmm30,0x11  ; a_H * b_H
 	vpxord	zmm4,zmm4,zmm7
 	vpternlogd	zmm5,zmm1,zmm2,0x96
 	vpxord	zmm6,zmm6,zmm3
@@ -822,10 +822,10 @@
 	jz	NEAR $L$reduce__func1
 
 $L$partial_vec__func1:
+; Process a partial vector of length 1 <= DATALEN < 64.
 
-
-
-
+; Set the data mask %k1 to DATALEN 1's.
+; Set the key powers mask %k2 to round_up(DATALEN, 16) 1's.
 	mov	rax,-1
 	bzhi	rax,rax,r8
 	kmovq	k1,rax
@@ -835,8 +835,8 @@
 	bzhi	rax,rax,r8
 	kmovq	k2,rax
 
-
-
+; Encrypt one last vector of counter blocks.  This does not need to be
+; masked.  The counter does not need to be incremented here.
 	vpshufb	zmm0,zmm12,zmm8
 	vpxord	zmm0,zmm0,zmm13
 	lea	rax,16+r9
@@ -848,38 +848,38 @@
 	jne	NEAR $L$vaesenc_loop_tail_partialvec__func1
 	vaesenclast	zmm0,zmm0,zmm14
 
-
+; XOR the data with the appropriate number of keystream bytes.
 	vmovdqu8	zmm1{k1}{z},rcx
 	vpxord	zmm0,zmm0,zmm1
 	vmovdqu8	ZMMWORDrdx{k1},zmm0
 
-
-
-
-
-
-
-
-
-
-
-
-
+; Update GHASH with the ciphertext block(s), without reducing.
+; 
+; In the case of DATALEN < 64, the ciphertext is zero-padded to 64
+; bytes.  (If decrypting, it's done by the above masked load.  If
+; encrypting, it's done by the below masked register-to-register move.)
+; Note that if DATALEN <= 48, there will be additional padding beyond
+; the padding of the last block specified by GHASH itself; i.e., there
+; may be whole block(s) that get processed by the GHASH multiplication
+; and reduction instructions but should not actually be included in the
+; GHASH.  However, any such blocks are all-zeroes, and the values that
+; they're multiplied with are also all-zeroes.  Therefore they just add
+; 0 * 0 = 0 to the final GHASH result, which makes no difference.
 	vmovdqu8	zmm30{k2}{z},rsi
 	vmovdqu8	zmm1{k1}{z},zmm0
 	vpshufb	zmm0,zmm1,zmm8
 	vpxord	zmm0,zmm0,zmm10
-	vpclmulqdq	zmm7,zmm0,zmm30,0x00
-	vpclmulqdq	zmm1,zmm0,zmm30,0x01
-	vpclmulqdq	zmm2,zmm0,zmm30,0x10
-	vpclmulqdq	zmm3,zmm0,zmm30,0x11
+	vpclmulqdq	zmm7,zmm0,zmm30,0x00  ; a_L * b_L
+	vpclmulqdq	zmm1,zmm0,zmm30,0x01  ; a_L * b_H
+	vpclmulqdq	zmm2,zmm0,zmm30,0x10  ; a_H * b_L
+	vpclmulqdq	zmm3,zmm0,zmm30,0x11  ; a_H * b_H
 	vpxord	zmm4,zmm4,zmm7
 	vpternlogd	zmm5,zmm1,zmm2,0x96
 	vpxord	zmm6,zmm6,zmm3
 
 
 $L$reduce__func1:
-
+; Finally, do the GHASH reduction.
 	vpclmulqdq	zmm0,zmm31,zmm4,0x01
 	vpshufd	zmm4,zmm4,0x4e
 	vpternlogd	zmm5,zmm4,zmm0,0x96
@@ -895,11 +895,11 @@
 
 
 $L$done__func1:
-
+; Store the updated GHASH accumulator back to memory.
 	vpshufb	xmm10,xmm10,xmm8
 	vmovdqu	XMMWORDr12,xmm10
 
-	vzeroupper
+	vzeroupper  ; This is needed after using ymm or zmm registers.
 	vmovdqa	xmm6,XMMWORDrsp
 	vmovdqa	xmm7,XMMWORD16+rsp
 	vmovdqa	xmm8,XMMWORD32+rsp
@@ -932,9 +932,9 @@
 	push	r12
 $L$SEH_prologue_aes_gcm_dec_update_vaes_avx512_4:
 
-	mov	rsi,QWORD64+rsp
-	mov	rdi,QWORD72+rsp
-	mov	r12,QWORD80+rsp
+	mov	rsi,QWORD64+rsp  ; arg5
+	mov	rdi,QWORD72+rsp  ; arg6
+	mov	r12,QWORD80+rsp  ; arg7
 	sub	rsp,160
 $L$SEH_prologue_aes_gcm_dec_update_vaes_avx512_5:
 	vmovdqa	XMMWORDrsp,xmm6
@@ -959,46 +959,46 @@
 $L$SEH_prologue_aes_gcm_dec_update_vaes_avx512_15:
 
 $L$SEH_endprologue_aes_gcm_dec_update_vaes_avx512_16:
-
+; Load some constants.
 	vbroadcasti32x4	zmm8,ZMMWORD$L$bswap_mask
 	vbroadcasti32x4	zmm31,ZMMWORD$L$gfpoly
 
-
-
+; Load the GHASH accumulator and the starting counter.
+; BoringSSL passes these values in big endian format.
 	vmovdqu	xmm10,XMMWORDr12
 	vpshufb	xmm10,xmm10,xmm8
 	vbroadcasti32x4	zmm12,ZMMWORDrsi
 	vpshufb	zmm12,zmm12,zmm8
 
-
-
+; Load the AES key length in bytes.  BoringSSL stores number of rounds
+; minus 1, so convert using: AESKEYLEN = 4 * aeskey->rounds - 20.
 	mov	r10d,DWORD240+r9
 	lea	r10d,((-20))+r10*4
 
-
-
-
+; Make RNDKEYLAST_PTR point to the last AES round key.  This is the
+; round key with index 10, 12, or 14 for AES-128, AES-192, or AES-256
+; respectively.  Then load the zero-th and last round keys.
 	lea	r11,96+r10*4+r9
 	vbroadcasti32x4	zmm13,ZMMWORDr9
 	vbroadcasti32x4	zmm14,ZMMWORDr11
 
-
+; Finish initializing LE_CTR by adding 0, 1, 2, 3 to its low words.
 	vpaddd	zmm12,zmm12,ZMMWORD$L$ctr_pattern
 
-
+; Load 4 into all 128-bit lanes of LE_CTR_INC.
 	vbroadcasti32x4	zmm11,ZMMWORD$L$inc_4blocks
 
-
-
+; If there are at least 256 bytes of data, then continue into the loop
+; that processes 256 bytes of data at a time.  Otherwise skip it.
 	cmp	r8,256
 	jb	NEAR $L$crypt_loop_4x_done__func2
 
-
+; Load powers of the hash key.
 	vmovdqu8	zmm27,ZMMWORD((256-256))+rdi
 	vmovdqu8	zmm28,ZMMWORD((256-192))+rdi
 	vmovdqu8	zmm29,ZMMWORD((256-128))+rdi
 	vmovdqu8	zmm30,ZMMWORD((256-64))+rdi
-
+; Cache as many additional AES round keys as possible.
 	vbroadcasti32x4	zmm15,ZMMWORD((-144))+r11
 	vbroadcasti32x4	zmm16,ZMMWORD((-128))+r11
 	vbroadcasti32x4	zmm17,ZMMWORD((-112))+r11
@@ -1014,9 +1014,9 @@
 	vmovdqu8	zmm5,ZMMWORD64+rcx
 	vmovdqu8	zmm6,ZMMWORD128+rcx
 	vmovdqu8	zmm7,ZMMWORD192+rcx
-
-
-
+; Start the AES encryption of the counter blocks.
+; Increment le_ctr four times to generate four vectors of little-endian
+; counter blocks, swap each to big-endian, and store them in aesdata0-3.
 	vpshufb	zmm0,zmm12,zmm8
 	vpaddd	zmm12,zmm12,zmm11
 	vpshufb	zmm1,zmm12,zmm8
@@ -1026,7 +1026,7 @@
 	vpshufb	zmm3,zmm12,zmm8
 	vpaddd	zmm12,zmm12,zmm11
 
-
+; AES "round zero": XOR in the zero-th round key.
 	vpxord	zmm0,zmm0,zmm13
 	vpxord	zmm1,zmm1,zmm13
 	vpxord	zmm2,zmm2,zmm13
@@ -1035,7 +1035,7 @@
 	cmp	r10d,24
 	jl	NEAR $L$aes128__func2
 	je	NEAR $L$aes192__func2
-
+; AES-256
 	vbroadcasti32x4	zmm9,ZMMWORD((-208))+r11
 	vaesenc	zmm0,zmm0,zmm9
 	vaesenc	zmm1,zmm1,zmm9
@@ -1063,17 +1063,17 @@
 
 $L$aes128__func2:
 
-
-
-
+; Prefetch the source data 512 bytes ahead into the L1 data cache, to
+; improve performance when the hardware prefetcher is disabled.  Assumes the
+; L1 data cache line size is 64 bytes (de facto standard on x86_64).
 	prefetcht0	((512+0))+rcx
 	prefetcht0	((512+64))+rcx
 	prefetcht0	((512+128))+rcx
 	prefetcht0	((512+192))+rcx
 
-
-
-
+; Finish the AES encryption of the counter blocks in AESDATA0-3,
+; interleaved with the GHASH update of the ciphertext blocks in
+; GHASHDATA0-3.
 	vpshufb	zmm4,zmm4,zmm8
 	vpxord	zmm4,zmm4,zmm10
 	vpshufb	zmm5,zmm5,zmm8
@@ -1085,78 +1085,78 @@
 	vaesenc	zmm3,zmm3,zmm15
 
 	vpshufb	zmm7,zmm7,zmm8
-	vpclmulqdq	zmm10,zmm4,zmm27,0x00
-	vpclmulqdq	zmm24,zmm5,zmm28,0x00
-	vpclmulqdq	zmm25,zmm6,zmm29,0x00
+	vpclmulqdq	zmm10,zmm4,zmm27,0x00  ; LO_0
+	vpclmulqdq	zmm24,zmm5,zmm28,0x00  ; LO_1
+	vpclmulqdq	zmm25,zmm6,zmm29,0x00  ; LO_2
 
 	vaesenc	zmm0,zmm0,zmm16
 	vaesenc	zmm1,zmm1,zmm16
 	vaesenc	zmm2,zmm2,zmm16
 	vaesenc	zmm3,zmm3,zmm16
 
-	vpxord	zmm10,zmm10,zmm24
-	vpclmulqdq	zmm26,zmm7,zmm30,0x00
-	vpternlogd	zmm10,zmm25,zmm26,0x96
-	vpclmulqdq	zmm24,zmm4,zmm27,0x01
+	vpxord	zmm10,zmm10,zmm24  ; sum(LO_{1,0})
+	vpclmulqdq	zmm26,zmm7,zmm30,0x00  ; LO_3
+	vpternlogd	zmm10,zmm25,zmm26,0x96  ; LO = sum(LO_{3,2,1,0})
+	vpclmulqdq	zmm24,zmm4,zmm27,0x01  ; MI_0
 
 	vaesenc	zmm0,zmm0,zmm17
 	vaesenc	zmm1,zmm1,zmm17
 	vaesenc	zmm2,zmm2,zmm17
 	vaesenc	zmm3,zmm3,zmm17
 
-	vpclmulqdq	zmm25,zmm5,zmm28,0x01
-	vpclmulqdq	zmm26,zmm6,zmm29,0x01
-	vpternlogd	zmm24,zmm25,zmm26,0x96
-	vpclmulqdq	zmm25,zmm7,zmm30,0x01
+	vpclmulqdq	zmm25,zmm5,zmm28,0x01  ; MI_1
+	vpclmulqdq	zmm26,zmm6,zmm29,0x01  ; MI_2
+	vpternlogd	zmm24,zmm25,zmm26,0x96  ; sum(MI_{2,1,0})
+	vpclmulqdq	zmm25,zmm7,zmm30,0x01  ; MI_3
 
 	vaesenc	zmm0,zmm0,zmm18
 	vaesenc	zmm1,zmm1,zmm18
 	vaesenc	zmm2,zmm2,zmm18
 	vaesenc	zmm3,zmm3,zmm18
 
-	vpclmulqdq	zmm26,zmm4,zmm27,0x10
-	vpternlogd	zmm24,zmm25,zmm26,0x96
-	vpclmulqdq	zmm25,zmm5,zmm28,0x10
-	vpclmulqdq	zmm26,zmm6,zmm29,0x10
+	vpclmulqdq	zmm26,zmm4,zmm27,0x10  ; MI_4
+	vpternlogd	zmm24,zmm25,zmm26,0x96  ; sum(MI_{4,3,2,1,0})
+	vpclmulqdq	zmm25,zmm5,zmm28,0x10  ; MI_5
+	vpclmulqdq	zmm26,zmm6,zmm29,0x10  ; MI_6
 
 	vaesenc	zmm0,zmm0,zmm19
 	vaesenc	zmm1,zmm1,zmm19
 	vaesenc	zmm2,zmm2,zmm19
 	vaesenc	zmm3,zmm3,zmm19
 
-	vpternlogd	zmm24,zmm25,zmm26,0x96
-	vpclmulqdq	zmm26,zmm31,zmm10,0x01
-	vpclmulqdq	zmm25,zmm7,zmm30,0x10
-	vpxord	zmm24,zmm24,zmm25
+	vpternlogd	zmm24,zmm25,zmm26,0x96  ; sum(MI_{6,5,4,3,2,1,0})
+	vpclmulqdq	zmm26,zmm31,zmm10,0x01  ; LO_L*(x^63 + x^62 + x^57)
+	vpclmulqdq	zmm25,zmm7,zmm30,0x10  ; MI_7
+	vpxord	zmm24,zmm24,zmm25  ; MI = sum(MI_{7,6,5,4,3,2,1,0})
 
 	vaesenc	zmm0,zmm0,zmm20
 	vaesenc	zmm1,zmm1,zmm20
 	vaesenc	zmm2,zmm2,zmm20
 	vaesenc	zmm3,zmm3,zmm20
 
-	vpshufd	zmm10,zmm10,0x4e
-	vpclmulqdq	zmm4,zmm4,zmm27,0x11
-	vpclmulqdq	zmm5,zmm5,zmm28,0x11
-	vpclmulqdq	zmm6,zmm6,zmm29,0x11
+	vpshufd	zmm10,zmm10,0x4e  ; Swap halves of LO
+	vpclmulqdq	zmm4,zmm4,zmm27,0x11  ; HI_0
+	vpclmulqdq	zmm5,zmm5,zmm28,0x11  ; HI_1
+	vpclmulqdq	zmm6,zmm6,zmm29,0x11  ; HI_2
 
 	vaesenc	zmm0,zmm0,zmm21
 	vaesenc	zmm1,zmm1,zmm21
 	vaesenc	zmm2,zmm2,zmm21
 	vaesenc	zmm3,zmm3,zmm21
 
-	vpternlogd	zmm24,zmm10,zmm26,0x96
-	vpclmulqdq	zmm7,zmm7,zmm30,0x11
-	vpternlogd	zmm4,zmm5,zmm6,0x96
-	vpclmulqdq	zmm25,zmm31,zmm24,0x01
+	vpternlogd	zmm24,zmm10,zmm26,0x96  ; Fold LO into MI
+	vpclmulqdq	zmm7,zmm7,zmm30,0x11  ; HI_3
+	vpternlogd	zmm4,zmm5,zmm6,0x96  ; sum(HI_{2,1,0})
+	vpclmulqdq	zmm25,zmm31,zmm24,0x01  ; MI_L*(x^63 + x^62 + x^57)
 
 	vaesenc	zmm0,zmm0,zmm22
 	vaesenc	zmm1,zmm1,zmm22
 	vaesenc	zmm2,zmm2,zmm22
 	vaesenc	zmm3,zmm3,zmm22
 
-	vpxord	zmm10,zmm4,zmm7
-	vpshufd	zmm24,zmm24,0x4e
-	vpternlogd	zmm10,zmm24,zmm25,0x96
+	vpxord	zmm10,zmm4,zmm7  ; HI = sum(HI_{3,2,1,0})
+	vpshufd	zmm24,zmm24,0x4e  ; Swap halves of MI
+	vpternlogd	zmm10,zmm24,zmm25,0x96  ; Fold MI into HI
 
 	vaesenc	zmm0,zmm0,zmm23
 	vaesenc	zmm1,zmm1,zmm23
@@ -1189,32 +1189,32 @@
 	cmp	r8,256
 	jae	NEAR $L$crypt_loop_4x__func2
 $L$crypt_loop_4x_done__func2:
-
+; Check whether any data remains.
 	test	r8,r8
 	jz	NEAR $L$done__func2
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+; The data length isn't a multiple of 256 bytes.  Process the remaining
+; data of length 1 <= DATALEN < 256, up to one 64-byte vector at a time.
+; Going one vector at a time may seem inefficient compared to having
+; separate code paths for each possible number of vectors remaining.
+; However, using a loop keeps the code size down, and it performs
+; surprising well; modern CPUs will start executing the next iteration
+; before the previous one finishes and also predict the number of loop
+; iterations.  For a similar reason, we roll up the AES rounds.
+; 
+; On the last iteration, the remaining length may be less than 64 bytes.
+; Handle this using masking.
+; 
+; Since there are enough key powers available for all remaining data,
+; there is no need to do a GHASH reduction after each iteration.
+; Instead, multiply each remaining block by its own key power, and only
+; do a GHASH reduction at the very end.
+
+; Make POWERS_PTR point to the key powers H^N, H^(N-1), ... where N
+; is the number of blocks that remain.
 	mov	rax,r8
 	neg	rax
-	and	rax,-16
+	and	rax,-16  ; -round_up(DATALEN, 16)
 	lea	rsi,256+rax*1+rdi
 	vpxor	xmm4,xmm4,xmm4
 	vpxor	xmm5,xmm5,xmm5
@@ -1224,9 +1224,9 @@
 	jb	NEAR $L$partial_vec__func2
 
 $L$crypt_loop_1x__func2:
+; Process a full 64-byte vector.
 
-
-
+; Encrypt a vector of counter blocks.
 	vpshufb	zmm0,zmm12,zmm8
 	vpaddd	zmm12,zmm12,zmm11
 	vpxord	zmm0,zmm0,zmm13
@@ -1239,19 +1239,19 @@
 	jne	NEAR $L$vaesenc_loop_tail_full_vec__func2
 	vaesenclast	zmm0,zmm0,zmm14
 
-
+; XOR the data with the vector of keystream blocks.
 	vmovdqu8	zmm1,ZMMWORDrcx
 	vpxord	zmm0,zmm0,zmm1
 	vmovdqu8	ZMMWORDrdx,zmm0
 
-
+; Update GHASH with the ciphertext blocks, without reducing.
 	vmovdqu8	zmm30,ZMMWORDrsi
 	vpshufb	zmm0,zmm1,zmm8
 	vpxord	zmm0,zmm0,zmm10
-	vpclmulqdq	zmm7,zmm0,zmm30,0x00
-	vpclmulqdq	zmm1,zmm0,zmm30,0x01
-	vpclmulqdq	zmm2,zmm0,zmm30,0x10
-	vpclmulqdq	zmm3,zmm0,zmm30,0x11
+	vpclmulqdq	zmm7,zmm0,zmm30,0x00  ; a_L * b_L
+	vpclmulqdq	zmm1,zmm0,zmm30,0x01  ; a_L * b_H
+	vpclmulqdq	zmm2,zmm0,zmm30,0x10  ; a_H * b_L
+	vpclmulqdq	zmm3,zmm0,zmm30,0x11  ; a_H * b_H
 	vpxord	zmm4,zmm4,zmm7
 	vpternlogd	zmm5,zmm1,zmm2,0x96
 	vpxord	zmm6,zmm6,zmm3
@@ -1269,10 +1269,10 @@
 	jz	NEAR $L$reduce__func2
 
 $L$partial_vec__func2:
+; Process a partial vector of length 1 <= DATALEN < 64.
 
-
-
-
+; Set the data mask %k1 to DATALEN 1's.
+; Set the key powers mask %k2 to round_up(DATALEN, 16) 1's.
 	mov	rax,-1
 	bzhi	rax,rax,r8
 	kmovq	k1,rax
@@ -1282,8 +1282,8 @@
 	bzhi	rax,rax,r8
 	kmovq	k2,rax
 
-
-
+; Encrypt one last vector of counter blocks.  This does not need to be
+; masked.  The counter does not need to be incremented here.
 	vpshufb	zmm0,zmm12,zmm8
 	vpxord	zmm0,zmm0,zmm13
 	lea	rax,16+r9
@@ -1295,38 +1295,38 @@
 	jne	NEAR $L$vaesenc_loop_tail_partialvec__func2
 	vaesenclast	zmm0,zmm0,zmm14
 
-
+; XOR the data with the appropriate number of keystream bytes.
 	vmovdqu8	zmm1{k1}{z},rcx
 	vpxord	zmm0,zmm0,zmm1
 	vmovdqu8	ZMMWORDrdx{k1},zmm0
 
-
-
-
-
-
-
-
-
-
-
-
-
+; Update GHASH with the ciphertext block(s), without reducing.
+; 
+; In the case of DATALEN < 64, the ciphertext is zero-padded to 64
+; bytes.  (If decrypting, it's done by the above masked load.  If
+; encrypting, it's done by the below masked register-to-register move.)
+; Note that if DATALEN <= 48, there will be additional padding beyond
+; the padding of the last block specified by GHASH itself; i.e., there
+; may be whole block(s) that get processed by the GHASH multiplication
+; and reduction instructions but should not actually be included in the
+; GHASH.  However, any such blocks are all-zeroes, and the values that
+; they're multiplied with are also all-zeroes.  Therefore they just add
+; 0 * 0 = 0 to the final GHASH result, which makes no difference.
 	vmovdqu8	zmm30{k2}{z},rsi
 
 	vpshufb	zmm0,zmm1,zmm8
 	vpxord	zmm0,zmm0,zmm10
-	vpclmulqdq	zmm7,zmm0,zmm30,0x00
-	vpclmulqdq	zmm1,zmm0,zmm30,0x01
-	vpclmulqdq	zmm2,zmm0,zmm30,0x10
-	vpclmulqdq	zmm3,zmm0,zmm30,0x11
+	vpclmulqdq	zmm7,zmm0,zmm30,0x00  ; a_L * b_L
+	vpclmulqdq	zmm1,zmm0,zmm30,0x01  ; a_L * b_H
+	vpclmulqdq	zmm2,zmm0,zmm30,0x10  ; a_H * b_L
+	vpclmulqdq	zmm3,zmm0,zmm30,0x11  ; a_H * b_H
 	vpxord	zmm4,zmm4,zmm7
 	vpternlogd	zmm5,zmm1,zmm2,0x96
 	vpxord	zmm6,zmm6,zmm3
 
 
 $L$reduce__func2:
-
+; Finally, do the GHASH reduction.
 	vpclmulqdq	zmm0,zmm31,zmm4,0x01
 	vpshufd	zmm4,zmm4,0x4e
 	vpternlogd	zmm5,zmm4,zmm0,0x96
@@ -1342,11 +1342,11 @@
 
 
 $L$done__func2:
-
+; Store the updated GHASH accumulator back to memory.
 	vpshufb	xmm10,xmm10,xmm8
 	vmovdqu	XMMWORDr12,xmm10
 
-	vzeroupper
+	vzeroupper  ; This is needed after using ymm or zmm registers.
 	vmovdqa	xmm6,XMMWORDrsp
 	vmovdqa	xmm7,XMMWORD16+rsp
 	vmovdqa	xmm8,XMMWORD32+rsp
@@ -1387,7 +1387,7 @@
 section	.xdata rdata align=8
 ALIGN	4
 $L$SEH_info_gcm_gmult_vpclmulqdq_avx512_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_gcm_gmult_vpclmulqdq_avx512_4-$L$SEH_begin_gcm_gmult_vpclmulqdq_avx512_1
 	DB	3
 	DB	0
@@ -1399,7 +1399,7 @@
 
 	DW	0
 $L$SEH_info_gcm_ghash_vpclmulqdq_avx512_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_gcm_ghash_vpclmulqdq_avx512_11-$L$SEH_begin_gcm_ghash_vpclmulqdq_avx512_1
 	DB	18
 	DB	0
@@ -1432,7 +1432,7 @@
 	DW	17
 
 $L$SEH_info_aes_gcm_enc_update_vaes_avx512_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_aes_gcm_enc_update_vaes_avx512_16-$L$SEH_begin_aes_gcm_enc_update_vaes_avx512_1
 	DB	25
 	DB	0
@@ -1478,7 +1478,7 @@
 
 	DW	0
 $L$SEH_info_aes_gcm_dec_update_vaes_avx512_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_aes_gcm_dec_update_vaes_avx512_16-$L$SEH_begin_aes_gcm_dec_update_vaes_avx512_1
 	DB	25
 	DB	0

boringssl-0.20260708.tar.xz/gen/bcm/aesni-gcm-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/aesni-gcm-x86_64-apple.S Changed

@@ -10,9 +10,9 @@
 .p2align	5
 _aesni_ctr32_ghash_6x:
 
-	vmovdqu	32(%r11),%xmm2
+	vmovdqu	32(%r11),%xmm2  // borrow %xmm2, .Lone_msb
 	subq	$6,%rdx
-	vpxor	%xmm4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm4,%xmm4  // %xmm4   = 0
 	vmovdqu	0-128(%rcx),%xmm15
 	vpaddb	%xmm2,%xmm1,%xmm10
 	vpaddb	%xmm2,%xmm10,%xmm11
@@ -20,46 +20,46 @@
 	vpaddb	%xmm2,%xmm12,%xmm13
 	vpaddb	%xmm2,%xmm13,%xmm14
 	vpxor	%xmm15,%xmm1,%xmm9
-	vmovdqu	%xmm4,16+8(%rsp)
+	vmovdqu	%xmm4,16+8(%rsp)  // "%xmm7" = 0
 	jmp	L$oop6x
 
 .p2align	5
 L$oop6x:
 	addl	$100663296,%ebx
-	jc	L$handle_ctr32
-	vmovdqu	0-32(%r9),%xmm3
-	vpaddb	%xmm2,%xmm14,%xmm1
+	jc	L$handle_ctr32  // discard ?
+	vmovdqu	0-32(%r9),%xmm3  // %xmm3^1
+	vpaddb	%xmm2,%xmm14,%xmm1  // next counter value
 	vpxor	%xmm15,%xmm10,%xmm10
 	vpxor	%xmm15,%xmm11,%xmm11
 
 L$resume_ctr32:
-	vmovdqu	%xmm1,(%r8)
+	vmovdqu	%xmm1,(%r8)  // save next counter value
 	vpclmulqdq	$0x10,%xmm3,%xmm7,%xmm5
 	vpxor	%xmm15,%xmm12,%xmm12
-	vmovups	16-128(%rcx),%xmm2
+	vmovups	16-128(%rcx),%xmm2  // borrow %xmm2 for %xmm15
 	vpclmulqdq	$0x01,%xmm3,%xmm7,%xmm6
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+// At this point, the current block of 96 (0x60) bytes has already been
+// loaded into registers. Concurrently with processing it, we want to
+// load the next 96 bytes of input for the next round. Obviously, we can
+// only do this if there are at least 96 more bytes of input beyond the
+// input we're currently processing, or else we'd read past the end of
+// the input buffer. Here, we set |%r12| to 96 if there are at least 96
+// bytes of input beyond the 96 bytes we're already processing, and we
+// set |%r12| to 0 otherwise. In the case where we set |%r12| to 96,
+// we'll read in the next block so that it is in registers for the next
+// loop iteration. In the case where we set |%r12| to 0, we'll re-read
+// the current block and then ignore what we re-read.
+// 
+// At this point, |%r14| points to the current (already read into
+// registers) block, and |%r15| points to 2*96 bytes before the end of
+// the input. Thus, |%r14| > |%r15| means that we do not have the next
+// 96-byte block to read in, and |%r14| <= |%r15| means we do.
 	xorq	%r12,%r12
 	cmpq	%r14,%r15
 
 	vaesenc	%xmm2,%xmm9,%xmm9
-	vmovdqu	48+8(%rsp),%xmm0
+	vmovdqu	48+8(%rsp),%xmm0  // I4
 	vpxor	%xmm15,%xmm13,%xmm13
 	vpclmulqdq	$0x00,%xmm3,%xmm7,%xmm1
 	vaesenc	%xmm2,%xmm10,%xmm10
@@ -67,12 +67,12 @@
 	setnc	%r12b
 	vpclmulqdq	$0x11,%xmm3,%xmm7,%xmm7
 	vaesenc	%xmm2,%xmm11,%xmm11
-	vmovdqu	16-32(%r9),%xmm3
+	vmovdqu	16-32(%r9),%xmm3  // %xmm3^2
 	negq	%r12
 	vaesenc	%xmm2,%xmm12,%xmm12
 	vpxor	%xmm5,%xmm6,%xmm6
 	vpclmulqdq	$0x00,%xmm3,%xmm0,%xmm5
-	vpxor	%xmm4,%xmm8,%xmm8
+	vpxor	%xmm4,%xmm8,%xmm8  // modulo-scheduled
 	vaesenc	%xmm2,%xmm13,%xmm13
 	vpxor	%xmm5,%xmm1,%xmm4
 	andq	$0x60,%r12
@@ -83,9 +83,9 @@
 	vpclmulqdq	$0x01,%xmm3,%xmm0,%xmm2
 	leaq	(%r14,%r12,1),%r14
 	vaesenc	%xmm15,%xmm9,%xmm9
-	vpxor	16+8(%rsp),%xmm8,%xmm8
+	vpxor	16+8(%rsp),%xmm8,%xmm8  // modulo-scheduled vpxor %xmm7,%xmm8,%xmm8
 	vpclmulqdq	$0x11,%xmm3,%xmm0,%xmm3
-	vmovdqu	64+8(%rsp),%xmm0
+	vmovdqu	64+8(%rsp),%xmm0  // I3
 	vaesenc	%xmm15,%xmm10,%xmm10
 	movbeq	88(%r14),%r13
 	vaesenc	%xmm15,%xmm11,%xmm11
@@ -94,7 +94,7 @@
 	movq	%r13,32+8(%rsp)
 	vaesenc	%xmm15,%xmm13,%xmm13
 	movq	%r12,40+8(%rsp)
-	vmovdqu	48-32(%r9),%xmm5
+	vmovdqu	48-32(%r9),%xmm5  // borrow %xmm5 for %xmm3^3
 	vaesenc	%xmm15,%xmm14,%xmm14
 
 	vmovups	48-128(%rcx),%xmm15
@@ -108,11 +108,11 @@
 	vpclmulqdq	$0x01,%xmm5,%xmm0,%xmm3
 	vaesenc	%xmm15,%xmm11,%xmm11
 	vpclmulqdq	$0x11,%xmm5,%xmm0,%xmm5
-	vmovdqu	80+8(%rsp),%xmm0
+	vmovdqu	80+8(%rsp),%xmm0  // I2
 	vaesenc	%xmm15,%xmm12,%xmm12
 	vaesenc	%xmm15,%xmm13,%xmm13
 	vpxor	%xmm1,%xmm4,%xmm4
-	vmovdqu	64-32(%r9),%xmm1
+	vmovdqu	64-32(%r9),%xmm1  // borrow %xmm1 for %xmm3^4
 	vaesenc	%xmm15,%xmm14,%xmm14
 
 	vmovups	64-128(%rcx),%xmm15
@@ -128,13 +128,13 @@
 	vaesenc	%xmm15,%xmm11,%xmm11
 	movbeq	64(%r14),%r12
 	vpclmulqdq	$0x11,%xmm1,%xmm0,%xmm1
-	vmovdqu	96+8(%rsp),%xmm0
+	vmovdqu	96+8(%rsp),%xmm0  // I1
 	vaesenc	%xmm15,%xmm12,%xmm12
 	movq	%r13,48+8(%rsp)
 	vaesenc	%xmm15,%xmm13,%xmm13
 	movq	%r12,56+8(%rsp)
 	vpxor	%xmm2,%xmm4,%xmm4
-	vmovdqu	96-32(%r9),%xmm2
+	vmovdqu	96-32(%r9),%xmm2  // borrow %xmm2 for %xmm3^5
 	vaesenc	%xmm15,%xmm14,%xmm14
 
 	vmovups	80-128(%rcx),%xmm15
@@ -147,7 +147,7 @@
 	movbeq	56(%r14),%r13
 	vpxor	%xmm1,%xmm7,%xmm7
 	vpclmulqdq	$0x01,%xmm2,%xmm0,%xmm1
-	vpxor	112+8(%rsp),%xmm8,%xmm8
+	vpxor	112+8(%rsp),%xmm8,%xmm8  // accumulate I0
 	vaesenc	%xmm15,%xmm11,%xmm11
 	movbeq	48(%r14),%r12
 	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm2
@@ -156,7 +156,7 @@
 	vaesenc	%xmm15,%xmm13,%xmm13
 	movq	%r12,72+8(%rsp)
 	vpxor	%xmm3,%xmm4,%xmm4
-	vmovdqu	112-32(%r9),%xmm3
+	vmovdqu	112-32(%r9),%xmm3  // %xmm3^6
 	vaesenc	%xmm15,%xmm14,%xmm14
 
 	vmovups	96-128(%rcx),%xmm15
@@ -183,7 +183,7 @@
 	vmovups	112-128(%rcx),%xmm15
 	vpslldq	$8,%xmm6,%xmm5
 	vpxor	%xmm2,%xmm4,%xmm4
-	vmovdqu	16(%r11),%xmm3
+	vmovdqu	16(%r11),%xmm3  // .Lpoly
 
 	vaesenc	%xmm15,%xmm9,%xmm9
 	vpxor	%xmm8,%xmm7,%xmm7
@@ -192,13 +192,13 @@
 	movbeq	24(%r14),%r13
 	vaesenc	%xmm15,%xmm11,%xmm11
 	movbeq	16(%r14),%r12
-	vpalignr	$8,%xmm4,%xmm4,%xmm0
+	vpalignr	$8,%xmm4,%xmm4,%xmm0  // 1st phase
 	vpclmulqdq	$0x10,%xmm3,%xmm4,%xmm4
 	movq	%r13,96+8(%rsp)
 	vaesenc	%xmm15,%xmm12,%xmm12
 	movq	%r12,104+8(%rsp)
 	vaesenc	%xmm15,%xmm13,%xmm13
-	vmovups	128-128(%rcx),%xmm1
+	vmovups	128-128(%rcx),%xmm1  // borrow %xmm1 for %xmm15
 	vaesenc	%xmm15,%xmm14,%xmm14
 
 	vaesenc	%xmm1,%xmm9,%xmm9
@@ -215,7 +215,7 @@
 	vaesenc	%xmm1,%xmm14,%xmm14
 	vmovups	160-128(%rcx),%xmm1
 	cmpl	$11,%r10d
-	jb	L$enc_tail
+	jb	L$enc_tail  // 128-bit key
 
 	vaesenc	%xmm15,%xmm9,%xmm9
 	vaesenc	%xmm15,%xmm10,%xmm10
@@ -232,7 +232,7 @@
 	vmovups	176-128(%rcx),%xmm15
 	vaesenc	%xmm1,%xmm14,%xmm14
 	vmovups	192-128(%rcx),%xmm1
-	je	L$enc_tail
+	je	L$enc_tail  // 192-bit key
 
 	vaesenc	%xmm15,%xmm9,%xmm9
 	vaesenc	%xmm15,%xmm10,%xmm10
@@ -249,16 +249,16 @@
 	vmovups	208-128(%rcx),%xmm15
 	vaesenc	%xmm1,%xmm14,%xmm14
 	vmovups	224-128(%rcx),%xmm1
-	jmp	L$enc_tail
+	jmp	L$enc_tail  // 256-bit key
 
 .p2align	5
 L$handle_ctr32:
-	vmovdqu	(%r11),%xmm0
-	vpshufb	%xmm0,%xmm1,%xmm6
-	vmovdqu	48(%r11),%xmm5
-	vpaddd	64(%r11),%xmm6,%xmm10
+	vmovdqu	(%r11),%xmm0  // borrow %xmm0 for .Lbswap_mask
+	vpshufb	%xmm0,%xmm1,%xmm6  // byte-swap counter
+	vmovdqu	48(%r11),%xmm5  // borrow %xmm5, .Ltwo_lsb
+	vpaddd	64(%r11),%xmm6,%xmm10  // .Lone_lsb
 	vpaddd	%xmm5,%xmm6,%xmm11
-	vmovdqu	0-32(%r9),%xmm3
+	vmovdqu	0-32(%r9),%xmm3  // %xmm3^1
 	vpaddd	%xmm5,%xmm10,%xmm12
 	vpshufb	%xmm0,%xmm10,%xmm10
 	vpaddd	%xmm5,%xmm11,%xmm13
@@ -267,17 +267,17 @@
 	vpaddd	%xmm5,%xmm12,%xmm14
 	vpshufb	%xmm0,%xmm12,%xmm12
 	vpxor	%xmm15,%xmm11,%xmm11
-	vpaddd	%xmm5,%xmm13,%xmm1
+	vpaddd	%xmm5,%xmm13,%xmm1  // byte-swapped next counter value
 	vpshufb	%xmm0,%xmm13,%xmm13
 	vpshufb	%xmm0,%xmm14,%xmm14
-	vpshufb	%xmm0,%xmm1,%xmm1
+	vpshufb	%xmm0,%xmm1,%xmm1  // next counter value
 	jmp	L$resume_ctr32
 
 .p2align	5
 L$enc_tail:
 	vaesenc	%xmm15,%xmm9,%xmm9
-	vmovdqu	%xmm7,16+8(%rsp)
-	vpalignr	$8,%xmm4,%xmm4,%xmm8
+	vmovdqu	%xmm7,16+8(%rsp)  // postpone vpxor %xmm7,%xmm8,%xmm8
+	vpalignr	$8,%xmm4,%xmm4,%xmm8  // 2nd phase
 	vaesenc	%xmm15,%xmm10,%xmm10
 	vpclmulqdq	$0x10,%xmm3,%xmm4,%xmm4
 	vpxor	0(%rdi),%xmm1,%xmm2
@@ -290,16 +290,16 @@
 	vaesenc	%xmm15,%xmm14,%xmm14
 	vpxor	64(%rdi),%xmm1,%xmm7
 	vpxor	80(%rdi),%xmm1,%xmm3
-	vmovdqu	(%r8),%xmm1
+	vmovdqu	(%r8),%xmm1  // load next counter value
 
 	vaesenclast	%xmm2,%xmm9,%xmm9
-	vmovdqu	32(%r11),%xmm2
+	vmovdqu	32(%r11),%xmm2  // borrow %xmm2, .Lone_msb
 	vaesenclast	%xmm0,%xmm10,%xmm10
 	vpaddb	%xmm2,%xmm1,%xmm0
 	movq	%r13,112+8(%rsp)
 	leaq	96(%rdi),%rdi
-
-	prefetcht0	512(%rdi)
+// These two prefetches were added in BoringSSL. See change that added them.
+	prefetcht0	512(%rdi)  // We use 96-byte block so prefetch 2 lines (128 bytes)
 	prefetcht0	576(%rdi)
 	vaesenclast	%xmm5,%xmm11,%xmm11
 	vpaddb	%xmm2,%xmm0,%xmm5
@@ -317,24 +317,24 @@
 	subq	$0x6,%rdx
 	jc	L$6x_done
 
-	vmovups	%xmm9,-96(%rsi)
+	vmovups	%xmm9,-96(%rsi)  // save output
 	vpxor	%xmm15,%xmm1,%xmm9
 	vmovups	%xmm10,-80(%rsi)
-	vmovdqa	%xmm0,%xmm10
+	vmovdqa	%xmm0,%xmm10  // 0 latency
 	vmovups	%xmm11,-64(%rsi)
-	vmovdqa	%xmm5,%xmm11
+	vmovdqa	%xmm5,%xmm11  // 0 latency
 	vmovups	%xmm12,-48(%rsi)
-	vmovdqa	%xmm6,%xmm12
+	vmovdqa	%xmm6,%xmm12  // 0 latency
 	vmovups	%xmm13,-32(%rsi)
-	vmovdqa	%xmm7,%xmm13
+	vmovdqa	%xmm7,%xmm13  // 0 latency
 	vmovups	%xmm14,-16(%rsi)
-	vmovdqa	%xmm3,%xmm14
-	vmovdqu	32+8(%rsp),%xmm7
+	vmovdqa	%xmm3,%xmm14  // 0 latency
+	vmovdqu	32+8(%rsp),%xmm7  // I5
 	jmp	L$oop6x
 
 L$6x_done:
-	vpxor	16+8(%rsp),%xmm8,%xmm8
-	vpxor	%xmm4,%xmm8,%xmm8
+	vpxor	16+8(%rsp),%xmm8,%xmm8  // modulo-scheduled
+	vpxor	%xmm4,%xmm8,%xmm8  // modulo-scheduled
 
 	ret
 
@@ -350,15 +350,15 @@
 _CET_ENDBR
 	xorq	%rax,%rax
 
-
-
-	cmpq	$0x60,%rdx
+// We call |_aesni_ctr32_ghash_6x|, which requires at least 96 (0x60)
+// bytes of input.
+	cmpq	$0x60,%rdx  // minimal accepted length
 	jb	L$gcm_dec_abort
 
 	pushq	%rbp
 
 
-	movq	%rsp,%rbp
+	movq	%rsp,%rbp  // save stack pointer
 
 	pushq	%rbx
 
@@ -378,17 +378,17 @@
 	vzeroupper
 
 	movq	16(%rbp),%r12
-	vmovdqu	(%r8),%xmm1
+	vmovdqu	(%r8),%xmm1  // input counter value
 	addq	$-128,%rsp
 	movl	12(%r8),%ebx
 	leaq	L$bswap_mask(%rip),%r11
-	leaq	-128(%rcx),%r14
-	movq	$0xf80,%r15
-	vmovdqu	(%r12),%xmm8
-	andq	$-128,%rsp
-	vmovdqu	(%r11),%xmm0
-	leaq	128(%rcx),%rcx
-	leaq	32(%r9),%r9
+	leaq	-128(%rcx),%r14  // borrow %r14
+	movq	$0xf80,%r15  // borrow %r15
+	vmovdqu	(%r12),%xmm8  // load Xi
+	andq	$-128,%rsp  // ensure stack alignment
+	vmovdqu	(%r11),%xmm0  // borrow %xmm0 for .Lbswap_mask
+	leaq	128(%rcx),%rcx  // size optimization
+	leaq	32(%r9),%r9  // size optimization
 	movl	240-128(%rcx),%r10d
 	vpshufb	%xmm0,%xmm8,%xmm8
 
@@ -398,26 +398,26 @@
 	jc	L$dec_no_key_aliasing
 	cmpq	$768,%r15
 	jnc	L$dec_no_key_aliasing
-	subq	%r15,%rsp
+	subq	%r15,%rsp  // avoid aliasing with key
 L$dec_no_key_aliasing:
 
-	vmovdqu	80(%rdi),%xmm7
+	vmovdqu	80(%rdi),%xmm7  // I5
 	movq	%rdi,%r14
 	vmovdqu	64(%rdi),%xmm4
 
-
-
-
-
-
-
+// |_aesni_ctr32_ghash_6x| requires |%r15| to point to 2*96 (0xc0)
+// bytes before the end of the input. Note, in particular, that this is
+// correct even if |%rdx| is not an even multiple of 96 or 16. XXX: This
+// seems to require that |%rdi| + |%rdx| >= 2*96 (0xc0); i.e. |%rdi| must
+// not be near the very beginning of the address space when |%rdx| < 2*96
+// (0xc0).
 	leaq	-192(%rdi,%rdx,1),%r15
 
 	vmovdqu	48(%rdi),%xmm5
 	shrq	$4,%rdx
 	xorq	%rax,%rax
 	vmovdqu	32(%rdi),%xmm6
-	vpshufb	%xmm0,%xmm7,%xmm7
+	vpshufb	%xmm0,%xmm7,%xmm7  // passed to _aesni_ctr32_ghash_6x
 	vmovdqu	16(%rdi),%xmm2
 	vpshufb	%xmm0,%xmm4,%xmm4
 	vmovdqu	(%rdi),%xmm3
@@ -434,18 +434,18 @@
 	call	_aesni_ctr32_ghash_6x
 
 	movq	16(%rbp),%r12
-	vmovups	%xmm9,-96(%rsi)
+	vmovups	%xmm9,-96(%rsi)  // save output
 	vmovups	%xmm10,-80(%rsi)
 	vmovups	%xmm11,-64(%rsi)
 	vmovups	%xmm12,-48(%rsi)
 	vmovups	%xmm13,-32(%rsi)
 	vmovups	%xmm14,-16(%rsi)
 
-	vpshufb	(%r11),%xmm8,%xmm8
-	vmovdqu	%xmm8,(%r12)
+	vpshufb	(%r11),%xmm8,%xmm8  // .Lbswap_mask
+	vmovdqu	%xmm8,(%r12)  // output Xi
 
 	vzeroupper
-	leaq	-40(%rbp),%rsp
+	leaq	-40(%rbp),%rsp  // restore %rsp to fixed allocation
 
 	popq	%r15
 
@@ -469,8 +469,8 @@
 .alt_entry _aesni_ctr32_6x
 _aesni_ctr32_6x:
 
-	vmovdqu	0-128(%rcx),%xmm4
-	vmovdqu	32(%r11),%xmm2
+	vmovdqu	0-128(%rcx),%xmm4  // borrow %xmm4 for %xmm15
+	vmovdqu	32(%r11),%xmm2  // borrow %xmm2, .Lone_msb
 	leaq	-1(%r10),%r13
 	vmovups	16-128(%rcx),%xmm15
 	leaq	32-128(%rcx),%r12
@@ -503,7 +503,7 @@
 	decl	%r13d
 	jnz	L$oop_ctr32
 
-	vmovdqu	(%r12),%xmm3
+	vmovdqu	(%r12),%xmm3  // last round key
 	vaesenc	%xmm15,%xmm9,%xmm9
 	vpxor	0(%rdi),%xmm3,%xmm4
 	vaesenc	%xmm15,%xmm10,%xmm10
@@ -535,9 +535,9 @@
 	ret
 .p2align	5
 L$handle_ctr32_2:
-	vpshufb	%xmm0,%xmm1,%xmm6
-	vmovdqu	48(%r11),%xmm5
-	vpaddd	64(%r11),%xmm6,%xmm10
+	vpshufb	%xmm0,%xmm1,%xmm6  // byte-swap counter
+	vmovdqu	48(%r11),%xmm5  // borrow %xmm5, .Ltwo_lsb
+	vpaddd	64(%r11),%xmm6,%xmm10  // .Lone_lsb
 	vpaddd	%xmm5,%xmm6,%xmm11
 	vpaddd	%xmm5,%xmm10,%xmm12
 	vpshufb	%xmm0,%xmm10,%xmm10
@@ -547,12 +547,12 @@
 	vpaddd	%xmm5,%xmm12,%xmm14
 	vpshufb	%xmm0,%xmm12,%xmm12
 	vpxor	%xmm4,%xmm11,%xmm11
-	vpaddd	%xmm5,%xmm13,%xmm1
+	vpaddd	%xmm5,%xmm13,%xmm1  // byte-swapped next counter value
 	vpshufb	%xmm0,%xmm13,%xmm13
 	vpxor	%xmm4,%xmm12,%xmm12
 	vpshufb	%xmm0,%xmm14,%xmm14
 	vpxor	%xmm4,%xmm13,%xmm13
-	vpshufb	%xmm0,%xmm1,%xmm1
+	vpshufb	%xmm0,%xmm1,%xmm1  // next counter value
 	vpxor	%xmm4,%xmm14,%xmm14
 	jmp	L$oop_ctr32
 
@@ -573,16 +573,16 @@
 #endif
 	xorq	%rax,%rax
 
-
-
-
-	cmpq	$288,%rdx
+// We call |_aesni_ctr32_6x| twice, each call consuming 96 bytes of
+// input. Then we call |_aesni_ctr32_ghash_6x|, which requires at
+// least 96 more bytes of input.
+	cmpq	$288,%rdx  // minimal accepted length
 	jb	L$gcm_enc_abort
 
 	pushq	%rbp
 
 
-	movq	%rsp,%rbp
+	movq	%rsp,%rbp  // save stack pointer
 
 	pushq	%rbx
 
@@ -601,15 +601,15 @@
 
 	vzeroupper
 
-	vmovdqu	(%r8),%xmm1
+	vmovdqu	(%r8),%xmm1  // input counter value
 	addq	$-128,%rsp
 	movl	12(%r8),%ebx
 	leaq	L$bswap_mask(%rip),%r11
-	leaq	-128(%rcx),%r14
-	movq	$0xf80,%r15
-	leaq	128(%rcx),%rcx
-	vmovdqu	(%r11),%xmm0
-	andq	$-128,%rsp
+	leaq	-128(%rcx),%r14  // borrow %r14
+	movq	$0xf80,%r15  // borrow %r15
+	leaq	128(%rcx),%rcx  // size optimization
+	vmovdqu	(%r11),%xmm0  // borrow %xmm0 for .Lbswap_mask
+	andq	$-128,%rsp  // ensure stack alignment
 	movl	240-128(%rcx),%r10d
 
 	andq	%r15,%r14
@@ -618,24 +618,24 @@
 	jc	L$enc_no_key_aliasing
 	cmpq	$768,%r15
 	jnc	L$enc_no_key_aliasing
-	subq	%r15,%rsp
+	subq	%r15,%rsp  // avoid aliasing with key
 L$enc_no_key_aliasing:
 
 	movq	%rsi,%r14
 
-
-
-
-
-
-
-
+// |_aesni_ctr32_ghash_6x| requires |%r15| to point to 2*96 (0xc0)
+// bytes before the end of the input. Note, in particular, that this is
+// correct even if |%rdx| is not an even multiple of 96 or 16. Unlike in
+// the decryption case, there's no caveat that |%rsi| must not be near
+// the very beginning of the address space, because we know that
+// |%rdx| >= 3*96 from the check above, and so we know
+// |%rsi| + |%rdx| >= 2*96 (0xc0).
 	leaq	-192(%rsi,%rdx,1),%r15
 
 	shrq	$4,%rdx
 
 	call	_aesni_ctr32_6x
-	vpshufb	%xmm0,%xmm9,%xmm8
+	vpshufb	%xmm0,%xmm9,%xmm8  // save bswapped output on stack
 	vpshufb	%xmm0,%xmm10,%xmm2
 	vmovdqu	%xmm8,112(%rsp)
 	vpshufb	%xmm0,%xmm11,%xmm4
@@ -644,26 +644,26 @@
 	vmovdqu	%xmm4,80(%rsp)
 	vpshufb	%xmm0,%xmm13,%xmm6
 	vmovdqu	%xmm5,64(%rsp)
-	vpshufb	%xmm0,%xmm14,%xmm7
+	vpshufb	%xmm0,%xmm14,%xmm7  // passed to _aesni_ctr32_ghash_6x
 	vmovdqu	%xmm6,48(%rsp)
 
 	call	_aesni_ctr32_6x
 
 	movq	16(%rbp),%r12
-	leaq	32(%r9),%r9
-	vmovdqu	(%r12),%xmm8
+	leaq	32(%r9),%r9  // size optimization
+	vmovdqu	(%r12),%xmm8  // load Xi
 	subq	$12,%rdx
 	movq	$192,%rax
 	vpshufb	%xmm0,%xmm8,%xmm8
 
 	call	_aesni_ctr32_ghash_6x
-	vmovdqu	32(%rsp),%xmm7
-	vmovdqu	(%r11),%xmm0
-	vmovdqu	0-32(%r9),%xmm3
+	vmovdqu	32(%rsp),%xmm7  // I5
+	vmovdqu	(%r11),%xmm0  // borrow %xmm0 for .Lbswap_mask
+	vmovdqu	0-32(%r9),%xmm3  // %xmm3^1
 	vpunpckhqdq	%xmm7,%xmm7,%xmm1
-	vmovdqu	32-32(%r9),%xmm15
-	vmovups	%xmm9,-96(%rsi)
-	vpshufb	%xmm0,%xmm9,%xmm9
+	vmovdqu	32-32(%r9),%xmm15  // borrow %xmm15 for
+	vmovups	%xmm9,-96(%rsi)  // save output
+	vpshufb	%xmm0,%xmm9,%xmm9  // but keep bswapped copy
 	vpxor	%xmm7,%xmm1,%xmm1
 	vmovups	%xmm10,-80(%rsi)
 	vpshufb	%xmm0,%xmm10,%xmm10
@@ -675,18 +675,18 @@
 	vpshufb	%xmm0,%xmm13,%xmm13
 	vmovups	%xmm14,-16(%rsi)
 	vpshufb	%xmm0,%xmm14,%xmm14
-	vmovdqu	%xmm9,16(%rsp)
-	vmovdqu	48(%rsp),%xmm6
-	vmovdqu	16-32(%r9),%xmm0
+	vmovdqu	%xmm9,16(%rsp)  // free %xmm9
+	vmovdqu	48(%rsp),%xmm6  // I4
+	vmovdqu	16-32(%r9),%xmm0  // borrow %xmm0 for %xmm3^2
 	vpunpckhqdq	%xmm6,%xmm6,%xmm2
 	vpclmulqdq	$0x00,%xmm3,%xmm7,%xmm5
 	vpxor	%xmm6,%xmm2,%xmm2
 	vpclmulqdq	$0x11,%xmm3,%xmm7,%xmm7
 	vpclmulqdq	$0x00,%xmm15,%xmm1,%xmm1
 
-	vmovdqu	64(%rsp),%xmm9
+	vmovdqu	64(%rsp),%xmm9  // I3
 	vpclmulqdq	$0x00,%xmm0,%xmm6,%xmm4
-	vmovdqu	48-32(%r9),%xmm3
+	vmovdqu	48-32(%r9),%xmm3  // %xmm3^3
 	vpxor	%xmm5,%xmm4,%xmm4
 	vpunpckhqdq	%xmm9,%xmm9,%xmm5
 	vpclmulqdq	$0x11,%xmm0,%xmm6,%xmm6
@@ -696,9 +696,9 @@
 	vmovdqu	80-32(%r9),%xmm15
 	vpxor	%xmm1,%xmm2,%xmm2
 
-	vmovdqu	80(%rsp),%xmm1
+	vmovdqu	80(%rsp),%xmm1  // I2
 	vpclmulqdq	$0x00,%xmm3,%xmm9,%xmm7
-	vmovdqu	64-32(%r9),%xmm0
+	vmovdqu	64-32(%r9),%xmm0  // borrow %xmm0 for %xmm3^4
 	vpxor	%xmm4,%xmm7,%xmm7
 	vpunpckhqdq	%xmm1,%xmm1,%xmm4
 	vpclmulqdq	$0x11,%xmm3,%xmm9,%xmm9
@@ -707,9 +707,9 @@
 	vpclmulqdq	$0x00,%xmm15,%xmm5,%xmm5
 	vpxor	%xmm2,%xmm5,%xmm5
 
-	vmovdqu	96(%rsp),%xmm2
+	vmovdqu	96(%rsp),%xmm2  // I1
 	vpclmulqdq	$0x00,%xmm0,%xmm1,%xmm6
-	vmovdqu	96-32(%r9),%xmm3
+	vmovdqu	96-32(%r9),%xmm3  // %xmm3^5
 	vpxor	%xmm7,%xmm6,%xmm6
 	vpunpckhqdq	%xmm2,%xmm2,%xmm7
 	vpclmulqdq	$0x11,%xmm0,%xmm1,%xmm1
@@ -719,9 +719,9 @@
 	vmovdqu	128-32(%r9),%xmm15
 	vpxor	%xmm5,%xmm4,%xmm4
 
-	vpxor	112(%rsp),%xmm8,%xmm8
+	vpxor	112(%rsp),%xmm8,%xmm8  // accumulate I0
 	vpclmulqdq	$0x00,%xmm3,%xmm2,%xmm5
-	vmovdqu	112-32(%r9),%xmm0
+	vmovdqu	112-32(%r9),%xmm0  // borrow %xmm0 for %xmm3^6
 	vpunpckhqdq	%xmm8,%xmm8,%xmm9
 	vpxor	%xmm6,%xmm5,%xmm5
 	vpclmulqdq	$0x11,%xmm3,%xmm2,%xmm2
@@ -731,7 +731,7 @@
 	vpxor	%xmm4,%xmm7,%xmm4
 
 	vpclmulqdq	$0x00,%xmm0,%xmm8,%xmm6
-	vmovdqu	0-32(%r9),%xmm3
+	vmovdqu	0-32(%r9),%xmm3  // %xmm3^1
 	vpunpckhqdq	%xmm14,%xmm14,%xmm1
 	vpclmulqdq	$0x11,%xmm0,%xmm8,%xmm8
 	vpxor	%xmm14,%xmm1,%xmm1
@@ -741,8 +741,8 @@
 	vpxor	%xmm2,%xmm8,%xmm7
 	vpxor	%xmm4,%xmm9,%xmm6
 
-	vmovdqu	16-32(%r9),%xmm0
-	vpxor	%xmm5,%xmm7,%xmm9
+	vmovdqu	16-32(%r9),%xmm0  // borrow %xmm0 for %xmm3^2
+	vpxor	%xmm5,%xmm7,%xmm9  // aggregated Karatsuba post-processing
 	vpclmulqdq	$0x00,%xmm3,%xmm14,%xmm4
 	vpxor	%xmm9,%xmm6,%xmm6
 	vpunpckhqdq	%xmm13,%xmm13,%xmm2
@@ -755,25 +755,25 @@
 	vpxor	%xmm6,%xmm7,%xmm7
 
 	vpclmulqdq	$0x00,%xmm0,%xmm13,%xmm5
-	vmovdqu	48-32(%r9),%xmm3
+	vmovdqu	48-32(%r9),%xmm3  // %xmm3^3
 	vpxor	%xmm4,%xmm5,%xmm5
 	vpunpckhqdq	%xmm12,%xmm12,%xmm9
 	vpclmulqdq	$0x11,%xmm0,%xmm13,%xmm13
 	vpxor	%xmm12,%xmm9,%xmm9
 	vpxor	%xmm14,%xmm13,%xmm13
-	vpalignr	$8,%xmm8,%xmm8,%xmm14
+	vpalignr	$8,%xmm8,%xmm8,%xmm14  // 1st phase
 	vpclmulqdq	$0x10,%xmm15,%xmm2,%xmm2
 	vmovdqu	80-32(%r9),%xmm15
 	vpxor	%xmm1,%xmm2,%xmm2
 
 	vpclmulqdq	$0x00,%xmm3,%xmm12,%xmm4
-	vmovdqu	64-32(%r9),%xmm0
+	vmovdqu	64-32(%r9),%xmm0  // borrow %xmm0 for %xmm3^4
 	vpxor	%xmm5,%xmm4,%xmm4
 	vpunpckhqdq	%xmm11,%xmm11,%xmm1
 	vpclmulqdq	$0x11,%xmm3,%xmm12,%xmm12
 	vpxor	%xmm11,%xmm1,%xmm1
 	vpxor	%xmm13,%xmm12,%xmm12
-	vxorps	16(%rsp),%xmm7,%xmm7
+	vxorps	16(%rsp),%xmm7,%xmm7  // accumulate %xmm9
 	vpclmulqdq	$0x00,%xmm15,%xmm9,%xmm9
 	vpxor	%xmm2,%xmm9,%xmm9
 
@@ -781,12 +781,12 @@
 	vxorps	%xmm14,%xmm8,%xmm8
 
 	vpclmulqdq	$0x00,%xmm0,%xmm11,%xmm5
-	vmovdqu	96-32(%r9),%xmm3
+	vmovdqu	96-32(%r9),%xmm3  // %xmm3^5
 	vpxor	%xmm4,%xmm5,%xmm5
 	vpunpckhqdq	%xmm10,%xmm10,%xmm2
 	vpclmulqdq	$0x11,%xmm0,%xmm11,%xmm11
 	vpxor	%xmm10,%xmm2,%xmm2
-	vpalignr	$8,%xmm8,%xmm8,%xmm14
+	vpalignr	$8,%xmm8,%xmm8,%xmm14  // 2nd phase
 	vpxor	%xmm12,%xmm11,%xmm11
 	vpclmulqdq	$0x10,%xmm15,%xmm1,%xmm1
 	vmovdqu	128-32(%r9),%xmm15
@@ -797,7 +797,7 @@
 	vxorps	%xmm14,%xmm8,%xmm8
 
 	vpclmulqdq	$0x00,%xmm3,%xmm10,%xmm4
-	vmovdqu	112-32(%r9),%xmm0
+	vmovdqu	112-32(%r9),%xmm0  // borrow %xmm0 for %xmm3^6
 	vpxor	%xmm5,%xmm4,%xmm4
 	vpunpckhqdq	%xmm8,%xmm8,%xmm9
 	vpclmulqdq	$0x11,%xmm3,%xmm10,%xmm10
@@ -813,28 +813,28 @@
 	vpxor	%xmm10,%xmm7,%xmm7
 	vpxor	%xmm2,%xmm6,%xmm6
 
-	vpxor	%xmm5,%xmm7,%xmm4
+	vpxor	%xmm5,%xmm7,%xmm4  // aggregated Karatsuba post-processing
 	vpxor	%xmm4,%xmm6,%xmm6
 	vpslldq	$8,%xmm6,%xmm1
-	vmovdqu	16(%r11),%xmm3
+	vmovdqu	16(%r11),%xmm3  // .Lpoly
 	vpsrldq	$8,%xmm6,%xmm6
 	vpxor	%xmm1,%xmm5,%xmm8
 	vpxor	%xmm6,%xmm7,%xmm7
 
-	vpalignr	$8,%xmm8,%xmm8,%xmm2
+	vpalignr	$8,%xmm8,%xmm8,%xmm2  // 1st phase
 	vpclmulqdq	$0x10,%xmm3,%xmm8,%xmm8
 	vpxor	%xmm2,%xmm8,%xmm8
 
-	vpalignr	$8,%xmm8,%xmm8,%xmm2
+	vpalignr	$8,%xmm8,%xmm8,%xmm2  // 2nd phase
 	vpclmulqdq	$0x10,%xmm3,%xmm8,%xmm8
 	vpxor	%xmm7,%xmm2,%xmm2
 	vpxor	%xmm2,%xmm8,%xmm8
 	movq	16(%rbp),%r12
-	vpshufb	(%r11),%xmm8,%xmm8
-	vmovdqu	%xmm8,(%r12)
+	vpshufb	(%r11),%xmm8,%xmm8  // .Lbswap_mask
+	vmovdqu	%xmm8,(%r12)  // output Xi
 
 	vzeroupper
-	leaq	-40(%rbp),%rsp
+	leaq	-40(%rbp),%rsp  // restore %rsp to fixed allocation
 
 	popq	%r15

boringssl-0.20260708.tar.xz/gen/bcm/aesni-gcm-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/aesni-gcm-x86_64-linux.S Changed

@@ -10,9 +10,9 @@
 .align	32
 _aesni_ctr32_ghash_6x:
 .cfi_startproc	
-	vmovdqu	32(%r11),%xmm2
+	vmovdqu	32(%r11),%xmm2  // borrow %xmm2, .Lone_msb
 	subq	$6,%rdx
-	vpxor	%xmm4,%xmm4,%xmm4
+	vpxor	%xmm4,%xmm4,%xmm4  // %xmm4   = 0
 	vmovdqu	0-128(%rcx),%xmm15
 	vpaddb	%xmm2,%xmm1,%xmm10
 	vpaddb	%xmm2,%xmm10,%xmm11
@@ -20,46 +20,46 @@
 	vpaddb	%xmm2,%xmm12,%xmm13
 	vpaddb	%xmm2,%xmm13,%xmm14
 	vpxor	%xmm15,%xmm1,%xmm9
-	vmovdqu	%xmm4,16+8(%rsp)
+	vmovdqu	%xmm4,16+8(%rsp)  // "%xmm7" = 0
 	jmp	.Loop6x
 
 .align	32
 .Loop6x:
 	addl	$100663296,%ebx
-	jc	.Lhandle_ctr32
-	vmovdqu	0-32(%r9),%xmm3
-	vpaddb	%xmm2,%xmm14,%xmm1
+	jc	.Lhandle_ctr32  // discard ?
+	vmovdqu	0-32(%r9),%xmm3  // %xmm3^1
+	vpaddb	%xmm2,%xmm14,%xmm1  // next counter value
 	vpxor	%xmm15,%xmm10,%xmm10
 	vpxor	%xmm15,%xmm11,%xmm11
 
 .Lresume_ctr32:
-	vmovdqu	%xmm1,(%r8)
+	vmovdqu	%xmm1,(%r8)  // save next counter value
 	vpclmulqdq	$0x10,%xmm3,%xmm7,%xmm5
 	vpxor	%xmm15,%xmm12,%xmm12
-	vmovups	16-128(%rcx),%xmm2
+	vmovups	16-128(%rcx),%xmm2  // borrow %xmm2 for %xmm15
 	vpclmulqdq	$0x01,%xmm3,%xmm7,%xmm6
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+// At this point, the current block of 96 (0x60) bytes has already been
+// loaded into registers. Concurrently with processing it, we want to
+// load the next 96 bytes of input for the next round. Obviously, we can
+// only do this if there are at least 96 more bytes of input beyond the
+// input we're currently processing, or else we'd read past the end of
+// the input buffer. Here, we set |%r12| to 96 if there are at least 96
+// bytes of input beyond the 96 bytes we're already processing, and we
+// set |%r12| to 0 otherwise. In the case where we set |%r12| to 96,
+// we'll read in the next block so that it is in registers for the next
+// loop iteration. In the case where we set |%r12| to 0, we'll re-read
+// the current block and then ignore what we re-read.
+// 
+// At this point, |%r14| points to the current (already read into
+// registers) block, and |%r15| points to 2*96 bytes before the end of
+// the input. Thus, |%r14| > |%r15| means that we do not have the next
+// 96-byte block to read in, and |%r14| <= |%r15| means we do.
 	xorq	%r12,%r12
 	cmpq	%r14,%r15
 
 	vaesenc	%xmm2,%xmm9,%xmm9
-	vmovdqu	48+8(%rsp),%xmm0
+	vmovdqu	48+8(%rsp),%xmm0  // I4
 	vpxor	%xmm15,%xmm13,%xmm13
 	vpclmulqdq	$0x00,%xmm3,%xmm7,%xmm1
 	vaesenc	%xmm2,%xmm10,%xmm10
@@ -67,12 +67,12 @@
 	setnc	%r12b
 	vpclmulqdq	$0x11,%xmm3,%xmm7,%xmm7
 	vaesenc	%xmm2,%xmm11,%xmm11
-	vmovdqu	16-32(%r9),%xmm3
+	vmovdqu	16-32(%r9),%xmm3  // %xmm3^2
 	negq	%r12
 	vaesenc	%xmm2,%xmm12,%xmm12
 	vpxor	%xmm5,%xmm6,%xmm6
 	vpclmulqdq	$0x00,%xmm3,%xmm0,%xmm5
-	vpxor	%xmm4,%xmm8,%xmm8
+	vpxor	%xmm4,%xmm8,%xmm8  // modulo-scheduled
 	vaesenc	%xmm2,%xmm13,%xmm13
 	vpxor	%xmm5,%xmm1,%xmm4
 	andq	$0x60,%r12
@@ -83,9 +83,9 @@
 	vpclmulqdq	$0x01,%xmm3,%xmm0,%xmm2
 	leaq	(%r14,%r12,1),%r14
 	vaesenc	%xmm15,%xmm9,%xmm9
-	vpxor	16+8(%rsp),%xmm8,%xmm8
+	vpxor	16+8(%rsp),%xmm8,%xmm8  // modulo-scheduled vpxor %xmm7,%xmm8,%xmm8
 	vpclmulqdq	$0x11,%xmm3,%xmm0,%xmm3
-	vmovdqu	64+8(%rsp),%xmm0
+	vmovdqu	64+8(%rsp),%xmm0  // I3
 	vaesenc	%xmm15,%xmm10,%xmm10
 	movbeq	88(%r14),%r13
 	vaesenc	%xmm15,%xmm11,%xmm11
@@ -94,7 +94,7 @@
 	movq	%r13,32+8(%rsp)
 	vaesenc	%xmm15,%xmm13,%xmm13
 	movq	%r12,40+8(%rsp)
-	vmovdqu	48-32(%r9),%xmm5
+	vmovdqu	48-32(%r9),%xmm5  // borrow %xmm5 for %xmm3^3
 	vaesenc	%xmm15,%xmm14,%xmm14
 
 	vmovups	48-128(%rcx),%xmm15
@@ -108,11 +108,11 @@
 	vpclmulqdq	$0x01,%xmm5,%xmm0,%xmm3
 	vaesenc	%xmm15,%xmm11,%xmm11
 	vpclmulqdq	$0x11,%xmm5,%xmm0,%xmm5
-	vmovdqu	80+8(%rsp),%xmm0
+	vmovdqu	80+8(%rsp),%xmm0  // I2
 	vaesenc	%xmm15,%xmm12,%xmm12
 	vaesenc	%xmm15,%xmm13,%xmm13
 	vpxor	%xmm1,%xmm4,%xmm4
-	vmovdqu	64-32(%r9),%xmm1
+	vmovdqu	64-32(%r9),%xmm1  // borrow %xmm1 for %xmm3^4
 	vaesenc	%xmm15,%xmm14,%xmm14
 
 	vmovups	64-128(%rcx),%xmm15
@@ -128,13 +128,13 @@
 	vaesenc	%xmm15,%xmm11,%xmm11
 	movbeq	64(%r14),%r12
 	vpclmulqdq	$0x11,%xmm1,%xmm0,%xmm1
-	vmovdqu	96+8(%rsp),%xmm0
+	vmovdqu	96+8(%rsp),%xmm0  // I1
 	vaesenc	%xmm15,%xmm12,%xmm12
 	movq	%r13,48+8(%rsp)
 	vaesenc	%xmm15,%xmm13,%xmm13
 	movq	%r12,56+8(%rsp)
 	vpxor	%xmm2,%xmm4,%xmm4
-	vmovdqu	96-32(%r9),%xmm2
+	vmovdqu	96-32(%r9),%xmm2  // borrow %xmm2 for %xmm3^5
 	vaesenc	%xmm15,%xmm14,%xmm14
 
 	vmovups	80-128(%rcx),%xmm15
@@ -147,7 +147,7 @@
 	movbeq	56(%r14),%r13
 	vpxor	%xmm1,%xmm7,%xmm7
 	vpclmulqdq	$0x01,%xmm2,%xmm0,%xmm1
-	vpxor	112+8(%rsp),%xmm8,%xmm8
+	vpxor	112+8(%rsp),%xmm8,%xmm8  // accumulate I0
 	vaesenc	%xmm15,%xmm11,%xmm11
 	movbeq	48(%r14),%r12
 	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm2
@@ -156,7 +156,7 @@
 	vaesenc	%xmm15,%xmm13,%xmm13
 	movq	%r12,72+8(%rsp)
 	vpxor	%xmm3,%xmm4,%xmm4
-	vmovdqu	112-32(%r9),%xmm3
+	vmovdqu	112-32(%r9),%xmm3  // %xmm3^6
 	vaesenc	%xmm15,%xmm14,%xmm14
 
 	vmovups	96-128(%rcx),%xmm15
@@ -183,7 +183,7 @@
 	vmovups	112-128(%rcx),%xmm15
 	vpslldq	$8,%xmm6,%xmm5
 	vpxor	%xmm2,%xmm4,%xmm4
-	vmovdqu	16(%r11),%xmm3
+	vmovdqu	16(%r11),%xmm3  // .Lpoly
 
 	vaesenc	%xmm15,%xmm9,%xmm9
 	vpxor	%xmm8,%xmm7,%xmm7
@@ -192,13 +192,13 @@
 	movbeq	24(%r14),%r13
 	vaesenc	%xmm15,%xmm11,%xmm11
 	movbeq	16(%r14),%r12
-	vpalignr	$8,%xmm4,%xmm4,%xmm0
+	vpalignr	$8,%xmm4,%xmm4,%xmm0  // 1st phase
 	vpclmulqdq	$0x10,%xmm3,%xmm4,%xmm4
 	movq	%r13,96+8(%rsp)
 	vaesenc	%xmm15,%xmm12,%xmm12
 	movq	%r12,104+8(%rsp)
 	vaesenc	%xmm15,%xmm13,%xmm13
-	vmovups	128-128(%rcx),%xmm1
+	vmovups	128-128(%rcx),%xmm1  // borrow %xmm1 for %xmm15
 	vaesenc	%xmm15,%xmm14,%xmm14
 
 	vaesenc	%xmm1,%xmm9,%xmm9
@@ -215,7 +215,7 @@
 	vaesenc	%xmm1,%xmm14,%xmm14
 	vmovups	160-128(%rcx),%xmm1
 	cmpl	$11,%r10d
-	jb	.Lenc_tail
+	jb	.Lenc_tail  // 128-bit key
 
 	vaesenc	%xmm15,%xmm9,%xmm9
 	vaesenc	%xmm15,%xmm10,%xmm10
@@ -232,7 +232,7 @@
 	vmovups	176-128(%rcx),%xmm15
 	vaesenc	%xmm1,%xmm14,%xmm14
 	vmovups	192-128(%rcx),%xmm1
-	je	.Lenc_tail
+	je	.Lenc_tail  // 192-bit key
 
 	vaesenc	%xmm15,%xmm9,%xmm9
 	vaesenc	%xmm15,%xmm10,%xmm10
@@ -249,16 +249,16 @@
 	vmovups	208-128(%rcx),%xmm15
 	vaesenc	%xmm1,%xmm14,%xmm14
 	vmovups	224-128(%rcx),%xmm1
-	jmp	.Lenc_tail
+	jmp	.Lenc_tail  // 256-bit key
 
 .align	32
 .Lhandle_ctr32:
-	vmovdqu	(%r11),%xmm0
-	vpshufb	%xmm0,%xmm1,%xmm6
-	vmovdqu	48(%r11),%xmm5
-	vpaddd	64(%r11),%xmm6,%xmm10
+	vmovdqu	(%r11),%xmm0  // borrow %xmm0 for .Lbswap_mask
+	vpshufb	%xmm0,%xmm1,%xmm6  // byte-swap counter
+	vmovdqu	48(%r11),%xmm5  // borrow %xmm5, .Ltwo_lsb
+	vpaddd	64(%r11),%xmm6,%xmm10  // .Lone_lsb
 	vpaddd	%xmm5,%xmm6,%xmm11
-	vmovdqu	0-32(%r9),%xmm3
+	vmovdqu	0-32(%r9),%xmm3  // %xmm3^1
 	vpaddd	%xmm5,%xmm10,%xmm12
 	vpshufb	%xmm0,%xmm10,%xmm10
 	vpaddd	%xmm5,%xmm11,%xmm13
@@ -267,17 +267,17 @@
 	vpaddd	%xmm5,%xmm12,%xmm14
 	vpshufb	%xmm0,%xmm12,%xmm12
 	vpxor	%xmm15,%xmm11,%xmm11
-	vpaddd	%xmm5,%xmm13,%xmm1
+	vpaddd	%xmm5,%xmm13,%xmm1  // byte-swapped next counter value
 	vpshufb	%xmm0,%xmm13,%xmm13
 	vpshufb	%xmm0,%xmm14,%xmm14
-	vpshufb	%xmm0,%xmm1,%xmm1
+	vpshufb	%xmm0,%xmm1,%xmm1  // next counter value
 	jmp	.Lresume_ctr32
 
 .align	32
 .Lenc_tail:
 	vaesenc	%xmm15,%xmm9,%xmm9
-	vmovdqu	%xmm7,16+8(%rsp)
-	vpalignr	$8,%xmm4,%xmm4,%xmm8
+	vmovdqu	%xmm7,16+8(%rsp)  // postpone vpxor %xmm7,%xmm8,%xmm8
+	vpalignr	$8,%xmm4,%xmm4,%xmm8  // 2nd phase
 	vaesenc	%xmm15,%xmm10,%xmm10
 	vpclmulqdq	$0x10,%xmm3,%xmm4,%xmm4
 	vpxor	0(%rdi),%xmm1,%xmm2
@@ -290,16 +290,16 @@
 	vaesenc	%xmm15,%xmm14,%xmm14
 	vpxor	64(%rdi),%xmm1,%xmm7
 	vpxor	80(%rdi),%xmm1,%xmm3
-	vmovdqu	(%r8),%xmm1
+	vmovdqu	(%r8),%xmm1  // load next counter value
 
 	vaesenclast	%xmm2,%xmm9,%xmm9
-	vmovdqu	32(%r11),%xmm2
+	vmovdqu	32(%r11),%xmm2  // borrow %xmm2, .Lone_msb
 	vaesenclast	%xmm0,%xmm10,%xmm10
 	vpaddb	%xmm2,%xmm1,%xmm0
 	movq	%r13,112+8(%rsp)
 	leaq	96(%rdi),%rdi
-
-	prefetcht0	512(%rdi)
+// These two prefetches were added in BoringSSL. See change that added them.
+	prefetcht0	512(%rdi)  // We use 96-byte block so prefetch 2 lines (128 bytes)
 	prefetcht0	576(%rdi)
 	vaesenclast	%xmm5,%xmm11,%xmm11
 	vpaddb	%xmm2,%xmm0,%xmm5
@@ -317,24 +317,24 @@
 	subq	$0x6,%rdx
 	jc	.L6x_done
 
-	vmovups	%xmm9,-96(%rsi)
+	vmovups	%xmm9,-96(%rsi)  // save output
 	vpxor	%xmm15,%xmm1,%xmm9
 	vmovups	%xmm10,-80(%rsi)
-	vmovdqa	%xmm0,%xmm10
+	vmovdqa	%xmm0,%xmm10  // 0 latency
 	vmovups	%xmm11,-64(%rsi)
-	vmovdqa	%xmm5,%xmm11
+	vmovdqa	%xmm5,%xmm11  // 0 latency
 	vmovups	%xmm12,-48(%rsi)
-	vmovdqa	%xmm6,%xmm12
+	vmovdqa	%xmm6,%xmm12  // 0 latency
 	vmovups	%xmm13,-32(%rsi)
-	vmovdqa	%xmm7,%xmm13
+	vmovdqa	%xmm7,%xmm13  // 0 latency
 	vmovups	%xmm14,-16(%rsi)
-	vmovdqa	%xmm3,%xmm14
-	vmovdqu	32+8(%rsp),%xmm7
+	vmovdqa	%xmm3,%xmm14  // 0 latency
+	vmovdqu	32+8(%rsp),%xmm7  // I5
 	jmp	.Loop6x
 
 .L6x_done:
-	vpxor	16+8(%rsp),%xmm8,%xmm8
-	vpxor	%xmm4,%xmm8,%xmm8
+	vpxor	16+8(%rsp),%xmm8,%xmm8  // modulo-scheduled
+	vpxor	%xmm4,%xmm8,%xmm8  // modulo-scheduled
 
 	ret
 .cfi_endproc	
@@ -349,16 +349,16 @@
 _CET_ENDBR
 	xorq	%rax,%rax
 
-
-
-	cmpq	$0x60,%rdx
+// We call |_aesni_ctr32_ghash_6x|, which requires at least 96 (0x60)
+// bytes of input.
+	cmpq	$0x60,%rdx  // minimal accepted length
 	jb	.Lgcm_dec_abort
 
 	pushq	%rbp
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%rbp,-16
 
-	movq	%rsp,%rbp
+	movq	%rsp,%rbp  // save stack pointer
 .cfi_def_cfa_register	%rbp
 	pushq	%rbx
 .cfi_offset	%rbx,-24
@@ -378,17 +378,17 @@
 	vzeroupper
 
 	movq	16(%rbp),%r12
-	vmovdqu	(%r8),%xmm1
+	vmovdqu	(%r8),%xmm1  // input counter value
 	addq	$-128,%rsp
 	movl	12(%r8),%ebx
 	leaq	.Lbswap_mask(%rip),%r11
-	leaq	-128(%rcx),%r14
-	movq	$0xf80,%r15
-	vmovdqu	(%r12),%xmm8
-	andq	$-128,%rsp
-	vmovdqu	(%r11),%xmm0
-	leaq	128(%rcx),%rcx
-	leaq	32(%r9),%r9
+	leaq	-128(%rcx),%r14  // borrow %r14
+	movq	$0xf80,%r15  // borrow %r15
+	vmovdqu	(%r12),%xmm8  // load Xi
+	andq	$-128,%rsp  // ensure stack alignment
+	vmovdqu	(%r11),%xmm0  // borrow %xmm0 for .Lbswap_mask
+	leaq	128(%rcx),%rcx  // size optimization
+	leaq	32(%r9),%r9  // size optimization
 	movl	240-128(%rcx),%r10d
 	vpshufb	%xmm0,%xmm8,%xmm8
 
@@ -398,26 +398,26 @@
 	jc	.Ldec_no_key_aliasing
 	cmpq	$768,%r15
 	jnc	.Ldec_no_key_aliasing
-	subq	%r15,%rsp
+	subq	%r15,%rsp  // avoid aliasing with key
 .Ldec_no_key_aliasing:
 
-	vmovdqu	80(%rdi),%xmm7
+	vmovdqu	80(%rdi),%xmm7  // I5
 	movq	%rdi,%r14
 	vmovdqu	64(%rdi),%xmm4
 
-
-
-
-
-
-
+// |_aesni_ctr32_ghash_6x| requires |%r15| to point to 2*96 (0xc0)
+// bytes before the end of the input. Note, in particular, that this is
+// correct even if |%rdx| is not an even multiple of 96 or 16. XXX: This
+// seems to require that |%rdi| + |%rdx| >= 2*96 (0xc0); i.e. |%rdi| must
+// not be near the very beginning of the address space when |%rdx| < 2*96
+// (0xc0).
 	leaq	-192(%rdi,%rdx,1),%r15
 
 	vmovdqu	48(%rdi),%xmm5
 	shrq	$4,%rdx
 	xorq	%rax,%rax
 	vmovdqu	32(%rdi),%xmm6
-	vpshufb	%xmm0,%xmm7,%xmm7
+	vpshufb	%xmm0,%xmm7,%xmm7  // passed to _aesni_ctr32_ghash_6x
 	vmovdqu	16(%rdi),%xmm2
 	vpshufb	%xmm0,%xmm4,%xmm4
 	vmovdqu	(%rdi),%xmm3
@@ -434,18 +434,18 @@
 	call	_aesni_ctr32_ghash_6x
 
 	movq	16(%rbp),%r12
-	vmovups	%xmm9,-96(%rsi)
+	vmovups	%xmm9,-96(%rsi)  // save output
 	vmovups	%xmm10,-80(%rsi)
 	vmovups	%xmm11,-64(%rsi)
 	vmovups	%xmm12,-48(%rsi)
 	vmovups	%xmm13,-32(%rsi)
 	vmovups	%xmm14,-16(%rsi)
 
-	vpshufb	(%r11),%xmm8,%xmm8
-	vmovdqu	%xmm8,(%r12)
+	vpshufb	(%r11),%xmm8,%xmm8  // .Lbswap_mask
+	vmovdqu	%xmm8,(%r12)  // output Xi
 
 	vzeroupper
-	leaq	-40(%rbp),%rsp
+	leaq	-40(%rbp),%rsp  // restore %rsp to fixed allocation
 .cfi_def_cfa	%rsp, 0x38
 	popq	%r15
 .cfi_adjust_cfa_offset	-8
@@ -474,8 +474,8 @@
 .align	32
 _aesni_ctr32_6x:
 .cfi_startproc	
-	vmovdqu	0-128(%rcx),%xmm4
-	vmovdqu	32(%r11),%xmm2
+	vmovdqu	0-128(%rcx),%xmm4  // borrow %xmm4 for %xmm15
+	vmovdqu	32(%r11),%xmm2  // borrow %xmm2, .Lone_msb
 	leaq	-1(%r10),%r13
 	vmovups	16-128(%rcx),%xmm15
 	leaq	32-128(%rcx),%r12
@@ -508,7 +508,7 @@
 	decl	%r13d
 	jnz	.Loop_ctr32
 
-	vmovdqu	(%r12),%xmm3
+	vmovdqu	(%r12),%xmm3  // last round key
 	vaesenc	%xmm15,%xmm9,%xmm9
 	vpxor	0(%rdi),%xmm3,%xmm4
 	vaesenc	%xmm15,%xmm10,%xmm10
@@ -540,9 +540,9 @@
 	ret
 .align	32
 .Lhandle_ctr32_2:
-	vpshufb	%xmm0,%xmm1,%xmm6
-	vmovdqu	48(%r11),%xmm5
-	vpaddd	64(%r11),%xmm6,%xmm10
+	vpshufb	%xmm0,%xmm1,%xmm6  // byte-swap counter
+	vmovdqu	48(%r11),%xmm5  // borrow %xmm5, .Ltwo_lsb
+	vpaddd	64(%r11),%xmm6,%xmm10  // .Lone_lsb
 	vpaddd	%xmm5,%xmm6,%xmm11
 	vpaddd	%xmm5,%xmm10,%xmm12
 	vpshufb	%xmm0,%xmm10,%xmm10
@@ -552,12 +552,12 @@
 	vpaddd	%xmm5,%xmm12,%xmm14
 	vpshufb	%xmm0,%xmm12,%xmm12
 	vpxor	%xmm4,%xmm11,%xmm11
-	vpaddd	%xmm5,%xmm13,%xmm1
+	vpaddd	%xmm5,%xmm13,%xmm1  // byte-swapped next counter value
 	vpshufb	%xmm0,%xmm13,%xmm13
 	vpxor	%xmm4,%xmm12,%xmm12
 	vpshufb	%xmm0,%xmm14,%xmm14
 	vpxor	%xmm4,%xmm13,%xmm13
-	vpshufb	%xmm0,%xmm1,%xmm1
+	vpshufb	%xmm0,%xmm1,%xmm1  // next counter value
 	vpxor	%xmm4,%xmm14,%xmm14
 	jmp	.Loop_ctr32
 .cfi_endproc	
@@ -578,17 +578,17 @@
 #endif
 	xorq	%rax,%rax
 
-
-
-
-	cmpq	$288,%rdx
+// We call |_aesni_ctr32_6x| twice, each call consuming 96 bytes of
+// input. Then we call |_aesni_ctr32_ghash_6x|, which requires at
+// least 96 more bytes of input.
+	cmpq	$288,%rdx  // minimal accepted length
 	jb	.Lgcm_enc_abort
 
 	pushq	%rbp
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%rbp,-16
 
-	movq	%rsp,%rbp
+	movq	%rsp,%rbp  // save stack pointer
 .cfi_def_cfa_register	%rbp
 	pushq	%rbx
 .cfi_offset	%rbx,-24
@@ -607,15 +607,15 @@
 
 	vzeroupper
 
-	vmovdqu	(%r8),%xmm1
+	vmovdqu	(%r8),%xmm1  // input counter value
 	addq	$-128,%rsp
 	movl	12(%r8),%ebx
 	leaq	.Lbswap_mask(%rip),%r11
-	leaq	-128(%rcx),%r14
-	movq	$0xf80,%r15
-	leaq	128(%rcx),%rcx
-	vmovdqu	(%r11),%xmm0
-	andq	$-128,%rsp
+	leaq	-128(%rcx),%r14  // borrow %r14
+	movq	$0xf80,%r15  // borrow %r15
+	leaq	128(%rcx),%rcx  // size optimization
+	vmovdqu	(%r11),%xmm0  // borrow %xmm0 for .Lbswap_mask
+	andq	$-128,%rsp  // ensure stack alignment
 	movl	240-128(%rcx),%r10d
 
 	andq	%r15,%r14
@@ -624,24 +624,24 @@
 	jc	.Lenc_no_key_aliasing
 	cmpq	$768,%r15
 	jnc	.Lenc_no_key_aliasing
-	subq	%r15,%rsp
+	subq	%r15,%rsp  // avoid aliasing with key
 .Lenc_no_key_aliasing:
 
 	movq	%rsi,%r14
 
-
-
-
-
-
-
-
+// |_aesni_ctr32_ghash_6x| requires |%r15| to point to 2*96 (0xc0)
+// bytes before the end of the input. Note, in particular, that this is
+// correct even if |%rdx| is not an even multiple of 96 or 16. Unlike in
+// the decryption case, there's no caveat that |%rsi| must not be near
+// the very beginning of the address space, because we know that
+// |%rdx| >= 3*96 from the check above, and so we know
+// |%rsi| + |%rdx| >= 2*96 (0xc0).
 	leaq	-192(%rsi,%rdx,1),%r15
 
 	shrq	$4,%rdx
 
 	call	_aesni_ctr32_6x
-	vpshufb	%xmm0,%xmm9,%xmm8
+	vpshufb	%xmm0,%xmm9,%xmm8  // save bswapped output on stack
 	vpshufb	%xmm0,%xmm10,%xmm2
 	vmovdqu	%xmm8,112(%rsp)
 	vpshufb	%xmm0,%xmm11,%xmm4
@@ -650,26 +650,26 @@
 	vmovdqu	%xmm4,80(%rsp)
 	vpshufb	%xmm0,%xmm13,%xmm6
 	vmovdqu	%xmm5,64(%rsp)
-	vpshufb	%xmm0,%xmm14,%xmm7
+	vpshufb	%xmm0,%xmm14,%xmm7  // passed to _aesni_ctr32_ghash_6x
 	vmovdqu	%xmm6,48(%rsp)
 
 	call	_aesni_ctr32_6x
 
 	movq	16(%rbp),%r12
-	leaq	32(%r9),%r9
-	vmovdqu	(%r12),%xmm8
+	leaq	32(%r9),%r9  // size optimization
+	vmovdqu	(%r12),%xmm8  // load Xi
 	subq	$12,%rdx
 	movq	$192,%rax
 	vpshufb	%xmm0,%xmm8,%xmm8
 
 	call	_aesni_ctr32_ghash_6x
-	vmovdqu	32(%rsp),%xmm7
-	vmovdqu	(%r11),%xmm0
-	vmovdqu	0-32(%r9),%xmm3
+	vmovdqu	32(%rsp),%xmm7  // I5
+	vmovdqu	(%r11),%xmm0  // borrow %xmm0 for .Lbswap_mask
+	vmovdqu	0-32(%r9),%xmm3  // %xmm3^1
 	vpunpckhqdq	%xmm7,%xmm7,%xmm1
-	vmovdqu	32-32(%r9),%xmm15
-	vmovups	%xmm9,-96(%rsi)
-	vpshufb	%xmm0,%xmm9,%xmm9
+	vmovdqu	32-32(%r9),%xmm15  // borrow %xmm15 for
+	vmovups	%xmm9,-96(%rsi)  // save output
+	vpshufb	%xmm0,%xmm9,%xmm9  // but keep bswapped copy
 	vpxor	%xmm7,%xmm1,%xmm1
 	vmovups	%xmm10,-80(%rsi)
 	vpshufb	%xmm0,%xmm10,%xmm10
@@ -681,18 +681,18 @@
 	vpshufb	%xmm0,%xmm13,%xmm13
 	vmovups	%xmm14,-16(%rsi)
 	vpshufb	%xmm0,%xmm14,%xmm14
-	vmovdqu	%xmm9,16(%rsp)
-	vmovdqu	48(%rsp),%xmm6
-	vmovdqu	16-32(%r9),%xmm0
+	vmovdqu	%xmm9,16(%rsp)  // free %xmm9
+	vmovdqu	48(%rsp),%xmm6  // I4
+	vmovdqu	16-32(%r9),%xmm0  // borrow %xmm0 for %xmm3^2
 	vpunpckhqdq	%xmm6,%xmm6,%xmm2
 	vpclmulqdq	$0x00,%xmm3,%xmm7,%xmm5
 	vpxor	%xmm6,%xmm2,%xmm2
 	vpclmulqdq	$0x11,%xmm3,%xmm7,%xmm7
 	vpclmulqdq	$0x00,%xmm15,%xmm1,%xmm1
 
-	vmovdqu	64(%rsp),%xmm9
+	vmovdqu	64(%rsp),%xmm9  // I3
 	vpclmulqdq	$0x00,%xmm0,%xmm6,%xmm4
-	vmovdqu	48-32(%r9),%xmm3
+	vmovdqu	48-32(%r9),%xmm3  // %xmm3^3
 	vpxor	%xmm5,%xmm4,%xmm4
 	vpunpckhqdq	%xmm9,%xmm9,%xmm5
 	vpclmulqdq	$0x11,%xmm0,%xmm6,%xmm6
@@ -702,9 +702,9 @@
 	vmovdqu	80-32(%r9),%xmm15
 	vpxor	%xmm1,%xmm2,%xmm2
 
-	vmovdqu	80(%rsp),%xmm1
+	vmovdqu	80(%rsp),%xmm1  // I2
 	vpclmulqdq	$0x00,%xmm3,%xmm9,%xmm7
-	vmovdqu	64-32(%r9),%xmm0
+	vmovdqu	64-32(%r9),%xmm0  // borrow %xmm0 for %xmm3^4
 	vpxor	%xmm4,%xmm7,%xmm7
 	vpunpckhqdq	%xmm1,%xmm1,%xmm4
 	vpclmulqdq	$0x11,%xmm3,%xmm9,%xmm9
@@ -713,9 +713,9 @@
 	vpclmulqdq	$0x00,%xmm15,%xmm5,%xmm5
 	vpxor	%xmm2,%xmm5,%xmm5
 
-	vmovdqu	96(%rsp),%xmm2
+	vmovdqu	96(%rsp),%xmm2  // I1
 	vpclmulqdq	$0x00,%xmm0,%xmm1,%xmm6
-	vmovdqu	96-32(%r9),%xmm3
+	vmovdqu	96-32(%r9),%xmm3  // %xmm3^5
 	vpxor	%xmm7,%xmm6,%xmm6
 	vpunpckhqdq	%xmm2,%xmm2,%xmm7
 	vpclmulqdq	$0x11,%xmm0,%xmm1,%xmm1
@@ -725,9 +725,9 @@
 	vmovdqu	128-32(%r9),%xmm15
 	vpxor	%xmm5,%xmm4,%xmm4
 
-	vpxor	112(%rsp),%xmm8,%xmm8
+	vpxor	112(%rsp),%xmm8,%xmm8  // accumulate I0
 	vpclmulqdq	$0x00,%xmm3,%xmm2,%xmm5
-	vmovdqu	112-32(%r9),%xmm0
+	vmovdqu	112-32(%r9),%xmm0  // borrow %xmm0 for %xmm3^6
 	vpunpckhqdq	%xmm8,%xmm8,%xmm9
 	vpxor	%xmm6,%xmm5,%xmm5
 	vpclmulqdq	$0x11,%xmm3,%xmm2,%xmm2
@@ -737,7 +737,7 @@
 	vpxor	%xmm4,%xmm7,%xmm4
 
 	vpclmulqdq	$0x00,%xmm0,%xmm8,%xmm6
-	vmovdqu	0-32(%r9),%xmm3
+	vmovdqu	0-32(%r9),%xmm3  // %xmm3^1
 	vpunpckhqdq	%xmm14,%xmm14,%xmm1
 	vpclmulqdq	$0x11,%xmm0,%xmm8,%xmm8
 	vpxor	%xmm14,%xmm1,%xmm1
@@ -747,8 +747,8 @@
 	vpxor	%xmm2,%xmm8,%xmm7
 	vpxor	%xmm4,%xmm9,%xmm6
 
-	vmovdqu	16-32(%r9),%xmm0
-	vpxor	%xmm5,%xmm7,%xmm9
+	vmovdqu	16-32(%r9),%xmm0  // borrow %xmm0 for %xmm3^2
+	vpxor	%xmm5,%xmm7,%xmm9  // aggregated Karatsuba post-processing
 	vpclmulqdq	$0x00,%xmm3,%xmm14,%xmm4
 	vpxor	%xmm9,%xmm6,%xmm6
 	vpunpckhqdq	%xmm13,%xmm13,%xmm2
@@ -761,25 +761,25 @@
 	vpxor	%xmm6,%xmm7,%xmm7
 
 	vpclmulqdq	$0x00,%xmm0,%xmm13,%xmm5
-	vmovdqu	48-32(%r9),%xmm3
+	vmovdqu	48-32(%r9),%xmm3  // %xmm3^3
 	vpxor	%xmm4,%xmm5,%xmm5
 	vpunpckhqdq	%xmm12,%xmm12,%xmm9
 	vpclmulqdq	$0x11,%xmm0,%xmm13,%xmm13
 	vpxor	%xmm12,%xmm9,%xmm9
 	vpxor	%xmm14,%xmm13,%xmm13
-	vpalignr	$8,%xmm8,%xmm8,%xmm14
+	vpalignr	$8,%xmm8,%xmm8,%xmm14  // 1st phase
 	vpclmulqdq	$0x10,%xmm15,%xmm2,%xmm2
 	vmovdqu	80-32(%r9),%xmm15
 	vpxor	%xmm1,%xmm2,%xmm2
 
 	vpclmulqdq	$0x00,%xmm3,%xmm12,%xmm4
-	vmovdqu	64-32(%r9),%xmm0
+	vmovdqu	64-32(%r9),%xmm0  // borrow %xmm0 for %xmm3^4
 	vpxor	%xmm5,%xmm4,%xmm4
 	vpunpckhqdq	%xmm11,%xmm11,%xmm1
 	vpclmulqdq	$0x11,%xmm3,%xmm12,%xmm12
 	vpxor	%xmm11,%xmm1,%xmm1
 	vpxor	%xmm13,%xmm12,%xmm12
-	vxorps	16(%rsp),%xmm7,%xmm7
+	vxorps	16(%rsp),%xmm7,%xmm7  // accumulate %xmm9
 	vpclmulqdq	$0x00,%xmm15,%xmm9,%xmm9
 	vpxor	%xmm2,%xmm9,%xmm9
 
@@ -787,12 +787,12 @@
 	vxorps	%xmm14,%xmm8,%xmm8
 
 	vpclmulqdq	$0x00,%xmm0,%xmm11,%xmm5
-	vmovdqu	96-32(%r9),%xmm3
+	vmovdqu	96-32(%r9),%xmm3  // %xmm3^5
 	vpxor	%xmm4,%xmm5,%xmm5
 	vpunpckhqdq	%xmm10,%xmm10,%xmm2
 	vpclmulqdq	$0x11,%xmm0,%xmm11,%xmm11
 	vpxor	%xmm10,%xmm2,%xmm2
-	vpalignr	$8,%xmm8,%xmm8,%xmm14
+	vpalignr	$8,%xmm8,%xmm8,%xmm14  // 2nd phase
 	vpxor	%xmm12,%xmm11,%xmm11
 	vpclmulqdq	$0x10,%xmm15,%xmm1,%xmm1
 	vmovdqu	128-32(%r9),%xmm15
@@ -803,7 +803,7 @@
 	vxorps	%xmm14,%xmm8,%xmm8
 
 	vpclmulqdq	$0x00,%xmm3,%xmm10,%xmm4
-	vmovdqu	112-32(%r9),%xmm0
+	vmovdqu	112-32(%r9),%xmm0  // borrow %xmm0 for %xmm3^6
 	vpxor	%xmm5,%xmm4,%xmm4
 	vpunpckhqdq	%xmm8,%xmm8,%xmm9
 	vpclmulqdq	$0x11,%xmm3,%xmm10,%xmm10
@@ -819,28 +819,28 @@
 	vpxor	%xmm10,%xmm7,%xmm7
 	vpxor	%xmm2,%xmm6,%xmm6
 
-	vpxor	%xmm5,%xmm7,%xmm4
+	vpxor	%xmm5,%xmm7,%xmm4  // aggregated Karatsuba post-processing
 	vpxor	%xmm4,%xmm6,%xmm6
 	vpslldq	$8,%xmm6,%xmm1
-	vmovdqu	16(%r11),%xmm3
+	vmovdqu	16(%r11),%xmm3  // .Lpoly
 	vpsrldq	$8,%xmm6,%xmm6
 	vpxor	%xmm1,%xmm5,%xmm8
 	vpxor	%xmm6,%xmm7,%xmm7
 
-	vpalignr	$8,%xmm8,%xmm8,%xmm2
+	vpalignr	$8,%xmm8,%xmm8,%xmm2  // 1st phase
 	vpclmulqdq	$0x10,%xmm3,%xmm8,%xmm8
 	vpxor	%xmm2,%xmm8,%xmm8
 
-	vpalignr	$8,%xmm8,%xmm8,%xmm2
+	vpalignr	$8,%xmm8,%xmm8,%xmm2  // 2nd phase
 	vpclmulqdq	$0x10,%xmm3,%xmm8,%xmm8
 	vpxor	%xmm7,%xmm2,%xmm2
 	vpxor	%xmm2,%xmm8,%xmm8
 	movq	16(%rbp),%r12
-	vpshufb	(%r11),%xmm8,%xmm8
-	vmovdqu	%xmm8,(%r12)
+	vpshufb	(%r11),%xmm8,%xmm8  // .Lbswap_mask
+	vmovdqu	%xmm8,(%r12)  // output Xi
 
 	vzeroupper
-	leaq	-40(%rbp),%rsp
+	leaq	-40(%rbp),%rsp  // restore %rsp to fixed allocation
 .cfi_def_cfa	%rsp, 0x38
 	popq	%r15
 .cfi_adjust_cfa_offset	-8

boringssl-0.20260708.tar.xz/gen/bcm/aesni-gcm-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/aesni-gcm-x86_64-win.asm Changed

@@ -18,9 +18,9 @@
 ALIGN	32
 _aesni_ctr32_ghash_6x:
 
-	vmovdqu	xmm2,XMMWORD32+r11
+	vmovdqu	xmm2,XMMWORD32+r11  ; borrow %xmm2, .Lone_msb
 	sub	r8,6
-	vpxor	xmm4,xmm4,xmm4
+	vpxor	xmm4,xmm4,xmm4  ; %xmm4   = 0
 	vmovdqu	xmm15,XMMWORD((0-128))+r9
 	vpaddb	xmm10,xmm1,xmm2
 	vpaddb	xmm11,xmm10,xmm2
@@ -28,46 +28,46 @@
 	vpaddb	xmm13,xmm12,xmm2
 	vpaddb	xmm14,xmm13,xmm2
 	vpxor	xmm9,xmm1,xmm15
-	vmovdqu	XMMWORD(16+8)+rsp,xmm4
+	vmovdqu	XMMWORD(16+8)+rsp,xmm4  ; "%xmm7" = 0
 	jmp	NEAR $L$oop6x
 
 ALIGN	32
 $L$oop6x:
 	add	ebx,100663296
-	jc	NEAR $L$handle_ctr32
-	vmovdqu	xmm3,XMMWORD((0-32))+rsi
-	vpaddb	xmm1,xmm14,xmm2
+	jc	NEAR $L$handle_ctr32  ; discard ?
+	vmovdqu	xmm3,XMMWORD((0-32))+rsi  ; %xmm3^1
+	vpaddb	xmm1,xmm14,xmm2  ; next counter value
 	vpxor	xmm10,xmm10,xmm15
 	vpxor	xmm11,xmm11,xmm15
 
 $L$resume_ctr32:
-	vmovdqu	XMMWORDrdi,xmm1
+	vmovdqu	XMMWORDrdi,xmm1  ; save next counter value
 	vpclmulqdq	xmm5,xmm7,xmm3,0x10
 	vpxor	xmm12,xmm12,xmm15
-	vmovups	xmm2,XMMWORD((16-128))+r9
+	vmovups	xmm2,XMMWORD((16-128))+r9  ; borrow %xmm2 for %xmm15
 	vpclmulqdq	xmm6,xmm7,xmm3,0x01
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+; At this point, the current block of 96 (0x60) bytes has already been
+; loaded into registers. Concurrently with processing it, we want to
+; load the next 96 bytes of input for the next round. Obviously, we can
+; only do this if there are at least 96 more bytes of input beyond the
+; input we're currently processing, or else we'd read past the end of
+; the input buffer. Here, we set |%r12| to 96 if there are at least 96
+; bytes of input beyond the 96 bytes we're already processing, and we
+; set |%r12| to 0 otherwise. In the case where we set |%r12| to 96,
+; we'll read in the next block so that it is in registers for the next
+; loop iteration. In the case where we set |%r12| to 0, we'll re-read
+; the current block and then ignore what we re-read.
+; 
+; At this point, |%r14| points to the current (already read into
+; registers) block, and |%r15| points to 2*96 bytes before the end of
+; the input. Thus, |%r14| > |%r15| means that we do not have the next
+; 96-byte block to read in, and |%r14| <= |%r15| means we do.
 	xor	r12,r12
 	cmp	r15,r14
 
 	vaesenc	xmm9,xmm9,xmm2
-	vmovdqu	xmm0,XMMWORD((48+8))+rsp
+	vmovdqu	xmm0,XMMWORD((48+8))+rsp  ; I4
 	vpxor	xmm13,xmm13,xmm15
 	vpclmulqdq	xmm1,xmm7,xmm3,0x00
 	vaesenc	xmm10,xmm10,xmm2
@@ -75,12 +75,12 @@
 	setnc	r12b
 	vpclmulqdq	xmm7,xmm7,xmm3,0x11
 	vaesenc	xmm11,xmm11,xmm2
-	vmovdqu	xmm3,XMMWORD((16-32))+rsi
+	vmovdqu	xmm3,XMMWORD((16-32))+rsi  ; %xmm3^2
 	neg	r12
 	vaesenc	xmm12,xmm12,xmm2
 	vpxor	xmm6,xmm6,xmm5
 	vpclmulqdq	xmm5,xmm0,xmm3,0x00
-	vpxor	xmm8,xmm8,xmm4
+	vpxor	xmm8,xmm8,xmm4  ; modulo-scheduled
 	vaesenc	xmm13,xmm13,xmm2
 	vpxor	xmm4,xmm1,xmm5
 	and	r12,0x60
@@ -91,9 +91,9 @@
 	vpclmulqdq	xmm2,xmm0,xmm3,0x01
 	lea	r14,r12*1+r14
 	vaesenc	xmm9,xmm9,xmm15
-	vpxor	xmm8,xmm8,XMMWORD((16+8))+rsp
+	vpxor	xmm8,xmm8,XMMWORD((16+8))+rsp  ; modulo-scheduled vpxor %xmm7,%xmm8,%xmm8
 	vpclmulqdq	xmm3,xmm0,xmm3,0x11
-	vmovdqu	xmm0,XMMWORD((64+8))+rsp
+	vmovdqu	xmm0,XMMWORD((64+8))+rsp  ; I3
 	vaesenc	xmm10,xmm10,xmm15
 	movbe	r13,QWORD88+r14
 	vaesenc	xmm11,xmm11,xmm15
@@ -102,7 +102,7 @@
 	mov	QWORD((32+8))+rsp,r13
 	vaesenc	xmm13,xmm13,xmm15
 	mov	QWORD((40+8))+rsp,r12
-	vmovdqu	xmm5,XMMWORD((48-32))+rsi
+	vmovdqu	xmm5,XMMWORD((48-32))+rsi  ; borrow %xmm5 for %xmm3^3
 	vaesenc	xmm14,xmm14,xmm15
 
 	vmovups	xmm15,XMMWORD((48-128))+r9
@@ -116,11 +116,11 @@
 	vpclmulqdq	xmm3,xmm0,xmm5,0x01
 	vaesenc	xmm11,xmm11,xmm15
 	vpclmulqdq	xmm5,xmm0,xmm5,0x11
-	vmovdqu	xmm0,XMMWORD((80+8))+rsp
+	vmovdqu	xmm0,XMMWORD((80+8))+rsp  ; I2
 	vaesenc	xmm12,xmm12,xmm15
 	vaesenc	xmm13,xmm13,xmm15
 	vpxor	xmm4,xmm4,xmm1
-	vmovdqu	xmm1,XMMWORD((64-32))+rsi
+	vmovdqu	xmm1,XMMWORD((64-32))+rsi  ; borrow %xmm1 for %xmm3^4
 	vaesenc	xmm14,xmm14,xmm15
 
 	vmovups	xmm15,XMMWORD((64-128))+r9
@@ -136,13 +136,13 @@
 	vaesenc	xmm11,xmm11,xmm15
 	movbe	r12,QWORD64+r14
 	vpclmulqdq	xmm1,xmm0,xmm1,0x11
-	vmovdqu	xmm0,XMMWORD((96+8))+rsp
+	vmovdqu	xmm0,XMMWORD((96+8))+rsp  ; I1
 	vaesenc	xmm12,xmm12,xmm15
 	mov	QWORD((48+8))+rsp,r13
 	vaesenc	xmm13,xmm13,xmm15
 	mov	QWORD((56+8))+rsp,r12
 	vpxor	xmm4,xmm4,xmm2
-	vmovdqu	xmm2,XMMWORD((96-32))+rsi
+	vmovdqu	xmm2,XMMWORD((96-32))+rsi  ; borrow %xmm2 for %xmm3^5
 	vaesenc	xmm14,xmm14,xmm15
 
 	vmovups	xmm15,XMMWORD((80-128))+r9
@@ -155,7 +155,7 @@
 	movbe	r13,QWORD56+r14
 	vpxor	xmm7,xmm7,xmm1
 	vpclmulqdq	xmm1,xmm0,xmm2,0x01
-	vpxor	xmm8,xmm8,XMMWORD((112+8))+rsp
+	vpxor	xmm8,xmm8,XMMWORD((112+8))+rsp  ; accumulate I0
 	vaesenc	xmm11,xmm11,xmm15
 	movbe	r12,QWORD48+r14
 	vpclmulqdq	xmm2,xmm0,xmm2,0x11
@@ -164,7 +164,7 @@
 	vaesenc	xmm13,xmm13,xmm15
 	mov	QWORD((72+8))+rsp,r12
 	vpxor	xmm4,xmm4,xmm3
-	vmovdqu	xmm3,XMMWORD((112-32))+rsi
+	vmovdqu	xmm3,XMMWORD((112-32))+rsi  ; %xmm3^6
 	vaesenc	xmm14,xmm14,xmm15
 
 	vmovups	xmm15,XMMWORD((96-128))+r9
@@ -191,7 +191,7 @@
 	vmovups	xmm15,XMMWORD((112-128))+r9
 	vpslldq	xmm5,xmm6,8
 	vpxor	xmm4,xmm4,xmm2
-	vmovdqu	xmm3,XMMWORD16+r11
+	vmovdqu	xmm3,XMMWORD16+r11  ; .Lpoly
 
 	vaesenc	xmm9,xmm9,xmm15
 	vpxor	xmm7,xmm7,xmm8
@@ -200,13 +200,13 @@
 	movbe	r13,QWORD24+r14
 	vaesenc	xmm11,xmm11,xmm15
 	movbe	r12,QWORD16+r14
-	vpalignr	xmm0,xmm4,xmm4,8
+	vpalignr	xmm0,xmm4,xmm4,8  ; 1st phase
 	vpclmulqdq	xmm4,xmm4,xmm3,0x10
 	mov	QWORD((96+8))+rsp,r13
 	vaesenc	xmm12,xmm12,xmm15
 	mov	QWORD((104+8))+rsp,r12
 	vaesenc	xmm13,xmm13,xmm15
-	vmovups	xmm1,XMMWORD((128-128))+r9
+	vmovups	xmm1,XMMWORD((128-128))+r9  ; borrow %xmm1 for %xmm15
 	vaesenc	xmm14,xmm14,xmm15
 
 	vaesenc	xmm9,xmm9,xmm1
@@ -223,7 +223,7 @@
 	vaesenc	xmm14,xmm14,xmm1
 	vmovups	xmm1,XMMWORD((160-128))+r9
 	cmp	r10d,11
-	jb	NEAR $L$enc_tail
+	jb	NEAR $L$enc_tail  ; 128-bit key
 
 	vaesenc	xmm9,xmm9,xmm15
 	vaesenc	xmm10,xmm10,xmm15
@@ -240,7 +240,7 @@
 	vmovups	xmm15,XMMWORD((176-128))+r9
 	vaesenc	xmm14,xmm14,xmm1
 	vmovups	xmm1,XMMWORD((192-128))+r9
-	je	NEAR $L$enc_tail
+	je	NEAR $L$enc_tail  ; 192-bit key
 
 	vaesenc	xmm9,xmm9,xmm15
 	vaesenc	xmm10,xmm10,xmm15
@@ -257,16 +257,16 @@
 	vmovups	xmm15,XMMWORD((208-128))+r9
 	vaesenc	xmm14,xmm14,xmm1
 	vmovups	xmm1,XMMWORD((224-128))+r9
-	jmp	NEAR $L$enc_tail
+	jmp	NEAR $L$enc_tail  ; 256-bit key
 
 ALIGN	32
 $L$handle_ctr32:
-	vmovdqu	xmm0,XMMWORDr11
-	vpshufb	xmm6,xmm1,xmm0
-	vmovdqu	xmm5,XMMWORD48+r11
-	vpaddd	xmm10,xmm6,XMMWORD64+r11
+	vmovdqu	xmm0,XMMWORDr11  ; borrow %xmm0 for .Lbswap_mask
+	vpshufb	xmm6,xmm1,xmm0  ; byte-swap counter
+	vmovdqu	xmm5,XMMWORD48+r11  ; borrow %xmm5, .Ltwo_lsb
+	vpaddd	xmm10,xmm6,XMMWORD64+r11  ; .Lone_lsb
 	vpaddd	xmm11,xmm6,xmm5
-	vmovdqu	xmm3,XMMWORD((0-32))+rsi
+	vmovdqu	xmm3,XMMWORD((0-32))+rsi  ; %xmm3^1
 	vpaddd	xmm12,xmm10,xmm5
 	vpshufb	xmm10,xmm10,xmm0
 	vpaddd	xmm13,xmm11,xmm5
@@ -275,17 +275,17 @@
 	vpaddd	xmm14,xmm12,xmm5
 	vpshufb	xmm12,xmm12,xmm0
 	vpxor	xmm11,xmm11,xmm15
-	vpaddd	xmm1,xmm13,xmm5
+	vpaddd	xmm1,xmm13,xmm5  ; byte-swapped next counter value
 	vpshufb	xmm13,xmm13,xmm0
 	vpshufb	xmm14,xmm14,xmm0
-	vpshufb	xmm1,xmm1,xmm0
+	vpshufb	xmm1,xmm1,xmm0  ; next counter value
 	jmp	NEAR $L$resume_ctr32
 
 ALIGN	32
 $L$enc_tail:
 	vaesenc	xmm9,xmm9,xmm15
-	vmovdqu	XMMWORD(16+8)+rsp,xmm7
-	vpalignr	xmm8,xmm4,xmm4,8
+	vmovdqu	XMMWORD(16+8)+rsp,xmm7  ; postpone vpxor %xmm7,%xmm8,%xmm8
+	vpalignr	xmm8,xmm4,xmm4,8  ; 2nd phase
 	vaesenc	xmm10,xmm10,xmm15
 	vpclmulqdq	xmm4,xmm4,xmm3,0x10
 	vpxor	xmm2,xmm1,XMMWORDrcx
@@ -298,16 +298,16 @@
 	vaesenc	xmm14,xmm14,xmm15
 	vpxor	xmm7,xmm1,XMMWORD64+rcx
 	vpxor	xmm3,xmm1,XMMWORD80+rcx
-	vmovdqu	xmm1,XMMWORDrdi
+	vmovdqu	xmm1,XMMWORDrdi  ; load next counter value
 
 	vaesenclast	xmm9,xmm9,xmm2
-	vmovdqu	xmm2,XMMWORD32+r11
+	vmovdqu	xmm2,XMMWORD32+r11  ; borrow %xmm2, .Lone_msb
 	vaesenclast	xmm10,xmm10,xmm0
 	vpaddb	xmm0,xmm1,xmm2
 	mov	QWORD((112+8))+rsp,r13
 	lea	rcx,96+rcx
-
-	prefetcht0	512+rcx
+; These two prefetches were added in BoringSSL. See change that added them.
+	prefetcht0	512+rcx  ; We use 96-byte block so prefetch 2 lines (128 bytes)
 	prefetcht0	576+rcx
 	vaesenclast	xmm11,xmm11,xmm5
 	vpaddb	xmm5,xmm0,xmm2
@@ -325,24 +325,24 @@
 	sub	r8,0x6
 	jc	NEAR $L$6x_done
 
-	vmovups	XMMWORD(-96)+rdx,xmm9
+	vmovups	XMMWORD(-96)+rdx,xmm9  ; save output
 	vpxor	xmm9,xmm1,xmm15
 	vmovups	XMMWORD(-80)+rdx,xmm10
-	vmovdqa	xmm10,xmm0
+	vmovdqa	xmm10,xmm0  ; 0 latency
 	vmovups	XMMWORD(-64)+rdx,xmm11
-	vmovdqa	xmm11,xmm5
+	vmovdqa	xmm11,xmm5  ; 0 latency
 	vmovups	XMMWORD(-48)+rdx,xmm12
-	vmovdqa	xmm12,xmm6
+	vmovdqa	xmm12,xmm6  ; 0 latency
 	vmovups	XMMWORD(-32)+rdx,xmm13
-	vmovdqa	xmm13,xmm7
+	vmovdqa	xmm13,xmm7  ; 0 latency
 	vmovups	XMMWORD(-16)+rdx,xmm14
-	vmovdqa	xmm14,xmm3
-	vmovdqu	xmm7,XMMWORD((32+8))+rsp
+	vmovdqa	xmm14,xmm3  ; 0 latency
+	vmovdqu	xmm7,XMMWORD((32+8))+rsp  ; I5
 	jmp	NEAR $L$oop6x
 
 $L$6x_done:
-	vpxor	xmm8,xmm8,XMMWORD((16+8))+rsp
-	vpxor	xmm8,xmm8,xmm4
+	vpxor	xmm8,xmm8,XMMWORD((16+8))+rsp  ; modulo-scheduled
+	vpxor	xmm8,xmm8,xmm4  ; modulo-scheduled
 
 	ret
 
@@ -356,15 +356,15 @@
 _CET_ENDBR
 	xor	rax,rax
 
-
-
-	cmp	r8,0x60
+; We call |_aesni_ctr32_ghash_6x|, which requires at least 96 (0x60)
+; bytes of input.
+	cmp	r8,0x60  ; minimal accepted length
 	jb	NEAR $L$gcm_dec_abort
 
 	push	rbp
 
 $L$SEH_prologue_aesni_gcm_decrypt_2:
-	mov	rbp,rsp
+	mov	rbp,rsp  ; save stack pointer
 
 	push	rbx
 
@@ -381,19 +381,19 @@
 	push	r15
 
 $L$SEH_prologue_aesni_gcm_decrypt_7:
-	lea	rsp,((-168))+rsp
+	lea	rsp,((-168))+rsp  ; 8 extra bytes to align the stack
 $L$SEH_prologue_aesni_gcm_decrypt_8:
 $L$SEH_prologue_aesni_gcm_decrypt_9:
-
-
-
+; Load the last two parameters. These go into %rdi and %rsi, which are
+; non-volatile on Windows, so stash them in the parameter stack area
+; first.
 	mov	QWORD16+rbp,rdi
 $L$SEH_prologue_aesni_gcm_decrypt_10:
 	mov	QWORD24+rbp,rsi
 $L$SEH_prologue_aesni_gcm_decrypt_11:
 	mov	rdi,QWORD48+rbp
 	mov	rsi,QWORD56+rbp
-
+; Save non-volatile XMM registers.
 	movaps	XMMWORD(-208)+rbp,xmm6
 $L$SEH_prologue_aesni_gcm_decrypt_12:
 	movaps	XMMWORD(-192)+rbp,xmm7
@@ -418,17 +418,17 @@
 	vzeroupper
 
 	mov	r12,QWORD64+rbp
-	vmovdqu	xmm1,XMMWORDrdi
+	vmovdqu	xmm1,XMMWORDrdi  ; input counter value
 	add	rsp,-128
 	mov	ebx,DWORD12+rdi
 	lea	r11,$L$bswap_mask
-	lea	r14,((-128))+r9
-	mov	r15,0xf80
-	vmovdqu	xmm8,XMMWORDr12
-	and	rsp,-128
-	vmovdqu	xmm0,XMMWORDr11
-	lea	r9,128+r9
-	lea	rsi,32+rsi
+	lea	r14,((-128))+r9  ; borrow %r14
+	mov	r15,0xf80  ; borrow %r15
+	vmovdqu	xmm8,XMMWORDr12  ; load Xi
+	and	rsp,-128  ; ensure stack alignment
+	vmovdqu	xmm0,XMMWORDr11  ; borrow %xmm0 for .Lbswap_mask
+	lea	r9,128+r9  ; size optimization
+	lea	rsi,32+rsi  ; size optimization
 	mov	r10d,DWORD((240-128))+r9
 	vpshufb	xmm8,xmm8,xmm0
 
@@ -438,26 +438,26 @@
 	jc	NEAR $L$dec_no_key_aliasing
 	cmp	r15,768
 	jnc	NEAR $L$dec_no_key_aliasing
-	sub	rsp,r15
+	sub	rsp,r15  ; avoid aliasing with key
 $L$dec_no_key_aliasing:
 
-	vmovdqu	xmm7,XMMWORD80+rcx
+	vmovdqu	xmm7,XMMWORD80+rcx  ; I5
 	mov	r14,rcx
 	vmovdqu	xmm4,XMMWORD64+rcx
 
-
-
-
-
-
-
+; |_aesni_ctr32_ghash_6x| requires |%r15| to point to 2*96 (0xc0)
+; bytes before the end of the input. Note, in particular, that this is
+; correct even if |%r8| is not an even multiple of 96 or 16. XXX: This
+; seems to require that |%rcx| + |%r8| >= 2*96 (0xc0); i.e. |%rcx| must
+; not be near the very beginning of the address space when |%r8| < 2*96
+; (0xc0).
 	lea	r15,((-192))+r8*1+rcx
 
 	vmovdqu	xmm5,XMMWORD48+rcx
 	shr	r8,4
 	xor	rax,rax
 	vmovdqu	xmm6,XMMWORD32+rcx
-	vpshufb	xmm7,xmm7,xmm0
+	vpshufb	xmm7,xmm7,xmm0  ; passed to _aesni_ctr32_ghash_6x
 	vmovdqu	xmm2,XMMWORD16+rcx
 	vpshufb	xmm4,xmm4,xmm0
 	vmovdqu	xmm3,XMMWORDrcx
@@ -474,15 +474,15 @@
 	call	_aesni_ctr32_ghash_6x
 
 	mov	r12,QWORD64+rbp
-	vmovups	XMMWORD(-96)+rdx,xmm9
+	vmovups	XMMWORD(-96)+rdx,xmm9  ; save output
 	vmovups	XMMWORD(-80)+rdx,xmm10
 	vmovups	XMMWORD(-64)+rdx,xmm11
 	vmovups	XMMWORD(-48)+rdx,xmm12
 	vmovups	XMMWORD(-32)+rdx,xmm13
 	vmovups	XMMWORD(-16)+rdx,xmm14
 
-	vpshufb	xmm8,xmm8,XMMWORDr11
-	vmovdqu	XMMWORDr12,xmm8
+	vpshufb	xmm8,xmm8,XMMWORDr11  ; .Lbswap_mask
+	vmovdqu	XMMWORDr12,xmm8  ; output Xi
 
 	vzeroupper
 	movaps	xmm6,XMMWORD((-208))+rbp
@@ -497,7 +497,7 @@
 	movaps	xmm15,XMMWORD((-64))+rbp
 	mov	rdi,QWORD16+rbp
 	mov	rsi,QWORD24+rbp
-	lea	rsp,((-40))+rbp
+	lea	rsp,((-40))+rbp  ; restore %rsp to fixed allocation
 
 	pop	r15
 
@@ -520,8 +520,8 @@
 ALIGN	32
 _aesni_ctr32_6x:
 
-	vmovdqu	xmm4,XMMWORD((0-128))+r9
-	vmovdqu	xmm2,XMMWORD32+r11
+	vmovdqu	xmm4,XMMWORD((0-128))+r9  ; borrow %xmm4 for %xmm15
+	vmovdqu	xmm2,XMMWORD32+r11  ; borrow %xmm2, .Lone_msb
 	lea	r13,((-1))+r10
 	vmovups	xmm15,XMMWORD((16-128))+r9
 	lea	r12,((32-128))+r9
@@ -554,7 +554,7 @@
 	dec	r13d
 	jnz	NEAR $L$oop_ctr32
 
-	vmovdqu	xmm3,XMMWORDr12
+	vmovdqu	xmm3,XMMWORDr12  ; last round key
 	vaesenc	xmm9,xmm9,xmm15
 	vpxor	xmm4,xmm3,XMMWORDrcx
 	vaesenc	xmm10,xmm10,xmm15
@@ -586,9 +586,9 @@
 	ret
 ALIGN	32
 $L$handle_ctr32_2:
-	vpshufb	xmm6,xmm1,xmm0
-	vmovdqu	xmm5,XMMWORD48+r11
-	vpaddd	xmm10,xmm6,XMMWORD64+r11
+	vpshufb	xmm6,xmm1,xmm0  ; byte-swap counter
+	vmovdqu	xmm5,XMMWORD48+r11  ; borrow %xmm5, .Ltwo_lsb
+	vpaddd	xmm10,xmm6,XMMWORD64+r11  ; .Lone_lsb
 	vpaddd	xmm11,xmm6,xmm5
 	vpaddd	xmm12,xmm10,xmm5
 	vpshufb	xmm10,xmm10,xmm0
@@ -598,12 +598,12 @@
 	vpaddd	xmm14,xmm12,xmm5
 	vpshufb	xmm12,xmm12,xmm0
 	vpxor	xmm11,xmm11,xmm4
-	vpaddd	xmm1,xmm13,xmm5
+	vpaddd	xmm1,xmm13,xmm5  ; byte-swapped next counter value
 	vpshufb	xmm13,xmm13,xmm0
 	vpxor	xmm12,xmm12,xmm4
 	vpshufb	xmm14,xmm14,xmm0
 	vpxor	xmm13,xmm13,xmm4
-	vpshufb	xmm1,xmm1,xmm0
+	vpshufb	xmm1,xmm1,xmm0  ; next counter value
 	vpxor	xmm14,xmm14,xmm4
 	jmp	NEAR $L$oop_ctr32
 
@@ -622,16 +622,16 @@
 %endif
 	xor	rax,rax
 
-
-
-
-	cmp	r8,0x60*3
+; We call |_aesni_ctr32_6x| twice, each call consuming 96 bytes of
+; input. Then we call |_aesni_ctr32_ghash_6x|, which requires at
+; least 96 more bytes of input.
+	cmp	r8,0x60*3  ; minimal accepted length
 	jb	NEAR $L$gcm_enc_abort
 
 	push	rbp
 
 $L$SEH_prologue_aesni_gcm_encrypt_2:
-	mov	rbp,rsp
+	mov	rbp,rsp  ; save stack pointer
 
 	push	rbx
 
@@ -648,19 +648,19 @@
 	push	r15
 
 $L$SEH_prologue_aesni_gcm_encrypt_7:
-	lea	rsp,((-168))+rsp
+	lea	rsp,((-168))+rsp  ; 8 extra bytes to align the stack
 $L$SEH_prologue_aesni_gcm_encrypt_8:
 $L$SEH_prologue_aesni_gcm_encrypt_9:
-
-
-
+; Load the last two parameters. These go into %rdi and %rsi, which are
+; non-volatile on Windows, so stash them in the parameter stack area
+; first.
 	mov	QWORD16+rbp,rdi
 $L$SEH_prologue_aesni_gcm_encrypt_10:
 	mov	QWORD24+rbp,rsi
 $L$SEH_prologue_aesni_gcm_encrypt_11:
 	mov	rdi,QWORD48+rbp
 	mov	rsi,QWORD56+rbp
-
+; Save non-volatile XMM registers.
 	movaps	XMMWORD(-208)+rbp,xmm6
 $L$SEH_prologue_aesni_gcm_encrypt_12:
 	movaps	XMMWORD(-192)+rbp,xmm7
@@ -684,15 +684,15 @@
 $L$SEH_endprologue_aesni_gcm_encrypt_22:
 	vzeroupper
 
-	vmovdqu	xmm1,XMMWORDrdi
+	vmovdqu	xmm1,XMMWORDrdi  ; input counter value
 	add	rsp,-128
 	mov	ebx,DWORD12+rdi
 	lea	r11,$L$bswap_mask
-	lea	r14,((-128))+r9
-	mov	r15,0xf80
-	lea	r9,128+r9
-	vmovdqu	xmm0,XMMWORDr11
-	and	rsp,-128
+	lea	r14,((-128))+r9  ; borrow %r14
+	mov	r15,0xf80  ; borrow %r15
+	lea	r9,128+r9  ; size optimization
+	vmovdqu	xmm0,XMMWORDr11  ; borrow %xmm0 for .Lbswap_mask
+	and	rsp,-128  ; ensure stack alignment
 	mov	r10d,DWORD((240-128))+r9
 
 	and	r14,r15
@@ -701,24 +701,24 @@
 	jc	NEAR $L$enc_no_key_aliasing
 	cmp	r15,768
 	jnc	NEAR $L$enc_no_key_aliasing
-	sub	rsp,r15
+	sub	rsp,r15  ; avoid aliasing with key
 $L$enc_no_key_aliasing:
 
 	mov	r14,rdx
 
-
-
-
-
-
-
-
+; |_aesni_ctr32_ghash_6x| requires |%r15| to point to 2*96 (0xc0)
+; bytes before the end of the input. Note, in particular, that this is
+; correct even if |%r8| is not an even multiple of 96 or 16. Unlike in
+; the decryption case, there's no caveat that |%rdx| must not be near
+; the very beginning of the address space, because we know that
+; |%r8| >= 3*96 from the check above, and so we know
+; |%rdx| + |%r8| >= 2*96 (0xc0).
 	lea	r15,((-192))+r8*1+rdx
 
 	shr	r8,4
 
 	call	_aesni_ctr32_6x
-	vpshufb	xmm8,xmm9,xmm0
+	vpshufb	xmm8,xmm9,xmm0  ; save bswapped output on stack
 	vpshufb	xmm2,xmm10,xmm0
 	vmovdqu	XMMWORD112+rsp,xmm8
 	vpshufb	xmm4,xmm11,xmm0
@@ -727,26 +727,26 @@
 	vmovdqu	XMMWORD80+rsp,xmm4
 	vpshufb	xmm6,xmm13,xmm0
 	vmovdqu	XMMWORD64+rsp,xmm5
-	vpshufb	xmm7,xmm14,xmm0
+	vpshufb	xmm7,xmm14,xmm0  ; passed to _aesni_ctr32_ghash_6x
 	vmovdqu	XMMWORD48+rsp,xmm6
 
 	call	_aesni_ctr32_6x
 
 	mov	r12,QWORD64+rbp
-	lea	rsi,32+rsi
-	vmovdqu	xmm8,XMMWORDr12
+	lea	rsi,32+rsi  ; size optimization
+	vmovdqu	xmm8,XMMWORDr12  ; load Xi
 	sub	r8,12
 	mov	rax,0x60*2
 	vpshufb	xmm8,xmm8,xmm0
 
 	call	_aesni_ctr32_ghash_6x
-	vmovdqu	xmm7,XMMWORD32+rsp
-	vmovdqu	xmm0,XMMWORDr11
-	vmovdqu	xmm3,XMMWORD((0-32))+rsi
+	vmovdqu	xmm7,XMMWORD32+rsp  ; I5
+	vmovdqu	xmm0,XMMWORDr11  ; borrow %xmm0 for .Lbswap_mask
+	vmovdqu	xmm3,XMMWORD((0-32))+rsi  ; %xmm3^1
 	vpunpckhqdq	xmm1,xmm7,xmm7
-	vmovdqu	xmm15,XMMWORD((32-32))+rsi
-	vmovups	XMMWORD(-96)+rdx,xmm9
-	vpshufb	xmm9,xmm9,xmm0
+	vmovdqu	xmm15,XMMWORD((32-32))+rsi  ; borrow %xmm15 for
+	vmovups	XMMWORD(-96)+rdx,xmm9  ; save output
+	vpshufb	xmm9,xmm9,xmm0  ; but keep bswapped copy
 	vpxor	xmm1,xmm1,xmm7
 	vmovups	XMMWORD(-80)+rdx,xmm10
 	vpshufb	xmm10,xmm10,xmm0
@@ -758,18 +758,18 @@
 	vpshufb	xmm13,xmm13,xmm0
 	vmovups	XMMWORD(-16)+rdx,xmm14
 	vpshufb	xmm14,xmm14,xmm0
-	vmovdqu	XMMWORD16+rsp,xmm9
-	vmovdqu	xmm6,XMMWORD48+rsp
-	vmovdqu	xmm0,XMMWORD((16-32))+rsi
+	vmovdqu	XMMWORD16+rsp,xmm9  ; free %xmm9
+	vmovdqu	xmm6,XMMWORD48+rsp  ; I4
+	vmovdqu	xmm0,XMMWORD((16-32))+rsi  ; borrow %xmm0 for %xmm3^2
 	vpunpckhqdq	xmm2,xmm6,xmm6
 	vpclmulqdq	xmm5,xmm7,xmm3,0x00
 	vpxor	xmm2,xmm2,xmm6
 	vpclmulqdq	xmm7,xmm7,xmm3,0x11
 	vpclmulqdq	xmm1,xmm1,xmm15,0x00
 
-	vmovdqu	xmm9,XMMWORD64+rsp
+	vmovdqu	xmm9,XMMWORD64+rsp  ; I3
 	vpclmulqdq	xmm4,xmm6,xmm0,0x00
-	vmovdqu	xmm3,XMMWORD((48-32))+rsi
+	vmovdqu	xmm3,XMMWORD((48-32))+rsi  ; %xmm3^3
 	vpxor	xmm4,xmm4,xmm5
 	vpunpckhqdq	xmm5,xmm9,xmm9
 	vpclmulqdq	xmm6,xmm6,xmm0,0x11
@@ -779,9 +779,9 @@
 	vmovdqu	xmm15,XMMWORD((80-32))+rsi
 	vpxor	xmm2,xmm2,xmm1
 
-	vmovdqu	xmm1,XMMWORD80+rsp
+	vmovdqu	xmm1,XMMWORD80+rsp  ; I2
 	vpclmulqdq	xmm7,xmm9,xmm3,0x00
-	vmovdqu	xmm0,XMMWORD((64-32))+rsi
+	vmovdqu	xmm0,XMMWORD((64-32))+rsi  ; borrow %xmm0 for %xmm3^4
 	vpxor	xmm7,xmm7,xmm4
 	vpunpckhqdq	xmm4,xmm1,xmm1
 	vpclmulqdq	xmm9,xmm9,xmm3,0x11
@@ -790,9 +790,9 @@
 	vpclmulqdq	xmm5,xmm5,xmm15,0x00
 	vpxor	xmm5,xmm5,xmm2
 
-	vmovdqu	xmm2,XMMWORD96+rsp
+	vmovdqu	xmm2,XMMWORD96+rsp  ; I1
 	vpclmulqdq	xmm6,xmm1,xmm0,0x00
-	vmovdqu	xmm3,XMMWORD((96-32))+rsi
+	vmovdqu	xmm3,XMMWORD((96-32))+rsi  ; %xmm3^5
 	vpxor	xmm6,xmm6,xmm7
 	vpunpckhqdq	xmm7,xmm2,xmm2
 	vpclmulqdq	xmm1,xmm1,xmm0,0x11
@@ -802,9 +802,9 @@
 	vmovdqu	xmm15,XMMWORD((128-32))+rsi
 	vpxor	xmm4,xmm4,xmm5
 
-	vpxor	xmm8,xmm8,XMMWORD112+rsp
+	vpxor	xmm8,xmm8,XMMWORD112+rsp  ; accumulate I0
 	vpclmulqdq	xmm5,xmm2,xmm3,0x00
-	vmovdqu	xmm0,XMMWORD((112-32))+rsi
+	vmovdqu	xmm0,XMMWORD((112-32))+rsi  ; borrow %xmm0 for %xmm3^6
 	vpunpckhqdq	xmm9,xmm8,xmm8
 	vpxor	xmm5,xmm5,xmm6
 	vpclmulqdq	xmm2,xmm2,xmm3,0x11
@@ -814,7 +814,7 @@
 	vpxor	xmm4,xmm7,xmm4
 
 	vpclmulqdq	xmm6,xmm8,xmm0,0x00
-	vmovdqu	xmm3,XMMWORD((0-32))+rsi
+	vmovdqu	xmm3,XMMWORD((0-32))+rsi  ; %xmm3^1
 	vpunpckhqdq	xmm1,xmm14,xmm14
 	vpclmulqdq	xmm8,xmm8,xmm0,0x11
 	vpxor	xmm1,xmm1,xmm14
@@ -824,8 +824,8 @@
 	vpxor	xmm7,xmm8,xmm2
 	vpxor	xmm6,xmm9,xmm4
 
-	vmovdqu	xmm0,XMMWORD((16-32))+rsi
-	vpxor	xmm9,xmm7,xmm5
+	vmovdqu	xmm0,XMMWORD((16-32))+rsi  ; borrow %xmm0 for %xmm3^2
+	vpxor	xmm9,xmm7,xmm5  ; aggregated Karatsuba post-processing
 	vpclmulqdq	xmm4,xmm14,xmm3,0x00
 	vpxor	xmm6,xmm6,xmm9
 	vpunpckhqdq	xmm2,xmm13,xmm13
@@ -838,25 +838,25 @@
 	vpxor	xmm7,xmm7,xmm6
 
 	vpclmulqdq	xmm5,xmm13,xmm0,0x00
-	vmovdqu	xmm3,XMMWORD((48-32))+rsi
+	vmovdqu	xmm3,XMMWORD((48-32))+rsi  ; %xmm3^3
 	vpxor	xmm5,xmm5,xmm4
 	vpunpckhqdq	xmm9,xmm12,xmm12
 	vpclmulqdq	xmm13,xmm13,xmm0,0x11
 	vpxor	xmm9,xmm9,xmm12
 	vpxor	xmm13,xmm13,xmm14
-	vpalignr	xmm14,xmm8,xmm8,8
+	vpalignr	xmm14,xmm8,xmm8,8  ; 1st phase
 	vpclmulqdq	xmm2,xmm2,xmm15,0x10
 	vmovdqu	xmm15,XMMWORD((80-32))+rsi
 	vpxor	xmm2,xmm2,xmm1
 
 	vpclmulqdq	xmm4,xmm12,xmm3,0x00
-	vmovdqu	xmm0,XMMWORD((64-32))+rsi
+	vmovdqu	xmm0,XMMWORD((64-32))+rsi  ; borrow %xmm0 for %xmm3^4
 	vpxor	xmm4,xmm4,xmm5
 	vpunpckhqdq	xmm1,xmm11,xmm11
 	vpclmulqdq	xmm12,xmm12,xmm3,0x11
 	vpxor	xmm1,xmm1,xmm11
 	vpxor	xmm12,xmm12,xmm13
-	vxorps	xmm7,xmm7,XMMWORD16+rsp
+	vxorps	xmm7,xmm7,XMMWORD16+rsp  ; accumulate %xmm9
 	vpclmulqdq	xmm9,xmm9,xmm15,0x00
 	vpxor	xmm9,xmm9,xmm2
 
@@ -864,12 +864,12 @@
 	vxorps	xmm8,xmm8,xmm14
 
 	vpclmulqdq	xmm5,xmm11,xmm0,0x00
-	vmovdqu	xmm3,XMMWORD((96-32))+rsi
+	vmovdqu	xmm3,XMMWORD((96-32))+rsi  ; %xmm3^5
 	vpxor	xmm5,xmm5,xmm4
 	vpunpckhqdq	xmm2,xmm10,xmm10
 	vpclmulqdq	xmm11,xmm11,xmm0,0x11
 	vpxor	xmm2,xmm2,xmm10
-	vpalignr	xmm14,xmm8,xmm8,8
+	vpalignr	xmm14,xmm8,xmm8,8  ; 2nd phase
 	vpxor	xmm11,xmm11,xmm12
 	vpclmulqdq	xmm1,xmm1,xmm15,0x10
 	vmovdqu	xmm15,XMMWORD((128-32))+rsi
@@ -880,7 +880,7 @@
 	vxorps	xmm8,xmm8,xmm14
 
 	vpclmulqdq	xmm4,xmm10,xmm3,0x00
-	vmovdqu	xmm0,XMMWORD((112-32))+rsi
+	vmovdqu	xmm0,XMMWORD((112-32))+rsi  ; borrow %xmm0 for %xmm3^6
 	vpxor	xmm4,xmm4,xmm5
 	vpunpckhqdq	xmm9,xmm8,xmm8
 	vpclmulqdq	xmm10,xmm10,xmm3,0x11
@@ -896,25 +896,25 @@
 	vpxor	xmm7,xmm7,xmm10
 	vpxor	xmm6,xmm6,xmm2
 
-	vpxor	xmm4,xmm7,xmm5
+	vpxor	xmm4,xmm7,xmm5  ; aggregated Karatsuba post-processing
 	vpxor	xmm6,xmm6,xmm4
 	vpslldq	xmm1,xmm6,8
-	vmovdqu	xmm3,XMMWORD16+r11
+	vmovdqu	xmm3,XMMWORD16+r11  ; .Lpoly
 	vpsrldq	xmm6,xmm6,8
 	vpxor	xmm8,xmm5,xmm1
 	vpxor	xmm7,xmm7,xmm6
 
-	vpalignr	xmm2,xmm8,xmm8,8
+	vpalignr	xmm2,xmm8,xmm8,8  ; 1st phase
 	vpclmulqdq	xmm8,xmm8,xmm3,0x10
 	vpxor	xmm8,xmm8,xmm2
 
-	vpalignr	xmm2,xmm8,xmm8,8
+	vpalignr	xmm2,xmm8,xmm8,8  ; 2nd phase
 	vpclmulqdq	xmm8,xmm8,xmm3,0x10
 	vpxor	xmm2,xmm2,xmm7
 	vpxor	xmm8,xmm8,xmm2
 	mov	r12,QWORD64+rbp
-	vpshufb	xmm8,xmm8,XMMWORDr11
-	vmovdqu	XMMWORDr12,xmm8
+	vpshufb	xmm8,xmm8,XMMWORDr11  ; .Lbswap_mask
+	vmovdqu	XMMWORDr12,xmm8  ; output Xi
 
 	vzeroupper
 	movaps	xmm6,XMMWORD((-208))+rbp
@@ -929,7 +929,7 @@
 	movaps	xmm15,XMMWORD((-64))+rbp
 	mov	rdi,QWORD16+rbp
 	mov	rsi,QWORD24+rbp
-	lea	rsp,((-40))+rbp
+	lea	rsp,((-40))+rbp  ; restore %rsp to fixed allocation
 
 	pop	r15
 
@@ -967,7 +967,7 @@
 	DB	89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112
 	DB	114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 ALIGN	64
-section	.text
+section	.text code align=64
 
 section	.pdata rdata align=4
 ALIGN	4
@@ -983,7 +983,7 @@
 section	.xdata rdata align=8
 ALIGN	4
 $L$SEH_info_aesni_gcm_decrypt_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_aesni_gcm_decrypt_22-$L$SEH_begin_aesni_gcm_decrypt_1
 	DB	33
 	DB	213
@@ -1043,7 +1043,7 @@
 
 	DW	0
 $L$SEH_info_aesni_gcm_encrypt_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_aesni_gcm_encrypt_22-$L$SEH_begin_aesni_gcm_encrypt_1
 	DB	33
 	DB	213

boringssl-0.20260708.tar.xz/gen/bcm/aesni-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/aesni-x86_64-apple.S Changed

@@ -16,8 +16,8 @@
 
 	movb	$1,_BORINGSSL_function_hit+1(%rip)
 #endif
-	movups	(%rdi),%xmm2
-	movl	240(%rdx),%eax
+	movups	(%rdi),%xmm2  // load input
+	movl	240(%rdx),%eax  // key->rounds
 	movups	(%rdx),%xmm0
 	movups	16(%rdx),%xmm1
 	leaq	32(%rdx),%rdx
@@ -27,11 +27,11 @@
 	decl	%eax
 	movups	(%rdx),%xmm1
 	leaq	16(%rdx),%rdx
-	jnz	L$oop_enc1_1
+	jnz	L$oop_enc1_1  // loop body is 16 bytes
 	aesenclast	%xmm1,%xmm2
-	pxor	%xmm0,%xmm0
+	pxor	%xmm0,%xmm0  // clear register bank
 	pxor	%xmm1,%xmm1
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // output
 	pxor	%xmm2,%xmm2
 	ret
 
@@ -45,8 +45,8 @@
 _aes_hw_decrypt:
 
 _CET_ENDBR
-	movups	(%rdi),%xmm2
-	movl	240(%rdx),%eax
+	movups	(%rdi),%xmm2  // load input
+	movl	240(%rdx),%eax  // key->rounds
 	movups	(%rdx),%xmm0
 	movups	16(%rdx),%xmm1
 	leaq	32(%rdx),%rdx
@@ -56,11 +56,11 @@
 	decl	%eax
 	movups	(%rdx),%xmm1
 	leaq	16(%rdx),%rdx
-	jnz	L$oop_dec1_2
+	jnz	L$oop_dec1_2  // loop body is 16 bytes
 	aesdeclast	%xmm1,%xmm2
-	pxor	%xmm0,%xmm0
+	pxor	%xmm0,%xmm0  // clear register bank
 	pxor	%xmm1,%xmm1
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // output
 	pxor	%xmm2,%xmm2
 	ret
 
@@ -77,7 +77,7 @@
 	xorps	%xmm0,%xmm3
 	movups	32(%rcx),%xmm0
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	addq	$16,%rax
 
 L$enc_loop2:
@@ -109,7 +109,7 @@
 	xorps	%xmm0,%xmm3
 	movups	32(%rcx),%xmm0
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	addq	$16,%rax
 
 L$dec_loop2:
@@ -142,7 +142,7 @@
 	xorps	%xmm0,%xmm4
 	movups	32(%rcx),%xmm0
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	addq	$16,%rax
 
 L$enc_loop3:
@@ -179,7 +179,7 @@
 	xorps	%xmm0,%xmm4
 	movups	32(%rcx),%xmm0
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	addq	$16,%rax
 
 L$dec_loop3:
@@ -217,7 +217,7 @@
 	xorps	%xmm0,%xmm5
 	movups	32(%rcx),%xmm0
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 .byte	0x0f,0x1f,0x00
 	addq	$16,%rax
 
@@ -260,7 +260,7 @@
 	xorps	%xmm0,%xmm5
 	movups	32(%rcx),%xmm0
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 .byte	0x0f,0x1f,0x00
 	addq	$16,%rax
 
@@ -302,7 +302,7 @@
 	pxor	%xmm0,%xmm4
 	aesenc	%xmm1,%xmm2
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	aesenc	%xmm1,%xmm3
 	pxor	%xmm0,%xmm5
 	pxor	%xmm0,%xmm6
@@ -359,7 +359,7 @@
 	pxor	%xmm0,%xmm4
 	aesdec	%xmm1,%xmm2
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	aesdec	%xmm1,%xmm3
 	pxor	%xmm0,%xmm5
 	pxor	%xmm0,%xmm6
@@ -417,7 +417,7 @@
 	pxor	%xmm0,%xmm5
 	pxor	%xmm0,%xmm6
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	aesenc	%xmm1,%xmm2
 	pxor	%xmm0,%xmm7
 	pxor	%xmm0,%xmm8
@@ -484,7 +484,7 @@
 	pxor	%xmm0,%xmm5
 	pxor	%xmm0,%xmm6
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	aesdec	%xmm1,%xmm2
 	pxor	%xmm0,%xmm7
 	pxor	%xmm0,%xmm8
@@ -545,20 +545,20 @@
 _aes_hw_ecb_encrypt:
 
 _CET_ENDBR
-	andq	$-16,%rdx
-	jz	L$ecb_ret
+	andq	$-16,%rdx  // if (%rdx<16)
+	jz	L$ecb_ret  // return
 
-	movl	240(%rcx),%eax
+	movl	240(%rcx),%eax  // key->rounds
 	movups	(%rcx),%xmm0
-	movq	%rcx,%r11
-	movl	%eax,%r10d
-	testl	%r8d,%r8d
+	movq	%rcx,%r11  // backup %rcx
+	movl	%eax,%r10d  // backup %eax
+	testl	%r8d,%r8d  // 5th argument
 	jz	L$ecb_decrypt
+//  --------------------------- ECB ENCRYPT ------------------------------
+	cmpq	$0x80,%rdx  // if (%rdx<8*16)
+	jb	L$ecb_enc_tail  // short input
 
-	cmpq	$0x80,%rdx
-	jb	L$ecb_enc_tail
-
-	movdqu	(%rdi),%xmm2
+	movdqu	(%rdi),%xmm2  // load 8 input blocks
 	movdqu	16(%rdi),%xmm3
 	movdqu	32(%rdi),%xmm4
 	movdqu	48(%rdi),%xmm5
@@ -566,15 +566,15 @@
 	movdqu	80(%rdi),%xmm7
 	movdqu	96(%rdi),%xmm8
 	movdqu	112(%rdi),%xmm9
-	leaq	128(%rdi),%rdi
-	subq	$0x80,%rdx
+	leaq	128(%rdi),%rdi  // %rdi+=8*16
+	subq	$0x80,%rdx  // %rdx-=8*16 (can be zero)
 	jmp	L$ecb_enc_loop8_enter
 .p2align	4
 L$ecb_enc_loop8:
-	movups	%xmm2,(%rsi)
-	movq	%r11,%rcx
-	movdqu	(%rdi),%xmm2
-	movl	%r10d,%eax
+	movups	%xmm2,(%rsi)  // store 8 output blocks
+	movq	%r11,%rcx  // restore %rcx
+	movdqu	(%rdi),%xmm2  // load 8 input blocks
+	movl	%r10d,%eax  // restore %eax
 	movups	%xmm3,16(%rsi)
 	movdqu	16(%rdi),%xmm3
 	movups	%xmm4,32(%rsi)
@@ -588,31 +588,31 @@
 	movups	%xmm8,96(%rsi)
 	movdqu	96(%rdi),%xmm8
 	movups	%xmm9,112(%rsi)
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // %rsi+=8*16
 	movdqu	112(%rdi),%xmm9
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // %rdi+=8*16
 L$ecb_enc_loop8_enter:
 
 	call	_aesni_encrypt8
 
 	subq	$0x80,%rdx
-	jnc	L$ecb_enc_loop8
+	jnc	L$ecb_enc_loop8  // loop if %rdx-=8*16 didn't borrow
 
-	movups	%xmm2,(%rsi)
-	movq	%r11,%rcx
+	movups	%xmm2,(%rsi)  // store 8 output blocks
+	movq	%r11,%rcx  // restore %rcx
 	movups	%xmm3,16(%rsi)
-	movl	%r10d,%eax
+	movl	%r10d,%eax  // restore %eax
 	movups	%xmm4,32(%rsi)
 	movups	%xmm5,48(%rsi)
 	movups	%xmm6,64(%rsi)
 	movups	%xmm7,80(%rsi)
 	movups	%xmm8,96(%rsi)
 	movups	%xmm9,112(%rsi)
-	leaq	128(%rsi),%rsi
-	addq	$0x80,%rdx
-	jz	L$ecb_ret
+	leaq	128(%rsi),%rsi  // %rsi+=8*16
+	addq	$0x80,%rdx  // restore real remaining %rdx
+	jz	L$ecb_ret  // done if (%rdx==0)
 
-L$ecb_enc_tail:
+L$ecb_enc_tail:  // %rdx is less than 8*16
 	movups	(%rdi),%xmm2
 	cmpq	$0x20,%rdx
 	jb	L$ecb_enc_one
@@ -631,7 +631,7 @@
 	movdqu	96(%rdi),%xmm8
 	xorps	%xmm9,%xmm9
 	call	_aesni_encrypt8
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 7 output blocks
 	movups	%xmm3,16(%rsi)
 	movups	%xmm4,32(%rsi)
 	movups	%xmm5,48(%rsi)
@@ -650,27 +650,27 @@
 	decl	%eax
 	movups	(%rcx),%xmm1
 	leaq	16(%rcx),%rcx
-	jnz	L$oop_enc1_3
+	jnz	L$oop_enc1_3  // loop body is 16 bytes
 	aesenclast	%xmm1,%xmm2
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store one output block
 	jmp	L$ecb_ret
 .p2align	4
 L$ecb_enc_two:
 	call	_aesni_encrypt2
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 2 output blocks
 	movups	%xmm3,16(%rsi)
 	jmp	L$ecb_ret
 .p2align	4
 L$ecb_enc_three:
 	call	_aesni_encrypt3
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 3 output blocks
 	movups	%xmm3,16(%rsi)
 	movups	%xmm4,32(%rsi)
 	jmp	L$ecb_ret
 .p2align	4
 L$ecb_enc_four:
 	call	_aesni_encrypt4
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 4 output blocks
 	movups	%xmm3,16(%rsi)
 	movups	%xmm4,32(%rsi)
 	movups	%xmm5,48(%rsi)
@@ -679,7 +679,7 @@
 L$ecb_enc_five:
 	xorps	%xmm7,%xmm7
 	call	_aesni_encrypt6
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 5 output blocks
 	movups	%xmm3,16(%rsi)
 	movups	%xmm4,32(%rsi)
 	movups	%xmm5,48(%rsi)
@@ -688,20 +688,20 @@
 .p2align	4
 L$ecb_enc_six:
 	call	_aesni_encrypt6
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 6 output blocks
 	movups	%xmm3,16(%rsi)
 	movups	%xmm4,32(%rsi)
 	movups	%xmm5,48(%rsi)
 	movups	%xmm6,64(%rsi)
 	movups	%xmm7,80(%rsi)
 	jmp	L$ecb_ret
-
+// --------------------------- ECB DECRYPT ------------------------------#
 .p2align	4
 L$ecb_decrypt:
-	cmpq	$0x80,%rdx
-	jb	L$ecb_dec_tail
+	cmpq	$0x80,%rdx  // if (%rdx<8*16)
+	jb	L$ecb_dec_tail  // short input
 
-	movdqu	(%rdi),%xmm2
+	movdqu	(%rdi),%xmm2  // load 8 input blocks
 	movdqu	16(%rdi),%xmm3
 	movdqu	32(%rdi),%xmm4
 	movdqu	48(%rdi),%xmm5
@@ -709,15 +709,15 @@
 	movdqu	80(%rdi),%xmm7
 	movdqu	96(%rdi),%xmm8
 	movdqu	112(%rdi),%xmm9
-	leaq	128(%rdi),%rdi
-	subq	$0x80,%rdx
+	leaq	128(%rdi),%rdi  // %rdi+=8*16
+	subq	$0x80,%rdx  // %rdx-=8*16 (can be zero)
 	jmp	L$ecb_dec_loop8_enter
 .p2align	4
 L$ecb_dec_loop8:
-	movups	%xmm2,(%rsi)
-	movq	%r11,%rcx
-	movdqu	(%rdi),%xmm2
-	movl	%r10d,%eax
+	movups	%xmm2,(%rsi)  // store 8 output blocks
+	movq	%r11,%rcx  // restore %rcx
+	movdqu	(%rdi),%xmm2  // load 8 input blocks
+	movl	%r10d,%eax  // restore %eax
 	movups	%xmm3,16(%rsi)
 	movdqu	16(%rdi),%xmm3
 	movups	%xmm4,32(%rsi)
@@ -731,23 +731,23 @@
 	movups	%xmm8,96(%rsi)
 	movdqu	96(%rdi),%xmm8
 	movups	%xmm9,112(%rsi)
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // %rsi+=8*16
 	movdqu	112(%rdi),%xmm9
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // %rdi+=8*16
 L$ecb_dec_loop8_enter:
 
 	call	_aesni_decrypt8
 
 	movups	(%r11),%xmm0
 	subq	$0x80,%rdx
-	jnc	L$ecb_dec_loop8
+	jnc	L$ecb_dec_loop8  // loop if %rdx-=8*16 didn't borrow
 
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
-	movq	%r11,%rcx
+	movups	%xmm2,(%rsi)  // store 8 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
+	movq	%r11,%rcx  // restore %rcx
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
-	movl	%r10d,%eax
+	movl	%r10d,%eax  // restore %eax
 	movups	%xmm4,32(%rsi)
 	pxor	%xmm4,%xmm4
 	movups	%xmm5,48(%rsi)
@@ -760,9 +760,9 @@
 	pxor	%xmm8,%xmm8
 	movups	%xmm9,112(%rsi)
 	pxor	%xmm9,%xmm9
-	leaq	128(%rsi),%rsi
-	addq	$0x80,%rdx
-	jz	L$ecb_ret
+	leaq	128(%rsi),%rsi  // %rsi+=8*16
+	addq	$0x80,%rdx  // restore real remaining %rdx
+	jz	L$ecb_ret  // done if (%rdx==0)
 
 L$ecb_dec_tail:
 	movups	(%rdi),%xmm2
@@ -784,8 +784,8 @@
 	movups	(%rcx),%xmm0
 	xorps	%xmm9,%xmm9
 	call	_aesni_decrypt8
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store 7 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
 	movups	%xmm4,32(%rsi)
@@ -811,24 +811,24 @@
 	decl	%eax
 	movups	(%rcx),%xmm1
 	leaq	16(%rcx),%rcx
-	jnz	L$oop_dec1_4
+	jnz	L$oop_dec1_4  // loop body is 16 bytes
 	aesdeclast	%xmm1,%xmm2
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store one output block
+	pxor	%xmm2,%xmm2  // clear register bank
 	jmp	L$ecb_ret
 .p2align	4
 L$ecb_dec_two:
 	call	_aesni_decrypt2
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store 2 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
 	jmp	L$ecb_ret
 .p2align	4
 L$ecb_dec_three:
 	call	_aesni_decrypt3
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store 3 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
 	movups	%xmm4,32(%rsi)
@@ -837,8 +837,8 @@
 .p2align	4
 L$ecb_dec_four:
 	call	_aesni_decrypt4
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store 4 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
 	movups	%xmm4,32(%rsi)
@@ -850,8 +850,8 @@
 L$ecb_dec_five:
 	xorps	%xmm7,%xmm7
 	call	_aesni_decrypt6
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store 5 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
 	movups	%xmm4,32(%rsi)
@@ -865,8 +865,8 @@
 .p2align	4
 L$ecb_dec_six:
 	call	_aesni_decrypt6
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store 6 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
 	movups	%xmm4,32(%rsi)
@@ -879,7 +879,7 @@
 	pxor	%xmm7,%xmm7
 
 L$ecb_ret:
-	xorps	%xmm0,%xmm0
+	xorps	%xmm0,%xmm0  // %xmm0
 	pxor	%xmm1,%xmm1
 	ret
 
@@ -898,11 +898,11 @@
 	cmpq	$1,%rdx
 	jne	L$ctr32_bulk
 
-
-
+// handle single block without allocating stack frame,
+// useful when handling edges
 	movups	(%r8),%xmm2
 	movups	(%rdi),%xmm3
-	movl	240(%rcx),%edx
+	movl	240(%rcx),%edx  // key->rounds
 	movups	(%rcx),%xmm0
 	movups	16(%rcx),%xmm1
 	leaq	32(%rcx),%rcx
@@ -912,9 +912,9 @@
 	decl	%edx
 	movups	(%rcx),%xmm1
 	leaq	16(%rcx),%rcx
-	jnz	L$oop_enc1_5
+	jnz	L$oop_enc1_5  // loop body is 16 bytes
 	aesenclast	%xmm1,%xmm2
-	pxor	%xmm0,%xmm0
+	pxor	%xmm0,%xmm0  // clear register bank
 	pxor	%xmm1,%xmm1
 	xorps	%xmm3,%xmm2
 	pxor	%xmm3,%xmm3
@@ -924,22 +924,22 @@
 
 .p2align	4
 L$ctr32_bulk:
-	leaq	(%rsp),%r11
+	leaq	(%rsp),%r11  // use %r11 as frame pointer
 
 	pushq	%rbp
 
 	subq	$128,%rsp
-	andq	$-16,%rsp
-
-
+	andq	$-16,%rsp  // Linux kernel stack can be incorrectly seeded
 
+// 8 16-byte words on top of stack are counter values
+// xor-ed with zero-round key
 
 	movdqu	(%r8),%xmm2
 	movdqu	(%rcx),%xmm0
-	movl	12(%r8),%r8d
+	movl	12(%r8),%r8d  // counter LSB
 	pxor	%xmm0,%xmm2
-	movl	12(%rcx),%ebp
-	movdqa	%xmm2,0(%rsp)
+	movl	12(%rcx),%ebp  // 0-round key LSB
+	movdqa	%xmm2,0(%rsp)  // populate counter block
 	bswapl	%r8d
 	movdqa	%xmm2,%xmm3
 	movdqa	%xmm2,%xmm4
@@ -947,7 +947,7 @@
 	movdqa	%xmm2,64(%rsp)
 	movdqa	%xmm2,80(%rsp)
 	movdqa	%xmm2,96(%rsp)
-	movq	%rdx,%r10
+	movq	%rdx,%r10  // about to borrow %rdx
 	movdqa	%xmm2,112(%rsp)
 
 	leaq	1(%r8),%rax
@@ -961,7 +961,7 @@
 	movdqa	%xmm3,16(%rsp)
 	pinsrd	$3,%edx,%xmm4
 	bswapl	%eax
-	movq	%r10,%rdx
+	movq	%r10,%rdx  // restore %rdx
 	leaq	4(%r8),%r10
 	movdqa	%xmm4,32(%rsp)
 	xorl	%ebp,%eax
@@ -973,7 +973,7 @@
 	movl	%r10d,64+12(%rsp)
 	bswapl	%r9d
 	leaq	6(%r8),%r10
-	movl	240(%rcx),%eax
+	movl	240(%rcx),%eax  // key->rounds
 	xorl	%ebp,%r9d
 	bswapl	%r10d
 	movl	%r9d,80+12(%rsp)
@@ -989,16 +989,16 @@
 	movdqa	64(%rsp),%xmm6
 	movdqa	80(%rsp),%xmm7
 
-	cmpq	$8,%rdx
-	jb	L$ctr32_tail
+	cmpq	$8,%rdx  // %rdx is in blocks
+	jb	L$ctr32_tail  // short input if (%rdx<8)
 
-	leaq	128(%rcx),%rcx
-	subq	$8,%rdx
+	leaq	128(%rcx),%rcx  // size optimization
+	subq	$8,%rdx  // %rdx is biased by -8
 	jmp	L$ctr32_loop8
 
 .p2align	5
 L$ctr32_loop8:
-	addl	$8,%r8d
+	addl	$8,%r8d  // next counter value
 	movdqa	96(%rsp),%xmm8
 	aesenc	%xmm1,%xmm2
 	movl	%r8d,%r9d
@@ -1010,7 +1010,7 @@
 	xorl	%ebp,%r9d
 	nop
 	aesenc	%xmm1,%xmm5
-	movl	%r9d,0+12(%rsp)
+	movl	%r9d,0+12(%rsp)  // store next counter value
 	leaq	1(%r8),%r9
 	aesenc	%xmm1,%xmm6
 	aesenc	%xmm1,%xmm7
@@ -1106,7 +1106,7 @@
 	aesenc	%xmm0,%xmm3
 	aesenc	%xmm0,%xmm4
 	xorl	%ebp,%r9d
-	movdqu	0(%rdi),%xmm10
+	movdqu	0(%rdi),%xmm10  // start loading input
 	aesenc	%xmm0,%xmm5
 	movl	%r9d,112+12(%rsp)
 	cmpl	$11,%eax
@@ -1163,7 +1163,7 @@
 .p2align	4
 L$ctr32_enc_done:
 	movdqu	16(%rdi),%xmm11
-	pxor	%xmm0,%xmm10
+	pxor	%xmm0,%xmm10  // input^=roundlast
 	movdqu	32(%rdi),%xmm12
 	pxor	%xmm0,%xmm11
 	movdqu	48(%rdi),%xmm13
@@ -1172,8 +1172,8 @@
 	pxor	%xmm0,%xmm13
 	movdqu	80(%rdi),%xmm15
 	pxor	%xmm0,%xmm14
-	prefetcht0	448(%rdi)
-	prefetcht0	512(%rdi)
+	prefetcht0	448(%rdi)  // We process 128 bytes (8*16), so to prefetch 1 iteration
+	prefetcht0	512(%rdi)  // We need to prefetch 2 64 byte lines
 	pxor	%xmm0,%xmm15
 	aesenc	%xmm1,%xmm2
 	aesenc	%xmm1,%xmm3
@@ -1183,15 +1183,15 @@
 	aesenc	%xmm1,%xmm7
 	aesenc	%xmm1,%xmm8
 	aesenc	%xmm1,%xmm9
-	movdqu	96(%rdi),%xmm1
-	leaq	128(%rdi),%rdi
+	movdqu	96(%rdi),%xmm1  // borrow %xmm1 for inp6
+	leaq	128(%rdi),%rdi  // %rdi+=8*16
 
-	aesenclast	%xmm10,%xmm2
-	pxor	%xmm0,%xmm1
+	aesenclast	%xmm10,%xmm2  // is inpN^roundlast
+	pxor	%xmm0,%xmm1  // borrowed
 	movdqu	112-128(%rdi),%xmm10
 	aesenclast	%xmm11,%xmm3
 	pxor	%xmm0,%xmm10
-	movdqa	0(%rsp),%xmm11
+	movdqa	0(%rsp),%xmm11  // load next counter block
 	aesenclast	%xmm12,%xmm4
 	aesenclast	%xmm13,%xmm5
 	movdqa	16(%rsp),%xmm12
@@ -1202,10 +1202,10 @@
 	movdqa	64(%rsp),%xmm15
 	aesenclast	%xmm1,%xmm8
 	movdqa	80(%rsp),%xmm0
-	movups	16-128(%rcx),%xmm1
+	movups	16-128(%rcx),%xmm1  // real 1st-round key
 	aesenclast	%xmm10,%xmm9
 
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 8 output blocks
 	movdqa	%xmm11,%xmm2
 	movups	%xmm3,16(%rsi)
 	movdqa	%xmm12,%xmm3
@@ -1219,24 +1219,24 @@
 	movdqa	%xmm0,%xmm7
 	movups	%xmm8,96(%rsi)
 	movups	%xmm9,112(%rsi)
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // %rsi+=8*16
 
 	subq	$8,%rdx
-	jnc	L$ctr32_loop8
+	jnc	L$ctr32_loop8  // loop if %rdx-=8 didn't borrow
 
-	addq	$8,%rdx
-	jz	L$ctr32_done
+	addq	$8,%rdx  // restore real remaining %rdx
+	jz	L$ctr32_done  // done if (%rdx==0)
 	leaq	-128(%rcx),%rcx
 
 L$ctr32_tail:
-
-
+// note that at this point %xmm2..5 are populated with
+// counter values xor-ed with 0-round key
 	leaq	16(%rcx),%rcx
 	cmpq	$4,%rdx
 	jb	L$ctr32_loop3
 	je	L$ctr32_loop4
 
-
+// if (%rdx>4) compute 7 E(counter)
 	shll	$4,%eax
 	movdqa	96(%rsp),%xmm8
 	pxor	%xmm9,%xmm9
@@ -1244,14 +1244,14 @@
 	movups	16(%rcx),%xmm0
 	aesenc	%xmm1,%xmm2
 	aesenc	%xmm1,%xmm3
-	leaq	32-16(%rcx,%rax,1),%rcx
+	leaq	32-16(%rcx,%rax,1),%rcx  // prepare for .Lenc_loop8_enter
 	negq	%rax
 	aesenc	%xmm1,%xmm4
-	addq	$16,%rax
+	addq	$16,%rax  // prepare for .Lenc_loop8_enter
 	movups	(%rdi),%xmm10
 	aesenc	%xmm1,%xmm5
 	aesenc	%xmm1,%xmm6
-	movups	16(%rdi),%xmm11
+	movups	16(%rdi),%xmm11  // pre-load input
 	movups	32(%rdi),%xmm12
 	aesenc	%xmm1,%xmm7
 	aesenc	%xmm1,%xmm8
@@ -1262,7 +1262,7 @@
 	pxor	%xmm10,%xmm2
 	movdqu	64(%rdi),%xmm10
 	pxor	%xmm11,%xmm3
-	movdqu	%xmm2,(%rsi)
+	movdqu	%xmm2,(%rsi)  // store output
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm3,16(%rsi)
 	pxor	%xmm13,%xmm5
@@ -1271,17 +1271,17 @@
 	movdqu	%xmm5,48(%rsi)
 	movdqu	%xmm6,64(%rsi)
 	cmpq	$6,%rdx
-	jb	L$ctr32_done
+	jb	L$ctr32_done  // %rdx was 5, stop store
 
 	movups	80(%rdi),%xmm11
 	xorps	%xmm11,%xmm7
 	movups	%xmm7,80(%rsi)
-	je	L$ctr32_done
+	je	L$ctr32_done  // %rdx was 6, stop store
 
 	movups	96(%rdi),%xmm12
 	xorps	%xmm12,%xmm8
 	movups	%xmm8,96(%rsi)
-	jmp	L$ctr32_done
+	jmp	L$ctr32_done  // %rdx was 7, stop store
 
 .p2align	5
 L$ctr32_loop4:
@@ -1295,7 +1295,7 @@
 	jnz	L$ctr32_loop4
 	aesenclast	%xmm1,%xmm2
 	aesenclast	%xmm1,%xmm3
-	movups	(%rdi),%xmm10
+	movups	(%rdi),%xmm10  // load input
 	movups	16(%rdi),%xmm11
 	aesenclast	%xmm1,%xmm4
 	aesenclast	%xmm1,%xmm5
@@ -1303,14 +1303,14 @@
 	movups	48(%rdi),%xmm13
 
 	xorps	%xmm10,%xmm2
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store output
 	xorps	%xmm11,%xmm3
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm4,32(%rsi)
 	pxor	%xmm13,%xmm5
 	movdqu	%xmm5,48(%rsi)
-	jmp	L$ctr32_done
+	jmp	L$ctr32_done  // %rdx was 4, stop store
 
 .p2align	5
 L$ctr32_loop3:
@@ -1325,23 +1325,23 @@
 	aesenclast	%xmm1,%xmm3
 	aesenclast	%xmm1,%xmm4
 
-	movups	(%rdi),%xmm10
+	movups	(%rdi),%xmm10  // load input
 	xorps	%xmm10,%xmm2
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store output
 	cmpq	$2,%rdx
-	jb	L$ctr32_done
+	jb	L$ctr32_done  // %rdx was 1, stop store
 
 	movups	16(%rdi),%xmm11
 	xorps	%xmm11,%xmm3
 	movups	%xmm3,16(%rsi)
-	je	L$ctr32_done
+	je	L$ctr32_done  // %rdx was 2, stop store
 
 	movups	32(%rdi),%xmm12
 	xorps	%xmm12,%xmm4
-	movups	%xmm4,32(%rsi)
+	movups	%xmm4,32(%rsi)  // %rdx was 3, stop store
 
 L$ctr32_done:
-	xorps	%xmm0,%xmm0
+	xorps	%xmm0,%xmm0  // clear register bank
 	xorl	%ebp,%ebp
 	pxor	%xmm1,%xmm1
 	pxor	%xmm2,%xmm2
@@ -1350,7 +1350,7 @@
 	pxor	%xmm5,%xmm5
 	pxor	%xmm6,%xmm6
 	pxor	%xmm7,%xmm7
-	movaps	%xmm0,0(%rsp)
+	movaps	%xmm0,0(%rsp)  // clear stack
 	pxor	%xmm8,%xmm8
 	movaps	%xmm0,16(%rsp)
 	pxor	%xmm9,%xmm9
@@ -1382,15 +1382,15 @@
 _aes_hw_cbc_encrypt:
 
 _CET_ENDBR
-	testq	%rdx,%rdx
+	testq	%rdx,%rdx  // check length
 	jz	L$cbc_ret
 
-	movl	240(%rcx),%r10d
-	movq	%rcx,%r11
-	testl	%r9d,%r9d
+	movl	240(%rcx),%r10d  // key->rounds
+	movq	%rcx,%r11  // backup %rcx
+	testl	%r9d,%r9d  // 6th argument
 	jz	L$cbc_decrypt
-
-	movups	(%r8),%xmm2
+//  --------------------------- CBC ENCRYPT ------------------------------
+	movups	(%r8),%xmm2  // load iv as initial state
 	movl	%r10d,%eax
 	cmpq	$16,%rdx
 	jb	L$cbc_enc_tail
@@ -1398,9 +1398,9 @@
 	jmp	L$cbc_enc_loop
 .p2align	4
 L$cbc_enc_loop:
-	movups	(%rdi),%xmm3
+	movups	(%rdi),%xmm3  // load input
 	leaq	16(%rdi),%rdi
-
+// xorps	%xmm3,%xmm2
 	movups	(%rcx),%xmm0
 	movups	16(%rcx),%xmm1
 	xorps	%xmm0,%xmm3
@@ -1411,17 +1411,17 @@
 	decl	%eax
 	movups	(%rcx),%xmm1
 	leaq	16(%rcx),%rcx
-	jnz	L$oop_enc1_6
+	jnz	L$oop_enc1_6  // loop body is 16 bytes
 	aesenclast	%xmm1,%xmm2
-	movl	%r10d,%eax
-	movq	%r11,%rcx
-	movups	%xmm2,0(%rsi)
+	movl	%r10d,%eax  // restore %eax
+	movq	%r11,%rcx  // restore %rcx
+	movups	%xmm2,0(%rsi)  // store output
 	leaq	16(%rsi),%rsi
 	subq	$16,%rdx
 	jnc	L$cbc_enc_loop
 	addq	$16,%rdx
 	jnz	L$cbc_enc_tail
-	pxor	%xmm0,%xmm0
+	pxor	%xmm0,%xmm0  // clear register bank
 	pxor	%xmm1,%xmm1
 	movups	%xmm2,(%r8)
 	pxor	%xmm2,%xmm2
@@ -1429,30 +1429,30 @@
 	jmp	L$cbc_ret
 
 L$cbc_enc_tail:
-	movq	%rdx,%rcx
-	xchgq	%rdi,%rsi
-.long	0x9066A4F3
-	movl	$16,%ecx
+	movq	%rdx,%rcx  // zaps %rcx
+	xchgq	%rdi,%rsi  // %rdi is %rsi and %rsi is %rdi now
+.long	0x9066A4F3  // rep movsb
+	movl	$16,%ecx  // zero tail
 	subq	%rdx,%rcx
 	xorl	%eax,%eax
-.long	0x9066AAF3
-	leaq	-16(%rdi),%rdi
-	movl	%r10d,%eax
-	movq	%rdi,%rsi
-	movq	%r11,%rcx
-	xorq	%rdx,%rdx
-	jmp	L$cbc_enc_loop
-
+.long	0x9066AAF3  // rep stosb
+	leaq	-16(%rdi),%rdi  // rewind %rsi by 1 block
+	movl	%r10d,%eax  // restore %eax
+	movq	%rdi,%rsi  // %rdi and %rsi are the same
+	movq	%r11,%rcx  // restore %rcx
+	xorq	%rdx,%rdx  // len=16
+	jmp	L$cbc_enc_loop  // one more spin
+// --------------------------- CBC DECRYPT ------------------------------#
 .p2align	4
 L$cbc_decrypt:
 	cmpq	$16,%rdx
 	jne	L$cbc_decrypt_bulk
 
-
-
-	movdqu	(%rdi),%xmm2
-	movdqu	(%r8),%xmm3
-	movdqa	%xmm2,%xmm4
+// handle single block without allocating stack frame,
+// useful in ciphertext stealing mode
+	movdqu	(%rdi),%xmm2  // load input
+	movdqu	(%r8),%xmm3  // load iv
+	movdqa	%xmm2,%xmm4  // future iv
 	movups	(%rcx),%xmm0
 	movups	16(%rcx),%xmm1
 	leaq	32(%rcx),%rcx
@@ -1462,32 +1462,32 @@
 	decl	%r10d
 	movups	(%rcx),%xmm1
 	leaq	16(%rcx),%rcx
-	jnz	L$oop_dec1_7
+	jnz	L$oop_dec1_7  // loop body is 16 bytes
 	aesdeclast	%xmm1,%xmm2
-	pxor	%xmm0,%xmm0
+	pxor	%xmm0,%xmm0  // clear register bank
 	pxor	%xmm1,%xmm1
-	movdqu	%xmm4,(%r8)
-	xorps	%xmm3,%xmm2
+	movdqu	%xmm4,(%r8)  // store iv
+	xorps	%xmm3,%xmm2  // ^=iv
 	pxor	%xmm3,%xmm3
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store output
 	pxor	%xmm2,%xmm2
 	jmp	L$cbc_ret
 .p2align	4
 L$cbc_decrypt_bulk:
-	leaq	(%rsp),%r11
+	leaq	(%rsp),%r11  // frame pointer
 
 	pushq	%rbp
 
 	subq	$16,%rsp
-	andq	$-16,%rsp
-	movq	%rcx,%rbp
+	andq	$-16,%rsp  // Linux kernel stack can be incorrectly seeded
+	movq	%rcx,%rbp  // re-backup %rcx after reassignment
 	movups	(%r8),%xmm10
 	movl	%r10d,%eax
 	cmpq	$0x50,%rdx
 	jbe	L$cbc_dec_tail
 
 	movups	(%rcx),%xmm0
-	movdqu	0(%rdi),%xmm2
+	movdqu	0(%rdi),%xmm2  // load input
 	movdqu	16(%rdi),%xmm3
 	movdqa	%xmm2,%xmm11
 	movdqu	32(%rdi),%xmm4
@@ -1501,8 +1501,8 @@
 	cmpq	$0x70,%rdx
 	jbe	L$cbc_dec_six_or_seven
 
-	subq	$0x70,%rdx
-	leaq	112(%rcx),%rcx
+	subq	$0x70,%rdx  // %rdx is biased by -7*16
+	leaq	112(%rcx),%rcx  // size optimization
 	jmp	L$cbc_dec_loop8_enter
 .p2align	4
 L$cbc_dec_loop8:
@@ -1516,7 +1516,7 @@
 	movups	16-112(%rcx),%xmm1
 	pxor	%xmm0,%xmm4
 	movq	$-1,%rbp
-	cmpq	$0x70,%rdx
+	cmpq	$0x70,%rdx  // is there at least 0x60 bytes ahead?
 	pxor	%xmm0,%xmm5
 	pxor	%xmm0,%xmm6
 	pxor	%xmm0,%xmm7
@@ -1665,11 +1665,11 @@
 	movdqu	80(%rdi),%xmm1
 
 	aesdeclast	%xmm10,%xmm2
-	movdqu	96(%rdi),%xmm10
+	movdqu	96(%rdi),%xmm10  // borrow %xmm10
 	pxor	%xmm0,%xmm1
 	aesdeclast	%xmm11,%xmm3
 	pxor	%xmm0,%xmm10
-	movdqu	112(%rdi),%xmm0
+	movdqu	112(%rdi),%xmm0  // next IV
 	aesdeclast	%xmm12,%xmm4
 	leaq	128(%rdi),%rdi
 	movdqu	0(%rbp),%xmm11
@@ -1682,11 +1682,11 @@
 	movdqu	48(%rbp),%xmm14
 	movdqu	64(%rbp),%xmm15
 	aesdeclast	%xmm10,%xmm9
-	movdqa	%xmm0,%xmm10
+	movdqa	%xmm0,%xmm10  // return %xmm10
 	movdqu	80(%rbp),%xmm1
 	movups	-112(%rcx),%xmm0
 
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store output
 	movdqa	%xmm11,%xmm2
 	movups	%xmm3,16(%rsi)
 	movdqa	%xmm12,%xmm3
@@ -1720,13 +1720,13 @@
 
 	movaps	%xmm7,%xmm8
 	call	_aesni_decrypt6
-	pxor	%xmm10,%xmm2
+	pxor	%xmm10,%xmm2  // ^= IV
 	movaps	%xmm8,%xmm10
 	pxor	%xmm11,%xmm3
 	movdqu	%xmm2,(%rsi)
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm3,16(%rsi)
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	pxor	%xmm13,%xmm5
 	movdqu	%xmm4,32(%rsi)
 	pxor	%xmm4,%xmm4
@@ -1747,13 +1747,13 @@
 	xorps	%xmm9,%xmm9
 	call	_aesni_decrypt8
 	movups	80(%rdi),%xmm9
-	pxor	%xmm10,%xmm2
+	pxor	%xmm10,%xmm2  // ^= IV
 	movups	96(%rdi),%xmm10
 	pxor	%xmm11,%xmm3
 	movdqu	%xmm2,(%rsi)
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm3,16(%rsi)
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	pxor	%xmm13,%xmm5
 	movdqu	%xmm4,32(%rsi)
 	pxor	%xmm4,%xmm4
@@ -1775,24 +1775,24 @@
 L$cbc_dec_tail:
 	movups	(%rdi),%xmm2
 	subq	$0x10,%rdx
-	jbe	L$cbc_dec_one
+	jbe	L$cbc_dec_one  // %rdx is 1*16 or less
 
 	movups	16(%rdi),%xmm3
 	movaps	%xmm2,%xmm11
 	subq	$0x10,%rdx
-	jbe	L$cbc_dec_two
+	jbe	L$cbc_dec_two  // %rdx is 2*16 or less
 
 	movups	32(%rdi),%xmm4
 	movaps	%xmm3,%xmm12
 	subq	$0x10,%rdx
-	jbe	L$cbc_dec_three
+	jbe	L$cbc_dec_three  // %rdx is 3*16 or less
 
 	movups	48(%rdi),%xmm5
 	movaps	%xmm4,%xmm13
 	subq	$0x10,%rdx
-	jbe	L$cbc_dec_four
+	jbe	L$cbc_dec_four  // %rdx is 4*16 or less
 
-	movups	64(%rdi),%xmm6
+	movups	64(%rdi),%xmm6  // %rdx is 5*16 or less
 	movaps	%xmm5,%xmm14
 	movaps	%xmm6,%xmm15
 	xorps	%xmm7,%xmm7
@@ -1803,7 +1803,7 @@
 	movdqu	%xmm2,(%rsi)
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm3,16(%rsi)
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	pxor	%xmm13,%xmm5
 	movdqu	%xmm4,32(%rsi)
 	pxor	%xmm4,%xmm4
@@ -1829,7 +1829,7 @@
 	decl	%eax
 	movups	(%rcx),%xmm1
 	leaq	16(%rcx),%rcx
-	jnz	L$oop_dec1_8
+	jnz	L$oop_dec1_8  // loop body is 16 bytes
 	aesdeclast	%xmm1,%xmm2
 	xorps	%xmm10,%xmm2
 	movaps	%xmm11,%xmm10
@@ -1843,7 +1843,7 @@
 	pxor	%xmm11,%xmm3
 	movdqu	%xmm2,(%rsi)
 	movdqa	%xmm3,%xmm2
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	leaq	16(%rsi),%rsi
 	jmp	L$cbc_dec_tail_collected
 .p2align	4
@@ -1856,7 +1856,7 @@
 	movdqu	%xmm2,(%rsi)
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm3,16(%rsi)
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	movdqa	%xmm4,%xmm2
 	pxor	%xmm4,%xmm4
 	leaq	32(%rsi),%rsi
@@ -1871,7 +1871,7 @@
 	movdqu	%xmm2,(%rsi)
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm3,16(%rsi)
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	pxor	%xmm13,%xmm5
 	movdqu	%xmm4,32(%rsi)
 	pxor	%xmm4,%xmm4
@@ -1882,10 +1882,10 @@
 
 .p2align	4
 L$cbc_dec_clear_tail_collected:
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	pxor	%xmm4,%xmm4
 	pxor	%xmm5,%xmm5
-	pxor	%xmm6,%xmm6
+	pxor	%xmm6,%xmm6  // %xmm6..9
 	pxor	%xmm7,%xmm7
 	pxor	%xmm8,%xmm8
 	pxor	%xmm9,%xmm9
@@ -1904,11 +1904,11 @@
 	movq	%rsi,%rdi
 	subq	%rdx,%rcx
 	leaq	(%rsp),%rsi
-.long	0x9066A4F3
+.long	0x9066A4F3  // rep movsb
 	movdqa	%xmm2,(%rsp)
 
 L$cbc_dec_ret:
-	xorps	%xmm0,%xmm0
+	xorps	%xmm0,%xmm0  // %xmm0
 	pxor	%xmm1,%xmm1
 	movq	-8(%r11),%rbp
 
@@ -1930,9 +1930,9 @@
 	movl	240(%rdi),%esi
 	shll	$4,%esi
 
-	leaq	16(%rdi,%rsi,1),%rdx
+	leaq	16(%rdi,%rsi,1),%rdx  // points at the end of key schedule
 
-	movups	(%rdi),%xmm0
+	movups	(%rdi),%xmm0  // just swap
 	movups	(%rdx),%xmm1
 	movups	%xmm0,(%rdx)
 	movups	%xmm1,(%rdi)
@@ -1940,7 +1940,7 @@
 	leaq	-16(%rdx),%rdx
 
 L$dec_key_inverse:
-	movups	(%rdi),%xmm0
+	movups	(%rdi),%xmm0  // swap and inverse
 	movups	(%rdx),%xmm1
 	aesimc	%xmm0,%xmm0
 	aesimc	%xmm1,%xmm1
@@ -1951,7 +1951,7 @@
 	cmpq	%rdi,%rdx
 	ja	L$dec_key_inverse
 
-	movups	(%rdi),%xmm0
+	movups	(%rdi),%xmm0  // inverse middle
 	aesimc	%xmm0,%xmm0
 	pxor	%xmm1,%xmm1
 	movups	%xmm0,(%rdx)
@@ -1975,9 +1975,9 @@
 
 
 
-	movups	(%rdi),%xmm0
-	xorps	%xmm4,%xmm4
-	leaq	16(%rdx),%rax
+	movups	(%rdi),%xmm0  // pull first 128 bits of *userKey
+	xorps	%xmm4,%xmm4  // low dword of xmm4 is assumed 0
+	leaq	16(%rdx),%rax  // %rax is used as modifiable copy of %rdx
 	cmpl	$256,%esi
 	je	L$14rounds
 	cmpl	$192,%esi
@@ -1986,97 +1986,97 @@
 	jne	L$bad_keybits
 
 L$10rounds:
-	movl	$9,%esi
+	movl	$9,%esi  // 10 rounds for 128-bit key
 
-	movups	%xmm0,(%rdx)
-	aeskeygenassist	$0x1,%xmm0,%xmm1
+	movups	%xmm0,(%rdx)  // round 0
+	aeskeygenassist	$0x1,%xmm0,%xmm1  // round 1
 	call	L$key_expansion_128_cold
-	aeskeygenassist	$0x2,%xmm0,%xmm1
+	aeskeygenassist	$0x2,%xmm0,%xmm1  // round 2
 	call	L$key_expansion_128
-	aeskeygenassist	$0x4,%xmm0,%xmm1
+	aeskeygenassist	$0x4,%xmm0,%xmm1  // round 3
 	call	L$key_expansion_128
-	aeskeygenassist	$0x8,%xmm0,%xmm1
+	aeskeygenassist	$0x8,%xmm0,%xmm1  // round 4
 	call	L$key_expansion_128
-	aeskeygenassist	$0x10,%xmm0,%xmm1
+	aeskeygenassist	$0x10,%xmm0,%xmm1  // round 5
 	call	L$key_expansion_128
-	aeskeygenassist	$0x20,%xmm0,%xmm1
+	aeskeygenassist	$0x20,%xmm0,%xmm1  // round 6
 	call	L$key_expansion_128
-	aeskeygenassist	$0x40,%xmm0,%xmm1
+	aeskeygenassist	$0x40,%xmm0,%xmm1  // round 7
 	call	L$key_expansion_128
-	aeskeygenassist	$0x80,%xmm0,%xmm1
+	aeskeygenassist	$0x80,%xmm0,%xmm1  // round 8
 	call	L$key_expansion_128
-	aeskeygenassist	$0x1b,%xmm0,%xmm1
+	aeskeygenassist	$0x1b,%xmm0,%xmm1  // round 9
 	call	L$key_expansion_128
-	aeskeygenassist	$0x36,%xmm0,%xmm1
+	aeskeygenassist	$0x36,%xmm0,%xmm1  // round 10
 	call	L$key_expansion_128
 	movups	%xmm0,(%rax)
-	movl	%esi,80(%rax)
+	movl	%esi,80(%rax)  // 240(%rdx)
 	xorl	%eax,%eax
 	jmp	L$enc_key_ret
 
 .p2align	4
 L$12rounds:
-	movq	16(%rdi),%xmm2
-	movl	$11,%esi
+	movq	16(%rdi),%xmm2  // remaining 1/3 of *userKey
+	movl	$11,%esi  // 12 rounds for 192
 
-	movups	%xmm0,(%rdx)
-	aeskeygenassist	$0x1,%xmm2,%xmm1
+	movups	%xmm0,(%rdx)  // round 0
+	aeskeygenassist	$0x1,%xmm2,%xmm1  // round 1,2
 	call	L$key_expansion_192a_cold
-	aeskeygenassist	$0x2,%xmm2,%xmm1
+	aeskeygenassist	$0x2,%xmm2,%xmm1  // round 2,3
 	call	L$key_expansion_192b
-	aeskeygenassist	$0x4,%xmm2,%xmm1
+	aeskeygenassist	$0x4,%xmm2,%xmm1  // round 4,5
 	call	L$key_expansion_192a
-	aeskeygenassist	$0x8,%xmm2,%xmm1
+	aeskeygenassist	$0x8,%xmm2,%xmm1  // round 5,6
 	call	L$key_expansion_192b
-	aeskeygenassist	$0x10,%xmm2,%xmm1
+	aeskeygenassist	$0x10,%xmm2,%xmm1  // round 7,8
 	call	L$key_expansion_192a
-	aeskeygenassist	$0x20,%xmm2,%xmm1
+	aeskeygenassist	$0x20,%xmm2,%xmm1  // round 8,9
 	call	L$key_expansion_192b
-	aeskeygenassist	$0x40,%xmm2,%xmm1
+	aeskeygenassist	$0x40,%xmm2,%xmm1  // round 10,11
 	call	L$key_expansion_192a
-	aeskeygenassist	$0x80,%xmm2,%xmm1
+	aeskeygenassist	$0x80,%xmm2,%xmm1  // round 11,12
 	call	L$key_expansion_192b
 	movups	%xmm0,(%rax)
-	movl	%esi,48(%rax)
+	movl	%esi,48(%rax)  // 240(%rdx)
 	xorq	%rax,%rax
 	jmp	L$enc_key_ret
 
 .p2align	4
 L$14rounds:
-	movups	16(%rdi),%xmm2
-	movl	$13,%esi
+	movups	16(%rdi),%xmm2  // remaining half of *userKey
+	movl	$13,%esi  // 14 rounds for 256
 	leaq	16(%rax),%rax
 
-	movups	%xmm0,(%rdx)
-	movups	%xmm2,16(%rdx)
-	aeskeygenassist	$0x1,%xmm2,%xmm1
+	movups	%xmm0,(%rdx)  // round 0
+	movups	%xmm2,16(%rdx)  // round 1
+	aeskeygenassist	$0x1,%xmm2,%xmm1  // round 2
 	call	L$key_expansion_256a_cold
-	aeskeygenassist	$0x1,%xmm0,%xmm1
+	aeskeygenassist	$0x1,%xmm0,%xmm1  // round 3
 	call	L$key_expansion_256b
-	aeskeygenassist	$0x2,%xmm2,%xmm1
+	aeskeygenassist	$0x2,%xmm2,%xmm1  // round 4
 	call	L$key_expansion_256a
-	aeskeygenassist	$0x2,%xmm0,%xmm1
+	aeskeygenassist	$0x2,%xmm0,%xmm1  // round 5
 	call	L$key_expansion_256b
-	aeskeygenassist	$0x4,%xmm2,%xmm1
+	aeskeygenassist	$0x4,%xmm2,%xmm1  // round 6
 	call	L$key_expansion_256a
-	aeskeygenassist	$0x4,%xmm0,%xmm1
+	aeskeygenassist	$0x4,%xmm0,%xmm1  // round 7
 	call	L$key_expansion_256b
-	aeskeygenassist	$0x8,%xmm2,%xmm1
+	aeskeygenassist	$0x8,%xmm2,%xmm1  // round 8
 	call	L$key_expansion_256a
-	aeskeygenassist	$0x8,%xmm0,%xmm1
+	aeskeygenassist	$0x8,%xmm0,%xmm1  // round 9
 	call	L$key_expansion_256b
-	aeskeygenassist	$0x10,%xmm2,%xmm1
+	aeskeygenassist	$0x10,%xmm2,%xmm1  // round 10
 	call	L$key_expansion_256a
-	aeskeygenassist	$0x10,%xmm0,%xmm1
+	aeskeygenassist	$0x10,%xmm0,%xmm1  // round 11
 	call	L$key_expansion_256b
-	aeskeygenassist	$0x20,%xmm2,%xmm1
+	aeskeygenassist	$0x20,%xmm2,%xmm1  // round 12
 	call	L$key_expansion_256a
-	aeskeygenassist	$0x20,%xmm0,%xmm1
+	aeskeygenassist	$0x20,%xmm0,%xmm1  // round 13
 	call	L$key_expansion_256b
-	aeskeygenassist	$0x40,%xmm2,%xmm1
+	aeskeygenassist	$0x40,%xmm2,%xmm1  // round 14
 	call	L$key_expansion_256a
 	movups	%xmm0,(%rax)
-	movl	%esi,16(%rax)
+	movl	%esi,16(%rax)  // 240(%rdx)
 	xorq	%rax,%rax
 	jmp	L$enc_key_ret
 
@@ -2107,7 +2107,7 @@
 	xorps	%xmm4,%xmm0
 	shufps	$140,%xmm0,%xmm4
 	xorps	%xmm4,%xmm0
-	shufps	$255,%xmm1,%xmm1
+	shufps	$255,%xmm1,%xmm1  // critical path
 	xorps	%xmm1,%xmm0
 	ret
 
@@ -2126,7 +2126,7 @@
 	shufps	$140,%xmm0,%xmm4
 	pslldq	$4,%xmm3
 	xorps	%xmm4,%xmm0
-	pshufd	$85,%xmm1,%xmm1
+	pshufd	$85,%xmm1,%xmm1  // critical path
 	pxor	%xmm3,%xmm2
 	pxor	%xmm1,%xmm0
 	pshufd	$255,%xmm0,%xmm3
@@ -2156,7 +2156,7 @@
 	xorps	%xmm4,%xmm0
 	shufps	$140,%xmm0,%xmm4
 	xorps	%xmm4,%xmm0
-	shufps	$255,%xmm1,%xmm1
+	shufps	$255,%xmm1,%xmm1  // critical path
 	xorps	%xmm1,%xmm0
 	ret
 
@@ -2171,7 +2171,7 @@
 	xorps	%xmm4,%xmm2
 	shufps	$140,%xmm2,%xmm4
 	xorps	%xmm4,%xmm2
-	shufps	$170,%xmm1,%xmm1
+	shufps	$170,%xmm1,%xmm1  // critical path
 	xorps	%xmm1,%xmm2
 	ret
 
@@ -2192,9 +2192,9 @@
 
 
 
-	movups	(%rdi),%xmm0
-	xorps	%xmm4,%xmm4
-	leaq	16(%rdx),%rax
+	movups	(%rdi),%xmm0  // pull first 128 bits of *userKey
+	xorps	%xmm4,%xmm4  // low dword of xmm4 is assumed 0
+	leaq	16(%rdx),%rax  // %rax is used as modifiable copy of %rdx
 	cmpl	$256,%esi
 	je	L$14rounds_alt
 	cmpl	$192,%esi
@@ -2202,7 +2202,7 @@
 	cmpl	$128,%esi
 	jne	L$bad_keybits_alt
 
-	movl	$9,%esi
+	movl	$9,%esi  // 10 rounds for 128-bit key
 	movdqa	L$key_rotate(%rip),%xmm5
 	movl	$8,%r10d
 	movdqa	L$key_rcon1(%rip),%xmm4
@@ -2264,14 +2264,14 @@
 	pxor	%xmm2,%xmm0
 	movdqu	%xmm0,16(%rax)
 
-	movl	%esi,96(%rax)
+	movl	%esi,96(%rax)  // 240(%rdx)
 	xorl	%eax,%eax
 	jmp	L$enc_key_ret_alt
 
 .p2align	4
 L$12rounds_alt:
-	movq	16(%rdi),%xmm2
-	movl	$11,%esi
+	movq	16(%rdi),%xmm2  // remaining 1/3 of *userKey
+	movl	$11,%esi  // 12 rounds for 192
 	movdqa	L$key_rotate192(%rip),%xmm5
 	movdqa	L$key_rcon1(%rip),%xmm4
 	movl	$8,%r10d
@@ -2307,14 +2307,14 @@
 	decl	%r10d
 	jnz	L$oop_key192
 
-	movl	%esi,32(%rax)
+	movl	%esi,32(%rax)  // 240(%rdx)
 	xorl	%eax,%eax
 	jmp	L$enc_key_ret_alt
 
 .p2align	4
 L$14rounds_alt:
-	movups	16(%rdi),%xmm2
-	movl	$13,%esi
+	movups	16(%rdi),%xmm2  // remaining half of *userKey
+	movl	$13,%esi  // 14 rounds for 256
 	leaq	16(%rax),%rax
 	movdqa	L$key_rotate(%rip),%xmm5
 	movdqa	L$key_rcon1(%rip),%xmm4
@@ -2364,7 +2364,7 @@
 	jmp	L$oop_key256
 
 L$done_key256:
-	movl	%esi,16(%rax)
+	movl	%esi,16(%rax)  // 240(%rdx)
 	xorl	%eax,%eax
 	jmp	L$enc_key_ret_alt

boringssl-0.20260708.tar.xz/gen/bcm/aesni-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/aesni-x86_64-linux.S Changed

@@ -17,8 +17,8 @@
 .hidden BORINGSSL_function_hit
 	movb	$1,BORINGSSL_function_hit+1(%rip)
 #endif
-	movups	(%rdi),%xmm2
-	movl	240(%rdx),%eax
+	movups	(%rdi),%xmm2  // load input
+	movl	240(%rdx),%eax  // key->rounds
 	movups	(%rdx),%xmm0
 	movups	16(%rdx),%xmm1
 	leaq	32(%rdx),%rdx
@@ -28,11 +28,11 @@
 	decl	%eax
 	movups	(%rdx),%xmm1
 	leaq	16(%rdx),%rdx
-	jnz	.Loop_enc1_1
+	jnz	.Loop_enc1_1  // loop body is 16 bytes
 	aesenclast	%xmm1,%xmm2
-	pxor	%xmm0,%xmm0
+	pxor	%xmm0,%xmm0  // clear register bank
 	pxor	%xmm1,%xmm1
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // output
 	pxor	%xmm2,%xmm2
 	ret
 .cfi_endproc	
@@ -45,8 +45,8 @@
 aes_hw_decrypt:
 .cfi_startproc	
 _CET_ENDBR
-	movups	(%rdi),%xmm2
-	movl	240(%rdx),%eax
+	movups	(%rdi),%xmm2  // load input
+	movl	240(%rdx),%eax  // key->rounds
 	movups	(%rdx),%xmm0
 	movups	16(%rdx),%xmm1
 	leaq	32(%rdx),%rdx
@@ -56,11 +56,11 @@
 	decl	%eax
 	movups	(%rdx),%xmm1
 	leaq	16(%rdx),%rdx
-	jnz	.Loop_dec1_2
+	jnz	.Loop_dec1_2  // loop body is 16 bytes
 	aesdeclast	%xmm1,%xmm2
-	pxor	%xmm0,%xmm0
+	pxor	%xmm0,%xmm0  // clear register bank
 	pxor	%xmm1,%xmm1
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // output
 	pxor	%xmm2,%xmm2
 	ret
 .cfi_endproc	
@@ -76,7 +76,7 @@
 	xorps	%xmm0,%xmm3
 	movups	32(%rcx),%xmm0
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	addq	$16,%rax
 
 .Lenc_loop2:
@@ -107,7 +107,7 @@
 	xorps	%xmm0,%xmm3
 	movups	32(%rcx),%xmm0
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	addq	$16,%rax
 
 .Ldec_loop2:
@@ -139,7 +139,7 @@
 	xorps	%xmm0,%xmm4
 	movups	32(%rcx),%xmm0
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	addq	$16,%rax
 
 .Lenc_loop3:
@@ -175,7 +175,7 @@
 	xorps	%xmm0,%xmm4
 	movups	32(%rcx),%xmm0
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	addq	$16,%rax
 
 .Ldec_loop3:
@@ -212,7 +212,7 @@
 	xorps	%xmm0,%xmm5
 	movups	32(%rcx),%xmm0
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 .byte	0x0f,0x1f,0x00
 	addq	$16,%rax
 
@@ -254,7 +254,7 @@
 	xorps	%xmm0,%xmm5
 	movups	32(%rcx),%xmm0
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 .byte	0x0f,0x1f,0x00
 	addq	$16,%rax
 
@@ -295,7 +295,7 @@
 	pxor	%xmm0,%xmm4
 	aesenc	%xmm1,%xmm2
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	aesenc	%xmm1,%xmm3
 	pxor	%xmm0,%xmm5
 	pxor	%xmm0,%xmm6
@@ -351,7 +351,7 @@
 	pxor	%xmm0,%xmm4
 	aesdec	%xmm1,%xmm2
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	aesdec	%xmm1,%xmm3
 	pxor	%xmm0,%xmm5
 	pxor	%xmm0,%xmm6
@@ -408,7 +408,7 @@
 	pxor	%xmm0,%xmm5
 	pxor	%xmm0,%xmm6
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	aesenc	%xmm1,%xmm2
 	pxor	%xmm0,%xmm7
 	pxor	%xmm0,%xmm8
@@ -474,7 +474,7 @@
 	pxor	%xmm0,%xmm5
 	pxor	%xmm0,%xmm6
 	leaq	32(%rcx,%rax,1),%rcx
-	negq	%rax
+	negq	%rax  // %eax
 	aesdec	%xmm1,%xmm2
 	pxor	%xmm0,%xmm7
 	pxor	%xmm0,%xmm8
@@ -534,20 +534,20 @@
 aes_hw_ecb_encrypt:
 .cfi_startproc	
 _CET_ENDBR
-	andq	$-16,%rdx
-	jz	.Lecb_ret
+	andq	$-16,%rdx  // if (%rdx<16)
+	jz	.Lecb_ret  // return
 
-	movl	240(%rcx),%eax
+	movl	240(%rcx),%eax  // key->rounds
 	movups	(%rcx),%xmm0
-	movq	%rcx,%r11
-	movl	%eax,%r10d
-	testl	%r8d,%r8d
+	movq	%rcx,%r11  // backup %rcx
+	movl	%eax,%r10d  // backup %eax
+	testl	%r8d,%r8d  // 5th argument
 	jz	.Lecb_decrypt
+//  --------------------------- ECB ENCRYPT ------------------------------
+	cmpq	$0x80,%rdx  // if (%rdx<8*16)
+	jb	.Lecb_enc_tail  // short input
 
-	cmpq	$0x80,%rdx
-	jb	.Lecb_enc_tail
-
-	movdqu	(%rdi),%xmm2
+	movdqu	(%rdi),%xmm2  // load 8 input blocks
 	movdqu	16(%rdi),%xmm3
 	movdqu	32(%rdi),%xmm4
 	movdqu	48(%rdi),%xmm5
@@ -555,15 +555,15 @@
 	movdqu	80(%rdi),%xmm7
 	movdqu	96(%rdi),%xmm8
 	movdqu	112(%rdi),%xmm9
-	leaq	128(%rdi),%rdi
-	subq	$0x80,%rdx
+	leaq	128(%rdi),%rdi  // %rdi+=8*16
+	subq	$0x80,%rdx  // %rdx-=8*16 (can be zero)
 	jmp	.Lecb_enc_loop8_enter
 .align	16
 .Lecb_enc_loop8:
-	movups	%xmm2,(%rsi)
-	movq	%r11,%rcx
-	movdqu	(%rdi),%xmm2
-	movl	%r10d,%eax
+	movups	%xmm2,(%rsi)  // store 8 output blocks
+	movq	%r11,%rcx  // restore %rcx
+	movdqu	(%rdi),%xmm2  // load 8 input blocks
+	movl	%r10d,%eax  // restore %eax
 	movups	%xmm3,16(%rsi)
 	movdqu	16(%rdi),%xmm3
 	movups	%xmm4,32(%rsi)
@@ -577,31 +577,31 @@
 	movups	%xmm8,96(%rsi)
 	movdqu	96(%rdi),%xmm8
 	movups	%xmm9,112(%rsi)
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // %rsi+=8*16
 	movdqu	112(%rdi),%xmm9
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // %rdi+=8*16
 .Lecb_enc_loop8_enter:
 
 	call	_aesni_encrypt8
 
 	subq	$0x80,%rdx
-	jnc	.Lecb_enc_loop8
+	jnc	.Lecb_enc_loop8  // loop if %rdx-=8*16 didn't borrow
 
-	movups	%xmm2,(%rsi)
-	movq	%r11,%rcx
+	movups	%xmm2,(%rsi)  // store 8 output blocks
+	movq	%r11,%rcx  // restore %rcx
 	movups	%xmm3,16(%rsi)
-	movl	%r10d,%eax
+	movl	%r10d,%eax  // restore %eax
 	movups	%xmm4,32(%rsi)
 	movups	%xmm5,48(%rsi)
 	movups	%xmm6,64(%rsi)
 	movups	%xmm7,80(%rsi)
 	movups	%xmm8,96(%rsi)
 	movups	%xmm9,112(%rsi)
-	leaq	128(%rsi),%rsi
-	addq	$0x80,%rdx
-	jz	.Lecb_ret
+	leaq	128(%rsi),%rsi  // %rsi+=8*16
+	addq	$0x80,%rdx  // restore real remaining %rdx
+	jz	.Lecb_ret  // done if (%rdx==0)
 
-.Lecb_enc_tail:
+.Lecb_enc_tail:  // %rdx is less than 8*16
 	movups	(%rdi),%xmm2
 	cmpq	$0x20,%rdx
 	jb	.Lecb_enc_one
@@ -620,7 +620,7 @@
 	movdqu	96(%rdi),%xmm8
 	xorps	%xmm9,%xmm9
 	call	_aesni_encrypt8
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 7 output blocks
 	movups	%xmm3,16(%rsi)
 	movups	%xmm4,32(%rsi)
 	movups	%xmm5,48(%rsi)
@@ -639,27 +639,27 @@
 	decl	%eax
 	movups	(%rcx),%xmm1
 	leaq	16(%rcx),%rcx
-	jnz	.Loop_enc1_3
+	jnz	.Loop_enc1_3  // loop body is 16 bytes
 	aesenclast	%xmm1,%xmm2
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store one output block
 	jmp	.Lecb_ret
 .align	16
 .Lecb_enc_two:
 	call	_aesni_encrypt2
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 2 output blocks
 	movups	%xmm3,16(%rsi)
 	jmp	.Lecb_ret
 .align	16
 .Lecb_enc_three:
 	call	_aesni_encrypt3
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 3 output blocks
 	movups	%xmm3,16(%rsi)
 	movups	%xmm4,32(%rsi)
 	jmp	.Lecb_ret
 .align	16
 .Lecb_enc_four:
 	call	_aesni_encrypt4
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 4 output blocks
 	movups	%xmm3,16(%rsi)
 	movups	%xmm4,32(%rsi)
 	movups	%xmm5,48(%rsi)
@@ -668,7 +668,7 @@
 .Lecb_enc_five:
 	xorps	%xmm7,%xmm7
 	call	_aesni_encrypt6
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 5 output blocks
 	movups	%xmm3,16(%rsi)
 	movups	%xmm4,32(%rsi)
 	movups	%xmm5,48(%rsi)
@@ -677,20 +677,20 @@
 .align	16
 .Lecb_enc_six:
 	call	_aesni_encrypt6
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 6 output blocks
 	movups	%xmm3,16(%rsi)
 	movups	%xmm4,32(%rsi)
 	movups	%xmm5,48(%rsi)
 	movups	%xmm6,64(%rsi)
 	movups	%xmm7,80(%rsi)
 	jmp	.Lecb_ret
-
+// --------------------------- ECB DECRYPT ------------------------------#
 .align	16
 .Lecb_decrypt:
-	cmpq	$0x80,%rdx
-	jb	.Lecb_dec_tail
+	cmpq	$0x80,%rdx  // if (%rdx<8*16)
+	jb	.Lecb_dec_tail  // short input
 
-	movdqu	(%rdi),%xmm2
+	movdqu	(%rdi),%xmm2  // load 8 input blocks
 	movdqu	16(%rdi),%xmm3
 	movdqu	32(%rdi),%xmm4
 	movdqu	48(%rdi),%xmm5
@@ -698,15 +698,15 @@
 	movdqu	80(%rdi),%xmm7
 	movdqu	96(%rdi),%xmm8
 	movdqu	112(%rdi),%xmm9
-	leaq	128(%rdi),%rdi
-	subq	$0x80,%rdx
+	leaq	128(%rdi),%rdi  // %rdi+=8*16
+	subq	$0x80,%rdx  // %rdx-=8*16 (can be zero)
 	jmp	.Lecb_dec_loop8_enter
 .align	16
 .Lecb_dec_loop8:
-	movups	%xmm2,(%rsi)
-	movq	%r11,%rcx
-	movdqu	(%rdi),%xmm2
-	movl	%r10d,%eax
+	movups	%xmm2,(%rsi)  // store 8 output blocks
+	movq	%r11,%rcx  // restore %rcx
+	movdqu	(%rdi),%xmm2  // load 8 input blocks
+	movl	%r10d,%eax  // restore %eax
 	movups	%xmm3,16(%rsi)
 	movdqu	16(%rdi),%xmm3
 	movups	%xmm4,32(%rsi)
@@ -720,23 +720,23 @@
 	movups	%xmm8,96(%rsi)
 	movdqu	96(%rdi),%xmm8
 	movups	%xmm9,112(%rsi)
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // %rsi+=8*16
 	movdqu	112(%rdi),%xmm9
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // %rdi+=8*16
 .Lecb_dec_loop8_enter:
 
 	call	_aesni_decrypt8
 
 	movups	(%r11),%xmm0
 	subq	$0x80,%rdx
-	jnc	.Lecb_dec_loop8
+	jnc	.Lecb_dec_loop8  // loop if %rdx-=8*16 didn't borrow
 
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
-	movq	%r11,%rcx
+	movups	%xmm2,(%rsi)  // store 8 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
+	movq	%r11,%rcx  // restore %rcx
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
-	movl	%r10d,%eax
+	movl	%r10d,%eax  // restore %eax
 	movups	%xmm4,32(%rsi)
 	pxor	%xmm4,%xmm4
 	movups	%xmm5,48(%rsi)
@@ -749,9 +749,9 @@
 	pxor	%xmm8,%xmm8
 	movups	%xmm9,112(%rsi)
 	pxor	%xmm9,%xmm9
-	leaq	128(%rsi),%rsi
-	addq	$0x80,%rdx
-	jz	.Lecb_ret
+	leaq	128(%rsi),%rsi  // %rsi+=8*16
+	addq	$0x80,%rdx  // restore real remaining %rdx
+	jz	.Lecb_ret  // done if (%rdx==0)
 
 .Lecb_dec_tail:
 	movups	(%rdi),%xmm2
@@ -773,8 +773,8 @@
 	movups	(%rcx),%xmm0
 	xorps	%xmm9,%xmm9
 	call	_aesni_decrypt8
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store 7 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
 	movups	%xmm4,32(%rsi)
@@ -800,24 +800,24 @@
 	decl	%eax
 	movups	(%rcx),%xmm1
 	leaq	16(%rcx),%rcx
-	jnz	.Loop_dec1_4
+	jnz	.Loop_dec1_4  // loop body is 16 bytes
 	aesdeclast	%xmm1,%xmm2
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store one output block
+	pxor	%xmm2,%xmm2  // clear register bank
 	jmp	.Lecb_ret
 .align	16
 .Lecb_dec_two:
 	call	_aesni_decrypt2
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store 2 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
 	jmp	.Lecb_ret
 .align	16
 .Lecb_dec_three:
 	call	_aesni_decrypt3
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store 3 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
 	movups	%xmm4,32(%rsi)
@@ -826,8 +826,8 @@
 .align	16
 .Lecb_dec_four:
 	call	_aesni_decrypt4
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store 4 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
 	movups	%xmm4,32(%rsi)
@@ -839,8 +839,8 @@
 .Lecb_dec_five:
 	xorps	%xmm7,%xmm7
 	call	_aesni_decrypt6
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store 5 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
 	movups	%xmm4,32(%rsi)
@@ -854,8 +854,8 @@
 .align	16
 .Lecb_dec_six:
 	call	_aesni_decrypt6
-	movups	%xmm2,(%rsi)
-	pxor	%xmm2,%xmm2
+	movups	%xmm2,(%rsi)  // store 6 output blocks
+	pxor	%xmm2,%xmm2  // clear register bank
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm3,%xmm3
 	movups	%xmm4,32(%rsi)
@@ -868,7 +868,7 @@
 	pxor	%xmm7,%xmm7
 
 .Lecb_ret:
-	xorps	%xmm0,%xmm0
+	xorps	%xmm0,%xmm0  // %xmm0
 	pxor	%xmm1,%xmm1
 	ret
 .cfi_endproc	
@@ -886,11 +886,11 @@
 	cmpq	$1,%rdx
 	jne	.Lctr32_bulk
 
-
-
+// handle single block without allocating stack frame,
+// useful when handling edges
 	movups	(%r8),%xmm2
 	movups	(%rdi),%xmm3
-	movl	240(%rcx),%edx
+	movl	240(%rcx),%edx  // key->rounds
 	movups	(%rcx),%xmm0
 	movups	16(%rcx),%xmm1
 	leaq	32(%rcx),%rcx
@@ -900,9 +900,9 @@
 	decl	%edx
 	movups	(%rcx),%xmm1
 	leaq	16(%rcx),%rcx
-	jnz	.Loop_enc1_5
+	jnz	.Loop_enc1_5  // loop body is 16 bytes
 	aesenclast	%xmm1,%xmm2
-	pxor	%xmm0,%xmm0
+	pxor	%xmm0,%xmm0  // clear register bank
 	pxor	%xmm1,%xmm1
 	xorps	%xmm3,%xmm2
 	pxor	%xmm3,%xmm3
@@ -912,22 +912,22 @@
 
 .align	16
 .Lctr32_bulk:
-	leaq	(%rsp),%r11
+	leaq	(%rsp),%r11  // use %r11 as frame pointer
 .cfi_def_cfa_register	%r11
 	pushq	%rbp
 .cfi_offset	%rbp,-16
 	subq	$128,%rsp
-	andq	$-16,%rsp
-
-
+	andq	$-16,%rsp  // Linux kernel stack can be incorrectly seeded
 
+// 8 16-byte words on top of stack are counter values
+// xor-ed with zero-round key
 
 	movdqu	(%r8),%xmm2
 	movdqu	(%rcx),%xmm0
-	movl	12(%r8),%r8d
+	movl	12(%r8),%r8d  // counter LSB
 	pxor	%xmm0,%xmm2
-	movl	12(%rcx),%ebp
-	movdqa	%xmm2,0(%rsp)
+	movl	12(%rcx),%ebp  // 0-round key LSB
+	movdqa	%xmm2,0(%rsp)  // populate counter block
 	bswapl	%r8d
 	movdqa	%xmm2,%xmm3
 	movdqa	%xmm2,%xmm4
@@ -935,7 +935,7 @@
 	movdqa	%xmm2,64(%rsp)
 	movdqa	%xmm2,80(%rsp)
 	movdqa	%xmm2,96(%rsp)
-	movq	%rdx,%r10
+	movq	%rdx,%r10  // about to borrow %rdx
 	movdqa	%xmm2,112(%rsp)
 
 	leaq	1(%r8),%rax
@@ -949,7 +949,7 @@
 	movdqa	%xmm3,16(%rsp)
 	pinsrd	$3,%edx,%xmm4
 	bswapl	%eax
-	movq	%r10,%rdx
+	movq	%r10,%rdx  // restore %rdx
 	leaq	4(%r8),%r10
 	movdqa	%xmm4,32(%rsp)
 	xorl	%ebp,%eax
@@ -961,7 +961,7 @@
 	movl	%r10d,64+12(%rsp)
 	bswapl	%r9d
 	leaq	6(%r8),%r10
-	movl	240(%rcx),%eax
+	movl	240(%rcx),%eax  // key->rounds
 	xorl	%ebp,%r9d
 	bswapl	%r10d
 	movl	%r9d,80+12(%rsp)
@@ -977,16 +977,16 @@
 	movdqa	64(%rsp),%xmm6
 	movdqa	80(%rsp),%xmm7
 
-	cmpq	$8,%rdx
-	jb	.Lctr32_tail
+	cmpq	$8,%rdx  // %rdx is in blocks
+	jb	.Lctr32_tail  // short input if (%rdx<8)
 
-	leaq	128(%rcx),%rcx
-	subq	$8,%rdx
+	leaq	128(%rcx),%rcx  // size optimization
+	subq	$8,%rdx  // %rdx is biased by -8
 	jmp	.Lctr32_loop8
 
 .align	32
 .Lctr32_loop8:
-	addl	$8,%r8d
+	addl	$8,%r8d  // next counter value
 	movdqa	96(%rsp),%xmm8
 	aesenc	%xmm1,%xmm2
 	movl	%r8d,%r9d
@@ -998,7 +998,7 @@
 	xorl	%ebp,%r9d
 	nop
 	aesenc	%xmm1,%xmm5
-	movl	%r9d,0+12(%rsp)
+	movl	%r9d,0+12(%rsp)  // store next counter value
 	leaq	1(%r8),%r9
 	aesenc	%xmm1,%xmm6
 	aesenc	%xmm1,%xmm7
@@ -1094,7 +1094,7 @@
 	aesenc	%xmm0,%xmm3
 	aesenc	%xmm0,%xmm4
 	xorl	%ebp,%r9d
-	movdqu	0(%rdi),%xmm10
+	movdqu	0(%rdi),%xmm10  // start loading input
 	aesenc	%xmm0,%xmm5
 	movl	%r9d,112+12(%rsp)
 	cmpl	$11,%eax
@@ -1151,7 +1151,7 @@
 .align	16
 .Lctr32_enc_done:
 	movdqu	16(%rdi),%xmm11
-	pxor	%xmm0,%xmm10
+	pxor	%xmm0,%xmm10  // input^=roundlast
 	movdqu	32(%rdi),%xmm12
 	pxor	%xmm0,%xmm11
 	movdqu	48(%rdi),%xmm13
@@ -1160,8 +1160,8 @@
 	pxor	%xmm0,%xmm13
 	movdqu	80(%rdi),%xmm15
 	pxor	%xmm0,%xmm14
-	prefetcht0	448(%rdi)
-	prefetcht0	512(%rdi)
+	prefetcht0	448(%rdi)  // We process 128 bytes (8*16), so to prefetch 1 iteration
+	prefetcht0	512(%rdi)  // We need to prefetch 2 64 byte lines
 	pxor	%xmm0,%xmm15
 	aesenc	%xmm1,%xmm2
 	aesenc	%xmm1,%xmm3
@@ -1171,15 +1171,15 @@
 	aesenc	%xmm1,%xmm7
 	aesenc	%xmm1,%xmm8
 	aesenc	%xmm1,%xmm9
-	movdqu	96(%rdi),%xmm1
-	leaq	128(%rdi),%rdi
+	movdqu	96(%rdi),%xmm1  // borrow %xmm1 for inp6
+	leaq	128(%rdi),%rdi  // %rdi+=8*16
 
-	aesenclast	%xmm10,%xmm2
-	pxor	%xmm0,%xmm1
+	aesenclast	%xmm10,%xmm2  // is inpN^roundlast
+	pxor	%xmm0,%xmm1  // borrowed
 	movdqu	112-128(%rdi),%xmm10
 	aesenclast	%xmm11,%xmm3
 	pxor	%xmm0,%xmm10
-	movdqa	0(%rsp),%xmm11
+	movdqa	0(%rsp),%xmm11  // load next counter block
 	aesenclast	%xmm12,%xmm4
 	aesenclast	%xmm13,%xmm5
 	movdqa	16(%rsp),%xmm12
@@ -1190,10 +1190,10 @@
 	movdqa	64(%rsp),%xmm15
 	aesenclast	%xmm1,%xmm8
 	movdqa	80(%rsp),%xmm0
-	movups	16-128(%rcx),%xmm1
+	movups	16-128(%rcx),%xmm1  // real 1st-round key
 	aesenclast	%xmm10,%xmm9
 
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store 8 output blocks
 	movdqa	%xmm11,%xmm2
 	movups	%xmm3,16(%rsi)
 	movdqa	%xmm12,%xmm3
@@ -1207,24 +1207,24 @@
 	movdqa	%xmm0,%xmm7
 	movups	%xmm8,96(%rsi)
 	movups	%xmm9,112(%rsi)
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // %rsi+=8*16
 
 	subq	$8,%rdx
-	jnc	.Lctr32_loop8
+	jnc	.Lctr32_loop8  // loop if %rdx-=8 didn't borrow
 
-	addq	$8,%rdx
-	jz	.Lctr32_done
+	addq	$8,%rdx  // restore real remaining %rdx
+	jz	.Lctr32_done  // done if (%rdx==0)
 	leaq	-128(%rcx),%rcx
 
 .Lctr32_tail:
-
-
+// note that at this point %xmm2..5 are populated with
+// counter values xor-ed with 0-round key
 	leaq	16(%rcx),%rcx
 	cmpq	$4,%rdx
 	jb	.Lctr32_loop3
 	je	.Lctr32_loop4
 
-
+// if (%rdx>4) compute 7 E(counter)
 	shll	$4,%eax
 	movdqa	96(%rsp),%xmm8
 	pxor	%xmm9,%xmm9
@@ -1232,14 +1232,14 @@
 	movups	16(%rcx),%xmm0
 	aesenc	%xmm1,%xmm2
 	aesenc	%xmm1,%xmm3
-	leaq	32-16(%rcx,%rax,1),%rcx
+	leaq	32-16(%rcx,%rax,1),%rcx  // prepare for .Lenc_loop8_enter
 	negq	%rax
 	aesenc	%xmm1,%xmm4
-	addq	$16,%rax
+	addq	$16,%rax  // prepare for .Lenc_loop8_enter
 	movups	(%rdi),%xmm10
 	aesenc	%xmm1,%xmm5
 	aesenc	%xmm1,%xmm6
-	movups	16(%rdi),%xmm11
+	movups	16(%rdi),%xmm11  // pre-load input
 	movups	32(%rdi),%xmm12
 	aesenc	%xmm1,%xmm7
 	aesenc	%xmm1,%xmm8
@@ -1250,7 +1250,7 @@
 	pxor	%xmm10,%xmm2
 	movdqu	64(%rdi),%xmm10
 	pxor	%xmm11,%xmm3
-	movdqu	%xmm2,(%rsi)
+	movdqu	%xmm2,(%rsi)  // store output
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm3,16(%rsi)
 	pxor	%xmm13,%xmm5
@@ -1259,17 +1259,17 @@
 	movdqu	%xmm5,48(%rsi)
 	movdqu	%xmm6,64(%rsi)
 	cmpq	$6,%rdx
-	jb	.Lctr32_done
+	jb	.Lctr32_done  // %rdx was 5, stop store
 
 	movups	80(%rdi),%xmm11
 	xorps	%xmm11,%xmm7
 	movups	%xmm7,80(%rsi)
-	je	.Lctr32_done
+	je	.Lctr32_done  // %rdx was 6, stop store
 
 	movups	96(%rdi),%xmm12
 	xorps	%xmm12,%xmm8
 	movups	%xmm8,96(%rsi)
-	jmp	.Lctr32_done
+	jmp	.Lctr32_done  // %rdx was 7, stop store
 
 .align	32
 .Lctr32_loop4:
@@ -1283,7 +1283,7 @@
 	jnz	.Lctr32_loop4
 	aesenclast	%xmm1,%xmm2
 	aesenclast	%xmm1,%xmm3
-	movups	(%rdi),%xmm10
+	movups	(%rdi),%xmm10  // load input
 	movups	16(%rdi),%xmm11
 	aesenclast	%xmm1,%xmm4
 	aesenclast	%xmm1,%xmm5
@@ -1291,14 +1291,14 @@
 	movups	48(%rdi),%xmm13
 
 	xorps	%xmm10,%xmm2
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store output
 	xorps	%xmm11,%xmm3
 	movups	%xmm3,16(%rsi)
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm4,32(%rsi)
 	pxor	%xmm13,%xmm5
 	movdqu	%xmm5,48(%rsi)
-	jmp	.Lctr32_done
+	jmp	.Lctr32_done  // %rdx was 4, stop store
 
 .align	32
 .Lctr32_loop3:
@@ -1313,23 +1313,23 @@
 	aesenclast	%xmm1,%xmm3
 	aesenclast	%xmm1,%xmm4
 
-	movups	(%rdi),%xmm10
+	movups	(%rdi),%xmm10  // load input
 	xorps	%xmm10,%xmm2
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store output
 	cmpq	$2,%rdx
-	jb	.Lctr32_done
+	jb	.Lctr32_done  // %rdx was 1, stop store
 
 	movups	16(%rdi),%xmm11
 	xorps	%xmm11,%xmm3
 	movups	%xmm3,16(%rsi)
-	je	.Lctr32_done
+	je	.Lctr32_done  // %rdx was 2, stop store
 
 	movups	32(%rdi),%xmm12
 	xorps	%xmm12,%xmm4
-	movups	%xmm4,32(%rsi)
+	movups	%xmm4,32(%rsi)  // %rdx was 3, stop store
 
 .Lctr32_done:
-	xorps	%xmm0,%xmm0
+	xorps	%xmm0,%xmm0  // clear register bank
 	xorl	%ebp,%ebp
 	pxor	%xmm1,%xmm1
 	pxor	%xmm2,%xmm2
@@ -1338,7 +1338,7 @@
 	pxor	%xmm5,%xmm5
 	pxor	%xmm6,%xmm6
 	pxor	%xmm7,%xmm7
-	movaps	%xmm0,0(%rsp)
+	movaps	%xmm0,0(%rsp)  // clear stack
 	pxor	%xmm8,%xmm8
 	movaps	%xmm0,16(%rsp)
 	pxor	%xmm9,%xmm9
@@ -1369,15 +1369,15 @@
 aes_hw_cbc_encrypt:
 .cfi_startproc	
 _CET_ENDBR
-	testq	%rdx,%rdx
+	testq	%rdx,%rdx  // check length
 	jz	.Lcbc_ret
 
-	movl	240(%rcx),%r10d
-	movq	%rcx,%r11
-	testl	%r9d,%r9d
+	movl	240(%rcx),%r10d  // key->rounds
+	movq	%rcx,%r11  // backup %rcx
+	testl	%r9d,%r9d  // 6th argument
 	jz	.Lcbc_decrypt
-
-	movups	(%r8),%xmm2
+//  --------------------------- CBC ENCRYPT ------------------------------
+	movups	(%r8),%xmm2  // load iv as initial state
 	movl	%r10d,%eax
 	cmpq	$16,%rdx
 	jb	.Lcbc_enc_tail
@@ -1385,9 +1385,9 @@
 	jmp	.Lcbc_enc_loop
 .align	16
 .Lcbc_enc_loop:
-	movups	(%rdi),%xmm3
+	movups	(%rdi),%xmm3  // load input
 	leaq	16(%rdi),%rdi
-
+// xorps	%xmm3,%xmm2
 	movups	(%rcx),%xmm0
 	movups	16(%rcx),%xmm1
 	xorps	%xmm0,%xmm3
@@ -1398,17 +1398,17 @@
 	decl	%eax
 	movups	(%rcx),%xmm1
 	leaq	16(%rcx),%rcx
-	jnz	.Loop_enc1_6
+	jnz	.Loop_enc1_6  // loop body is 16 bytes
 	aesenclast	%xmm1,%xmm2
-	movl	%r10d,%eax
-	movq	%r11,%rcx
-	movups	%xmm2,0(%rsi)
+	movl	%r10d,%eax  // restore %eax
+	movq	%r11,%rcx  // restore %rcx
+	movups	%xmm2,0(%rsi)  // store output
 	leaq	16(%rsi),%rsi
 	subq	$16,%rdx
 	jnc	.Lcbc_enc_loop
 	addq	$16,%rdx
 	jnz	.Lcbc_enc_tail
-	pxor	%xmm0,%xmm0
+	pxor	%xmm0,%xmm0  // clear register bank
 	pxor	%xmm1,%xmm1
 	movups	%xmm2,(%r8)
 	pxor	%xmm2,%xmm2
@@ -1416,30 +1416,30 @@
 	jmp	.Lcbc_ret
 
 .Lcbc_enc_tail:
-	movq	%rdx,%rcx
-	xchgq	%rdi,%rsi
-.long	0x9066A4F3
-	movl	$16,%ecx
+	movq	%rdx,%rcx  // zaps %rcx
+	xchgq	%rdi,%rsi  // %rdi is %rsi and %rsi is %rdi now
+.long	0x9066A4F3  // rep movsb
+	movl	$16,%ecx  // zero tail
 	subq	%rdx,%rcx
 	xorl	%eax,%eax
-.long	0x9066AAF3
-	leaq	-16(%rdi),%rdi
-	movl	%r10d,%eax
-	movq	%rdi,%rsi
-	movq	%r11,%rcx
-	xorq	%rdx,%rdx
-	jmp	.Lcbc_enc_loop
-
+.long	0x9066AAF3  // rep stosb
+	leaq	-16(%rdi),%rdi  // rewind %rsi by 1 block
+	movl	%r10d,%eax  // restore %eax
+	movq	%rdi,%rsi  // %rdi and %rsi are the same
+	movq	%r11,%rcx  // restore %rcx
+	xorq	%rdx,%rdx  // len=16
+	jmp	.Lcbc_enc_loop  // one more spin
+// --------------------------- CBC DECRYPT ------------------------------#
 .align	16
 .Lcbc_decrypt:
 	cmpq	$16,%rdx
 	jne	.Lcbc_decrypt_bulk
 
-
-
-	movdqu	(%rdi),%xmm2
-	movdqu	(%r8),%xmm3
-	movdqa	%xmm2,%xmm4
+// handle single block without allocating stack frame,
+// useful in ciphertext stealing mode
+	movdqu	(%rdi),%xmm2  // load input
+	movdqu	(%r8),%xmm3  // load iv
+	movdqa	%xmm2,%xmm4  // future iv
 	movups	(%rcx),%xmm0
 	movups	16(%rcx),%xmm1
 	leaq	32(%rcx),%rcx
@@ -1449,32 +1449,32 @@
 	decl	%r10d
 	movups	(%rcx),%xmm1
 	leaq	16(%rcx),%rcx
-	jnz	.Loop_dec1_7
+	jnz	.Loop_dec1_7  // loop body is 16 bytes
 	aesdeclast	%xmm1,%xmm2
-	pxor	%xmm0,%xmm0
+	pxor	%xmm0,%xmm0  // clear register bank
 	pxor	%xmm1,%xmm1
-	movdqu	%xmm4,(%r8)
-	xorps	%xmm3,%xmm2
+	movdqu	%xmm4,(%r8)  // store iv
+	xorps	%xmm3,%xmm2  // ^=iv
 	pxor	%xmm3,%xmm3
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store output
 	pxor	%xmm2,%xmm2
 	jmp	.Lcbc_ret
 .align	16
 .Lcbc_decrypt_bulk:
-	leaq	(%rsp),%r11
+	leaq	(%rsp),%r11  // frame pointer
 .cfi_def_cfa_register	%r11
 	pushq	%rbp
 .cfi_offset	%rbp,-16
 	subq	$16,%rsp
-	andq	$-16,%rsp
-	movq	%rcx,%rbp
+	andq	$-16,%rsp  // Linux kernel stack can be incorrectly seeded
+	movq	%rcx,%rbp  // re-backup %rcx after reassignment
 	movups	(%r8),%xmm10
 	movl	%r10d,%eax
 	cmpq	$0x50,%rdx
 	jbe	.Lcbc_dec_tail
 
 	movups	(%rcx),%xmm0
-	movdqu	0(%rdi),%xmm2
+	movdqu	0(%rdi),%xmm2  // load input
 	movdqu	16(%rdi),%xmm3
 	movdqa	%xmm2,%xmm11
 	movdqu	32(%rdi),%xmm4
@@ -1488,8 +1488,8 @@
 	cmpq	$0x70,%rdx
 	jbe	.Lcbc_dec_six_or_seven
 
-	subq	$0x70,%rdx
-	leaq	112(%rcx),%rcx
+	subq	$0x70,%rdx  // %rdx is biased by -7*16
+	leaq	112(%rcx),%rcx  // size optimization
 	jmp	.Lcbc_dec_loop8_enter
 .align	16
 .Lcbc_dec_loop8:
@@ -1503,7 +1503,7 @@
 	movups	16-112(%rcx),%xmm1
 	pxor	%xmm0,%xmm4
 	movq	$-1,%rbp
-	cmpq	$0x70,%rdx
+	cmpq	$0x70,%rdx  // is there at least 0x60 bytes ahead?
 	pxor	%xmm0,%xmm5
 	pxor	%xmm0,%xmm6
 	pxor	%xmm0,%xmm7
@@ -1652,11 +1652,11 @@
 	movdqu	80(%rdi),%xmm1
 
 	aesdeclast	%xmm10,%xmm2
-	movdqu	96(%rdi),%xmm10
+	movdqu	96(%rdi),%xmm10  // borrow %xmm10
 	pxor	%xmm0,%xmm1
 	aesdeclast	%xmm11,%xmm3
 	pxor	%xmm0,%xmm10
-	movdqu	112(%rdi),%xmm0
+	movdqu	112(%rdi),%xmm0  // next IV
 	aesdeclast	%xmm12,%xmm4
 	leaq	128(%rdi),%rdi
 	movdqu	0(%rbp),%xmm11
@@ -1669,11 +1669,11 @@
 	movdqu	48(%rbp),%xmm14
 	movdqu	64(%rbp),%xmm15
 	aesdeclast	%xmm10,%xmm9
-	movdqa	%xmm0,%xmm10
+	movdqa	%xmm0,%xmm10  // return %xmm10
 	movdqu	80(%rbp),%xmm1
 	movups	-112(%rcx),%xmm0
 
-	movups	%xmm2,(%rsi)
+	movups	%xmm2,(%rsi)  // store output
 	movdqa	%xmm11,%xmm2
 	movups	%xmm3,16(%rsi)
 	movdqa	%xmm12,%xmm3
@@ -1707,13 +1707,13 @@
 
 	movaps	%xmm7,%xmm8
 	call	_aesni_decrypt6
-	pxor	%xmm10,%xmm2
+	pxor	%xmm10,%xmm2  // ^= IV
 	movaps	%xmm8,%xmm10
 	pxor	%xmm11,%xmm3
 	movdqu	%xmm2,(%rsi)
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm3,16(%rsi)
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	pxor	%xmm13,%xmm5
 	movdqu	%xmm4,32(%rsi)
 	pxor	%xmm4,%xmm4
@@ -1734,13 +1734,13 @@
 	xorps	%xmm9,%xmm9
 	call	_aesni_decrypt8
 	movups	80(%rdi),%xmm9
-	pxor	%xmm10,%xmm2
+	pxor	%xmm10,%xmm2  // ^= IV
 	movups	96(%rdi),%xmm10
 	pxor	%xmm11,%xmm3
 	movdqu	%xmm2,(%rsi)
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm3,16(%rsi)
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	pxor	%xmm13,%xmm5
 	movdqu	%xmm4,32(%rsi)
 	pxor	%xmm4,%xmm4
@@ -1762,24 +1762,24 @@
 .Lcbc_dec_tail:
 	movups	(%rdi),%xmm2
 	subq	$0x10,%rdx
-	jbe	.Lcbc_dec_one
+	jbe	.Lcbc_dec_one  // %rdx is 1*16 or less
 
 	movups	16(%rdi),%xmm3
 	movaps	%xmm2,%xmm11
 	subq	$0x10,%rdx
-	jbe	.Lcbc_dec_two
+	jbe	.Lcbc_dec_two  // %rdx is 2*16 or less
 
 	movups	32(%rdi),%xmm4
 	movaps	%xmm3,%xmm12
 	subq	$0x10,%rdx
-	jbe	.Lcbc_dec_three
+	jbe	.Lcbc_dec_three  // %rdx is 3*16 or less
 
 	movups	48(%rdi),%xmm5
 	movaps	%xmm4,%xmm13
 	subq	$0x10,%rdx
-	jbe	.Lcbc_dec_four
+	jbe	.Lcbc_dec_four  // %rdx is 4*16 or less
 
-	movups	64(%rdi),%xmm6
+	movups	64(%rdi),%xmm6  // %rdx is 5*16 or less
 	movaps	%xmm5,%xmm14
 	movaps	%xmm6,%xmm15
 	xorps	%xmm7,%xmm7
@@ -1790,7 +1790,7 @@
 	movdqu	%xmm2,(%rsi)
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm3,16(%rsi)
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	pxor	%xmm13,%xmm5
 	movdqu	%xmm4,32(%rsi)
 	pxor	%xmm4,%xmm4
@@ -1816,7 +1816,7 @@
 	decl	%eax
 	movups	(%rcx),%xmm1
 	leaq	16(%rcx),%rcx
-	jnz	.Loop_dec1_8
+	jnz	.Loop_dec1_8  // loop body is 16 bytes
 	aesdeclast	%xmm1,%xmm2
 	xorps	%xmm10,%xmm2
 	movaps	%xmm11,%xmm10
@@ -1830,7 +1830,7 @@
 	pxor	%xmm11,%xmm3
 	movdqu	%xmm2,(%rsi)
 	movdqa	%xmm3,%xmm2
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	leaq	16(%rsi),%rsi
 	jmp	.Lcbc_dec_tail_collected
 .align	16
@@ -1843,7 +1843,7 @@
 	movdqu	%xmm2,(%rsi)
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm3,16(%rsi)
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	movdqa	%xmm4,%xmm2
 	pxor	%xmm4,%xmm4
 	leaq	32(%rsi),%rsi
@@ -1858,7 +1858,7 @@
 	movdqu	%xmm2,(%rsi)
 	pxor	%xmm12,%xmm4
 	movdqu	%xmm3,16(%rsi)
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	pxor	%xmm13,%xmm5
 	movdqu	%xmm4,32(%rsi)
 	pxor	%xmm4,%xmm4
@@ -1869,10 +1869,10 @@
 
 .align	16
 .Lcbc_dec_clear_tail_collected:
-	pxor	%xmm3,%xmm3
+	pxor	%xmm3,%xmm3  // clear register bank
 	pxor	%xmm4,%xmm4
 	pxor	%xmm5,%xmm5
-	pxor	%xmm6,%xmm6
+	pxor	%xmm6,%xmm6  // %xmm6..9
 	pxor	%xmm7,%xmm7
 	pxor	%xmm8,%xmm8
 	pxor	%xmm9,%xmm9
@@ -1891,11 +1891,11 @@
 	movq	%rsi,%rdi
 	subq	%rdx,%rcx
 	leaq	(%rsp),%rsi
-.long	0x9066A4F3
+.long	0x9066A4F3  // rep movsb
 	movdqa	%xmm2,(%rsp)
 
 .Lcbc_dec_ret:
-	xorps	%xmm0,%xmm0
+	xorps	%xmm0,%xmm0  // %xmm0
 	pxor	%xmm1,%xmm1
 	movq	-8(%r11),%rbp
 .cfi_restore	%rbp
@@ -1916,9 +1916,9 @@
 	movl	240(%rdi),%esi
 	shll	$4,%esi
 
-	leaq	16(%rdi,%rsi,1),%rdx
+	leaq	16(%rdi,%rsi,1),%rdx  // points at the end of key schedule
 
-	movups	(%rdi),%xmm0
+	movups	(%rdi),%xmm0  // just swap
 	movups	(%rdx),%xmm1
 	movups	%xmm0,(%rdx)
 	movups	%xmm1,(%rdi)
@@ -1926,7 +1926,7 @@
 	leaq	-16(%rdx),%rdx
 
 .Ldec_key_inverse:
-	movups	(%rdi),%xmm0
+	movups	(%rdi),%xmm0  // swap and inverse
 	movups	(%rdx),%xmm1
 	aesimc	%xmm0,%xmm0
 	aesimc	%xmm1,%xmm1
@@ -1937,7 +1937,7 @@
 	cmpq	%rdi,%rdx
 	ja	.Ldec_key_inverse
 
-	movups	(%rdi),%xmm0
+	movups	(%rdi),%xmm0  // inverse middle
 	aesimc	%xmm0,%xmm0
 	pxor	%xmm1,%xmm1
 	movups	%xmm0,(%rdx)
@@ -1960,9 +1960,9 @@
 .cfi_adjust_cfa_offset	8
 
 
-	movups	(%rdi),%xmm0
-	xorps	%xmm4,%xmm4
-	leaq	16(%rdx),%rax
+	movups	(%rdi),%xmm0  // pull first 128 bits of *userKey
+	xorps	%xmm4,%xmm4  // low dword of xmm4 is assumed 0
+	leaq	16(%rdx),%rax  // %rax is used as modifiable copy of %rdx
 	cmpl	$256,%esi
 	je	.L14rounds
 	cmpl	$192,%esi
@@ -1971,97 +1971,97 @@
 	jne	.Lbad_keybits
 
 .L10rounds:
-	movl	$9,%esi
+	movl	$9,%esi  // 10 rounds for 128-bit key
 
-	movups	%xmm0,(%rdx)
-	aeskeygenassist	$0x1,%xmm0,%xmm1
+	movups	%xmm0,(%rdx)  // round 0
+	aeskeygenassist	$0x1,%xmm0,%xmm1  // round 1
 	call	.Lkey_expansion_128_cold
-	aeskeygenassist	$0x2,%xmm0,%xmm1
+	aeskeygenassist	$0x2,%xmm0,%xmm1  // round 2
 	call	.Lkey_expansion_128
-	aeskeygenassist	$0x4,%xmm0,%xmm1
+	aeskeygenassist	$0x4,%xmm0,%xmm1  // round 3
 	call	.Lkey_expansion_128
-	aeskeygenassist	$0x8,%xmm0,%xmm1
+	aeskeygenassist	$0x8,%xmm0,%xmm1  // round 4
 	call	.Lkey_expansion_128
-	aeskeygenassist	$0x10,%xmm0,%xmm1
+	aeskeygenassist	$0x10,%xmm0,%xmm1  // round 5
 	call	.Lkey_expansion_128
-	aeskeygenassist	$0x20,%xmm0,%xmm1
+	aeskeygenassist	$0x20,%xmm0,%xmm1  // round 6
 	call	.Lkey_expansion_128
-	aeskeygenassist	$0x40,%xmm0,%xmm1
+	aeskeygenassist	$0x40,%xmm0,%xmm1  // round 7
 	call	.Lkey_expansion_128
-	aeskeygenassist	$0x80,%xmm0,%xmm1
+	aeskeygenassist	$0x80,%xmm0,%xmm1  // round 8
 	call	.Lkey_expansion_128
-	aeskeygenassist	$0x1b,%xmm0,%xmm1
+	aeskeygenassist	$0x1b,%xmm0,%xmm1  // round 9
 	call	.Lkey_expansion_128
-	aeskeygenassist	$0x36,%xmm0,%xmm1
+	aeskeygenassist	$0x36,%xmm0,%xmm1  // round 10
 	call	.Lkey_expansion_128
 	movups	%xmm0,(%rax)
-	movl	%esi,80(%rax)
+	movl	%esi,80(%rax)  // 240(%rdx)
 	xorl	%eax,%eax
 	jmp	.Lenc_key_ret
 
 .align	16
 .L12rounds:
-	movq	16(%rdi),%xmm2
-	movl	$11,%esi
+	movq	16(%rdi),%xmm2  // remaining 1/3 of *userKey
+	movl	$11,%esi  // 12 rounds for 192
 
-	movups	%xmm0,(%rdx)
-	aeskeygenassist	$0x1,%xmm2,%xmm1
+	movups	%xmm0,(%rdx)  // round 0
+	aeskeygenassist	$0x1,%xmm2,%xmm1  // round 1,2
 	call	.Lkey_expansion_192a_cold
-	aeskeygenassist	$0x2,%xmm2,%xmm1
+	aeskeygenassist	$0x2,%xmm2,%xmm1  // round 2,3
 	call	.Lkey_expansion_192b
-	aeskeygenassist	$0x4,%xmm2,%xmm1
+	aeskeygenassist	$0x4,%xmm2,%xmm1  // round 4,5
 	call	.Lkey_expansion_192a
-	aeskeygenassist	$0x8,%xmm2,%xmm1
+	aeskeygenassist	$0x8,%xmm2,%xmm1  // round 5,6
 	call	.Lkey_expansion_192b
-	aeskeygenassist	$0x10,%xmm2,%xmm1
+	aeskeygenassist	$0x10,%xmm2,%xmm1  // round 7,8
 	call	.Lkey_expansion_192a
-	aeskeygenassist	$0x20,%xmm2,%xmm1
+	aeskeygenassist	$0x20,%xmm2,%xmm1  // round 8,9
 	call	.Lkey_expansion_192b
-	aeskeygenassist	$0x40,%xmm2,%xmm1
+	aeskeygenassist	$0x40,%xmm2,%xmm1  // round 10,11
 	call	.Lkey_expansion_192a
-	aeskeygenassist	$0x80,%xmm2,%xmm1
+	aeskeygenassist	$0x80,%xmm2,%xmm1  // round 11,12
 	call	.Lkey_expansion_192b
 	movups	%xmm0,(%rax)
-	movl	%esi,48(%rax)
+	movl	%esi,48(%rax)  // 240(%rdx)
 	xorq	%rax,%rax
 	jmp	.Lenc_key_ret
 
 .align	16
 .L14rounds:
-	movups	16(%rdi),%xmm2
-	movl	$13,%esi
+	movups	16(%rdi),%xmm2  // remaining half of *userKey
+	movl	$13,%esi  // 14 rounds for 256
 	leaq	16(%rax),%rax
 
-	movups	%xmm0,(%rdx)
-	movups	%xmm2,16(%rdx)
-	aeskeygenassist	$0x1,%xmm2,%xmm1
+	movups	%xmm0,(%rdx)  // round 0
+	movups	%xmm2,16(%rdx)  // round 1
+	aeskeygenassist	$0x1,%xmm2,%xmm1  // round 2
 	call	.Lkey_expansion_256a_cold
-	aeskeygenassist	$0x1,%xmm0,%xmm1
+	aeskeygenassist	$0x1,%xmm0,%xmm1  // round 3
 	call	.Lkey_expansion_256b
-	aeskeygenassist	$0x2,%xmm2,%xmm1
+	aeskeygenassist	$0x2,%xmm2,%xmm1  // round 4
 	call	.Lkey_expansion_256a
-	aeskeygenassist	$0x2,%xmm0,%xmm1
+	aeskeygenassist	$0x2,%xmm0,%xmm1  // round 5
 	call	.Lkey_expansion_256b
-	aeskeygenassist	$0x4,%xmm2,%xmm1
+	aeskeygenassist	$0x4,%xmm2,%xmm1  // round 6
 	call	.Lkey_expansion_256a
-	aeskeygenassist	$0x4,%xmm0,%xmm1
+	aeskeygenassist	$0x4,%xmm0,%xmm1  // round 7
 	call	.Lkey_expansion_256b
-	aeskeygenassist	$0x8,%xmm2,%xmm1
+	aeskeygenassist	$0x8,%xmm2,%xmm1  // round 8
 	call	.Lkey_expansion_256a
-	aeskeygenassist	$0x8,%xmm0,%xmm1
+	aeskeygenassist	$0x8,%xmm0,%xmm1  // round 9
 	call	.Lkey_expansion_256b
-	aeskeygenassist	$0x10,%xmm2,%xmm1
+	aeskeygenassist	$0x10,%xmm2,%xmm1  // round 10
 	call	.Lkey_expansion_256a
-	aeskeygenassist	$0x10,%xmm0,%xmm1
+	aeskeygenassist	$0x10,%xmm0,%xmm1  // round 11
 	call	.Lkey_expansion_256b
-	aeskeygenassist	$0x20,%xmm2,%xmm1
+	aeskeygenassist	$0x20,%xmm2,%xmm1  // round 12
 	call	.Lkey_expansion_256a
-	aeskeygenassist	$0x20,%xmm0,%xmm1
+	aeskeygenassist	$0x20,%xmm0,%xmm1  // round 13
 	call	.Lkey_expansion_256b
-	aeskeygenassist	$0x40,%xmm2,%xmm1
+	aeskeygenassist	$0x40,%xmm2,%xmm1  // round 14
 	call	.Lkey_expansion_256a
 	movups	%xmm0,(%rax)
-	movl	%esi,16(%rax)
+	movl	%esi,16(%rax)  // 240(%rdx)
 	xorq	%rax,%rax
 	jmp	.Lenc_key_ret
 
@@ -2092,7 +2092,7 @@
 	xorps	%xmm4,%xmm0
 	shufps	$140,%xmm0,%xmm4
 	xorps	%xmm4,%xmm0
-	shufps	$255,%xmm1,%xmm1
+	shufps	$255,%xmm1,%xmm1  // critical path
 	xorps	%xmm1,%xmm0
 	ret
 .cfi_endproc	
@@ -2111,7 +2111,7 @@
 	shufps	$140,%xmm0,%xmm4
 	pslldq	$4,%xmm3
 	xorps	%xmm4,%xmm0
-	pshufd	$85,%xmm1,%xmm1
+	pshufd	$85,%xmm1,%xmm1  // critical path
 	pxor	%xmm3,%xmm2
 	pxor	%xmm1,%xmm0
 	pshufd	$255,%xmm0,%xmm3
@@ -2141,7 +2141,7 @@
 	xorps	%xmm4,%xmm0
 	shufps	$140,%xmm0,%xmm4
 	xorps	%xmm4,%xmm0
-	shufps	$255,%xmm1,%xmm1
+	shufps	$255,%xmm1,%xmm1  // critical path
 	xorps	%xmm1,%xmm0
 	ret
 .cfi_endproc	
@@ -2156,7 +2156,7 @@
 	xorps	%xmm4,%xmm2
 	shufps	$140,%xmm2,%xmm4
 	xorps	%xmm4,%xmm2
-	shufps	$170,%xmm1,%xmm1
+	shufps	$170,%xmm1,%xmm1  // critical path
 	xorps	%xmm1,%xmm2
 	ret
 .cfi_endproc	
@@ -2176,9 +2176,9 @@
 .cfi_adjust_cfa_offset	8
 
 
-	movups	(%rdi),%xmm0
-	xorps	%xmm4,%xmm4
-	leaq	16(%rdx),%rax
+	movups	(%rdi),%xmm0  // pull first 128 bits of *userKey
+	xorps	%xmm4,%xmm4  // low dword of xmm4 is assumed 0
+	leaq	16(%rdx),%rax  // %rax is used as modifiable copy of %rdx
 	cmpl	$256,%esi
 	je	.L14rounds_alt
 	cmpl	$192,%esi
@@ -2186,7 +2186,7 @@
 	cmpl	$128,%esi
 	jne	.Lbad_keybits_alt
 
-	movl	$9,%esi
+	movl	$9,%esi  // 10 rounds for 128-bit key
 	movdqa	.Lkey_rotate(%rip),%xmm5
 	movl	$8,%r10d
 	movdqa	.Lkey_rcon1(%rip),%xmm4
@@ -2248,14 +2248,14 @@
 	pxor	%xmm2,%xmm0
 	movdqu	%xmm0,16(%rax)
 
-	movl	%esi,96(%rax)
+	movl	%esi,96(%rax)  // 240(%rdx)
 	xorl	%eax,%eax
 	jmp	.Lenc_key_ret_alt
 
 .align	16
 .L12rounds_alt:
-	movq	16(%rdi),%xmm2
-	movl	$11,%esi
+	movq	16(%rdi),%xmm2  // remaining 1/3 of *userKey
+	movl	$11,%esi  // 12 rounds for 192
 	movdqa	.Lkey_rotate192(%rip),%xmm5
 	movdqa	.Lkey_rcon1(%rip),%xmm4
 	movl	$8,%r10d
@@ -2291,14 +2291,14 @@
 	decl	%r10d
 	jnz	.Loop_key192
 
-	movl	%esi,32(%rax)
+	movl	%esi,32(%rax)  // 240(%rdx)
 	xorl	%eax,%eax
 	jmp	.Lenc_key_ret_alt
 
 .align	16
 .L14rounds_alt:
-	movups	16(%rdi),%xmm2
-	movl	$13,%esi
+	movups	16(%rdi),%xmm2  // remaining half of *userKey
+	movl	$13,%esi  // 14 rounds for 256
 	leaq	16(%rax),%rax
 	movdqa	.Lkey_rotate(%rip),%xmm5
 	movdqa	.Lkey_rcon1(%rip),%xmm4
@@ -2348,7 +2348,7 @@
 	jmp	.Loop_key256
 
 .Ldone_key256:
-	movl	%esi,16(%rax)
+	movl	%esi,16(%rax)  // 240(%rdx)
 	xorl	%eax,%eax
 	jmp	.Lenc_key_ret_alt

boringssl-0.20260708.tar.xz/gen/bcm/aesni-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/aesni-x86_64-win.asm Changed

@@ -23,8 +23,8 @@
 EXTERN	BORINGSSL_function_hit
 	mov	BYTE((BORINGSSL_function_hit+1)),1
 %endif
-	movups	xmm2,XMMWORDrcx
-	mov	eax,DWORD240+r8
+	movups	xmm2,XMMWORDrcx  ; load input
+	mov	eax,DWORD240+r8  ; key->rounds
 	movups	xmm0,XMMWORDr8
 	movups	xmm1,XMMWORD16+r8
 	lea	r8,32+r8
@@ -34,11 +34,11 @@
 	dec	eax
 	movups	xmm1,XMMWORDr8
 	lea	r8,16+r8
-	jnz	NEAR $L$oop_enc1_1
+	jnz	NEAR $L$oop_enc1_1  ; loop body is 16 bytes
 	aesenclast	xmm2,xmm1
-	pxor	xmm0,xmm0
+	pxor	xmm0,xmm0  ; clear register bank
 	pxor	xmm1,xmm1
-	movups	XMMWORDrdx,xmm2
+	movups	XMMWORDrdx,xmm2  ; output
 	pxor	xmm2,xmm2
 	ret
 
@@ -50,8 +50,8 @@
 aes_hw_decrypt:
 
 _CET_ENDBR
-	movups	xmm2,XMMWORDrcx
-	mov	eax,DWORD240+r8
+	movups	xmm2,XMMWORDrcx  ; load input
+	mov	eax,DWORD240+r8  ; key->rounds
 	movups	xmm0,XMMWORDr8
 	movups	xmm1,XMMWORD16+r8
 	lea	r8,32+r8
@@ -61,11 +61,11 @@
 	dec	eax
 	movups	xmm1,XMMWORDr8
 	lea	r8,16+r8
-	jnz	NEAR $L$oop_dec1_2
+	jnz	NEAR $L$oop_dec1_2  ; loop body is 16 bytes
 	aesdeclast	xmm2,xmm1
-	pxor	xmm0,xmm0
+	pxor	xmm0,xmm0  ; clear register bank
 	pxor	xmm1,xmm1
-	movups	XMMWORDrdx,xmm2
+	movups	XMMWORDrdx,xmm2  ; output
 	pxor	xmm2,xmm2
 	ret
 
@@ -81,7 +81,7 @@
 	xorps	xmm3,xmm0
 	movups	xmm0,XMMWORD32+rcx
 	lea	rcx,32+rax*1+rcx
-	neg	rax
+	neg	rax  ; %eax
 	add	rax,16
 
 $L$enc_loop2:
@@ -112,7 +112,7 @@
 	xorps	xmm3,xmm0
 	movups	xmm0,XMMWORD32+rcx
 	lea	rcx,32+rax*1+rcx
-	neg	rax
+	neg	rax  ; %eax
 	add	rax,16
 
 $L$dec_loop2:
@@ -144,7 +144,7 @@
 	xorps	xmm4,xmm0
 	movups	xmm0,XMMWORD32+rcx
 	lea	rcx,32+rax*1+rcx
-	neg	rax
+	neg	rax  ; %eax
 	add	rax,16
 
 $L$enc_loop3:
@@ -180,7 +180,7 @@
 	xorps	xmm4,xmm0
 	movups	xmm0,XMMWORD32+rcx
 	lea	rcx,32+rax*1+rcx
-	neg	rax
+	neg	rax  ; %eax
 	add	rax,16
 
 $L$dec_loop3:
@@ -217,7 +217,7 @@
 	xorps	xmm5,xmm0
 	movups	xmm0,XMMWORD32+rcx
 	lea	rcx,32+rax*1+rcx
-	neg	rax
+	neg	rax  ; %eax
 	DB	0x0f,0x1f,0x00
 	add	rax,16
 
@@ -259,7 +259,7 @@
 	xorps	xmm5,xmm0
 	movups	xmm0,XMMWORD32+rcx
 	lea	rcx,32+rax*1+rcx
-	neg	rax
+	neg	rax  ; %eax
 	DB	0x0f,0x1f,0x00
 	add	rax,16
 
@@ -300,7 +300,7 @@
 	pxor	xmm4,xmm0
 	aesenc	xmm2,xmm1
 	lea	rcx,32+rax*1+rcx
-	neg	rax
+	neg	rax  ; %eax
 	aesenc	xmm3,xmm1
 	pxor	xmm5,xmm0
 	pxor	xmm6,xmm0
@@ -356,7 +356,7 @@
 	pxor	xmm4,xmm0
 	aesdec	xmm2,xmm1
 	lea	rcx,32+rax*1+rcx
-	neg	rax
+	neg	rax  ; %eax
 	aesdec	xmm3,xmm1
 	pxor	xmm5,xmm0
 	pxor	xmm6,xmm0
@@ -413,7 +413,7 @@
 	pxor	xmm5,xmm0
 	pxor	xmm6,xmm0
 	lea	rcx,32+rax*1+rcx
-	neg	rax
+	neg	rax  ; %eax
 	aesenc	xmm2,xmm1
 	pxor	xmm7,xmm0
 	pxor	xmm8,xmm0
@@ -479,7 +479,7 @@
 	pxor	xmm5,xmm0
 	pxor	xmm6,xmm0
 	lea	rcx,32+rax*1+rcx
-	neg	rax
+	neg	rax  ; %eax
 	aesdec	xmm2,xmm1
 	pxor	xmm7,xmm0
 	pxor	xmm8,xmm0
@@ -550,25 +550,25 @@
 
 _CET_ENDBR
 	lea	rsp,((-88))+rsp
-	movaps	XMMWORDrsp,xmm6
+	movaps	XMMWORDrsp,xmm6  ; offload %xmm6..7
 	movaps	XMMWORD16+rsp,xmm7
 	movaps	XMMWORD32+rsp,xmm8
 	movaps	XMMWORD48+rsp,xmm9
 $L$ecb_enc_body:
-	and	rdx,-16
-	jz	NEAR $L$ecb_ret
+	and	rdx,-16  ; if (%rdx<16)
+	jz	NEAR $L$ecb_ret  ; return
 
-	mov	eax,DWORD240+rcx
+	mov	eax,DWORD240+rcx  ; key->rounds
 	movups	xmm0,XMMWORDrcx
-	mov	r11,rcx
-	mov	r10d,eax
-	test	r8d,r8d
+	mov	r11,rcx  ; backup %rcx
+	mov	r10d,eax  ; backup %eax
+	test	r8d,r8d  ; 5th argument
 	jz	NEAR $L$ecb_decrypt
+; --------------------------- ECB ENCRYPT ------------------------------#
+	cmp	rdx,0x80  ; if (%rdx<8*16)
+	jb	NEAR $L$ecb_enc_tail  ; short input
 
-	cmp	rdx,0x80
-	jb	NEAR $L$ecb_enc_tail
-
-	movdqu	xmm2,XMMWORDrdi
+	movdqu	xmm2,XMMWORDrdi  ; load 8 input blocks
 	movdqu	xmm3,XMMWORD16+rdi
 	movdqu	xmm4,XMMWORD32+rdi
 	movdqu	xmm5,XMMWORD48+rdi
@@ -576,15 +576,15 @@
 	movdqu	xmm7,XMMWORD80+rdi
 	movdqu	xmm8,XMMWORD96+rdi
 	movdqu	xmm9,XMMWORD112+rdi
-	lea	rdi,128+rdi
-	sub	rdx,0x80
+	lea	rdi,128+rdi  ; %rdi+=8*16
+	sub	rdx,0x80  ; %rdx-=8*16 (can be zero)
 	jmp	NEAR $L$ecb_enc_loop8_enter
 ALIGN	16
 $L$ecb_enc_loop8:
-	movups	XMMWORDrsi,xmm2
-	mov	rcx,r11
-	movdqu	xmm2,XMMWORDrdi
-	mov	eax,r10d
+	movups	XMMWORDrsi,xmm2  ; store 8 output blocks
+	mov	rcx,r11  ; restore %rcx
+	movdqu	xmm2,XMMWORDrdi  ; load 8 input blocks
+	mov	eax,r10d  ; restore %eax
 	movups	XMMWORD16+rsi,xmm3
 	movdqu	xmm3,XMMWORD16+rdi
 	movups	XMMWORD32+rsi,xmm4
@@ -598,31 +598,31 @@
 	movups	XMMWORD96+rsi,xmm8
 	movdqu	xmm8,XMMWORD96+rdi
 	movups	XMMWORD112+rsi,xmm9
-	lea	rsi,128+rsi
+	lea	rsi,128+rsi  ; %rsi+=8*16
 	movdqu	xmm9,XMMWORD112+rdi
-	lea	rdi,128+rdi
+	lea	rdi,128+rdi  ; %rdi+=8*16
 $L$ecb_enc_loop8_enter:
 
 	call	_aesni_encrypt8
 
 	sub	rdx,0x80
-	jnc	NEAR $L$ecb_enc_loop8
+	jnc	NEAR $L$ecb_enc_loop8  ; loop if %rdx-=8*16 didn't borrow
 
-	movups	XMMWORDrsi,xmm2
-	mov	rcx,r11
+	movups	XMMWORDrsi,xmm2  ; store 8 output blocks
+	mov	rcx,r11  ; restore %rcx
 	movups	XMMWORD16+rsi,xmm3
-	mov	eax,r10d
+	mov	eax,r10d  ; restore %eax
 	movups	XMMWORD32+rsi,xmm4
 	movups	XMMWORD48+rsi,xmm5
 	movups	XMMWORD64+rsi,xmm6
 	movups	XMMWORD80+rsi,xmm7
 	movups	XMMWORD96+rsi,xmm8
 	movups	XMMWORD112+rsi,xmm9
-	lea	rsi,128+rsi
-	add	rdx,0x80
-	jz	NEAR $L$ecb_ret
+	lea	rsi,128+rsi  ; %rsi+=8*16
+	add	rdx,0x80  ; restore real remaining %rdx
+	jz	NEAR $L$ecb_ret  ; done if (%rdx==0)
 
-$L$ecb_enc_tail:
+$L$ecb_enc_tail:  ; %rdx is less than 8*16
 	movups	xmm2,XMMWORDrdi
 	cmp	rdx,0x20
 	jb	NEAR $L$ecb_enc_one
@@ -641,7 +641,7 @@
 	movdqu	xmm8,XMMWORD96+rdi
 	xorps	xmm9,xmm9
 	call	_aesni_encrypt8
-	movups	XMMWORDrsi,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 7 output blocks
 	movups	XMMWORD16+rsi,xmm3
 	movups	XMMWORD32+rsi,xmm4
 	movups	XMMWORD48+rsi,xmm5
@@ -660,27 +660,27 @@
 	dec	eax
 	movups	xmm1,XMMWORDrcx
 	lea	rcx,16+rcx
-	jnz	NEAR $L$oop_enc1_3
+	jnz	NEAR $L$oop_enc1_3  ; loop body is 16 bytes
 	aesenclast	xmm2,xmm1
-	movups	XMMWORDrsi,xmm2
+	movups	XMMWORDrsi,xmm2  ; store one output block
 	jmp	NEAR $L$ecb_ret
 ALIGN	16
 $L$ecb_enc_two:
 	call	_aesni_encrypt2
-	movups	XMMWORDrsi,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 2 output blocks
 	movups	XMMWORD16+rsi,xmm3
 	jmp	NEAR $L$ecb_ret
 ALIGN	16
 $L$ecb_enc_three:
 	call	_aesni_encrypt3
-	movups	XMMWORDrsi,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 3 output blocks
 	movups	XMMWORD16+rsi,xmm3
 	movups	XMMWORD32+rsi,xmm4
 	jmp	NEAR $L$ecb_ret
 ALIGN	16
 $L$ecb_enc_four:
 	call	_aesni_encrypt4
-	movups	XMMWORDrsi,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 4 output blocks
 	movups	XMMWORD16+rsi,xmm3
 	movups	XMMWORD32+rsi,xmm4
 	movups	XMMWORD48+rsi,xmm5
@@ -689,7 +689,7 @@
 $L$ecb_enc_five:
 	xorps	xmm7,xmm7
 	call	_aesni_encrypt6
-	movups	XMMWORDrsi,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 5 output blocks
 	movups	XMMWORD16+rsi,xmm3
 	movups	XMMWORD32+rsi,xmm4
 	movups	XMMWORD48+rsi,xmm5
@@ -698,20 +698,20 @@
 ALIGN	16
 $L$ecb_enc_six:
 	call	_aesni_encrypt6
-	movups	XMMWORDrsi,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 6 output blocks
 	movups	XMMWORD16+rsi,xmm3
 	movups	XMMWORD32+rsi,xmm4
 	movups	XMMWORD48+rsi,xmm5
 	movups	XMMWORD64+rsi,xmm6
 	movups	XMMWORD80+rsi,xmm7
 	jmp	NEAR $L$ecb_ret
-
+; --------------------------- ECB DECRYPT ------------------------------#
 ALIGN	16
 $L$ecb_decrypt:
-	cmp	rdx,0x80
-	jb	NEAR $L$ecb_dec_tail
+	cmp	rdx,0x80  ; if (%rdx<8*16)
+	jb	NEAR $L$ecb_dec_tail  ; short input
 
-	movdqu	xmm2,XMMWORDrdi
+	movdqu	xmm2,XMMWORDrdi  ; load 8 input blocks
 	movdqu	xmm3,XMMWORD16+rdi
 	movdqu	xmm4,XMMWORD32+rdi
 	movdqu	xmm5,XMMWORD48+rdi
@@ -719,15 +719,15 @@
 	movdqu	xmm7,XMMWORD80+rdi
 	movdqu	xmm8,XMMWORD96+rdi
 	movdqu	xmm9,XMMWORD112+rdi
-	lea	rdi,128+rdi
-	sub	rdx,0x80
+	lea	rdi,128+rdi  ; %rdi+=8*16
+	sub	rdx,0x80  ; %rdx-=8*16 (can be zero)
 	jmp	NEAR $L$ecb_dec_loop8_enter
 ALIGN	16
 $L$ecb_dec_loop8:
-	movups	XMMWORDrsi,xmm2
-	mov	rcx,r11
-	movdqu	xmm2,XMMWORDrdi
-	mov	eax,r10d
+	movups	XMMWORDrsi,xmm2  ; store 8 output blocks
+	mov	rcx,r11  ; restore %rcx
+	movdqu	xmm2,XMMWORDrdi  ; load 8 input blocks
+	mov	eax,r10d  ; restore %eax
 	movups	XMMWORD16+rsi,xmm3
 	movdqu	xmm3,XMMWORD16+rdi
 	movups	XMMWORD32+rsi,xmm4
@@ -741,23 +741,23 @@
 	movups	XMMWORD96+rsi,xmm8
 	movdqu	xmm8,XMMWORD96+rdi
 	movups	XMMWORD112+rsi,xmm9
-	lea	rsi,128+rsi
+	lea	rsi,128+rsi  ; %rsi+=8*16
 	movdqu	xmm9,XMMWORD112+rdi
-	lea	rdi,128+rdi
+	lea	rdi,128+rdi  ; %rdi+=8*16
 $L$ecb_dec_loop8_enter:
 
 	call	_aesni_decrypt8
 
 	movups	xmm0,XMMWORDr11
 	sub	rdx,0x80
-	jnc	NEAR $L$ecb_dec_loop8
+	jnc	NEAR $L$ecb_dec_loop8  ; loop if %rdx-=8*16 didn't borrow
 
-	movups	XMMWORDrsi,xmm2
-	pxor	xmm2,xmm2
-	mov	rcx,r11
+	movups	XMMWORDrsi,xmm2  ; store 8 output blocks
+	pxor	xmm2,xmm2  ; clear register bank
+	mov	rcx,r11  ; restore %rcx
 	movups	XMMWORD16+rsi,xmm3
 	pxor	xmm3,xmm3
-	mov	eax,r10d
+	mov	eax,r10d  ; restore %eax
 	movups	XMMWORD32+rsi,xmm4
 	pxor	xmm4,xmm4
 	movups	XMMWORD48+rsi,xmm5
@@ -770,9 +770,9 @@
 	pxor	xmm8,xmm8
 	movups	XMMWORD112+rsi,xmm9
 	pxor	xmm9,xmm9
-	lea	rsi,128+rsi
-	add	rdx,0x80
-	jz	NEAR $L$ecb_ret
+	lea	rsi,128+rsi  ; %rsi+=8*16
+	add	rdx,0x80  ; restore real remaining %rdx
+	jz	NEAR $L$ecb_ret  ; done if (%rdx==0)
 
 $L$ecb_dec_tail:
 	movups	xmm2,XMMWORDrdi
@@ -794,8 +794,8 @@
 	movups	xmm0,XMMWORDrcx
 	xorps	xmm9,xmm9
 	call	_aesni_decrypt8
-	movups	XMMWORDrsi,xmm2
-	pxor	xmm2,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 7 output blocks
+	pxor	xmm2,xmm2  ; clear register bank
 	movups	XMMWORD16+rsi,xmm3
 	pxor	xmm3,xmm3
 	movups	XMMWORD32+rsi,xmm4
@@ -821,24 +821,24 @@
 	dec	eax
 	movups	xmm1,XMMWORDrcx
 	lea	rcx,16+rcx
-	jnz	NEAR $L$oop_dec1_4
+	jnz	NEAR $L$oop_dec1_4  ; loop body is 16 bytes
 	aesdeclast	xmm2,xmm1
-	movups	XMMWORDrsi,xmm2
-	pxor	xmm2,xmm2
+	movups	XMMWORDrsi,xmm2  ; store one output block
+	pxor	xmm2,xmm2  ; clear register bank
 	jmp	NEAR $L$ecb_ret
 ALIGN	16
 $L$ecb_dec_two:
 	call	_aesni_decrypt2
-	movups	XMMWORDrsi,xmm2
-	pxor	xmm2,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 2 output blocks
+	pxor	xmm2,xmm2  ; clear register bank
 	movups	XMMWORD16+rsi,xmm3
 	pxor	xmm3,xmm3
 	jmp	NEAR $L$ecb_ret
 ALIGN	16
 $L$ecb_dec_three:
 	call	_aesni_decrypt3
-	movups	XMMWORDrsi,xmm2
-	pxor	xmm2,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 3 output blocks
+	pxor	xmm2,xmm2  ; clear register bank
 	movups	XMMWORD16+rsi,xmm3
 	pxor	xmm3,xmm3
 	movups	XMMWORD32+rsi,xmm4
@@ -847,8 +847,8 @@
 ALIGN	16
 $L$ecb_dec_four:
 	call	_aesni_decrypt4
-	movups	XMMWORDrsi,xmm2
-	pxor	xmm2,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 4 output blocks
+	pxor	xmm2,xmm2  ; clear register bank
 	movups	XMMWORD16+rsi,xmm3
 	pxor	xmm3,xmm3
 	movups	XMMWORD32+rsi,xmm4
@@ -860,8 +860,8 @@
 $L$ecb_dec_five:
 	xorps	xmm7,xmm7
 	call	_aesni_decrypt6
-	movups	XMMWORDrsi,xmm2
-	pxor	xmm2,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 5 output blocks
+	pxor	xmm2,xmm2  ; clear register bank
 	movups	XMMWORD16+rsi,xmm3
 	pxor	xmm3,xmm3
 	movups	XMMWORD32+rsi,xmm4
@@ -875,8 +875,8 @@
 ALIGN	16
 $L$ecb_dec_six:
 	call	_aesni_decrypt6
-	movups	XMMWORDrsi,xmm2
-	pxor	xmm2,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 6 output blocks
+	pxor	xmm2,xmm2  ; clear register bank
 	movups	XMMWORD16+rsi,xmm3
 	pxor	xmm3,xmm3
 	movups	XMMWORD32+rsi,xmm4
@@ -889,10 +889,10 @@
 	pxor	xmm7,xmm7
 
 $L$ecb_ret:
-	xorps	xmm0,xmm0
+	xorps	xmm0,xmm0  ; %xmm0
 	pxor	xmm1,xmm1
 	movaps	xmm6,XMMWORDrsp
-	movaps	XMMWORDrsp,xmm0
+	movaps	XMMWORDrsp,xmm0  ; clear stack
 	movaps	xmm7,XMMWORD16+rsp
 	movaps	XMMWORD16+rsp,xmm0
 	movaps	xmm8,XMMWORD32+rsp
@@ -929,11 +929,11 @@
 	cmp	rdx,1
 	jne	NEAR $L$ctr32_bulk
 
-
-
+; handle single block without allocating stack frame,
+; useful when handling edges
 	movups	xmm2,XMMWORDr8
 	movups	xmm3,XMMWORDrdi
-	mov	edx,DWORD240+rcx
+	mov	edx,DWORD240+rcx  ; key->rounds
 	movups	xmm0,XMMWORDrcx
 	movups	xmm1,XMMWORD16+rcx
 	lea	rcx,32+rcx
@@ -943,9 +943,9 @@
 	dec	edx
 	movups	xmm1,XMMWORDrcx
 	lea	rcx,16+rcx
-	jnz	NEAR $L$oop_enc1_5
+	jnz	NEAR $L$oop_enc1_5  ; loop body is 16 bytes
 	aesenclast	xmm2,xmm1
-	pxor	xmm0,xmm0
+	pxor	xmm0,xmm0  ; clear register bank
 	pxor	xmm1,xmm1
 	xorps	xmm2,xmm3
 	pxor	xmm3,xmm3
@@ -955,13 +955,13 @@
 
 ALIGN	16
 $L$ctr32_bulk:
-	lea	r11,rsp
+	lea	r11,rsp  ; use %r11 as frame pointer
 
 	push	rbp
 
 	sub	rsp,288
-	and	rsp,-16
-	movaps	XMMWORD(-168)+r11,xmm6
+	and	rsp,-16  ; Linux kernel stack can be incorrectly seeded
+	movaps	XMMWORD(-168)+r11,xmm6  ; offload everything
 	movaps	XMMWORD(-152)+r11,xmm7
 	movaps	XMMWORD(-136)+r11,xmm8
 	movaps	XMMWORD(-120)+r11,xmm9
@@ -973,15 +973,15 @@
 	movaps	XMMWORD(-24)+r11,xmm15
 $L$ctr32_body:
 
-
-
+; 8 16-byte words on top of stack are counter values
+; xor-ed with zero-round key
 
 	movdqu	xmm2,XMMWORDr8
 	movdqu	xmm0,XMMWORDrcx
-	mov	r8d,DWORD12+r8
+	mov	r8d,DWORD12+r8  ; counter LSB
 	pxor	xmm2,xmm0
-	mov	ebp,DWORD12+rcx
-	movdqa	XMMWORDrsp,xmm2
+	mov	ebp,DWORD12+rcx  ; 0-round key LSB
+	movdqa	XMMWORDrsp,xmm2  ; populate counter block
 	bswap	r8d
 	movdqa	xmm3,xmm2
 	movdqa	xmm4,xmm2
@@ -989,7 +989,7 @@
 	movdqa	XMMWORD64+rsp,xmm2
 	movdqa	XMMWORD80+rsp,xmm2
 	movdqa	XMMWORD96+rsp,xmm2
-	mov	r10,rdx
+	mov	r10,rdx  ; about to borrow %rdx
 	movdqa	XMMWORD112+rsp,xmm2
 
 	lea	rax,1+r8
@@ -1003,7 +1003,7 @@
 	movdqa	XMMWORD16+rsp,xmm3
 	pinsrd	xmm4,edx,3
 	bswap	eax
-	mov	rdx,r10
+	mov	rdx,r10  ; restore %rdx
 	lea	r10,4+r8
 	movdqa	XMMWORD32+rsp,xmm4
 	xor	eax,ebp
@@ -1015,7 +1015,7 @@
 	mov	DWORD((64+12))+rsp,r10d
 	bswap	r9d
 	lea	r10,6+r8
-	mov	eax,DWORD240+rcx
+	mov	eax,DWORD240+rcx  ; key->rounds
 	xor	r9d,ebp
 	bswap	r10d
 	mov	DWORD((80+12))+rsp,r9d
@@ -1031,16 +1031,16 @@
 	movdqa	xmm6,XMMWORD64+rsp
 	movdqa	xmm7,XMMWORD80+rsp
 
-	cmp	rdx,8
-	jb	NEAR $L$ctr32_tail
+	cmp	rdx,8  ; %rdx is in blocks
+	jb	NEAR $L$ctr32_tail  ; short input if (%rdx<8)
 
-	lea	rcx,128+rcx
-	sub	rdx,8
+	lea	rcx,128+rcx  ; size optimization
+	sub	rdx,8  ; %rdx is biased by -8
 	jmp	NEAR $L$ctr32_loop8
 
 ALIGN	32
 $L$ctr32_loop8:
-	add	r8d,8
+	add	r8d,8  ; next counter value
 	movdqa	xmm8,XMMWORD96+rsp
 	aesenc	xmm2,xmm1
 	mov	r9d,r8d
@@ -1052,7 +1052,7 @@
 	xor	r9d,ebp
 	nop
 	aesenc	xmm5,xmm1
-	mov	DWORD((0+12))+rsp,r9d
+	mov	DWORD((0+12))+rsp,r9d  ; store next counter value
 	lea	r9,1+r8
 	aesenc	xmm6,xmm1
 	aesenc	xmm7,xmm1
@@ -1148,7 +1148,7 @@
 	aesenc	xmm3,xmm0
 	aesenc	xmm4,xmm0
 	xor	r9d,ebp
-	movdqu	xmm10,XMMWORDrdi
+	movdqu	xmm10,XMMWORDrdi  ; start loading input
 	aesenc	xmm5,xmm0
 	mov	DWORD((112+12))+rsp,r9d
 	cmp	eax,11
@@ -1205,7 +1205,7 @@
 ALIGN	16
 $L$ctr32_enc_done:
 	movdqu	xmm11,XMMWORD16+rdi
-	pxor	xmm10,xmm0
+	pxor	xmm10,xmm0  ; input^=roundlast
 	movdqu	xmm12,XMMWORD32+rdi
 	pxor	xmm11,xmm0
 	movdqu	xmm13,XMMWORD48+rdi
@@ -1214,8 +1214,8 @@
 	pxor	xmm13,xmm0
 	movdqu	xmm15,XMMWORD80+rdi
 	pxor	xmm14,xmm0
-	prefetcht0	448+rdi
-	prefetcht0	512+rdi
+	prefetcht0	448+rdi  ; We process 128 bytes (8*16), so to prefetch 1 iteration
+	prefetcht0	512+rdi  ; We need to prefetch 2 64 byte lines
 	pxor	xmm15,xmm0
 	aesenc	xmm2,xmm1
 	aesenc	xmm3,xmm1
@@ -1225,15 +1225,15 @@
 	aesenc	xmm7,xmm1
 	aesenc	xmm8,xmm1
 	aesenc	xmm9,xmm1
-	movdqu	xmm1,XMMWORD96+rdi
-	lea	rdi,128+rdi
+	movdqu	xmm1,XMMWORD96+rdi  ; borrow %xmm1 for inp6
+	lea	rdi,128+rdi  ; %rdi+=8*16
 
-	aesenclast	xmm2,xmm10
-	pxor	xmm1,xmm0
+	aesenclast	xmm2,xmm10  ; is inpN^roundlast
+	pxor	xmm1,xmm0  ; borrowed
 	movdqu	xmm10,XMMWORD((112-128))+rdi
 	aesenclast	xmm3,xmm11
 	pxor	xmm10,xmm0
-	movdqa	xmm11,XMMWORDrsp
+	movdqa	xmm11,XMMWORDrsp  ; load next counter block
 	aesenclast	xmm4,xmm12
 	aesenclast	xmm5,xmm13
 	movdqa	xmm12,XMMWORD16+rsp
@@ -1244,10 +1244,10 @@
 	movdqa	xmm15,XMMWORD64+rsp
 	aesenclast	xmm8,xmm1
 	movdqa	xmm0,XMMWORD80+rsp
-	movups	xmm1,XMMWORD((16-128))+rcx
+	movups	xmm1,XMMWORD((16-128))+rcx  ; real 1st-round key
 	aesenclast	xmm9,xmm10
 
-	movups	XMMWORDrsi,xmm2
+	movups	XMMWORDrsi,xmm2  ; store 8 output blocks
 	movdqa	xmm2,xmm11
 	movups	XMMWORD16+rsi,xmm3
 	movdqa	xmm3,xmm12
@@ -1261,24 +1261,24 @@
 	movdqa	xmm7,xmm0
 	movups	XMMWORD96+rsi,xmm8
 	movups	XMMWORD112+rsi,xmm9
-	lea	rsi,128+rsi
+	lea	rsi,128+rsi  ; %rsi+=8*16
 
 	sub	rdx,8
-	jnc	NEAR $L$ctr32_loop8
+	jnc	NEAR $L$ctr32_loop8  ; loop if %rdx-=8 didn't borrow
 
-	add	rdx,8
-	jz	NEAR $L$ctr32_done
+	add	rdx,8  ; restore real remaining %rdx
+	jz	NEAR $L$ctr32_done  ; done if (%rdx==0)
 	lea	rcx,((-128))+rcx
 
 $L$ctr32_tail:
-
-
+; note that at this point %xmm2..5 are populated with
+; counter values xor-ed with 0-round key
 	lea	rcx,16+rcx
 	cmp	rdx,4
 	jb	NEAR $L$ctr32_loop3
 	je	NEAR $L$ctr32_loop4
 
-
+; if (%rdx>4) compute 7 E(counter)
 	shl	eax,4
 	movdqa	xmm8,XMMWORD96+rsp
 	pxor	xmm9,xmm9
@@ -1286,14 +1286,14 @@
 	movups	xmm0,XMMWORD16+rcx
 	aesenc	xmm2,xmm1
 	aesenc	xmm3,xmm1
-	lea	rcx,((32-16))+rax*1+rcx
+	lea	rcx,((32-16))+rax*1+rcx  ; prepare for .Lenc_loop8_enter
 	neg	rax
 	aesenc	xmm4,xmm1
-	add	rax,16
+	add	rax,16  ; prepare for .Lenc_loop8_enter
 	movups	xmm10,XMMWORDrdi
 	aesenc	xmm5,xmm1
 	aesenc	xmm6,xmm1
-	movups	xmm11,XMMWORD16+rdi
+	movups	xmm11,XMMWORD16+rdi  ; pre-load input
 	movups	xmm12,XMMWORD32+rdi
 	aesenc	xmm7,xmm1
 	aesenc	xmm8,xmm1
@@ -1304,7 +1304,7 @@
 	pxor	xmm2,xmm10
 	movdqu	xmm10,XMMWORD64+rdi
 	pxor	xmm3,xmm11
-	movdqu	XMMWORDrsi,xmm2
+	movdqu	XMMWORDrsi,xmm2  ; store output
 	pxor	xmm4,xmm12
 	movdqu	XMMWORD16+rsi,xmm3
 	pxor	xmm5,xmm13
@@ -1313,17 +1313,17 @@
 	movdqu	XMMWORD48+rsi,xmm5
 	movdqu	XMMWORD64+rsi,xmm6
 	cmp	rdx,6
-	jb	NEAR $L$ctr32_done
+	jb	NEAR $L$ctr32_done  ; %rdx was 5, stop store
 
 	movups	xmm11,XMMWORD80+rdi
 	xorps	xmm7,xmm11
 	movups	XMMWORD80+rsi,xmm7
-	je	NEAR $L$ctr32_done
+	je	NEAR $L$ctr32_done  ; %rdx was 6, stop store
 
 	movups	xmm12,XMMWORD96+rdi
 	xorps	xmm8,xmm12
 	movups	XMMWORD96+rsi,xmm8
-	jmp	NEAR $L$ctr32_done
+	jmp	NEAR $L$ctr32_done  ; %rdx was 7, stop store
 
 ALIGN	32
 $L$ctr32_loop4:
@@ -1337,7 +1337,7 @@
 	jnz	NEAR $L$ctr32_loop4
 	aesenclast	xmm2,xmm1
 	aesenclast	xmm3,xmm1
-	movups	xmm10,XMMWORDrdi
+	movups	xmm10,XMMWORDrdi  ; load input
 	movups	xmm11,XMMWORD16+rdi
 	aesenclast	xmm4,xmm1
 	aesenclast	xmm5,xmm1
@@ -1345,14 +1345,14 @@
 	movups	xmm13,XMMWORD48+rdi
 
 	xorps	xmm2,xmm10
-	movups	XMMWORDrsi,xmm2
+	movups	XMMWORDrsi,xmm2  ; store output
 	xorps	xmm3,xmm11
 	movups	XMMWORD16+rsi,xmm3
 	pxor	xmm4,xmm12
 	movdqu	XMMWORD32+rsi,xmm4
 	pxor	xmm5,xmm13
 	movdqu	XMMWORD48+rsi,xmm5
-	jmp	NEAR $L$ctr32_done
+	jmp	NEAR $L$ctr32_done  ; %rdx was 4, stop store
 
 ALIGN	32
 $L$ctr32_loop3:
@@ -1367,23 +1367,23 @@
 	aesenclast	xmm3,xmm1
 	aesenclast	xmm4,xmm1
 
-	movups	xmm10,XMMWORDrdi
+	movups	xmm10,XMMWORDrdi  ; load input
 	xorps	xmm2,xmm10
-	movups	XMMWORDrsi,xmm2
+	movups	XMMWORDrsi,xmm2  ; store output
 	cmp	rdx,2
-	jb	NEAR $L$ctr32_done
+	jb	NEAR $L$ctr32_done  ; %rdx was 1, stop store
 
 	movups	xmm11,XMMWORD16+rdi
 	xorps	xmm3,xmm11
 	movups	XMMWORD16+rsi,xmm3
-	je	NEAR $L$ctr32_done
+	je	NEAR $L$ctr32_done  ; %rdx was 2, stop store
 
 	movups	xmm12,XMMWORD32+rdi
 	xorps	xmm4,xmm12
-	movups	XMMWORD32+rsi,xmm4
+	movups	XMMWORD32+rsi,xmm4  ; %rdx was 3, stop store
 
 $L$ctr32_done:
-	xorps	xmm0,xmm0
+	xorps	xmm0,xmm0  ; clear register bank
 	xor	ebp,ebp
 	pxor	xmm1,xmm1
 	pxor	xmm2,xmm2
@@ -1391,7 +1391,7 @@
 	pxor	xmm4,xmm4
 	pxor	xmm5,xmm5
 	movaps	xmm6,XMMWORD((-168))+r11
-	movaps	XMMWORD(-168)+r11,xmm0
+	movaps	XMMWORD(-168)+r11,xmm0  ; clear stack
 	movaps	xmm7,XMMWORD((-152))+r11
 	movaps	XMMWORD(-152)+r11,xmm0
 	movaps	xmm8,XMMWORD((-136))+r11
@@ -1446,15 +1446,15 @@
 
 
 _CET_ENDBR
-	test	rdx,rdx
+	test	rdx,rdx  ; check length
 	jz	NEAR $L$cbc_ret
 
-	mov	r10d,DWORD240+rcx
-	mov	r11,rcx
-	test	r9d,r9d
+	mov	r10d,DWORD240+rcx  ; key->rounds
+	mov	r11,rcx  ; backup %rcx
+	test	r9d,r9d  ; 6th argument
 	jz	NEAR $L$cbc_decrypt
-
-	movups	xmm2,XMMWORDr8
+; --------------------------- CBC ENCRYPT ------------------------------#
+	movups	xmm2,XMMWORDr8  ; load iv as initial state
 	mov	eax,r10d
 	cmp	rdx,16
 	jb	NEAR $L$cbc_enc_tail
@@ -1462,9 +1462,9 @@
 	jmp	NEAR $L$cbc_enc_loop
 ALIGN	16
 $L$cbc_enc_loop:
-	movups	xmm3,XMMWORDrdi
+	movups	xmm3,XMMWORDrdi  ; load input
 	lea	rdi,16+rdi
-
+; xorps	%xmm3,%xmm2
 	movups	xmm0,XMMWORDrcx
 	movups	xmm1,XMMWORD16+rcx
 	xorps	xmm3,xmm0
@@ -1475,17 +1475,17 @@
 	dec	eax
 	movups	xmm1,XMMWORDrcx
 	lea	rcx,16+rcx
-	jnz	NEAR $L$oop_enc1_6
+	jnz	NEAR $L$oop_enc1_6  ; loop body is 16 bytes
 	aesenclast	xmm2,xmm1
-	mov	eax,r10d
-	mov	rcx,r11
-	movups	XMMWORDrsi,xmm2
+	mov	eax,r10d  ; restore %eax
+	mov	rcx,r11  ; restore %rcx
+	movups	XMMWORDrsi,xmm2  ; store output
 	lea	rsi,16+rsi
 	sub	rdx,16
 	jnc	NEAR $L$cbc_enc_loop
 	add	rdx,16
 	jnz	NEAR $L$cbc_enc_tail
-	pxor	xmm0,xmm0
+	pxor	xmm0,xmm0  ; clear register bank
 	pxor	xmm1,xmm1
 	movups	XMMWORDr8,xmm2
 	pxor	xmm2,xmm2
@@ -1493,30 +1493,30 @@
 	jmp	NEAR $L$cbc_ret
 
 $L$cbc_enc_tail:
-	mov	rcx,rdx
-	xchg	rsi,rdi
-	DD	0x9066A4F3
-	mov	ecx,16
+	mov	rcx,rdx  ; zaps %rcx
+	xchg	rsi,rdi  ; %rdi is %rsi and %rsi is %rdi now
+	DD	0x9066A4F3  ; rep movsb
+	mov	ecx,16  ; zero tail
 	sub	rcx,rdx
 	xor	eax,eax
-	DD	0x9066AAF3
-	lea	rdi,((-16))+rdi
-	mov	eax,r10d
-	mov	rsi,rdi
-	mov	rcx,r11
-	xor	rdx,rdx
-	jmp	NEAR $L$cbc_enc_loop
-
+	DD	0x9066AAF3  ; rep stosb
+	lea	rdi,((-16))+rdi  ; rewind %rsi by 1 block
+	mov	eax,r10d  ; restore %eax
+	mov	rsi,rdi  ; %rdi and %rsi are the same
+	mov	rcx,r11  ; restore %rcx
+	xor	rdx,rdx  ; len=16
+	jmp	NEAR $L$cbc_enc_loop  ; one more spin
+; --------------------------- CBC DECRYPT ------------------------------#
 ALIGN	16
 $L$cbc_decrypt:
 	cmp	rdx,16
 	jne	NEAR $L$cbc_decrypt_bulk
 
-
-
-	movdqu	xmm2,XMMWORDrdi
-	movdqu	xmm3,XMMWORDr8
-	movdqa	xmm4,xmm2
+; handle single block without allocating stack frame,
+; useful in ciphertext stealing mode
+	movdqu	xmm2,XMMWORDrdi  ; load input
+	movdqu	xmm3,XMMWORDr8  ; load iv
+	movdqa	xmm4,xmm2  ; future iv
 	movups	xmm0,XMMWORDrcx
 	movups	xmm1,XMMWORD16+rcx
 	lea	rcx,32+rcx
@@ -1526,24 +1526,24 @@
 	dec	r10d
 	movups	xmm1,XMMWORDrcx
 	lea	rcx,16+rcx
-	jnz	NEAR $L$oop_dec1_7
+	jnz	NEAR $L$oop_dec1_7  ; loop body is 16 bytes
 	aesdeclast	xmm2,xmm1
-	pxor	xmm0,xmm0
+	pxor	xmm0,xmm0  ; clear register bank
 	pxor	xmm1,xmm1
-	movdqu	XMMWORDr8,xmm4
-	xorps	xmm2,xmm3
+	movdqu	XMMWORDr8,xmm4  ; store iv
+	xorps	xmm2,xmm3  ; ^=iv
 	pxor	xmm3,xmm3
-	movups	XMMWORDrsi,xmm2
+	movups	XMMWORDrsi,xmm2  ; store output
 	pxor	xmm2,xmm2
 	jmp	NEAR $L$cbc_ret
 ALIGN	16
 $L$cbc_decrypt_bulk:
-	lea	r11,rsp
+	lea	r11,rsp  ; frame pointer
 
 	push	rbp
 
 	sub	rsp,176
-	and	rsp,-16
+	and	rsp,-16  ; Linux kernel stack can be incorrectly seeded
 	movaps	XMMWORD16+rsp,xmm6
 	movaps	XMMWORD32+rsp,xmm7
 	movaps	XMMWORD48+rsp,xmm8
@@ -1555,14 +1555,14 @@
 	movaps	XMMWORD144+rsp,xmm14
 	movaps	XMMWORD160+rsp,xmm15
 $L$cbc_decrypt_body:
-	mov	rbp,rcx
+	mov	rbp,rcx  ; re-backup %rcx after reassignment
 	movups	xmm10,XMMWORDr8
 	mov	eax,r10d
 	cmp	rdx,0x50
 	jbe	NEAR $L$cbc_dec_tail
 
 	movups	xmm0,XMMWORDrcx
-	movdqu	xmm2,XMMWORDrdi
+	movdqu	xmm2,XMMWORDrdi  ; load input
 	movdqu	xmm3,XMMWORD16+rdi
 	movdqa	xmm11,xmm2
 	movdqu	xmm4,XMMWORD32+rdi
@@ -1576,8 +1576,8 @@
 	cmp	rdx,0x70
 	jbe	NEAR $L$cbc_dec_six_or_seven
 
-	sub	rdx,0x70
-	lea	rcx,112+rcx
+	sub	rdx,0x70  ; %rdx is biased by -7*16
+	lea	rcx,112+rcx  ; size optimization
 	jmp	NEAR $L$cbc_dec_loop8_enter
 ALIGN	16
 $L$cbc_dec_loop8:
@@ -1591,7 +1591,7 @@
 	movups	xmm1,XMMWORD((16-112))+rcx
 	pxor	xmm4,xmm0
 	mov	rbp,-1
-	cmp	rdx,0x70
+	cmp	rdx,0x70  ; is there at least 0x60 bytes ahead?
 	pxor	xmm5,xmm0
 	pxor	xmm6,xmm0
 	pxor	xmm7,xmm0
@@ -1740,11 +1740,11 @@
 	movdqu	xmm1,XMMWORD80+rdi
 
 	aesdeclast	xmm2,xmm10
-	movdqu	xmm10,XMMWORD96+rdi
+	movdqu	xmm10,XMMWORD96+rdi  ; borrow %xmm10
 	pxor	xmm1,xmm0
 	aesdeclast	xmm3,xmm11
 	pxor	xmm10,xmm0
-	movdqu	xmm0,XMMWORD112+rdi
+	movdqu	xmm0,XMMWORD112+rdi  ; next IV
 	aesdeclast	xmm4,xmm12
 	lea	rdi,128+rdi
 	movdqu	xmm11,XMMWORDrbp
@@ -1757,11 +1757,11 @@
 	movdqu	xmm14,XMMWORD48+rbp
 	movdqu	xmm15,XMMWORD64+rbp
 	aesdeclast	xmm9,xmm10
-	movdqa	xmm10,xmm0
+	movdqa	xmm10,xmm0  ; return %xmm10
 	movdqu	xmm1,XMMWORD80+rbp
 	movups	xmm0,XMMWORD((-112))+rcx
 
-	movups	XMMWORDrsi,xmm2
+	movups	XMMWORDrsi,xmm2  ; store output
 	movdqa	xmm2,xmm11
 	movups	XMMWORD16+rsi,xmm3
 	movdqa	xmm3,xmm12
@@ -1795,13 +1795,13 @@
 
 	movaps	xmm8,xmm7
 	call	_aesni_decrypt6
-	pxor	xmm2,xmm10
+	pxor	xmm2,xmm10  ; ^= IV
 	movaps	xmm10,xmm8
 	pxor	xmm3,xmm11
 	movdqu	XMMWORDrsi,xmm2
 	pxor	xmm4,xmm12
 	movdqu	XMMWORD16+rsi,xmm3
-	pxor	xmm3,xmm3
+	pxor	xmm3,xmm3  ; clear register bank
 	pxor	xmm5,xmm13
 	movdqu	XMMWORD32+rsi,xmm4
 	pxor	xmm4,xmm4
@@ -1822,13 +1822,13 @@
 	xorps	xmm9,xmm9
 	call	_aesni_decrypt8
 	movups	xmm9,XMMWORD80+rdi
-	pxor	xmm2,xmm10
+	pxor	xmm2,xmm10  ; ^= IV
 	movups	xmm10,XMMWORD96+rdi
 	pxor	xmm3,xmm11
 	movdqu	XMMWORDrsi,xmm2
 	pxor	xmm4,xmm12
 	movdqu	XMMWORD16+rsi,xmm3
-	pxor	xmm3,xmm3
+	pxor	xmm3,xmm3  ; clear register bank
 	pxor	xmm5,xmm13
 	movdqu	XMMWORD32+rsi,xmm4
 	pxor	xmm4,xmm4
@@ -1850,24 +1850,24 @@
 $L$cbc_dec_tail:
 	movups	xmm2,XMMWORDrdi
 	sub	rdx,0x10
-	jbe	NEAR $L$cbc_dec_one
+	jbe	NEAR $L$cbc_dec_one  ; %rdx is 1*16 or less
 
 	movups	xmm3,XMMWORD16+rdi
 	movaps	xmm11,xmm2
 	sub	rdx,0x10
-	jbe	NEAR $L$cbc_dec_two
+	jbe	NEAR $L$cbc_dec_two  ; %rdx is 2*16 or less
 
 	movups	xmm4,XMMWORD32+rdi
 	movaps	xmm12,xmm3
 	sub	rdx,0x10
-	jbe	NEAR $L$cbc_dec_three
+	jbe	NEAR $L$cbc_dec_three  ; %rdx is 3*16 or less
 
 	movups	xmm5,XMMWORD48+rdi
 	movaps	xmm13,xmm4
 	sub	rdx,0x10
-	jbe	NEAR $L$cbc_dec_four
+	jbe	NEAR $L$cbc_dec_four  ; %rdx is 4*16 or less
 
-	movups	xmm6,XMMWORD64+rdi
+	movups	xmm6,XMMWORD64+rdi  ; %rdx is 5*16 or less
 	movaps	xmm14,xmm5
 	movaps	xmm15,xmm6
 	xorps	xmm7,xmm7
@@ -1878,7 +1878,7 @@
 	movdqu	XMMWORDrsi,xmm2
 	pxor	xmm4,xmm12
 	movdqu	XMMWORD16+rsi,xmm3
-	pxor	xmm3,xmm3
+	pxor	xmm3,xmm3  ; clear register bank
 	pxor	xmm5,xmm13
 	movdqu	XMMWORD32+rsi,xmm4
 	pxor	xmm4,xmm4
@@ -1904,7 +1904,7 @@
 	dec	eax
 	movups	xmm1,XMMWORDrcx
 	lea	rcx,16+rcx
-	jnz	NEAR $L$oop_dec1_8
+	jnz	NEAR $L$oop_dec1_8  ; loop body is 16 bytes
 	aesdeclast	xmm2,xmm1
 	xorps	xmm2,xmm10
 	movaps	xmm10,xmm11
@@ -1918,7 +1918,7 @@
 	pxor	xmm3,xmm11
 	movdqu	XMMWORDrsi,xmm2
 	movdqa	xmm2,xmm3
-	pxor	xmm3,xmm3
+	pxor	xmm3,xmm3  ; clear register bank
 	lea	rsi,16+rsi
 	jmp	NEAR $L$cbc_dec_tail_collected
 ALIGN	16
@@ -1931,7 +1931,7 @@
 	movdqu	XMMWORDrsi,xmm2
 	pxor	xmm4,xmm12
 	movdqu	XMMWORD16+rsi,xmm3
-	pxor	xmm3,xmm3
+	pxor	xmm3,xmm3  ; clear register bank
 	movdqa	xmm2,xmm4
 	pxor	xmm4,xmm4
 	lea	rsi,32+rsi
@@ -1946,7 +1946,7 @@
 	movdqu	XMMWORDrsi,xmm2
 	pxor	xmm4,xmm12
 	movdqu	XMMWORD16+rsi,xmm3
-	pxor	xmm3,xmm3
+	pxor	xmm3,xmm3  ; clear register bank
 	pxor	xmm5,xmm13
 	movdqu	XMMWORD32+rsi,xmm4
 	pxor	xmm4,xmm4
@@ -1957,7 +1957,7 @@
 
 ALIGN	16
 $L$cbc_dec_clear_tail_collected:
-	pxor	xmm3,xmm3
+	pxor	xmm3,xmm3  ; clear register bank
 	pxor	xmm4,xmm4
 	pxor	xmm5,xmm5
 $L$cbc_dec_tail_collected:
@@ -1975,14 +1975,14 @@
 	mov	rdi,rsi
 	sub	rcx,rdx
 	lea	rsi,rsp
-	DD	0x9066A4F3
+	DD	0x9066A4F3  ; rep movsb
 	movdqa	XMMWORDrsp,xmm2
 
 $L$cbc_dec_ret:
-	xorps	xmm0,xmm0
+	xorps	xmm0,xmm0  ; %xmm0
 	pxor	xmm1,xmm1
 	movaps	xmm6,XMMWORD16+rsp
-	movaps	XMMWORD16+rsp,xmm0
+	movaps	XMMWORD16+rsp,xmm0  ; clear stack
 	movaps	xmm7,XMMWORD32+rsp
 	movaps	XMMWORD32+rsp,xmm0
 	movaps	xmm8,XMMWORD48+rsp
@@ -2021,9 +2021,9 @@
 	mov	edx,DWORD240+rcx
 	shl	edx,4
 
-	lea	r8,16+rdx*1+rcx
+	lea	r8,16+rdx*1+rcx  ; points at the end of key schedule
 
-	movups	xmm0,XMMWORDrcx
+	movups	xmm0,XMMWORDrcx  ; just swap
 	movups	xmm1,XMMWORDr8
 	movups	XMMWORDr8,xmm0
 	movups	XMMWORDrcx,xmm1
@@ -2031,7 +2031,7 @@
 	lea	r8,((-16))+r8
 
 $L$dec_key_inverse:
-	movups	xmm0,XMMWORDrcx
+	movups	xmm0,XMMWORDrcx  ; swap and inverse
 	movups	xmm1,XMMWORDr8
 	aesimc	xmm0,xmm0
 	aesimc	xmm1,xmm1
@@ -2042,7 +2042,7 @@
 	cmp	r8,rcx
 	ja	NEAR $L$dec_key_inverse
 
-	movups	xmm0,XMMWORDrcx
+	movups	xmm0,XMMWORDrcx  ; inverse middle
 	aesimc	xmm0,xmm0
 	pxor	xmm1,xmm1
 	movups	XMMWORDr8,xmm0
@@ -2064,9 +2064,9 @@
 
 $L$SEH_prologue_aes_hw_set_encrypt_key_base_2:
 $L$SEH_endprologue_aes_hw_set_encrypt_key_base_3:
-	movups	xmm0,XMMWORDrcx
-	xorps	xmm4,xmm4
-	lea	rax,16+r8
+	movups	xmm0,XMMWORDrcx  ; pull first 128 bits of *userKey
+	xorps	xmm4,xmm4  ; low dword of xmm4 is assumed 0
+	lea	rax,16+r8  ; %rax is used as modifiable copy of %r8
 	cmp	edx,256
 	je	NEAR $L$14rounds
 	cmp	edx,192
@@ -2075,97 +2075,97 @@
 	jne	NEAR $L$bad_keybits
 
 $L$10rounds:
-	mov	edx,9
+	mov	edx,9  ; 10 rounds for 128-bit key
 
-	movups	XMMWORDr8,xmm0
-	aeskeygenassist	xmm1,xmm0,0x1
+	movups	XMMWORDr8,xmm0  ; round 0
+	aeskeygenassist	xmm1,xmm0,0x1  ; round 1
 	call	$L$key_expansion_128_cold
-	aeskeygenassist	xmm1,xmm0,0x2
+	aeskeygenassist	xmm1,xmm0,0x2  ; round 2
 	call	$L$key_expansion_128
-	aeskeygenassist	xmm1,xmm0,0x4
+	aeskeygenassist	xmm1,xmm0,0x4  ; round 3
 	call	$L$key_expansion_128
-	aeskeygenassist	xmm1,xmm0,0x8
+	aeskeygenassist	xmm1,xmm0,0x8  ; round 4
 	call	$L$key_expansion_128
-	aeskeygenassist	xmm1,xmm0,0x10
+	aeskeygenassist	xmm1,xmm0,0x10  ; round 5
 	call	$L$key_expansion_128
-	aeskeygenassist	xmm1,xmm0,0x20
+	aeskeygenassist	xmm1,xmm0,0x20  ; round 6
 	call	$L$key_expansion_128
-	aeskeygenassist	xmm1,xmm0,0x40
+	aeskeygenassist	xmm1,xmm0,0x40  ; round 7
 	call	$L$key_expansion_128
-	aeskeygenassist	xmm1,xmm0,0x80
+	aeskeygenassist	xmm1,xmm0,0x80  ; round 8
 	call	$L$key_expansion_128
-	aeskeygenassist	xmm1,xmm0,0x1b
+	aeskeygenassist	xmm1,xmm0,0x1b  ; round 9
 	call	$L$key_expansion_128
-	aeskeygenassist	xmm1,xmm0,0x36
+	aeskeygenassist	xmm1,xmm0,0x36  ; round 10
 	call	$L$key_expansion_128
 	movups	XMMWORDrax,xmm0
-	mov	DWORD80+rax,edx
+	mov	DWORD80+rax,edx  ; 240(%rdx)
 	xor	eax,eax
 	jmp	NEAR $L$enc_key_ret
 
 ALIGN	16
 $L$12rounds:
-	movq	xmm2,QWORD16+rcx
-	mov	edx,11
+	movq	xmm2,QWORD16+rcx  ; remaining 1/3 of *userKey
+	mov	edx,11  ; 12 rounds for 192
 
-	movups	XMMWORDr8,xmm0
-	aeskeygenassist	xmm1,xmm2,0x1
+	movups	XMMWORDr8,xmm0  ; round 0
+	aeskeygenassist	xmm1,xmm2,0x1  ; round 1,2
 	call	$L$key_expansion_192a_cold
-	aeskeygenassist	xmm1,xmm2,0x2
+	aeskeygenassist	xmm1,xmm2,0x2  ; round 2,3
 	call	$L$key_expansion_192b
-	aeskeygenassist	xmm1,xmm2,0x4
+	aeskeygenassist	xmm1,xmm2,0x4  ; round 4,5
 	call	$L$key_expansion_192a
-	aeskeygenassist	xmm1,xmm2,0x8
+	aeskeygenassist	xmm1,xmm2,0x8  ; round 5,6
 	call	$L$key_expansion_192b
-	aeskeygenassist	xmm1,xmm2,0x10
+	aeskeygenassist	xmm1,xmm2,0x10  ; round 7,8
 	call	$L$key_expansion_192a
-	aeskeygenassist	xmm1,xmm2,0x20
+	aeskeygenassist	xmm1,xmm2,0x20  ; round 8,9
 	call	$L$key_expansion_192b
-	aeskeygenassist	xmm1,xmm2,0x40
+	aeskeygenassist	xmm1,xmm2,0x40  ; round 10,11
 	call	$L$key_expansion_192a
-	aeskeygenassist	xmm1,xmm2,0x80
+	aeskeygenassist	xmm1,xmm2,0x80  ; round 11,12
 	call	$L$key_expansion_192b
 	movups	XMMWORDrax,xmm0
-	mov	DWORD48+rax,edx
+	mov	DWORD48+rax,edx  ; 240(%rdx)
 	xor	rax,rax
 	jmp	NEAR $L$enc_key_ret
 
 ALIGN	16
 $L$14rounds:
-	movups	xmm2,XMMWORD16+rcx
-	mov	edx,13
+	movups	xmm2,XMMWORD16+rcx  ; remaining half of *userKey
+	mov	edx,13  ; 14 rounds for 256
 	lea	rax,16+rax
 
-	movups	XMMWORDr8,xmm0
-	movups	XMMWORD16+r8,xmm2
-	aeskeygenassist	xmm1,xmm2,0x1
+	movups	XMMWORDr8,xmm0  ; round 0
+	movups	XMMWORD16+r8,xmm2  ; round 1
+	aeskeygenassist	xmm1,xmm2,0x1  ; round 2
 	call	$L$key_expansion_256a_cold
-	aeskeygenassist	xmm1,xmm0,0x1
+	aeskeygenassist	xmm1,xmm0,0x1  ; round 3
 	call	$L$key_expansion_256b
-	aeskeygenassist	xmm1,xmm2,0x2
+	aeskeygenassist	xmm1,xmm2,0x2  ; round 4
 	call	$L$key_expansion_256a
-	aeskeygenassist	xmm1,xmm0,0x2
+	aeskeygenassist	xmm1,xmm0,0x2  ; round 5
 	call	$L$key_expansion_256b
-	aeskeygenassist	xmm1,xmm2,0x4
+	aeskeygenassist	xmm1,xmm2,0x4  ; round 6
 	call	$L$key_expansion_256a
-	aeskeygenassist	xmm1,xmm0,0x4
+	aeskeygenassist	xmm1,xmm0,0x4  ; round 7
 	call	$L$key_expansion_256b
-	aeskeygenassist	xmm1,xmm2,0x8
+	aeskeygenassist	xmm1,xmm2,0x8  ; round 8
 	call	$L$key_expansion_256a
-	aeskeygenassist	xmm1,xmm0,0x8
+	aeskeygenassist	xmm1,xmm0,0x8  ; round 9
 	call	$L$key_expansion_256b
-	aeskeygenassist	xmm1,xmm2,0x10
+	aeskeygenassist	xmm1,xmm2,0x10  ; round 10
 	call	$L$key_expansion_256a
-	aeskeygenassist	xmm1,xmm0,0x10
+	aeskeygenassist	xmm1,xmm0,0x10  ; round 11
 	call	$L$key_expansion_256b
-	aeskeygenassist	xmm1,xmm2,0x20
+	aeskeygenassist	xmm1,xmm2,0x20  ; round 12
 	call	$L$key_expansion_256a
-	aeskeygenassist	xmm1,xmm0,0x20
+	aeskeygenassist	xmm1,xmm0,0x20  ; round 13
 	call	$L$key_expansion_256b
-	aeskeygenassist	xmm1,xmm2,0x40
+	aeskeygenassist	xmm1,xmm2,0x40  ; round 14
 	call	$L$key_expansion_256a
 	movups	XMMWORDrax,xmm0
-	mov	DWORD16+rax,edx
+	mov	DWORD16+rax,edx  ; 240(%rdx)
 	xor	rax,rax
 	jmp	NEAR $L$enc_key_ret
 
@@ -2196,7 +2196,7 @@
 	xorps	xmm0,xmm4
 	shufps	xmm4,xmm0,140
 	xorps	xmm0,xmm4
-	shufps	xmm1,xmm1,255
+	shufps	xmm1,xmm1,255  ; critical path
 	xorps	xmm0,xmm1
 	ret
 
@@ -2215,7 +2215,7 @@
 	shufps	xmm4,xmm0,140
 	pslldq	xmm3,4
 	xorps	xmm0,xmm4
-	pshufd	xmm1,xmm1,85
+	pshufd	xmm1,xmm1,85  ; critical path
 	pxor	xmm2,xmm3
 	pxor	xmm0,xmm1
 	pshufd	xmm3,xmm0,255
@@ -2245,7 +2245,7 @@
 	xorps	xmm0,xmm4
 	shufps	xmm4,xmm0,140
 	xorps	xmm0,xmm4
-	shufps	xmm1,xmm1,255
+	shufps	xmm1,xmm1,255  ; critical path
 	xorps	xmm0,xmm1
 	ret
 
@@ -2260,7 +2260,7 @@
 	xorps	xmm2,xmm4
 	shufps	xmm4,xmm2,140
 	xorps	xmm2,xmm4
-	shufps	xmm1,xmm1,170
+	shufps	xmm1,xmm1,170  ; critical path
 	xorps	xmm2,xmm1
 	ret
 
@@ -2279,9 +2279,9 @@
 
 $L$SEH_prologue_aes_hw_set_encrypt_key_alt_2:
 $L$SEH_endprologue_aes_hw_set_encrypt_key_alt_3:
-	movups	xmm0,XMMWORDrcx
-	xorps	xmm4,xmm4
-	lea	rax,16+r8
+	movups	xmm0,XMMWORDrcx  ; pull first 128 bits of *userKey
+	xorps	xmm4,xmm4  ; low dword of xmm4 is assumed 0
+	lea	rax,16+r8  ; %rax is used as modifiable copy of %r8
 	cmp	edx,256
 	je	NEAR $L$14rounds_alt
 	cmp	edx,192
@@ -2289,7 +2289,7 @@
 	cmp	edx,128
 	jne	NEAR $L$bad_keybits_alt
 
-	mov	edx,9
+	mov	edx,9  ; 10 rounds for 128-bit key
 	movdqa	xmm5,XMMWORD$L$key_rotate
 	mov	r10d,8
 	movdqa	xmm4,XMMWORD$L$key_rcon1
@@ -2351,14 +2351,14 @@
 	pxor	xmm0,xmm2
 	movdqu	XMMWORD16+rax,xmm0
 
-	mov	DWORD96+rax,edx
+	mov	DWORD96+rax,edx  ; 240(%r8)
 	xor	eax,eax
 	jmp	NEAR $L$enc_key_ret_alt
 
 ALIGN	16
 $L$12rounds_alt:
-	movq	xmm2,QWORD16+rcx
-	mov	edx,11
+	movq	xmm2,QWORD16+rcx  ; remaining 1/3 of *userKey
+	mov	edx,11  ; 12 rounds for 192
 	movdqa	xmm5,XMMWORD$L$key_rotate192
 	movdqa	xmm4,XMMWORD$L$key_rcon1
 	mov	r10d,8
@@ -2394,14 +2394,14 @@
 	dec	r10d
 	jnz	NEAR $L$oop_key192
 
-	mov	DWORD32+rax,edx
+	mov	DWORD32+rax,edx  ; 240(%r8)
 	xor	eax,eax
 	jmp	NEAR $L$enc_key_ret_alt
 
 ALIGN	16
 $L$14rounds_alt:
-	movups	xmm2,XMMWORD16+rcx
-	mov	edx,13
+	movups	xmm2,XMMWORD16+rcx  ; remaining half of *userKey
+	mov	edx,13  ; 14 rounds for 256
 	lea	rax,16+rax
 	movdqa	xmm5,XMMWORD$L$key_rotate
 	movdqa	xmm4,XMMWORD$L$key_rcon1
@@ -2451,7 +2451,7 @@
 	jmp	NEAR $L$oop_key256
 
 $L$done_key256:
-	mov	DWORD16+rax,edx
+	mov	DWORD16+rax,edx  ; 240(%r8)
 	xor	eax,eax
 	jmp	NEAR $L$enc_key_ret_alt
 
@@ -2499,7 +2499,7 @@
 	DB	32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115
 	DB	115,108,46,111,114,103,62,0
 ALIGN	64
-section	.text
+section	.text code align=64
 
 EXTERN	__imp_RtlVirtualUnwind
 
@@ -2516,29 +2516,29 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; prologue label
+	cmp	rbx,r10  ; context->Rip<prologue label
 	jb	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$common_seh_tail
 
-	lea	rsi,rax
-	lea	rdi,512+r8
-	mov	ecx,8
-	DD	0xa548f3fc
-	lea	rax,88+rax
+	lea	rsi,rax  ; %xmm save area
+	lea	rdi,512+r8  ; &context.Xmm6
+	mov	ecx,8  ; 4*sizeof(%xmm0)/sizeof(%rax)
+	DD	0xa548f3fc  ; cld; rep movsq
+	lea	rax,88+rax  ; adjust stack pointer
 
 	jmp	NEAR $L$common_seh_tail
 
@@ -2557,33 +2557,33 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; prologue label
+	cmp	rbx,r10  ; context->Rip<prologue label
 	jb	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD208+r8
+	mov	rax,QWORD208+r8  ; pull context->R11
 
-	lea	rsi,((-168))+rax
-	lea	rdi,512+r8
-	mov	ecx,20
-	DD	0xa548f3fc
+	lea	rsi,((-168))+rax  ; %xmm save area
+	lea	rdi,512+r8  ; & context.Xmm6
+	mov	ecx,20  ; 10*sizeof(%xmm0)/sizeof(%rax)
+	DD	0xa548f3fc  ; cld; rep movsq
 
-	mov	rbp,QWORD((-8))+rax
-	mov	QWORD160+r8,rbp
+	mov	rbp,QWORD((-8))+rax  ; restore saved %rbp
+	mov	QWORD160+r8,rbp  ; restore context->Rbp
 	jmp	NEAR $L$common_seh_tail
 
 
@@ -2601,62 +2601,62 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD152+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
 	lea	r10,$L$cbc_decrypt_bulk
-	cmp	rbx,r10
+	cmp	rbx,r10  ; context->Rip<"prologue" label
 	jb	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD120+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
 
 	lea	r10,$L$cbc_decrypt_body
-	cmp	rbx,r10
+	cmp	rbx,r10  ; context->Rip<cbc_decrypt_body
 	jb	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
 	lea	r10,$L$cbc_ret
-	cmp	rbx,r10
+	cmp	rbx,r10  ; context->Rip>="epilogue" label
 	jae	NEAR $L$common_seh_tail
 
-	lea	rsi,16+rax
-	lea	rdi,512+r8
-	mov	ecx,20
-	DD	0xa548f3fc
+	lea	rsi,16+rax  ; %xmm save area
+	lea	rdi,512+r8  ; &context.Xmm6
+	mov	ecx,20  ; 10*sizeof(%xmm0)/sizeof(%rax)
+	DD	0xa548f3fc  ; cld; rep movsq
 
-	mov	rax,QWORD208+r8
+	mov	rax,QWORD208+r8  ; pull context->R11
 
-	mov	rbp,QWORD((-8))+rax
-	mov	QWORD160+r8,rbp
+	mov	rbp,QWORD((-8))+rax  ; restore saved %rbp
+	mov	QWORD160+r8,rbp  ; restore context->Rbp
 
 $L$common_seh_tail:
 	mov	rdi,QWORD8+rax
 	mov	rsi,QWORD16+rax
-	mov	QWORD152+r8,rax
-	mov	QWORD168+r8,rsi
-	mov	QWORD176+r8,rdi
+	mov	QWORD152+r8,rax  ; restore context->Rsp
+	mov	QWORD168+r8,rsi  ; restore context->Rsi
+	mov	QWORD176+r8,rdi  ; restore context->Rdi
 
-	mov	rdi,QWORD40+r9
-	mov	rsi,r8
-	mov	ecx,154
-	DD	0xa548f3fc
+	mov	rdi,QWORD40+r9  ; disp->ContextRecord
+	mov	rsi,r8  ; context
+	mov	ecx,154  ; sizeof(CONTEXT)
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	mov	rsi,r9
-	xor	rcx,rcx
-	mov	rdx,QWORD8+rsi
-	mov	r8,QWORDrsi
-	mov	r9,QWORD16+rsi
-	mov	r10,QWORD40+rsi
-	lea	r11,56+rsi
-	lea	r12,24+rsi
-	mov	QWORD32+rsp,r10
-	mov	QWORD40+rsp,r11
-	mov	QWORD48+rsp,r12
-	mov	QWORD56+rsp,rcx
+	xor	rcx,rcx  ; arg1, UNW_FLAG_NHANDLER
+	mov	rdx,QWORD8+rsi  ; arg2, disp->ImageBase
+	mov	r8,QWORDrsi  ; arg3, disp->ControlPc
+	mov	r9,QWORD16+rsi  ; arg4, disp->FunctionEntry
+	mov	r10,QWORD40+rsi  ; disp->ContextRecord
+	lea	r11,56+rsi  ; &disp->HandlerData
+	lea	r12,24+rsi  ; &disp->EstablisherFrame
+	mov	QWORD32+rsp,r10  ; arg5
+	mov	QWORD40+rsp,r11  ; arg6
+	mov	QWORD48+rsp,r12  ; arg7
+	mov	QWORD56+rsp,rcx  ; arg8, (NULL)
 	call	QWORD__imp_RtlVirtualUnwind
 
-	mov	eax,1
+	mov	eax,1  ; ExceptionContinueSearch
 	add	rsp,64
 	popfq
 	pop	r15
@@ -2687,15 +2687,15 @@
 $L$SEH_info_ecb:
 	DB	9,0,0,0
 	DD	ecb_ccm64_se_handler wrt ..imagebase
-	DD	$L$ecb_enc_body wrt ..imagebase,$L$ecb_enc_ret wrt ..imagebase
+	DD	$L$ecb_enc_body wrt ..imagebase,$L$ecb_enc_ret wrt ..imagebase  ; HandlerData
 $L$SEH_info_ctr32:
 	DB	9,0,0,0
 	DD	ctr_xts_se_handler wrt ..imagebase
-	DD	$L$ctr32_body wrt ..imagebase,$L$ctr32_epilogue wrt ..imagebase
+	DD	$L$ctr32_body wrt ..imagebase,$L$ctr32_epilogue wrt ..imagebase  ; HandlerData
 $L$SEH_info_cbc:
 	DB	9,0,0,0
 	DD	cbc_se_handler wrt ..imagebase
-section	.pdata
+section	.pdata rdata align=4
 ALIGN	4
 	DD	$L$SEH_begin_aes_hw_set_encrypt_key_base_1 wrt ..imagebase
 	DD	$L$SEH_end_aes_hw_set_encrypt_key_base_4 wrt ..imagebase
@@ -2706,10 +2706,10 @@
 	DD	$L$SEH_info_aes_hw_set_encrypt_key_alt_0 wrt ..imagebase
 
 
-section	.xdata
+section	.xdata rdata align=8
 ALIGN	4
 $L$SEH_info_aes_hw_set_encrypt_key_base_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_aes_hw_set_encrypt_key_base_3-$L$SEH_begin_aes_hw_set_encrypt_key_base_1
 	DB	1
 	DB	0
@@ -2718,7 +2718,7 @@
 
 	DW	0
 $L$SEH_info_aes_hw_set_encrypt_key_alt_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_aes_hw_set_encrypt_key_alt_3-$L$SEH_begin_aes_hw_set_encrypt_key_alt_1
 	DB	1
 	DB	0

boringssl-0.20260708.tar.xz/gen/bcm/ghash-ssse3-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/ghash-ssse3-x86_64-apple.S Changed

@@ -6,10 +6,10 @@
 #if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && defined(__APPLE__)
 .text	
 
-
-
-
-
+// gcm_gmult_ssse3 multiplies |Xi| by |Htable| and writes the result to |Xi|.
+// |Xi| is represented in GHASH's serialized byte representation. |Htable| is
+// formatted as described above.
+// void gcm_gmult_ssse3(uint64_t Xi2, const u128 Htable16);
 
 .globl	_gcm_gmult_ssse3
 .private_extern _gcm_gmult_ssse3
@@ -22,18 +22,18 @@
 	movdqa	L$reverse_bytes(%rip),%xmm10
 	movdqa	L$low4_mask(%rip),%xmm2
 
-
+// Reverse input bytes to deserialize.
 	pshufb	%xmm10,%xmm0
 
-
+// Split each byte into low (%xmm0) and high (%xmm1) halves.
 	movdqa	%xmm2,%xmm1
 	pandn	%xmm0,%xmm1
 	psrld	$4,%xmm1
 	pand	%xmm2,%xmm0
 
-
-
-
+// Maintain the result in %xmm2 (the value) and %xmm3 (carry bits). Note
+// that, due to bit reversal, %xmm3 contains bits that fall off when
+// right-shifting, not left-shifting.
 	pxor	%xmm2,%xmm2
 	pxor	%xmm3,%xmm3
 	movq	$5,%rax
@@ -41,31 +41,31 @@
 	movdqu	(%rsi),%xmm4
 	leaq	16(%rsi),%rsi
 
-
+// Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	%xmm2,%xmm6
 	palignr	$1,%xmm3,%xmm6
 	movdqa	%xmm6,%xmm3
 	psrldq	$1,%xmm2
 
-
-
-
+// Load the next table row and index the low and high bits of the input.
+// Note the low (respectively, high) half corresponds to more
+// (respectively, less) significant coefficients.
 	movdqa	%xmm4,%xmm5
 	pshufb	%xmm0,%xmm4
 	pshufb	%xmm1,%xmm5
 
-
+// Add the high half (%xmm5) without shifting.
 	pxor	%xmm5,%xmm2
 
-
-
+// Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+// add into the carry register (%xmm3).
 	movdqa	%xmm4,%xmm5
 	psllq	$60,%xmm5
 	movdqa	%xmm5,%xmm6
 	pslldq	$8,%xmm6
 	pxor	%xmm6,%xmm3
 
-
+// Next, add into %xmm2.
 	psrldq	$8,%xmm5
 	pxor	%xmm5,%xmm2
 	psrlq	$4,%xmm4
@@ -74,46 +74,46 @@
 	subq	$1,%rax
 	jnz	L$oop_row_1
 
-
-
-	pxor	%xmm3,%xmm2
+// Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+// x^7, so we shift and XOR four times.
+	pxor	%xmm3,%xmm2  // x^0 = 0
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^1 = x
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1) = x^2
 	psrlq	$5,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1+5) = x^7
 	pxor	%xmm3,%xmm3
 	movq	$5,%rax
 L$oop_row_2:
 	movdqu	(%rsi),%xmm4
 	leaq	16(%rsi),%rsi
 
-
+// Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	%xmm2,%xmm6
 	palignr	$1,%xmm3,%xmm6
 	movdqa	%xmm6,%xmm3
 	psrldq	$1,%xmm2
 
-
-
-
+// Load the next table row and index the low and high bits of the input.
+// Note the low (respectively, high) half corresponds to more
+// (respectively, less) significant coefficients.
 	movdqa	%xmm4,%xmm5
 	pshufb	%xmm0,%xmm4
 	pshufb	%xmm1,%xmm5
 
-
+// Add the high half (%xmm5) without shifting.
 	pxor	%xmm5,%xmm2
 
-
-
+// Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+// add into the carry register (%xmm3).
 	movdqa	%xmm4,%xmm5
 	psllq	$60,%xmm5
 	movdqa	%xmm5,%xmm6
 	pslldq	$8,%xmm6
 	pxor	%xmm6,%xmm3
 
-
+// Next, add into %xmm2.
 	psrldq	$8,%xmm5
 	pxor	%xmm5,%xmm2
 	psrlq	$4,%xmm4
@@ -122,46 +122,46 @@
 	subq	$1,%rax
 	jnz	L$oop_row_2
 
-
-
-	pxor	%xmm3,%xmm2
+// Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+// x^7, so we shift and XOR four times.
+	pxor	%xmm3,%xmm2  // x^0 = 0
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^1 = x
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1) = x^2
 	psrlq	$5,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1+5) = x^7
 	pxor	%xmm3,%xmm3
 	movq	$6,%rax
 L$oop_row_3:
 	movdqu	(%rsi),%xmm4
 	leaq	16(%rsi),%rsi
 
-
+// Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	%xmm2,%xmm6
 	palignr	$1,%xmm3,%xmm6
 	movdqa	%xmm6,%xmm3
 	psrldq	$1,%xmm2
 
-
-
-
+// Load the next table row and index the low and high bits of the input.
+// Note the low (respectively, high) half corresponds to more
+// (respectively, less) significant coefficients.
 	movdqa	%xmm4,%xmm5
 	pshufb	%xmm0,%xmm4
 	pshufb	%xmm1,%xmm5
 
-
+// Add the high half (%xmm5) without shifting.
 	pxor	%xmm5,%xmm2
 
-
-
+// Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+// add into the carry register (%xmm3).
 	movdqa	%xmm4,%xmm5
 	psllq	$60,%xmm5
 	movdqa	%xmm5,%xmm6
 	pslldq	$8,%xmm6
 	pxor	%xmm6,%xmm3
 
-
+// Next, add into %xmm2.
 	psrldq	$8,%xmm5
 	pxor	%xmm5,%xmm2
 	psrlq	$4,%xmm4
@@ -170,21 +170,21 @@
 	subq	$1,%rax
 	jnz	L$oop_row_3
 
-
-
-	pxor	%xmm3,%xmm2
+// Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+// x^7, so we shift and XOR four times.
+	pxor	%xmm3,%xmm2  // x^0 = 0
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^1 = x
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1) = x^2
 	psrlq	$5,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1+5) = x^7
 	pxor	%xmm3,%xmm3
-
+// Store the result. Reverse bytes to serialize.
 	pshufb	%xmm10,%xmm2
 	movdqu	%xmm2,(%rdi)
 
-
+// Zero any registers which contain secrets.
 	pxor	%xmm0,%xmm0
 	pxor	%xmm1,%xmm1
 	pxor	%xmm2,%xmm2
@@ -196,11 +196,11 @@
 
 
 
-
-
-
-
-
+// gcm_ghash_ssse3 incorporates |len| bytes from |in| to |Xi|, using |Htable| as
+// the key. It writes the result back to |Xi|. |Xi| is represented in GHASH's
+// serialized byte representation. |Htable| is formatted as described above.
+// void gcm_ghash_ssse3(uint64_t Xi2, const u128 Htable16, const uint8_t *in,
+// size_t len);
 
 .globl	_gcm_ghash_ssse3
 .private_extern _gcm_ghash_ssse3
@@ -214,62 +214,62 @@
 	movdqa	L$reverse_bytes(%rip),%xmm10
 	movdqa	L$low4_mask(%rip),%xmm11
 
-
+// This function only processes whole blocks.
 	andq	$-16,%rcx
 
-
-
+// Reverse input bytes to deserialize. We maintain the running
+// total in %xmm0.
 	pshufb	%xmm10,%xmm0
 
-
+// Iterate over each block. On entry to each iteration, %xmm3 is zero.
 	pxor	%xmm3,%xmm3
 L$oop_ghash:
-
+// Incorporate the next block of input.
 	movdqu	(%rdx),%xmm1
-	pshufb	%xmm10,%xmm1
+	pshufb	%xmm10,%xmm1  // Reverse bytes.
 	pxor	%xmm1,%xmm0
 
-
+// Split each byte into low (%xmm0) and high (%xmm1) halves.
 	movdqa	%xmm11,%xmm1
 	pandn	%xmm0,%xmm1
 	psrld	$4,%xmm1
 	pand	%xmm11,%xmm0
 
-
-
-
+// Maintain the result in %xmm2 (the value) and %xmm3 (carry bits). Note
+// that, due to bit reversal, %xmm3 contains bits that fall off when
+// right-shifting, not left-shifting.
 	pxor	%xmm2,%xmm2
-
+// %xmm3 is already zero at this point.
 	movq	$5,%rax
 L$oop_row_4:
 	movdqu	(%rsi),%xmm4
 	leaq	16(%rsi),%rsi
 
-
+// Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	%xmm2,%xmm6
 	palignr	$1,%xmm3,%xmm6
 	movdqa	%xmm6,%xmm3
 	psrldq	$1,%xmm2
 
-
-
-
+// Load the next table row and index the low and high bits of the input.
+// Note the low (respectively, high) half corresponds to more
+// (respectively, less) significant coefficients.
 	movdqa	%xmm4,%xmm5
 	pshufb	%xmm0,%xmm4
 	pshufb	%xmm1,%xmm5
 
-
+// Add the high half (%xmm5) without shifting.
 	pxor	%xmm5,%xmm2
 
-
-
+// Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+// add into the carry register (%xmm3).
 	movdqa	%xmm4,%xmm5
 	psllq	$60,%xmm5
 	movdqa	%xmm5,%xmm6
 	pslldq	$8,%xmm6
 	pxor	%xmm6,%xmm3
 
-
+// Next, add into %xmm2.
 	psrldq	$8,%xmm5
 	pxor	%xmm5,%xmm2
 	psrlq	$4,%xmm4
@@ -278,46 +278,46 @@
 	subq	$1,%rax
 	jnz	L$oop_row_4
 
-
-
-	pxor	%xmm3,%xmm2
+// Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+// x^7, so we shift and XOR four times.
+	pxor	%xmm3,%xmm2  // x^0 = 0
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^1 = x
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1) = x^2
 	psrlq	$5,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1+5) = x^7
 	pxor	%xmm3,%xmm3
 	movq	$5,%rax
 L$oop_row_5:
 	movdqu	(%rsi),%xmm4
 	leaq	16(%rsi),%rsi
 
-
+// Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	%xmm2,%xmm6
 	palignr	$1,%xmm3,%xmm6
 	movdqa	%xmm6,%xmm3
 	psrldq	$1,%xmm2
 
-
-
-
+// Load the next table row and index the low and high bits of the input.
+// Note the low (respectively, high) half corresponds to more
+// (respectively, less) significant coefficients.
 	movdqa	%xmm4,%xmm5
 	pshufb	%xmm0,%xmm4
 	pshufb	%xmm1,%xmm5
 
-
+// Add the high half (%xmm5) without shifting.
 	pxor	%xmm5,%xmm2
 
-
-
+// Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+// add into the carry register (%xmm3).
 	movdqa	%xmm4,%xmm5
 	psllq	$60,%xmm5
 	movdqa	%xmm5,%xmm6
 	pslldq	$8,%xmm6
 	pxor	%xmm6,%xmm3
 
-
+// Next, add into %xmm2.
 	psrldq	$8,%xmm5
 	pxor	%xmm5,%xmm2
 	psrlq	$4,%xmm4
@@ -326,46 +326,46 @@
 	subq	$1,%rax
 	jnz	L$oop_row_5
 
-
-
-	pxor	%xmm3,%xmm2
+// Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+// x^7, so we shift and XOR four times.
+	pxor	%xmm3,%xmm2  // x^0 = 0
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^1 = x
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1) = x^2
 	psrlq	$5,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1+5) = x^7
 	pxor	%xmm3,%xmm3
 	movq	$6,%rax
 L$oop_row_6:
 	movdqu	(%rsi),%xmm4
 	leaq	16(%rsi),%rsi
 
-
+// Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	%xmm2,%xmm6
 	palignr	$1,%xmm3,%xmm6
 	movdqa	%xmm6,%xmm3
 	psrldq	$1,%xmm2
 
-
-
-
+// Load the next table row and index the low and high bits of the input.
+// Note the low (respectively, high) half corresponds to more
+// (respectively, less) significant coefficients.
 	movdqa	%xmm4,%xmm5
 	pshufb	%xmm0,%xmm4
 	pshufb	%xmm1,%xmm5
 
-
+// Add the high half (%xmm5) without shifting.
 	pxor	%xmm5,%xmm2
 
-
-
+// Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+// add into the carry register (%xmm3).
 	movdqa	%xmm4,%xmm5
 	psllq	$60,%xmm5
 	movdqa	%xmm5,%xmm6
 	pslldq	$8,%xmm6
 	pxor	%xmm6,%xmm3
 
-
+// Next, add into %xmm2.
 	psrldq	$8,%xmm5
 	pxor	%xmm5,%xmm2
 	psrlq	$4,%xmm4
@@ -374,31 +374,31 @@
 	subq	$1,%rax
 	jnz	L$oop_row_6
 
-
-
-	pxor	%xmm3,%xmm2
+// Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+// x^7, so we shift and XOR four times.
+	pxor	%xmm3,%xmm2  // x^0 = 0
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^1 = x
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1) = x^2
 	psrlq	$5,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1+5) = x^7
 	pxor	%xmm3,%xmm3
 	movdqa	%xmm2,%xmm0
 
-
+// Rewind %rsi for the next iteration.
 	leaq	-256(%rsi),%rsi
 
-
+// Advance input and continue.
 	leaq	16(%rdx),%rdx
 	subq	$16,%rcx
 	jnz	L$oop_ghash
 
-
+// Reverse bytes and store the result.
 	pshufb	%xmm10,%xmm0
 	movdqu	%xmm0,(%rdi)
 
-
+// Zero any registers which contain secrets.
 	pxor	%xmm0,%xmm0
 	pxor	%xmm1,%xmm1
 	pxor	%xmm2,%xmm2
@@ -415,11 +415,11 @@
 
 .p2align	4
 ghash_ssse3_constants:
-
-
+// .Lreverse_bytes is a permutation which, if applied with pshufb, reverses the
+// bytes in an XMM register.
 L$reverse_bytes:
 .byte	15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0
-
+// .Llow4_mask is an XMM mask which selects the low four bits of each byte.
 L$low4_mask:
 .quad	0x0f0f0f0f0f0f0f0f, 0x0f0f0f0f0f0f0f0f
 .text

boringssl-0.20260708.tar.xz/gen/bcm/ghash-ssse3-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/ghash-ssse3-x86_64-linux.S Changed

@@ -6,10 +6,10 @@
 #if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && defined(__ELF__)
 .text	
 
-
-
-
-
+// gcm_gmult_ssse3 multiplies |Xi| by |Htable| and writes the result to |Xi|.
+// |Xi| is represented in GHASH's serialized byte representation. |Htable| is
+// formatted as described above.
+// void gcm_gmult_ssse3(uint64_t Xi2, const u128 Htable16);
 .type	gcm_gmult_ssse3, @function
 .globl	gcm_gmult_ssse3
 .hidden gcm_gmult_ssse3
@@ -22,18 +22,18 @@
 	movdqa	.Lreverse_bytes(%rip),%xmm10
 	movdqa	.Llow4_mask(%rip),%xmm2
 
-
+// Reverse input bytes to deserialize.
 	pshufb	%xmm10,%xmm0
 
-
+// Split each byte into low (%xmm0) and high (%xmm1) halves.
 	movdqa	%xmm2,%xmm1
 	pandn	%xmm0,%xmm1
 	psrld	$4,%xmm1
 	pand	%xmm2,%xmm0
 
-
-
-
+// Maintain the result in %xmm2 (the value) and %xmm3 (carry bits). Note
+// that, due to bit reversal, %xmm3 contains bits that fall off when
+// right-shifting, not left-shifting.
 	pxor	%xmm2,%xmm2
 	pxor	%xmm3,%xmm3
 	movq	$5,%rax
@@ -41,31 +41,31 @@
 	movdqu	(%rsi),%xmm4
 	leaq	16(%rsi),%rsi
 
-
+// Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	%xmm2,%xmm6
 	palignr	$1,%xmm3,%xmm6
 	movdqa	%xmm6,%xmm3
 	psrldq	$1,%xmm2
 
-
-
-
+// Load the next table row and index the low and high bits of the input.
+// Note the low (respectively, high) half corresponds to more
+// (respectively, less) significant coefficients.
 	movdqa	%xmm4,%xmm5
 	pshufb	%xmm0,%xmm4
 	pshufb	%xmm1,%xmm5
 
-
+// Add the high half (%xmm5) without shifting.
 	pxor	%xmm5,%xmm2
 
-
-
+// Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+// add into the carry register (%xmm3).
 	movdqa	%xmm4,%xmm5
 	psllq	$60,%xmm5
 	movdqa	%xmm5,%xmm6
 	pslldq	$8,%xmm6
 	pxor	%xmm6,%xmm3
 
-
+// Next, add into %xmm2.
 	psrldq	$8,%xmm5
 	pxor	%xmm5,%xmm2
 	psrlq	$4,%xmm4
@@ -74,46 +74,46 @@
 	subq	$1,%rax
 	jnz	.Loop_row_1
 
-
-
-	pxor	%xmm3,%xmm2
+// Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+// x^7, so we shift and XOR four times.
+	pxor	%xmm3,%xmm2  // x^0 = 0
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^1 = x
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1) = x^2
 	psrlq	$5,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1+5) = x^7
 	pxor	%xmm3,%xmm3
 	movq	$5,%rax
 .Loop_row_2:
 	movdqu	(%rsi),%xmm4
 	leaq	16(%rsi),%rsi
 
-
+// Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	%xmm2,%xmm6
 	palignr	$1,%xmm3,%xmm6
 	movdqa	%xmm6,%xmm3
 	psrldq	$1,%xmm2
 
-
-
-
+// Load the next table row and index the low and high bits of the input.
+// Note the low (respectively, high) half corresponds to more
+// (respectively, less) significant coefficients.
 	movdqa	%xmm4,%xmm5
 	pshufb	%xmm0,%xmm4
 	pshufb	%xmm1,%xmm5
 
-
+// Add the high half (%xmm5) without shifting.
 	pxor	%xmm5,%xmm2
 
-
-
+// Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+// add into the carry register (%xmm3).
 	movdqa	%xmm4,%xmm5
 	psllq	$60,%xmm5
 	movdqa	%xmm5,%xmm6
 	pslldq	$8,%xmm6
 	pxor	%xmm6,%xmm3
 
-
+// Next, add into %xmm2.
 	psrldq	$8,%xmm5
 	pxor	%xmm5,%xmm2
 	psrlq	$4,%xmm4
@@ -122,46 +122,46 @@
 	subq	$1,%rax
 	jnz	.Loop_row_2
 
-
-
-	pxor	%xmm3,%xmm2
+// Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+// x^7, so we shift and XOR four times.
+	pxor	%xmm3,%xmm2  // x^0 = 0
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^1 = x
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1) = x^2
 	psrlq	$5,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1+5) = x^7
 	pxor	%xmm3,%xmm3
 	movq	$6,%rax
 .Loop_row_3:
 	movdqu	(%rsi),%xmm4
 	leaq	16(%rsi),%rsi
 
-
+// Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	%xmm2,%xmm6
 	palignr	$1,%xmm3,%xmm6
 	movdqa	%xmm6,%xmm3
 	psrldq	$1,%xmm2
 
-
-
-
+// Load the next table row and index the low and high bits of the input.
+// Note the low (respectively, high) half corresponds to more
+// (respectively, less) significant coefficients.
 	movdqa	%xmm4,%xmm5
 	pshufb	%xmm0,%xmm4
 	pshufb	%xmm1,%xmm5
 
-
+// Add the high half (%xmm5) without shifting.
 	pxor	%xmm5,%xmm2
 
-
-
+// Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+// add into the carry register (%xmm3).
 	movdqa	%xmm4,%xmm5
 	psllq	$60,%xmm5
 	movdqa	%xmm5,%xmm6
 	pslldq	$8,%xmm6
 	pxor	%xmm6,%xmm3
 
-
+// Next, add into %xmm2.
 	psrldq	$8,%xmm5
 	pxor	%xmm5,%xmm2
 	psrlq	$4,%xmm4
@@ -170,21 +170,21 @@
 	subq	$1,%rax
 	jnz	.Loop_row_3
 
-
-
-	pxor	%xmm3,%xmm2
+// Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+// x^7, so we shift and XOR four times.
+	pxor	%xmm3,%xmm2  // x^0 = 0
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^1 = x
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1) = x^2
 	psrlq	$5,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1+5) = x^7
 	pxor	%xmm3,%xmm3
-
+// Store the result. Reverse bytes to serialize.
 	pshufb	%xmm10,%xmm2
 	movdqu	%xmm2,(%rdi)
 
-
+// Zero any registers which contain secrets.
 	pxor	%xmm0,%xmm0
 	pxor	%xmm1,%xmm1
 	pxor	%xmm2,%xmm2
@@ -196,11 +196,11 @@
 .cfi_endproc	
 
 .size	gcm_gmult_ssse3,.-gcm_gmult_ssse3
-
-
-
-
-
+// gcm_ghash_ssse3 incorporates |len| bytes from |in| to |Xi|, using |Htable| as
+// the key. It writes the result back to |Xi|. |Xi| is represented in GHASH's
+// serialized byte representation. |Htable| is formatted as described above.
+// void gcm_ghash_ssse3(uint64_t Xi2, const u128 Htable16, const uint8_t *in,
+// size_t len);
 .type	gcm_ghash_ssse3, @function
 .globl	gcm_ghash_ssse3
 .hidden gcm_ghash_ssse3
@@ -213,62 +213,62 @@
 	movdqa	.Lreverse_bytes(%rip),%xmm10
 	movdqa	.Llow4_mask(%rip),%xmm11
 
-
+// This function only processes whole blocks.
 	andq	$-16,%rcx
 
-
-
+// Reverse input bytes to deserialize. We maintain the running
+// total in %xmm0.
 	pshufb	%xmm10,%xmm0
 
-
+// Iterate over each block. On entry to each iteration, %xmm3 is zero.
 	pxor	%xmm3,%xmm3
 .Loop_ghash:
-
+// Incorporate the next block of input.
 	movdqu	(%rdx),%xmm1
-	pshufb	%xmm10,%xmm1
+	pshufb	%xmm10,%xmm1  // Reverse bytes.
 	pxor	%xmm1,%xmm0
 
-
+// Split each byte into low (%xmm0) and high (%xmm1) halves.
 	movdqa	%xmm11,%xmm1
 	pandn	%xmm0,%xmm1
 	psrld	$4,%xmm1
 	pand	%xmm11,%xmm0
 
-
-
-
+// Maintain the result in %xmm2 (the value) and %xmm3 (carry bits). Note
+// that, due to bit reversal, %xmm3 contains bits that fall off when
+// right-shifting, not left-shifting.
 	pxor	%xmm2,%xmm2
-
+// %xmm3 is already zero at this point.
 	movq	$5,%rax
 .Loop_row_4:
 	movdqu	(%rsi),%xmm4
 	leaq	16(%rsi),%rsi
 
-
+// Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	%xmm2,%xmm6
 	palignr	$1,%xmm3,%xmm6
 	movdqa	%xmm6,%xmm3
 	psrldq	$1,%xmm2
 
-
-
-
+// Load the next table row and index the low and high bits of the input.
+// Note the low (respectively, high) half corresponds to more
+// (respectively, less) significant coefficients.
 	movdqa	%xmm4,%xmm5
 	pshufb	%xmm0,%xmm4
 	pshufb	%xmm1,%xmm5
 
-
+// Add the high half (%xmm5) without shifting.
 	pxor	%xmm5,%xmm2
 
-
-
+// Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+// add into the carry register (%xmm3).
 	movdqa	%xmm4,%xmm5
 	psllq	$60,%xmm5
 	movdqa	%xmm5,%xmm6
 	pslldq	$8,%xmm6
 	pxor	%xmm6,%xmm3
 
-
+// Next, add into %xmm2.
 	psrldq	$8,%xmm5
 	pxor	%xmm5,%xmm2
 	psrlq	$4,%xmm4
@@ -277,46 +277,46 @@
 	subq	$1,%rax
 	jnz	.Loop_row_4
 
-
-
-	pxor	%xmm3,%xmm2
+// Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+// x^7, so we shift and XOR four times.
+	pxor	%xmm3,%xmm2  // x^0 = 0
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^1 = x
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1) = x^2
 	psrlq	$5,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1+5) = x^7
 	pxor	%xmm3,%xmm3
 	movq	$5,%rax
 .Loop_row_5:
 	movdqu	(%rsi),%xmm4
 	leaq	16(%rsi),%rsi
 
-
+// Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	%xmm2,%xmm6
 	palignr	$1,%xmm3,%xmm6
 	movdqa	%xmm6,%xmm3
 	psrldq	$1,%xmm2
 
-
-
-
+// Load the next table row and index the low and high bits of the input.
+// Note the low (respectively, high) half corresponds to more
+// (respectively, less) significant coefficients.
 	movdqa	%xmm4,%xmm5
 	pshufb	%xmm0,%xmm4
 	pshufb	%xmm1,%xmm5
 
-
+// Add the high half (%xmm5) without shifting.
 	pxor	%xmm5,%xmm2
 
-
-
+// Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+// add into the carry register (%xmm3).
 	movdqa	%xmm4,%xmm5
 	psllq	$60,%xmm5
 	movdqa	%xmm5,%xmm6
 	pslldq	$8,%xmm6
 	pxor	%xmm6,%xmm3
 
-
+// Next, add into %xmm2.
 	psrldq	$8,%xmm5
 	pxor	%xmm5,%xmm2
 	psrlq	$4,%xmm4
@@ -325,46 +325,46 @@
 	subq	$1,%rax
 	jnz	.Loop_row_5
 
-
-
-	pxor	%xmm3,%xmm2
+// Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+// x^7, so we shift and XOR four times.
+	pxor	%xmm3,%xmm2  // x^0 = 0
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^1 = x
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1) = x^2
 	psrlq	$5,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1+5) = x^7
 	pxor	%xmm3,%xmm3
 	movq	$6,%rax
 .Loop_row_6:
 	movdqu	(%rsi),%xmm4
 	leaq	16(%rsi),%rsi
 
-
+// Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	%xmm2,%xmm6
 	palignr	$1,%xmm3,%xmm6
 	movdqa	%xmm6,%xmm3
 	psrldq	$1,%xmm2
 
-
-
-
+// Load the next table row and index the low and high bits of the input.
+// Note the low (respectively, high) half corresponds to more
+// (respectively, less) significant coefficients.
 	movdqa	%xmm4,%xmm5
 	pshufb	%xmm0,%xmm4
 	pshufb	%xmm1,%xmm5
 
-
+// Add the high half (%xmm5) without shifting.
 	pxor	%xmm5,%xmm2
 
-
-
+// Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+// add into the carry register (%xmm3).
 	movdqa	%xmm4,%xmm5
 	psllq	$60,%xmm5
 	movdqa	%xmm5,%xmm6
 	pslldq	$8,%xmm6
 	pxor	%xmm6,%xmm3
 
-
+// Next, add into %xmm2.
 	psrldq	$8,%xmm5
 	pxor	%xmm5,%xmm2
 	psrlq	$4,%xmm4
@@ -373,31 +373,31 @@
 	subq	$1,%rax
 	jnz	.Loop_row_6
 
-
-
-	pxor	%xmm3,%xmm2
+// Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+// x^7, so we shift and XOR four times.
+	pxor	%xmm3,%xmm2  // x^0 = 0
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^1 = x
 	psrlq	$1,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1) = x^2
 	psrlq	$5,%xmm3
-	pxor	%xmm3,%xmm2
+	pxor	%xmm3,%xmm2  // x^(1+1+5) = x^7
 	pxor	%xmm3,%xmm3
 	movdqa	%xmm2,%xmm0
 
-
+// Rewind %rsi for the next iteration.
 	leaq	-256(%rsi),%rsi
 
-
+// Advance input and continue.
 	leaq	16(%rdx),%rdx
 	subq	$16,%rcx
 	jnz	.Loop_ghash
 
-
+// Reverse bytes and store the result.
 	pshufb	%xmm10,%xmm0
 	movdqu	%xmm0,(%rdi)
 
-
+// Zero any registers which contain secrets.
 	pxor	%xmm0,%xmm0
 	pxor	%xmm1,%xmm1
 	pxor	%xmm2,%xmm2
@@ -414,11 +414,11 @@
 
 .align	16
 ghash_ssse3_constants:
-
-
+// .Lreverse_bytes is a permutation which, if applied with pshufb, reverses the
+// bytes in an XMM register.
 .Lreverse_bytes:
 .byte	15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0
-
+// .Llow4_mask is an XMM mask which selects the low four bits of each byte.
 .Llow4_mask:
 .quad	0x0f0f0f0f0f0f0f0f, 0x0f0f0f0f0f0f0f0f
 .text

boringssl-0.20260708.tar.xz/gen/bcm/ghash-ssse3-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/ghash-ssse3-x86_64-win.asm Changed

@@ -14,10 +14,10 @@
 section	.text code align=64
 
 
-
-
-
-
+; gcm_gmult_ssse3 multiplies |Xi| by |Htable| and writes the result to |Xi|.
+; |Xi| is represented in GHASH's serialized byte representation. |Htable| is
+; formatted as described above.
+; void gcm_gmult_ssse3(uint64_t Xi2, const u128 Htable16);
 
 global	gcm_gmult_ssse3
 ALIGN	16
@@ -36,18 +36,18 @@
 	movdqa	xmm10,XMMWORD$L$reverse_bytes
 	movdqa	xmm2,XMMWORD$L$low4_mask
 
-
+; Reverse input bytes to deserialize.
 	pshufb	xmm0,xmm10
 
-
+; Split each byte into low (%xmm0) and high (%xmm1) halves.
 	movdqa	xmm1,xmm2
 	pandn	xmm1,xmm0
 	psrld	xmm1,4
 	pand	xmm0,xmm2
 
-
-
-
+; Maintain the result in %xmm2 (the value) and %xmm3 (carry bits). Note
+; that, due to bit reversal, %xmm3 contains bits that fall off when
+; right-shifting, not left-shifting.
 	pxor	xmm2,xmm2
 	pxor	xmm3,xmm3
 	mov	rax,5
@@ -55,31 +55,31 @@
 	movdqu	xmm4,XMMWORDrdx
 	lea	rdx,16+rdx
 
-
+; Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	xmm6,xmm2
 	palignr	xmm6,xmm3,1
 	movdqa	xmm3,xmm6
 	psrldq	xmm2,1
 
-
-
-
+; Load the next table row and index the low and high bits of the input.
+; Note the low (respectively, high) half corresponds to more
+; (respectively, less) significant coefficients.
 	movdqa	xmm5,xmm4
 	pshufb	xmm4,xmm0
 	pshufb	xmm5,xmm1
 
-
+; Add the high half (%xmm5) without shifting.
 	pxor	xmm2,xmm5
 
-
-
+; Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+; add into the carry register (%xmm3).
 	movdqa	xmm5,xmm4
 	psllq	xmm5,60
 	movdqa	xmm6,xmm5
 	pslldq	xmm6,8
 	pxor	xmm3,xmm6
 
-
+; Next, add into %xmm2.
 	psrldq	xmm5,8
 	pxor	xmm2,xmm5
 	psrlq	xmm4,4
@@ -88,46 +88,46 @@
 	sub	rax,1
 	jnz	NEAR $L$oop_row_1
 
-
-
-	pxor	xmm2,xmm3
+; Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+; x^7, so we shift and XOR four times.
+	pxor	xmm2,xmm3  ; x^0 = 0
 	psrlq	xmm3,1
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^1 = x
 	psrlq	xmm3,1
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^(1+1) = x^2
 	psrlq	xmm3,5
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^(1+1+5) = x^7
 	pxor	xmm3,xmm3
 	mov	rax,5
 $L$oop_row_2:
 	movdqu	xmm4,XMMWORDrdx
 	lea	rdx,16+rdx
 
-
+; Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	xmm6,xmm2
 	palignr	xmm6,xmm3,1
 	movdqa	xmm3,xmm6
 	psrldq	xmm2,1
 
-
-
-
+; Load the next table row and index the low and high bits of the input.
+; Note the low (respectively, high) half corresponds to more
+; (respectively, less) significant coefficients.
 	movdqa	xmm5,xmm4
 	pshufb	xmm4,xmm0
 	pshufb	xmm5,xmm1
 
-
+; Add the high half (%xmm5) without shifting.
 	pxor	xmm2,xmm5
 
-
-
+; Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+; add into the carry register (%xmm3).
 	movdqa	xmm5,xmm4
 	psllq	xmm5,60
 	movdqa	xmm6,xmm5
 	pslldq	xmm6,8
 	pxor	xmm3,xmm6
 
-
+; Next, add into %xmm2.
 	psrldq	xmm5,8
 	pxor	xmm2,xmm5
 	psrlq	xmm4,4
@@ -136,46 +136,46 @@
 	sub	rax,1
 	jnz	NEAR $L$oop_row_2
 
-
-
-	pxor	xmm2,xmm3
+; Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+; x^7, so we shift and XOR four times.
+	pxor	xmm2,xmm3  ; x^0 = 0
 	psrlq	xmm3,1
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^1 = x
 	psrlq	xmm3,1
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^(1+1) = x^2
 	psrlq	xmm3,5
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^(1+1+5) = x^7
 	pxor	xmm3,xmm3
 	mov	rax,6
 $L$oop_row_3:
 	movdqu	xmm4,XMMWORDrdx
 	lea	rdx,16+rdx
 
-
+; Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	xmm6,xmm2
 	palignr	xmm6,xmm3,1
 	movdqa	xmm3,xmm6
 	psrldq	xmm2,1
 
-
-
-
+; Load the next table row and index the low and high bits of the input.
+; Note the low (respectively, high) half corresponds to more
+; (respectively, less) significant coefficients.
 	movdqa	xmm5,xmm4
 	pshufb	xmm4,xmm0
 	pshufb	xmm5,xmm1
 
-
+; Add the high half (%xmm5) without shifting.
 	pxor	xmm2,xmm5
 
-
-
+; Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+; add into the carry register (%xmm3).
 	movdqa	xmm5,xmm4
 	psllq	xmm5,60
 	movdqa	xmm6,xmm5
 	pslldq	xmm6,8
 	pxor	xmm3,xmm6
 
-
+; Next, add into %xmm2.
 	psrldq	xmm5,8
 	pxor	xmm2,xmm5
 	psrlq	xmm4,4
@@ -184,21 +184,21 @@
 	sub	rax,1
 	jnz	NEAR $L$oop_row_3
 
-
-
-	pxor	xmm2,xmm3
+; Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+; x^7, so we shift and XOR four times.
+	pxor	xmm2,xmm3  ; x^0 = 0
 	psrlq	xmm3,1
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^1 = x
 	psrlq	xmm3,1
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^(1+1) = x^2
 	psrlq	xmm3,5
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^(1+1+5) = x^7
 	pxor	xmm3,xmm3
-
+; Store the result. Reverse bytes to serialize.
 	pshufb	xmm2,xmm10
 	movdqu	XMMWORDrcx,xmm2
 
-
+; Zero any registers which contain secrets.
 	pxor	xmm0,xmm0
 	pxor	xmm1,xmm1
 	pxor	xmm2,xmm2
@@ -213,11 +213,11 @@
 
 $L$SEH_end_gcm_gmult_ssse3_6:
 
-
-
-
-
-
+; gcm_ghash_ssse3 incorporates |len| bytes from |in| to |Xi|, using |Htable| as
+; the key. It writes the result back to |Xi|. |Xi| is represented in GHASH's
+; serialized byte representation. |Htable| is formatted as described above.
+; void gcm_ghash_ssse3(uint64_t Xi2, const u128 Htable16, const uint8_t *in,
+; size_t len);
 
 global	gcm_ghash_ssse3
 ALIGN	16
@@ -238,62 +238,62 @@
 	movdqa	xmm10,XMMWORD$L$reverse_bytes
 	movdqa	xmm11,XMMWORD$L$low4_mask
 
-
+; This function only processes whole blocks.
 	and	r9,-16
 
-
-
+; Reverse input bytes to deserialize. We maintain the running
+; total in %xmm0.
 	pshufb	xmm0,xmm10
 
-
+; Iterate over each block. On entry to each iteration, %xmm3 is zero.
 	pxor	xmm3,xmm3
 $L$oop_ghash:
-
+; Incorporate the next block of input.
 	movdqu	xmm1,XMMWORDr8
-	pshufb	xmm1,xmm10
+	pshufb	xmm1,xmm10  ; Reverse bytes.
 	pxor	xmm0,xmm1
 
-
+; Split each byte into low (%xmm0) and high (%xmm1) halves.
 	movdqa	xmm1,xmm11
 	pandn	xmm1,xmm0
 	psrld	xmm1,4
 	pand	xmm0,xmm11
 
-
-
-
+; Maintain the result in %xmm2 (the value) and %xmm3 (carry bits). Note
+; that, due to bit reversal, %xmm3 contains bits that fall off when
+; right-shifting, not left-shifting.
 	pxor	xmm2,xmm2
-
+; %xmm3 is already zero at this point.
 	mov	rax,5
 $L$oop_row_4:
 	movdqu	xmm4,XMMWORDrdx
 	lea	rdx,16+rdx
 
-
+; Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	xmm6,xmm2
 	palignr	xmm6,xmm3,1
 	movdqa	xmm3,xmm6
 	psrldq	xmm2,1
 
-
-
-
+; Load the next table row and index the low and high bits of the input.
+; Note the low (respectively, high) half corresponds to more
+; (respectively, less) significant coefficients.
 	movdqa	xmm5,xmm4
 	pshufb	xmm4,xmm0
 	pshufb	xmm5,xmm1
 
-
+; Add the high half (%xmm5) without shifting.
 	pxor	xmm2,xmm5
 
-
-
+; Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+; add into the carry register (%xmm3).
 	movdqa	xmm5,xmm4
 	psllq	xmm5,60
 	movdqa	xmm6,xmm5
 	pslldq	xmm6,8
 	pxor	xmm3,xmm6
 
-
+; Next, add into %xmm2.
 	psrldq	xmm5,8
 	pxor	xmm2,xmm5
 	psrlq	xmm4,4
@@ -302,46 +302,46 @@
 	sub	rax,1
 	jnz	NEAR $L$oop_row_4
 
-
-
-	pxor	xmm2,xmm3
+; Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+; x^7, so we shift and XOR four times.
+	pxor	xmm2,xmm3  ; x^0 = 0
 	psrlq	xmm3,1
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^1 = x
 	psrlq	xmm3,1
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^(1+1) = x^2
 	psrlq	xmm3,5
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^(1+1+5) = x^7
 	pxor	xmm3,xmm3
 	mov	rax,5
 $L$oop_row_5:
 	movdqu	xmm4,XMMWORDrdx
 	lea	rdx,16+rdx
 
-
+; Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	xmm6,xmm2
 	palignr	xmm6,xmm3,1
 	movdqa	xmm3,xmm6
 	psrldq	xmm2,1
 
-
-
-
+; Load the next table row and index the low and high bits of the input.
+; Note the low (respectively, high) half corresponds to more
+; (respectively, less) significant coefficients.
 	movdqa	xmm5,xmm4
 	pshufb	xmm4,xmm0
 	pshufb	xmm5,xmm1
 
-
+; Add the high half (%xmm5) without shifting.
 	pxor	xmm2,xmm5
 
-
-
+; Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+; add into the carry register (%xmm3).
 	movdqa	xmm5,xmm4
 	psllq	xmm5,60
 	movdqa	xmm6,xmm5
 	pslldq	xmm6,8
 	pxor	xmm3,xmm6
 
-
+; Next, add into %xmm2.
 	psrldq	xmm5,8
 	pxor	xmm2,xmm5
 	psrlq	xmm4,4
@@ -350,46 +350,46 @@
 	sub	rax,1
 	jnz	NEAR $L$oop_row_5
 
-
-
-	pxor	xmm2,xmm3
+; Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+; x^7, so we shift and XOR four times.
+	pxor	xmm2,xmm3  ; x^0 = 0
 	psrlq	xmm3,1
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^1 = x
 	psrlq	xmm3,1
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^(1+1) = x^2
 	psrlq	xmm3,5
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^(1+1+5) = x^7
 	pxor	xmm3,xmm3
 	mov	rax,6
 $L$oop_row_6:
 	movdqu	xmm4,XMMWORDrdx
 	lea	rdx,16+rdx
 
-
+; Right-shift %xmm2 and %xmm3 by 8 bytes.
 	movdqa	xmm6,xmm2
 	palignr	xmm6,xmm3,1
 	movdqa	xmm3,xmm6
 	psrldq	xmm2,1
 
-
-
-
+; Load the next table row and index the low and high bits of the input.
+; Note the low (respectively, high) half corresponds to more
+; (respectively, less) significant coefficients.
 	movdqa	xmm5,xmm4
 	pshufb	xmm4,xmm0
 	pshufb	xmm5,xmm1
 
-
+; Add the high half (%xmm5) without shifting.
 	pxor	xmm2,xmm5
 
-
-
+; Add the low half (%xmm4). This must be right-shifted by 4 bits. First,
+; add into the carry register (%xmm3).
 	movdqa	xmm5,xmm4
 	psllq	xmm5,60
 	movdqa	xmm6,xmm5
 	pslldq	xmm6,8
 	pxor	xmm3,xmm6
 
-
+; Next, add into %xmm2.
 	psrldq	xmm5,8
 	pxor	xmm2,xmm5
 	psrlq	xmm4,4
@@ -398,31 +398,31 @@
 	sub	rax,1
 	jnz	NEAR $L$oop_row_6
 
-
-
-	pxor	xmm2,xmm3
+; Reduce the carry register. The reduction polynomial is 1 + x + x^2 +
+; x^7, so we shift and XOR four times.
+	pxor	xmm2,xmm3  ; x^0 = 0
 	psrlq	xmm3,1
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^1 = x
 	psrlq	xmm3,1
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^(1+1) = x^2
 	psrlq	xmm3,5
-	pxor	xmm2,xmm3
+	pxor	xmm2,xmm3  ; x^(1+1+5) = x^7
 	pxor	xmm3,xmm3
 	movdqa	xmm0,xmm2
 
-
+; Rewind %rdx for the next iteration.
 	lea	rdx,((-256))+rdx
 
-
+; Advance input and continue.
 	lea	r8,16+r8
 	sub	r9,16
 	jnz	NEAR $L$oop_ghash
 
-
+; Reverse bytes and store the result.
 	pshufb	xmm0,xmm10
 	movdqu	XMMWORDrcx,xmm0
 
-
+; Zero any registers which contain secrets.
 	pxor	xmm0,xmm0
 	pxor	xmm1,xmm1
 	pxor	xmm2,xmm2
@@ -443,14 +443,14 @@
 
 ALIGN	16
 ghash_ssse3_constants:
-
-
+; .Lreverse_bytes is a permutation which, if applied with pshufb, reverses the
+; bytes in an XMM register.
 $L$reverse_bytes:
 	DB	15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0
-
+; .Llow4_mask is an XMM mask which selects the low four bits of each byte.
 $L$low4_mask:
 	DQ	0x0f0f0f0f0f0f0f0f,0x0f0f0f0f0f0f0f0f
-section	.text
+section	.text code align=64
 
 section	.pdata rdata align=4
 ALIGN	4
@@ -466,7 +466,7 @@
 section	.xdata rdata align=8
 ALIGN	4
 $L$SEH_info_gcm_gmult_ssse3_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_gcm_gmult_ssse3_5-$L$SEH_begin_gcm_gmult_ssse3_1
 	DB	5
 	DB	0
@@ -481,7 +481,7 @@
 
 	DW	0
 $L$SEH_info_gcm_ghash_ssse3_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_gcm_ghash_ssse3_6-$L$SEH_begin_gcm_ghash_ssse3_1
 	DB	7
 	DB	0

boringssl-0.20260708.tar.xz/gen/bcm/ghash-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/ghash-x86_64-apple.S Changed

@@ -15,154 +15,154 @@
 _CET_ENDBR
 L$_init_clmul:
 	movdqu	(%rsi),%xmm2
-	pshufd	$78,%xmm2,%xmm2
+	pshufd	$78,%xmm2,%xmm2  // dword swap
 
-
-	pshufd	$255,%xmm2,%xmm4
+// <<1 twist
+	pshufd	$255,%xmm2,%xmm4  // broadcast uppermost dword
 	movdqa	%xmm2,%xmm3
 	psllq	$1,%xmm2
-	pxor	%xmm5,%xmm5
+	pxor	%xmm5,%xmm5  // 
 	psrlq	$63,%xmm3
-	pcmpgtd	%xmm4,%xmm5
+	pcmpgtd	%xmm4,%xmm5  // broadcast carry bit
 	pslldq	$8,%xmm3
-	por	%xmm3,%xmm2
-
+	por	%xmm3,%xmm2  // H<<=1
 
+// magic reduction
 	pand	L$0x1c2_polynomial(%rip),%xmm5
-	pxor	%xmm5,%xmm2
-
+	pxor	%xmm5,%xmm2  // if(carry) H^=0x1c2_polynomial
 
+// calculate H^2
 	pshufd	$78,%xmm2,%xmm6
 	movdqa	%xmm2,%xmm0
 	pxor	%xmm2,%xmm6
-	movdqa	%xmm0,%xmm1
+	movdqa	%xmm0,%xmm1  // 
 	pshufd	$78,%xmm0,%xmm3
-	pxor	%xmm0,%xmm3
-	pclmulqdq	$0x00,%xmm2,%xmm0
-	pclmulqdq	$0x11,%xmm2,%xmm1
-	pclmulqdq	$0x00,%xmm6,%xmm3
-	pxor	%xmm0,%xmm3
-	pxor	%xmm1,%xmm3
-
-	movdqa	%xmm3,%xmm4
+	pxor	%xmm0,%xmm3  // 
+	pclmulqdq	$0x00,%xmm2,%xmm0  // ######
+	pclmulqdq	$0x11,%xmm2,%xmm1  // ######
+	pclmulqdq	$0x00,%xmm6,%xmm3  // ######
+	pxor	%xmm0,%xmm3  // 
+	pxor	%xmm1,%xmm3  // 
+
+	movdqa	%xmm3,%xmm4  // 
 	psrldq	$8,%xmm3
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm4,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	pshufd	$78,%xmm2,%xmm3
 	pshufd	$78,%xmm0,%xmm4
-	pxor	%xmm2,%xmm3
-	movdqu	%xmm2,0(%rdi)
-	pxor	%xmm0,%xmm4
-	movdqu	%xmm0,16(%rdi)
-	palignr	$8,%xmm3,%xmm4
-	movdqu	%xmm4,32(%rdi)
-	movdqa	%xmm0,%xmm1
+	pxor	%xmm2,%xmm3  // Karatsuba pre-processing
+	movdqu	%xmm2,0(%rdi)  // save H
+	pxor	%xmm0,%xmm4  // Karatsuba pre-processing
+	movdqu	%xmm0,16(%rdi)  // save H^2
+	palignr	$8,%xmm3,%xmm4  // low part is H.lo^H.hi...
+	movdqu	%xmm4,32(%rdi)  // save Karatsuba "salt"
+	movdqa	%xmm0,%xmm1  // 
 	pshufd	$78,%xmm0,%xmm3
-	pxor	%xmm0,%xmm3
-	pclmulqdq	$0x00,%xmm2,%xmm0
-	pclmulqdq	$0x11,%xmm2,%xmm1
-	pclmulqdq	$0x00,%xmm6,%xmm3
-	pxor	%xmm0,%xmm3
-	pxor	%xmm1,%xmm3
-
-	movdqa	%xmm3,%xmm4
+	pxor	%xmm0,%xmm3  // 
+	pclmulqdq	$0x00,%xmm2,%xmm0  // ######
+	pclmulqdq	$0x11,%xmm2,%xmm1  // ######
+	pclmulqdq	$0x00,%xmm6,%xmm3  // ######
+	pxor	%xmm0,%xmm3  // 
+	pxor	%xmm1,%xmm3  // 
+
+	movdqa	%xmm3,%xmm4  // 
 	psrldq	$8,%xmm3
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm4,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	movdqa	%xmm0,%xmm5
-	movdqa	%xmm0,%xmm1
+	movdqa	%xmm0,%xmm1  // 
 	pshufd	$78,%xmm0,%xmm3
-	pxor	%xmm0,%xmm3
-	pclmulqdq	$0x00,%xmm2,%xmm0
-	pclmulqdq	$0x11,%xmm2,%xmm1
-	pclmulqdq	$0x00,%xmm6,%xmm3
-	pxor	%xmm0,%xmm3
-	pxor	%xmm1,%xmm3
-
-	movdqa	%xmm3,%xmm4
+	pxor	%xmm0,%xmm3  // 
+	pclmulqdq	$0x00,%xmm2,%xmm0  // ######
+	pclmulqdq	$0x11,%xmm2,%xmm1  // ######
+	pclmulqdq	$0x00,%xmm6,%xmm3  // ######
+	pxor	%xmm0,%xmm3  // 
+	pxor	%xmm1,%xmm3  // 
+
+	movdqa	%xmm3,%xmm4  // 
 	psrldq	$8,%xmm3
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm4,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	pshufd	$78,%xmm5,%xmm3
 	pshufd	$78,%xmm0,%xmm4
-	pxor	%xmm5,%xmm3
-	movdqu	%xmm5,48(%rdi)
-	pxor	%xmm0,%xmm4
-	movdqu	%xmm0,64(%rdi)
-	palignr	$8,%xmm3,%xmm4
-	movdqu	%xmm4,80(%rdi)
+	pxor	%xmm5,%xmm3  // Karatsuba pre-processing
+	movdqu	%xmm5,48(%rdi)  // save H^3
+	pxor	%xmm0,%xmm4  // Karatsuba pre-processing
+	movdqu	%xmm0,64(%rdi)  // save H^4
+	palignr	$8,%xmm3,%xmm4  // low part is H^3.lo^H^3.hi...
+	movdqu	%xmm4,80(%rdi)  // save Karatsuba "salt"
 	ret
 
 
@@ -181,43 +181,43 @@
 	movdqu	(%rsi),%xmm2
 	movdqu	32(%rsi),%xmm4
 	pshufb	%xmm5,%xmm0
-	movdqa	%xmm0,%xmm1
+	movdqa	%xmm0,%xmm1  // 
 	pshufd	$78,%xmm0,%xmm3
-	pxor	%xmm0,%xmm3
-	pclmulqdq	$0x00,%xmm2,%xmm0
-	pclmulqdq	$0x11,%xmm2,%xmm1
-	pclmulqdq	$0x00,%xmm4,%xmm3
-	pxor	%xmm0,%xmm3
-	pxor	%xmm1,%xmm3
-
-	movdqa	%xmm3,%xmm4
+	pxor	%xmm0,%xmm3  // 
+	pclmulqdq	$0x00,%xmm2,%xmm0  // ######
+	pclmulqdq	$0x11,%xmm2,%xmm1  // ######
+	pclmulqdq	$0x00,%xmm4,%xmm3  // ######
+	pxor	%xmm0,%xmm3  // 
+	pxor	%xmm1,%xmm3  // 
+
+	movdqa	%xmm3,%xmm4  // 
 	psrldq	$8,%xmm3
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm4,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	pshufb	%xmm5,%xmm0
 	movdqu	%xmm0,(%rdi)
 	ret
@@ -248,13 +248,13 @@
 	jb	L$skip4x
 
 	subq	$0x30,%rcx
-	movq	$0xA040608020C0E000,%rax
+	movq	$0xA040608020C0E000,%rax  // ((7..0)·0xE0)&0xff
 	movdqu	48(%rsi),%xmm14
 	movdqu	64(%rsi),%xmm15
 
-
-
-
+// ######
+// Xi+4 =(H*Ii+3) + (H^2*Ii+2) + (H^3*Ii+1) + H^4*(Ii+Xi) mod P
+// 
 	movdqu	48(%rdx),%xmm3
 	movdqu	32(%rdx),%xmm11
 	pshufb	%xmm10,%xmm3
@@ -319,33 +319,33 @@
 	pclmulqdq	$0x00,%xmm2,%xmm11
 	pshufd	$78,%xmm3,%xmm4
 
-	pxor	%xmm0,%xmm8
+	pxor	%xmm0,%xmm8  // aggregated Karatsuba post-processing
 	movdqa	%xmm3,%xmm5
-	pxor	%xmm1,%xmm8
+	pxor	%xmm1,%xmm8  // 
 	pxor	%xmm3,%xmm4
-	movdqa	%xmm8,%xmm9
+	movdqa	%xmm8,%xmm9  // 
 	pclmulqdq	$0x11,%xmm2,%xmm13
 	pslldq	$8,%xmm8
-	psrldq	$8,%xmm9
+	psrldq	$8,%xmm9  // 
 	pxor	%xmm8,%xmm0
 	movdqa	L$7_mask(%rip),%xmm8
-	pxor	%xmm9,%xmm1
+	pxor	%xmm9,%xmm1  // 
 	movq	%rax,%xmm9
 
-	pand	%xmm0,%xmm8
-	pshufb	%xmm8,%xmm9
-	pxor	%xmm0,%xmm9
+	pand	%xmm0,%xmm8  // 1st phase
+	pshufb	%xmm8,%xmm9  // 
+	pxor	%xmm0,%xmm9  // 
 	pclmulqdq	$0x00,%xmm7,%xmm12
-	psllq	$57,%xmm9
-	movdqa	%xmm9,%xmm8
+	psllq	$57,%xmm9  // 
+	movdqa	%xmm9,%xmm8  // 
 	pslldq	$8,%xmm9
 	pclmulqdq	$0x00,%xmm6,%xmm3
-	psrldq	$8,%xmm8
+	psrldq	$8,%xmm8  // 
 	pxor	%xmm9,%xmm0
-	pxor	%xmm8,%xmm1
+	pxor	%xmm8,%xmm1  // 
 	movdqu	0(%rdx),%xmm8
 
-	movdqa	%xmm0,%xmm9
+	movdqa	%xmm0,%xmm9  // 2nd phase
 	psrlq	$1,%xmm0
 	pclmulqdq	$0x11,%xmm6,%xmm5
 	xorps	%xmm11,%xmm3
@@ -355,19 +355,19 @@
 	xorps	%xmm13,%xmm5
 	movups	80(%rsi),%xmm7
 	pshufb	%xmm10,%xmm8
-	pxor	%xmm9,%xmm1
+	pxor	%xmm9,%xmm1  // 
 	pxor	%xmm0,%xmm9
 	psrlq	$5,%xmm0
 
 	movdqa	%xmm11,%xmm13
 	pxor	%xmm12,%xmm4
 	pshufd	$78,%xmm11,%xmm12
-	pxor	%xmm9,%xmm0
+	pxor	%xmm9,%xmm0  // 
 	pxor	%xmm8,%xmm1
 	pxor	%xmm11,%xmm12
 	pclmulqdq	$0x00,%xmm14,%xmm11
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	movdqa	%xmm0,%xmm1
 	pclmulqdq	$0x11,%xmm14,%xmm13
 	xorps	%xmm11,%xmm3
@@ -388,56 +388,56 @@
 	xorps	%xmm12,%xmm4
 	xorps	%xmm3,%xmm0
 	xorps	%xmm5,%xmm1
-	pxor	%xmm0,%xmm1
+	pxor	%xmm0,%xmm1  // aggregated Karatsuba post-processing
 	pxor	%xmm4,%xmm8
 
-	pxor	%xmm1,%xmm8
+	pxor	%xmm1,%xmm8  // 
 	pxor	%xmm0,%xmm1
 
-	movdqa	%xmm8,%xmm9
+	movdqa	%xmm8,%xmm9  // 
 	psrldq	$8,%xmm8
-	pslldq	$8,%xmm9
+	pslldq	$8,%xmm9  // 
 	pxor	%xmm8,%xmm1
-	pxor	%xmm9,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm9,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	addq	$0x40,%rcx
 	jz	L$done
 	movdqu	32(%rsi),%xmm7
 	subq	$0x10,%rcx
 	jz	L$odd_tail
 L$skip4x:
-
-
-
-
-
-	movdqu	(%rdx),%xmm8
-	movdqu	16(%rdx),%xmm3
+// ######
+// Xi+2 =H*(Ii+1 + Xi+1) mod P =
+// (H*Ii+1) + (H*Xi+1) mod P =
+// (H*Ii+1) + H^2*(Ii+Xi) mod P
+// 
+	movdqu	(%rdx),%xmm8  // Ii
+	movdqu	16(%rdx),%xmm3  // Ii+1
 	pshufb	%xmm10,%xmm8
 	pshufb	%xmm10,%xmm3
-	pxor	%xmm8,%xmm0
+	pxor	%xmm8,%xmm0  // Ii+Xi
 
 	movdqa	%xmm3,%xmm5
 	pshufd	$78,%xmm3,%xmm4
@@ -446,7 +446,7 @@
 	pclmulqdq	$0x11,%xmm2,%xmm5
 	pclmulqdq	$0x00,%xmm7,%xmm4
 
-	leaq	32(%rdx),%rdx
+	leaq	32(%rdx),%rdx  // i+=2
 	nop
 	subq	$0x20,%rcx
 	jbe	L$even_tail
@@ -457,59 +457,59 @@
 L$mod_loop:
 	movdqa	%xmm0,%xmm1
 	movdqa	%xmm4,%xmm8
-	pshufd	$78,%xmm0,%xmm4
-	pxor	%xmm0,%xmm4
+	pshufd	$78,%xmm0,%xmm4  // 
+	pxor	%xmm0,%xmm4  // 
 
 	pclmulqdq	$0x00,%xmm6,%xmm0
 	pclmulqdq	$0x11,%xmm6,%xmm1
 	pclmulqdq	$0x10,%xmm7,%xmm4
 
-	pxor	%xmm3,%xmm0
+	pxor	%xmm3,%xmm0  // (H*Ii+1) + H^2*(Ii+Xi)
 	pxor	%xmm5,%xmm1
-	movdqu	(%rdx),%xmm9
-	pxor	%xmm0,%xmm8
+	movdqu	(%rdx),%xmm9  // Ii
+	pxor	%xmm0,%xmm8  // aggregated Karatsuba post-processing
 	pshufb	%xmm10,%xmm9
-	movdqu	16(%rdx),%xmm3
+	movdqu	16(%rdx),%xmm3  // Ii+1
 
 	pxor	%xmm1,%xmm8
-	pxor	%xmm9,%xmm1
+	pxor	%xmm9,%xmm1  // "Ii+Xi", consume early
 	pxor	%xmm8,%xmm4
 	pshufb	%xmm10,%xmm3
-	movdqa	%xmm4,%xmm8
+	movdqa	%xmm4,%xmm8  // 
 	psrldq	$8,%xmm8
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm8,%xmm1
-	pxor	%xmm4,%xmm0
+	pxor	%xmm4,%xmm0  // 
 
-	movdqa	%xmm3,%xmm5
+	movdqa	%xmm3,%xmm5  // 
 
-	movdqa	%xmm0,%xmm9
+	movdqa	%xmm0,%xmm9  // 1st phase
 	movdqa	%xmm0,%xmm8
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm8
-	pclmulqdq	$0x00,%xmm2,%xmm3
+	pxor	%xmm0,%xmm8  // 
+	pclmulqdq	$0x00,%xmm2,%xmm3  // ######
 	psllq	$1,%xmm0
-	pxor	%xmm8,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm8
+	pxor	%xmm8,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm8  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm8
+	psrldq	$8,%xmm8  // 
 	pxor	%xmm9,%xmm0
 	pshufd	$78,%xmm5,%xmm4
-	pxor	%xmm8,%xmm1
-	pxor	%xmm5,%xmm4
+	pxor	%xmm8,%xmm1  // 
+	pxor	%xmm5,%xmm4  // 
 
-	movdqa	%xmm0,%xmm9
+	movdqa	%xmm0,%xmm9  // 2nd phase
 	psrlq	$1,%xmm0
-	pclmulqdq	$0x11,%xmm2,%xmm5
-	pxor	%xmm9,%xmm1
+	pclmulqdq	$0x11,%xmm2,%xmm5  // ######
+	pxor	%xmm9,%xmm1  // 
 	pxor	%xmm0,%xmm9
 	psrlq	$5,%xmm0
-	pxor	%xmm9,%xmm0
+	pxor	%xmm9,%xmm0  // 
 	leaq	32(%rdx),%rdx
-	psrlq	$1,%xmm0
-	pclmulqdq	$0x00,%xmm7,%xmm4
-	pxor	%xmm1,%xmm0
+	psrlq	$1,%xmm0  // 
+	pclmulqdq	$0x00,%xmm7,%xmm4  // ######
+	pxor	%xmm1,%xmm0  // 
 
 	subq	$0x20,%rcx
 	ja	L$mod_loop
@@ -517,90 +517,90 @@
 L$even_tail:
 	movdqa	%xmm0,%xmm1
 	movdqa	%xmm4,%xmm8
-	pshufd	$78,%xmm0,%xmm4
-	pxor	%xmm0,%xmm4
+	pshufd	$78,%xmm0,%xmm4  // 
+	pxor	%xmm0,%xmm4  // 
 
 	pclmulqdq	$0x00,%xmm6,%xmm0
 	pclmulqdq	$0x11,%xmm6,%xmm1
 	pclmulqdq	$0x10,%xmm7,%xmm4
 
-	pxor	%xmm3,%xmm0
+	pxor	%xmm3,%xmm0  // (H*Ii+1) + H^2*(Ii+Xi)
 	pxor	%xmm5,%xmm1
 	pxor	%xmm0,%xmm8
 	pxor	%xmm1,%xmm8
 	pxor	%xmm8,%xmm4
-	movdqa	%xmm4,%xmm8
+	movdqa	%xmm4,%xmm8  // 
 	psrldq	$8,%xmm8
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm8,%xmm1
-	pxor	%xmm4,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm4,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	testq	%rcx,%rcx
 	jnz	L$done
 
 L$odd_tail:
-	movdqu	(%rdx),%xmm8
+	movdqu	(%rdx),%xmm8  // Ii
 	pshufb	%xmm10,%xmm8
-	pxor	%xmm8,%xmm0
-	movdqa	%xmm0,%xmm1
+	pxor	%xmm8,%xmm0  // Ii+Xi
+	movdqa	%xmm0,%xmm1  // 
 	pshufd	$78,%xmm0,%xmm3
-	pxor	%xmm0,%xmm3
-	pclmulqdq	$0x00,%xmm2,%xmm0
-	pclmulqdq	$0x11,%xmm2,%xmm1
-	pclmulqdq	$0x00,%xmm7,%xmm3
-	pxor	%xmm0,%xmm3
-	pxor	%xmm1,%xmm3
-
-	movdqa	%xmm3,%xmm4
+	pxor	%xmm0,%xmm3  // 
+	pclmulqdq	$0x00,%xmm2,%xmm0  // ######
+	pclmulqdq	$0x11,%xmm2,%xmm1  // ######
+	pclmulqdq	$0x00,%xmm7,%xmm3  // ######
+	pxor	%xmm0,%xmm3  // 
+	pxor	%xmm1,%xmm3  // 
+
+	movdqa	%xmm3,%xmm4  // 
 	psrldq	$8,%xmm3
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm4,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 L$done:
 	pshufb	%xmm10,%xmm0
 	movdqu	%xmm0,(%rdi)
@@ -620,101 +620,101 @@
 	vzeroupper
 
 	vmovdqu	(%rsi),%xmm2
-	vpshufd	$78,%xmm2,%xmm2
+	vpshufd	$78,%xmm2,%xmm2  // dword swap
 
-
-	vpshufd	$255,%xmm2,%xmm4
+// <<1 twist
+	vpshufd	$255,%xmm2,%xmm4  // broadcast uppermost dword
 	vpsrlq	$63,%xmm2,%xmm3
 	vpsllq	$1,%xmm2,%xmm2
-	vpxor	%xmm5,%xmm5,%xmm5
-	vpcmpgtd	%xmm4,%xmm5,%xmm5
+	vpxor	%xmm5,%xmm5,%xmm5  // 
+	vpcmpgtd	%xmm4,%xmm5,%xmm5  // broadcast carry bit
 	vpslldq	$8,%xmm3,%xmm3
-	vpor	%xmm3,%xmm2,%xmm2
-
+	vpor	%xmm3,%xmm2,%xmm2  // H<<=1
 
+// magic reduction
 	vpand	L$0x1c2_polynomial(%rip),%xmm5,%xmm5
-	vpxor	%xmm5,%xmm2,%xmm2
+	vpxor	%xmm5,%xmm2,%xmm2  // if(carry) H^=0x1c2_polynomial
 
 	vpunpckhqdq	%xmm2,%xmm2,%xmm6
 	vmovdqa	%xmm2,%xmm0
 	vpxor	%xmm2,%xmm6,%xmm6
-	movq	$4,%r10
+	movq	$4,%r10  // up to H^8
 	jmp	L$init_start_avx
 .p2align	5
 L$init_loop_avx:
-	vpalignr	$8,%xmm3,%xmm4,%xmm5
-	vmovdqu	%xmm5,-16(%rdi)
+	vpalignr	$8,%xmm3,%xmm4,%xmm5  // low part is H.lo^H.hi...
+	vmovdqu	%xmm5,-16(%rdi)  // save Karatsuba "salt"
 	vpunpckhqdq	%xmm0,%xmm0,%xmm3
-	vpxor	%xmm0,%xmm3,%xmm3
-	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm1
-	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm0
-	vpclmulqdq	$0x00,%xmm6,%xmm3,%xmm3
-	vpxor	%xmm0,%xmm1,%xmm4
-	vpxor	%xmm4,%xmm3,%xmm3
-
-	vpslldq	$8,%xmm3,%xmm4
+	vpxor	%xmm0,%xmm3,%xmm3  // 
+	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm1  // ######
+	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm0  // ######
+	vpclmulqdq	$0x00,%xmm6,%xmm3,%xmm3  // ######
+	vpxor	%xmm0,%xmm1,%xmm4  // 
+	vpxor	%xmm4,%xmm3,%xmm3  // 
+
+	vpslldq	$8,%xmm3,%xmm4  // 
 	vpsrldq	$8,%xmm3,%xmm3
-	vpxor	%xmm4,%xmm0,%xmm0
+	vpxor	%xmm4,%xmm0,%xmm0  // 
 	vpxor	%xmm3,%xmm1,%xmm1
-	vpsllq	$57,%xmm0,%xmm3
+	vpsllq	$57,%xmm0,%xmm3  // 1st phase
 	vpsllq	$62,%xmm0,%xmm4
-	vpxor	%xmm3,%xmm4,%xmm4
+	vpxor	%xmm3,%xmm4,%xmm4  // 
 	vpsllq	$63,%xmm0,%xmm3
-	vpxor	%xmm3,%xmm4,%xmm4
-	vpslldq	$8,%xmm4,%xmm3
+	vpxor	%xmm3,%xmm4,%xmm4  // 
+	vpslldq	$8,%xmm4,%xmm3  // 
 	vpsrldq	$8,%xmm4,%xmm4
-	vpxor	%xmm3,%xmm0,%xmm0
+	vpxor	%xmm3,%xmm0,%xmm0  // 
 	vpxor	%xmm4,%xmm1,%xmm1
 
-	vpsrlq	$1,%xmm0,%xmm4
+	vpsrlq	$1,%xmm0,%xmm4  // 2nd phase
 	vpxor	%xmm0,%xmm1,%xmm1
-	vpxor	%xmm4,%xmm0,%xmm0
+	vpxor	%xmm4,%xmm0,%xmm0  // 
 	vpsrlq	$5,%xmm4,%xmm4
-	vpxor	%xmm4,%xmm0,%xmm0
-	vpsrlq	$1,%xmm0,%xmm0
-	vpxor	%xmm1,%xmm0,%xmm0
+	vpxor	%xmm4,%xmm0,%xmm0  // 
+	vpsrlq	$1,%xmm0,%xmm0  // 
+	vpxor	%xmm1,%xmm0,%xmm0  // 
 L$init_start_avx:
 	vmovdqa	%xmm0,%xmm5
 	vpunpckhqdq	%xmm0,%xmm0,%xmm3
-	vpxor	%xmm0,%xmm3,%xmm3
-	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm1
-	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm0
-	vpclmulqdq	$0x00,%xmm6,%xmm3,%xmm3
-	vpxor	%xmm0,%xmm1,%xmm4
-	vpxor	%xmm4,%xmm3,%xmm3
-
-	vpslldq	$8,%xmm3,%xmm4
+	vpxor	%xmm0,%xmm3,%xmm3  // 
+	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm1  // ######
+	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm0  // ######
+	vpclmulqdq	$0x00,%xmm6,%xmm3,%xmm3  // ######
+	vpxor	%xmm0,%xmm1,%xmm4  // 
+	vpxor	%xmm4,%xmm3,%xmm3  // 
+
+	vpslldq	$8,%xmm3,%xmm4  // 
 	vpsrldq	$8,%xmm3,%xmm3
-	vpxor	%xmm4,%xmm0,%xmm0
+	vpxor	%xmm4,%xmm0,%xmm0  // 
 	vpxor	%xmm3,%xmm1,%xmm1
-	vpsllq	$57,%xmm0,%xmm3
+	vpsllq	$57,%xmm0,%xmm3  // 1st phase
 	vpsllq	$62,%xmm0,%xmm4
-	vpxor	%xmm3,%xmm4,%xmm4
+	vpxor	%xmm3,%xmm4,%xmm4  // 
 	vpsllq	$63,%xmm0,%xmm3
-	vpxor	%xmm3,%xmm4,%xmm4
-	vpslldq	$8,%xmm4,%xmm3
+	vpxor	%xmm3,%xmm4,%xmm4  // 
+	vpslldq	$8,%xmm4,%xmm3  // 
 	vpsrldq	$8,%xmm4,%xmm4
-	vpxor	%xmm3,%xmm0,%xmm0
+	vpxor	%xmm3,%xmm0,%xmm0  // 
 	vpxor	%xmm4,%xmm1,%xmm1
 
-	vpsrlq	$1,%xmm0,%xmm4
+	vpsrlq	$1,%xmm0,%xmm4  // 2nd phase
 	vpxor	%xmm0,%xmm1,%xmm1
-	vpxor	%xmm4,%xmm0,%xmm0
+	vpxor	%xmm4,%xmm0,%xmm0  // 
 	vpsrlq	$5,%xmm4,%xmm4
-	vpxor	%xmm4,%xmm0,%xmm0
-	vpsrlq	$1,%xmm0,%xmm0
-	vpxor	%xmm1,%xmm0,%xmm0
+	vpxor	%xmm4,%xmm0,%xmm0  // 
+	vpsrlq	$1,%xmm0,%xmm0  // 
+	vpxor	%xmm1,%xmm0,%xmm0  // 
 	vpshufd	$78,%xmm5,%xmm3
 	vpshufd	$78,%xmm0,%xmm4
-	vpxor	%xmm5,%xmm3,%xmm3
-	vmovdqu	%xmm5,0(%rdi)
-	vpxor	%xmm0,%xmm4,%xmm4
-	vmovdqu	%xmm0,16(%rdi)
+	vpxor	%xmm5,%xmm3,%xmm3  // Karatsuba pre-processing
+	vmovdqu	%xmm5,0(%rdi)  // save H^1,3,5,7
+	vpxor	%xmm0,%xmm4,%xmm4  // Karatsuba pre-processing
+	vmovdqu	%xmm0,16(%rdi)  // save H^2,4,6,8
 	leaq	48(%rdi),%rdi
 	subq	$1,%r10
 	jnz	L$init_loop_avx
 
-	vpalignr	$8,%xmm4,%xmm3,%xmm5
+	vpalignr	$8,%xmm4,%xmm3,%xmm5  // last "salt" is flipped
 	vmovdqu	%xmm5,-16(%rdi)
 
 	vzeroupper
@@ -744,29 +744,29 @@
 _CET_ENDBR
 	vzeroupper
 
-	vmovdqu	(%rdi),%xmm10
+	vmovdqu	(%rdi),%xmm10  // load %xmm10
 	leaq	L$0x1c2_polynomial(%rip),%r10
-	leaq	64(%rsi),%rsi
+	leaq	64(%rsi),%rsi  // size optimization
 	vmovdqu	L$bswap_mask(%rip),%xmm13
 	vpshufb	%xmm13,%xmm10,%xmm10
 	cmpq	$0x80,%rcx
 	jb	L$short_avx
 	subq	$0x80,%rcx
 
-	vmovdqu	112(%rdx),%xmm14
-	vmovdqu	0-64(%rsi),%xmm6
+	vmovdqu	112(%rdx),%xmm14  // I7
+	vmovdqu	0-64(%rsi),%xmm6  // %xmm6^1
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vmovdqu	32-64(%rsi),%xmm7
 
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
-	vmovdqu	96(%rdx),%xmm15
+	vmovdqu	96(%rdx),%xmm15  // I6
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
 	vpxor	%xmm14,%xmm9,%xmm9
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	16-64(%rsi),%xmm6
+	vmovdqu	16-64(%rsi),%xmm6  // %xmm6^2
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
-	vmovdqu	80(%rdx),%xmm14
+	vmovdqu	80(%rdx),%xmm14  // I5
 	vpclmulqdq	$0x00,%xmm7,%xmm9,%xmm2
 	vpxor	%xmm15,%xmm8,%xmm8
 
@@ -774,9 +774,9 @@
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm3
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm4
-	vmovdqu	48-64(%rsi),%xmm6
+	vmovdqu	48-64(%rsi),%xmm6  // %xmm6^3
 	vpxor	%xmm14,%xmm9,%xmm9
-	vmovdqu	64(%rdx),%xmm15
+	vmovdqu	64(%rdx),%xmm15  // I4
 	vpclmulqdq	$0x10,%xmm7,%xmm8,%xmm5
 	vmovdqu	80-64(%rsi),%xmm7
 
@@ -786,56 +786,56 @@
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	64-64(%rsi),%xmm6
+	vmovdqu	64-64(%rsi),%xmm6  // %xmm6^4
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm9,%xmm2
 	vpxor	%xmm15,%xmm8,%xmm8
 
-	vmovdqu	48(%rdx),%xmm14
+	vmovdqu	48(%rdx),%xmm14  // I3
 	vpxor	%xmm3,%xmm0,%xmm0
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm3
 	vpxor	%xmm4,%xmm1,%xmm1
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm4
-	vmovdqu	96-64(%rsi),%xmm6
+	vmovdqu	96-64(%rsi),%xmm6  // %xmm6^5
 	vpxor	%xmm5,%xmm2,%xmm2
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
 	vpclmulqdq	$0x10,%xmm7,%xmm8,%xmm5
 	vmovdqu	128-64(%rsi),%xmm7
 	vpxor	%xmm14,%xmm9,%xmm9
 
-	vmovdqu	32(%rdx),%xmm15
+	vmovdqu	32(%rdx),%xmm15  // I2
 	vpxor	%xmm0,%xmm3,%xmm3
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	112-64(%rsi),%xmm6
+	vmovdqu	112-64(%rsi),%xmm6  // %xmm6^6
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
 	vpclmulqdq	$0x00,%xmm7,%xmm9,%xmm2
 	vpxor	%xmm15,%xmm8,%xmm8
 
-	vmovdqu	16(%rdx),%xmm14
+	vmovdqu	16(%rdx),%xmm14  // I1
 	vpxor	%xmm3,%xmm0,%xmm0
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm3
 	vpxor	%xmm4,%xmm1,%xmm1
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm4
-	vmovdqu	144-64(%rsi),%xmm6
+	vmovdqu	144-64(%rsi),%xmm6  // %xmm6^7
 	vpxor	%xmm5,%xmm2,%xmm2
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
 	vpclmulqdq	$0x10,%xmm7,%xmm8,%xmm5
 	vmovdqu	176-64(%rsi),%xmm7
 	vpxor	%xmm14,%xmm9,%xmm9
 
-	vmovdqu	(%rdx),%xmm15
+	vmovdqu	(%rdx),%xmm15  // I0
 	vpxor	%xmm0,%xmm3,%xmm3
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	160-64(%rsi),%xmm6
+	vmovdqu	160-64(%rsi),%xmm6  // %xmm6^8
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x10,%xmm7,%xmm9,%xmm2
 
@@ -843,41 +843,41 @@
 	cmpq	$0x80,%rcx
 	jb	L$tail_avx
 
-	vpxor	%xmm10,%xmm15,%xmm15
+	vpxor	%xmm10,%xmm15,%xmm15  // accumulate %xmm10
 	subq	$0x80,%rcx
 	jmp	L$oop8x_avx
 
 .p2align	5
 L$oop8x_avx:
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
-	vmovdqu	112(%rdx),%xmm14
+	vmovdqu	112(%rdx),%xmm14  // I7
 	vpxor	%xmm0,%xmm3,%xmm3
 	vpxor	%xmm15,%xmm8,%xmm8
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm10
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm11
-	vmovdqu	0-64(%rsi),%xmm6
+	vmovdqu	0-64(%rsi),%xmm6  // %xmm6^1
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm12
 	vmovdqu	32-64(%rsi),%xmm7
 	vpxor	%xmm14,%xmm9,%xmm9
 
-	vmovdqu	96(%rdx),%xmm15
+	vmovdqu	96(%rdx),%xmm15  // I6
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
-	vpxor	%xmm3,%xmm10,%xmm10
+	vpxor	%xmm3,%xmm10,%xmm10  // collect result
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
 	vxorps	%xmm4,%xmm11,%xmm11
-	vmovdqu	16-64(%rsi),%xmm6
+	vmovdqu	16-64(%rsi),%xmm6  // %xmm6^2
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
 	vpclmulqdq	$0x00,%xmm7,%xmm9,%xmm2
 	vpxor	%xmm5,%xmm12,%xmm12
 	vxorps	%xmm15,%xmm8,%xmm8
 
-	vmovdqu	80(%rdx),%xmm14
-	vpxor	%xmm10,%xmm12,%xmm12
+	vmovdqu	80(%rdx),%xmm14  // I5
+	vpxor	%xmm10,%xmm12,%xmm12  // aggregated Karatsuba post-processing
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm3
 	vpxor	%xmm11,%xmm12,%xmm12
 	vpslldq	$8,%xmm12,%xmm9
@@ -885,7 +885,7 @@
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm4
 	vpsrldq	$8,%xmm12,%xmm12
 	vpxor	%xmm9,%xmm10,%xmm10
-	vmovdqu	48-64(%rsi),%xmm6
+	vmovdqu	48-64(%rsi),%xmm6  // %xmm6^3
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vxorps	%xmm12,%xmm11,%xmm11
 	vpxor	%xmm1,%xmm4,%xmm4
@@ -895,26 +895,26 @@
 	vpxor	%xmm14,%xmm9,%xmm9
 	vpxor	%xmm2,%xmm5,%xmm5
 
-	vmovdqu	64(%rdx),%xmm15
-	vpalignr	$8,%xmm10,%xmm10,%xmm12
+	vmovdqu	64(%rdx),%xmm15  // I4
+	vpalignr	$8,%xmm10,%xmm10,%xmm12  // 1st phase
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpxor	%xmm3,%xmm0,%xmm0
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	64-64(%rsi),%xmm6
+	vmovdqu	64-64(%rsi),%xmm6  // %xmm6^4
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
 	vpxor	%xmm4,%xmm1,%xmm1
 	vpclmulqdq	$0x00,%xmm7,%xmm9,%xmm2
 	vxorps	%xmm15,%xmm8,%xmm8
 	vpxor	%xmm5,%xmm2,%xmm2
 
-	vmovdqu	48(%rdx),%xmm14
+	vmovdqu	48(%rdx),%xmm14  // I3
 	vpclmulqdq	$0x10,(%r10),%xmm10,%xmm10
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm3
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vpxor	%xmm0,%xmm3,%xmm3
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm4
-	vmovdqu	96-64(%rsi),%xmm6
+	vmovdqu	96-64(%rsi),%xmm6  // %xmm6^5
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x10,%xmm7,%xmm8,%xmm5
@@ -922,12 +922,12 @@
 	vpxor	%xmm14,%xmm9,%xmm9
 	vpxor	%xmm2,%xmm5,%xmm5
 
-	vmovdqu	32(%rdx),%xmm15
+	vmovdqu	32(%rdx),%xmm15  // I2
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpxor	%xmm3,%xmm0,%xmm0
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	112-64(%rsi),%xmm6
+	vmovdqu	112-64(%rsi),%xmm6  // %xmm6^6
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
 	vpxor	%xmm4,%xmm1,%xmm1
 	vpclmulqdq	$0x00,%xmm7,%xmm9,%xmm2
@@ -935,13 +935,13 @@
 	vpxor	%xmm5,%xmm2,%xmm2
 	vxorps	%xmm12,%xmm10,%xmm10
 
-	vmovdqu	16(%rdx),%xmm14
-	vpalignr	$8,%xmm10,%xmm10,%xmm12
+	vmovdqu	16(%rdx),%xmm14  // I1
+	vpalignr	$8,%xmm10,%xmm10,%xmm12  // 2nd phase
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm3
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vpxor	%xmm0,%xmm3,%xmm3
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm4
-	vmovdqu	144-64(%rsi),%xmm6
+	vmovdqu	144-64(%rsi),%xmm6  // %xmm6^7
 	vpclmulqdq	$0x10,(%r10),%xmm10,%xmm10
 	vxorps	%xmm11,%xmm12,%xmm12
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
@@ -951,14 +951,14 @@
 	vpxor	%xmm14,%xmm9,%xmm9
 	vpxor	%xmm2,%xmm5,%xmm5
 
-	vmovdqu	(%rdx),%xmm15
+	vmovdqu	(%rdx),%xmm15  // I0
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	160-64(%rsi),%xmm6
+	vmovdqu	160-64(%rsi),%xmm6  // %xmm6^8
 	vpxor	%xmm12,%xmm15,%xmm15
 	vpclmulqdq	$0x10,%xmm7,%xmm9,%xmm2
-	vpxor	%xmm10,%xmm15,%xmm15
+	vpxor	%xmm10,%xmm15,%xmm15  // accumulate %xmm10
 
 	leaq	128(%rdx),%rdx
 	subq	$0x80,%rcx
@@ -969,15 +969,15 @@
 
 .p2align	5
 L$short_avx:
-	vmovdqu	-16(%rdx,%rcx,1),%xmm14
+	vmovdqu	-16(%rdx,%rcx,1),%xmm14  // very last word
 	leaq	(%rdx,%rcx,1),%rdx
-	vmovdqu	0-64(%rsi),%xmm6
+	vmovdqu	0-64(%rsi),%xmm6  // %xmm6^1
 	vmovdqu	32-64(%rsi),%xmm7
 	vpshufb	%xmm13,%xmm14,%xmm15
 
-	vmovdqa	%xmm0,%xmm3
-	vmovdqa	%xmm1,%xmm4
-	vmovdqa	%xmm2,%xmm5
+	vmovdqa	%xmm0,%xmm3  // subtle way to zero %xmm3,
+	vmovdqa	%xmm1,%xmm4  // %xmm4 and
+	vmovdqa	%xmm2,%xmm5  // %xmm5
 	subq	$0x10,%rcx
 	jz	L$tail_avx
 
@@ -988,7 +988,7 @@
 	vmovdqu	-32(%rdx),%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm1
-	vmovdqu	16-64(%rsi),%xmm6
+	vmovdqu	16-64(%rsi),%xmm6  // %xmm6^2
 	vpshufb	%xmm13,%xmm14,%xmm15
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm2
@@ -1003,7 +1003,7 @@
 	vmovdqu	-48(%rdx),%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm1
-	vmovdqu	48-64(%rsi),%xmm6
+	vmovdqu	48-64(%rsi),%xmm6  // %xmm6^3
 	vpshufb	%xmm13,%xmm14,%xmm15
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm2
@@ -1018,7 +1018,7 @@
 	vmovdqu	-64(%rdx),%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm1
-	vmovdqu	64-64(%rsi),%xmm6
+	vmovdqu	64-64(%rsi),%xmm6  // %xmm6^4
 	vpshufb	%xmm13,%xmm14,%xmm15
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm2
@@ -1033,7 +1033,7 @@
 	vmovdqu	-80(%rdx),%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm1
-	vmovdqu	96-64(%rsi),%xmm6
+	vmovdqu	96-64(%rsi),%xmm6  // %xmm6^5
 	vpshufb	%xmm13,%xmm14,%xmm15
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm2
@@ -1048,7 +1048,7 @@
 	vmovdqu	-96(%rdx),%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm1
-	vmovdqu	112-64(%rsi),%xmm6
+	vmovdqu	112-64(%rsi),%xmm6  // %xmm6^6
 	vpshufb	%xmm13,%xmm14,%xmm15
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm2
@@ -1063,7 +1063,7 @@
 	vmovdqu	-112(%rdx),%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm1
-	vmovdqu	144-64(%rsi),%xmm6
+	vmovdqu	144-64(%rsi),%xmm6  // %xmm6^7
 	vpshufb	%xmm13,%xmm14,%xmm15
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm2
@@ -1073,7 +1073,7 @@
 
 .p2align	5
 L$tail_avx:
-	vpxor	%xmm10,%xmm15,%xmm15
+	vpxor	%xmm10,%xmm15,%xmm15  // accumulate %xmm10
 L$tail_no_xor_avx:
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
 	vpxor	%xmm0,%xmm3,%xmm3
@@ -1090,18 +1090,18 @@
 	vpxor	%xmm1,%xmm4,%xmm11
 	vpxor	%xmm2,%xmm5,%xmm5
 
-	vpxor	%xmm10,%xmm5,%xmm5
+	vpxor	%xmm10,%xmm5,%xmm5  // aggregated Karatsuba post-processing
 	vpxor	%xmm11,%xmm5,%xmm5
 	vpslldq	$8,%xmm5,%xmm9
 	vpsrldq	$8,%xmm5,%xmm5
 	vpxor	%xmm9,%xmm10,%xmm10
 	vpxor	%xmm5,%xmm11,%xmm11
 
-	vpclmulqdq	$0x10,%xmm12,%xmm10,%xmm9
+	vpclmulqdq	$0x10,%xmm12,%xmm10,%xmm9  // 1st phase
 	vpalignr	$8,%xmm10,%xmm10,%xmm10
 	vpxor	%xmm9,%xmm10,%xmm10
 
-	vpclmulqdq	$0x10,%xmm12,%xmm10,%xmm9
+	vpclmulqdq	$0x10,%xmm12,%xmm10,%xmm9  // 2nd phase
 	vpalignr	$8,%xmm10,%xmm10,%xmm10
 	vpxor	%xmm11,%xmm10,%xmm10
 	vpxor	%xmm9,%xmm10,%xmm10

boringssl-0.20260708.tar.xz/gen/bcm/ghash-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/ghash-x86_64-linux.S Changed

@@ -15,154 +15,154 @@
 _CET_ENDBR
 .L_init_clmul:
 	movdqu	(%rsi),%xmm2
-	pshufd	$78,%xmm2,%xmm2
+	pshufd	$78,%xmm2,%xmm2  // dword swap
 
-
-	pshufd	$255,%xmm2,%xmm4
+// <<1 twist
+	pshufd	$255,%xmm2,%xmm4  // broadcast uppermost dword
 	movdqa	%xmm2,%xmm3
 	psllq	$1,%xmm2
-	pxor	%xmm5,%xmm5
+	pxor	%xmm5,%xmm5  // 
 	psrlq	$63,%xmm3
-	pcmpgtd	%xmm4,%xmm5
+	pcmpgtd	%xmm4,%xmm5  // broadcast carry bit
 	pslldq	$8,%xmm3
-	por	%xmm3,%xmm2
-
+	por	%xmm3,%xmm2  // H<<=1
 
+// magic reduction
 	pand	.L0x1c2_polynomial(%rip),%xmm5
-	pxor	%xmm5,%xmm2
-
+	pxor	%xmm5,%xmm2  // if(carry) H^=0x1c2_polynomial
 
+// calculate H^2
 	pshufd	$78,%xmm2,%xmm6
 	movdqa	%xmm2,%xmm0
 	pxor	%xmm2,%xmm6
-	movdqa	%xmm0,%xmm1
+	movdqa	%xmm0,%xmm1  // 
 	pshufd	$78,%xmm0,%xmm3
-	pxor	%xmm0,%xmm3
-	pclmulqdq	$0x00,%xmm2,%xmm0
-	pclmulqdq	$0x11,%xmm2,%xmm1
-	pclmulqdq	$0x00,%xmm6,%xmm3
-	pxor	%xmm0,%xmm3
-	pxor	%xmm1,%xmm3
-
-	movdqa	%xmm3,%xmm4
+	pxor	%xmm0,%xmm3  // 
+	pclmulqdq	$0x00,%xmm2,%xmm0  // ######
+	pclmulqdq	$0x11,%xmm2,%xmm1  // ######
+	pclmulqdq	$0x00,%xmm6,%xmm3  // ######
+	pxor	%xmm0,%xmm3  // 
+	pxor	%xmm1,%xmm3  // 
+
+	movdqa	%xmm3,%xmm4  // 
 	psrldq	$8,%xmm3
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm4,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	pshufd	$78,%xmm2,%xmm3
 	pshufd	$78,%xmm0,%xmm4
-	pxor	%xmm2,%xmm3
-	movdqu	%xmm2,0(%rdi)
-	pxor	%xmm0,%xmm4
-	movdqu	%xmm0,16(%rdi)
-	palignr	$8,%xmm3,%xmm4
-	movdqu	%xmm4,32(%rdi)
-	movdqa	%xmm0,%xmm1
+	pxor	%xmm2,%xmm3  // Karatsuba pre-processing
+	movdqu	%xmm2,0(%rdi)  // save H
+	pxor	%xmm0,%xmm4  // Karatsuba pre-processing
+	movdqu	%xmm0,16(%rdi)  // save H^2
+	palignr	$8,%xmm3,%xmm4  // low part is H.lo^H.hi...
+	movdqu	%xmm4,32(%rdi)  // save Karatsuba "salt"
+	movdqa	%xmm0,%xmm1  // 
 	pshufd	$78,%xmm0,%xmm3
-	pxor	%xmm0,%xmm3
-	pclmulqdq	$0x00,%xmm2,%xmm0
-	pclmulqdq	$0x11,%xmm2,%xmm1
-	pclmulqdq	$0x00,%xmm6,%xmm3
-	pxor	%xmm0,%xmm3
-	pxor	%xmm1,%xmm3
-
-	movdqa	%xmm3,%xmm4
+	pxor	%xmm0,%xmm3  // 
+	pclmulqdq	$0x00,%xmm2,%xmm0  // ######
+	pclmulqdq	$0x11,%xmm2,%xmm1  // ######
+	pclmulqdq	$0x00,%xmm6,%xmm3  // ######
+	pxor	%xmm0,%xmm3  // 
+	pxor	%xmm1,%xmm3  // 
+
+	movdqa	%xmm3,%xmm4  // 
 	psrldq	$8,%xmm3
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm4,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	movdqa	%xmm0,%xmm5
-	movdqa	%xmm0,%xmm1
+	movdqa	%xmm0,%xmm1  // 
 	pshufd	$78,%xmm0,%xmm3
-	pxor	%xmm0,%xmm3
-	pclmulqdq	$0x00,%xmm2,%xmm0
-	pclmulqdq	$0x11,%xmm2,%xmm1
-	pclmulqdq	$0x00,%xmm6,%xmm3
-	pxor	%xmm0,%xmm3
-	pxor	%xmm1,%xmm3
-
-	movdqa	%xmm3,%xmm4
+	pxor	%xmm0,%xmm3  // 
+	pclmulqdq	$0x00,%xmm2,%xmm0  // ######
+	pclmulqdq	$0x11,%xmm2,%xmm1  // ######
+	pclmulqdq	$0x00,%xmm6,%xmm3  // ######
+	pxor	%xmm0,%xmm3  // 
+	pxor	%xmm1,%xmm3  // 
+
+	movdqa	%xmm3,%xmm4  // 
 	psrldq	$8,%xmm3
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm4,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	pshufd	$78,%xmm5,%xmm3
 	pshufd	$78,%xmm0,%xmm4
-	pxor	%xmm5,%xmm3
-	movdqu	%xmm5,48(%rdi)
-	pxor	%xmm0,%xmm4
-	movdqu	%xmm0,64(%rdi)
-	palignr	$8,%xmm3,%xmm4
-	movdqu	%xmm4,80(%rdi)
+	pxor	%xmm5,%xmm3  // Karatsuba pre-processing
+	movdqu	%xmm5,48(%rdi)  // save H^3
+	pxor	%xmm0,%xmm4  // Karatsuba pre-processing
+	movdqu	%xmm0,64(%rdi)  // save H^4
+	palignr	$8,%xmm3,%xmm4  // low part is H^3.lo^H^3.hi...
+	movdqu	%xmm4,80(%rdi)  // save Karatsuba "salt"
 	ret
 .cfi_endproc	
 
@@ -180,43 +180,43 @@
 	movdqu	(%rsi),%xmm2
 	movdqu	32(%rsi),%xmm4
 	pshufb	%xmm5,%xmm0
-	movdqa	%xmm0,%xmm1
+	movdqa	%xmm0,%xmm1  // 
 	pshufd	$78,%xmm0,%xmm3
-	pxor	%xmm0,%xmm3
-	pclmulqdq	$0x00,%xmm2,%xmm0
-	pclmulqdq	$0x11,%xmm2,%xmm1
-	pclmulqdq	$0x00,%xmm4,%xmm3
-	pxor	%xmm0,%xmm3
-	pxor	%xmm1,%xmm3
-
-	movdqa	%xmm3,%xmm4
+	pxor	%xmm0,%xmm3  // 
+	pclmulqdq	$0x00,%xmm2,%xmm0  // ######
+	pclmulqdq	$0x11,%xmm2,%xmm1  // ######
+	pclmulqdq	$0x00,%xmm4,%xmm3  // ######
+	pxor	%xmm0,%xmm3  // 
+	pxor	%xmm1,%xmm3  // 
+
+	movdqa	%xmm3,%xmm4  // 
 	psrldq	$8,%xmm3
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm4,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	pshufb	%xmm5,%xmm0
 	movdqu	%xmm0,(%rdi)
 	ret
@@ -246,13 +246,13 @@
 	jb	.Lskip4x
 
 	subq	$0x30,%rcx
-	movq	$0xA040608020C0E000,%rax
+	movq	$0xA040608020C0E000,%rax  // ((7..0)·0xE0)&0xff
 	movdqu	48(%rsi),%xmm14
 	movdqu	64(%rsi),%xmm15
 
-
-
-
+// ######
+// Xi+4 =(H*Ii+3) + (H^2*Ii+2) + (H^3*Ii+1) + H^4*(Ii+Xi) mod P
+// 
 	movdqu	48(%rdx),%xmm3
 	movdqu	32(%rdx),%xmm11
 	pshufb	%xmm10,%xmm3
@@ -317,33 +317,33 @@
 	pclmulqdq	$0x00,%xmm2,%xmm11
 	pshufd	$78,%xmm3,%xmm4
 
-	pxor	%xmm0,%xmm8
+	pxor	%xmm0,%xmm8  // aggregated Karatsuba post-processing
 	movdqa	%xmm3,%xmm5
-	pxor	%xmm1,%xmm8
+	pxor	%xmm1,%xmm8  // 
 	pxor	%xmm3,%xmm4
-	movdqa	%xmm8,%xmm9
+	movdqa	%xmm8,%xmm9  // 
 	pclmulqdq	$0x11,%xmm2,%xmm13
 	pslldq	$8,%xmm8
-	psrldq	$8,%xmm9
+	psrldq	$8,%xmm9  // 
 	pxor	%xmm8,%xmm0
 	movdqa	.L7_mask(%rip),%xmm8
-	pxor	%xmm9,%xmm1
+	pxor	%xmm9,%xmm1  // 
 	movq	%rax,%xmm9
 
-	pand	%xmm0,%xmm8
-	pshufb	%xmm8,%xmm9
-	pxor	%xmm0,%xmm9
+	pand	%xmm0,%xmm8  // 1st phase
+	pshufb	%xmm8,%xmm9  // 
+	pxor	%xmm0,%xmm9  // 
 	pclmulqdq	$0x00,%xmm7,%xmm12
-	psllq	$57,%xmm9
-	movdqa	%xmm9,%xmm8
+	psllq	$57,%xmm9  // 
+	movdqa	%xmm9,%xmm8  // 
 	pslldq	$8,%xmm9
 	pclmulqdq	$0x00,%xmm6,%xmm3
-	psrldq	$8,%xmm8
+	psrldq	$8,%xmm8  // 
 	pxor	%xmm9,%xmm0
-	pxor	%xmm8,%xmm1
+	pxor	%xmm8,%xmm1  // 
 	movdqu	0(%rdx),%xmm8
 
-	movdqa	%xmm0,%xmm9
+	movdqa	%xmm0,%xmm9  // 2nd phase
 	psrlq	$1,%xmm0
 	pclmulqdq	$0x11,%xmm6,%xmm5
 	xorps	%xmm11,%xmm3
@@ -353,19 +353,19 @@
 	xorps	%xmm13,%xmm5
 	movups	80(%rsi),%xmm7
 	pshufb	%xmm10,%xmm8
-	pxor	%xmm9,%xmm1
+	pxor	%xmm9,%xmm1  // 
 	pxor	%xmm0,%xmm9
 	psrlq	$5,%xmm0
 
 	movdqa	%xmm11,%xmm13
 	pxor	%xmm12,%xmm4
 	pshufd	$78,%xmm11,%xmm12
-	pxor	%xmm9,%xmm0
+	pxor	%xmm9,%xmm0  // 
 	pxor	%xmm8,%xmm1
 	pxor	%xmm11,%xmm12
 	pclmulqdq	$0x00,%xmm14,%xmm11
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	movdqa	%xmm0,%xmm1
 	pclmulqdq	$0x11,%xmm14,%xmm13
 	xorps	%xmm11,%xmm3
@@ -386,56 +386,56 @@
 	xorps	%xmm12,%xmm4
 	xorps	%xmm3,%xmm0
 	xorps	%xmm5,%xmm1
-	pxor	%xmm0,%xmm1
+	pxor	%xmm0,%xmm1  // aggregated Karatsuba post-processing
 	pxor	%xmm4,%xmm8
 
-	pxor	%xmm1,%xmm8
+	pxor	%xmm1,%xmm8  // 
 	pxor	%xmm0,%xmm1
 
-	movdqa	%xmm8,%xmm9
+	movdqa	%xmm8,%xmm9  // 
 	psrldq	$8,%xmm8
-	pslldq	$8,%xmm9
+	pslldq	$8,%xmm9  // 
 	pxor	%xmm8,%xmm1
-	pxor	%xmm9,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm9,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	addq	$0x40,%rcx
 	jz	.Ldone
 	movdqu	32(%rsi),%xmm7
 	subq	$0x10,%rcx
 	jz	.Lodd_tail
 .Lskip4x:
-
-
-
-
-
-	movdqu	(%rdx),%xmm8
-	movdqu	16(%rdx),%xmm3
+// ######
+// Xi+2 =H*(Ii+1 + Xi+1) mod P =
+// (H*Ii+1) + (H*Xi+1) mod P =
+// (H*Ii+1) + H^2*(Ii+Xi) mod P
+// 
+	movdqu	(%rdx),%xmm8  // Ii
+	movdqu	16(%rdx),%xmm3  // Ii+1
 	pshufb	%xmm10,%xmm8
 	pshufb	%xmm10,%xmm3
-	pxor	%xmm8,%xmm0
+	pxor	%xmm8,%xmm0  // Ii+Xi
 
 	movdqa	%xmm3,%xmm5
 	pshufd	$78,%xmm3,%xmm4
@@ -444,7 +444,7 @@
 	pclmulqdq	$0x11,%xmm2,%xmm5
 	pclmulqdq	$0x00,%xmm7,%xmm4
 
-	leaq	32(%rdx),%rdx
+	leaq	32(%rdx),%rdx  // i+=2
 	nop
 	subq	$0x20,%rcx
 	jbe	.Leven_tail
@@ -455,59 +455,59 @@
 .Lmod_loop:
 	movdqa	%xmm0,%xmm1
 	movdqa	%xmm4,%xmm8
-	pshufd	$78,%xmm0,%xmm4
-	pxor	%xmm0,%xmm4
+	pshufd	$78,%xmm0,%xmm4  // 
+	pxor	%xmm0,%xmm4  // 
 
 	pclmulqdq	$0x00,%xmm6,%xmm0
 	pclmulqdq	$0x11,%xmm6,%xmm1
 	pclmulqdq	$0x10,%xmm7,%xmm4
 
-	pxor	%xmm3,%xmm0
+	pxor	%xmm3,%xmm0  // (H*Ii+1) + H^2*(Ii+Xi)
 	pxor	%xmm5,%xmm1
-	movdqu	(%rdx),%xmm9
-	pxor	%xmm0,%xmm8
+	movdqu	(%rdx),%xmm9  // Ii
+	pxor	%xmm0,%xmm8  // aggregated Karatsuba post-processing
 	pshufb	%xmm10,%xmm9
-	movdqu	16(%rdx),%xmm3
+	movdqu	16(%rdx),%xmm3  // Ii+1
 
 	pxor	%xmm1,%xmm8
-	pxor	%xmm9,%xmm1
+	pxor	%xmm9,%xmm1  // "Ii+Xi", consume early
 	pxor	%xmm8,%xmm4
 	pshufb	%xmm10,%xmm3
-	movdqa	%xmm4,%xmm8
+	movdqa	%xmm4,%xmm8  // 
 	psrldq	$8,%xmm8
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm8,%xmm1
-	pxor	%xmm4,%xmm0
+	pxor	%xmm4,%xmm0  // 
 
-	movdqa	%xmm3,%xmm5
+	movdqa	%xmm3,%xmm5  // 
 
-	movdqa	%xmm0,%xmm9
+	movdqa	%xmm0,%xmm9  // 1st phase
 	movdqa	%xmm0,%xmm8
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm8
-	pclmulqdq	$0x00,%xmm2,%xmm3
+	pxor	%xmm0,%xmm8  // 
+	pclmulqdq	$0x00,%xmm2,%xmm3  // ######
 	psllq	$1,%xmm0
-	pxor	%xmm8,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm8
+	pxor	%xmm8,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm8  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm8
+	psrldq	$8,%xmm8  // 
 	pxor	%xmm9,%xmm0
 	pshufd	$78,%xmm5,%xmm4
-	pxor	%xmm8,%xmm1
-	pxor	%xmm5,%xmm4
+	pxor	%xmm8,%xmm1  // 
+	pxor	%xmm5,%xmm4  // 
 
-	movdqa	%xmm0,%xmm9
+	movdqa	%xmm0,%xmm9  // 2nd phase
 	psrlq	$1,%xmm0
-	pclmulqdq	$0x11,%xmm2,%xmm5
-	pxor	%xmm9,%xmm1
+	pclmulqdq	$0x11,%xmm2,%xmm5  // ######
+	pxor	%xmm9,%xmm1  // 
 	pxor	%xmm0,%xmm9
 	psrlq	$5,%xmm0
-	pxor	%xmm9,%xmm0
+	pxor	%xmm9,%xmm0  // 
 	leaq	32(%rdx),%rdx
-	psrlq	$1,%xmm0
-	pclmulqdq	$0x00,%xmm7,%xmm4
-	pxor	%xmm1,%xmm0
+	psrlq	$1,%xmm0  // 
+	pclmulqdq	$0x00,%xmm7,%xmm4  // ######
+	pxor	%xmm1,%xmm0  // 
 
 	subq	$0x20,%rcx
 	ja	.Lmod_loop
@@ -515,90 +515,90 @@
 .Leven_tail:
 	movdqa	%xmm0,%xmm1
 	movdqa	%xmm4,%xmm8
-	pshufd	$78,%xmm0,%xmm4
-	pxor	%xmm0,%xmm4
+	pshufd	$78,%xmm0,%xmm4  // 
+	pxor	%xmm0,%xmm4  // 
 
 	pclmulqdq	$0x00,%xmm6,%xmm0
 	pclmulqdq	$0x11,%xmm6,%xmm1
 	pclmulqdq	$0x10,%xmm7,%xmm4
 
-	pxor	%xmm3,%xmm0
+	pxor	%xmm3,%xmm0  // (H*Ii+1) + H^2*(Ii+Xi)
 	pxor	%xmm5,%xmm1
 	pxor	%xmm0,%xmm8
 	pxor	%xmm1,%xmm8
 	pxor	%xmm8,%xmm4
-	movdqa	%xmm4,%xmm8
+	movdqa	%xmm4,%xmm8  // 
 	psrldq	$8,%xmm8
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm8,%xmm1
-	pxor	%xmm4,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm4,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 	testq	%rcx,%rcx
 	jnz	.Ldone
 
 .Lodd_tail:
-	movdqu	(%rdx),%xmm8
+	movdqu	(%rdx),%xmm8  // Ii
 	pshufb	%xmm10,%xmm8
-	pxor	%xmm8,%xmm0
-	movdqa	%xmm0,%xmm1
+	pxor	%xmm8,%xmm0  // Ii+Xi
+	movdqa	%xmm0,%xmm1  // 
 	pshufd	$78,%xmm0,%xmm3
-	pxor	%xmm0,%xmm3
-	pclmulqdq	$0x00,%xmm2,%xmm0
-	pclmulqdq	$0x11,%xmm2,%xmm1
-	pclmulqdq	$0x00,%xmm7,%xmm3
-	pxor	%xmm0,%xmm3
-	pxor	%xmm1,%xmm3
-
-	movdqa	%xmm3,%xmm4
+	pxor	%xmm0,%xmm3  // 
+	pclmulqdq	$0x00,%xmm2,%xmm0  // ######
+	pclmulqdq	$0x11,%xmm2,%xmm1  // ######
+	pclmulqdq	$0x00,%xmm7,%xmm3  // ######
+	pxor	%xmm0,%xmm3  // 
+	pxor	%xmm1,%xmm3  // 
+
+	movdqa	%xmm3,%xmm4  // 
 	psrldq	$8,%xmm3
-	pslldq	$8,%xmm4
+	pslldq	$8,%xmm4  // 
 	pxor	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-
-	movdqa	%xmm0,%xmm4
+	pxor	%xmm4,%xmm0  // 
+// 1st phase
+	movdqa	%xmm0,%xmm4  // 
 	movdqa	%xmm0,%xmm3
 	psllq	$5,%xmm0
-	pxor	%xmm0,%xmm3
+	pxor	%xmm0,%xmm3  // 
 	psllq	$1,%xmm0
-	pxor	%xmm3,%xmm0
-	psllq	$57,%xmm0
-	movdqa	%xmm0,%xmm3
+	pxor	%xmm3,%xmm0  // 
+	psllq	$57,%xmm0  // 
+	movdqa	%xmm0,%xmm3  // 
 	pslldq	$8,%xmm0
-	psrldq	$8,%xmm3
+	psrldq	$8,%xmm3  // 
 	pxor	%xmm4,%xmm0
-	pxor	%xmm3,%xmm1
-
+	pxor	%xmm3,%xmm1  // 
 
+// 2nd phase
 	movdqa	%xmm0,%xmm4
 	psrlq	$1,%xmm0
-	pxor	%xmm4,%xmm1
+	pxor	%xmm4,%xmm1  // 
 	pxor	%xmm0,%xmm4
 	psrlq	$5,%xmm0
-	pxor	%xmm4,%xmm0
-	psrlq	$1,%xmm0
-	pxor	%xmm1,%xmm0
+	pxor	%xmm4,%xmm0  // 
+	psrlq	$1,%xmm0  // 
+	pxor	%xmm1,%xmm0  // 
 .Ldone:
 	pshufb	%xmm10,%xmm0
 	movdqu	%xmm0,(%rdi)
@@ -617,101 +617,101 @@
 	vzeroupper
 
 	vmovdqu	(%rsi),%xmm2
-	vpshufd	$78,%xmm2,%xmm2
+	vpshufd	$78,%xmm2,%xmm2  // dword swap
 
-
-	vpshufd	$255,%xmm2,%xmm4
+// <<1 twist
+	vpshufd	$255,%xmm2,%xmm4  // broadcast uppermost dword
 	vpsrlq	$63,%xmm2,%xmm3
 	vpsllq	$1,%xmm2,%xmm2
-	vpxor	%xmm5,%xmm5,%xmm5
-	vpcmpgtd	%xmm4,%xmm5,%xmm5
+	vpxor	%xmm5,%xmm5,%xmm5  // 
+	vpcmpgtd	%xmm4,%xmm5,%xmm5  // broadcast carry bit
 	vpslldq	$8,%xmm3,%xmm3
-	vpor	%xmm3,%xmm2,%xmm2
-
+	vpor	%xmm3,%xmm2,%xmm2  // H<<=1
 
+// magic reduction
 	vpand	.L0x1c2_polynomial(%rip),%xmm5,%xmm5
-	vpxor	%xmm5,%xmm2,%xmm2
+	vpxor	%xmm5,%xmm2,%xmm2  // if(carry) H^=0x1c2_polynomial
 
 	vpunpckhqdq	%xmm2,%xmm2,%xmm6
 	vmovdqa	%xmm2,%xmm0
 	vpxor	%xmm2,%xmm6,%xmm6
-	movq	$4,%r10
+	movq	$4,%r10  // up to H^8
 	jmp	.Linit_start_avx
 .align	32
 .Linit_loop_avx:
-	vpalignr	$8,%xmm3,%xmm4,%xmm5
-	vmovdqu	%xmm5,-16(%rdi)
+	vpalignr	$8,%xmm3,%xmm4,%xmm5  // low part is H.lo^H.hi...
+	vmovdqu	%xmm5,-16(%rdi)  // save Karatsuba "salt"
 	vpunpckhqdq	%xmm0,%xmm0,%xmm3
-	vpxor	%xmm0,%xmm3,%xmm3
-	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm1
-	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm0
-	vpclmulqdq	$0x00,%xmm6,%xmm3,%xmm3
-	vpxor	%xmm0,%xmm1,%xmm4
-	vpxor	%xmm4,%xmm3,%xmm3
-
-	vpslldq	$8,%xmm3,%xmm4
+	vpxor	%xmm0,%xmm3,%xmm3  // 
+	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm1  // ######
+	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm0  // ######
+	vpclmulqdq	$0x00,%xmm6,%xmm3,%xmm3  // ######
+	vpxor	%xmm0,%xmm1,%xmm4  // 
+	vpxor	%xmm4,%xmm3,%xmm3  // 
+
+	vpslldq	$8,%xmm3,%xmm4  // 
 	vpsrldq	$8,%xmm3,%xmm3
-	vpxor	%xmm4,%xmm0,%xmm0
+	vpxor	%xmm4,%xmm0,%xmm0  // 
 	vpxor	%xmm3,%xmm1,%xmm1
-	vpsllq	$57,%xmm0,%xmm3
+	vpsllq	$57,%xmm0,%xmm3  // 1st phase
 	vpsllq	$62,%xmm0,%xmm4
-	vpxor	%xmm3,%xmm4,%xmm4
+	vpxor	%xmm3,%xmm4,%xmm4  // 
 	vpsllq	$63,%xmm0,%xmm3
-	vpxor	%xmm3,%xmm4,%xmm4
-	vpslldq	$8,%xmm4,%xmm3
+	vpxor	%xmm3,%xmm4,%xmm4  // 
+	vpslldq	$8,%xmm4,%xmm3  // 
 	vpsrldq	$8,%xmm4,%xmm4
-	vpxor	%xmm3,%xmm0,%xmm0
+	vpxor	%xmm3,%xmm0,%xmm0  // 
 	vpxor	%xmm4,%xmm1,%xmm1
 
-	vpsrlq	$1,%xmm0,%xmm4
+	vpsrlq	$1,%xmm0,%xmm4  // 2nd phase
 	vpxor	%xmm0,%xmm1,%xmm1
-	vpxor	%xmm4,%xmm0,%xmm0
+	vpxor	%xmm4,%xmm0,%xmm0  // 
 	vpsrlq	$5,%xmm4,%xmm4
-	vpxor	%xmm4,%xmm0,%xmm0
-	vpsrlq	$1,%xmm0,%xmm0
-	vpxor	%xmm1,%xmm0,%xmm0
+	vpxor	%xmm4,%xmm0,%xmm0  // 
+	vpsrlq	$1,%xmm0,%xmm0  // 
+	vpxor	%xmm1,%xmm0,%xmm0  // 
 .Linit_start_avx:
 	vmovdqa	%xmm0,%xmm5
 	vpunpckhqdq	%xmm0,%xmm0,%xmm3
-	vpxor	%xmm0,%xmm3,%xmm3
-	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm1
-	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm0
-	vpclmulqdq	$0x00,%xmm6,%xmm3,%xmm3
-	vpxor	%xmm0,%xmm1,%xmm4
-	vpxor	%xmm4,%xmm3,%xmm3
-
-	vpslldq	$8,%xmm3,%xmm4
+	vpxor	%xmm0,%xmm3,%xmm3  // 
+	vpclmulqdq	$0x11,%xmm2,%xmm0,%xmm1  // ######
+	vpclmulqdq	$0x00,%xmm2,%xmm0,%xmm0  // ######
+	vpclmulqdq	$0x00,%xmm6,%xmm3,%xmm3  // ######
+	vpxor	%xmm0,%xmm1,%xmm4  // 
+	vpxor	%xmm4,%xmm3,%xmm3  // 
+
+	vpslldq	$8,%xmm3,%xmm4  // 
 	vpsrldq	$8,%xmm3,%xmm3
-	vpxor	%xmm4,%xmm0,%xmm0
+	vpxor	%xmm4,%xmm0,%xmm0  // 
 	vpxor	%xmm3,%xmm1,%xmm1
-	vpsllq	$57,%xmm0,%xmm3
+	vpsllq	$57,%xmm0,%xmm3  // 1st phase
 	vpsllq	$62,%xmm0,%xmm4
-	vpxor	%xmm3,%xmm4,%xmm4
+	vpxor	%xmm3,%xmm4,%xmm4  // 
 	vpsllq	$63,%xmm0,%xmm3
-	vpxor	%xmm3,%xmm4,%xmm4
-	vpslldq	$8,%xmm4,%xmm3
+	vpxor	%xmm3,%xmm4,%xmm4  // 
+	vpslldq	$8,%xmm4,%xmm3  // 
 	vpsrldq	$8,%xmm4,%xmm4
-	vpxor	%xmm3,%xmm0,%xmm0
+	vpxor	%xmm3,%xmm0,%xmm0  // 
 	vpxor	%xmm4,%xmm1,%xmm1
 
-	vpsrlq	$1,%xmm0,%xmm4
+	vpsrlq	$1,%xmm0,%xmm4  // 2nd phase
 	vpxor	%xmm0,%xmm1,%xmm1
-	vpxor	%xmm4,%xmm0,%xmm0
+	vpxor	%xmm4,%xmm0,%xmm0  // 
 	vpsrlq	$5,%xmm4,%xmm4
-	vpxor	%xmm4,%xmm0,%xmm0
-	vpsrlq	$1,%xmm0,%xmm0
-	vpxor	%xmm1,%xmm0,%xmm0
+	vpxor	%xmm4,%xmm0,%xmm0  // 
+	vpsrlq	$1,%xmm0,%xmm0  // 
+	vpxor	%xmm1,%xmm0,%xmm0  // 
 	vpshufd	$78,%xmm5,%xmm3
 	vpshufd	$78,%xmm0,%xmm4
-	vpxor	%xmm5,%xmm3,%xmm3
-	vmovdqu	%xmm5,0(%rdi)
-	vpxor	%xmm0,%xmm4,%xmm4
-	vmovdqu	%xmm0,16(%rdi)
+	vpxor	%xmm5,%xmm3,%xmm3  // Karatsuba pre-processing
+	vmovdqu	%xmm5,0(%rdi)  // save H^1,3,5,7
+	vpxor	%xmm0,%xmm4,%xmm4  // Karatsuba pre-processing
+	vmovdqu	%xmm0,16(%rdi)  // save H^2,4,6,8
 	leaq	48(%rdi),%rdi
 	subq	$1,%r10
 	jnz	.Linit_loop_avx
 
-	vpalignr	$8,%xmm4,%xmm3,%xmm5
+	vpalignr	$8,%xmm4,%xmm3,%xmm5  // last "salt" is flipped
 	vmovdqu	%xmm5,-16(%rdi)
 
 	vzeroupper
@@ -739,29 +739,29 @@
 _CET_ENDBR
 	vzeroupper
 
-	vmovdqu	(%rdi),%xmm10
+	vmovdqu	(%rdi),%xmm10  // load %xmm10
 	leaq	.L0x1c2_polynomial(%rip),%r10
-	leaq	64(%rsi),%rsi
+	leaq	64(%rsi),%rsi  // size optimization
 	vmovdqu	.Lbswap_mask(%rip),%xmm13
 	vpshufb	%xmm13,%xmm10,%xmm10
 	cmpq	$0x80,%rcx
 	jb	.Lshort_avx
 	subq	$0x80,%rcx
 
-	vmovdqu	112(%rdx),%xmm14
-	vmovdqu	0-64(%rsi),%xmm6
+	vmovdqu	112(%rdx),%xmm14  // I7
+	vmovdqu	0-64(%rsi),%xmm6  // %xmm6^1
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vmovdqu	32-64(%rsi),%xmm7
 
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
-	vmovdqu	96(%rdx),%xmm15
+	vmovdqu	96(%rdx),%xmm15  // I6
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
 	vpxor	%xmm14,%xmm9,%xmm9
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	16-64(%rsi),%xmm6
+	vmovdqu	16-64(%rsi),%xmm6  // %xmm6^2
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
-	vmovdqu	80(%rdx),%xmm14
+	vmovdqu	80(%rdx),%xmm14  // I5
 	vpclmulqdq	$0x00,%xmm7,%xmm9,%xmm2
 	vpxor	%xmm15,%xmm8,%xmm8
 
@@ -769,9 +769,9 @@
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm3
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm4
-	vmovdqu	48-64(%rsi),%xmm6
+	vmovdqu	48-64(%rsi),%xmm6  // %xmm6^3
 	vpxor	%xmm14,%xmm9,%xmm9
-	vmovdqu	64(%rdx),%xmm15
+	vmovdqu	64(%rdx),%xmm15  // I4
 	vpclmulqdq	$0x10,%xmm7,%xmm8,%xmm5
 	vmovdqu	80-64(%rsi),%xmm7
 
@@ -781,56 +781,56 @@
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	64-64(%rsi),%xmm6
+	vmovdqu	64-64(%rsi),%xmm6  // %xmm6^4
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm9,%xmm2
 	vpxor	%xmm15,%xmm8,%xmm8
 
-	vmovdqu	48(%rdx),%xmm14
+	vmovdqu	48(%rdx),%xmm14  // I3
 	vpxor	%xmm3,%xmm0,%xmm0
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm3
 	vpxor	%xmm4,%xmm1,%xmm1
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm4
-	vmovdqu	96-64(%rsi),%xmm6
+	vmovdqu	96-64(%rsi),%xmm6  // %xmm6^5
 	vpxor	%xmm5,%xmm2,%xmm2
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
 	vpclmulqdq	$0x10,%xmm7,%xmm8,%xmm5
 	vmovdqu	128-64(%rsi),%xmm7
 	vpxor	%xmm14,%xmm9,%xmm9
 
-	vmovdqu	32(%rdx),%xmm15
+	vmovdqu	32(%rdx),%xmm15  // I2
 	vpxor	%xmm0,%xmm3,%xmm3
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	112-64(%rsi),%xmm6
+	vmovdqu	112-64(%rsi),%xmm6  // %xmm6^6
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
 	vpclmulqdq	$0x00,%xmm7,%xmm9,%xmm2
 	vpxor	%xmm15,%xmm8,%xmm8
 
-	vmovdqu	16(%rdx),%xmm14
+	vmovdqu	16(%rdx),%xmm14  // I1
 	vpxor	%xmm3,%xmm0,%xmm0
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm3
 	vpxor	%xmm4,%xmm1,%xmm1
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm4
-	vmovdqu	144-64(%rsi),%xmm6
+	vmovdqu	144-64(%rsi),%xmm6  // %xmm6^7
 	vpxor	%xmm5,%xmm2,%xmm2
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
 	vpclmulqdq	$0x10,%xmm7,%xmm8,%xmm5
 	vmovdqu	176-64(%rsi),%xmm7
 	vpxor	%xmm14,%xmm9,%xmm9
 
-	vmovdqu	(%rdx),%xmm15
+	vmovdqu	(%rdx),%xmm15  // I0
 	vpxor	%xmm0,%xmm3,%xmm3
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	160-64(%rsi),%xmm6
+	vmovdqu	160-64(%rsi),%xmm6  // %xmm6^8
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x10,%xmm7,%xmm9,%xmm2
 
@@ -838,41 +838,41 @@
 	cmpq	$0x80,%rcx
 	jb	.Ltail_avx
 
-	vpxor	%xmm10,%xmm15,%xmm15
+	vpxor	%xmm10,%xmm15,%xmm15  // accumulate %xmm10
 	subq	$0x80,%rcx
 	jmp	.Loop8x_avx
 
 .align	32
 .Loop8x_avx:
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
-	vmovdqu	112(%rdx),%xmm14
+	vmovdqu	112(%rdx),%xmm14  // I7
 	vpxor	%xmm0,%xmm3,%xmm3
 	vpxor	%xmm15,%xmm8,%xmm8
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm10
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm11
-	vmovdqu	0-64(%rsi),%xmm6
+	vmovdqu	0-64(%rsi),%xmm6  // %xmm6^1
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm12
 	vmovdqu	32-64(%rsi),%xmm7
 	vpxor	%xmm14,%xmm9,%xmm9
 
-	vmovdqu	96(%rdx),%xmm15
+	vmovdqu	96(%rdx),%xmm15  // I6
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
-	vpxor	%xmm3,%xmm10,%xmm10
+	vpxor	%xmm3,%xmm10,%xmm10  // collect result
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
 	vxorps	%xmm4,%xmm11,%xmm11
-	vmovdqu	16-64(%rsi),%xmm6
+	vmovdqu	16-64(%rsi),%xmm6  // %xmm6^2
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
 	vpclmulqdq	$0x00,%xmm7,%xmm9,%xmm2
 	vpxor	%xmm5,%xmm12,%xmm12
 	vxorps	%xmm15,%xmm8,%xmm8
 
-	vmovdqu	80(%rdx),%xmm14
-	vpxor	%xmm10,%xmm12,%xmm12
+	vmovdqu	80(%rdx),%xmm14  // I5
+	vpxor	%xmm10,%xmm12,%xmm12  // aggregated Karatsuba post-processing
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm3
 	vpxor	%xmm11,%xmm12,%xmm12
 	vpslldq	$8,%xmm12,%xmm9
@@ -880,7 +880,7 @@
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm4
 	vpsrldq	$8,%xmm12,%xmm12
 	vpxor	%xmm9,%xmm10,%xmm10
-	vmovdqu	48-64(%rsi),%xmm6
+	vmovdqu	48-64(%rsi),%xmm6  // %xmm6^3
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vxorps	%xmm12,%xmm11,%xmm11
 	vpxor	%xmm1,%xmm4,%xmm4
@@ -890,26 +890,26 @@
 	vpxor	%xmm14,%xmm9,%xmm9
 	vpxor	%xmm2,%xmm5,%xmm5
 
-	vmovdqu	64(%rdx),%xmm15
-	vpalignr	$8,%xmm10,%xmm10,%xmm12
+	vmovdqu	64(%rdx),%xmm15  // I4
+	vpalignr	$8,%xmm10,%xmm10,%xmm12  // 1st phase
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpxor	%xmm3,%xmm0,%xmm0
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	64-64(%rsi),%xmm6
+	vmovdqu	64-64(%rsi),%xmm6  // %xmm6^4
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
 	vpxor	%xmm4,%xmm1,%xmm1
 	vpclmulqdq	$0x00,%xmm7,%xmm9,%xmm2
 	vxorps	%xmm15,%xmm8,%xmm8
 	vpxor	%xmm5,%xmm2,%xmm2
 
-	vmovdqu	48(%rdx),%xmm14
+	vmovdqu	48(%rdx),%xmm14  // I3
 	vpclmulqdq	$0x10,(%r10),%xmm10,%xmm10
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm3
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vpxor	%xmm0,%xmm3,%xmm3
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm4
-	vmovdqu	96-64(%rsi),%xmm6
+	vmovdqu	96-64(%rsi),%xmm6  // %xmm6^5
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x10,%xmm7,%xmm8,%xmm5
@@ -917,12 +917,12 @@
 	vpxor	%xmm14,%xmm9,%xmm9
 	vpxor	%xmm2,%xmm5,%xmm5
 
-	vmovdqu	32(%rdx),%xmm15
+	vmovdqu	32(%rdx),%xmm15  // I2
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpxor	%xmm3,%xmm0,%xmm0
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	112-64(%rsi),%xmm6
+	vmovdqu	112-64(%rsi),%xmm6  // %xmm6^6
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
 	vpxor	%xmm4,%xmm1,%xmm1
 	vpclmulqdq	$0x00,%xmm7,%xmm9,%xmm2
@@ -930,13 +930,13 @@
 	vpxor	%xmm5,%xmm2,%xmm2
 	vxorps	%xmm12,%xmm10,%xmm10
 
-	vmovdqu	16(%rdx),%xmm14
-	vpalignr	$8,%xmm10,%xmm10,%xmm12
+	vmovdqu	16(%rdx),%xmm14  // I1
+	vpalignr	$8,%xmm10,%xmm10,%xmm12  // 2nd phase
 	vpclmulqdq	$0x00,%xmm6,%xmm15,%xmm3
 	vpshufb	%xmm13,%xmm14,%xmm14
 	vpxor	%xmm0,%xmm3,%xmm3
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm4
-	vmovdqu	144-64(%rsi),%xmm6
+	vmovdqu	144-64(%rsi),%xmm6  // %xmm6^7
 	vpclmulqdq	$0x10,(%r10),%xmm10,%xmm10
 	vxorps	%xmm11,%xmm12,%xmm12
 	vpunpckhqdq	%xmm14,%xmm14,%xmm9
@@ -946,14 +946,14 @@
 	vpxor	%xmm14,%xmm9,%xmm9
 	vpxor	%xmm2,%xmm5,%xmm5
 
-	vmovdqu	(%rdx),%xmm15
+	vmovdqu	(%rdx),%xmm15  // I0
 	vpclmulqdq	$0x00,%xmm6,%xmm14,%xmm0
 	vpshufb	%xmm13,%xmm15,%xmm15
 	vpclmulqdq	$0x11,%xmm6,%xmm14,%xmm1
-	vmovdqu	160-64(%rsi),%xmm6
+	vmovdqu	160-64(%rsi),%xmm6  // %xmm6^8
 	vpxor	%xmm12,%xmm15,%xmm15
 	vpclmulqdq	$0x10,%xmm7,%xmm9,%xmm2
-	vpxor	%xmm10,%xmm15,%xmm15
+	vpxor	%xmm10,%xmm15,%xmm15  // accumulate %xmm10
 
 	leaq	128(%rdx),%rdx
 	subq	$0x80,%rcx
@@ -964,15 +964,15 @@
 
 .align	32
 .Lshort_avx:
-	vmovdqu	-16(%rdx,%rcx,1),%xmm14
+	vmovdqu	-16(%rdx,%rcx,1),%xmm14  // very last word
 	leaq	(%rdx,%rcx,1),%rdx
-	vmovdqu	0-64(%rsi),%xmm6
+	vmovdqu	0-64(%rsi),%xmm6  // %xmm6^1
 	vmovdqu	32-64(%rsi),%xmm7
 	vpshufb	%xmm13,%xmm14,%xmm15
 
-	vmovdqa	%xmm0,%xmm3
-	vmovdqa	%xmm1,%xmm4
-	vmovdqa	%xmm2,%xmm5
+	vmovdqa	%xmm0,%xmm3  // subtle way to zero %xmm3,
+	vmovdqa	%xmm1,%xmm4  // %xmm4 and
+	vmovdqa	%xmm2,%xmm5  // %xmm5
 	subq	$0x10,%rcx
 	jz	.Ltail_avx
 
@@ -983,7 +983,7 @@
 	vmovdqu	-32(%rdx),%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm1
-	vmovdqu	16-64(%rsi),%xmm6
+	vmovdqu	16-64(%rsi),%xmm6  // %xmm6^2
 	vpshufb	%xmm13,%xmm14,%xmm15
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm2
@@ -998,7 +998,7 @@
 	vmovdqu	-48(%rdx),%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm1
-	vmovdqu	48-64(%rsi),%xmm6
+	vmovdqu	48-64(%rsi),%xmm6  // %xmm6^3
 	vpshufb	%xmm13,%xmm14,%xmm15
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm2
@@ -1013,7 +1013,7 @@
 	vmovdqu	-64(%rdx),%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm1
-	vmovdqu	64-64(%rsi),%xmm6
+	vmovdqu	64-64(%rsi),%xmm6  // %xmm6^4
 	vpshufb	%xmm13,%xmm14,%xmm15
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm2
@@ -1028,7 +1028,7 @@
 	vmovdqu	-80(%rdx),%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm1
-	vmovdqu	96-64(%rsi),%xmm6
+	vmovdqu	96-64(%rsi),%xmm6  // %xmm6^5
 	vpshufb	%xmm13,%xmm14,%xmm15
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm2
@@ -1043,7 +1043,7 @@
 	vmovdqu	-96(%rdx),%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm1
-	vmovdqu	112-64(%rsi),%xmm6
+	vmovdqu	112-64(%rsi),%xmm6  // %xmm6^6
 	vpshufb	%xmm13,%xmm14,%xmm15
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm2
@@ -1058,7 +1058,7 @@
 	vmovdqu	-112(%rdx),%xmm14
 	vpxor	%xmm1,%xmm4,%xmm4
 	vpclmulqdq	$0x11,%xmm6,%xmm15,%xmm1
-	vmovdqu	144-64(%rsi),%xmm6
+	vmovdqu	144-64(%rsi),%xmm6  // %xmm6^7
 	vpshufb	%xmm13,%xmm14,%xmm15
 	vpxor	%xmm2,%xmm5,%xmm5
 	vpclmulqdq	$0x00,%xmm7,%xmm8,%xmm2
@@ -1068,7 +1068,7 @@
 
 .align	32
 .Ltail_avx:
-	vpxor	%xmm10,%xmm15,%xmm15
+	vpxor	%xmm10,%xmm15,%xmm15  // accumulate %xmm10
 .Ltail_no_xor_avx:
 	vpunpckhqdq	%xmm15,%xmm15,%xmm8
 	vpxor	%xmm0,%xmm3,%xmm3
@@ -1085,18 +1085,18 @@
 	vpxor	%xmm1,%xmm4,%xmm11
 	vpxor	%xmm2,%xmm5,%xmm5
 
-	vpxor	%xmm10,%xmm5,%xmm5
+	vpxor	%xmm10,%xmm5,%xmm5  // aggregated Karatsuba post-processing
 	vpxor	%xmm11,%xmm5,%xmm5
 	vpslldq	$8,%xmm5,%xmm9
 	vpsrldq	$8,%xmm5,%xmm5
 	vpxor	%xmm9,%xmm10,%xmm10
 	vpxor	%xmm5,%xmm11,%xmm11
 
-	vpclmulqdq	$0x10,%xmm12,%xmm10,%xmm9
+	vpclmulqdq	$0x10,%xmm12,%xmm10,%xmm9  // 1st phase
 	vpalignr	$8,%xmm10,%xmm10,%xmm10
 	vpxor	%xmm9,%xmm10,%xmm10
 
-	vpclmulqdq	$0x10,%xmm12,%xmm10,%xmm9
+	vpclmulqdq	$0x10,%xmm12,%xmm10,%xmm9  // 2nd phase
 	vpalignr	$8,%xmm10,%xmm10,%xmm10
 	vpxor	%xmm11,%xmm10,%xmm10
 	vpxor	%xmm9,%xmm10,%xmm10

boringssl-0.20260708.tar.xz/gen/bcm/ghash-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/ghash-x86_64-win.asm Changed

@@ -27,154 +27,154 @@
 $L$SEH_prologue_gcm_init_clmul_3:
 $L$SEH_endprologue_gcm_init_clmul_4:
 	movdqu	xmm2,XMMWORDrdx
-	pshufd	xmm2,xmm2,78
+	pshufd	xmm2,xmm2,78  ; dword swap
 
-
-	pshufd	xmm4,xmm2,255
+; <<1 twist
+	pshufd	xmm4,xmm2,255  ; broadcast uppermost dword
 	movdqa	xmm3,xmm2
 	psllq	xmm2,1
-	pxor	xmm5,xmm5
+	pxor	xmm5,xmm5  ; 
 	psrlq	xmm3,63
-	pcmpgtd	xmm5,xmm4
+	pcmpgtd	xmm5,xmm4  ; broadcast carry bit
 	pslldq	xmm3,8
-	por	xmm2,xmm3
-
+	por	xmm2,xmm3  ; H<<=1
 
+; magic reduction
 	pand	xmm5,XMMWORD$L$0x1c2_polynomial
-	pxor	xmm2,xmm5
-
+	pxor	xmm2,xmm5  ; if(carry) H^=0x1c2_polynomial
 
+; calculate H^2
 	pshufd	xmm6,xmm2,78
 	movdqa	xmm0,xmm2
 	pxor	xmm6,xmm2
-	movdqa	xmm1,xmm0
+	movdqa	xmm1,xmm0  ; 
 	pshufd	xmm3,xmm0,78
-	pxor	xmm3,xmm0
-	pclmulqdq	xmm0,xmm2,0x00
-	pclmulqdq	xmm1,xmm2,0x11
-	pclmulqdq	xmm3,xmm6,0x00
-	pxor	xmm3,xmm0
-	pxor	xmm3,xmm1
-
-	movdqa	xmm4,xmm3
+	pxor	xmm3,xmm0  ; 
+	pclmulqdq	xmm0,xmm2,0x00  ; ######
+	pclmulqdq	xmm1,xmm2,0x11  ; ######
+	pclmulqdq	xmm3,xmm6,0x00  ; ######
+	pxor	xmm3,xmm0  ; 
+	pxor	xmm3,xmm1  ; 
+
+	movdqa	xmm4,xmm3  ; 
 	psrldq	xmm3,8
-	pslldq	xmm4,8
+	pslldq	xmm4,8  ; 
 	pxor	xmm1,xmm3
-	pxor	xmm0,xmm4
-
-	movdqa	xmm4,xmm0
+	pxor	xmm0,xmm4  ; 
+; 1st phase
+	movdqa	xmm4,xmm0  ; 
 	movdqa	xmm3,xmm0
 	psllq	xmm0,5
-	pxor	xmm3,xmm0
+	pxor	xmm3,xmm0  ; 
 	psllq	xmm0,1
-	pxor	xmm0,xmm3
-	psllq	xmm0,57
-	movdqa	xmm3,xmm0
+	pxor	xmm0,xmm3  ; 
+	psllq	xmm0,57  ; 
+	movdqa	xmm3,xmm0  ; 
 	pslldq	xmm0,8
-	psrldq	xmm3,8
+	psrldq	xmm3,8  ; 
 	pxor	xmm0,xmm4
-	pxor	xmm1,xmm3
-
+	pxor	xmm1,xmm3  ; 
 
+; 2nd phase
 	movdqa	xmm4,xmm0
 	psrlq	xmm0,1
-	pxor	xmm1,xmm4
+	pxor	xmm1,xmm4  ; 
 	pxor	xmm4,xmm0
 	psrlq	xmm0,5
-	pxor	xmm0,xmm4
-	psrlq	xmm0,1
-	pxor	xmm0,xmm1
+	pxor	xmm0,xmm4  ; 
+	psrlq	xmm0,1  ; 
+	pxor	xmm0,xmm1  ; 
 	pshufd	xmm3,xmm2,78
 	pshufd	xmm4,xmm0,78
-	pxor	xmm3,xmm2
-	movdqu	XMMWORDrcx,xmm2
-	pxor	xmm4,xmm0
-	movdqu	XMMWORD16+rcx,xmm0
-	palignr	xmm4,xmm3,8
-	movdqu	XMMWORD32+rcx,xmm4
-	movdqa	xmm1,xmm0
+	pxor	xmm3,xmm2  ; Karatsuba pre-processing
+	movdqu	XMMWORDrcx,xmm2  ; save H
+	pxor	xmm4,xmm0  ; Karatsuba pre-processing
+	movdqu	XMMWORD16+rcx,xmm0  ; save H^2
+	palignr	xmm4,xmm3,8  ; low part is H.lo^H.hi...
+	movdqu	XMMWORD32+rcx,xmm4  ; save Karatsuba "salt"
+	movdqa	xmm1,xmm0  ; 
 	pshufd	xmm3,xmm0,78
-	pxor	xmm3,xmm0
-	pclmulqdq	xmm0,xmm2,0x00
-	pclmulqdq	xmm1,xmm2,0x11
-	pclmulqdq	xmm3,xmm6,0x00
-	pxor	xmm3,xmm0
-	pxor	xmm3,xmm1
-
-	movdqa	xmm4,xmm3
+	pxor	xmm3,xmm0  ; 
+	pclmulqdq	xmm0,xmm2,0x00  ; ######
+	pclmulqdq	xmm1,xmm2,0x11  ; ######
+	pclmulqdq	xmm3,xmm6,0x00  ; ######
+	pxor	xmm3,xmm0  ; 
+	pxor	xmm3,xmm1  ; 
+
+	movdqa	xmm4,xmm3  ; 
 	psrldq	xmm3,8
-	pslldq	xmm4,8
+	pslldq	xmm4,8  ; 
 	pxor	xmm1,xmm3
-	pxor	xmm0,xmm4
-
-	movdqa	xmm4,xmm0
+	pxor	xmm0,xmm4  ; 
+; 1st phase
+	movdqa	xmm4,xmm0  ; 
 	movdqa	xmm3,xmm0
 	psllq	xmm0,5
-	pxor	xmm3,xmm0
+	pxor	xmm3,xmm0  ; 
 	psllq	xmm0,1
-	pxor	xmm0,xmm3
-	psllq	xmm0,57
-	movdqa	xmm3,xmm0
+	pxor	xmm0,xmm3  ; 
+	psllq	xmm0,57  ; 
+	movdqa	xmm3,xmm0  ; 
 	pslldq	xmm0,8
-	psrldq	xmm3,8
+	psrldq	xmm3,8  ; 
 	pxor	xmm0,xmm4
-	pxor	xmm1,xmm3
-
+	pxor	xmm1,xmm3  ; 
 
+; 2nd phase
 	movdqa	xmm4,xmm0
 	psrlq	xmm0,1
-	pxor	xmm1,xmm4
+	pxor	xmm1,xmm4  ; 
 	pxor	xmm4,xmm0
 	psrlq	xmm0,5
-	pxor	xmm0,xmm4
-	psrlq	xmm0,1
-	pxor	xmm0,xmm1
+	pxor	xmm0,xmm4  ; 
+	psrlq	xmm0,1  ; 
+	pxor	xmm0,xmm1  ; 
 	movdqa	xmm5,xmm0
-	movdqa	xmm1,xmm0
+	movdqa	xmm1,xmm0  ; 
 	pshufd	xmm3,xmm0,78
-	pxor	xmm3,xmm0
-	pclmulqdq	xmm0,xmm2,0x00
-	pclmulqdq	xmm1,xmm2,0x11
-	pclmulqdq	xmm3,xmm6,0x00
-	pxor	xmm3,xmm0
-	pxor	xmm3,xmm1
-
-	movdqa	xmm4,xmm3
+	pxor	xmm3,xmm0  ; 
+	pclmulqdq	xmm0,xmm2,0x00  ; ######
+	pclmulqdq	xmm1,xmm2,0x11  ; ######
+	pclmulqdq	xmm3,xmm6,0x00  ; ######
+	pxor	xmm3,xmm0  ; 
+	pxor	xmm3,xmm1  ; 
+
+	movdqa	xmm4,xmm3  ; 
 	psrldq	xmm3,8
-	pslldq	xmm4,8
+	pslldq	xmm4,8  ; 
 	pxor	xmm1,xmm3
-	pxor	xmm0,xmm4
-
-	movdqa	xmm4,xmm0
+	pxor	xmm0,xmm4  ; 
+; 1st phase
+	movdqa	xmm4,xmm0  ; 
 	movdqa	xmm3,xmm0
 	psllq	xmm0,5
-	pxor	xmm3,xmm0
+	pxor	xmm3,xmm0  ; 
 	psllq	xmm0,1
-	pxor	xmm0,xmm3
-	psllq	xmm0,57
-	movdqa	xmm3,xmm0
+	pxor	xmm0,xmm3  ; 
+	psllq	xmm0,57  ; 
+	movdqa	xmm3,xmm0  ; 
 	pslldq	xmm0,8
-	psrldq	xmm3,8
+	psrldq	xmm3,8  ; 
 	pxor	xmm0,xmm4
-	pxor	xmm1,xmm3
-
+	pxor	xmm1,xmm3  ; 
 
+; 2nd phase
 	movdqa	xmm4,xmm0
 	psrlq	xmm0,1
-	pxor	xmm1,xmm4
+	pxor	xmm1,xmm4  ; 
 	pxor	xmm4,xmm0
 	psrlq	xmm0,5
-	pxor	xmm0,xmm4
-	psrlq	xmm0,1
-	pxor	xmm0,xmm1
+	pxor	xmm0,xmm4  ; 
+	psrlq	xmm0,1  ; 
+	pxor	xmm0,xmm1  ; 
 	pshufd	xmm3,xmm5,78
 	pshufd	xmm4,xmm0,78
-	pxor	xmm3,xmm5
-	movdqu	XMMWORD48+rcx,xmm5
-	pxor	xmm4,xmm0
-	movdqu	XMMWORD64+rcx,xmm0
-	palignr	xmm4,xmm3,8
-	movdqu	XMMWORD80+rcx,xmm4
+	pxor	xmm3,xmm5  ; Karatsuba pre-processing
+	movdqu	XMMWORD48+rcx,xmm5  ; save H^3
+	pxor	xmm4,xmm0  ; Karatsuba pre-processing
+	movdqu	XMMWORD64+rcx,xmm0  ; save H^4
+	palignr	xmm4,xmm3,8  ; low part is H^3.lo^H^3.hi...
+	movdqu	XMMWORD80+rcx,xmm4  ; save Karatsuba "salt"
 	movaps	xmm6,XMMWORDrsp
 	lea	rsp,24+rsp
 	ret
@@ -193,43 +193,43 @@
 	movdqu	xmm2,XMMWORDrdx
 	movdqu	xmm4,XMMWORD32+rdx
 	pshufb	xmm0,xmm5
-	movdqa	xmm1,xmm0
+	movdqa	xmm1,xmm0  ; 
 	pshufd	xmm3,xmm0,78
-	pxor	xmm3,xmm0
-	pclmulqdq	xmm0,xmm2,0x00
-	pclmulqdq	xmm1,xmm2,0x11
-	pclmulqdq	xmm3,xmm4,0x00
-	pxor	xmm3,xmm0
-	pxor	xmm3,xmm1
-
-	movdqa	xmm4,xmm3
+	pxor	xmm3,xmm0  ; 
+	pclmulqdq	xmm0,xmm2,0x00  ; ######
+	pclmulqdq	xmm1,xmm2,0x11  ; ######
+	pclmulqdq	xmm3,xmm4,0x00  ; ######
+	pxor	xmm3,xmm0  ; 
+	pxor	xmm3,xmm1  ; 
+
+	movdqa	xmm4,xmm3  ; 
 	psrldq	xmm3,8
-	pslldq	xmm4,8
+	pslldq	xmm4,8  ; 
 	pxor	xmm1,xmm3
-	pxor	xmm0,xmm4
-
-	movdqa	xmm4,xmm0
+	pxor	xmm0,xmm4  ; 
+; 1st phase
+	movdqa	xmm4,xmm0  ; 
 	movdqa	xmm3,xmm0
 	psllq	xmm0,5
-	pxor	xmm3,xmm0
+	pxor	xmm3,xmm0  ; 
 	psllq	xmm0,1
-	pxor	xmm0,xmm3
-	psllq	xmm0,57
-	movdqa	xmm3,xmm0
+	pxor	xmm0,xmm3  ; 
+	psllq	xmm0,57  ; 
+	movdqa	xmm3,xmm0  ; 
 	pslldq	xmm0,8
-	psrldq	xmm3,8
+	psrldq	xmm3,8  ; 
 	pxor	xmm0,xmm4
-	pxor	xmm1,xmm3
-
+	pxor	xmm1,xmm3  ; 
 
+; 2nd phase
 	movdqa	xmm4,xmm0
 	psrlq	xmm0,1
-	pxor	xmm1,xmm4
+	pxor	xmm1,xmm4  ; 
 	pxor	xmm4,xmm0
 	psrlq	xmm0,5
-	pxor	xmm0,xmm4
-	psrlq	xmm0,1
-	pxor	xmm0,xmm1
+	pxor	xmm0,xmm4  ; 
+	psrlq	xmm0,1  ; 
+	pxor	xmm0,xmm1  ; 
 	pshufb	xmm0,xmm5
 	movdqu	XMMWORDrcx,xmm0
 	ret
@@ -282,13 +282,13 @@
 	jb	NEAR $L$skip4x
 
 	sub	r9,0x30
-	mov	rax,0xA040608020C0E000
+	mov	rax,0xA040608020C0E000  ; ((7..0)·0xE0)&0xff
 	movdqu	xmm14,XMMWORD48+rdx
 	movdqu	xmm15,XMMWORD64+rdx
 
-
-
-
+; ######
+; Xi+4 =(H*Ii+3) + (H^2*Ii+2) + (H^3*Ii+1) + H^4*(Ii+Xi) mod P
+; 
 	movdqu	xmm3,XMMWORD48+r8
 	movdqu	xmm11,XMMWORD32+r8
 	pshufb	xmm3,xmm10
@@ -353,33 +353,33 @@
 	pclmulqdq	xmm11,xmm2,0x00
 	pshufd	xmm4,xmm3,78
 
-	pxor	xmm8,xmm0
+	pxor	xmm8,xmm0  ; aggregated Karatsuba post-processing
 	movdqa	xmm5,xmm3
-	pxor	xmm8,xmm1
+	pxor	xmm8,xmm1  ; 
 	pxor	xmm4,xmm3
-	movdqa	xmm9,xmm8
+	movdqa	xmm9,xmm8  ; 
 	pclmulqdq	xmm13,xmm2,0x11
 	pslldq	xmm8,8
-	psrldq	xmm9,8
+	psrldq	xmm9,8  ; 
 	pxor	xmm0,xmm8
 	movdqa	xmm8,XMMWORD$L$7_mask
-	pxor	xmm1,xmm9
+	pxor	xmm1,xmm9  ; 
 	movq	xmm9,rax
 
-	pand	xmm8,xmm0
-	pshufb	xmm9,xmm8
-	pxor	xmm9,xmm0
+	pand	xmm8,xmm0  ; 1st phase
+	pshufb	xmm9,xmm8  ; 
+	pxor	xmm9,xmm0  ; 
 	pclmulqdq	xmm12,xmm7,0x00
-	psllq	xmm9,57
-	movdqa	xmm8,xmm9
+	psllq	xmm9,57  ; 
+	movdqa	xmm8,xmm9  ; 
 	pslldq	xmm9,8
 	pclmulqdq	xmm3,xmm6,0x00
-	psrldq	xmm8,8
+	psrldq	xmm8,8  ; 
 	pxor	xmm0,xmm9
-	pxor	xmm1,xmm8
+	pxor	xmm1,xmm8  ; 
 	movdqu	xmm8,XMMWORDr8
 
-	movdqa	xmm9,xmm0
+	movdqa	xmm9,xmm0  ; 2nd phase
 	psrlq	xmm0,1
 	pclmulqdq	xmm5,xmm6,0x11
 	xorps	xmm3,xmm11
@@ -389,19 +389,19 @@
 	xorps	xmm5,xmm13
 	movups	xmm7,XMMWORD80+rdx
 	pshufb	xmm8,xmm10
-	pxor	xmm1,xmm9
+	pxor	xmm1,xmm9  ; 
 	pxor	xmm9,xmm0
 	psrlq	xmm0,5
 
 	movdqa	xmm13,xmm11
 	pxor	xmm4,xmm12
 	pshufd	xmm12,xmm11,78
-	pxor	xmm0,xmm9
+	pxor	xmm0,xmm9  ; 
 	pxor	xmm1,xmm8
 	pxor	xmm12,xmm11
 	pclmulqdq	xmm11,xmm14,0x00
-	psrlq	xmm0,1
-	pxor	xmm0,xmm1
+	psrlq	xmm0,1  ; 
+	pxor	xmm0,xmm1  ; 
 	movdqa	xmm1,xmm0
 	pclmulqdq	xmm13,xmm14,0x11
 	xorps	xmm3,xmm11
@@ -422,56 +422,56 @@
 	xorps	xmm4,xmm12
 	xorps	xmm0,xmm3
 	xorps	xmm1,xmm5
-	pxor	xmm1,xmm0
+	pxor	xmm1,xmm0  ; aggregated Karatsuba post-processing
 	pxor	xmm8,xmm4
 
-	pxor	xmm8,xmm1
+	pxor	xmm8,xmm1  ; 
 	pxor	xmm1,xmm0
 
-	movdqa	xmm9,xmm8
+	movdqa	xmm9,xmm8  ; 
 	psrldq	xmm8,8
-	pslldq	xmm9,8
+	pslldq	xmm9,8  ; 
 	pxor	xmm1,xmm8
-	pxor	xmm0,xmm9
-
-	movdqa	xmm4,xmm0
+	pxor	xmm0,xmm9  ; 
+; 1st phase
+	movdqa	xmm4,xmm0  ; 
 	movdqa	xmm3,xmm0
 	psllq	xmm0,5
-	pxor	xmm3,xmm0
+	pxor	xmm3,xmm0  ; 
 	psllq	xmm0,1
-	pxor	xmm0,xmm3
-	psllq	xmm0,57
-	movdqa	xmm3,xmm0
+	pxor	xmm0,xmm3  ; 
+	psllq	xmm0,57  ; 
+	movdqa	xmm3,xmm0  ; 
 	pslldq	xmm0,8
-	psrldq	xmm3,8
+	psrldq	xmm3,8  ; 
 	pxor	xmm0,xmm4
-	pxor	xmm1,xmm3
-
+	pxor	xmm1,xmm3  ; 
 
+; 2nd phase
 	movdqa	xmm4,xmm0
 	psrlq	xmm0,1
-	pxor	xmm1,xmm4
+	pxor	xmm1,xmm4  ; 
 	pxor	xmm4,xmm0
 	psrlq	xmm0,5
-	pxor	xmm0,xmm4
-	psrlq	xmm0,1
-	pxor	xmm0,xmm1
+	pxor	xmm0,xmm4  ; 
+	psrlq	xmm0,1  ; 
+	pxor	xmm0,xmm1  ; 
 	add	r9,0x40
 	jz	NEAR $L$done
 	movdqu	xmm7,XMMWORD32+rdx
 	sub	r9,0x10
 	jz	NEAR $L$odd_tail
 $L$skip4x:
-
-
-
-
-
-	movdqu	xmm8,XMMWORDr8
-	movdqu	xmm3,XMMWORD16+r8
+; ######
+; Xi+2 =H*(Ii+1 + Xi+1) mod P =
+; (H*Ii+1) + (H*Xi+1) mod P =
+; (H*Ii+1) + H^2*(Ii+Xi) mod P
+; 
+	movdqu	xmm8,XMMWORDr8  ; Ii
+	movdqu	xmm3,XMMWORD16+r8  ; Ii+1
 	pshufb	xmm8,xmm10
 	pshufb	xmm3,xmm10
-	pxor	xmm0,xmm8
+	pxor	xmm0,xmm8  ; Ii+Xi
 
 	movdqa	xmm5,xmm3
 	pshufd	xmm4,xmm3,78
@@ -480,7 +480,7 @@
 	pclmulqdq	xmm5,xmm2,0x11
 	pclmulqdq	xmm4,xmm7,0x00
 
-	lea	r8,32+r8
+	lea	r8,32+r8  ; i+=2
 	nop
 	sub	r9,0x20
 	jbe	NEAR $L$even_tail
@@ -491,59 +491,59 @@
 $L$mod_loop:
 	movdqa	xmm1,xmm0
 	movdqa	xmm8,xmm4
-	pshufd	xmm4,xmm0,78
-	pxor	xmm4,xmm0
+	pshufd	xmm4,xmm0,78  ; 
+	pxor	xmm4,xmm0  ; 
 
 	pclmulqdq	xmm0,xmm6,0x00
 	pclmulqdq	xmm1,xmm6,0x11
 	pclmulqdq	xmm4,xmm7,0x10
 
-	pxor	xmm0,xmm3
+	pxor	xmm0,xmm3  ; (H*Ii+1) + H^2*(Ii+Xi)
 	pxor	xmm1,xmm5
-	movdqu	xmm9,XMMWORDr8
-	pxor	xmm8,xmm0
+	movdqu	xmm9,XMMWORDr8  ; Ii
+	pxor	xmm8,xmm0  ; aggregated Karatsuba post-processing
 	pshufb	xmm9,xmm10
-	movdqu	xmm3,XMMWORD16+r8
+	movdqu	xmm3,XMMWORD16+r8  ; Ii+1
 
 	pxor	xmm8,xmm1
-	pxor	xmm1,xmm9
+	pxor	xmm1,xmm9  ; "Ii+Xi", consume early
 	pxor	xmm4,xmm8
 	pshufb	xmm3,xmm10
-	movdqa	xmm8,xmm4
+	movdqa	xmm8,xmm4  ; 
 	psrldq	xmm8,8
-	pslldq	xmm4,8
+	pslldq	xmm4,8  ; 
 	pxor	xmm1,xmm8
-	pxor	xmm0,xmm4
+	pxor	xmm0,xmm4  ; 
 
-	movdqa	xmm5,xmm3
+	movdqa	xmm5,xmm3  ; 
 
-	movdqa	xmm9,xmm0
+	movdqa	xmm9,xmm0  ; 1st phase
 	movdqa	xmm8,xmm0
 	psllq	xmm0,5
-	pxor	xmm8,xmm0
-	pclmulqdq	xmm3,xmm2,0x00
+	pxor	xmm8,xmm0  ; 
+	pclmulqdq	xmm3,xmm2,0x00  ; ######
 	psllq	xmm0,1
-	pxor	xmm0,xmm8
-	psllq	xmm0,57
-	movdqa	xmm8,xmm0
+	pxor	xmm0,xmm8  ; 
+	psllq	xmm0,57  ; 
+	movdqa	xmm8,xmm0  ; 
 	pslldq	xmm0,8
-	psrldq	xmm8,8
+	psrldq	xmm8,8  ; 
 	pxor	xmm0,xmm9
 	pshufd	xmm4,xmm5,78
-	pxor	xmm1,xmm8
-	pxor	xmm4,xmm5
+	pxor	xmm1,xmm8  ; 
+	pxor	xmm4,xmm5  ; 
 
-	movdqa	xmm9,xmm0
+	movdqa	xmm9,xmm0  ; 2nd phase
 	psrlq	xmm0,1
-	pclmulqdq	xmm5,xmm2,0x11
-	pxor	xmm1,xmm9
+	pclmulqdq	xmm5,xmm2,0x11  ; ######
+	pxor	xmm1,xmm9  ; 
 	pxor	xmm9,xmm0
 	psrlq	xmm0,5
-	pxor	xmm0,xmm9
+	pxor	xmm0,xmm9  ; 
 	lea	r8,32+r8
-	psrlq	xmm0,1
-	pclmulqdq	xmm4,xmm7,0x00
-	pxor	xmm0,xmm1
+	psrlq	xmm0,1  ; 
+	pclmulqdq	xmm4,xmm7,0x00  ; ######
+	pxor	xmm0,xmm1  ; 
 
 	sub	r9,0x20
 	ja	NEAR $L$mod_loop
@@ -551,90 +551,90 @@
 $L$even_tail:
 	movdqa	xmm1,xmm0
 	movdqa	xmm8,xmm4
-	pshufd	xmm4,xmm0,78
-	pxor	xmm4,xmm0
+	pshufd	xmm4,xmm0,78  ; 
+	pxor	xmm4,xmm0  ; 
 
 	pclmulqdq	xmm0,xmm6,0x00
 	pclmulqdq	xmm1,xmm6,0x11
 	pclmulqdq	xmm4,xmm7,0x10
 
-	pxor	xmm0,xmm3
+	pxor	xmm0,xmm3  ; (H*Ii+1) + H^2*(Ii+Xi)
 	pxor	xmm1,xmm5
 	pxor	xmm8,xmm0
 	pxor	xmm8,xmm1
 	pxor	xmm4,xmm8
-	movdqa	xmm8,xmm4
+	movdqa	xmm8,xmm4  ; 
 	psrldq	xmm8,8
-	pslldq	xmm4,8
+	pslldq	xmm4,8  ; 
 	pxor	xmm1,xmm8
-	pxor	xmm0,xmm4
-
-	movdqa	xmm4,xmm0
+	pxor	xmm0,xmm4  ; 
+; 1st phase
+	movdqa	xmm4,xmm0  ; 
 	movdqa	xmm3,xmm0
 	psllq	xmm0,5
-	pxor	xmm3,xmm0
+	pxor	xmm3,xmm0  ; 
 	psllq	xmm0,1
-	pxor	xmm0,xmm3
-	psllq	xmm0,57
-	movdqa	xmm3,xmm0
+	pxor	xmm0,xmm3  ; 
+	psllq	xmm0,57  ; 
+	movdqa	xmm3,xmm0  ; 
 	pslldq	xmm0,8
-	psrldq	xmm3,8
+	psrldq	xmm3,8  ; 
 	pxor	xmm0,xmm4
-	pxor	xmm1,xmm3
-
+	pxor	xmm1,xmm3  ; 
 
+; 2nd phase
 	movdqa	xmm4,xmm0
 	psrlq	xmm0,1
-	pxor	xmm1,xmm4
+	pxor	xmm1,xmm4  ; 
 	pxor	xmm4,xmm0
 	psrlq	xmm0,5
-	pxor	xmm0,xmm4
-	psrlq	xmm0,1
-	pxor	xmm0,xmm1
+	pxor	xmm0,xmm4  ; 
+	psrlq	xmm0,1  ; 
+	pxor	xmm0,xmm1  ; 
 	test	r9,r9
 	jnz	NEAR $L$done
 
 $L$odd_tail:
-	movdqu	xmm8,XMMWORDr8
+	movdqu	xmm8,XMMWORDr8  ; Ii
 	pshufb	xmm8,xmm10
-	pxor	xmm0,xmm8
-	movdqa	xmm1,xmm0
+	pxor	xmm0,xmm8  ; Ii+Xi
+	movdqa	xmm1,xmm0  ; 
 	pshufd	xmm3,xmm0,78
-	pxor	xmm3,xmm0
-	pclmulqdq	xmm0,xmm2,0x00
-	pclmulqdq	xmm1,xmm2,0x11
-	pclmulqdq	xmm3,xmm7,0x00
-	pxor	xmm3,xmm0
-	pxor	xmm3,xmm1
-
-	movdqa	xmm4,xmm3
+	pxor	xmm3,xmm0  ; 
+	pclmulqdq	xmm0,xmm2,0x00  ; ######
+	pclmulqdq	xmm1,xmm2,0x11  ; ######
+	pclmulqdq	xmm3,xmm7,0x00  ; ######
+	pxor	xmm3,xmm0  ; 
+	pxor	xmm3,xmm1  ; 
+
+	movdqa	xmm4,xmm3  ; 
 	psrldq	xmm3,8
-	pslldq	xmm4,8
+	pslldq	xmm4,8  ; 
 	pxor	xmm1,xmm3
-	pxor	xmm0,xmm4
-
-	movdqa	xmm4,xmm0
+	pxor	xmm0,xmm4  ; 
+; 1st phase
+	movdqa	xmm4,xmm0  ; 
 	movdqa	xmm3,xmm0
 	psllq	xmm0,5
-	pxor	xmm3,xmm0
+	pxor	xmm3,xmm0  ; 
 	psllq	xmm0,1
-	pxor	xmm0,xmm3
-	psllq	xmm0,57
-	movdqa	xmm3,xmm0
+	pxor	xmm0,xmm3  ; 
+	psllq	xmm0,57  ; 
+	movdqa	xmm3,xmm0  ; 
 	pslldq	xmm0,8
-	psrldq	xmm3,8
+	psrldq	xmm3,8  ; 
 	pxor	xmm0,xmm4
-	pxor	xmm1,xmm3
-
+	pxor	xmm1,xmm3  ; 
 
+; 2nd phase
 	movdqa	xmm4,xmm0
 	psrlq	xmm0,1
-	pxor	xmm1,xmm4
+	pxor	xmm1,xmm4  ; 
 	pxor	xmm4,xmm0
 	psrlq	xmm0,5
-	pxor	xmm0,xmm4
-	psrlq	xmm0,1
-	pxor	xmm0,xmm1
+	pxor	xmm0,xmm4  ; 
+	psrlq	xmm0,1  ; 
+	pxor	xmm0,xmm1  ; 
 $L$done:
 	pshufb	xmm0,xmm10
 	movdqu	XMMWORDrcx,xmm0
@@ -668,101 +668,101 @@
 	vzeroupper
 
 	vmovdqu	xmm2,XMMWORDrdx
-	vpshufd	xmm2,xmm2,78
-
+	vpshufd	xmm2,xmm2,78  ; dword swap
 
-	vpshufd	xmm4,xmm2,255
+; <<1 twist
+	vpshufd	xmm4,xmm2,255  ; broadcast uppermost dword
 	vpsrlq	xmm3,xmm2,63
 	vpsllq	xmm2,xmm2,1
-	vpxor	xmm5,xmm5,xmm5
-	vpcmpgtd	xmm5,xmm5,xmm4
+	vpxor	xmm5,xmm5,xmm5  ; 
+	vpcmpgtd	xmm5,xmm5,xmm4  ; broadcast carry bit
 	vpslldq	xmm3,xmm3,8
-	vpor	xmm2,xmm2,xmm3
-
+	vpor	xmm2,xmm2,xmm3  ; H<<=1
 
+; magic reduction
 	vpand	xmm5,xmm5,XMMWORD$L$0x1c2_polynomial
-	vpxor	xmm2,xmm2,xmm5
+	vpxor	xmm2,xmm2,xmm5  ; if(carry) H^=0x1c2_polynomial
 
 	vpunpckhqdq	xmm6,xmm2,xmm2
 	vmovdqa	xmm0,xmm2
 	vpxor	xmm6,xmm6,xmm2
-	mov	r10,4
+	mov	r10,4  ; up to H^8
 	jmp	NEAR $L$init_start_avx
 ALIGN	32
 $L$init_loop_avx:
-	vpalignr	xmm5,xmm4,xmm3,8
-	vmovdqu	XMMWORD(-16)+rcx,xmm5
+	vpalignr	xmm5,xmm4,xmm3,8  ; low part is H.lo^H.hi...
+	vmovdqu	XMMWORD(-16)+rcx,xmm5  ; save Karatsuba "salt"
 	vpunpckhqdq	xmm3,xmm0,xmm0
-	vpxor	xmm3,xmm3,xmm0
-	vpclmulqdq	xmm1,xmm0,xmm2,0x11
-	vpclmulqdq	xmm0,xmm0,xmm2,0x00
-	vpclmulqdq	xmm3,xmm3,xmm6,0x00
-	vpxor	xmm4,xmm1,xmm0
-	vpxor	xmm3,xmm3,xmm4
-
-	vpslldq	xmm4,xmm3,8
+	vpxor	xmm3,xmm3,xmm0  ; 
+	vpclmulqdq	xmm1,xmm0,xmm2,0x11  ; ######
+	vpclmulqdq	xmm0,xmm0,xmm2,0x00  ; ######
+	vpclmulqdq	xmm3,xmm3,xmm6,0x00  ; ######
+	vpxor	xmm4,xmm1,xmm0  ; 
+	vpxor	xmm3,xmm3,xmm4  ; 
+
+	vpslldq	xmm4,xmm3,8  ; 
 	vpsrldq	xmm3,xmm3,8
-	vpxor	xmm0,xmm0,xmm4
+	vpxor	xmm0,xmm0,xmm4  ; 
 	vpxor	xmm1,xmm1,xmm3
-	vpsllq	xmm3,xmm0,57
+	vpsllq	xmm3,xmm0,57  ; 1st phase
 	vpsllq	xmm4,xmm0,62
-	vpxor	xmm4,xmm4,xmm3
+	vpxor	xmm4,xmm4,xmm3  ; 
 	vpsllq	xmm3,xmm0,63
-	vpxor	xmm4,xmm4,xmm3
-	vpslldq	xmm3,xmm4,8
+	vpxor	xmm4,xmm4,xmm3  ; 
+	vpslldq	xmm3,xmm4,8  ; 
 	vpsrldq	xmm4,xmm4,8
-	vpxor	xmm0,xmm0,xmm3
+	vpxor	xmm0,xmm0,xmm3  ; 
 	vpxor	xmm1,xmm1,xmm4
 
-	vpsrlq	xmm4,xmm0,1
+	vpsrlq	xmm4,xmm0,1  ; 2nd phase
 	vpxor	xmm1,xmm1,xmm0
-	vpxor	xmm0,xmm0,xmm4
+	vpxor	xmm0,xmm0,xmm4  ; 
 	vpsrlq	xmm4,xmm4,5
-	vpxor	xmm0,xmm0,xmm4
-	vpsrlq	xmm0,xmm0,1
-	vpxor	xmm0,xmm0,xmm1
+	vpxor	xmm0,xmm0,xmm4  ; 
+	vpsrlq	xmm0,xmm0,1  ; 
+	vpxor	xmm0,xmm0,xmm1  ; 
 $L$init_start_avx:
 	vmovdqa	xmm5,xmm0
 	vpunpckhqdq	xmm3,xmm0,xmm0
-	vpxor	xmm3,xmm3,xmm0
-	vpclmulqdq	xmm1,xmm0,xmm2,0x11
-	vpclmulqdq	xmm0,xmm0,xmm2,0x00
-	vpclmulqdq	xmm3,xmm3,xmm6,0x00
-	vpxor	xmm4,xmm1,xmm0
-	vpxor	xmm3,xmm3,xmm4
-
-	vpslldq	xmm4,xmm3,8
+	vpxor	xmm3,xmm3,xmm0  ; 
+	vpclmulqdq	xmm1,xmm0,xmm2,0x11  ; ######
+	vpclmulqdq	xmm0,xmm0,xmm2,0x00  ; ######
+	vpclmulqdq	xmm3,xmm3,xmm6,0x00  ; ######
+	vpxor	xmm4,xmm1,xmm0  ; 
+	vpxor	xmm3,xmm3,xmm4  ; 
+
+	vpslldq	xmm4,xmm3,8  ; 
 	vpsrldq	xmm3,xmm3,8
-	vpxor	xmm0,xmm0,xmm4
+	vpxor	xmm0,xmm0,xmm4  ; 
 	vpxor	xmm1,xmm1,xmm3
-	vpsllq	xmm3,xmm0,57
+	vpsllq	xmm3,xmm0,57  ; 1st phase
 	vpsllq	xmm4,xmm0,62
-	vpxor	xmm4,xmm4,xmm3
+	vpxor	xmm4,xmm4,xmm3  ; 
 	vpsllq	xmm3,xmm0,63
-	vpxor	xmm4,xmm4,xmm3
-	vpslldq	xmm3,xmm4,8
+	vpxor	xmm4,xmm4,xmm3  ; 
+	vpslldq	xmm3,xmm4,8  ; 
 	vpsrldq	xmm4,xmm4,8
-	vpxor	xmm0,xmm0,xmm3
+	vpxor	xmm0,xmm0,xmm3  ; 
 	vpxor	xmm1,xmm1,xmm4
 
-	vpsrlq	xmm4,xmm0,1
+	vpsrlq	xmm4,xmm0,1  ; 2nd phase
 	vpxor	xmm1,xmm1,xmm0
-	vpxor	xmm0,xmm0,xmm4
+	vpxor	xmm0,xmm0,xmm4  ; 
 	vpsrlq	xmm4,xmm4,5
-	vpxor	xmm0,xmm0,xmm4
-	vpsrlq	xmm0,xmm0,1
-	vpxor	xmm0,xmm0,xmm1
+	vpxor	xmm0,xmm0,xmm4  ; 
+	vpsrlq	xmm0,xmm0,1  ; 
+	vpxor	xmm0,xmm0,xmm1  ; 
 	vpshufd	xmm3,xmm5,78
 	vpshufd	xmm4,xmm0,78
-	vpxor	xmm3,xmm3,xmm5
-	vmovdqu	XMMWORDrcx,xmm5
-	vpxor	xmm4,xmm4,xmm0
-	vmovdqu	XMMWORD16+rcx,xmm0
+	vpxor	xmm3,xmm3,xmm5  ; Karatsuba pre-processing
+	vmovdqu	XMMWORDrcx,xmm5  ; save H^1,3,5,7
+	vpxor	xmm4,xmm4,xmm0  ; Karatsuba pre-processing
+	vmovdqu	XMMWORD16+rcx,xmm0  ; save H^2,4,6,8
 	lea	rcx,48+rcx
 	sub	r10,1
 	jnz	NEAR $L$init_loop_avx
 
-	vpalignr	xmm5,xmm3,xmm4,8
+	vpalignr	xmm5,xmm3,xmm4,8  ; last "salt" is flipped
 	vmovdqu	XMMWORD(-16)+rcx,xmm5
 
 	vzeroupper
@@ -814,29 +814,29 @@
 $L$SEH_endprologue_gcm_ghash_avx_13:
 	vzeroupper
 
-	vmovdqu	xmm10,XMMWORDrcx
+	vmovdqu	xmm10,XMMWORDrcx  ; load %xmm10
 	lea	r10,$L$0x1c2_polynomial
-	lea	rdx,64+rdx
+	lea	rdx,64+rdx  ; size optimization
 	vmovdqu	xmm13,XMMWORD$L$bswap_mask
 	vpshufb	xmm10,xmm10,xmm13
 	cmp	r9,0x80
 	jb	NEAR $L$short_avx
 	sub	r9,0x80
 
-	vmovdqu	xmm14,XMMWORD112+r8
-	vmovdqu	xmm6,XMMWORD((0-64))+rdx
+	vmovdqu	xmm14,XMMWORD112+r8  ; I7
+	vmovdqu	xmm6,XMMWORD((0-64))+rdx  ; %xmm6^1
 	vpshufb	xmm14,xmm14,xmm13
 	vmovdqu	xmm7,XMMWORD((32-64))+rdx
 
 	vpunpckhqdq	xmm9,xmm14,xmm14
-	vmovdqu	xmm15,XMMWORD96+r8
+	vmovdqu	xmm15,XMMWORD96+r8  ; I6
 	vpclmulqdq	xmm0,xmm14,xmm6,0x00
 	vpxor	xmm9,xmm9,xmm14
 	vpshufb	xmm15,xmm15,xmm13
 	vpclmulqdq	xmm1,xmm14,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((16-64))+rdx
+	vmovdqu	xmm6,XMMWORD((16-64))+rdx  ; %xmm6^2
 	vpunpckhqdq	xmm8,xmm15,xmm15
-	vmovdqu	xmm14,XMMWORD80+r8
+	vmovdqu	xmm14,XMMWORD80+r8  ; I5
 	vpclmulqdq	xmm2,xmm9,xmm7,0x00
 	vpxor	xmm8,xmm8,xmm15
 
@@ -844,9 +844,9 @@
 	vpclmulqdq	xmm3,xmm15,xmm6,0x00
 	vpunpckhqdq	xmm9,xmm14,xmm14
 	vpclmulqdq	xmm4,xmm15,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((48-64))+rdx
+	vmovdqu	xmm6,XMMWORD((48-64))+rdx  ; %xmm6^3
 	vpxor	xmm9,xmm9,xmm14
-	vmovdqu	xmm15,XMMWORD64+r8
+	vmovdqu	xmm15,XMMWORD64+r8  ; I4
 	vpclmulqdq	xmm5,xmm8,xmm7,0x10
 	vmovdqu	xmm7,XMMWORD((80-64))+rdx
 
@@ -856,56 +856,56 @@
 	vpxor	xmm4,xmm4,xmm1
 	vpunpckhqdq	xmm8,xmm15,xmm15
 	vpclmulqdq	xmm1,xmm14,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((64-64))+rdx
+	vmovdqu	xmm6,XMMWORD((64-64))+rdx  ; %xmm6^4
 	vpxor	xmm5,xmm5,xmm2
 	vpclmulqdq	xmm2,xmm9,xmm7,0x00
 	vpxor	xmm8,xmm8,xmm15
 
-	vmovdqu	xmm14,XMMWORD48+r8
+	vmovdqu	xmm14,XMMWORD48+r8  ; I3
 	vpxor	xmm0,xmm0,xmm3
 	vpclmulqdq	xmm3,xmm15,xmm6,0x00
 	vpxor	xmm1,xmm1,xmm4
 	vpshufb	xmm14,xmm14,xmm13
 	vpclmulqdq	xmm4,xmm15,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((96-64))+rdx
+	vmovdqu	xmm6,XMMWORD((96-64))+rdx  ; %xmm6^5
 	vpxor	xmm2,xmm2,xmm5
 	vpunpckhqdq	xmm9,xmm14,xmm14
 	vpclmulqdq	xmm5,xmm8,xmm7,0x10
 	vmovdqu	xmm7,XMMWORD((128-64))+rdx
 	vpxor	xmm9,xmm9,xmm14
 
-	vmovdqu	xmm15,XMMWORD32+r8
+	vmovdqu	xmm15,XMMWORD32+r8  ; I2
 	vpxor	xmm3,xmm3,xmm0
 	vpclmulqdq	xmm0,xmm14,xmm6,0x00
 	vpxor	xmm4,xmm4,xmm1
 	vpshufb	xmm15,xmm15,xmm13
 	vpclmulqdq	xmm1,xmm14,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((112-64))+rdx
+	vmovdqu	xmm6,XMMWORD((112-64))+rdx  ; %xmm6^6
 	vpxor	xmm5,xmm5,xmm2
 	vpunpckhqdq	xmm8,xmm15,xmm15
 	vpclmulqdq	xmm2,xmm9,xmm7,0x00
 	vpxor	xmm8,xmm8,xmm15
 
-	vmovdqu	xmm14,XMMWORD16+r8
+	vmovdqu	xmm14,XMMWORD16+r8  ; I1
 	vpxor	xmm0,xmm0,xmm3
 	vpclmulqdq	xmm3,xmm15,xmm6,0x00
 	vpxor	xmm1,xmm1,xmm4
 	vpshufb	xmm14,xmm14,xmm13
 	vpclmulqdq	xmm4,xmm15,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((144-64))+rdx
+	vmovdqu	xmm6,XMMWORD((144-64))+rdx  ; %xmm6^7
 	vpxor	xmm2,xmm2,xmm5
 	vpunpckhqdq	xmm9,xmm14,xmm14
 	vpclmulqdq	xmm5,xmm8,xmm7,0x10
 	vmovdqu	xmm7,XMMWORD((176-64))+rdx
 	vpxor	xmm9,xmm9,xmm14
 
-	vmovdqu	xmm15,XMMWORDr8
+	vmovdqu	xmm15,XMMWORDr8  ; I0
 	vpxor	xmm3,xmm3,xmm0
 	vpclmulqdq	xmm0,xmm14,xmm6,0x00
 	vpxor	xmm4,xmm4,xmm1
 	vpshufb	xmm15,xmm15,xmm13
 	vpclmulqdq	xmm1,xmm14,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((160-64))+rdx
+	vmovdqu	xmm6,XMMWORD((160-64))+rdx  ; %xmm6^8
 	vpxor	xmm5,xmm5,xmm2
 	vpclmulqdq	xmm2,xmm9,xmm7,0x10
 
@@ -913,41 +913,41 @@
 	cmp	r9,0x80
 	jb	NEAR $L$tail_avx
 
-	vpxor	xmm15,xmm15,xmm10
+	vpxor	xmm15,xmm15,xmm10  ; accumulate %xmm10
 	sub	r9,0x80
 	jmp	NEAR $L$oop8x_avx
 
 ALIGN	32
 $L$oop8x_avx:
 	vpunpckhqdq	xmm8,xmm15,xmm15
-	vmovdqu	xmm14,XMMWORD112+r8
+	vmovdqu	xmm14,XMMWORD112+r8  ; I7
 	vpxor	xmm3,xmm3,xmm0
 	vpxor	xmm8,xmm8,xmm15
 	vpclmulqdq	xmm10,xmm15,xmm6,0x00
 	vpshufb	xmm14,xmm14,xmm13
 	vpxor	xmm4,xmm4,xmm1
 	vpclmulqdq	xmm11,xmm15,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((0-64))+rdx
+	vmovdqu	xmm6,XMMWORD((0-64))+rdx  ; %xmm6^1
 	vpunpckhqdq	xmm9,xmm14,xmm14
 	vpxor	xmm5,xmm5,xmm2
 	vpclmulqdq	xmm12,xmm8,xmm7,0x00
 	vmovdqu	xmm7,XMMWORD((32-64))+rdx
 	vpxor	xmm9,xmm9,xmm14
 
-	vmovdqu	xmm15,XMMWORD96+r8
+	vmovdqu	xmm15,XMMWORD96+r8  ; I6
 	vpclmulqdq	xmm0,xmm14,xmm6,0x00
-	vpxor	xmm10,xmm10,xmm3
+	vpxor	xmm10,xmm10,xmm3  ; collect result
 	vpshufb	xmm15,xmm15,xmm13
 	vpclmulqdq	xmm1,xmm14,xmm6,0x11
 	vxorps	xmm11,xmm11,xmm4
-	vmovdqu	xmm6,XMMWORD((16-64))+rdx
+	vmovdqu	xmm6,XMMWORD((16-64))+rdx  ; %xmm6^2
 	vpunpckhqdq	xmm8,xmm15,xmm15
 	vpclmulqdq	xmm2,xmm9,xmm7,0x00
 	vpxor	xmm12,xmm12,xmm5
 	vxorps	xmm8,xmm8,xmm15
 
-	vmovdqu	xmm14,XMMWORD80+r8
-	vpxor	xmm12,xmm12,xmm10
+	vmovdqu	xmm14,XMMWORD80+r8  ; I5
+	vpxor	xmm12,xmm12,xmm10  ; aggregated Karatsuba post-processing
 	vpclmulqdq	xmm3,xmm15,xmm6,0x00
 	vpxor	xmm12,xmm12,xmm11
 	vpslldq	xmm9,xmm12,8
@@ -955,7 +955,7 @@
 	vpclmulqdq	xmm4,xmm15,xmm6,0x11
 	vpsrldq	xmm12,xmm12,8
 	vpxor	xmm10,xmm10,xmm9
-	vmovdqu	xmm6,XMMWORD((48-64))+rdx
+	vmovdqu	xmm6,XMMWORD((48-64))+rdx  ; %xmm6^3
 	vpshufb	xmm14,xmm14,xmm13
 	vxorps	xmm11,xmm11,xmm12
 	vpxor	xmm4,xmm4,xmm1
@@ -965,26 +965,26 @@
 	vpxor	xmm9,xmm9,xmm14
 	vpxor	xmm5,xmm5,xmm2
 
-	vmovdqu	xmm15,XMMWORD64+r8
-	vpalignr	xmm12,xmm10,xmm10,8
+	vmovdqu	xmm15,XMMWORD64+r8  ; I4
+	vpalignr	xmm12,xmm10,xmm10,8  ; 1st phase
 	vpclmulqdq	xmm0,xmm14,xmm6,0x00
 	vpshufb	xmm15,xmm15,xmm13
 	vpxor	xmm0,xmm0,xmm3
 	vpclmulqdq	xmm1,xmm14,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((64-64))+rdx
+	vmovdqu	xmm6,XMMWORD((64-64))+rdx  ; %xmm6^4
 	vpunpckhqdq	xmm8,xmm15,xmm15
 	vpxor	xmm1,xmm1,xmm4
 	vpclmulqdq	xmm2,xmm9,xmm7,0x00
 	vxorps	xmm8,xmm8,xmm15
 	vpxor	xmm2,xmm2,xmm5
 
-	vmovdqu	xmm14,XMMWORD48+r8
+	vmovdqu	xmm14,XMMWORD48+r8  ; I3
 	vpclmulqdq	xmm10,xmm10,XMMWORDr10,0x10
 	vpclmulqdq	xmm3,xmm15,xmm6,0x00
 	vpshufb	xmm14,xmm14,xmm13
 	vpxor	xmm3,xmm3,xmm0
 	vpclmulqdq	xmm4,xmm15,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((96-64))+rdx
+	vmovdqu	xmm6,XMMWORD((96-64))+rdx  ; %xmm6^5
 	vpunpckhqdq	xmm9,xmm14,xmm14
 	vpxor	xmm4,xmm4,xmm1
 	vpclmulqdq	xmm5,xmm8,xmm7,0x10
@@ -992,12 +992,12 @@
 	vpxor	xmm9,xmm9,xmm14
 	vpxor	xmm5,xmm5,xmm2
 
-	vmovdqu	xmm15,XMMWORD32+r8
+	vmovdqu	xmm15,XMMWORD32+r8  ; I2
 	vpclmulqdq	xmm0,xmm14,xmm6,0x00
 	vpshufb	xmm15,xmm15,xmm13
 	vpxor	xmm0,xmm0,xmm3
 	vpclmulqdq	xmm1,xmm14,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((112-64))+rdx
+	vmovdqu	xmm6,XMMWORD((112-64))+rdx  ; %xmm6^6
 	vpunpckhqdq	xmm8,xmm15,xmm15
 	vpxor	xmm1,xmm1,xmm4
 	vpclmulqdq	xmm2,xmm9,xmm7,0x00
@@ -1005,13 +1005,13 @@
 	vpxor	xmm2,xmm2,xmm5
 	vxorps	xmm10,xmm10,xmm12
 
-	vmovdqu	xmm14,XMMWORD16+r8
-	vpalignr	xmm12,xmm10,xmm10,8
+	vmovdqu	xmm14,XMMWORD16+r8  ; I1
+	vpalignr	xmm12,xmm10,xmm10,8  ; 2nd phase
 	vpclmulqdq	xmm3,xmm15,xmm6,0x00
 	vpshufb	xmm14,xmm14,xmm13
 	vpxor	xmm3,xmm3,xmm0
 	vpclmulqdq	xmm4,xmm15,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((144-64))+rdx
+	vmovdqu	xmm6,XMMWORD((144-64))+rdx  ; %xmm6^7
 	vpclmulqdq	xmm10,xmm10,XMMWORDr10,0x10
 	vxorps	xmm12,xmm12,xmm11
 	vpunpckhqdq	xmm9,xmm14,xmm14
@@ -1021,14 +1021,14 @@
 	vpxor	xmm9,xmm9,xmm14
 	vpxor	xmm5,xmm5,xmm2
 
-	vmovdqu	xmm15,XMMWORDr8
+	vmovdqu	xmm15,XMMWORDr8  ; I0
 	vpclmulqdq	xmm0,xmm14,xmm6,0x00
 	vpshufb	xmm15,xmm15,xmm13
 	vpclmulqdq	xmm1,xmm14,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((160-64))+rdx
+	vmovdqu	xmm6,XMMWORD((160-64))+rdx  ; %xmm6^8
 	vpxor	xmm15,xmm15,xmm12
 	vpclmulqdq	xmm2,xmm9,xmm7,0x10
-	vpxor	xmm15,xmm15,xmm10
+	vpxor	xmm15,xmm15,xmm10  ; accumulate %xmm10
 
 	lea	r8,128+r8
 	sub	r9,0x80
@@ -1039,15 +1039,15 @@
 
 ALIGN	32
 $L$short_avx:
-	vmovdqu	xmm14,XMMWORD((-16))+r9*1+r8
+	vmovdqu	xmm14,XMMWORD((-16))+r9*1+r8  ; very last word
 	lea	r8,r9*1+r8
-	vmovdqu	xmm6,XMMWORD((0-64))+rdx
+	vmovdqu	xmm6,XMMWORD((0-64))+rdx  ; %xmm6^1
 	vmovdqu	xmm7,XMMWORD((32-64))+rdx
 	vpshufb	xmm15,xmm14,xmm13
 
-	vmovdqa	xmm3,xmm0
-	vmovdqa	xmm4,xmm1
-	vmovdqa	xmm5,xmm2
+	vmovdqa	xmm3,xmm0  ; subtle way to zero %xmm3,
+	vmovdqa	xmm4,xmm1  ; %xmm4 and
+	vmovdqa	xmm5,xmm2  ; %xmm5
 	sub	r9,0x10
 	jz	NEAR $L$tail_avx
 
@@ -1058,7 +1058,7 @@
 	vmovdqu	xmm14,XMMWORD((-32))+r8
 	vpxor	xmm4,xmm4,xmm1
 	vpclmulqdq	xmm1,xmm15,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((16-64))+rdx
+	vmovdqu	xmm6,XMMWORD((16-64))+rdx  ; %xmm6^2
 	vpshufb	xmm15,xmm14,xmm13
 	vpxor	xmm5,xmm5,xmm2
 	vpclmulqdq	xmm2,xmm8,xmm7,0x00
@@ -1073,7 +1073,7 @@
 	vmovdqu	xmm14,XMMWORD((-48))+r8
 	vpxor	xmm4,xmm4,xmm1
 	vpclmulqdq	xmm1,xmm15,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((48-64))+rdx
+	vmovdqu	xmm6,XMMWORD((48-64))+rdx  ; %xmm6^3
 	vpshufb	xmm15,xmm14,xmm13
 	vpxor	xmm5,xmm5,xmm2
 	vpclmulqdq	xmm2,xmm8,xmm7,0x00
@@ -1088,7 +1088,7 @@
 	vmovdqu	xmm14,XMMWORD((-64))+r8
 	vpxor	xmm4,xmm4,xmm1
 	vpclmulqdq	xmm1,xmm15,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((64-64))+rdx
+	vmovdqu	xmm6,XMMWORD((64-64))+rdx  ; %xmm6^4
 	vpshufb	xmm15,xmm14,xmm13
 	vpxor	xmm5,xmm5,xmm2
 	vpclmulqdq	xmm2,xmm8,xmm7,0x00
@@ -1103,7 +1103,7 @@
 	vmovdqu	xmm14,XMMWORD((-80))+r8
 	vpxor	xmm4,xmm4,xmm1
 	vpclmulqdq	xmm1,xmm15,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((96-64))+rdx
+	vmovdqu	xmm6,XMMWORD((96-64))+rdx  ; %xmm6^5
 	vpshufb	xmm15,xmm14,xmm13
 	vpxor	xmm5,xmm5,xmm2
 	vpclmulqdq	xmm2,xmm8,xmm7,0x00
@@ -1118,7 +1118,7 @@
 	vmovdqu	xmm14,XMMWORD((-96))+r8
 	vpxor	xmm4,xmm4,xmm1
 	vpclmulqdq	xmm1,xmm15,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((112-64))+rdx
+	vmovdqu	xmm6,XMMWORD((112-64))+rdx  ; %xmm6^6
 	vpshufb	xmm15,xmm14,xmm13
 	vpxor	xmm5,xmm5,xmm2
 	vpclmulqdq	xmm2,xmm8,xmm7,0x00
@@ -1133,7 +1133,7 @@
 	vmovdqu	xmm14,XMMWORD((-112))+r8
 	vpxor	xmm4,xmm4,xmm1
 	vpclmulqdq	xmm1,xmm15,xmm6,0x11
-	vmovdqu	xmm6,XMMWORD((144-64))+rdx
+	vmovdqu	xmm6,XMMWORD((144-64))+rdx  ; %xmm6^7
 	vpshufb	xmm15,xmm14,xmm13
 	vpxor	xmm5,xmm5,xmm2
 	vpclmulqdq	xmm2,xmm8,xmm7,0x00
@@ -1143,7 +1143,7 @@
 
 ALIGN	32
 $L$tail_avx:
-	vpxor	xmm15,xmm15,xmm10
+	vpxor	xmm15,xmm15,xmm10  ; accumulate %xmm10
 $L$tail_no_xor_avx:
 	vpunpckhqdq	xmm8,xmm15,xmm15
 	vpxor	xmm3,xmm3,xmm0
@@ -1160,18 +1160,18 @@
 	vpxor	xmm11,xmm4,xmm1
 	vpxor	xmm5,xmm5,xmm2
 
-	vpxor	xmm5,xmm5,xmm10
+	vpxor	xmm5,xmm5,xmm10  ; aggregated Karatsuba post-processing
 	vpxor	xmm5,xmm5,xmm11
 	vpslldq	xmm9,xmm5,8
 	vpsrldq	xmm5,xmm5,8
 	vpxor	xmm10,xmm10,xmm9
 	vpxor	xmm11,xmm11,xmm5
 
-	vpclmulqdq	xmm9,xmm10,xmm12,0x10
+	vpclmulqdq	xmm9,xmm10,xmm12,0x10  ; 1st phase
 	vpalignr	xmm10,xmm10,xmm10,8
 	vpxor	xmm10,xmm10,xmm9
 
-	vpclmulqdq	xmm9,xmm10,xmm12,0x10
+	vpclmulqdq	xmm9,xmm10,xmm12,0x10  ; 2nd phase
 	vpalignr	xmm10,xmm10,xmm10,8
 	vpxor	xmm10,xmm10,xmm11
 	vpxor	xmm10,xmm10,xmm9
@@ -1214,7 +1214,7 @@
 	DB	60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111
 	DB	114,103,62,0
 ALIGN	64
-section	.text
+section	.text code align=64
 
 section	.pdata rdata align=4
 ALIGN	4
@@ -1238,7 +1238,7 @@
 section	.xdata rdata align=8
 ALIGN	4
 $L$SEH_info_gcm_init_clmul_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_gcm_init_clmul_4-$L$SEH_begin_gcm_init_clmul_1
 	DB	3
 	DB	0
@@ -1250,7 +1250,7 @@
 
 	DW	0
 $L$SEH_info_gcm_ghash_clmul_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_gcm_ghash_clmul_13-$L$SEH_begin_gcm_ghash_clmul_1
 	DB	22
 	DB	0
@@ -1289,7 +1289,7 @@
 	DW	21
 
 $L$SEH_info_gcm_init_avx_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_gcm_init_avx_4-$L$SEH_begin_gcm_init_avx_1
 	DB	3
 	DB	0
@@ -1301,7 +1301,7 @@
 
 	DW	0
 $L$SEH_info_gcm_ghash_avx_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_gcm_ghash_avx_13-$L$SEH_begin_gcm_ghash_avx_1
 	DB	22
 	DB	0

boringssl-0.20260708.tar.xz/gen/bcm/p256-x86_64-asm-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/p256-x86_64-asm-apple.S Changed

@@ -6,7 +6,7 @@
 #if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && defined(__APPLE__)
 .text	
 
-
+// The polynomial
 .section	__DATA,__const
 .p2align	6
 p256_constants:
@@ -22,15 +22,15 @@
 L$ONE_mont:
 .quad	0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe
 
-
+// Constants for computations modulo ord(p256)
 L$ord:
 .quad	0xf3b9cac2fc632551, 0xbce6faada7179e84, 0xffffffffffffffff, 0xffffffff00000000
 L$ordK:
 .quad	0xccd1c8aaee00bc4f
 .text	
 
-
-
+// ############################################################################## 
+// void ecp_nistz256_neg(uint64_t res4, uint64_t a4);
 .globl	_ecp_nistz256_neg
 .private_extern _ecp_nistz256_neg
 
@@ -86,11 +86,11 @@
 	ret
 
 
-
-
-
-
-
+// ############################################################################## 
+// void ecp_nistz256_ord_mul_mont(
+// uint64_t res4,
+// uint64_t a4,
+// uint64_t b4);
 
 .globl	_ecp_nistz256_ord_mul_mont_nohw
 .private_extern _ecp_nistz256_ord_mul_mont_nohw
@@ -119,7 +119,7 @@
 	leaq	L$ord(%rip),%r14
 	movq	L$ordK(%rip),%r15
 
-
+// ################################ * b0
 	movq	%rax,%rcx
 	mulq	0(%rsi)
 	movq	%rax,%r8
@@ -147,16 +147,16 @@
 	adcq	$0,%rdx
 	movq	%rdx,%r12
 
-
+// ################################ First reduction step
 	mulq	0(%r14)
 	movq	%r8,%rbp
-	addq	%rax,%r13
+	addq	%rax,%r13  // guaranteed to be zero
 	movq	%r8,%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rcx
 
 	subq	%r8,%r10
-	sbbq	$0,%r8
+	sbbq	$0,%r8  // can't borrow
 
 	mulq	8(%r14)
 	addq	%rcx,%r9
@@ -165,19 +165,19 @@
 	movq	%rbp,%rax
 	adcq	%rdx,%r10
 	movq	%rbp,%rdx
-	adcq	$0,%r8
+	adcq	$0,%r8  // can't overflow
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r11
 	movq	8(%rbx),%rax
-	sbbq	%rdx,%rbp
+	sbbq	%rdx,%rbp  // can't borrow
 
 	addq	%r8,%r11
 	adcq	%rbp,%r12
 	adcq	$0,%r13
 
-
+// ################################ * b1
 	movq	%rax,%rcx
 	mulq	0(%rsi)
 	addq	%rax,%r9
@@ -213,15 +213,15 @@
 	adcq	%rdx,%r13
 	adcq	$0,%r8
 
-
+// ################################ Second reduction step
 	mulq	0(%r14)
 	movq	%r9,%rbp
-	addq	%rax,%rcx
+	addq	%rax,%rcx  // guaranteed to be zero
 	movq	%r9,%rax
 	adcq	%rdx,%rcx
 
 	subq	%r9,%r11
-	sbbq	$0,%r9
+	sbbq	$0,%r9  // can't borrow
 
 	mulq	8(%r14)
 	addq	%rcx,%r10
@@ -230,19 +230,19 @@
 	movq	%rbp,%rax
 	adcq	%rdx,%r11
 	movq	%rbp,%rdx
-	adcq	$0,%r9
+	adcq	$0,%r9  // can't overflow
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r12
 	movq	16(%rbx),%rax
-	sbbq	%rdx,%rbp
+	sbbq	%rdx,%rbp  // can't borrow
 
 	addq	%r9,%r12
 	adcq	%rbp,%r13
 	adcq	$0,%r8
 
-
+// ################################# * b2
 	movq	%rax,%rcx
 	mulq	0(%rsi)
 	addq	%rax,%r10
@@ -278,15 +278,15 @@
 	adcq	%rdx,%r8
 	adcq	$0,%r9
 
-
+// ################################ Third reduction step
 	mulq	0(%r14)
 	movq	%r10,%rbp
-	addq	%rax,%rcx
+	addq	%rax,%rcx  // guaranteed to be zero
 	movq	%r10,%rax
 	adcq	%rdx,%rcx
 
 	subq	%r10,%r12
-	sbbq	$0,%r10
+	sbbq	$0,%r10  // can't borrow
 
 	mulq	8(%r14)
 	addq	%rcx,%r11
@@ -295,19 +295,19 @@
 	movq	%rbp,%rax
 	adcq	%rdx,%r12
 	movq	%rbp,%rdx
-	adcq	$0,%r10
+	adcq	$0,%r10  // can't overflow
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r13
 	movq	24(%rbx),%rax
-	sbbq	%rdx,%rbp
+	sbbq	%rdx,%rbp  // can't borrow
 
 	addq	%r10,%r13
 	adcq	%rbp,%r8
 	adcq	$0,%r9
 
-
+// ################################ * b3
 	movq	%rax,%rcx
 	mulq	0(%rsi)
 	addq	%rax,%r11
@@ -343,15 +343,15 @@
 	adcq	%rdx,%r9
 	adcq	$0,%r10
 
-
+// ################################ Last reduction step
 	mulq	0(%r14)
 	movq	%r11,%rbp
-	addq	%rax,%rcx
+	addq	%rax,%rcx  // guaranteed to be zero
 	movq	%r11,%rax
 	adcq	%rdx,%rcx
 
 	subq	%r11,%r13
-	sbbq	$0,%r11
+	sbbq	$0,%r11  // can't borrow
 
 	mulq	8(%r14)
 	addq	%rcx,%r12
@@ -360,18 +360,18 @@
 	movq	%rbp,%rax
 	adcq	%rdx,%r13
 	movq	%rbp,%rdx
-	adcq	$0,%r11
+	adcq	$0,%r11  // can't overflow
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r8
-	sbbq	%rdx,%rbp
+	sbbq	%rdx,%rbp  // can't borrow
 
 	addq	%r11,%r8
 	adcq	%rbp,%r9
 	adcq	$0,%r10
 
-
+// ################################ Subtract ord
 	movq	%r12,%rsi
 	subq	0(%r14),%r12
 	movq	%r13,%r11
@@ -411,11 +411,11 @@
 
 
 
-
-
-
-
-
+// ############################################################################## 
+// void ecp_nistz256_ord_sqr_mont(
+// uint64_t res4,
+// uint64_t a4,
+// uint64_t rep);
 
 .globl	_ecp_nistz256_ord_sqr_mont_nohw
 .private_extern _ecp_nistz256_ord_sqr_mont_nohw
@@ -443,56 +443,56 @@
 	movq	8(%rsi),%rax
 	movq	16(%rsi),%r14
 	movq	24(%rsi),%r15
-	leaq	L$ord(%rip),%rsi
+	leaq	L$ord(%rip),%rsi  // pointer to modulus
 	movq	%rdx,%rbx
 	jmp	L$oop_ord_sqr
 
 .p2align	5
 L$oop_ord_sqr:
-
-	movq	%rax,%rbp
-	mulq	%r8
+// ################################ a1: * a0
+	movq	%rax,%rbp  // put aside a1
+	mulq	%r8  // a1 * a0
 	movq	%rax,%r9
-	movq	%rbp,%xmm1
+	movq	%rbp,%xmm1  // offload a1
 	movq	%r14,%rax
 	movq	%rdx,%r10
 
-	mulq	%r8
+	mulq	%r8  // a2 * a0
 	addq	%rax,%r10
 	movq	%r15,%rax
-	movq	%r14,%xmm2
+	movq	%r14,%xmm2  // offload a2
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%r8
+	mulq	%r8  // a3 * a0
 	addq	%rax,%r11
 	movq	%r15,%rax
-	movq	%r15,%xmm3
+	movq	%r15,%xmm3  // offload a3
 	adcq	$0,%rdx
 	movq	%rdx,%r12
 
-
-	mulq	%r14
+// ################################ a3 * a2
+	mulq	%r14  // a3 * a2
 	movq	%rax,%r13
 	movq	%r14,%rax
 	movq	%rdx,%r14
 
-
-	mulq	%rbp
+// ################################ a2: * a1
+	mulq	%rbp  // a2 * a1
 	addq	%rax,%r11
 	movq	%r15,%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r15
 
-	mulq	%rbp
+	mulq	%rbp  // a3 * a1
 	addq	%rax,%r12
 	adcq	$0,%rdx
 
 	addq	%r15,%r12
 	adcq	%rdx,%r13
-	adcq	$0,%r14
-
+	adcq	$0,%r14  // can't overflow
 
+// ################################ *2
 	xorq	%r15,%r15
 	movq	%r8,%rax
 	addq	%r9,%r9
@@ -503,20 +503,20 @@
 	adcq	%r14,%r14
 	adcq	$0,%r15
 
-
-	mulq	%rax
+// ################################ Missing products
+	mulq	%rax  // a0 * a0
 	movq	%rax,%r8
 	movq	%xmm1,%rax
 	movq	%rdx,%rbp
 
-	mulq	%rax
+	mulq	%rax  // a1 * a1
 	addq	%rbp,%r9
 	adcq	%rax,%r10
 	movq	%xmm2,%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rbp
 
-	mulq	%rax
+	mulq	%rax  // a2 * a2
 	addq	%rbp,%r11
 	adcq	%rax,%r12
 	movq	%xmm3,%rax
@@ -524,23 +524,23 @@
 	movq	%rdx,%rbp
 
 	movq	%r8,%rcx
-	imulq	32(%rsi),%r8
+	imulq	32(%rsi),%r8  // *= .LordK
 
-	mulq	%rax
+	mulq	%rax  // a3 * a3
 	addq	%rbp,%r13
 	adcq	%rax,%r14
-	movq	0(%rsi),%rax
-	adcq	%rdx,%r15
-
+	movq	0(%rsi),%rax  // modulus0
+	adcq	%rdx,%r15  // can't overflow
 
+// ################################ First reduction step
 	mulq	%r8
 	movq	%r8,%rbp
-	addq	%rax,%rcx
-	movq	8(%rsi),%rax
+	addq	%rax,%rcx  // guaranteed to be zero
+	movq	8(%rsi),%rax  // modulus1
 	adcq	%rdx,%rcx
 
 	subq	%r8,%r10
-	sbbq	$0,%rbp
+	sbbq	$0,%rbp  // can't borrow
 
 	mulq	%r8
 	addq	%rcx,%r9
@@ -549,29 +549,29 @@
 	movq	%r8,%rax
 	adcq	%rdx,%r10
 	movq	%r8,%rdx
-	adcq	$0,%rbp
+	adcq	$0,%rbp  // can't overflow
 
 	movq	%r9,%rcx
-	imulq	32(%rsi),%r9
+	imulq	32(%rsi),%r9  // *= .LordK
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r11
 	movq	0(%rsi),%rax
-	sbbq	%rdx,%r8
+	sbbq	%rdx,%r8  // can't borrow
 
 	addq	%rbp,%r11
-	adcq	$0,%r8
-
+	adcq	$0,%r8  // can't overflow
 
+// ################################ Second reduction step
 	mulq	%r9
 	movq	%r9,%rbp
-	addq	%rax,%rcx
+	addq	%rax,%rcx  // guaranteed to be zero
 	movq	8(%rsi),%rax
 	adcq	%rdx,%rcx
 
 	subq	%r9,%r11
-	sbbq	$0,%rbp
+	sbbq	$0,%rbp  // can't borrow
 
 	mulq	%r9
 	addq	%rcx,%r10
@@ -580,29 +580,29 @@
 	movq	%r9,%rax
 	adcq	%rdx,%r11
 	movq	%r9,%rdx
-	adcq	$0,%rbp
+	adcq	$0,%rbp  // can't overflow
 
 	movq	%r10,%rcx
-	imulq	32(%rsi),%r10
+	imulq	32(%rsi),%r10  // *= .LordK
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r8
 	movq	0(%rsi),%rax
-	sbbq	%rdx,%r9
+	sbbq	%rdx,%r9  // can't borrow
 
 	addq	%rbp,%r8
-	adcq	$0,%r9
-
+	adcq	$0,%r9  // can't overflow
 
+// ################################ Third reduction step
 	mulq	%r10
 	movq	%r10,%rbp
-	addq	%rax,%rcx
+	addq	%rax,%rcx  // guaranteed to be zero
 	movq	8(%rsi),%rax
 	adcq	%rdx,%rcx
 
 	subq	%r10,%r8
-	sbbq	$0,%rbp
+	sbbq	$0,%rbp  // can't borrow
 
 	mulq	%r10
 	addq	%rcx,%r11
@@ -611,29 +611,29 @@
 	movq	%r10,%rax
 	adcq	%rdx,%r8
 	movq	%r10,%rdx
-	adcq	$0,%rbp
+	adcq	$0,%rbp  // can't overflow
 
 	movq	%r11,%rcx
-	imulq	32(%rsi),%r11
+	imulq	32(%rsi),%r11  // *= .LordK
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r9
 	movq	0(%rsi),%rax
-	sbbq	%rdx,%r10
+	sbbq	%rdx,%r10  // can't borrow
 
 	addq	%rbp,%r9
-	adcq	$0,%r10
-
+	adcq	$0,%r10  // can't overflow
 
+// ################################ Last reduction step
 	mulq	%r11
 	movq	%r11,%rbp
-	addq	%rax,%rcx
+	addq	%rax,%rcx  // guaranteed to be zero
 	movq	8(%rsi),%rax
 	adcq	%rdx,%rcx
 
 	subq	%r11,%r9
-	sbbq	$0,%rbp
+	sbbq	$0,%rbp  // can't borrow
 
 	mulq	%r11
 	addq	%rcx,%r8
@@ -642,17 +642,17 @@
 	movq	%r11,%rax
 	adcq	%rdx,%r9
 	movq	%r11,%rdx
-	adcq	$0,%rbp
+	adcq	$0,%rbp  // can't overflow
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r10
-	sbbq	%rdx,%r11
+	sbbq	%rdx,%r11  // can't borrow
 
 	addq	%rbp,%r10
-	adcq	$0,%r11
-
+	adcq	$0,%r11  // can't overflow
 
+// ################################ Add bits 511:256 of the sqr result
 	xorq	%rdx,%rdx
 	addq	%r12,%r8
 	adcq	%r13,%r9
@@ -662,7 +662,7 @@
 	movq	%r9,%rax
 	adcq	$0,%rdx
 
-
+// ################################ Compare to modulus
 	subq	0(%rsi),%r8
 	movq	%r10,%r14
 	sbbq	8(%rsi),%r9
@@ -705,7 +705,7 @@
 	ret
 
 
-
+// ############################################################################## 
 .globl	_ecp_nistz256_ord_mul_mont_adx
 .private_extern _ecp_nistz256_ord_mul_mont_adx
 
@@ -735,11 +735,11 @@
 	movq	8(%rsi),%r10
 	movq	16(%rsi),%r11
 	movq	24(%rsi),%r12
-	leaq	-128(%rsi),%rsi
+	leaq	-128(%rsi),%rsi  // control u-op density
 	leaq	L$ord-128(%rip),%r14
 	movq	L$ordK(%rip),%r15
 
-
+// ################################ Multiply by b0
 	mulxq	%r9,%r8,%r9
 	mulxq	%r10,%rcx,%r10
 	mulxq	%r11,%rbp,%r11
@@ -751,10 +751,10 @@
 	adcq	%rcx,%r11
 	adcq	$0,%r12
 
-
-	xorq	%r13,%r13
+// ################################ reduction
+	xorq	%r13,%r13  // %r13=0, cf=0, of=0
 	mulxq	0+128(%r14),%rcx,%rbp
-	adcxq	%rcx,%r8
+	adcxq	%rcx,%r8  // guaranteed to be zero
 	adoxq	%rbp,%r9
 
 	mulxq	8+128(%r14),%rcx,%rbp
@@ -771,9 +771,9 @@
 	adoxq	%rbp,%r12
 	adcxq	%r8,%r12
 	adoxq	%r8,%r13
-	adcq	$0,%r13
-
+	adcq	$0,%r13  // cf=0, of=0
 
+// ################################ Multiply by b1
 	mulxq	0+128(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r9
 	adoxq	%rbp,%r10
@@ -794,11 +794,11 @@
 
 	adcxq	%r8,%r13
 	adoxq	%r8,%r8
-	adcq	$0,%r8
-
+	adcq	$0,%r8  // cf=0, of=0
 
+// ################################ reduction
 	mulxq	0+128(%r14),%rcx,%rbp
-	adcxq	%rcx,%r9
+	adcxq	%rcx,%r9  // guaranteed to be zero
 	adoxq	%rbp,%r10
 
 	mulxq	8+128(%r14),%rcx,%rbp
@@ -815,9 +815,9 @@
 	adoxq	%rbp,%r13
 	adcxq	%r9,%r13
 	adoxq	%r9,%r8
-	adcq	$0,%r8
-
+	adcq	$0,%r8  // cf=0, of=0
 
+// ################################ Multiply by b2
 	mulxq	0+128(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r10
 	adoxq	%rbp,%r11
@@ -838,11 +838,11 @@
 
 	adcxq	%r9,%r8
 	adoxq	%r9,%r9
-	adcq	$0,%r9
-
+	adcq	$0,%r9  // cf=0, of=0
 
+// ################################ reduction
 	mulxq	0+128(%r14),%rcx,%rbp
-	adcxq	%rcx,%r10
+	adcxq	%rcx,%r10  // guaranteed to be zero
 	adoxq	%rbp,%r11
 
 	mulxq	8+128(%r14),%rcx,%rbp
@@ -859,9 +859,9 @@
 	adoxq	%rbp,%r8
 	adcxq	%r10,%r8
 	adoxq	%r10,%r9
-	adcq	$0,%r9
-
+	adcq	$0,%r9  // cf=0, of=0
 
+// ################################ Multiply by b3
 	mulxq	0+128(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r11
 	adoxq	%rbp,%r12
@@ -882,11 +882,11 @@
 
 	adcxq	%r10,%r9
 	adoxq	%r10,%r10
-	adcq	$0,%r10
-
+	adcq	$0,%r10  // cf=0, of=0
 
+// ################################ reduction
 	mulxq	0+128(%r14),%rcx,%rbp
-	adcxq	%rcx,%r11
+	adcxq	%rcx,%r11  // guaranteed to be zero
 	adoxq	%rbp,%r12
 
 	mulxq	8+128(%r14),%rcx,%rbp
@@ -907,8 +907,8 @@
 	adoxq	%r11,%r10
 	adcq	$0,%r10
 
-
-
+// ################################
+// Branch-less conditional subtraction of P
 	movq	%r8,%rcx
 	subq	0(%r14),%r12
 	sbbq	8(%r14),%r13
@@ -979,38 +979,38 @@
 
 .p2align	5
 L$oop_ord_sqrx:
-	mulxq	%r14,%r9,%r10
-	mulxq	%r15,%rcx,%r11
-	movq	%rdx,%rax
-	movq	%r14,%xmm1
-	mulxq	%r8,%rbp,%r12
+	mulxq	%r14,%r9,%r10  // a0*a1
+	mulxq	%r15,%rcx,%r11  // a0*a2
+	movq	%rdx,%rax  // offload a0
+	movq	%r14,%xmm1  // offload a1
+	mulxq	%r8,%rbp,%r12  // a0*a3
 	movq	%r14,%rdx
 	addq	%rcx,%r10
-	movq	%r15,%xmm2
+	movq	%r15,%xmm2  // offload a2
 	adcq	%rbp,%r11
 	adcq	$0,%r12
-	xorq	%r13,%r13
-
-	mulxq	%r15,%rcx,%rbp
+	xorq	%r13,%r13  // %r13=0,cf=0,of=0
+// ################################
+	mulxq	%r15,%rcx,%rbp  // a1*a2
 	adcxq	%rcx,%r11
 	adoxq	%rbp,%r12
 
-	mulxq	%r8,%rcx,%rbp
+	mulxq	%r8,%rcx,%rbp  // a1*a3
 	movq	%r15,%rdx
 	adcxq	%rcx,%r12
 	adoxq	%rbp,%r13
 	adcq	$0,%r13
-
-	mulxq	%r8,%rcx,%r14
+// ################################
+	mulxq	%r8,%rcx,%r14  // a2*a3
 	movq	%rax,%rdx
-	movq	%r8,%xmm3
-	xorq	%r15,%r15
-	adcxq	%r9,%r9
+	movq	%r8,%xmm3  // offload a3
+	xorq	%r15,%r15  // %r15=0,cf=0,of=0
+	adcxq	%r9,%r9  // acc1:6<<1
 	adoxq	%rcx,%r13
 	adcxq	%r10,%r10
-	adoxq	%r15,%r14
-
+	adoxq	%r15,%r14  // of=0
 
+// ################################ ai*ai
 	mulxq	%rdx,%r8,%rbp
 	movq	%xmm1,%rdx
 	adcxq	%r11,%r11
@@ -1032,13 +1032,13 @@
 	adoxq	%rcx,%r14
 	adoxq	%rax,%r15
 
-
+// ################################ reduction
 	movq	%r8,%rdx
 	mulxq	32(%rsi),%rdx,%rcx
 
-	xorq	%rax,%rax
+	xorq	%rax,%rax  // cf=0, of=0
 	mulxq	0(%rsi),%rcx,%rbp
-	adcxq	%rcx,%r8
+	adcxq	%rcx,%r8  // guaranteed to be zero
 	adoxq	%rbp,%r9
 	mulxq	8(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r9
@@ -1048,15 +1048,15 @@
 	adoxq	%rbp,%r11
 	mulxq	24(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r11
-	adoxq	%rbp,%r8
-	adcxq	%rax,%r8
-
+	adoxq	%rbp,%r8  // of=0
+	adcxq	%rax,%r8  // cf=0
 
+// ################################
 	movq	%r9,%rdx
 	mulxq	32(%rsi),%rdx,%rcx
 
 	mulxq	0(%rsi),%rcx,%rbp
-	adoxq	%rcx,%r9
+	adoxq	%rcx,%r9  // guaranteed to be zero
 	adcxq	%rbp,%r10
 	mulxq	8(%rsi),%rcx,%rbp
 	adoxq	%rcx,%r10
@@ -1066,15 +1066,15 @@
 	adcxq	%rbp,%r8
 	mulxq	24(%rsi),%rcx,%rbp
 	adoxq	%rcx,%r8
-	adcxq	%rbp,%r9
-	adoxq	%rax,%r9
-
+	adcxq	%rbp,%r9  // cf=0
+	adoxq	%rax,%r9  // of=0
 
+// ################################
 	movq	%r10,%rdx
 	mulxq	32(%rsi),%rdx,%rcx
 
 	mulxq	0(%rsi),%rcx,%rbp
-	adcxq	%rcx,%r10
+	adcxq	%rcx,%r10  // guaranteed to be zero
 	adoxq	%rbp,%r11
 	mulxq	8(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r11
@@ -1084,15 +1084,15 @@
 	adoxq	%rbp,%r9
 	mulxq	24(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r9
-	adoxq	%rbp,%r10
-	adcxq	%rax,%r10
-
+	adoxq	%rbp,%r10  // of=0
+	adcxq	%rax,%r10  // cf=0
 
+// ################################
 	movq	%r11,%rdx
 	mulxq	32(%rsi),%rdx,%rcx
 
 	mulxq	0(%rsi),%rcx,%rbp
-	adoxq	%rcx,%r11
+	adoxq	%rcx,%r11  // guaranteed to be zero
 	adcxq	%rbp,%r8
 	mulxq	8(%rsi),%rcx,%rbp
 	adoxq	%rcx,%r8
@@ -1105,8 +1105,8 @@
 	adcxq	%rbp,%r11
 	adoxq	%rax,%r11
 
-
-	addq	%r8,%r12
+// ################################ accumulate upper half
+	addq	%r8,%r12  // add	%r12, %r8
 	adcq	%r13,%r9
 	movq	%r12,%rdx
 	adcq	%r14,%r10
@@ -1114,7 +1114,7 @@
 	movq	%r9,%r14
 	adcq	$0,%rax
 
-
+// ################################ compare to modulus
 	subq	0(%rsi),%r12
 	movq	%r10,%r15
 	sbbq	8(%rsi),%r9
@@ -1157,11 +1157,11 @@
 	ret
 
 
-
-
-
-
-
+// ############################################################################## 
+// void ecp_nistz256_mul_mont(
+// uint64_t res4,
+// uint64_t a4,
+// uint64_t b4);
 
 .globl	_ecp_nistz256_mul_mont_nohw
 .private_extern _ecp_nistz256_mul_mont_nohw
@@ -1217,8 +1217,8 @@
 .alt_entry __ecp_nistz256_mul_montq
 __ecp_nistz256_mul_montq:
 
-
-
+// #######################################################################
+// Multiply a by b0
 	movq	%rax,%rbp
 	mulq	%r9
 	movq	L$poly+8(%rip),%r14
@@ -1246,20 +1246,20 @@
 	xorq	%r13,%r13
 	movq	%rdx,%r12
 
-
-
-
-
-
-
-
-
+// #######################################################################
+// First reduction step
+// Basically now we want to multiply acc0 by p256,
+// and add the result to the acc.
+// Due to the special form of p256 we do some optimizations
+// 
+// acc0 x p2560..1 = acc0 x 2^96 - acc0
+// then we add acc0 and get acc0 x 2^96
 
 	movq	%r8,%rbp
 	shlq	$32,%r8
 	mulq	%r15
 	shrq	$32,%rbp
-	addq	%r8,%r9
+	addq	%r8,%r9  // +=acc0<<96
 	adcq	%rbp,%r10
 	adcq	%rax,%r11
 	movq	8(%rbx),%rax
@@ -1267,8 +1267,8 @@
 	adcq	$0,%r13
 	xorq	%r8,%r8
 
-
-
+// #######################################################################
+// Multiply by b1
 	movq	%rax,%rbp
 	mulq	0(%rsi)
 	addq	%rax,%r9
@@ -1300,8 +1300,8 @@
 	adcq	%rdx,%r13
 	adcq	$0,%r8
 
-
-
+// #######################################################################
+// Second reduction step
 	movq	%r9,%rbp
 	shlq	$32,%r9
 	mulq	%r15
@@ -1314,8 +1314,8 @@
 	adcq	$0,%r8
 	xorq	%r9,%r9
 
-
-
+// #######################################################################
+// Multiply by b2
 	movq	%rax,%rbp
 	mulq	0(%rsi)
 	addq	%rax,%r10
@@ -1347,8 +1347,8 @@
 	adcq	%rdx,%r8
 	adcq	$0,%r9
 
-
-
+// #######################################################################
+// Third reduction step
 	movq	%r10,%rbp
 	shlq	$32,%r10
 	mulq	%r15
@@ -1361,8 +1361,8 @@
 	adcq	$0,%r9
 	xorq	%r10,%r10
 
-
-
+// #######################################################################
+// Multiply by b3
 	movq	%rax,%rbp
 	mulq	0(%rsi)
 	addq	%rax,%r11
@@ -1394,8 +1394,8 @@
 	adcq	%rdx,%r9
 	adcq	$0,%r10
 
-
-
+// #######################################################################
+// Final reduction step
 	movq	%r11,%rbp
 	shlq	$32,%r11
 	mulq	%r15
@@ -1408,14 +1408,14 @@
 	movq	%r13,%rbp
 	adcq	$0,%r10
 
-
-
-	subq	$-1,%r12
+// #######################################################################
+// Branch-less conditional subtraction of P
+	subq	$-1,%r12  // .Lpoly0
 	movq	%r8,%rbx
-	sbbq	%r14,%r13
-	sbbq	$0,%r8
+	sbbq	%r14,%r13  // .Lpoly1
+	sbbq	$0,%r8  // .Lpoly2
 	movq	%r9,%rdx
-	sbbq	%r15,%r9
+	sbbq	%r15,%r9  // .Lpoly3
 	sbbq	$0,%r10
 
 	cmovcq	%rcx,%r12
@@ -1431,13 +1431,13 @@
 
 
 
+// ############################################################################## 
+// void ecp_nistz256_sqr_mont(
+// uint64_t res4,
+// uint64_t a4);
 
-
-
-
-
-
-
+// we optimize the square according to S.Gueron and V.Krasnov,
+// "Speeding up Big-Number Squaring"
 .globl	_ecp_nistz256_sqr_mont_nohw
 .private_extern _ecp_nistz256_sqr_mont_nohw
 
@@ -1491,31 +1491,31 @@
 __ecp_nistz256_sqr_montq:
 
 	movq	%rax,%r13
-	mulq	%r14
+	mulq	%r14  // a1*a0
 	movq	%rax,%r9
 	movq	%r15,%rax
 	movq	%rdx,%r10
 
-	mulq	%r13
+	mulq	%r13  // a0*a2
 	addq	%rax,%r10
 	movq	%r8,%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%r13
+	mulq	%r13  // a0*a3
 	addq	%rax,%r11
 	movq	%r15,%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r12
 
-
-	mulq	%r14
+// ################################
+	mulq	%r14  // a1*a2
 	addq	%rax,%r11
 	movq	%r8,%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rbp
 
-	mulq	%r14
+	mulq	%r14  // a1*a3
 	addq	%rax,%r12
 	movq	%r8,%rax
 	adcq	$0,%rdx
@@ -1523,15 +1523,15 @@
 	movq	%rdx,%r13
 	adcq	$0,%r13
 
-
-	mulq	%r15
+// ################################
+	mulq	%r15  // a2*a3
 	xorq	%r15,%r15
 	addq	%rax,%r13
 	movq	0(%rsi),%rax
 	movq	%rdx,%r14
 	adcq	$0,%r14
 
-	addq	%r9,%r9
+	addq	%r9,%r9  // acc1:6<<1
 	adcq	%r10,%r10
 	adcq	%r11,%r11
 	adcq	%r12,%r12
@@ -1567,21 +1567,21 @@
 	movq	L$poly+8(%rip),%rsi
 	movq	L$poly+24(%rip),%rbp
 
-
-
-
+// #########################################
+// Now the reduction
+// First iteration
 	movq	%r8,%rcx
 	shlq	$32,%r8
 	mulq	%rbp
 	shrq	$32,%rcx
-	addq	%r8,%r9
+	addq	%r8,%r9  // +=acc0<<96
 	adcq	%rcx,%r10
 	adcq	%rax,%r11
 	movq	%r9,%rax
 	adcq	$0,%rdx
 
-
-
+// #########################################
+// Second iteration
 	movq	%r9,%rcx
 	shlq	$32,%r9
 	movq	%rdx,%r8
@@ -1593,8 +1593,8 @@
 	movq	%r10,%rax
 	adcq	$0,%rdx
 
-
-
+// #########################################
+// Third iteration
 	movq	%r10,%rcx
 	shlq	$32,%r10
 	movq	%rdx,%r9
@@ -1606,8 +1606,8 @@
 	movq	%r11,%rax
 	adcq	$0,%rdx
 
-
-
+// ##########################################
+// Last iteration
 	movq	%r11,%rcx
 	shlq	$32,%r11
 	movq	%rdx,%r10
@@ -1619,8 +1619,8 @@
 	adcq	$0,%rdx
 	xorq	%r11,%r11
 
-
-
+// ###########################################
+// Add the rest of the acc
 	addq	%r8,%r12
 	adcq	%r9,%r13
 	movq	%r12,%r8
@@ -1629,12 +1629,12 @@
 	movq	%r13,%r9
 	adcq	$0,%r11
 
-	subq	$-1,%r12
+	subq	$-1,%r12  // .Lpoly0
 	movq	%r14,%r10
-	sbbq	%rsi,%r13
-	sbbq	$0,%r14
+	sbbq	%rsi,%r13  // .Lpoly1
+	sbbq	$0,%r14  // .Lpoly2
 	movq	%r15,%rcx
-	sbbq	%rbp,%r15
+	sbbq	%rbp,%r15  // .Lpoly3
 	sbbq	$0,%r11
 
 	cmovcq	%r8,%r12
@@ -1676,7 +1676,7 @@
 	movq	8(%rsi),%r10
 	movq	16(%rsi),%r11
 	movq	24(%rsi),%r12
-	leaq	-128(%rsi),%rsi
+	leaq	-128(%rsi),%rsi  // control u-op density
 
 	call	__ecp_nistz256_mul_montx
 
@@ -1704,12 +1704,12 @@
 .alt_entry __ecp_nistz256_mul_montx
 __ecp_nistz256_mul_montx:
 
-
-
+// #######################################################################
+// Multiply by b0
 	mulxq	%r9,%r8,%r9
 	mulxq	%r10,%rcx,%r10
 	movq	$32,%r14
-	xorq	%r13,%r13
+	xorq	%r13,%r13  // cf=0
 	mulxq	%r11,%rbp,%r11
 	movq	L$poly+24(%rip),%r15
 	adcq	%rcx,%r9
@@ -1721,8 +1721,8 @@
 	shrxq	%r14,%r8,%rcx
 	adcq	$0,%r12
 
-
-
+// #######################################################################
+// First reduction step
 	addq	%rbp,%r9
 	adcq	%rcx,%r10
 
@@ -1731,10 +1731,10 @@
 	adcq	%rcx,%r11
 	adcq	%rbp,%r12
 	adcq	$0,%r13
-	xorq	%r8,%r8
-
-
+	xorq	%r8,%r8  // %r8=0,cf=0,of=0
 
+// #######################################################################
+// Multiply by b1
 	mulxq	0+128(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r9
 	adoxq	%rbp,%r10
@@ -1758,8 +1758,8 @@
 	adoxq	%r8,%r8
 	adcq	$0,%r8
 
-
-
+// #######################################################################
+// Second reduction step
 	addq	%rcx,%r10
 	adcq	%rbp,%r11
 
@@ -1768,10 +1768,10 @@
 	adcq	%rcx,%r12
 	adcq	%rbp,%r13
 	adcq	$0,%r8
-	xorq	%r9,%r9
-
-
+	xorq	%r9,%r9  // %r9=0,cf=0,of=0
 
+// #######################################################################
+// Multiply by b2
 	mulxq	0+128(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r10
 	adoxq	%rbp,%r11
@@ -1795,8 +1795,8 @@
 	adoxq	%r9,%r9
 	adcq	$0,%r9
 
-
-
+// #######################################################################
+// Third reduction step
 	addq	%rcx,%r11
 	adcq	%rbp,%r12
 
@@ -1805,10 +1805,10 @@
 	adcq	%rcx,%r13
 	adcq	%rbp,%r8
 	adcq	$0,%r9
-	xorq	%r10,%r10
-
-
+	xorq	%r10,%r10  // %r10=0,cf=0,of=0
 
+// #######################################################################
+// Multiply by b3
 	mulxq	0+128(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r11
 	adoxq	%rbp,%r12
@@ -1832,8 +1832,8 @@
 	adoxq	%r10,%r10
 	adcq	$0,%r10
 
-
-
+// #######################################################################
+// Fourth reduction step
 	addq	%rcx,%r12
 	adcq	%rbp,%r13
 
@@ -1845,15 +1845,15 @@
 	adcq	%rbp,%r9
 	adcq	$0,%r10
 
-
-
+// #######################################################################
+// Branch-less conditional subtraction of P
 	xorl	%eax,%eax
 	movq	%r8,%rcx
-	sbbq	$-1,%r12
-	sbbq	%r14,%r13
-	sbbq	$0,%r8
+	sbbq	$-1,%r12  // .Lpoly0
+	sbbq	%r14,%r13  // .Lpoly1
+	sbbq	$0,%r8  // .Lpoly2
 	movq	%r9,%rbp
-	sbbq	%r15,%r9
+	sbbq	%r15,%r9  // .Lpoly3
 	sbbq	$0,%r10
 
 	cmovcq	%rbx,%r12
@@ -1894,7 +1894,7 @@
 	movq	8(%rsi),%r14
 	movq	16(%rsi),%r15
 	movq	24(%rsi),%r8
-	leaq	-128(%rsi),%rsi
+	leaq	-128(%rsi),%rsi  // control u-op density
 
 	call	__ecp_nistz256_sqr_montx
 
@@ -1922,35 +1922,35 @@
 .alt_entry __ecp_nistz256_sqr_montx
 __ecp_nistz256_sqr_montx:
 
-	mulxq	%r14,%r9,%r10
-	mulxq	%r15,%rcx,%r11
+	mulxq	%r14,%r9,%r10  // a0*a1
+	mulxq	%r15,%rcx,%r11  // a0*a2
 	xorl	%eax,%eax
 	adcq	%rcx,%r10
-	mulxq	%r8,%rbp,%r12
+	mulxq	%r8,%rbp,%r12  // a0*a3
 	movq	%r14,%rdx
 	adcq	%rbp,%r11
 	adcq	$0,%r12
-	xorq	%r13,%r13
+	xorq	%r13,%r13  // %r13=0,cf=0,of=0
 
-
-	mulxq	%r15,%rcx,%rbp
+// ################################
+	mulxq	%r15,%rcx,%rbp  // a1*a2
 	adcxq	%rcx,%r11
 	adoxq	%rbp,%r12
 
-	mulxq	%r8,%rcx,%rbp
+	mulxq	%r8,%rcx,%rbp  // a1*a3
 	movq	%r15,%rdx
 	adcxq	%rcx,%r12
 	adoxq	%rbp,%r13
 	adcq	$0,%r13
 
-
-	mulxq	%r8,%rcx,%r14
+// ################################
+	mulxq	%r8,%rcx,%r14  // a2*a3
 	movq	0+128(%rsi),%rdx
-	xorq	%r15,%r15
-	adcxq	%r9,%r9
+	xorq	%r15,%r15  // %r15=0,cf=0,of=0
+	adcxq	%r9,%r9  // acc1:6<<1
 	adoxq	%rcx,%r13
 	adcxq	%r10,%r10
-	adoxq	%r15,%r14
+	adoxq	%r15,%r14  // of=0
 
 	mulxq	%rdx,%r8,%rbp
 	movq	8+128(%rsi),%rdx
@@ -1979,7 +1979,7 @@
 	shrxq	%rsi,%r8,%rax
 	movq	%rdx,%rbp
 
-
+// reduction step 1
 	addq	%rcx,%r9
 	adcq	%rax,%r10
 
@@ -1989,7 +1989,7 @@
 	adcq	$0,%r8
 	shrxq	%rsi,%r9,%rax
 
-
+// reduction step 2
 	addq	%rcx,%r10
 	adcq	%rax,%r11
 
@@ -1999,7 +1999,7 @@
 	adcq	$0,%r9
 	shrxq	%rsi,%r10,%rax
 
-
+// reduction step 3
 	addq	%rcx,%r11
 	adcq	%rax,%r8
 
@@ -2009,7 +2009,7 @@
 	adcq	$0,%r10
 	shrxq	%rsi,%r11,%rax
 
-
+// reduction step 4
 	addq	%rcx,%r8
 	adcq	%rax,%r9
 
@@ -2018,7 +2018,7 @@
 	adcq	$0,%r11
 
 	xorq	%rdx,%rdx
-	addq	%r8,%r12
+	addq	%r8,%r12  // accumulate upper half
 	movq	L$poly+8(%rip),%rsi
 	adcq	%r9,%r13
 	movq	%r12,%r8
@@ -2027,12 +2027,12 @@
 	movq	%r13,%r9
 	adcq	$0,%rdx
 
-	subq	$-1,%r12
+	subq	$-1,%r12  // .Lpoly0
 	movq	%r14,%r10
-	sbbq	%rsi,%r13
-	sbbq	$0,%r14
+	sbbq	%rsi,%r13  // .Lpoly1
+	sbbq	$0,%r14  // .Lpoly2
 	movq	%r15,%r11
-	sbbq	%rbp,%r15
+	sbbq	%rbp,%r15  // .Lpoly3
 	sbbq	$0,%rdx
 
 	cmovcq	%r8,%r12
@@ -2047,8 +2047,8 @@
 	ret
 
 
-
-
+// ############################################################################## 
+// void ecp_nistz256_select_w5_nohw(uint64_t *val, uint64_t *in_t, int index);
 .globl	_ecp_nistz256_select_w5_nohw
 .private_extern _ecp_nistz256_select_w5_nohw
 
@@ -2112,8 +2112,8 @@
 L$SEH_end_ecp_nistz256_select_w5_nohw:
 
 
-
-
+// ############################################################################## 
+// void ecp_nistz256_select_w7_nohw(uint64_t *val, uint64_t *in_t, int index);
 .globl	_ecp_nistz256_select_w7_nohw
 .private_extern _ecp_nistz256_select_w7_nohw
 
@@ -2165,8 +2165,8 @@
 
 L$SEH_end_ecp_nistz256_select_w7_nohw:
 
-
-
+// ############################################################################## 
+// void ecp_nistz256_select_w5_avx2(uint64_t *val, uint64_t *in_t, int index);
 .globl	_ecp_nistz256_select_w5_avx2
 .private_extern _ecp_nistz256_select_w5_avx2
 
@@ -2232,8 +2232,8 @@
 L$SEH_end_ecp_nistz256_select_w5_avx2:
 
 
-
-
+// ############################################################################## 
+// void ecp_nistz256_select_w7_avx2(uint64_t *val, uint64_t *in_t, int index);
 .globl	_ecp_nistz256_select_w7_avx2
 .private_extern _ecp_nistz256_select_w7_avx2
 
@@ -2254,7 +2254,7 @@
 
 	vmovd	%edx,%xmm1
 	vpermd	%ymm1,%ymm2,%ymm1
-
+// Skip index = 0, because it is implicitly the point at infinity
 
 	movq	$21,%rax
 L$select_loop_avx2_w7:
@@ -2418,7 +2418,7 @@
 __ecp_nistz256_mul_by_2q:
 
 	xorq	%r11,%r11
-	addq	%r12,%r12
+	addq	%r12,%r12  // a0:a3+a0:a3
 	adcq	%r13,%r13
 	movq	%r12,%rax
 	adcq	%r8,%r8
@@ -2471,10 +2471,10 @@
 L$point_doubleq_body:
 
 L$point_double_shortcutq:
-	movdqu	0(%rsi),%xmm0
-	movq	%rsi,%rbx
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rsi.x
+	movq	%rsi,%rbx  // backup copy
 	movdqu	16(%rsi),%xmm1
-	movq	32+0(%rsi),%r12
+	movq	32+0(%rsi),%r12  // load in_y in "5-4-0-1" order
 	movq	32+8(%rsi),%r13
 	movq	32+16(%rsi),%r8
 	movq	32+24(%rsi),%r9
@@ -2489,7 +2489,7 @@
 	movq	%r11,%xmm2
 
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_by_2q
+	call	__ecp_nistz256_mul_by_2q  // p256_mul_by_2(S, in_y);
 
 	movq	64+0(%rsi),%rax
 	movq	64+8(%rsi),%r14
@@ -2497,7 +2497,7 @@
 	movq	64+24(%rsi),%r8
 	leaq	64-0(%rsi),%rsi
 	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Zsqr, in_z);
 
 	movq	0+0(%rsp),%rax
 	movq	8+0(%rsp),%r14
@@ -2505,9 +2505,9 @@
 	movq	16+0(%rsp),%r15
 	movq	24+0(%rsp),%r8
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(S, S);
 
-	movq	32(%rbx),%rax
+	movq	32(%rbx),%rax  // %rbx is still valid
 	movq	64+0(%rbx),%r9
 	movq	64+8(%rbx),%r10
 	movq	64+16(%rbx),%r11
@@ -2515,24 +2515,24 @@
 	leaq	64-0(%rbx),%rsi
 	leaq	32(%rbx),%rbx
 	movq	%xmm2,%rdi
-	call	__ecp_nistz256_mul_montq
-	call	__ecp_nistz256_mul_by_2q
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(res_z, in_z, in_y);
+	call	__ecp_nistz256_mul_by_2q  // p256_mul_by_2(res_z, res_z);
 
-	movq	96+0(%rsp),%r12
+	movq	96+0(%rsp),%r12  // "5-4-0-1" order
 	movq	96+8(%rsp),%r13
 	leaq	64(%rsp),%rbx
 	movq	96+16(%rsp),%r8
 	movq	96+24(%rsp),%r9
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_add_toq
+	call	__ecp_nistz256_add_toq  // p256_add(M, in_x, Zsqr);
 
-	movq	96+0(%rsp),%r12
+	movq	96+0(%rsp),%r12  // "5-4-0-1" order
 	movq	96+8(%rsp),%r13
 	leaq	64(%rsp),%rbx
 	movq	96+16(%rsp),%r8
 	movq	96+24(%rsp),%r9
 	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(Zsqr, in_x, Zsqr);
 
 	movq	0+0(%rsp),%rax
 	movq	8+0(%rsp),%r14
@@ -2540,7 +2540,7 @@
 	movq	16+0(%rsp),%r15
 	movq	24+0(%rsp),%r8
 	movq	%xmm1,%rdi
-	call	__ecp_nistz256_sqr_montq
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(res_y, S);
 	xorq	%r9,%r9
 	movq	%r12,%rax
 	addq	$-1,%r12
@@ -2551,7 +2551,7 @@
 	movq	%r15,%r8
 	adcq	%rbp,%r15
 	adcq	$0,%r9
-	xorq	%rsi,%rsi
+	xorq	%rsi,%rsi  // borrow %rsi
 	testq	$1,%rax
 
 	cmovzq	%rax,%r12
@@ -2560,7 +2560,7 @@
 	cmovzq	%r8,%r15
 	cmovzq	%rsi,%r9
 
-	movq	%r13,%rax
+	movq	%r13,%rax  // a0:a3>>1
 	shrq	$1,%r12
 	shlq	$63,%rax
 	movq	%r14,%r10
@@ -2587,14 +2587,14 @@
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(M, M, Zsqr);
 
 	leaq	128(%rsp),%rdi
 	call	__ecp_nistz256_mul_by_2q
 
 	leaq	32(%rsp),%rbx
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_add_toq
+	call	__ecp_nistz256_add_toq  // p256_mul_by_3(M, M);
 
 	movq	96(%rsp),%rax
 	leaq	96(%rsp),%rbx
@@ -2604,10 +2604,10 @@
 	movq	16+0(%rsp),%r11
 	movq	24+0(%rsp),%r12
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S, S, in_x);
 
 	leaq	128(%rsp),%rdi
-	call	__ecp_nistz256_mul_by_2q
+	call	__ecp_nistz256_mul_by_2q  // p256_mul_by_2(tmp0, S);
 
 	movq	0+32(%rsp),%rax
 	movq	8+32(%rsp),%r14
@@ -2615,27 +2615,27 @@
 	movq	16+32(%rsp),%r15
 	movq	24+32(%rsp),%r8
 	movq	%xmm0,%rdi
-	call	__ecp_nistz256_sqr_montq
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(res_x, M);
 
 	leaq	128(%rsp),%rbx
-	movq	%r14,%r8
+	movq	%r14,%r8  // harmonize sqr output and sub input
 	movq	%r15,%r9
 	movq	%rsi,%r14
 	movq	%rbp,%r15
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(res_x, res_x, tmp0);
 
 	movq	0+0(%rsp),%rax
 	movq	0+8(%rsp),%rbp
 	movq	0+16(%rsp),%rcx
-	movq	0+24(%rsp),%r10
+	movq	0+24(%rsp),%r10  // "4-5-0-1" order
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  // p256_sub(S, S, res_x);
 
 	movq	32(%rsp),%rax
 	leaq	32(%rsp),%rbx
-	movq	%r12,%r14
+	movq	%r12,%r14  // harmonize sub output and mul input
 	xorl	%ecx,%ecx
-	movq	%r12,0+0(%rsp)
+	movq	%r12,0+0(%rsp)  // have to save:-(
 	movq	%r13,%r10
 	movq	%r13,0+8(%rsp)
 	cmovzq	%r8,%r11
@@ -2645,11 +2645,11 @@
 	movq	%r9,0+24(%rsp)
 	movq	%r14,%r9
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S, S, M);
 
 	movq	%xmm1,%rbx
 	movq	%xmm1,%rdi
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(res_y, S, res_y);
 
 	leaq	160+56(%rsp),%rsi
 
@@ -2695,14 +2695,14 @@
 
 L$point_addq_body:
 
-	movdqu	0(%rsi),%xmm0
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rsi
 	movdqu	16(%rsi),%xmm1
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm3
 	movdqu	64(%rsi),%xmm4
 	movdqu	80(%rsi),%xmm5
-	movq	%rsi,%rbx
-	movq	%rdx,%rsi
+	movq	%rsi,%rbx  // reassign
+	movq	%rdx,%rsi  // reassign
 	movdqa	%xmm0,384(%rsp)
 	movdqa	%xmm1,384+16(%rsp)
 	movdqa	%xmm2,416(%rsp)
@@ -2711,54 +2711,54 @@
 	movdqa	%xmm5,448+16(%rsp)
 	por	%xmm4,%xmm5
 
-	movdqu	0(%rsi),%xmm0
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rbx
 	pshufd	$0xb1,%xmm5,%xmm3
 	movdqu	16(%rsi),%xmm1
 	movdqu	32(%rsi),%xmm2
 	por	%xmm3,%xmm5
 	movdqu	48(%rsi),%xmm3
-	movq	64+0(%rsi),%rax
+	movq	64+0(%rsi),%rax  // load original in2_z
 	movq	64+8(%rsi),%r14
 	movq	64+16(%rsi),%r15
 	movq	64+24(%rsi),%r8
 	movdqa	%xmm0,480(%rsp)
 	pshufd	$0x1e,%xmm5,%xmm4
 	movdqa	%xmm1,480+16(%rsp)
-	movdqu	64(%rsi),%xmm0
+	movdqu	64(%rsi),%xmm0  // in2_z again
 	movdqu	80(%rsi),%xmm1
 	movdqa	%xmm2,512(%rsp)
 	movdqa	%xmm3,512+16(%rsp)
 	por	%xmm4,%xmm5
 	pxor	%xmm4,%xmm4
 	por	%xmm0,%xmm1
-	movq	%rdi,%xmm0
+	movq	%rdi,%xmm0  // save %rdi
 
-	leaq	64-0(%rsi),%rsi
-	movq	%rax,544+0(%rsp)
+	leaq	64-0(%rsi),%rsi  // %rsi is still valid
+	movq	%rax,544+0(%rsp)  // make in2_z copy
 	movq	%r14,544+8(%rsp)
 	movq	%r15,544+16(%rsp)
 	movq	%r8,544+24(%rsp)
-	leaq	96(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	96(%rsp),%rdi  // Z2^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Z2sqr, in2_z);
 
 	pcmpeqd	%xmm4,%xmm5
 	pshufd	$0xb1,%xmm1,%xmm4
 	por	%xmm1,%xmm4
-	pshufd	$0,%xmm5,%xmm5
+	pshufd	$0,%xmm5,%xmm5  // in1infty
 	pshufd	$0x1e,%xmm4,%xmm3
 	por	%xmm3,%xmm4
 	pxor	%xmm3,%xmm3
 	pcmpeqd	%xmm3,%xmm4
-	pshufd	$0,%xmm4,%xmm4
-	movq	64+0(%rbx),%rax
+	pshufd	$0,%xmm4,%xmm4  // in2infty
+	movq	64+0(%rbx),%rax  // load original in1_z
 	movq	64+8(%rbx),%r14
 	movq	64+16(%rbx),%r15
 	movq	64+24(%rbx),%r8
 	movq	%rbx,%xmm1
 
 	leaq	64-0(%rbx),%rsi
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	32(%rsp),%rdi  // Z1^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Z1sqr, in1_z);
 
 	movq	544(%rsp),%rax
 	leaq	544(%rsp),%rbx
@@ -2767,8 +2767,8 @@
 	leaq	0+96(%rsp),%rsi
 	movq	16+96(%rsp),%r11
 	movq	24+96(%rsp),%r12
-	leaq	224(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	224(%rsp),%rdi  // S1 = Z2^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S1, Z2sqr, in2_z);
 
 	movq	448(%rsp),%rax
 	leaq	448(%rsp),%rbx
@@ -2777,8 +2777,8 @@
 	leaq	0+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	256(%rsp),%rdi  // S2 = Z1^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S2, Z1sqr, in1_z);
 
 	movq	416(%rsp),%rax
 	leaq	416(%rsp),%rbx
@@ -2787,8 +2787,8 @@
 	leaq	0+224(%rsp),%rsi
 	movq	16+224(%rsp),%r11
 	movq	24+224(%rsp),%r12
-	leaq	224(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	224(%rsp),%rdi  // S1 = Y1*Z2^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S1, S1, in1_y);
 
 	movq	512(%rsp),%rax
 	leaq	512(%rsp),%rbx
@@ -2797,18 +2797,18 @@
 	leaq	0+256(%rsp),%rsi
 	movq	16+256(%rsp),%r11
 	movq	24+256(%rsp),%r12
-	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	256(%rsp),%rdi  // S2 = Y2*Z1^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S2, S2, in2_y);
 
 	leaq	224(%rsp),%rbx
-	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	leaq	64(%rsp),%rdi  // R = S2 - S1
+	call	__ecp_nistz256_sub_fromq  // p256_sub(R, S2, S1);
 
-	orq	%r13,%r12
+	orq	%r13,%r12  // see if result is zero
 	movdqa	%xmm4,%xmm2
 	orq	%r8,%r12
 	orq	%r9,%r12
-	por	%xmm5,%xmm2
+	por	%xmm5,%xmm2  // in1infty || in2infty
 	movq	%r12,%xmm3
 
 	movq	384(%rsp),%rax
@@ -2818,8 +2818,8 @@
 	leaq	0+96(%rsp),%rsi
 	movq	16+96(%rsp),%r11
 	movq	24+96(%rsp),%r12
-	leaq	160(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	160(%rsp),%rdi  // U1 = X1*Z2^2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(U1, in1_x, Z2sqr);
 
 	movq	480(%rsp),%rax
 	leaq	480(%rsp),%rbx
@@ -2828,34 +2828,34 @@
 	leaq	0+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	192(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	192(%rsp),%rdi  // U2 = X2*Z1^2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(U2, in2_x, Z1sqr);
 
 	leaq	160(%rsp),%rbx
-	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	leaq	0(%rsp),%rdi  // H = U2 - U1
+	call	__ecp_nistz256_sub_fromq  // p256_sub(H, U2, U1);
 
-	orq	%r13,%r12
+	orq	%r13,%r12  // see if result is zero
 	orq	%r8,%r12
-	orq	%r9,%r12
+	orq	%r9,%r12  // 
 
 	movq	%xmm2,%r8
 	movq	%xmm3,%r9
 	orq	%r8,%r12
-.byte	0x3e
-	jnz	L$add_proceedq
-
-
+.byte	0x3e  // predict taken
+	jnz	L$add_proceedq  // 
 
+// We now know A = B or A = -B and neither is infinity. Compare the
+// y-coordinates via S1 and S2.
 	testq	%r9,%r9
-	jz	L$add_doubleq
-
-
-
-
-
-
-	movq	%xmm0,%rdi
+	jz	L$add_doubleq  // is_equal(S1, S2)
+
+// A = -B, so the result is infinity.
+// 
+// TODO(davidben): Does .Ladd_proceed handle this case? It seems to, in
+// which case we should eliminate this special-case and simplify the
+// timing analysis.
+	movq	%xmm0,%rdi  // restore %rdi
 	pxor	%xmm0,%xmm0
 	movdqu	%xmm0,0(%rdi)
 	movdqu	%xmm0,16(%rdi)
@@ -2867,9 +2867,9 @@
 
 .p2align	5
 L$add_doubleq:
-	movq	%xmm1,%rsi
-	movq	%xmm0,%rdi
-	addq	$416,%rsp
+	movq	%xmm1,%rsi  // restore %rsi
+	movq	%xmm0,%rdi  // restore %rdi
+	addq	$416,%rsp  // difference in frame sizes
 
 	jmp	L$point_double_shortcutq
 
@@ -2881,8 +2881,8 @@
 	leaq	0+64(%rsp),%rsi
 	movq	16+64(%rsp),%r15
 	movq	24+64(%rsp),%r8
-	leaq	96(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	96(%rsp),%rdi  // R^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Rsqr, R);
 
 	movq	448(%rsp),%rax
 	leaq	448(%rsp),%rbx
@@ -2891,16 +2891,16 @@
 	leaq	0+0(%rsp),%rsi
 	movq	16+0(%rsp),%r11
 	movq	24+0(%rsp),%r12
-	leaq	352(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	352(%rsp),%rdi  // Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(res_z, H, in1_z);
 
 	movq	0+0(%rsp),%rax
 	movq	8+0(%rsp),%r14
 	leaq	0+0(%rsp),%rsi
 	movq	16+0(%rsp),%r15
 	movq	24+0(%rsp),%r8
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	32(%rsp),%rdi  // H^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Hsqr, H);
 
 	movq	544(%rsp),%rax
 	leaq	544(%rsp),%rbx
@@ -2909,8 +2909,8 @@
 	leaq	0+352(%rsp),%rsi
 	movq	16+352(%rsp),%r11
 	movq	24+352(%rsp),%r12
-	leaq	352(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	352(%rsp),%rdi  // Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(res_z, res_z, in2_z);
 
 	movq	0(%rsp),%rax
 	leaq	0(%rsp),%rbx
@@ -2919,8 +2919,8 @@
 	leaq	0+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	128(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	128(%rsp),%rdi  // H^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(Hcub, Hsqr, H);
 
 	movq	160(%rsp),%rax
 	leaq	160(%rsp),%rbx
@@ -2929,14 +2929,14 @@
 	leaq	0+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	192(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
-
-
-
+	leaq	192(%rsp),%rdi  // U1*H^2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(U2, U1, Hsqr);
+// lea	192(%rsp), %rsi
+// lea	32(%rsp), %rdi	# 2*U1*H^2
+// call	__ecp_nistz256_mul_by_2	# ecp_nistz256_mul_by_2(Hsqr, U2);
 
 	xorq	%r11,%r11
-	addq	%r12,%r12
+	addq	%r12,%r12  // a0:a3+a0:a3
 	leaq	96(%rsp),%rsi
 	adcq	%r13,%r13
 	movq	%r12,%rax
@@ -2962,11 +2962,11 @@
 	cmovcq	%r10,%r9
 	movq	24(%rsi),%r10
 
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  // p256_sub(res_x, Rsqr, Hsqr);
 
 	leaq	128(%rsp),%rbx
 	leaq	288(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(res_x, res_x, Hcub);
 
 	movq	192+0(%rsp),%rax
 	movq	192+8(%rsp),%rbp
@@ -2974,10 +2974,10 @@
 	movq	192+24(%rsp),%r10
 	leaq	320(%rsp),%rdi
 
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  // p256_sub(res_y, U2, res_x);
 
-	movq	%r12,0(%rdi)
-	movq	%r13,8(%rdi)
+	movq	%r12,0(%rdi)  // save the result, as
+	movq	%r13,8(%rdi)  // __ecp_nistz256_sub doesn't
 	movq	%r8,16(%rdi)
 	movq	%r9,24(%rdi)
 	movq	128(%rsp),%rax
@@ -2988,7 +2988,7 @@
 	movq	16+224(%rsp),%r11
 	movq	24+224(%rsp),%r12
 	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S2, S1, Hcub);
 
 	movq	320(%rsp),%rax
 	leaq	320(%rsp),%rbx
@@ -2998,15 +2998,15 @@
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
 	leaq	320(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(res_y, R, res_y);
 
 	leaq	256(%rsp),%rbx
 	leaq	320(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(res_y, res_y, S2);
 
-	movq	%xmm0,%rdi
+	movq	%xmm0,%rdi  // restore %rdi
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_z, in2_z, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	352(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -3017,7 +3017,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_z, in1_z, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -3030,7 +3030,7 @@
 	movdqu	%xmm2,64(%rdi)
 	movdqu	%xmm3,80(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_x, in2_x, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	288(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -3041,7 +3041,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_x, in1_x, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -3054,7 +3054,7 @@
 	movdqu	%xmm2,0(%rdi)
 	movdqu	%xmm3,16(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_y, in2_y, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	320(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -3065,7 +3065,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_y, in1_y, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -3123,14 +3123,14 @@
 
 L$add_affineq_body:
 
-	movdqu	0(%rsi),%xmm0
-	movq	%rdx,%rbx
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rsi
+	movq	%rdx,%rbx  // reassign
 	movdqu	16(%rsi),%xmm1
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm3
 	movdqu	64(%rsi),%xmm4
 	movdqu	80(%rsi),%xmm5
-	movq	64+0(%rsi),%rax
+	movq	64+0(%rsi),%rax  // load original in1_z
 	movq	64+8(%rsi),%r14
 	movq	64+16(%rsi),%r15
 	movq	64+24(%rsi),%r8
@@ -3142,7 +3142,7 @@
 	movdqa	%xmm5,384+16(%rsp)
 	por	%xmm4,%xmm5
 
-	movdqu	0(%rbx),%xmm0
+	movdqu	0(%rbx),%xmm0  // copy	*(P256_POINT_AFFINE *)%rbx
 	pshufd	$0xb1,%xmm5,%xmm3
 	movdqu	16(%rbx),%xmm1
 	movdqu	32(%rbx),%xmm2
@@ -3152,7 +3152,7 @@
 	pshufd	$0x1e,%xmm5,%xmm4
 	movdqa	%xmm1,416+16(%rsp)
 	por	%xmm0,%xmm1
-	movq	%rdi,%xmm0
+	movq	%rdi,%xmm0  // save %rdi
 	movdqa	%xmm2,448(%rsp)
 	movdqa	%xmm3,448+16(%rsp)
 	por	%xmm2,%xmm3
@@ -3160,33 +3160,33 @@
 	pxor	%xmm4,%xmm4
 	por	%xmm1,%xmm3
 
-	leaq	64-0(%rsi),%rsi
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	64-0(%rsi),%rsi  // %rsi is still valid
+	leaq	32(%rsp),%rdi  // Z1^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Z1sqr, in1_z);
 
 	pcmpeqd	%xmm4,%xmm5
 	pshufd	$0xb1,%xmm3,%xmm4
-	movq	0(%rbx),%rax
-
-	movq	%r12,%r9
+	movq	0(%rbx),%rax  // %rbx is still valid
+// lea	0x00(%rbx), %rbx
+	movq	%r12,%r9  // harmonize sqr output and mul input
 	por	%xmm3,%xmm4
-	pshufd	$0,%xmm5,%xmm5
+	pshufd	$0,%xmm5,%xmm5  // in1infty
 	pshufd	$0x1e,%xmm4,%xmm3
 	movq	%r13,%r10
 	por	%xmm3,%xmm4
 	pxor	%xmm3,%xmm3
 	movq	%r14,%r11
 	pcmpeqd	%xmm3,%xmm4
-	pshufd	$0,%xmm4,%xmm4
+	pshufd	$0,%xmm4,%xmm4  // in2infty
 
 	leaq	32-0(%rsp),%rsi
 	movq	%r15,%r12
-	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	0(%rsp),%rdi  // U2 = X2*Z1^2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(U2, Z1sqr, in2_x);
 
 	leaq	320(%rsp),%rbx
-	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	leaq	64(%rsp),%rdi  // H = U2 - U1
+	call	__ecp_nistz256_sub_fromq  // p256_sub(H, U2, in1_x);
 
 	movq	384(%rsp),%rax
 	leaq	384(%rsp),%rbx
@@ -3195,8 +3195,8 @@
 	leaq	0+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	32(%rsp),%rdi  // S2 = Z1^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S2, Z1sqr, in1_z);
 
 	movq	384(%rsp),%rax
 	leaq	384(%rsp),%rbx
@@ -3205,8 +3205,8 @@
 	leaq	0+64(%rsp),%rsi
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
-	leaq	288(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	288(%rsp),%rdi  // Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(res_z, H, in1_z);
 
 	movq	448(%rsp),%rax
 	leaq	448(%rsp),%rbx
@@ -3215,28 +3215,28 @@
 	leaq	0+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	32(%rsp),%rdi  // S2 = Y2*Z1^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S2, S2, in2_y);
 
 	leaq	352(%rsp),%rbx
-	leaq	96(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	leaq	96(%rsp),%rdi  // R = S2 - S1
+	call	__ecp_nistz256_sub_fromq  // p256_sub(R, S2, in1_y);
 
 	movq	0+64(%rsp),%rax
 	movq	8+64(%rsp),%r14
 	leaq	0+64(%rsp),%rsi
 	movq	16+64(%rsp),%r15
 	movq	24+64(%rsp),%r8
-	leaq	128(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	128(%rsp),%rdi  // H^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Hsqr, H);
 
 	movq	0+96(%rsp),%rax
 	movq	8+96(%rsp),%r14
 	leaq	0+96(%rsp),%rsi
 	movq	16+96(%rsp),%r15
 	movq	24+96(%rsp),%r8
-	leaq	192(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	192(%rsp),%rdi  // R^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Rsqr, R);
 
 	movq	128(%rsp),%rax
 	leaq	128(%rsp),%rbx
@@ -3245,8 +3245,8 @@
 	leaq	0+64(%rsp),%rsi
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
-	leaq	160(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	160(%rsp),%rdi  // H^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(Hcub, Hsqr, H);
 
 	movq	320(%rsp),%rax
 	leaq	320(%rsp),%rbx
@@ -3255,14 +3255,14 @@
 	leaq	0+128(%rsp),%rsi
 	movq	16+128(%rsp),%r11
 	movq	24+128(%rsp),%r12
-	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
-
-
-
+	leaq	0(%rsp),%rdi  // U1*H^2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(U2, in1_x, Hsqr);
+// lea	0(%rsp), %rsi
+// lea	128(%rsp), %rdi	# 2*U1*H^2
+// call	__ecp_nistz256_mul_by_2	# ecp_nistz256_mul_by_2(Hsqr, U2);
 
 	xorq	%r11,%r11
-	addq	%r12,%r12
+	addq	%r12,%r12  // a0:a3+a0:a3
 	leaq	192(%rsp),%rsi
 	adcq	%r13,%r13
 	movq	%r12,%rax
@@ -3288,11 +3288,11 @@
 	cmovcq	%r10,%r9
 	movq	24(%rsi),%r10
 
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  // p256_sub(res_x, Rsqr, Hsqr);
 
 	leaq	160(%rsp),%rbx
 	leaq	224(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(res_x, res_x, Hcub);
 
 	movq	0+0(%rsp),%rax
 	movq	0+8(%rsp),%rbp
@@ -3300,10 +3300,10 @@
 	movq	0+24(%rsp),%r10
 	leaq	64(%rsp),%rdi
 
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  // p256_sub(H, U2, res_x);
 
-	movq	%r12,0(%rdi)
-	movq	%r13,8(%rdi)
+	movq	%r12,0(%rdi)  // save the result, as
+	movq	%r13,8(%rdi)  // __ecp_nistz256_sub doesn't
 	movq	%r8,16(%rdi)
 	movq	%r9,24(%rdi)
 	movq	352(%rsp),%rax
@@ -3314,7 +3314,7 @@
 	movq	16+160(%rsp),%r11
 	movq	24+160(%rsp),%r12
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S2, Hcub, in1_y);
 
 	movq	96(%rsp),%rax
 	leaq	96(%rsp),%rbx
@@ -3324,15 +3324,15 @@
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
 	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(H, H, R);
 
 	leaq	32(%rsp),%rbx
 	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(res_y, H, S2);
 
-	movq	%xmm0,%rdi
+	movq	%xmm0,%rdi  // restore %rdi
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_z, ONE, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	288(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -3343,7 +3343,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_z, in1_z, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -3356,7 +3356,7 @@
 	movdqu	%xmm2,64(%rdi)
 	movdqu	%xmm3,80(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_x, in2_x, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	224(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -3367,7 +3367,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_x, in1_x, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -3380,7 +3380,7 @@
 	movdqu	%xmm2,0(%rdi)
 	movdqu	%xmm3,16(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_y, in2_y, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	256(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -3391,7 +3391,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_y, in1_y, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -3534,7 +3534,7 @@
 __ecp_nistz256_mul_by_2x:
 
 	xorq	%r11,%r11
-	adcq	%r12,%r12
+	adcq	%r12,%r12  // a0:a3+a0:a3
 	adcq	%r13,%r13
 	movq	%r12,%rax
 	adcq	%r8,%r8
@@ -3588,10 +3588,10 @@
 L$point_doublex_body:
 
 L$point_double_shortcutx:
-	movdqu	0(%rsi),%xmm0
-	movq	%rsi,%rbx
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rsi.x
+	movq	%rsi,%rbx  // backup copy
 	movdqu	16(%rsi),%xmm1
-	movq	32+0(%rsi),%r12
+	movq	32+0(%rsi),%r12  // load in_y in "5-4-0-1" order
 	movq	32+8(%rsi),%r13
 	movq	32+16(%rsi),%r8
 	movq	32+24(%rsi),%r9
@@ -3606,7 +3606,7 @@
 	movq	%r11,%xmm2
 
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_by_2x
+	call	__ecp_nistz256_mul_by_2x  // p256_mul_by_2(S, in_y);
 
 	movq	64+0(%rsi),%rdx
 	movq	64+8(%rsi),%r14
@@ -3614,7 +3614,7 @@
 	movq	64+24(%rsi),%r8
 	leaq	64-128(%rsi),%rsi
 	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Zsqr, in_z);
 
 	movq	0+0(%rsp),%rdx
 	movq	8+0(%rsp),%r14
@@ -3622,9 +3622,9 @@
 	movq	16+0(%rsp),%r15
 	movq	24+0(%rsp),%r8
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(S, S);
 
-	movq	32(%rbx),%rdx
+	movq	32(%rbx),%rdx  // %rbx is still valid
 	movq	64+0(%rbx),%r9
 	movq	64+8(%rbx),%r10
 	movq	64+16(%rbx),%r11
@@ -3632,24 +3632,24 @@
 	leaq	64-128(%rbx),%rsi
 	leaq	32(%rbx),%rbx
 	movq	%xmm2,%rdi
-	call	__ecp_nistz256_mul_montx
-	call	__ecp_nistz256_mul_by_2x
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(res_z, in_z, in_y);
+	call	__ecp_nistz256_mul_by_2x  // p256_mul_by_2(res_z, res_z);
 
-	movq	96+0(%rsp),%r12
+	movq	96+0(%rsp),%r12  // "5-4-0-1" order
 	movq	96+8(%rsp),%r13
 	leaq	64(%rsp),%rbx
 	movq	96+16(%rsp),%r8
 	movq	96+24(%rsp),%r9
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_add_tox
+	call	__ecp_nistz256_add_tox  // p256_add(M, in_x, Zsqr);
 
-	movq	96+0(%rsp),%r12
+	movq	96+0(%rsp),%r12  // "5-4-0-1" order
 	movq	96+8(%rsp),%r13
 	leaq	64(%rsp),%rbx
 	movq	96+16(%rsp),%r8
 	movq	96+24(%rsp),%r9
 	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(Zsqr, in_x, Zsqr);
 
 	movq	0+0(%rsp),%rdx
 	movq	8+0(%rsp),%r14
@@ -3657,7 +3657,7 @@
 	movq	16+0(%rsp),%r15
 	movq	24+0(%rsp),%r8
 	movq	%xmm1,%rdi
-	call	__ecp_nistz256_sqr_montx
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(res_y, S);
 	xorq	%r9,%r9
 	movq	%r12,%rax
 	addq	$-1,%r12
@@ -3668,7 +3668,7 @@
 	movq	%r15,%r8
 	adcq	%rbp,%r15
 	adcq	$0,%r9
-	xorq	%rsi,%rsi
+	xorq	%rsi,%rsi  // borrow %rsi
 	testq	$1,%rax
 
 	cmovzq	%rax,%r12
@@ -3677,7 +3677,7 @@
 	cmovzq	%r8,%r15
 	cmovzq	%rsi,%r9
 
-	movq	%r13,%rax
+	movq	%r13,%rax  // a0:a3>>1
 	shrq	$1,%r12
 	shlq	$63,%rax
 	movq	%r14,%r10
@@ -3704,14 +3704,14 @@
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(M, M, Zsqr);
 
 	leaq	128(%rsp),%rdi
 	call	__ecp_nistz256_mul_by_2x
 
 	leaq	32(%rsp),%rbx
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_add_tox
+	call	__ecp_nistz256_add_tox  // p256_mul_by_3(M, M);
 
 	movq	96(%rsp),%rdx
 	leaq	96(%rsp),%rbx
@@ -3721,10 +3721,10 @@
 	movq	16+0(%rsp),%r11
 	movq	24+0(%rsp),%r12
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S, S, in_x);
 
 	leaq	128(%rsp),%rdi
-	call	__ecp_nistz256_mul_by_2x
+	call	__ecp_nistz256_mul_by_2x  // p256_mul_by_2(tmp0, S);
 
 	movq	0+32(%rsp),%rdx
 	movq	8+32(%rsp),%r14
@@ -3732,27 +3732,27 @@
 	movq	16+32(%rsp),%r15
 	movq	24+32(%rsp),%r8
 	movq	%xmm0,%rdi
-	call	__ecp_nistz256_sqr_montx
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(res_x, M);
 
 	leaq	128(%rsp),%rbx
-	movq	%r14,%r8
+	movq	%r14,%r8  // harmonize sqr output and sub input
 	movq	%r15,%r9
 	movq	%rsi,%r14
 	movq	%rbp,%r15
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(res_x, res_x, tmp0);
 
 	movq	0+0(%rsp),%rax
 	movq	0+8(%rsp),%rbp
 	movq	0+16(%rsp),%rcx
-	movq	0+24(%rsp),%r10
+	movq	0+24(%rsp),%r10  // "4-5-0-1" order
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  // p256_sub(S, S, res_x);
 
 	movq	32(%rsp),%rdx
 	leaq	32(%rsp),%rbx
-	movq	%r12,%r14
+	movq	%r12,%r14  // harmonize sub output and mul input
 	xorl	%ecx,%ecx
-	movq	%r12,0+0(%rsp)
+	movq	%r12,0+0(%rsp)  // have to save:-(
 	movq	%r13,%r10
 	movq	%r13,0+8(%rsp)
 	cmovzq	%r8,%r11
@@ -3762,11 +3762,11 @@
 	movq	%r9,0+24(%rsp)
 	movq	%r14,%r9
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S, S, M);
 
 	movq	%xmm1,%rbx
 	movq	%xmm1,%rdi
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(res_y, S, res_y);
 
 	leaq	160+56(%rsp),%rsi
 
@@ -3812,14 +3812,14 @@
 
 L$point_addx_body:
 
-	movdqu	0(%rsi),%xmm0
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rsi
 	movdqu	16(%rsi),%xmm1
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm3
 	movdqu	64(%rsi),%xmm4
 	movdqu	80(%rsi),%xmm5
-	movq	%rsi,%rbx
-	movq	%rdx,%rsi
+	movq	%rsi,%rbx  // reassign
+	movq	%rdx,%rsi  // reassign
 	movdqa	%xmm0,384(%rsp)
 	movdqa	%xmm1,384+16(%rsp)
 	movdqa	%xmm2,416(%rsp)
@@ -3828,54 +3828,54 @@
 	movdqa	%xmm5,448+16(%rsp)
 	por	%xmm4,%xmm5
 
-	movdqu	0(%rsi),%xmm0
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rbx
 	pshufd	$0xb1,%xmm5,%xmm3
 	movdqu	16(%rsi),%xmm1
 	movdqu	32(%rsi),%xmm2
 	por	%xmm3,%xmm5
 	movdqu	48(%rsi),%xmm3
-	movq	64+0(%rsi),%rdx
+	movq	64+0(%rsi),%rdx  // load original in2_z
 	movq	64+8(%rsi),%r14
 	movq	64+16(%rsi),%r15
 	movq	64+24(%rsi),%r8
 	movdqa	%xmm0,480(%rsp)
 	pshufd	$0x1e,%xmm5,%xmm4
 	movdqa	%xmm1,480+16(%rsp)
-	movdqu	64(%rsi),%xmm0
+	movdqu	64(%rsi),%xmm0  // in2_z again
 	movdqu	80(%rsi),%xmm1
 	movdqa	%xmm2,512(%rsp)
 	movdqa	%xmm3,512+16(%rsp)
 	por	%xmm4,%xmm5
 	pxor	%xmm4,%xmm4
 	por	%xmm0,%xmm1
-	movq	%rdi,%xmm0
+	movq	%rdi,%xmm0  // save %rdi
 
-	leaq	64-128(%rsi),%rsi
-	movq	%rdx,544+0(%rsp)
+	leaq	64-128(%rsi),%rsi  // %rsi is still valid
+	movq	%rdx,544+0(%rsp)  // make in2_z copy
 	movq	%r14,544+8(%rsp)
 	movq	%r15,544+16(%rsp)
 	movq	%r8,544+24(%rsp)
-	leaq	96(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	96(%rsp),%rdi  // Z2^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Z2sqr, in2_z);
 
 	pcmpeqd	%xmm4,%xmm5
 	pshufd	$0xb1,%xmm1,%xmm4
 	por	%xmm1,%xmm4
-	pshufd	$0,%xmm5,%xmm5
+	pshufd	$0,%xmm5,%xmm5  // in1infty
 	pshufd	$0x1e,%xmm4,%xmm3
 	por	%xmm3,%xmm4
 	pxor	%xmm3,%xmm3
 	pcmpeqd	%xmm3,%xmm4
-	pshufd	$0,%xmm4,%xmm4
-	movq	64+0(%rbx),%rdx
+	pshufd	$0,%xmm4,%xmm4  // in2infty
+	movq	64+0(%rbx),%rdx  // load original in1_z
 	movq	64+8(%rbx),%r14
 	movq	64+16(%rbx),%r15
 	movq	64+24(%rbx),%r8
 	movq	%rbx,%xmm1
 
 	leaq	64-128(%rbx),%rsi
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	32(%rsp),%rdi  // Z1^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Z1sqr, in1_z);
 
 	movq	544(%rsp),%rdx
 	leaq	544(%rsp),%rbx
@@ -3884,8 +3884,8 @@
 	leaq	-128+96(%rsp),%rsi
 	movq	16+96(%rsp),%r11
 	movq	24+96(%rsp),%r12
-	leaq	224(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	224(%rsp),%rdi  // S1 = Z2^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S1, Z2sqr, in2_z);
 
 	movq	448(%rsp),%rdx
 	leaq	448(%rsp),%rbx
@@ -3894,8 +3894,8 @@
 	leaq	-128+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	256(%rsp),%rdi  // S2 = Z1^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S2, Z1sqr, in1_z);
 
 	movq	416(%rsp),%rdx
 	leaq	416(%rsp),%rbx
@@ -3904,8 +3904,8 @@
 	leaq	-128+224(%rsp),%rsi
 	movq	16+224(%rsp),%r11
 	movq	24+224(%rsp),%r12
-	leaq	224(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	224(%rsp),%rdi  // S1 = Y1*Z2^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S1, S1, in1_y);
 
 	movq	512(%rsp),%rdx
 	leaq	512(%rsp),%rbx
@@ -3914,18 +3914,18 @@
 	leaq	-128+256(%rsp),%rsi
 	movq	16+256(%rsp),%r11
 	movq	24+256(%rsp),%r12
-	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	256(%rsp),%rdi  // S2 = Y2*Z1^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S2, S2, in2_y);
 
 	leaq	224(%rsp),%rbx
-	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	leaq	64(%rsp),%rdi  // R = S2 - S1
+	call	__ecp_nistz256_sub_fromx  // p256_sub(R, S2, S1);
 
-	orq	%r13,%r12
+	orq	%r13,%r12  // see if result is zero
 	movdqa	%xmm4,%xmm2
 	orq	%r8,%r12
 	orq	%r9,%r12
-	por	%xmm5,%xmm2
+	por	%xmm5,%xmm2  // in1infty || in2infty
 	movq	%r12,%xmm3
 
 	movq	384(%rsp),%rdx
@@ -3935,8 +3935,8 @@
 	leaq	-128+96(%rsp),%rsi
 	movq	16+96(%rsp),%r11
 	movq	24+96(%rsp),%r12
-	leaq	160(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	160(%rsp),%rdi  // U1 = X1*Z2^2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(U1, in1_x, Z2sqr);
 
 	movq	480(%rsp),%rdx
 	leaq	480(%rsp),%rbx
@@ -3945,34 +3945,34 @@
 	leaq	-128+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	192(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	192(%rsp),%rdi  // U2 = X2*Z1^2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(U2, in2_x, Z1sqr);
 
 	leaq	160(%rsp),%rbx
-	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	leaq	0(%rsp),%rdi  // H = U2 - U1
+	call	__ecp_nistz256_sub_fromx  // p256_sub(H, U2, U1);
 
-	orq	%r13,%r12
+	orq	%r13,%r12  // see if result is zero
 	orq	%r8,%r12
-	orq	%r9,%r12
+	orq	%r9,%r12  // 
 
 	movq	%xmm2,%r8
 	movq	%xmm3,%r9
 	orq	%r8,%r12
-.byte	0x3e
-	jnz	L$add_proceedx
-
-
+.byte	0x3e  // predict taken
+	jnz	L$add_proceedx  // 
 
+// We now know A = B or A = -B and neither is infinity. Compare the
+// y-coordinates via S1 and S2.
 	testq	%r9,%r9
-	jz	L$add_doublex
-
-
-
-
-
-
-	movq	%xmm0,%rdi
+	jz	L$add_doublex  // is_equal(S1, S2)
+
+// A = -B, so the result is infinity.
+// 
+// TODO(davidben): Does .Ladd_proceed handle this case? It seems to, in
+// which case we should eliminate this special-case and simplify the
+// timing analysis.
+	movq	%xmm0,%rdi  // restore %rdi
 	pxor	%xmm0,%xmm0
 	movdqu	%xmm0,0(%rdi)
 	movdqu	%xmm0,16(%rdi)
@@ -3984,9 +3984,9 @@
 
 .p2align	5
 L$add_doublex:
-	movq	%xmm1,%rsi
-	movq	%xmm0,%rdi
-	addq	$416,%rsp
+	movq	%xmm1,%rsi  // restore %rsi
+	movq	%xmm0,%rdi  // restore %rdi
+	addq	$416,%rsp  // difference in frame sizes
 
 	jmp	L$point_double_shortcutx
 
@@ -3998,8 +3998,8 @@
 	leaq	-128+64(%rsp),%rsi
 	movq	16+64(%rsp),%r15
 	movq	24+64(%rsp),%r8
-	leaq	96(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	96(%rsp),%rdi  // R^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Rsqr, R);
 
 	movq	448(%rsp),%rdx
 	leaq	448(%rsp),%rbx
@@ -4008,16 +4008,16 @@
 	leaq	-128+0(%rsp),%rsi
 	movq	16+0(%rsp),%r11
 	movq	24+0(%rsp),%r12
-	leaq	352(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	352(%rsp),%rdi  // Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(res_z, H, in1_z);
 
 	movq	0+0(%rsp),%rdx
 	movq	8+0(%rsp),%r14
 	leaq	-128+0(%rsp),%rsi
 	movq	16+0(%rsp),%r15
 	movq	24+0(%rsp),%r8
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	32(%rsp),%rdi  // H^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Hsqr, H);
 
 	movq	544(%rsp),%rdx
 	leaq	544(%rsp),%rbx
@@ -4026,8 +4026,8 @@
 	leaq	-128+352(%rsp),%rsi
 	movq	16+352(%rsp),%r11
 	movq	24+352(%rsp),%r12
-	leaq	352(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	352(%rsp),%rdi  // Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(res_z, res_z, in2_z);
 
 	movq	0(%rsp),%rdx
 	leaq	0(%rsp),%rbx
@@ -4036,8 +4036,8 @@
 	leaq	-128+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	128(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	128(%rsp),%rdi  // H^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(Hcub, Hsqr, H);
 
 	movq	160(%rsp),%rdx
 	leaq	160(%rsp),%rbx
@@ -4046,14 +4046,14 @@
 	leaq	-128+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	192(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
-
-
-
+	leaq	192(%rsp),%rdi  // U1*H^2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(U2, U1, Hsqr);
+// lea	192(%rsp), %rsi
+// lea	32(%rsp), %rdi	# 2*U1*H^2
+// call	__ecp_nistz256_mul_by_2	# ecp_nistz256_mul_by_2(Hsqr, U2);
 
 	xorq	%r11,%r11
-	addq	%r12,%r12
+	addq	%r12,%r12  // a0:a3+a0:a3
 	leaq	96(%rsp),%rsi
 	adcq	%r13,%r13
 	movq	%r12,%rax
@@ -4079,11 +4079,11 @@
 	cmovcq	%r10,%r9
 	movq	24(%rsi),%r10
 
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  // p256_sub(res_x, Rsqr, Hsqr);
 
 	leaq	128(%rsp),%rbx
 	leaq	288(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(res_x, res_x, Hcub);
 
 	movq	192+0(%rsp),%rax
 	movq	192+8(%rsp),%rbp
@@ -4091,10 +4091,10 @@
 	movq	192+24(%rsp),%r10
 	leaq	320(%rsp),%rdi
 
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  // p256_sub(res_y, U2, res_x);
 
-	movq	%r12,0(%rdi)
-	movq	%r13,8(%rdi)
+	movq	%r12,0(%rdi)  // save the result, as
+	movq	%r13,8(%rdi)  // __ecp_nistz256_sub doesn't
 	movq	%r8,16(%rdi)
 	movq	%r9,24(%rdi)
 	movq	128(%rsp),%rdx
@@ -4105,7 +4105,7 @@
 	movq	16+224(%rsp),%r11
 	movq	24+224(%rsp),%r12
 	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S2, S1, Hcub);
 
 	movq	320(%rsp),%rdx
 	leaq	320(%rsp),%rbx
@@ -4115,15 +4115,15 @@
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
 	leaq	320(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(res_y, R, res_y);
 
 	leaq	256(%rsp),%rbx
 	leaq	320(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(res_y, res_y, S2);
 
-	movq	%xmm0,%rdi
+	movq	%xmm0,%rdi  // restore %rdi
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_z, in2_z, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	352(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -4134,7 +4134,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_z, in1_z, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -4147,7 +4147,7 @@
 	movdqu	%xmm2,64(%rdi)
 	movdqu	%xmm3,80(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_x, in2_x, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	288(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -4158,7 +4158,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_x, in1_x, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -4171,7 +4171,7 @@
 	movdqu	%xmm2,0(%rdi)
 	movdqu	%xmm3,16(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_y, in2_y, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	320(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -4182,7 +4182,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_y, in1_y, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -4240,14 +4240,14 @@
 
 L$add_affinex_body:
 
-	movdqu	0(%rsi),%xmm0
-	movq	%rdx,%rbx
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rsi
+	movq	%rdx,%rbx  // reassign
 	movdqu	16(%rsi),%xmm1
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm3
 	movdqu	64(%rsi),%xmm4
 	movdqu	80(%rsi),%xmm5
-	movq	64+0(%rsi),%rdx
+	movq	64+0(%rsi),%rdx  // load original in1_z
 	movq	64+8(%rsi),%r14
 	movq	64+16(%rsi),%r15
 	movq	64+24(%rsi),%r8
@@ -4259,7 +4259,7 @@
 	movdqa	%xmm5,384+16(%rsp)
 	por	%xmm4,%xmm5
 
-	movdqu	0(%rbx),%xmm0
+	movdqu	0(%rbx),%xmm0  // copy	*(P256_POINT_AFFINE *)%rbx
 	pshufd	$0xb1,%xmm5,%xmm3
 	movdqu	16(%rbx),%xmm1
 	movdqu	32(%rbx),%xmm2
@@ -4269,7 +4269,7 @@
 	pshufd	$0x1e,%xmm5,%xmm4
 	movdqa	%xmm1,416+16(%rsp)
 	por	%xmm0,%xmm1
-	movq	%rdi,%xmm0
+	movq	%rdi,%xmm0  // save %rdi
 	movdqa	%xmm2,448(%rsp)
 	movdqa	%xmm3,448+16(%rsp)
 	por	%xmm2,%xmm3
@@ -4277,33 +4277,33 @@
 	pxor	%xmm4,%xmm4
 	por	%xmm1,%xmm3
 
-	leaq	64-128(%rsi),%rsi
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	64-128(%rsi),%rsi  // %rsi is still valid
+	leaq	32(%rsp),%rdi  // Z1^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Z1sqr, in1_z);
 
 	pcmpeqd	%xmm4,%xmm5
 	pshufd	$0xb1,%xmm3,%xmm4
-	movq	0(%rbx),%rdx
-
-	movq	%r12,%r9
+	movq	0(%rbx),%rdx  // %rbx is still valid
+// lea	0x00(%rbx), %rbx
+	movq	%r12,%r9  // harmonize sqr output and mul input
 	por	%xmm3,%xmm4
-	pshufd	$0,%xmm5,%xmm5
+	pshufd	$0,%xmm5,%xmm5  // in1infty
 	pshufd	$0x1e,%xmm4,%xmm3
 	movq	%r13,%r10
 	por	%xmm3,%xmm4
 	pxor	%xmm3,%xmm3
 	movq	%r14,%r11
 	pcmpeqd	%xmm3,%xmm4
-	pshufd	$0,%xmm4,%xmm4
+	pshufd	$0,%xmm4,%xmm4  // in2infty
 
 	leaq	32-128(%rsp),%rsi
 	movq	%r15,%r12
-	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	0(%rsp),%rdi  // U2 = X2*Z1^2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(U2, Z1sqr, in2_x);
 
 	leaq	320(%rsp),%rbx
-	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	leaq	64(%rsp),%rdi  // H = U2 - U1
+	call	__ecp_nistz256_sub_fromx  // p256_sub(H, U2, in1_x);
 
 	movq	384(%rsp),%rdx
 	leaq	384(%rsp),%rbx
@@ -4312,8 +4312,8 @@
 	leaq	-128+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	32(%rsp),%rdi  // S2 = Z1^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S2, Z1sqr, in1_z);
 
 	movq	384(%rsp),%rdx
 	leaq	384(%rsp),%rbx
@@ -4322,8 +4322,8 @@
 	leaq	-128+64(%rsp),%rsi
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
-	leaq	288(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	288(%rsp),%rdi  // Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(res_z, H, in1_z);
 
 	movq	448(%rsp),%rdx
 	leaq	448(%rsp),%rbx
@@ -4332,28 +4332,28 @@
 	leaq	-128+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	32(%rsp),%rdi  // S2 = Y2*Z1^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S2, S2, in2_y);
 
 	leaq	352(%rsp),%rbx
-	leaq	96(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	leaq	96(%rsp),%rdi  // R = S2 - S1
+	call	__ecp_nistz256_sub_fromx  // p256_sub(R, S2, in1_y);
 
 	movq	0+64(%rsp),%rdx
 	movq	8+64(%rsp),%r14
 	leaq	-128+64(%rsp),%rsi
 	movq	16+64(%rsp),%r15
 	movq	24+64(%rsp),%r8
-	leaq	128(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	128(%rsp),%rdi  // H^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Hsqr, H);
 
 	movq	0+96(%rsp),%rdx
 	movq	8+96(%rsp),%r14
 	leaq	-128+96(%rsp),%rsi
 	movq	16+96(%rsp),%r15
 	movq	24+96(%rsp),%r8
-	leaq	192(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	192(%rsp),%rdi  // R^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Rsqr, R);
 
 	movq	128(%rsp),%rdx
 	leaq	128(%rsp),%rbx
@@ -4362,8 +4362,8 @@
 	leaq	-128+64(%rsp),%rsi
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
-	leaq	160(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	160(%rsp),%rdi  // H^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(Hcub, Hsqr, H);
 
 	movq	320(%rsp),%rdx
 	leaq	320(%rsp),%rbx
@@ -4372,14 +4372,14 @@
 	leaq	-128+128(%rsp),%rsi
 	movq	16+128(%rsp),%r11
 	movq	24+128(%rsp),%r12
-	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
-
-
-
+	leaq	0(%rsp),%rdi  // U1*H^2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(U2, in1_x, Hsqr);
+// lea	0(%rsp), %rsi
+// lea	128(%rsp), %rdi	# 2*U1*H^2
+// call	__ecp_nistz256_mul_by_2	# ecp_nistz256_mul_by_2(Hsqr, U2);
 
 	xorq	%r11,%r11
-	addq	%r12,%r12
+	addq	%r12,%r12  // a0:a3+a0:a3
 	leaq	192(%rsp),%rsi
 	adcq	%r13,%r13
 	movq	%r12,%rax
@@ -4405,11 +4405,11 @@
 	cmovcq	%r10,%r9
 	movq	24(%rsi),%r10
 
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  // p256_sub(res_x, Rsqr, Hsqr);
 
 	leaq	160(%rsp),%rbx
 	leaq	224(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(res_x, res_x, Hcub);
 
 	movq	0+0(%rsp),%rax
 	movq	0+8(%rsp),%rbp
@@ -4417,10 +4417,10 @@
 	movq	0+24(%rsp),%r10
 	leaq	64(%rsp),%rdi
 
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  // p256_sub(H, U2, res_x);
 
-	movq	%r12,0(%rdi)
-	movq	%r13,8(%rdi)
+	movq	%r12,0(%rdi)  // save the result, as
+	movq	%r13,8(%rdi)  // __ecp_nistz256_sub doesn't
 	movq	%r8,16(%rdi)
 	movq	%r9,24(%rdi)
 	movq	352(%rsp),%rdx
@@ -4431,7 +4431,7 @@
 	movq	16+160(%rsp),%r11
 	movq	24+160(%rsp),%r12
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S2, Hcub, in1_y);
 
 	movq	96(%rsp),%rdx
 	leaq	96(%rsp),%rbx
@@ -4441,15 +4441,15 @@
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
 	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(H, H, R);
 
 	leaq	32(%rsp),%rbx
 	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(res_y, H, S2);
 
-	movq	%xmm0,%rdi
+	movq	%xmm0,%rdi  // restore %rdi
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_z, ONE, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	288(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -4460,7 +4460,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_z, in1_z, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -4473,7 +4473,7 @@
 	movdqu	%xmm2,64(%rdi)
 	movdqu	%xmm3,80(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_x, in2_x, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	224(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -4484,7 +4484,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_x, in1_x, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -4497,7 +4497,7 @@
 	movdqu	%xmm2,0(%rdi)
 	movdqu	%xmm3,16(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_y, in2_y, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	256(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -4508,7 +4508,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_y, in1_y, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2

boringssl-0.20260708.tar.xz/gen/bcm/p256-x86_64-asm-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/p256-x86_64-asm-linux.S Changed

@@ -6,7 +6,7 @@
 #if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && defined(__ELF__)
 .text	
 
-
+// The polynomial
 .section	.rodata
 .align	64
 p256_constants:
@@ -22,15 +22,15 @@
 .LONE_mont:
 .quad	0x0000000000000001, 0xffffffff00000000, 0xffffffffffffffff, 0x00000000fffffffe
 
-
+// Constants for computations modulo ord(p256)
 .Lord:
 .quad	0xf3b9cac2fc632551, 0xbce6faada7179e84, 0xffffffffffffffff, 0xffffffff00000000
 .LordK:
 .quad	0xccd1c8aaee00bc4f
 .text	
 
-
-
+// ############################################################################## 
+// void ecp_nistz256_neg(uint64_t res4, uint64_t a4);
 .globl	ecp_nistz256_neg
 .hidden ecp_nistz256_neg
 .type	ecp_nistz256_neg,@function
@@ -88,11 +88,11 @@
 	ret
 .cfi_endproc	
 .size	ecp_nistz256_neg,.-ecp_nistz256_neg
-
-
-
-
-
+// ############################################################################## 
+// void ecp_nistz256_ord_mul_mont(
+// uint64_t res4,
+// uint64_t a4,
+// uint64_t b4);
 
 .globl	ecp_nistz256_ord_mul_mont_nohw
 .hidden ecp_nistz256_ord_mul_mont_nohw
@@ -126,7 +126,7 @@
 	leaq	.Lord(%rip),%r14
 	movq	.LordK(%rip),%r15
 
-
+// ################################ * b0
 	movq	%rax,%rcx
 	mulq	0(%rsi)
 	movq	%rax,%r8
@@ -154,16 +154,16 @@
 	adcq	$0,%rdx
 	movq	%rdx,%r12
 
-
+// ################################ First reduction step
 	mulq	0(%r14)
 	movq	%r8,%rbp
-	addq	%rax,%r13
+	addq	%rax,%r13  // guaranteed to be zero
 	movq	%r8,%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rcx
 
 	subq	%r8,%r10
-	sbbq	$0,%r8
+	sbbq	$0,%r8  // can't borrow
 
 	mulq	8(%r14)
 	addq	%rcx,%r9
@@ -172,19 +172,19 @@
 	movq	%rbp,%rax
 	adcq	%rdx,%r10
 	movq	%rbp,%rdx
-	adcq	$0,%r8
+	adcq	$0,%r8  // can't overflow
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r11
 	movq	8(%rbx),%rax
-	sbbq	%rdx,%rbp
+	sbbq	%rdx,%rbp  // can't borrow
 
 	addq	%r8,%r11
 	adcq	%rbp,%r12
 	adcq	$0,%r13
 
-
+// ################################ * b1
 	movq	%rax,%rcx
 	mulq	0(%rsi)
 	addq	%rax,%r9
@@ -220,15 +220,15 @@
 	adcq	%rdx,%r13
 	adcq	$0,%r8
 
-
+// ################################ Second reduction step
 	mulq	0(%r14)
 	movq	%r9,%rbp
-	addq	%rax,%rcx
+	addq	%rax,%rcx  // guaranteed to be zero
 	movq	%r9,%rax
 	adcq	%rdx,%rcx
 
 	subq	%r9,%r11
-	sbbq	$0,%r9
+	sbbq	$0,%r9  // can't borrow
 
 	mulq	8(%r14)
 	addq	%rcx,%r10
@@ -237,19 +237,19 @@
 	movq	%rbp,%rax
 	adcq	%rdx,%r11
 	movq	%rbp,%rdx
-	adcq	$0,%r9
+	adcq	$0,%r9  // can't overflow
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r12
 	movq	16(%rbx),%rax
-	sbbq	%rdx,%rbp
+	sbbq	%rdx,%rbp  // can't borrow
 
 	addq	%r9,%r12
 	adcq	%rbp,%r13
 	adcq	$0,%r8
 
-
+// ################################# * b2
 	movq	%rax,%rcx
 	mulq	0(%rsi)
 	addq	%rax,%r10
@@ -285,15 +285,15 @@
 	adcq	%rdx,%r8
 	adcq	$0,%r9
 
-
+// ################################ Third reduction step
 	mulq	0(%r14)
 	movq	%r10,%rbp
-	addq	%rax,%rcx
+	addq	%rax,%rcx  // guaranteed to be zero
 	movq	%r10,%rax
 	adcq	%rdx,%rcx
 
 	subq	%r10,%r12
-	sbbq	$0,%r10
+	sbbq	$0,%r10  // can't borrow
 
 	mulq	8(%r14)
 	addq	%rcx,%r11
@@ -302,19 +302,19 @@
 	movq	%rbp,%rax
 	adcq	%rdx,%r12
 	movq	%rbp,%rdx
-	adcq	$0,%r10
+	adcq	$0,%r10  // can't overflow
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r13
 	movq	24(%rbx),%rax
-	sbbq	%rdx,%rbp
+	sbbq	%rdx,%rbp  // can't borrow
 
 	addq	%r10,%r13
 	adcq	%rbp,%r8
 	adcq	$0,%r9
 
-
+// ################################ * b3
 	movq	%rax,%rcx
 	mulq	0(%rsi)
 	addq	%rax,%r11
@@ -350,15 +350,15 @@
 	adcq	%rdx,%r9
 	adcq	$0,%r10
 
-
+// ################################ Last reduction step
 	mulq	0(%r14)
 	movq	%r11,%rbp
-	addq	%rax,%rcx
+	addq	%rax,%rcx  // guaranteed to be zero
 	movq	%r11,%rax
 	adcq	%rdx,%rcx
 
 	subq	%r11,%r13
-	sbbq	$0,%r11
+	sbbq	$0,%r11  // can't borrow
 
 	mulq	8(%r14)
 	addq	%rcx,%r12
@@ -367,18 +367,18 @@
 	movq	%rbp,%rax
 	adcq	%rdx,%r13
 	movq	%rbp,%rdx
-	adcq	$0,%r11
+	adcq	$0,%r11  // can't overflow
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r8
-	sbbq	%rdx,%rbp
+	sbbq	%rdx,%rbp  // can't borrow
 
 	addq	%r11,%r8
 	adcq	%rbp,%r9
 	adcq	$0,%r10
 
-
+// ################################ Subtract ord
 	movq	%r12,%rsi
 	subq	0(%r14),%r12
 	movq	%r13,%r11
@@ -418,11 +418,11 @@
 .cfi_endproc	
 .size	ecp_nistz256_ord_mul_mont_nohw,.-ecp_nistz256_ord_mul_mont_nohw
 
-
-
-
-
-
+// ############################################################################## 
+// void ecp_nistz256_ord_sqr_mont(
+// uint64_t res4,
+// uint64_t a4,
+// uint64_t rep);
 
 .globl	ecp_nistz256_ord_sqr_mont_nohw
 .hidden ecp_nistz256_ord_sqr_mont_nohw
@@ -455,56 +455,56 @@
 	movq	8(%rsi),%rax
 	movq	16(%rsi),%r14
 	movq	24(%rsi),%r15
-	leaq	.Lord(%rip),%rsi
+	leaq	.Lord(%rip),%rsi  // pointer to modulus
 	movq	%rdx,%rbx
 	jmp	.Loop_ord_sqr
 
 .align	32
 .Loop_ord_sqr:
-
-	movq	%rax,%rbp
-	mulq	%r8
+// ################################ a1: * a0
+	movq	%rax,%rbp  // put aside a1
+	mulq	%r8  // a1 * a0
 	movq	%rax,%r9
-	movq	%rbp,%xmm1
+	movq	%rbp,%xmm1  // offload a1
 	movq	%r14,%rax
 	movq	%rdx,%r10
 
-	mulq	%r8
+	mulq	%r8  // a2 * a0
 	addq	%rax,%r10
 	movq	%r15,%rax
-	movq	%r14,%xmm2
+	movq	%r14,%xmm2  // offload a2
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%r8
+	mulq	%r8  // a3 * a0
 	addq	%rax,%r11
 	movq	%r15,%rax
-	movq	%r15,%xmm3
+	movq	%r15,%xmm3  // offload a3
 	adcq	$0,%rdx
 	movq	%rdx,%r12
 
-
-	mulq	%r14
+// ################################ a3 * a2
+	mulq	%r14  // a3 * a2
 	movq	%rax,%r13
 	movq	%r14,%rax
 	movq	%rdx,%r14
 
-
-	mulq	%rbp
+// ################################ a2: * a1
+	mulq	%rbp  // a2 * a1
 	addq	%rax,%r11
 	movq	%r15,%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r15
 
-	mulq	%rbp
+	mulq	%rbp  // a3 * a1
 	addq	%rax,%r12
 	adcq	$0,%rdx
 
 	addq	%r15,%r12
 	adcq	%rdx,%r13
-	adcq	$0,%r14
-
+	adcq	$0,%r14  // can't overflow
 
+// ################################ *2
 	xorq	%r15,%r15
 	movq	%r8,%rax
 	addq	%r9,%r9
@@ -515,20 +515,20 @@
 	adcq	%r14,%r14
 	adcq	$0,%r15
 
-
-	mulq	%rax
+// ################################ Missing products
+	mulq	%rax  // a0 * a0
 	movq	%rax,%r8
 	movq	%xmm1,%rax
 	movq	%rdx,%rbp
 
-	mulq	%rax
+	mulq	%rax  // a1 * a1
 	addq	%rbp,%r9
 	adcq	%rax,%r10
 	movq	%xmm2,%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rbp
 
-	mulq	%rax
+	mulq	%rax  // a2 * a2
 	addq	%rbp,%r11
 	adcq	%rax,%r12
 	movq	%xmm3,%rax
@@ -536,23 +536,23 @@
 	movq	%rdx,%rbp
 
 	movq	%r8,%rcx
-	imulq	32(%rsi),%r8
+	imulq	32(%rsi),%r8  // *= .LordK
 
-	mulq	%rax
+	mulq	%rax  // a3 * a3
 	addq	%rbp,%r13
 	adcq	%rax,%r14
-	movq	0(%rsi),%rax
-	adcq	%rdx,%r15
-
+	movq	0(%rsi),%rax  // modulus0
+	adcq	%rdx,%r15  // can't overflow
 
+// ################################ First reduction step
 	mulq	%r8
 	movq	%r8,%rbp
-	addq	%rax,%rcx
-	movq	8(%rsi),%rax
+	addq	%rax,%rcx  // guaranteed to be zero
+	movq	8(%rsi),%rax  // modulus1
 	adcq	%rdx,%rcx
 
 	subq	%r8,%r10
-	sbbq	$0,%rbp
+	sbbq	$0,%rbp  // can't borrow
 
 	mulq	%r8
 	addq	%rcx,%r9
@@ -561,29 +561,29 @@
 	movq	%r8,%rax
 	adcq	%rdx,%r10
 	movq	%r8,%rdx
-	adcq	$0,%rbp
+	adcq	$0,%rbp  // can't overflow
 
 	movq	%r9,%rcx
-	imulq	32(%rsi),%r9
+	imulq	32(%rsi),%r9  // *= .LordK
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r11
 	movq	0(%rsi),%rax
-	sbbq	%rdx,%r8
+	sbbq	%rdx,%r8  // can't borrow
 
 	addq	%rbp,%r11
-	adcq	$0,%r8
-
+	adcq	$0,%r8  // can't overflow
 
+// ################################ Second reduction step
 	mulq	%r9
 	movq	%r9,%rbp
-	addq	%rax,%rcx
+	addq	%rax,%rcx  // guaranteed to be zero
 	movq	8(%rsi),%rax
 	adcq	%rdx,%rcx
 
 	subq	%r9,%r11
-	sbbq	$0,%rbp
+	sbbq	$0,%rbp  // can't borrow
 
 	mulq	%r9
 	addq	%rcx,%r10
@@ -592,29 +592,29 @@
 	movq	%r9,%rax
 	adcq	%rdx,%r11
 	movq	%r9,%rdx
-	adcq	$0,%rbp
+	adcq	$0,%rbp  // can't overflow
 
 	movq	%r10,%rcx
-	imulq	32(%rsi),%r10
+	imulq	32(%rsi),%r10  // *= .LordK
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r8
 	movq	0(%rsi),%rax
-	sbbq	%rdx,%r9
+	sbbq	%rdx,%r9  // can't borrow
 
 	addq	%rbp,%r8
-	adcq	$0,%r9
-
+	adcq	$0,%r9  // can't overflow
 
+// ################################ Third reduction step
 	mulq	%r10
 	movq	%r10,%rbp
-	addq	%rax,%rcx
+	addq	%rax,%rcx  // guaranteed to be zero
 	movq	8(%rsi),%rax
 	adcq	%rdx,%rcx
 
 	subq	%r10,%r8
-	sbbq	$0,%rbp
+	sbbq	$0,%rbp  // can't borrow
 
 	mulq	%r10
 	addq	%rcx,%r11
@@ -623,29 +623,29 @@
 	movq	%r10,%rax
 	adcq	%rdx,%r8
 	movq	%r10,%rdx
-	adcq	$0,%rbp
+	adcq	$0,%rbp  // can't overflow
 
 	movq	%r11,%rcx
-	imulq	32(%rsi),%r11
+	imulq	32(%rsi),%r11  // *= .LordK
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r9
 	movq	0(%rsi),%rax
-	sbbq	%rdx,%r10
+	sbbq	%rdx,%r10  // can't borrow
 
 	addq	%rbp,%r9
-	adcq	$0,%r10
-
+	adcq	$0,%r10  // can't overflow
 
+// ################################ Last reduction step
 	mulq	%r11
 	movq	%r11,%rbp
-	addq	%rax,%rcx
+	addq	%rax,%rcx  // guaranteed to be zero
 	movq	8(%rsi),%rax
 	adcq	%rdx,%rcx
 
 	subq	%r11,%r9
-	sbbq	$0,%rbp
+	sbbq	$0,%rbp  // can't borrow
 
 	mulq	%r11
 	addq	%rcx,%r8
@@ -654,17 +654,17 @@
 	movq	%r11,%rax
 	adcq	%rdx,%r9
 	movq	%r11,%rdx
-	adcq	$0,%rbp
+	adcq	$0,%rbp  // can't overflow
 
 	shlq	$32,%rax
 	shrq	$32,%rdx
 	subq	%rax,%r10
-	sbbq	%rdx,%r11
+	sbbq	%rdx,%r11  // can't borrow
 
 	addq	%rbp,%r10
-	adcq	$0,%r11
-
+	adcq	$0,%r11  // can't overflow
 
+// ################################ Add bits 511:256 of the sqr result
 	xorq	%rdx,%rdx
 	addq	%r12,%r8
 	adcq	%r13,%r9
@@ -674,7 +674,7 @@
 	movq	%r9,%rax
 	adcq	$0,%rdx
 
-
+// ################################ Compare to modulus
 	subq	0(%rsi),%r8
 	movq	%r10,%r14
 	sbbq	8(%rsi),%r9
@@ -717,7 +717,7 @@
 	ret
 .cfi_endproc	
 .size	ecp_nistz256_ord_sqr_mont_nohw,.-ecp_nistz256_ord_sqr_mont_nohw
-
+// ############################################################################## 
 .globl	ecp_nistz256_ord_mul_mont_adx
 .hidden ecp_nistz256_ord_mul_mont_adx
 .type	ecp_nistz256_ord_mul_mont_adx,@function
@@ -752,11 +752,11 @@
 	movq	8(%rsi),%r10
 	movq	16(%rsi),%r11
 	movq	24(%rsi),%r12
-	leaq	-128(%rsi),%rsi
+	leaq	-128(%rsi),%rsi  // control u-op density
 	leaq	.Lord-128(%rip),%r14
 	movq	.LordK(%rip),%r15
 
-
+// ################################ Multiply by b0
 	mulxq	%r9,%r8,%r9
 	mulxq	%r10,%rcx,%r10
 	mulxq	%r11,%rbp,%r11
@@ -768,10 +768,10 @@
 	adcq	%rcx,%r11
 	adcq	$0,%r12
 
-
-	xorq	%r13,%r13
+// ################################ reduction
+	xorq	%r13,%r13  // %r13=0, cf=0, of=0
 	mulxq	0+128(%r14),%rcx,%rbp
-	adcxq	%rcx,%r8
+	adcxq	%rcx,%r8  // guaranteed to be zero
 	adoxq	%rbp,%r9
 
 	mulxq	8+128(%r14),%rcx,%rbp
@@ -788,9 +788,9 @@
 	adoxq	%rbp,%r12
 	adcxq	%r8,%r12
 	adoxq	%r8,%r13
-	adcq	$0,%r13
-
+	adcq	$0,%r13  // cf=0, of=0
 
+// ################################ Multiply by b1
 	mulxq	0+128(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r9
 	adoxq	%rbp,%r10
@@ -811,11 +811,11 @@
 
 	adcxq	%r8,%r13
 	adoxq	%r8,%r8
-	adcq	$0,%r8
-
+	adcq	$0,%r8  // cf=0, of=0
 
+// ################################ reduction
 	mulxq	0+128(%r14),%rcx,%rbp
-	adcxq	%rcx,%r9
+	adcxq	%rcx,%r9  // guaranteed to be zero
 	adoxq	%rbp,%r10
 
 	mulxq	8+128(%r14),%rcx,%rbp
@@ -832,9 +832,9 @@
 	adoxq	%rbp,%r13
 	adcxq	%r9,%r13
 	adoxq	%r9,%r8
-	adcq	$0,%r8
-
+	adcq	$0,%r8  // cf=0, of=0
 
+// ################################ Multiply by b2
 	mulxq	0+128(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r10
 	adoxq	%rbp,%r11
@@ -855,11 +855,11 @@
 
 	adcxq	%r9,%r8
 	adoxq	%r9,%r9
-	adcq	$0,%r9
-
+	adcq	$0,%r9  // cf=0, of=0
 
+// ################################ reduction
 	mulxq	0+128(%r14),%rcx,%rbp
-	adcxq	%rcx,%r10
+	adcxq	%rcx,%r10  // guaranteed to be zero
 	adoxq	%rbp,%r11
 
 	mulxq	8+128(%r14),%rcx,%rbp
@@ -876,9 +876,9 @@
 	adoxq	%rbp,%r8
 	adcxq	%r10,%r8
 	adoxq	%r10,%r9
-	adcq	$0,%r9
-
+	adcq	$0,%r9  // cf=0, of=0
 
+// ################################ Multiply by b3
 	mulxq	0+128(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r11
 	adoxq	%rbp,%r12
@@ -899,11 +899,11 @@
 
 	adcxq	%r10,%r9
 	adoxq	%r10,%r10
-	adcq	$0,%r10
-
+	adcq	$0,%r10  // cf=0, of=0
 
+// ################################ reduction
 	mulxq	0+128(%r14),%rcx,%rbp
-	adcxq	%rcx,%r11
+	adcxq	%rcx,%r11  // guaranteed to be zero
 	adoxq	%rbp,%r12
 
 	mulxq	8+128(%r14),%rcx,%rbp
@@ -924,8 +924,8 @@
 	adoxq	%r11,%r10
 	adcq	$0,%r10
 
-
-
+// ################################
+// Branch-less conditional subtraction of P
 	movq	%r8,%rcx
 	subq	0(%r14),%r12
 	sbbq	8(%r14),%r13
@@ -1001,38 +1001,38 @@
 
 .align	32
 .Loop_ord_sqrx:
-	mulxq	%r14,%r9,%r10
-	mulxq	%r15,%rcx,%r11
-	movq	%rdx,%rax
-	movq	%r14,%xmm1
-	mulxq	%r8,%rbp,%r12
+	mulxq	%r14,%r9,%r10  // a0*a1
+	mulxq	%r15,%rcx,%r11  // a0*a2
+	movq	%rdx,%rax  // offload a0
+	movq	%r14,%xmm1  // offload a1
+	mulxq	%r8,%rbp,%r12  // a0*a3
 	movq	%r14,%rdx
 	addq	%rcx,%r10
-	movq	%r15,%xmm2
+	movq	%r15,%xmm2  // offload a2
 	adcq	%rbp,%r11
 	adcq	$0,%r12
-	xorq	%r13,%r13
-
-	mulxq	%r15,%rcx,%rbp
+	xorq	%r13,%r13  // %r13=0,cf=0,of=0
+// ################################
+	mulxq	%r15,%rcx,%rbp  // a1*a2
 	adcxq	%rcx,%r11
 	adoxq	%rbp,%r12
 
-	mulxq	%r8,%rcx,%rbp
+	mulxq	%r8,%rcx,%rbp  // a1*a3
 	movq	%r15,%rdx
 	adcxq	%rcx,%r12
 	adoxq	%rbp,%r13
 	adcq	$0,%r13
-
-	mulxq	%r8,%rcx,%r14
+// ################################
+	mulxq	%r8,%rcx,%r14  // a2*a3
 	movq	%rax,%rdx
-	movq	%r8,%xmm3
-	xorq	%r15,%r15
-	adcxq	%r9,%r9
+	movq	%r8,%xmm3  // offload a3
+	xorq	%r15,%r15  // %r15=0,cf=0,of=0
+	adcxq	%r9,%r9  // acc1:6<<1
 	adoxq	%rcx,%r13
 	adcxq	%r10,%r10
-	adoxq	%r15,%r14
-
+	adoxq	%r15,%r14  // of=0
 
+// ################################ ai*ai
 	mulxq	%rdx,%r8,%rbp
 	movq	%xmm1,%rdx
 	adcxq	%r11,%r11
@@ -1054,13 +1054,13 @@
 	adoxq	%rcx,%r14
 	adoxq	%rax,%r15
 
-
+// ################################ reduction
 	movq	%r8,%rdx
 	mulxq	32(%rsi),%rdx,%rcx
 
-	xorq	%rax,%rax
+	xorq	%rax,%rax  // cf=0, of=0
 	mulxq	0(%rsi),%rcx,%rbp
-	adcxq	%rcx,%r8
+	adcxq	%rcx,%r8  // guaranteed to be zero
 	adoxq	%rbp,%r9
 	mulxq	8(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r9
@@ -1070,15 +1070,15 @@
 	adoxq	%rbp,%r11
 	mulxq	24(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r11
-	adoxq	%rbp,%r8
-	adcxq	%rax,%r8
-
+	adoxq	%rbp,%r8  // of=0
+	adcxq	%rax,%r8  // cf=0
 
+// ################################
 	movq	%r9,%rdx
 	mulxq	32(%rsi),%rdx,%rcx
 
 	mulxq	0(%rsi),%rcx,%rbp
-	adoxq	%rcx,%r9
+	adoxq	%rcx,%r9  // guaranteed to be zero
 	adcxq	%rbp,%r10
 	mulxq	8(%rsi),%rcx,%rbp
 	adoxq	%rcx,%r10
@@ -1088,15 +1088,15 @@
 	adcxq	%rbp,%r8
 	mulxq	24(%rsi),%rcx,%rbp
 	adoxq	%rcx,%r8
-	adcxq	%rbp,%r9
-	adoxq	%rax,%r9
-
+	adcxq	%rbp,%r9  // cf=0
+	adoxq	%rax,%r9  // of=0
 
+// ################################
 	movq	%r10,%rdx
 	mulxq	32(%rsi),%rdx,%rcx
 
 	mulxq	0(%rsi),%rcx,%rbp
-	adcxq	%rcx,%r10
+	adcxq	%rcx,%r10  // guaranteed to be zero
 	adoxq	%rbp,%r11
 	mulxq	8(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r11
@@ -1106,15 +1106,15 @@
 	adoxq	%rbp,%r9
 	mulxq	24(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r9
-	adoxq	%rbp,%r10
-	adcxq	%rax,%r10
-
+	adoxq	%rbp,%r10  // of=0
+	adcxq	%rax,%r10  // cf=0
 
+// ################################
 	movq	%r11,%rdx
 	mulxq	32(%rsi),%rdx,%rcx
 
 	mulxq	0(%rsi),%rcx,%rbp
-	adoxq	%rcx,%r11
+	adoxq	%rcx,%r11  // guaranteed to be zero
 	adcxq	%rbp,%r8
 	mulxq	8(%rsi),%rcx,%rbp
 	adoxq	%rcx,%r8
@@ -1127,8 +1127,8 @@
 	adcxq	%rbp,%r11
 	adoxq	%rax,%r11
 
-
-	addq	%r8,%r12
+// ################################ accumulate upper half
+	addq	%r8,%r12  // add	%r12, %r8
 	adcq	%r13,%r9
 	movq	%r12,%rdx
 	adcq	%r14,%r10
@@ -1136,7 +1136,7 @@
 	movq	%r9,%r14
 	adcq	$0,%rax
 
-
+// ################################ compare to modulus
 	subq	0(%rsi),%r12
 	movq	%r10,%r15
 	sbbq	8(%rsi),%r9
@@ -1179,11 +1179,11 @@
 	ret
 .cfi_endproc	
 .size	ecp_nistz256_ord_sqr_mont_adx,.-ecp_nistz256_ord_sqr_mont_adx
-
-
-
-
-
+// ############################################################################## 
+// void ecp_nistz256_mul_mont(
+// uint64_t res4,
+// uint64_t a4,
+// uint64_t b4);
 
 .globl	ecp_nistz256_mul_mont_nohw
 .hidden ecp_nistz256_mul_mont_nohw
@@ -1243,8 +1243,8 @@
 .align	32
 __ecp_nistz256_mul_montq:
 .cfi_startproc	
-
-
+// #######################################################################
+// Multiply a by b0
 	movq	%rax,%rbp
 	mulq	%r9
 	movq	.Lpoly+8(%rip),%r14
@@ -1272,20 +1272,20 @@
 	xorq	%r13,%r13
 	movq	%rdx,%r12
 
-
-
-
-
-
-
-
-
+// #######################################################################
+// First reduction step
+// Basically now we want to multiply acc0 by p256,
+// and add the result to the acc.
+// Due to the special form of p256 we do some optimizations
+// 
+// acc0 x p2560..1 = acc0 x 2^96 - acc0
+// then we add acc0 and get acc0 x 2^96
 
 	movq	%r8,%rbp
 	shlq	$32,%r8
 	mulq	%r15
 	shrq	$32,%rbp
-	addq	%r8,%r9
+	addq	%r8,%r9  // +=acc0<<96
 	adcq	%rbp,%r10
 	adcq	%rax,%r11
 	movq	8(%rbx),%rax
@@ -1293,8 +1293,8 @@
 	adcq	$0,%r13
 	xorq	%r8,%r8
 
-
-
+// #######################################################################
+// Multiply by b1
 	movq	%rax,%rbp
 	mulq	0(%rsi)
 	addq	%rax,%r9
@@ -1326,8 +1326,8 @@
 	adcq	%rdx,%r13
 	adcq	$0,%r8
 
-
-
+// #######################################################################
+// Second reduction step
 	movq	%r9,%rbp
 	shlq	$32,%r9
 	mulq	%r15
@@ -1340,8 +1340,8 @@
 	adcq	$0,%r8
 	xorq	%r9,%r9
 
-
-
+// #######################################################################
+// Multiply by b2
 	movq	%rax,%rbp
 	mulq	0(%rsi)
 	addq	%rax,%r10
@@ -1373,8 +1373,8 @@
 	adcq	%rdx,%r8
 	adcq	$0,%r9
 
-
-
+// #######################################################################
+// Third reduction step
 	movq	%r10,%rbp
 	shlq	$32,%r10
 	mulq	%r15
@@ -1387,8 +1387,8 @@
 	adcq	$0,%r9
 	xorq	%r10,%r10
 
-
-
+// #######################################################################
+// Multiply by b3
 	movq	%rax,%rbp
 	mulq	0(%rsi)
 	addq	%rax,%r11
@@ -1420,8 +1420,8 @@
 	adcq	%rdx,%r9
 	adcq	$0,%r10
 
-
-
+// #######################################################################
+// Final reduction step
 	movq	%r11,%rbp
 	shlq	$32,%r11
 	mulq	%r15
@@ -1434,14 +1434,14 @@
 	movq	%r13,%rbp
 	adcq	$0,%r10
 
-
-
-	subq	$-1,%r12
+// #######################################################################
+// Branch-less conditional subtraction of P
+	subq	$-1,%r12  // .Lpoly0
 	movq	%r8,%rbx
-	sbbq	%r14,%r13
-	sbbq	$0,%r8
+	sbbq	%r14,%r13  // .Lpoly1
+	sbbq	$0,%r8  // .Lpoly2
 	movq	%r9,%rdx
-	sbbq	%r15,%r9
+	sbbq	%r15,%r9  // .Lpoly3
 	sbbq	$0,%r10
 
 	cmovcq	%rcx,%r12
@@ -1457,13 +1457,13 @@
 .cfi_endproc	
 .size	__ecp_nistz256_mul_montq,.-__ecp_nistz256_mul_montq
 
+// ############################################################################## 
+// void ecp_nistz256_sqr_mont(
+// uint64_t res4,
+// uint64_t a4);
 
-
-
-
-
-
-
+// we optimize the square according to S.Gueron and V.Krasnov,
+// "Speeding up Big-Number Squaring"
 .globl	ecp_nistz256_sqr_mont_nohw
 .hidden ecp_nistz256_sqr_mont_nohw
 .type	ecp_nistz256_sqr_mont_nohw,@function
@@ -1521,31 +1521,31 @@
 __ecp_nistz256_sqr_montq:
 .cfi_startproc	
 	movq	%rax,%r13
-	mulq	%r14
+	mulq	%r14  // a1*a0
 	movq	%rax,%r9
 	movq	%r15,%rax
 	movq	%rdx,%r10
 
-	mulq	%r13
+	mulq	%r13  // a0*a2
 	addq	%rax,%r10
 	movq	%r8,%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%r13
+	mulq	%r13  // a0*a3
 	addq	%rax,%r11
 	movq	%r15,%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r12
 
-
-	mulq	%r14
+// ################################
+	mulq	%r14  // a1*a2
 	addq	%rax,%r11
 	movq	%r8,%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rbp
 
-	mulq	%r14
+	mulq	%r14  // a1*a3
 	addq	%rax,%r12
 	movq	%r8,%rax
 	adcq	$0,%rdx
@@ -1553,15 +1553,15 @@
 	movq	%rdx,%r13
 	adcq	$0,%r13
 
-
-	mulq	%r15
+// ################################
+	mulq	%r15  // a2*a3
 	xorq	%r15,%r15
 	addq	%rax,%r13
 	movq	0(%rsi),%rax
 	movq	%rdx,%r14
 	adcq	$0,%r14
 
-	addq	%r9,%r9
+	addq	%r9,%r9  // acc1:6<<1
 	adcq	%r10,%r10
 	adcq	%r11,%r11
 	adcq	%r12,%r12
@@ -1597,21 +1597,21 @@
 	movq	.Lpoly+8(%rip),%rsi
 	movq	.Lpoly+24(%rip),%rbp
 
-
-
-
+// #########################################
+// Now the reduction
+// First iteration
 	movq	%r8,%rcx
 	shlq	$32,%r8
 	mulq	%rbp
 	shrq	$32,%rcx
-	addq	%r8,%r9
+	addq	%r8,%r9  // +=acc0<<96
 	adcq	%rcx,%r10
 	adcq	%rax,%r11
 	movq	%r9,%rax
 	adcq	$0,%rdx
 
-
-
+// #########################################
+// Second iteration
 	movq	%r9,%rcx
 	shlq	$32,%r9
 	movq	%rdx,%r8
@@ -1623,8 +1623,8 @@
 	movq	%r10,%rax
 	adcq	$0,%rdx
 
-
-
+// #########################################
+// Third iteration
 	movq	%r10,%rcx
 	shlq	$32,%r10
 	movq	%rdx,%r9
@@ -1636,8 +1636,8 @@
 	movq	%r11,%rax
 	adcq	$0,%rdx
 
-
-
+// ##########################################
+// Last iteration
 	movq	%r11,%rcx
 	shlq	$32,%r11
 	movq	%rdx,%r10
@@ -1649,8 +1649,8 @@
 	adcq	$0,%rdx
 	xorq	%r11,%r11
 
-
-
+// ###########################################
+// Add the rest of the acc
 	addq	%r8,%r12
 	adcq	%r9,%r13
 	movq	%r12,%r8
@@ -1659,12 +1659,12 @@
 	movq	%r13,%r9
 	adcq	$0,%r11
 
-	subq	$-1,%r12
+	subq	$-1,%r12  // .Lpoly0
 	movq	%r14,%r10
-	sbbq	%rsi,%r13
-	sbbq	$0,%r14
+	sbbq	%rsi,%r13  // .Lpoly1
+	sbbq	$0,%r14  // .Lpoly2
 	movq	%r15,%rcx
-	sbbq	%rbp,%r15
+	sbbq	%rbp,%r15  // .Lpoly3
 	sbbq	$0,%r11
 
 	cmovcq	%r8,%r12
@@ -1711,7 +1711,7 @@
 	movq	8(%rsi),%r10
 	movq	16(%rsi),%r11
 	movq	24(%rsi),%r12
-	leaq	-128(%rsi),%rsi
+	leaq	-128(%rsi),%rsi  // control u-op density
 
 	call	__ecp_nistz256_mul_montx
 
@@ -1738,12 +1738,12 @@
 .align	32
 __ecp_nistz256_mul_montx:
 .cfi_startproc	
-
-
+// #######################################################################
+// Multiply by b0
 	mulxq	%r9,%r8,%r9
 	mulxq	%r10,%rcx,%r10
 	movq	$32,%r14
-	xorq	%r13,%r13
+	xorq	%r13,%r13  // cf=0
 	mulxq	%r11,%rbp,%r11
 	movq	.Lpoly+24(%rip),%r15
 	adcq	%rcx,%r9
@@ -1755,8 +1755,8 @@
 	shrxq	%r14,%r8,%rcx
 	adcq	$0,%r12
 
-
-
+// #######################################################################
+// First reduction step
 	addq	%rbp,%r9
 	adcq	%rcx,%r10
 
@@ -1765,10 +1765,10 @@
 	adcq	%rcx,%r11
 	adcq	%rbp,%r12
 	adcq	$0,%r13
-	xorq	%r8,%r8
-
-
+	xorq	%r8,%r8  // %r8=0,cf=0,of=0
 
+// #######################################################################
+// Multiply by b1
 	mulxq	0+128(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r9
 	adoxq	%rbp,%r10
@@ -1792,8 +1792,8 @@
 	adoxq	%r8,%r8
 	adcq	$0,%r8
 
-
-
+// #######################################################################
+// Second reduction step
 	addq	%rcx,%r10
 	adcq	%rbp,%r11
 
@@ -1802,10 +1802,10 @@
 	adcq	%rcx,%r12
 	adcq	%rbp,%r13
 	adcq	$0,%r8
-	xorq	%r9,%r9
-
-
+	xorq	%r9,%r9  // %r9=0,cf=0,of=0
 
+// #######################################################################
+// Multiply by b2
 	mulxq	0+128(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r10
 	adoxq	%rbp,%r11
@@ -1829,8 +1829,8 @@
 	adoxq	%r9,%r9
 	adcq	$0,%r9
 
-
-
+// #######################################################################
+// Third reduction step
 	addq	%rcx,%r11
 	adcq	%rbp,%r12
 
@@ -1839,10 +1839,10 @@
 	adcq	%rcx,%r13
 	adcq	%rbp,%r8
 	adcq	$0,%r9
-	xorq	%r10,%r10
-
-
+	xorq	%r10,%r10  // %r10=0,cf=0,of=0
 
+// #######################################################################
+// Multiply by b3
 	mulxq	0+128(%rsi),%rcx,%rbp
 	adcxq	%rcx,%r11
 	adoxq	%rbp,%r12
@@ -1866,8 +1866,8 @@
 	adoxq	%r10,%r10
 	adcq	$0,%r10
 
-
-
+// #######################################################################
+// Fourth reduction step
 	addq	%rcx,%r12
 	adcq	%rbp,%r13
 
@@ -1879,15 +1879,15 @@
 	adcq	%rbp,%r9
 	adcq	$0,%r10
 
-
-
+// #######################################################################
+// Branch-less conditional subtraction of P
 	xorl	%eax,%eax
 	movq	%r8,%rcx
-	sbbq	$-1,%r12
-	sbbq	%r14,%r13
-	sbbq	$0,%r8
+	sbbq	$-1,%r12  // .Lpoly0
+	sbbq	%r14,%r13  // .Lpoly1
+	sbbq	$0,%r8  // .Lpoly2
 	movq	%r9,%rbp
-	sbbq	%r15,%r9
+	sbbq	%r15,%r9  // .Lpoly3
 	sbbq	$0,%r10
 
 	cmovcq	%rbx,%r12
@@ -1933,7 +1933,7 @@
 	movq	8(%rsi),%r14
 	movq	16(%rsi),%r15
 	movq	24(%rsi),%r8
-	leaq	-128(%rsi),%rsi
+	leaq	-128(%rsi),%rsi  // control u-op density
 
 	call	__ecp_nistz256_sqr_montx
 
@@ -1960,35 +1960,35 @@
 .align	32
 __ecp_nistz256_sqr_montx:
 .cfi_startproc	
-	mulxq	%r14,%r9,%r10
-	mulxq	%r15,%rcx,%r11
+	mulxq	%r14,%r9,%r10  // a0*a1
+	mulxq	%r15,%rcx,%r11  // a0*a2
 	xorl	%eax,%eax
 	adcq	%rcx,%r10
-	mulxq	%r8,%rbp,%r12
+	mulxq	%r8,%rbp,%r12  // a0*a3
 	movq	%r14,%rdx
 	adcq	%rbp,%r11
 	adcq	$0,%r12
-	xorq	%r13,%r13
+	xorq	%r13,%r13  // %r13=0,cf=0,of=0
 
-
-	mulxq	%r15,%rcx,%rbp
+// ################################
+	mulxq	%r15,%rcx,%rbp  // a1*a2
 	adcxq	%rcx,%r11
 	adoxq	%rbp,%r12
 
-	mulxq	%r8,%rcx,%rbp
+	mulxq	%r8,%rcx,%rbp  // a1*a3
 	movq	%r15,%rdx
 	adcxq	%rcx,%r12
 	adoxq	%rbp,%r13
 	adcq	$0,%r13
 
-
-	mulxq	%r8,%rcx,%r14
+// ################################
+	mulxq	%r8,%rcx,%r14  // a2*a3
 	movq	0+128(%rsi),%rdx
-	xorq	%r15,%r15
-	adcxq	%r9,%r9
+	xorq	%r15,%r15  // %r15=0,cf=0,of=0
+	adcxq	%r9,%r9  // acc1:6<<1
 	adoxq	%rcx,%r13
 	adcxq	%r10,%r10
-	adoxq	%r15,%r14
+	adoxq	%r15,%r14  // of=0
 
 	mulxq	%rdx,%r8,%rbp
 	movq	8+128(%rsi),%rdx
@@ -2017,7 +2017,7 @@
 	shrxq	%rsi,%r8,%rax
 	movq	%rdx,%rbp
 
-
+// reduction step 1
 	addq	%rcx,%r9
 	adcq	%rax,%r10
 
@@ -2027,7 +2027,7 @@
 	adcq	$0,%r8
 	shrxq	%rsi,%r9,%rax
 
-
+// reduction step 2
 	addq	%rcx,%r10
 	adcq	%rax,%r11
 
@@ -2037,7 +2037,7 @@
 	adcq	$0,%r9
 	shrxq	%rsi,%r10,%rax
 
-
+// reduction step 3
 	addq	%rcx,%r11
 	adcq	%rax,%r8
 
@@ -2047,7 +2047,7 @@
 	adcq	$0,%r10
 	shrxq	%rsi,%r11,%rax
 
-
+// reduction step 4
 	addq	%rcx,%r8
 	adcq	%rax,%r9
 
@@ -2056,7 +2056,7 @@
 	adcq	$0,%r11
 
 	xorq	%rdx,%rdx
-	addq	%r8,%r12
+	addq	%r8,%r12  // accumulate upper half
 	movq	.Lpoly+8(%rip),%rsi
 	adcq	%r9,%r13
 	movq	%r12,%r8
@@ -2065,12 +2065,12 @@
 	movq	%r13,%r9
 	adcq	$0,%rdx
 
-	subq	$-1,%r12
+	subq	$-1,%r12  // .Lpoly0
 	movq	%r14,%r10
-	sbbq	%rsi,%r13
-	sbbq	$0,%r14
+	sbbq	%rsi,%r13  // .Lpoly1
+	sbbq	$0,%r14  // .Lpoly2
 	movq	%r15,%r11
-	sbbq	%rbp,%r15
+	sbbq	%rbp,%r15  // .Lpoly3
 	sbbq	$0,%rdx
 
 	cmovcq	%r8,%r12
@@ -2085,8 +2085,8 @@
 	ret
 .cfi_endproc	
 .size	__ecp_nistz256_sqr_montx,.-__ecp_nistz256_sqr_montx
-
-
+// ############################################################################## 
+// void ecp_nistz256_select_w5_nohw(uint64_t *val, uint64_t *in_t, int index);
 .globl	ecp_nistz256_select_w5_nohw
 .hidden ecp_nistz256_select_w5_nohw
 .type	ecp_nistz256_select_w5_nohw,@function
@@ -2149,8 +2149,8 @@
 .LSEH_end_ecp_nistz256_select_w5_nohw:
 .size	ecp_nistz256_select_w5_nohw,.-ecp_nistz256_select_w5_nohw
 
-
-
+// ############################################################################## 
+// void ecp_nistz256_select_w7_nohw(uint64_t *val, uint64_t *in_t, int index);
 .globl	ecp_nistz256_select_w7_nohw
 .hidden ecp_nistz256_select_w7_nohw
 .type	ecp_nistz256_select_w7_nohw,@function
@@ -2201,8 +2201,8 @@
 .cfi_endproc	
 .LSEH_end_ecp_nistz256_select_w7_nohw:
 .size	ecp_nistz256_select_w7_nohw,.-ecp_nistz256_select_w7_nohw
-
-
+// ############################################################################## 
+// void ecp_nistz256_select_w5_avx2(uint64_t *val, uint64_t *in_t, int index);
 .globl	ecp_nistz256_select_w5_avx2
 .hidden ecp_nistz256_select_w5_avx2
 .type	ecp_nistz256_select_w5_avx2,@function
@@ -2267,8 +2267,8 @@
 .LSEH_end_ecp_nistz256_select_w5_avx2:
 .size	ecp_nistz256_select_w5_avx2,.-ecp_nistz256_select_w5_avx2
 
-
-
+// ############################################################################## 
+// void ecp_nistz256_select_w7_avx2(uint64_t *val, uint64_t *in_t, int index);
 .globl	ecp_nistz256_select_w7_avx2
 .hidden ecp_nistz256_select_w7_avx2
 .type	ecp_nistz256_select_w7_avx2,@function
@@ -2288,7 +2288,7 @@
 
 	vmovd	%edx,%xmm1
 	vpermd	%ymm1,%ymm2,%ymm1
-
+// Skip index = 0, because it is implicitly the point at infinity
 
 	movq	$21,%rax
 .Lselect_loop_avx2_w7:
@@ -2448,7 +2448,7 @@
 __ecp_nistz256_mul_by_2q:
 .cfi_startproc	
 	xorq	%r11,%r11
-	addq	%r12,%r12
+	addq	%r12,%r12  // a0:a3+a0:a3
 	adcq	%r13,%r13
 	movq	%r12,%rax
 	adcq	%r8,%r8
@@ -2506,10 +2506,10 @@
 .Lpoint_doubleq_body:
 
 .Lpoint_double_shortcutq:
-	movdqu	0(%rsi),%xmm0
-	movq	%rsi,%rbx
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rsi.x
+	movq	%rsi,%rbx  // backup copy
 	movdqu	16(%rsi),%xmm1
-	movq	32+0(%rsi),%r12
+	movq	32+0(%rsi),%r12  // load in_y in "5-4-0-1" order
 	movq	32+8(%rsi),%r13
 	movq	32+16(%rsi),%r8
 	movq	32+24(%rsi),%r9
@@ -2524,7 +2524,7 @@
 	movq	%r11,%xmm2
 
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_by_2q
+	call	__ecp_nistz256_mul_by_2q  // p256_mul_by_2(S, in_y);
 
 	movq	64+0(%rsi),%rax
 	movq	64+8(%rsi),%r14
@@ -2532,7 +2532,7 @@
 	movq	64+24(%rsi),%r8
 	leaq	64-0(%rsi),%rsi
 	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Zsqr, in_z);
 
 	movq	0+0(%rsp),%rax
 	movq	8+0(%rsp),%r14
@@ -2540,9 +2540,9 @@
 	movq	16+0(%rsp),%r15
 	movq	24+0(%rsp),%r8
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(S, S);
 
-	movq	32(%rbx),%rax
+	movq	32(%rbx),%rax  // %rbx is still valid
 	movq	64+0(%rbx),%r9
 	movq	64+8(%rbx),%r10
 	movq	64+16(%rbx),%r11
@@ -2550,24 +2550,24 @@
 	leaq	64-0(%rbx),%rsi
 	leaq	32(%rbx),%rbx
 	movq	%xmm2,%rdi
-	call	__ecp_nistz256_mul_montq
-	call	__ecp_nistz256_mul_by_2q
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(res_z, in_z, in_y);
+	call	__ecp_nistz256_mul_by_2q  // p256_mul_by_2(res_z, res_z);
 
-	movq	96+0(%rsp),%r12
+	movq	96+0(%rsp),%r12  // "5-4-0-1" order
 	movq	96+8(%rsp),%r13
 	leaq	64(%rsp),%rbx
 	movq	96+16(%rsp),%r8
 	movq	96+24(%rsp),%r9
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_add_toq
+	call	__ecp_nistz256_add_toq  // p256_add(M, in_x, Zsqr);
 
-	movq	96+0(%rsp),%r12
+	movq	96+0(%rsp),%r12  // "5-4-0-1" order
 	movq	96+8(%rsp),%r13
 	leaq	64(%rsp),%rbx
 	movq	96+16(%rsp),%r8
 	movq	96+24(%rsp),%r9
 	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(Zsqr, in_x, Zsqr);
 
 	movq	0+0(%rsp),%rax
 	movq	8+0(%rsp),%r14
@@ -2575,7 +2575,7 @@
 	movq	16+0(%rsp),%r15
 	movq	24+0(%rsp),%r8
 	movq	%xmm1,%rdi
-	call	__ecp_nistz256_sqr_montq
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(res_y, S);
 	xorq	%r9,%r9
 	movq	%r12,%rax
 	addq	$-1,%r12
@@ -2586,7 +2586,7 @@
 	movq	%r15,%r8
 	adcq	%rbp,%r15
 	adcq	$0,%r9
-	xorq	%rsi,%rsi
+	xorq	%rsi,%rsi  // borrow %rsi
 	testq	$1,%rax
 
 	cmovzq	%rax,%r12
@@ -2595,7 +2595,7 @@
 	cmovzq	%r8,%r15
 	cmovzq	%rsi,%r9
 
-	movq	%r13,%rax
+	movq	%r13,%rax  // a0:a3>>1
 	shrq	$1,%r12
 	shlq	$63,%rax
 	movq	%r14,%r10
@@ -2622,14 +2622,14 @@
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(M, M, Zsqr);
 
 	leaq	128(%rsp),%rdi
 	call	__ecp_nistz256_mul_by_2q
 
 	leaq	32(%rsp),%rbx
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_add_toq
+	call	__ecp_nistz256_add_toq  // p256_mul_by_3(M, M);
 
 	movq	96(%rsp),%rax
 	leaq	96(%rsp),%rbx
@@ -2639,10 +2639,10 @@
 	movq	16+0(%rsp),%r11
 	movq	24+0(%rsp),%r12
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S, S, in_x);
 
 	leaq	128(%rsp),%rdi
-	call	__ecp_nistz256_mul_by_2q
+	call	__ecp_nistz256_mul_by_2q  // p256_mul_by_2(tmp0, S);
 
 	movq	0+32(%rsp),%rax
 	movq	8+32(%rsp),%r14
@@ -2650,27 +2650,27 @@
 	movq	16+32(%rsp),%r15
 	movq	24+32(%rsp),%r8
 	movq	%xmm0,%rdi
-	call	__ecp_nistz256_sqr_montq
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(res_x, M);
 
 	leaq	128(%rsp),%rbx
-	movq	%r14,%r8
+	movq	%r14,%r8  // harmonize sqr output and sub input
 	movq	%r15,%r9
 	movq	%rsi,%r14
 	movq	%rbp,%r15
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(res_x, res_x, tmp0);
 
 	movq	0+0(%rsp),%rax
 	movq	0+8(%rsp),%rbp
 	movq	0+16(%rsp),%rcx
-	movq	0+24(%rsp),%r10
+	movq	0+24(%rsp),%r10  // "4-5-0-1" order
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  // p256_sub(S, S, res_x);
 
 	movq	32(%rsp),%rax
 	leaq	32(%rsp),%rbx
-	movq	%r12,%r14
+	movq	%r12,%r14  // harmonize sub output and mul input
 	xorl	%ecx,%ecx
-	movq	%r12,0+0(%rsp)
+	movq	%r12,0+0(%rsp)  // have to save:-(
 	movq	%r13,%r10
 	movq	%r13,0+8(%rsp)
 	cmovzq	%r8,%r11
@@ -2680,11 +2680,11 @@
 	movq	%r9,0+24(%rsp)
 	movq	%r14,%r9
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S, S, M);
 
 	movq	%xmm1,%rbx
 	movq	%xmm1,%rdi
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(res_y, S, res_y);
 
 	leaq	160+56(%rsp),%rsi
 .cfi_def_cfa	%rsi,8
@@ -2735,14 +2735,14 @@
 .cfi_adjust_cfa_offset	32*18+8
 .Lpoint_addq_body:
 
-	movdqu	0(%rsi),%xmm0
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rsi
 	movdqu	16(%rsi),%xmm1
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm3
 	movdqu	64(%rsi),%xmm4
 	movdqu	80(%rsi),%xmm5
-	movq	%rsi,%rbx
-	movq	%rdx,%rsi
+	movq	%rsi,%rbx  // reassign
+	movq	%rdx,%rsi  // reassign
 	movdqa	%xmm0,384(%rsp)
 	movdqa	%xmm1,384+16(%rsp)
 	movdqa	%xmm2,416(%rsp)
@@ -2751,54 +2751,54 @@
 	movdqa	%xmm5,448+16(%rsp)
 	por	%xmm4,%xmm5
 
-	movdqu	0(%rsi),%xmm0
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rbx
 	pshufd	$0xb1,%xmm5,%xmm3
 	movdqu	16(%rsi),%xmm1
 	movdqu	32(%rsi),%xmm2
 	por	%xmm3,%xmm5
 	movdqu	48(%rsi),%xmm3
-	movq	64+0(%rsi),%rax
+	movq	64+0(%rsi),%rax  // load original in2_z
 	movq	64+8(%rsi),%r14
 	movq	64+16(%rsi),%r15
 	movq	64+24(%rsi),%r8
 	movdqa	%xmm0,480(%rsp)
 	pshufd	$0x1e,%xmm5,%xmm4
 	movdqa	%xmm1,480+16(%rsp)
-	movdqu	64(%rsi),%xmm0
+	movdqu	64(%rsi),%xmm0  // in2_z again
 	movdqu	80(%rsi),%xmm1
 	movdqa	%xmm2,512(%rsp)
 	movdqa	%xmm3,512+16(%rsp)
 	por	%xmm4,%xmm5
 	pxor	%xmm4,%xmm4
 	por	%xmm0,%xmm1
-	movq	%rdi,%xmm0
+	movq	%rdi,%xmm0  // save %rdi
 
-	leaq	64-0(%rsi),%rsi
-	movq	%rax,544+0(%rsp)
+	leaq	64-0(%rsi),%rsi  // %rsi is still valid
+	movq	%rax,544+0(%rsp)  // make in2_z copy
 	movq	%r14,544+8(%rsp)
 	movq	%r15,544+16(%rsp)
 	movq	%r8,544+24(%rsp)
-	leaq	96(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	96(%rsp),%rdi  // Z2^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Z2sqr, in2_z);
 
 	pcmpeqd	%xmm4,%xmm5
 	pshufd	$0xb1,%xmm1,%xmm4
 	por	%xmm1,%xmm4
-	pshufd	$0,%xmm5,%xmm5
+	pshufd	$0,%xmm5,%xmm5  // in1infty
 	pshufd	$0x1e,%xmm4,%xmm3
 	por	%xmm3,%xmm4
 	pxor	%xmm3,%xmm3
 	pcmpeqd	%xmm3,%xmm4
-	pshufd	$0,%xmm4,%xmm4
-	movq	64+0(%rbx),%rax
+	pshufd	$0,%xmm4,%xmm4  // in2infty
+	movq	64+0(%rbx),%rax  // load original in1_z
 	movq	64+8(%rbx),%r14
 	movq	64+16(%rbx),%r15
 	movq	64+24(%rbx),%r8
 	movq	%rbx,%xmm1
 
 	leaq	64-0(%rbx),%rsi
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	32(%rsp),%rdi  // Z1^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Z1sqr, in1_z);
 
 	movq	544(%rsp),%rax
 	leaq	544(%rsp),%rbx
@@ -2807,8 +2807,8 @@
 	leaq	0+96(%rsp),%rsi
 	movq	16+96(%rsp),%r11
 	movq	24+96(%rsp),%r12
-	leaq	224(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	224(%rsp),%rdi  // S1 = Z2^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S1, Z2sqr, in2_z);
 
 	movq	448(%rsp),%rax
 	leaq	448(%rsp),%rbx
@@ -2817,8 +2817,8 @@
 	leaq	0+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	256(%rsp),%rdi  // S2 = Z1^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S2, Z1sqr, in1_z);
 
 	movq	416(%rsp),%rax
 	leaq	416(%rsp),%rbx
@@ -2827,8 +2827,8 @@
 	leaq	0+224(%rsp),%rsi
 	movq	16+224(%rsp),%r11
 	movq	24+224(%rsp),%r12
-	leaq	224(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	224(%rsp),%rdi  // S1 = Y1*Z2^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S1, S1, in1_y);
 
 	movq	512(%rsp),%rax
 	leaq	512(%rsp),%rbx
@@ -2837,18 +2837,18 @@
 	leaq	0+256(%rsp),%rsi
 	movq	16+256(%rsp),%r11
 	movq	24+256(%rsp),%r12
-	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	256(%rsp),%rdi  // S2 = Y2*Z1^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S2, S2, in2_y);
 
 	leaq	224(%rsp),%rbx
-	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	leaq	64(%rsp),%rdi  // R = S2 - S1
+	call	__ecp_nistz256_sub_fromq  // p256_sub(R, S2, S1);
 
-	orq	%r13,%r12
+	orq	%r13,%r12  // see if result is zero
 	movdqa	%xmm4,%xmm2
 	orq	%r8,%r12
 	orq	%r9,%r12
-	por	%xmm5,%xmm2
+	por	%xmm5,%xmm2  // in1infty || in2infty
 	movq	%r12,%xmm3
 
 	movq	384(%rsp),%rax
@@ -2858,8 +2858,8 @@
 	leaq	0+96(%rsp),%rsi
 	movq	16+96(%rsp),%r11
 	movq	24+96(%rsp),%r12
-	leaq	160(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	160(%rsp),%rdi  // U1 = X1*Z2^2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(U1, in1_x, Z2sqr);
 
 	movq	480(%rsp),%rax
 	leaq	480(%rsp),%rbx
@@ -2868,34 +2868,34 @@
 	leaq	0+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	192(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	192(%rsp),%rdi  // U2 = X2*Z1^2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(U2, in2_x, Z1sqr);
 
 	leaq	160(%rsp),%rbx
-	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	leaq	0(%rsp),%rdi  // H = U2 - U1
+	call	__ecp_nistz256_sub_fromq  // p256_sub(H, U2, U1);
 
-	orq	%r13,%r12
+	orq	%r13,%r12  // see if result is zero
 	orq	%r8,%r12
-	orq	%r9,%r12
+	orq	%r9,%r12  // 
 
 	movq	%xmm2,%r8
 	movq	%xmm3,%r9
 	orq	%r8,%r12
-.byte	0x3e
-	jnz	.Ladd_proceedq
-
-
+.byte	0x3e  // predict taken
+	jnz	.Ladd_proceedq  // 
 
+// We now know A = B or A = -B and neither is infinity. Compare the
+// y-coordinates via S1 and S2.
 	testq	%r9,%r9
-	jz	.Ladd_doubleq
-
-
-
-
-
-
-	movq	%xmm0,%rdi
+	jz	.Ladd_doubleq  // is_equal(S1, S2)
+
+// A = -B, so the result is infinity.
+// 
+// TODO(davidben): Does .Ladd_proceed handle this case? It seems to, in
+// which case we should eliminate this special-case and simplify the
+// timing analysis.
+	movq	%xmm0,%rdi  // restore %rdi
 	pxor	%xmm0,%xmm0
 	movdqu	%xmm0,0(%rdi)
 	movdqu	%xmm0,16(%rdi)
@@ -2907,9 +2907,9 @@
 
 .align	32
 .Ladd_doubleq:
-	movq	%xmm1,%rsi
-	movq	%xmm0,%rdi
-	addq	$416,%rsp
+	movq	%xmm1,%rsi  // restore %rsi
+	movq	%xmm0,%rdi  // restore %rdi
+	addq	$416,%rsp  // difference in frame sizes
 .cfi_adjust_cfa_offset	-416
 	jmp	.Lpoint_double_shortcutq
 .cfi_adjust_cfa_offset	416
@@ -2921,8 +2921,8 @@
 	leaq	0+64(%rsp),%rsi
 	movq	16+64(%rsp),%r15
 	movq	24+64(%rsp),%r8
-	leaq	96(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	96(%rsp),%rdi  // R^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Rsqr, R);
 
 	movq	448(%rsp),%rax
 	leaq	448(%rsp),%rbx
@@ -2931,16 +2931,16 @@
 	leaq	0+0(%rsp),%rsi
 	movq	16+0(%rsp),%r11
 	movq	24+0(%rsp),%r12
-	leaq	352(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	352(%rsp),%rdi  // Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(res_z, H, in1_z);
 
 	movq	0+0(%rsp),%rax
 	movq	8+0(%rsp),%r14
 	leaq	0+0(%rsp),%rsi
 	movq	16+0(%rsp),%r15
 	movq	24+0(%rsp),%r8
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	32(%rsp),%rdi  // H^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Hsqr, H);
 
 	movq	544(%rsp),%rax
 	leaq	544(%rsp),%rbx
@@ -2949,8 +2949,8 @@
 	leaq	0+352(%rsp),%rsi
 	movq	16+352(%rsp),%r11
 	movq	24+352(%rsp),%r12
-	leaq	352(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	352(%rsp),%rdi  // Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(res_z, res_z, in2_z);
 
 	movq	0(%rsp),%rax
 	leaq	0(%rsp),%rbx
@@ -2959,8 +2959,8 @@
 	leaq	0+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	128(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	128(%rsp),%rdi  // H^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(Hcub, Hsqr, H);
 
 	movq	160(%rsp),%rax
 	leaq	160(%rsp),%rbx
@@ -2969,14 +2969,14 @@
 	leaq	0+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	192(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
-
-
-
+	leaq	192(%rsp),%rdi  // U1*H^2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(U2, U1, Hsqr);
+// lea	192(%rsp), %rsi
+// lea	32(%rsp), %rdi	# 2*U1*H^2
+// call	__ecp_nistz256_mul_by_2	# ecp_nistz256_mul_by_2(Hsqr, U2);
 
 	xorq	%r11,%r11
-	addq	%r12,%r12
+	addq	%r12,%r12  // a0:a3+a0:a3
 	leaq	96(%rsp),%rsi
 	adcq	%r13,%r13
 	movq	%r12,%rax
@@ -3002,11 +3002,11 @@
 	cmovcq	%r10,%r9
 	movq	24(%rsi),%r10
 
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  // p256_sub(res_x, Rsqr, Hsqr);
 
 	leaq	128(%rsp),%rbx
 	leaq	288(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(res_x, res_x, Hcub);
 
 	movq	192+0(%rsp),%rax
 	movq	192+8(%rsp),%rbp
@@ -3014,10 +3014,10 @@
 	movq	192+24(%rsp),%r10
 	leaq	320(%rsp),%rdi
 
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  // p256_sub(res_y, U2, res_x);
 
-	movq	%r12,0(%rdi)
-	movq	%r13,8(%rdi)
+	movq	%r12,0(%rdi)  // save the result, as
+	movq	%r13,8(%rdi)  // __ecp_nistz256_sub doesn't
 	movq	%r8,16(%rdi)
 	movq	%r9,24(%rdi)
 	movq	128(%rsp),%rax
@@ -3028,7 +3028,7 @@
 	movq	16+224(%rsp),%r11
 	movq	24+224(%rsp),%r12
 	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S2, S1, Hcub);
 
 	movq	320(%rsp),%rax
 	leaq	320(%rsp),%rbx
@@ -3038,15 +3038,15 @@
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
 	leaq	320(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(res_y, R, res_y);
 
 	leaq	256(%rsp),%rbx
 	leaq	320(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(res_y, res_y, S2);
 
-	movq	%xmm0,%rdi
+	movq	%xmm0,%rdi  // restore %rdi
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_z, in2_z, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	352(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -3057,7 +3057,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_z, in1_z, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -3070,7 +3070,7 @@
 	movdqu	%xmm2,64(%rdi)
 	movdqu	%xmm3,80(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_x, in2_x, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	288(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -3081,7 +3081,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_x, in1_x, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -3094,7 +3094,7 @@
 	movdqu	%xmm2,0(%rdi)
 	movdqu	%xmm3,16(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_y, in2_y, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	320(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -3105,7 +3105,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_y, in1_y, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -3168,14 +3168,14 @@
 .cfi_adjust_cfa_offset	32*15+8
 .Ladd_affineq_body:
 
-	movdqu	0(%rsi),%xmm0
-	movq	%rdx,%rbx
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rsi
+	movq	%rdx,%rbx  // reassign
 	movdqu	16(%rsi),%xmm1
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm3
 	movdqu	64(%rsi),%xmm4
 	movdqu	80(%rsi),%xmm5
-	movq	64+0(%rsi),%rax
+	movq	64+0(%rsi),%rax  // load original in1_z
 	movq	64+8(%rsi),%r14
 	movq	64+16(%rsi),%r15
 	movq	64+24(%rsi),%r8
@@ -3187,7 +3187,7 @@
 	movdqa	%xmm5,384+16(%rsp)
 	por	%xmm4,%xmm5
 
-	movdqu	0(%rbx),%xmm0
+	movdqu	0(%rbx),%xmm0  // copy	*(P256_POINT_AFFINE *)%rbx
 	pshufd	$0xb1,%xmm5,%xmm3
 	movdqu	16(%rbx),%xmm1
 	movdqu	32(%rbx),%xmm2
@@ -3197,7 +3197,7 @@
 	pshufd	$0x1e,%xmm5,%xmm4
 	movdqa	%xmm1,416+16(%rsp)
 	por	%xmm0,%xmm1
-	movq	%rdi,%xmm0
+	movq	%rdi,%xmm0  // save %rdi
 	movdqa	%xmm2,448(%rsp)
 	movdqa	%xmm3,448+16(%rsp)
 	por	%xmm2,%xmm3
@@ -3205,33 +3205,33 @@
 	pxor	%xmm4,%xmm4
 	por	%xmm1,%xmm3
 
-	leaq	64-0(%rsi),%rsi
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	64-0(%rsi),%rsi  // %rsi is still valid
+	leaq	32(%rsp),%rdi  // Z1^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Z1sqr, in1_z);
 
 	pcmpeqd	%xmm4,%xmm5
 	pshufd	$0xb1,%xmm3,%xmm4
-	movq	0(%rbx),%rax
-
-	movq	%r12,%r9
+	movq	0(%rbx),%rax  // %rbx is still valid
+// lea	0x00(%rbx), %rbx
+	movq	%r12,%r9  // harmonize sqr output and mul input
 	por	%xmm3,%xmm4
-	pshufd	$0,%xmm5,%xmm5
+	pshufd	$0,%xmm5,%xmm5  // in1infty
 	pshufd	$0x1e,%xmm4,%xmm3
 	movq	%r13,%r10
 	por	%xmm3,%xmm4
 	pxor	%xmm3,%xmm3
 	movq	%r14,%r11
 	pcmpeqd	%xmm3,%xmm4
-	pshufd	$0,%xmm4,%xmm4
+	pshufd	$0,%xmm4,%xmm4  // in2infty
 
 	leaq	32-0(%rsp),%rsi
 	movq	%r15,%r12
-	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	0(%rsp),%rdi  // U2 = X2*Z1^2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(U2, Z1sqr, in2_x);
 
 	leaq	320(%rsp),%rbx
-	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	leaq	64(%rsp),%rdi  // H = U2 - U1
+	call	__ecp_nistz256_sub_fromq  // p256_sub(H, U2, in1_x);
 
 	movq	384(%rsp),%rax
 	leaq	384(%rsp),%rbx
@@ -3240,8 +3240,8 @@
 	leaq	0+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	32(%rsp),%rdi  // S2 = Z1^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S2, Z1sqr, in1_z);
 
 	movq	384(%rsp),%rax
 	leaq	384(%rsp),%rbx
@@ -3250,8 +3250,8 @@
 	leaq	0+64(%rsp),%rsi
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
-	leaq	288(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	288(%rsp),%rdi  // Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(res_z, H, in1_z);
 
 	movq	448(%rsp),%rax
 	leaq	448(%rsp),%rbx
@@ -3260,28 +3260,28 @@
 	leaq	0+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	32(%rsp),%rdi  // S2 = Y2*Z1^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S2, S2, in2_y);
 
 	leaq	352(%rsp),%rbx
-	leaq	96(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	leaq	96(%rsp),%rdi  // R = S2 - S1
+	call	__ecp_nistz256_sub_fromq  // p256_sub(R, S2, in1_y);
 
 	movq	0+64(%rsp),%rax
 	movq	8+64(%rsp),%r14
 	leaq	0+64(%rsp),%rsi
 	movq	16+64(%rsp),%r15
 	movq	24+64(%rsp),%r8
-	leaq	128(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	128(%rsp),%rdi  // H^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Hsqr, H);
 
 	movq	0+96(%rsp),%rax
 	movq	8+96(%rsp),%r14
 	leaq	0+96(%rsp),%rsi
 	movq	16+96(%rsp),%r15
 	movq	24+96(%rsp),%r8
-	leaq	192(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montq
+	leaq	192(%rsp),%rdi  // R^2
+	call	__ecp_nistz256_sqr_montq  // p256_sqr_mont(Rsqr, R);
 
 	movq	128(%rsp),%rax
 	leaq	128(%rsp),%rbx
@@ -3290,8 +3290,8 @@
 	leaq	0+64(%rsp),%rsi
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
-	leaq	160(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	leaq	160(%rsp),%rdi  // H^3
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(Hcub, Hsqr, H);
 
 	movq	320(%rsp),%rax
 	leaq	320(%rsp),%rbx
@@ -3300,14 +3300,14 @@
 	leaq	0+128(%rsp),%rsi
 	movq	16+128(%rsp),%r11
 	movq	24+128(%rsp),%r12
-	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
-
-
-
+	leaq	0(%rsp),%rdi  // U1*H^2
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(U2, in1_x, Hsqr);
+// lea	0(%rsp), %rsi
+// lea	128(%rsp), %rdi	# 2*U1*H^2
+// call	__ecp_nistz256_mul_by_2	# ecp_nistz256_mul_by_2(Hsqr, U2);
 
 	xorq	%r11,%r11
-	addq	%r12,%r12
+	addq	%r12,%r12  // a0:a3+a0:a3
 	leaq	192(%rsp),%rsi
 	adcq	%r13,%r13
 	movq	%r12,%rax
@@ -3333,11 +3333,11 @@
 	cmovcq	%r10,%r9
 	movq	24(%rsi),%r10
 
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  // p256_sub(res_x, Rsqr, Hsqr);
 
 	leaq	160(%rsp),%rbx
 	leaq	224(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(res_x, res_x, Hcub);
 
 	movq	0+0(%rsp),%rax
 	movq	0+8(%rsp),%rbp
@@ -3345,10 +3345,10 @@
 	movq	0+24(%rsp),%r10
 	leaq	64(%rsp),%rdi
 
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  // p256_sub(H, U2, res_x);
 
-	movq	%r12,0(%rdi)
-	movq	%r13,8(%rdi)
+	movq	%r12,0(%rdi)  // save the result, as
+	movq	%r13,8(%rdi)  // __ecp_nistz256_sub doesn't
 	movq	%r8,16(%rdi)
 	movq	%r9,24(%rdi)
 	movq	352(%rsp),%rax
@@ -3359,7 +3359,7 @@
 	movq	16+160(%rsp),%r11
 	movq	24+160(%rsp),%r12
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(S2, Hcub, in1_y);
 
 	movq	96(%rsp),%rax
 	leaq	96(%rsp),%rbx
@@ -3369,15 +3369,15 @@
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
 	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  // p256_mul_mont(H, H, R);
 
 	leaq	32(%rsp),%rbx
 	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  // p256_sub(res_y, H, S2);
 
-	movq	%xmm0,%rdi
+	movq	%xmm0,%rdi  // restore %rdi
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_z, ONE, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	288(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -3388,7 +3388,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_z, in1_z, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -3401,7 +3401,7 @@
 	movdqu	%xmm2,64(%rdi)
 	movdqu	%xmm3,80(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_x, in2_x, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	224(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -3412,7 +3412,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_x, in1_x, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -3425,7 +3425,7 @@
 	movdqu	%xmm2,0(%rdi)
 	movdqu	%xmm3,16(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_y, in2_y, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	256(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -3436,7 +3436,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_y, in1_y, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -3575,7 +3575,7 @@
 __ecp_nistz256_mul_by_2x:
 .cfi_startproc	
 	xorq	%r11,%r11
-	adcq	%r12,%r12
+	adcq	%r12,%r12  // a0:a3+a0:a3
 	adcq	%r13,%r13
 	movq	%r12,%rax
 	adcq	%r8,%r8
@@ -3634,10 +3634,10 @@
 .Lpoint_doublex_body:
 
 .Lpoint_double_shortcutx:
-	movdqu	0(%rsi),%xmm0
-	movq	%rsi,%rbx
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rsi.x
+	movq	%rsi,%rbx  // backup copy
 	movdqu	16(%rsi),%xmm1
-	movq	32+0(%rsi),%r12
+	movq	32+0(%rsi),%r12  // load in_y in "5-4-0-1" order
 	movq	32+8(%rsi),%r13
 	movq	32+16(%rsi),%r8
 	movq	32+24(%rsi),%r9
@@ -3652,7 +3652,7 @@
 	movq	%r11,%xmm2
 
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_by_2x
+	call	__ecp_nistz256_mul_by_2x  // p256_mul_by_2(S, in_y);
 
 	movq	64+0(%rsi),%rdx
 	movq	64+8(%rsi),%r14
@@ -3660,7 +3660,7 @@
 	movq	64+24(%rsi),%r8
 	leaq	64-128(%rsi),%rsi
 	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Zsqr, in_z);
 
 	movq	0+0(%rsp),%rdx
 	movq	8+0(%rsp),%r14
@@ -3668,9 +3668,9 @@
 	movq	16+0(%rsp),%r15
 	movq	24+0(%rsp),%r8
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(S, S);
 
-	movq	32(%rbx),%rdx
+	movq	32(%rbx),%rdx  // %rbx is still valid
 	movq	64+0(%rbx),%r9
 	movq	64+8(%rbx),%r10
 	movq	64+16(%rbx),%r11
@@ -3678,24 +3678,24 @@
 	leaq	64-128(%rbx),%rsi
 	leaq	32(%rbx),%rbx
 	movq	%xmm2,%rdi
-	call	__ecp_nistz256_mul_montx
-	call	__ecp_nistz256_mul_by_2x
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(res_z, in_z, in_y);
+	call	__ecp_nistz256_mul_by_2x  // p256_mul_by_2(res_z, res_z);
 
-	movq	96+0(%rsp),%r12
+	movq	96+0(%rsp),%r12  // "5-4-0-1" order
 	movq	96+8(%rsp),%r13
 	leaq	64(%rsp),%rbx
 	movq	96+16(%rsp),%r8
 	movq	96+24(%rsp),%r9
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_add_tox
+	call	__ecp_nistz256_add_tox  // p256_add(M, in_x, Zsqr);
 
-	movq	96+0(%rsp),%r12
+	movq	96+0(%rsp),%r12  // "5-4-0-1" order
 	movq	96+8(%rsp),%r13
 	leaq	64(%rsp),%rbx
 	movq	96+16(%rsp),%r8
 	movq	96+24(%rsp),%r9
 	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(Zsqr, in_x, Zsqr);
 
 	movq	0+0(%rsp),%rdx
 	movq	8+0(%rsp),%r14
@@ -3703,7 +3703,7 @@
 	movq	16+0(%rsp),%r15
 	movq	24+0(%rsp),%r8
 	movq	%xmm1,%rdi
-	call	__ecp_nistz256_sqr_montx
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(res_y, S);
 	xorq	%r9,%r9
 	movq	%r12,%rax
 	addq	$-1,%r12
@@ -3714,7 +3714,7 @@
 	movq	%r15,%r8
 	adcq	%rbp,%r15
 	adcq	$0,%r9
-	xorq	%rsi,%rsi
+	xorq	%rsi,%rsi  // borrow %rsi
 	testq	$1,%rax
 
 	cmovzq	%rax,%r12
@@ -3723,7 +3723,7 @@
 	cmovzq	%r8,%r15
 	cmovzq	%rsi,%r9
 
-	movq	%r13,%rax
+	movq	%r13,%rax  // a0:a3>>1
 	shrq	$1,%r12
 	shlq	$63,%rax
 	movq	%r14,%r10
@@ -3750,14 +3750,14 @@
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(M, M, Zsqr);
 
 	leaq	128(%rsp),%rdi
 	call	__ecp_nistz256_mul_by_2x
 
 	leaq	32(%rsp),%rbx
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_add_tox
+	call	__ecp_nistz256_add_tox  // p256_mul_by_3(M, M);
 
 	movq	96(%rsp),%rdx
 	leaq	96(%rsp),%rbx
@@ -3767,10 +3767,10 @@
 	movq	16+0(%rsp),%r11
 	movq	24+0(%rsp),%r12
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S, S, in_x);
 
 	leaq	128(%rsp),%rdi
-	call	__ecp_nistz256_mul_by_2x
+	call	__ecp_nistz256_mul_by_2x  // p256_mul_by_2(tmp0, S);
 
 	movq	0+32(%rsp),%rdx
 	movq	8+32(%rsp),%r14
@@ -3778,27 +3778,27 @@
 	movq	16+32(%rsp),%r15
 	movq	24+32(%rsp),%r8
 	movq	%xmm0,%rdi
-	call	__ecp_nistz256_sqr_montx
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(res_x, M);
 
 	leaq	128(%rsp),%rbx
-	movq	%r14,%r8
+	movq	%r14,%r8  // harmonize sqr output and sub input
 	movq	%r15,%r9
 	movq	%rsi,%r14
 	movq	%rbp,%r15
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(res_x, res_x, tmp0);
 
 	movq	0+0(%rsp),%rax
 	movq	0+8(%rsp),%rbp
 	movq	0+16(%rsp),%rcx
-	movq	0+24(%rsp),%r10
+	movq	0+24(%rsp),%r10  // "4-5-0-1" order
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  // p256_sub(S, S, res_x);
 
 	movq	32(%rsp),%rdx
 	leaq	32(%rsp),%rbx
-	movq	%r12,%r14
+	movq	%r12,%r14  // harmonize sub output and mul input
 	xorl	%ecx,%ecx
-	movq	%r12,0+0(%rsp)
+	movq	%r12,0+0(%rsp)  // have to save:-(
 	movq	%r13,%r10
 	movq	%r13,0+8(%rsp)
 	cmovzq	%r8,%r11
@@ -3808,11 +3808,11 @@
 	movq	%r9,0+24(%rsp)
 	movq	%r14,%r9
 	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S, S, M);
 
 	movq	%xmm1,%rbx
 	movq	%xmm1,%rdi
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(res_y, S, res_y);
 
 	leaq	160+56(%rsp),%rsi
 .cfi_def_cfa	%rsi,8
@@ -3863,14 +3863,14 @@
 .cfi_adjust_cfa_offset	32*18+8
 .Lpoint_addx_body:
 
-	movdqu	0(%rsi),%xmm0
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rsi
 	movdqu	16(%rsi),%xmm1
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm3
 	movdqu	64(%rsi),%xmm4
 	movdqu	80(%rsi),%xmm5
-	movq	%rsi,%rbx
-	movq	%rdx,%rsi
+	movq	%rsi,%rbx  // reassign
+	movq	%rdx,%rsi  // reassign
 	movdqa	%xmm0,384(%rsp)
 	movdqa	%xmm1,384+16(%rsp)
 	movdqa	%xmm2,416(%rsp)
@@ -3879,54 +3879,54 @@
 	movdqa	%xmm5,448+16(%rsp)
 	por	%xmm4,%xmm5
 
-	movdqu	0(%rsi),%xmm0
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rbx
 	pshufd	$0xb1,%xmm5,%xmm3
 	movdqu	16(%rsi),%xmm1
 	movdqu	32(%rsi),%xmm2
 	por	%xmm3,%xmm5
 	movdqu	48(%rsi),%xmm3
-	movq	64+0(%rsi),%rdx
+	movq	64+0(%rsi),%rdx  // load original in2_z
 	movq	64+8(%rsi),%r14
 	movq	64+16(%rsi),%r15
 	movq	64+24(%rsi),%r8
 	movdqa	%xmm0,480(%rsp)
 	pshufd	$0x1e,%xmm5,%xmm4
 	movdqa	%xmm1,480+16(%rsp)
-	movdqu	64(%rsi),%xmm0
+	movdqu	64(%rsi),%xmm0  // in2_z again
 	movdqu	80(%rsi),%xmm1
 	movdqa	%xmm2,512(%rsp)
 	movdqa	%xmm3,512+16(%rsp)
 	por	%xmm4,%xmm5
 	pxor	%xmm4,%xmm4
 	por	%xmm0,%xmm1
-	movq	%rdi,%xmm0
+	movq	%rdi,%xmm0  // save %rdi
 
-	leaq	64-128(%rsi),%rsi
-	movq	%rdx,544+0(%rsp)
+	leaq	64-128(%rsi),%rsi  // %rsi is still valid
+	movq	%rdx,544+0(%rsp)  // make in2_z copy
 	movq	%r14,544+8(%rsp)
 	movq	%r15,544+16(%rsp)
 	movq	%r8,544+24(%rsp)
-	leaq	96(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	96(%rsp),%rdi  // Z2^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Z2sqr, in2_z);
 
 	pcmpeqd	%xmm4,%xmm5
 	pshufd	$0xb1,%xmm1,%xmm4
 	por	%xmm1,%xmm4
-	pshufd	$0,%xmm5,%xmm5
+	pshufd	$0,%xmm5,%xmm5  // in1infty
 	pshufd	$0x1e,%xmm4,%xmm3
 	por	%xmm3,%xmm4
 	pxor	%xmm3,%xmm3
 	pcmpeqd	%xmm3,%xmm4
-	pshufd	$0,%xmm4,%xmm4
-	movq	64+0(%rbx),%rdx
+	pshufd	$0,%xmm4,%xmm4  // in2infty
+	movq	64+0(%rbx),%rdx  // load original in1_z
 	movq	64+8(%rbx),%r14
 	movq	64+16(%rbx),%r15
 	movq	64+24(%rbx),%r8
 	movq	%rbx,%xmm1
 
 	leaq	64-128(%rbx),%rsi
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	32(%rsp),%rdi  // Z1^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Z1sqr, in1_z);
 
 	movq	544(%rsp),%rdx
 	leaq	544(%rsp),%rbx
@@ -3935,8 +3935,8 @@
 	leaq	-128+96(%rsp),%rsi
 	movq	16+96(%rsp),%r11
 	movq	24+96(%rsp),%r12
-	leaq	224(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	224(%rsp),%rdi  // S1 = Z2^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S1, Z2sqr, in2_z);
 
 	movq	448(%rsp),%rdx
 	leaq	448(%rsp),%rbx
@@ -3945,8 +3945,8 @@
 	leaq	-128+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	256(%rsp),%rdi  // S2 = Z1^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S2, Z1sqr, in1_z);
 
 	movq	416(%rsp),%rdx
 	leaq	416(%rsp),%rbx
@@ -3955,8 +3955,8 @@
 	leaq	-128+224(%rsp),%rsi
 	movq	16+224(%rsp),%r11
 	movq	24+224(%rsp),%r12
-	leaq	224(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	224(%rsp),%rdi  // S1 = Y1*Z2^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S1, S1, in1_y);
 
 	movq	512(%rsp),%rdx
 	leaq	512(%rsp),%rbx
@@ -3965,18 +3965,18 @@
 	leaq	-128+256(%rsp),%rsi
 	movq	16+256(%rsp),%r11
 	movq	24+256(%rsp),%r12
-	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	256(%rsp),%rdi  // S2 = Y2*Z1^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S2, S2, in2_y);
 
 	leaq	224(%rsp),%rbx
-	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	leaq	64(%rsp),%rdi  // R = S2 - S1
+	call	__ecp_nistz256_sub_fromx  // p256_sub(R, S2, S1);
 
-	orq	%r13,%r12
+	orq	%r13,%r12  // see if result is zero
 	movdqa	%xmm4,%xmm2
 	orq	%r8,%r12
 	orq	%r9,%r12
-	por	%xmm5,%xmm2
+	por	%xmm5,%xmm2  // in1infty || in2infty
 	movq	%r12,%xmm3
 
 	movq	384(%rsp),%rdx
@@ -3986,8 +3986,8 @@
 	leaq	-128+96(%rsp),%rsi
 	movq	16+96(%rsp),%r11
 	movq	24+96(%rsp),%r12
-	leaq	160(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	160(%rsp),%rdi  // U1 = X1*Z2^2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(U1, in1_x, Z2sqr);
 
 	movq	480(%rsp),%rdx
 	leaq	480(%rsp),%rbx
@@ -3996,34 +3996,34 @@
 	leaq	-128+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	192(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	192(%rsp),%rdi  // U2 = X2*Z1^2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(U2, in2_x, Z1sqr);
 
 	leaq	160(%rsp),%rbx
-	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	leaq	0(%rsp),%rdi  // H = U2 - U1
+	call	__ecp_nistz256_sub_fromx  // p256_sub(H, U2, U1);
 
-	orq	%r13,%r12
+	orq	%r13,%r12  // see if result is zero
 	orq	%r8,%r12
-	orq	%r9,%r12
+	orq	%r9,%r12  // 
 
 	movq	%xmm2,%r8
 	movq	%xmm3,%r9
 	orq	%r8,%r12
-.byte	0x3e
-	jnz	.Ladd_proceedx
-
-
+.byte	0x3e  // predict taken
+	jnz	.Ladd_proceedx  // 
 
+// We now know A = B or A = -B and neither is infinity. Compare the
+// y-coordinates via S1 and S2.
 	testq	%r9,%r9
-	jz	.Ladd_doublex
-
-
-
-
-
-
-	movq	%xmm0,%rdi
+	jz	.Ladd_doublex  // is_equal(S1, S2)
+
+// A = -B, so the result is infinity.
+// 
+// TODO(davidben): Does .Ladd_proceed handle this case? It seems to, in
+// which case we should eliminate this special-case and simplify the
+// timing analysis.
+	movq	%xmm0,%rdi  // restore %rdi
 	pxor	%xmm0,%xmm0
 	movdqu	%xmm0,0(%rdi)
 	movdqu	%xmm0,16(%rdi)
@@ -4035,9 +4035,9 @@
 
 .align	32
 .Ladd_doublex:
-	movq	%xmm1,%rsi
-	movq	%xmm0,%rdi
-	addq	$416,%rsp
+	movq	%xmm1,%rsi  // restore %rsi
+	movq	%xmm0,%rdi  // restore %rdi
+	addq	$416,%rsp  // difference in frame sizes
 .cfi_adjust_cfa_offset	-416
 	jmp	.Lpoint_double_shortcutx
 .cfi_adjust_cfa_offset	416
@@ -4049,8 +4049,8 @@
 	leaq	-128+64(%rsp),%rsi
 	movq	16+64(%rsp),%r15
 	movq	24+64(%rsp),%r8
-	leaq	96(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	96(%rsp),%rdi  // R^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Rsqr, R);
 
 	movq	448(%rsp),%rdx
 	leaq	448(%rsp),%rbx
@@ -4059,16 +4059,16 @@
 	leaq	-128+0(%rsp),%rsi
 	movq	16+0(%rsp),%r11
 	movq	24+0(%rsp),%r12
-	leaq	352(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	352(%rsp),%rdi  // Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(res_z, H, in1_z);
 
 	movq	0+0(%rsp),%rdx
 	movq	8+0(%rsp),%r14
 	leaq	-128+0(%rsp),%rsi
 	movq	16+0(%rsp),%r15
 	movq	24+0(%rsp),%r8
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	32(%rsp),%rdi  // H^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Hsqr, H);
 
 	movq	544(%rsp),%rdx
 	leaq	544(%rsp),%rbx
@@ -4077,8 +4077,8 @@
 	leaq	-128+352(%rsp),%rsi
 	movq	16+352(%rsp),%r11
 	movq	24+352(%rsp),%r12
-	leaq	352(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	352(%rsp),%rdi  // Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(res_z, res_z, in2_z);
 
 	movq	0(%rsp),%rdx
 	leaq	0(%rsp),%rbx
@@ -4087,8 +4087,8 @@
 	leaq	-128+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	128(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	128(%rsp),%rdi  // H^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(Hcub, Hsqr, H);
 
 	movq	160(%rsp),%rdx
 	leaq	160(%rsp),%rbx
@@ -4097,14 +4097,14 @@
 	leaq	-128+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	192(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
-
-
-
+	leaq	192(%rsp),%rdi  // U1*H^2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(U2, U1, Hsqr);
+// lea	192(%rsp), %rsi
+// lea	32(%rsp), %rdi	# 2*U1*H^2
+// call	__ecp_nistz256_mul_by_2	# ecp_nistz256_mul_by_2(Hsqr, U2);
 
 	xorq	%r11,%r11
-	addq	%r12,%r12
+	addq	%r12,%r12  // a0:a3+a0:a3
 	leaq	96(%rsp),%rsi
 	adcq	%r13,%r13
 	movq	%r12,%rax
@@ -4130,11 +4130,11 @@
 	cmovcq	%r10,%r9
 	movq	24(%rsi),%r10
 
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  // p256_sub(res_x, Rsqr, Hsqr);
 
 	leaq	128(%rsp),%rbx
 	leaq	288(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(res_x, res_x, Hcub);
 
 	movq	192+0(%rsp),%rax
 	movq	192+8(%rsp),%rbp
@@ -4142,10 +4142,10 @@
 	movq	192+24(%rsp),%r10
 	leaq	320(%rsp),%rdi
 
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  // p256_sub(res_y, U2, res_x);
 
-	movq	%r12,0(%rdi)
-	movq	%r13,8(%rdi)
+	movq	%r12,0(%rdi)  // save the result, as
+	movq	%r13,8(%rdi)  // __ecp_nistz256_sub doesn't
 	movq	%r8,16(%rdi)
 	movq	%r9,24(%rdi)
 	movq	128(%rsp),%rdx
@@ -4156,7 +4156,7 @@
 	movq	16+224(%rsp),%r11
 	movq	24+224(%rsp),%r12
 	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S2, S1, Hcub);
 
 	movq	320(%rsp),%rdx
 	leaq	320(%rsp),%rbx
@@ -4166,15 +4166,15 @@
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
 	leaq	320(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(res_y, R, res_y);
 
 	leaq	256(%rsp),%rbx
 	leaq	320(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(res_y, res_y, S2);
 
-	movq	%xmm0,%rdi
+	movq	%xmm0,%rdi  // restore %rdi
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_z, in2_z, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	352(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -4185,7 +4185,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_z, in1_z, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -4198,7 +4198,7 @@
 	movdqu	%xmm2,64(%rdi)
 	movdqu	%xmm3,80(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_x, in2_x, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	288(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -4209,7 +4209,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_x, in1_x, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -4222,7 +4222,7 @@
 	movdqu	%xmm2,0(%rdi)
 	movdqu	%xmm3,16(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_y, in2_y, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	320(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -4233,7 +4233,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_y, in1_y, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -4296,14 +4296,14 @@
 .cfi_adjust_cfa_offset	32*15+8
 .Ladd_affinex_body:
 
-	movdqu	0(%rsi),%xmm0
-	movq	%rdx,%rbx
+	movdqu	0(%rsi),%xmm0  // copy	*(P256_POINT *)%rsi
+	movq	%rdx,%rbx  // reassign
 	movdqu	16(%rsi),%xmm1
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm3
 	movdqu	64(%rsi),%xmm4
 	movdqu	80(%rsi),%xmm5
-	movq	64+0(%rsi),%rdx
+	movq	64+0(%rsi),%rdx  // load original in1_z
 	movq	64+8(%rsi),%r14
 	movq	64+16(%rsi),%r15
 	movq	64+24(%rsi),%r8
@@ -4315,7 +4315,7 @@
 	movdqa	%xmm5,384+16(%rsp)
 	por	%xmm4,%xmm5
 
-	movdqu	0(%rbx),%xmm0
+	movdqu	0(%rbx),%xmm0  // copy	*(P256_POINT_AFFINE *)%rbx
 	pshufd	$0xb1,%xmm5,%xmm3
 	movdqu	16(%rbx),%xmm1
 	movdqu	32(%rbx),%xmm2
@@ -4325,7 +4325,7 @@
 	pshufd	$0x1e,%xmm5,%xmm4
 	movdqa	%xmm1,416+16(%rsp)
 	por	%xmm0,%xmm1
-	movq	%rdi,%xmm0
+	movq	%rdi,%xmm0  // save %rdi
 	movdqa	%xmm2,448(%rsp)
 	movdqa	%xmm3,448+16(%rsp)
 	por	%xmm2,%xmm3
@@ -4333,33 +4333,33 @@
 	pxor	%xmm4,%xmm4
 	por	%xmm1,%xmm3
 
-	leaq	64-128(%rsi),%rsi
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	64-128(%rsi),%rsi  // %rsi is still valid
+	leaq	32(%rsp),%rdi  // Z1^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Z1sqr, in1_z);
 
 	pcmpeqd	%xmm4,%xmm5
 	pshufd	$0xb1,%xmm3,%xmm4
-	movq	0(%rbx),%rdx
-
-	movq	%r12,%r9
+	movq	0(%rbx),%rdx  // %rbx is still valid
+// lea	0x00(%rbx), %rbx
+	movq	%r12,%r9  // harmonize sqr output and mul input
 	por	%xmm3,%xmm4
-	pshufd	$0,%xmm5,%xmm5
+	pshufd	$0,%xmm5,%xmm5  // in1infty
 	pshufd	$0x1e,%xmm4,%xmm3
 	movq	%r13,%r10
 	por	%xmm3,%xmm4
 	pxor	%xmm3,%xmm3
 	movq	%r14,%r11
 	pcmpeqd	%xmm3,%xmm4
-	pshufd	$0,%xmm4,%xmm4
+	pshufd	$0,%xmm4,%xmm4  // in2infty
 
 	leaq	32-128(%rsp),%rsi
 	movq	%r15,%r12
-	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	0(%rsp),%rdi  // U2 = X2*Z1^2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(U2, Z1sqr, in2_x);
 
 	leaq	320(%rsp),%rbx
-	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	leaq	64(%rsp),%rdi  // H = U2 - U1
+	call	__ecp_nistz256_sub_fromx  // p256_sub(H, U2, in1_x);
 
 	movq	384(%rsp),%rdx
 	leaq	384(%rsp),%rbx
@@ -4368,8 +4368,8 @@
 	leaq	-128+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	32(%rsp),%rdi  // S2 = Z1^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S2, Z1sqr, in1_z);
 
 	movq	384(%rsp),%rdx
 	leaq	384(%rsp),%rbx
@@ -4378,8 +4378,8 @@
 	leaq	-128+64(%rsp),%rsi
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
-	leaq	288(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	288(%rsp),%rdi  // Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(res_z, H, in1_z);
 
 	movq	448(%rsp),%rdx
 	leaq	448(%rsp),%rbx
@@ -4388,28 +4388,28 @@
 	leaq	-128+32(%rsp),%rsi
 	movq	16+32(%rsp),%r11
 	movq	24+32(%rsp),%r12
-	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	32(%rsp),%rdi  // S2 = Y2*Z1^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S2, S2, in2_y);
 
 	leaq	352(%rsp),%rbx
-	leaq	96(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	leaq	96(%rsp),%rdi  // R = S2 - S1
+	call	__ecp_nistz256_sub_fromx  // p256_sub(R, S2, in1_y);
 
 	movq	0+64(%rsp),%rdx
 	movq	8+64(%rsp),%r14
 	leaq	-128+64(%rsp),%rsi
 	movq	16+64(%rsp),%r15
 	movq	24+64(%rsp),%r8
-	leaq	128(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	128(%rsp),%rdi  // H^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Hsqr, H);
 
 	movq	0+96(%rsp),%rdx
 	movq	8+96(%rsp),%r14
 	leaq	-128+96(%rsp),%rsi
 	movq	16+96(%rsp),%r15
 	movq	24+96(%rsp),%r8
-	leaq	192(%rsp),%rdi
-	call	__ecp_nistz256_sqr_montx
+	leaq	192(%rsp),%rdi  // R^2
+	call	__ecp_nistz256_sqr_montx  // p256_sqr_mont(Rsqr, R);
 
 	movq	128(%rsp),%rdx
 	leaq	128(%rsp),%rbx
@@ -4418,8 +4418,8 @@
 	leaq	-128+64(%rsp),%rsi
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
-	leaq	160(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	leaq	160(%rsp),%rdi  // H^3
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(Hcub, Hsqr, H);
 
 	movq	320(%rsp),%rdx
 	leaq	320(%rsp),%rbx
@@ -4428,14 +4428,14 @@
 	leaq	-128+128(%rsp),%rsi
 	movq	16+128(%rsp),%r11
 	movq	24+128(%rsp),%r12
-	leaq	0(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
-
-
-
+	leaq	0(%rsp),%rdi  // U1*H^2
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(U2, in1_x, Hsqr);
+// lea	0(%rsp), %rsi
+// lea	128(%rsp), %rdi	# 2*U1*H^2
+// call	__ecp_nistz256_mul_by_2	# ecp_nistz256_mul_by_2(Hsqr, U2);
 
 	xorq	%r11,%r11
-	addq	%r12,%r12
+	addq	%r12,%r12  // a0:a3+a0:a3
 	leaq	192(%rsp),%rsi
 	adcq	%r13,%r13
 	movq	%r12,%rax
@@ -4461,11 +4461,11 @@
 	cmovcq	%r10,%r9
 	movq	24(%rsi),%r10
 
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  // p256_sub(res_x, Rsqr, Hsqr);
 
 	leaq	160(%rsp),%rbx
 	leaq	224(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(res_x, res_x, Hcub);
 
 	movq	0+0(%rsp),%rax
 	movq	0+8(%rsp),%rbp
@@ -4473,10 +4473,10 @@
 	movq	0+24(%rsp),%r10
 	leaq	64(%rsp),%rdi
 
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  // p256_sub(H, U2, res_x);
 
-	movq	%r12,0(%rdi)
-	movq	%r13,8(%rdi)
+	movq	%r12,0(%rdi)  // save the result, as
+	movq	%r13,8(%rdi)  // __ecp_nistz256_sub doesn't
 	movq	%r8,16(%rdi)
 	movq	%r9,24(%rdi)
 	movq	352(%rsp),%rdx
@@ -4487,7 +4487,7 @@
 	movq	16+160(%rsp),%r11
 	movq	24+160(%rsp),%r12
 	leaq	32(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(S2, Hcub, in1_y);
 
 	movq	96(%rsp),%rdx
 	leaq	96(%rsp),%rbx
@@ -4497,15 +4497,15 @@
 	movq	16+64(%rsp),%r11
 	movq	24+64(%rsp),%r12
 	leaq	64(%rsp),%rdi
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  // p256_mul_mont(H, H, R);
 
 	leaq	32(%rsp),%rbx
 	leaq	256(%rsp),%rdi
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  // p256_sub(res_y, H, S2);
 
-	movq	%xmm0,%rdi
+	movq	%xmm0,%rdi  // restore %rdi
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_z, ONE, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	288(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -4516,7 +4516,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_z, in1_z, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -4529,7 +4529,7 @@
 	movdqu	%xmm2,64(%rdi)
 	movdqu	%xmm3,80(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_x, in2_x, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	224(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -4540,7 +4540,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_x, in1_x, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2
@@ -4553,7 +4553,7 @@
 	movdqu	%xmm2,0(%rdi)
 	movdqu	%xmm3,16(%rdi)
 
-	movdqa	%xmm5,%xmm0
+	movdqa	%xmm5,%xmm0  // copy_conditional(res_y, in2_y, in1infty);
 	movdqa	%xmm5,%xmm1
 	pandn	256(%rsp),%xmm0
 	movdqa	%xmm5,%xmm2
@@ -4564,7 +4564,7 @@
 	por	%xmm0,%xmm2
 	por	%xmm1,%xmm3
 
-	movdqa	%xmm4,%xmm0
+	movdqa	%xmm4,%xmm0  // copy_conditional(res_y, in1_y, in2infty);
 	movdqa	%xmm4,%xmm1
 	pandn	%xmm2,%xmm0
 	movdqa	%xmm4,%xmm2

boringssl-0.20260708.tar.xz/gen/bcm/p256-x86_64-asm-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/p256-x86_64-asm-win.asm Changed

@@ -14,7 +14,7 @@
 section	.text code align=64
 
 
-
+; The polynomial
 section	.rdata rdata align=8
 ALIGN	64
 p256_constants:
@@ -30,16 +30,16 @@
 $L$ONE_mont:
 	DQ	0x0000000000000001,0xffffffff00000000,0xffffffffffffffff,0x00000000fffffffe
 
-
+; Constants for computations modulo ord(p256)
 $L$ord:
 	DQ	0xf3b9cac2fc632551,0xbce6faada7179e84,0xffffffffffffffff,0xffffffff00000000
 $L$ordK:
 	DQ	0xccd1c8aaee00bc4f
-section	.text
-
-
+section	.text code align=64
 
 
+; ###############################################################################
+; void ecp_nistz256_neg(uint64_t res4, uint64_t a4);
 global	ecp_nistz256_neg
 
 ALIGN	32
@@ -104,11 +104,11 @@
 	ret
 
 $L$SEH_end_ecp_nistz256_neg:
-
-
-
-
-
+; ###############################################################################
+; void ecp_nistz256_ord_mul_mont(
+; uint64_t res4,
+; uint64_t a4,
+; uint64_t b4);
 
 global	ecp_nistz256_ord_mul_mont_nohw
 
@@ -144,7 +144,7 @@
 	lea	r14,$L$ord
 	mov	r15,QWORD$L$ordK
 
-
+; ################################ * b0
 	mov	rcx,rax
 	mul	QWORDrsi
 	mov	r8,rax
@@ -172,16 +172,16 @@
 	adc	rdx,0
 	mov	r12,rdx
 
-
+; ################################ First reduction step
 	mul	QWORDr14
 	mov	rbp,r8
-	add	r13,rax
+	add	r13,rax  ; guaranteed to be zero
 	mov	rax,r8
 	adc	rdx,0
 	mov	rcx,rdx
 
 	sub	r10,r8
-	sbb	r8,0
+	sbb	r8,0  ; can't borrow
 
 	mul	QWORD8+r14
 	add	r9,rcx
@@ -190,19 +190,19 @@
 	mov	rax,rbp
 	adc	r10,rdx
 	mov	rdx,rbp
-	adc	r8,0
+	adc	r8,0  ; can't overflow
 
 	shl	rax,32
 	shr	rdx,32
 	sub	r11,rax
 	mov	rax,QWORD8+rbx
-	sbb	rbp,rdx
+	sbb	rbp,rdx  ; can't borrow
 
 	add	r11,r8
 	adc	r12,rbp
 	adc	r13,0
 
-
+; ################################ * b1
 	mov	rcx,rax
 	mul	QWORDrsi
 	add	r9,rax
@@ -238,15 +238,15 @@
 	adc	r13,rdx
 	adc	r8,0
 
-
+; ################################ Second reduction step
 	mul	QWORDr14
 	mov	rbp,r9
-	add	rcx,rax
+	add	rcx,rax  ; guaranteed to be zero
 	mov	rax,r9
 	adc	rcx,rdx
 
 	sub	r11,r9
-	sbb	r9,0
+	sbb	r9,0  ; can't borrow
 
 	mul	QWORD8+r14
 	add	r10,rcx
@@ -255,19 +255,19 @@
 	mov	rax,rbp
 	adc	r11,rdx
 	mov	rdx,rbp
-	adc	r9,0
+	adc	r9,0  ; can't overflow
 
 	shl	rax,32
 	shr	rdx,32
 	sub	r12,rax
 	mov	rax,QWORD16+rbx
-	sbb	rbp,rdx
+	sbb	rbp,rdx  ; can't borrow
 
 	add	r12,r9
 	adc	r13,rbp
 	adc	r8,0
 
-
+; ################################# * b2
 	mov	rcx,rax
 	mul	QWORDrsi
 	add	r10,rax
@@ -303,15 +303,15 @@
 	adc	r8,rdx
 	adc	r9,0
 
-
+; ################################ Third reduction step
 	mul	QWORDr14
 	mov	rbp,r10
-	add	rcx,rax
+	add	rcx,rax  ; guaranteed to be zero
 	mov	rax,r10
 	adc	rcx,rdx
 
 	sub	r12,r10
-	sbb	r10,0
+	sbb	r10,0  ; can't borrow
 
 	mul	QWORD8+r14
 	add	r11,rcx
@@ -320,19 +320,19 @@
 	mov	rax,rbp
 	adc	r12,rdx
 	mov	rdx,rbp
-	adc	r10,0
+	adc	r10,0  ; can't overflow
 
 	shl	rax,32
 	shr	rdx,32
 	sub	r13,rax
 	mov	rax,QWORD24+rbx
-	sbb	rbp,rdx
+	sbb	rbp,rdx  ; can't borrow
 
 	add	r13,r10
 	adc	r8,rbp
 	adc	r9,0
 
-
+; ################################ * b3
 	mov	rcx,rax
 	mul	QWORDrsi
 	add	r11,rax
@@ -368,15 +368,15 @@
 	adc	r9,rdx
 	adc	r10,0
 
-
+; ################################ Last reduction step
 	mul	QWORDr14
 	mov	rbp,r11
-	add	rcx,rax
+	add	rcx,rax  ; guaranteed to be zero
 	mov	rax,r11
 	adc	rcx,rdx
 
 	sub	r13,r11
-	sbb	r11,0
+	sbb	r11,0  ; can't borrow
 
 	mul	QWORD8+r14
 	add	r12,rcx
@@ -385,18 +385,18 @@
 	mov	rax,rbp
 	adc	r13,rdx
 	mov	rdx,rbp
-	adc	r11,0
+	adc	r11,0  ; can't overflow
 
 	shl	rax,32
 	shr	rdx,32
 	sub	r8,rax
-	sbb	rbp,rdx
+	sbb	rbp,rdx  ; can't borrow
 
 	add	r8,r11
 	adc	r9,rbp
 	adc	r10,0
 
-
+; ################################ Subtract ord
 	mov	rsi,r12
 	sub	r12,QWORDr14
 	mov	r11,r13
@@ -438,11 +438,11 @@
 
 $L$SEH_end_ecp_nistz256_ord_mul_mont_nohw:
 
-
-
-
-
-
+; ###############################################################################
+; void ecp_nistz256_ord_sqr_mont(
+; uint64_t res4,
+; uint64_t a4,
+; uint64_t rep);
 
 global	ecp_nistz256_ord_sqr_mont_nohw
 
@@ -477,56 +477,56 @@
 	mov	rax,QWORD8+rsi
 	mov	r14,QWORD16+rsi
 	mov	r15,QWORD24+rsi
-	lea	rsi,$L$ord
+	lea	rsi,$L$ord  ; pointer to modulus
 	mov	rbx,rdx
 	jmp	NEAR $L$oop_ord_sqr
 
 ALIGN	32
 $L$oop_ord_sqr:
-
-	mov	rbp,rax
-	mul	r8
+; ################################ a1: * a0
+	mov	rbp,rax  ; put aside a1
+	mul	r8  ; a1 * a0
 	mov	r9,rax
-	movq	xmm1,rbp
+	movq	xmm1,rbp  ; offload a1
 	mov	rax,r14
 	mov	r10,rdx
 
-	mul	r8
+	mul	r8  ; a2 * a0
 	add	r10,rax
 	mov	rax,r15
-	movq	xmm2,r14
+	movq	xmm2,r14  ; offload a2
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	r8
+	mul	r8  ; a3 * a0
 	add	r11,rax
 	mov	rax,r15
-	movq	xmm3,r15
+	movq	xmm3,r15  ; offload a3
 	adc	rdx,0
 	mov	r12,rdx
 
-
-	mul	r14
+; ################################ a3 * a2
+	mul	r14  ; a3 * a2
 	mov	r13,rax
 	mov	rax,r14
 	mov	r14,rdx
 
-
-	mul	rbp
+; ################################ a2: * a1
+	mul	rbp  ; a2 * a1
 	add	r11,rax
 	mov	rax,r15
 	adc	rdx,0
 	mov	r15,rdx
 
-	mul	rbp
+	mul	rbp  ; a3 * a1
 	add	r12,rax
 	adc	rdx,0
 
 	add	r12,r15
 	adc	r13,rdx
-	adc	r14,0
-
+	adc	r14,0  ; can't overflow
 
+; ################################ *2
 	xor	r15,r15
 	mov	rax,r8
 	add	r9,r9
@@ -537,20 +537,20 @@
 	adc	r14,r14
 	adc	r15,0
 
-
-	mul	rax
+; ################################ Missing products
+	mul	rax  ; a0 * a0
 	mov	r8,rax
 	movq	rax,xmm1
 	mov	rbp,rdx
 
-	mul	rax
+	mul	rax  ; a1 * a1
 	add	r9,rbp
 	adc	r10,rax
 	movq	rax,xmm2
 	adc	rdx,0
 	mov	rbp,rdx
 
-	mul	rax
+	mul	rax  ; a2 * a2
 	add	r11,rbp
 	adc	r12,rax
 	movq	rax,xmm3
@@ -558,23 +558,23 @@
 	mov	rbp,rdx
 
 	mov	rcx,r8
-	imul	r8,QWORD32+rsi
+	imul	r8,QWORD32+rsi  ; *= .LordK
 
-	mul	rax
+	mul	rax  ; a3 * a3
 	add	r13,rbp
 	adc	r14,rax
-	mov	rax,QWORDrsi
-	adc	r15,rdx
-
+	mov	rax,QWORDrsi  ; modulus0
+	adc	r15,rdx  ; can't overflow
 
+; ################################ First reduction step
 	mul	r8
 	mov	rbp,r8
-	add	rcx,rax
-	mov	rax,QWORD8+rsi
+	add	rcx,rax  ; guaranteed to be zero
+	mov	rax,QWORD8+rsi  ; modulus1
 	adc	rcx,rdx
 
 	sub	r10,r8
-	sbb	rbp,0
+	sbb	rbp,0  ; can't borrow
 
 	mul	r8
 	add	r9,rcx
@@ -583,29 +583,29 @@
 	mov	rax,r8
 	adc	r10,rdx
 	mov	rdx,r8
-	adc	rbp,0
+	adc	rbp,0  ; can't overflow
 
 	mov	rcx,r9
-	imul	r9,QWORD32+rsi
+	imul	r9,QWORD32+rsi  ; *= .LordK
 
 	shl	rax,32
 	shr	rdx,32
 	sub	r11,rax
 	mov	rax,QWORDrsi
-	sbb	r8,rdx
+	sbb	r8,rdx  ; can't borrow
 
 	add	r11,rbp
-	adc	r8,0
-
+	adc	r8,0  ; can't overflow
 
+; ################################ Second reduction step
 	mul	r9
 	mov	rbp,r9
-	add	rcx,rax
+	add	rcx,rax  ; guaranteed to be zero
 	mov	rax,QWORD8+rsi
 	adc	rcx,rdx
 
 	sub	r11,r9
-	sbb	rbp,0
+	sbb	rbp,0  ; can't borrow
 
 	mul	r9
 	add	r10,rcx
@@ -614,29 +614,29 @@
 	mov	rax,r9
 	adc	r11,rdx
 	mov	rdx,r9
-	adc	rbp,0
+	adc	rbp,0  ; can't overflow
 
 	mov	rcx,r10
-	imul	r10,QWORD32+rsi
+	imul	r10,QWORD32+rsi  ; *= .LordK
 
 	shl	rax,32
 	shr	rdx,32
 	sub	r8,rax
 	mov	rax,QWORDrsi
-	sbb	r9,rdx
+	sbb	r9,rdx  ; can't borrow
 
 	add	r8,rbp
-	adc	r9,0
-
+	adc	r9,0  ; can't overflow
 
+; ################################ Third reduction step
 	mul	r10
 	mov	rbp,r10
-	add	rcx,rax
+	add	rcx,rax  ; guaranteed to be zero
 	mov	rax,QWORD8+rsi
 	adc	rcx,rdx
 
 	sub	r8,r10
-	sbb	rbp,0
+	sbb	rbp,0  ; can't borrow
 
 	mul	r10
 	add	r11,rcx
@@ -645,29 +645,29 @@
 	mov	rax,r10
 	adc	r8,rdx
 	mov	rdx,r10
-	adc	rbp,0
+	adc	rbp,0  ; can't overflow
 
 	mov	rcx,r11
-	imul	r11,QWORD32+rsi
+	imul	r11,QWORD32+rsi  ; *= .LordK
 
 	shl	rax,32
 	shr	rdx,32
 	sub	r9,rax
 	mov	rax,QWORDrsi
-	sbb	r10,rdx
+	sbb	r10,rdx  ; can't borrow
 
 	add	r9,rbp
-	adc	r10,0
-
+	adc	r10,0  ; can't overflow
 
+; ################################ Last reduction step
 	mul	r11
 	mov	rbp,r11
-	add	rcx,rax
+	add	rcx,rax  ; guaranteed to be zero
 	mov	rax,QWORD8+rsi
 	adc	rcx,rdx
 
 	sub	r9,r11
-	sbb	rbp,0
+	sbb	rbp,0  ; can't borrow
 
 	mul	r11
 	add	r8,rcx
@@ -676,17 +676,17 @@
 	mov	rax,r11
 	adc	r9,rdx
 	mov	rdx,r11
-	adc	rbp,0
+	adc	rbp,0  ; can't overflow
 
 	shl	rax,32
 	shr	rdx,32
 	sub	r10,rax
-	sbb	r11,rdx
+	sbb	r11,rdx  ; can't borrow
 
 	add	r10,rbp
-	adc	r11,0
-
+	adc	r11,0  ; can't overflow
 
+; ################################ Add bits 511:256 of the sqr result
 	xor	rdx,rdx
 	add	r8,r12
 	adc	r9,r13
@@ -696,7 +696,7 @@
 	mov	rax,r9
 	adc	rdx,0
 
-
+; ################################ Compare to modulus
 	sub	r8,QWORDrsi
 	mov	r14,r10
 	sbb	r9,QWORD8+rsi
@@ -741,7 +741,7 @@
 	ret
 
 $L$SEH_end_ecp_nistz256_ord_sqr_mont_nohw:
-
+; ###############################################################################
 global	ecp_nistz256_ord_mul_mont_adx
 
 ALIGN	32
@@ -778,11 +778,11 @@
 	mov	r10,QWORD8+rsi
 	mov	r11,QWORD16+rsi
 	mov	r12,QWORD24+rsi
-	lea	rsi,((-128))+rsi
+	lea	rsi,((-128))+rsi  ; control u-op density
 	lea	r14,(($L$ord-128))
 	mov	r15,QWORD$L$ordK
 
-
+; ################################ Multiply by b0
 	mulx	r9,r8,r9
 	mulx	r10,rcx,r10
 	mulx	r11,rbp,r11
@@ -794,10 +794,10 @@
 	adc	r11,rcx
 	adc	r12,0
 
-
-	xor	r13,r13
+; ################################ reduction
+	xor	r13,r13  ; %r13=0, cf=0, of=0
 	mulx	rbp,rcx,QWORD((0+128))+r14
-	adcx	r8,rcx
+	adcx	r8,rcx  ; guaranteed to be zero
 	adox	r9,rbp
 
 	mulx	rbp,rcx,QWORD((8+128))+r14
@@ -814,9 +814,9 @@
 	adox	r12,rbp
 	adcx	r12,r8
 	adox	r13,r8
-	adc	r13,0
-
+	adc	r13,0  ; cf=0, of=0
 
+; ################################ Multiply by b1
 	mulx	rbp,rcx,QWORD((0+128))+rsi
 	adcx	r9,rcx
 	adox	r10,rbp
@@ -837,11 +837,11 @@
 
 	adcx	r13,r8
 	adox	r8,r8
-	adc	r8,0
-
+	adc	r8,0  ; cf=0, of=0
 
+; ################################ reduction
 	mulx	rbp,rcx,QWORD((0+128))+r14
-	adcx	r9,rcx
+	adcx	r9,rcx  ; guaranteed to be zero
 	adox	r10,rbp
 
 	mulx	rbp,rcx,QWORD((8+128))+r14
@@ -858,9 +858,9 @@
 	adox	r13,rbp
 	adcx	r13,r9
 	adox	r8,r9
-	adc	r8,0
-
+	adc	r8,0  ; cf=0, of=0
 
+; ################################ Multiply by b2
 	mulx	rbp,rcx,QWORD((0+128))+rsi
 	adcx	r10,rcx
 	adox	r11,rbp
@@ -881,11 +881,11 @@
 
 	adcx	r8,r9
 	adox	r9,r9
-	adc	r9,0
-
+	adc	r9,0  ; cf=0, of=0
 
+; ################################ reduction
 	mulx	rbp,rcx,QWORD((0+128))+r14
-	adcx	r10,rcx
+	adcx	r10,rcx  ; guaranteed to be zero
 	adox	r11,rbp
 
 	mulx	rbp,rcx,QWORD((8+128))+r14
@@ -902,9 +902,9 @@
 	adox	r8,rbp
 	adcx	r8,r10
 	adox	r9,r10
-	adc	r9,0
-
+	adc	r9,0  ; cf=0, of=0
 
+; ################################ Multiply by b3
 	mulx	rbp,rcx,QWORD((0+128))+rsi
 	adcx	r11,rcx
 	adox	r12,rbp
@@ -925,11 +925,11 @@
 
 	adcx	r9,r10
 	adox	r10,r10
-	adc	r10,0
-
+	adc	r10,0  ; cf=0, of=0
 
+; ################################ reduction
 	mulx	rbp,rcx,QWORD((0+128))+r14
-	adcx	r11,rcx
+	adcx	r11,rcx  ; guaranteed to be zero
 	adox	r12,rbp
 
 	mulx	rbp,rcx,QWORD((8+128))+r14
@@ -950,8 +950,8 @@
 	adox	r10,r11
 	adc	r10,0
 
-
-
+; ################################
+; Branch-less conditional subtraction of P
 	mov	rcx,r8
 	sub	r12,QWORDr14
 	sbb	r13,QWORD8+r14
@@ -1031,38 +1031,38 @@
 
 ALIGN	32
 $L$oop_ord_sqrx:
-	mulx	r10,r9,r14
-	mulx	r11,rcx,r15
-	mov	rax,rdx
-	movq	xmm1,r14
-	mulx	r12,rbp,r8
+	mulx	r10,r9,r14  ; a0*a1
+	mulx	r11,rcx,r15  ; a0*a2
+	mov	rax,rdx  ; offload a0
+	movq	xmm1,r14  ; offload a1
+	mulx	r12,rbp,r8  ; a0*a3
 	mov	rdx,r14
 	add	r10,rcx
-	movq	xmm2,r15
+	movq	xmm2,r15  ; offload a2
 	adc	r11,rbp
 	adc	r12,0
-	xor	r13,r13
-
-	mulx	rbp,rcx,r15
+	xor	r13,r13  ; %r13=0,cf=0,of=0
+; ################################
+	mulx	rbp,rcx,r15  ; a1*a2
 	adcx	r11,rcx
 	adox	r12,rbp
 
-	mulx	rbp,rcx,r8
+	mulx	rbp,rcx,r8  ; a1*a3
 	mov	rdx,r15
 	adcx	r12,rcx
 	adox	r13,rbp
 	adc	r13,0
-
-	mulx	r14,rcx,r8
+; ################################
+	mulx	r14,rcx,r8  ; a2*a3
 	mov	rdx,rax
-	movq	xmm3,r8
-	xor	r15,r15
-	adcx	r9,r9
+	movq	xmm3,r8  ; offload a3
+	xor	r15,r15  ; %r15=0,cf=0,of=0
+	adcx	r9,r9  ; acc1:6<<1
 	adox	r13,rcx
 	adcx	r10,r10
-	adox	r14,r15
-
+	adox	r14,r15  ; of=0
 
+; ################################ ai*ai
 	mulx	rbp,r8,rdx
 	movq	rdx,xmm1
 	adcx	r11,r11
@@ -1084,13 +1084,13 @@
 	adox	r14,rcx
 	adox	r15,rax
 
-
+; ################################ reduction
 	mov	rdx,r8
 	mulx	rcx,rdx,QWORD32+rsi
 
-	xor	rax,rax
+	xor	rax,rax  ; cf=0, of=0
 	mulx	rbp,rcx,QWORDrsi
-	adcx	r8,rcx
+	adcx	r8,rcx  ; guaranteed to be zero
 	adox	r9,rbp
 	mulx	rbp,rcx,QWORD8+rsi
 	adcx	r9,rcx
@@ -1100,15 +1100,15 @@
 	adox	r11,rbp
 	mulx	rbp,rcx,QWORD24+rsi
 	adcx	r11,rcx
-	adox	r8,rbp
-	adcx	r8,rax
-
+	adox	r8,rbp  ; of=0
+	adcx	r8,rax  ; cf=0
 
+; ################################
 	mov	rdx,r9
 	mulx	rcx,rdx,QWORD32+rsi
 
 	mulx	rbp,rcx,QWORDrsi
-	adox	r9,rcx
+	adox	r9,rcx  ; guaranteed to be zero
 	adcx	r10,rbp
 	mulx	rbp,rcx,QWORD8+rsi
 	adox	r10,rcx
@@ -1118,15 +1118,15 @@
 	adcx	r8,rbp
 	mulx	rbp,rcx,QWORD24+rsi
 	adox	r8,rcx
-	adcx	r9,rbp
-	adox	r9,rax
-
+	adcx	r9,rbp  ; cf=0
+	adox	r9,rax  ; of=0
 
+; ################################
 	mov	rdx,r10
 	mulx	rcx,rdx,QWORD32+rsi
 
 	mulx	rbp,rcx,QWORDrsi
-	adcx	r10,rcx
+	adcx	r10,rcx  ; guaranteed to be zero
 	adox	r11,rbp
 	mulx	rbp,rcx,QWORD8+rsi
 	adcx	r11,rcx
@@ -1136,15 +1136,15 @@
 	adox	r9,rbp
 	mulx	rbp,rcx,QWORD24+rsi
 	adcx	r9,rcx
-	adox	r10,rbp
-	adcx	r10,rax
-
+	adox	r10,rbp  ; of=0
+	adcx	r10,rax  ; cf=0
 
+; ################################
 	mov	rdx,r11
 	mulx	rcx,rdx,QWORD32+rsi
 
 	mulx	rbp,rcx,QWORDrsi
-	adox	r11,rcx
+	adox	r11,rcx  ; guaranteed to be zero
 	adcx	r8,rbp
 	mulx	rbp,rcx,QWORD8+rsi
 	adox	r8,rcx
@@ -1157,8 +1157,8 @@
 	adcx	r11,rbp
 	adox	r11,rax
 
-
-	add	r12,r8
+; ################################ accumulate upper half
+	add	r12,r8  ; add	%r12, %r8
 	adc	r9,r13
 	mov	rdx,r12
 	adc	r10,r14
@@ -1166,7 +1166,7 @@
 	mov	r14,r9
 	adc	rax,0
 
-
+; ################################ compare to modulus
 	sub	r12,QWORDrsi
 	mov	r15,r10
 	sbb	r9,QWORD8+rsi
@@ -1211,11 +1211,11 @@
 	ret
 
 $L$SEH_end_ecp_nistz256_ord_sqr_mont_adx:
-
-
-
-
-
+; ###############################################################################
+; void ecp_nistz256_mul_mont(
+; uint64_t res4,
+; uint64_t a4,
+; uint64_t b4);
 
 global	ecp_nistz256_mul_mont_nohw
 
@@ -1279,8 +1279,8 @@
 ALIGN	32
 __ecp_nistz256_mul_montq:
 
-
-
+; #######################################################################
+; Multiply a by b0
 	mov	rbp,rax
 	mul	r9
 	mov	r14,QWORD(($L$poly+8))
@@ -1308,20 +1308,20 @@
 	xor	r13,r13
 	mov	r12,rdx
 
-
-
-
-
-
-
-
-
+; #######################################################################
+; First reduction step
+; Basically now we want to multiply acc0 by p256,
+; and add the result to the acc.
+; Due to the special form of p256 we do some optimizations
+; 
+; acc0 x p2560..1 = acc0 x 2^96 - acc0
+; then we add acc0 and get acc0 x 2^96
 
 	mov	rbp,r8
 	shl	r8,32
 	mul	r15
 	shr	rbp,32
-	add	r9,r8
+	add	r9,r8  ; +=acc0<<96
 	adc	r10,rbp
 	adc	r11,rax
 	mov	rax,QWORD8+rbx
@@ -1329,8 +1329,8 @@
 	adc	r13,0
 	xor	r8,r8
 
-
-
+; #######################################################################
+; Multiply by b1
 	mov	rbp,rax
 	mul	QWORDrsi
 	add	r9,rax
@@ -1362,8 +1362,8 @@
 	adc	r13,rdx
 	adc	r8,0
 
-
-
+; #######################################################################
+; Second reduction step
 	mov	rbp,r9
 	shl	r9,32
 	mul	r15
@@ -1376,8 +1376,8 @@
 	adc	r8,0
 	xor	r9,r9
 
-
-
+; #######################################################################
+; Multiply by b2
 	mov	rbp,rax
 	mul	QWORDrsi
 	add	r10,rax
@@ -1409,8 +1409,8 @@
 	adc	r8,rdx
 	adc	r9,0
 
-
-
+; #######################################################################
+; Third reduction step
 	mov	rbp,r10
 	shl	r10,32
 	mul	r15
@@ -1423,8 +1423,8 @@
 	adc	r9,0
 	xor	r10,r10
 
-
-
+; #######################################################################
+; Multiply by b3
 	mov	rbp,rax
 	mul	QWORDrsi
 	add	r11,rax
@@ -1456,8 +1456,8 @@
 	adc	r9,rdx
 	adc	r10,0
 
-
-
+; #######################################################################
+; Final reduction step
 	mov	rbp,r11
 	shl	r11,32
 	mul	r15
@@ -1470,14 +1470,14 @@
 	mov	rbp,r13
 	adc	r10,0
 
-
-
-	sub	r12,-1
+; #######################################################################
+; Branch-less conditional subtraction of P
+	sub	r12,-1  ; .Lpoly0
 	mov	rbx,r8
-	sbb	r13,r14
-	sbb	r8,0
+	sbb	r13,r14  ; .Lpoly1
+	sbb	r8,0  ; .Lpoly2
 	mov	rdx,r9
-	sbb	r9,r15
+	sbb	r9,r15  ; .Lpoly3
 	sbb	r10,0
 
 	cmovc	r12,rcx
@@ -1493,13 +1493,13 @@
 
 
 
+; ###############################################################################
+; void ecp_nistz256_sqr_mont(
+; uint64_t res4,
+; uint64_t a4);
 
-
-
-
-
-
-
+; we optimize the square according to S.Gueron and V.Krasnov,
+; "Speeding up Big-Number Squaring"
 global	ecp_nistz256_sqr_mont_nohw
 
 ALIGN	32
@@ -1560,31 +1560,31 @@
 __ecp_nistz256_sqr_montq:
 
 	mov	r13,rax
-	mul	r14
+	mul	r14  ; a1*a0
 	mov	r9,rax
 	mov	rax,r15
 	mov	r10,rdx
 
-	mul	r13
+	mul	r13  ; a0*a2
 	add	r10,rax
 	mov	rax,r8
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	r13
+	mul	r13  ; a0*a3
 	add	r11,rax
 	mov	rax,r15
 	adc	rdx,0
 	mov	r12,rdx
 
-
-	mul	r14
+; ################################
+	mul	r14  ; a1*a2
 	add	r11,rax
 	mov	rax,r8
 	adc	rdx,0
 	mov	rbp,rdx
 
-	mul	r14
+	mul	r14  ; a1*a3
 	add	r12,rax
 	mov	rax,r8
 	adc	rdx,0
@@ -1592,15 +1592,15 @@
 	mov	r13,rdx
 	adc	r13,0
 
-
-	mul	r15
+; ################################
+	mul	r15  ; a2*a3
 	xor	r15,r15
 	add	r13,rax
 	mov	rax,QWORDrsi
 	mov	r14,rdx
 	adc	r14,0
 
-	add	r9,r9
+	add	r9,r9  ; acc1:6<<1
 	adc	r10,r10
 	adc	r11,r11
 	adc	r12,r12
@@ -1636,21 +1636,21 @@
 	mov	rsi,QWORD(($L$poly+8))
 	mov	rbp,QWORD(($L$poly+24))
 
-
-
-
+; #########################################
+; Now the reduction
+; First iteration
 	mov	rcx,r8
 	shl	r8,32
 	mul	rbp
 	shr	rcx,32
-	add	r9,r8
+	add	r9,r8  ; +=acc0<<96
 	adc	r10,rcx
 	adc	r11,rax
 	mov	rax,r9
 	adc	rdx,0
 
-
-
+; #########################################
+; Second iteration
 	mov	rcx,r9
 	shl	r9,32
 	mov	r8,rdx
@@ -1662,8 +1662,8 @@
 	mov	rax,r10
 	adc	rdx,0
 
-
-
+; #########################################
+; Third iteration
 	mov	rcx,r10
 	shl	r10,32
 	mov	r9,rdx
@@ -1675,8 +1675,8 @@
 	mov	rax,r11
 	adc	rdx,0
 
-
-
+; ##########################################
+; Last iteration
 	mov	rcx,r11
 	shl	r11,32
 	mov	r10,rdx
@@ -1688,8 +1688,8 @@
 	adc	rdx,0
 	xor	r11,r11
 
-
-
+; ###########################################
+; Add the rest of the acc
 	add	r12,r8
 	adc	r13,r9
 	mov	r8,r12
@@ -1698,12 +1698,12 @@
 	mov	r9,r13
 	adc	r11,0
 
-	sub	r12,-1
+	sub	r12,-1  ; .Lpoly0
 	mov	r10,r14
-	sbb	r13,rsi
-	sbb	r14,0
+	sbb	r13,rsi  ; .Lpoly1
+	sbb	r14,0  ; .Lpoly2
 	mov	rcx,r15
-	sbb	r15,rbp
+	sbb	r15,rbp  ; .Lpoly3
 	sbb	r11,0
 
 	cmovc	r12,r8
@@ -1752,7 +1752,7 @@
 	mov	r10,QWORD8+rsi
 	mov	r11,QWORD16+rsi
 	mov	r12,QWORD24+rsi
-	lea	rsi,((-128))+rsi
+	lea	rsi,((-128))+rsi  ; control u-op density
 
 	call	__ecp_nistz256_mul_montx
 
@@ -1781,12 +1781,12 @@
 ALIGN	32
 __ecp_nistz256_mul_montx:
 
-
-
+; #######################################################################
+; Multiply by b0
 	mulx	r9,r8,r9
 	mulx	r10,rcx,r10
 	mov	r14,32
-	xor	r13,r13
+	xor	r13,r13  ; cf=0
 	mulx	r11,rbp,r11
 	mov	r15,QWORD(($L$poly+24))
 	adc	r9,rcx
@@ -1798,8 +1798,8 @@
 	shrx	rcx,r8,r14
 	adc	r12,0
 
-
-
+; #######################################################################
+; First reduction step
 	add	r9,rbp
 	adc	r10,rcx
 
@@ -1808,10 +1808,10 @@
 	adc	r11,rcx
 	adc	r12,rbp
 	adc	r13,0
-	xor	r8,r8
-
-
+	xor	r8,r8  ; %r8=0,cf=0,of=0
 
+; #######################################################################
+; Multiply by b1
 	mulx	rbp,rcx,QWORD((0+128))+rsi
 	adcx	r9,rcx
 	adox	r10,rbp
@@ -1835,8 +1835,8 @@
 	adox	r8,r8
 	adc	r8,0
 
-
-
+; #######################################################################
+; Second reduction step
 	add	r10,rcx
 	adc	r11,rbp
 
@@ -1845,10 +1845,10 @@
 	adc	r12,rcx
 	adc	r13,rbp
 	adc	r8,0
-	xor	r9,r9
-
-
+	xor	r9,r9  ; %r9=0,cf=0,of=0
 
+; #######################################################################
+; Multiply by b2
 	mulx	rbp,rcx,QWORD((0+128))+rsi
 	adcx	r10,rcx
 	adox	r11,rbp
@@ -1872,8 +1872,8 @@
 	adox	r9,r9
 	adc	r9,0
 
-
-
+; #######################################################################
+; Third reduction step
 	add	r11,rcx
 	adc	r12,rbp
 
@@ -1882,10 +1882,10 @@
 	adc	r13,rcx
 	adc	r8,rbp
 	adc	r9,0
-	xor	r10,r10
-
-
+	xor	r10,r10  ; %r10=0,cf=0,of=0
 
+; #######################################################################
+; Multiply by b3
 	mulx	rbp,rcx,QWORD((0+128))+rsi
 	adcx	r11,rcx
 	adox	r12,rbp
@@ -1909,8 +1909,8 @@
 	adox	r10,r10
 	adc	r10,0
 
-
-
+; #######################################################################
+; Fourth reduction step
 	add	r12,rcx
 	adc	r13,rbp
 
@@ -1922,15 +1922,15 @@
 	adc	r9,rbp
 	adc	r10,0
 
-
-
+; #######################################################################
+; Branch-less conditional subtraction of P
 	xor	eax,eax
 	mov	rcx,r8
-	sbb	r12,-1
-	sbb	r13,r14
-	sbb	r8,0
+	sbb	r12,-1  ; .Lpoly0
+	sbb	r13,r14  ; .Lpoly1
+	sbb	r8,0  ; .Lpoly2
 	mov	rbp,r9
-	sbb	r9,r15
+	sbb	r9,r15  ; .Lpoly3
 	sbb	r10,0
 
 	cmovc	r12,rbx
@@ -1977,7 +1977,7 @@
 	mov	r14,QWORD8+rsi
 	mov	r15,QWORD16+rsi
 	mov	r8,QWORD24+rsi
-	lea	rsi,((-128))+rsi
+	lea	rsi,((-128))+rsi  ; control u-op density
 
 	call	__ecp_nistz256_sqr_montx
 
@@ -2006,35 +2006,35 @@
 ALIGN	32
 __ecp_nistz256_sqr_montx:
 
-	mulx	r10,r9,r14
-	mulx	r11,rcx,r15
+	mulx	r10,r9,r14  ; a0*a1
+	mulx	r11,rcx,r15  ; a0*a2
 	xor	eax,eax
 	adc	r10,rcx
-	mulx	r12,rbp,r8
+	mulx	r12,rbp,r8  ; a0*a3
 	mov	rdx,r14
 	adc	r11,rbp
 	adc	r12,0
-	xor	r13,r13
+	xor	r13,r13  ; %r13=0,cf=0,of=0
 
-
-	mulx	rbp,rcx,r15
+; ################################
+	mulx	rbp,rcx,r15  ; a1*a2
 	adcx	r11,rcx
 	adox	r12,rbp
 
-	mulx	rbp,rcx,r8
+	mulx	rbp,rcx,r8  ; a1*a3
 	mov	rdx,r15
 	adcx	r12,rcx
 	adox	r13,rbp
 	adc	r13,0
 
-
-	mulx	r14,rcx,r8
+; ################################
+	mulx	r14,rcx,r8  ; a2*a3
 	mov	rdx,QWORD((0+128))+rsi
-	xor	r15,r15
-	adcx	r9,r9
+	xor	r15,r15  ; %r15=0,cf=0,of=0
+	adcx	r9,r9  ; acc1:6<<1
 	adox	r13,rcx
 	adcx	r10,r10
-	adox	r14,r15
+	adox	r14,r15  ; of=0
 
 	mulx	rbp,r8,rdx
 	mov	rdx,QWORD((8+128))+rsi
@@ -2063,7 +2063,7 @@
 	shrx	rax,r8,rsi
 	mov	rbp,rdx
 
-
+; reduction step 1
 	add	r9,rcx
 	adc	r10,rax
 
@@ -2073,7 +2073,7 @@
 	adc	r8,0
 	shrx	rax,r9,rsi
 
-
+; reduction step 2
 	add	r10,rcx
 	adc	r11,rax
 
@@ -2083,7 +2083,7 @@
 	adc	r9,0
 	shrx	rax,r10,rsi
 
-
+; reduction step 3
 	add	r11,rcx
 	adc	r8,rax
 
@@ -2093,7 +2093,7 @@
 	adc	r10,0
 	shrx	rax,r11,rsi
 
-
+; reduction step 4
 	add	r8,rcx
 	adc	r9,rax
 
@@ -2102,7 +2102,7 @@
 	adc	r11,0
 
 	xor	rdx,rdx
-	add	r12,r8
+	add	r12,r8  ; accumulate upper half
 	mov	rsi,QWORD(($L$poly+8))
 	adc	r13,r9
 	mov	r8,r12
@@ -2111,12 +2111,12 @@
 	mov	r9,r13
 	adc	rdx,0
 
-	sub	r12,-1
+	sub	r12,-1  ; .Lpoly0
 	mov	r10,r14
-	sbb	r13,rsi
-	sbb	r14,0
+	sbb	r13,rsi  ; .Lpoly1
+	sbb	r14,0  ; .Lpoly2
 	mov	r11,r15
-	sbb	r15,rbp
+	sbb	r15,rbp  ; .Lpoly3
 	sbb	rdx,0
 
 	cmovc	r12,r8
@@ -2131,8 +2131,8 @@
 	ret
 
 
-
-
+; ###############################################################################
+; void ecp_nistz256_select_w5_nohw(uint64_t *val, uint64_t *in_t, int index);
 global	ecp_nistz256_select_w5_nohw
 
 ALIGN	32
@@ -2141,17 +2141,17 @@
 _CET_ENDBR
 	lea	rax,((-136))+rsp
 $L$SEH_begin_ecp_nistz256_select_w5_nohw:
-	DB	0x48,0x8d,0x60,0xe0
-	DB	0x0f,0x29,0x70,0xe0
-	DB	0x0f,0x29,0x78,0xf0
-	DB	0x44,0x0f,0x29,0x00
-	DB	0x44,0x0f,0x29,0x48,0x10
-	DB	0x44,0x0f,0x29,0x50,0x20
-	DB	0x44,0x0f,0x29,0x58,0x30
-	DB	0x44,0x0f,0x29,0x60,0x40
-	DB	0x44,0x0f,0x29,0x68,0x50
-	DB	0x44,0x0f,0x29,0x70,0x60
-	DB	0x44,0x0f,0x29,0x78,0x70
+	DB	0x48,0x8d,0x60,0xe0  ; lea	-0x20(%rax), %rsp
+	DB	0x0f,0x29,0x70,0xe0  ; movaps	%xmm6, -0x20(%rax)
+	DB	0x0f,0x29,0x78,0xf0  ; movaps	%xmm7, -0x10(%rax)
+	DB	0x44,0x0f,0x29,0x00  ; movaps	%xmm8, 0(%rax)
+	DB	0x44,0x0f,0x29,0x48,0x10  ; movaps	%xmm9, 0x10(%rax)
+	DB	0x44,0x0f,0x29,0x50,0x20  ; movaps	%xmm10, 0x20(%rax)
+	DB	0x44,0x0f,0x29,0x58,0x30  ; movaps	%xmm11, 0x30(%rax)
+	DB	0x44,0x0f,0x29,0x60,0x40  ; movaps	%xmm12, 0x40(%rax)
+	DB	0x44,0x0f,0x29,0x68,0x50  ; movaps	%xmm13, 0x50(%rax)
+	DB	0x44,0x0f,0x29,0x70,0x60  ; movaps	%xmm14, 0x60(%rax)
+	DB	0x44,0x0f,0x29,0x78,0x70  ; movaps	%xmm15, 0x70(%rax)
 	movdqa	xmm0,XMMWORD$L$One
 	movd	xmm1,r8d
 
@@ -2218,8 +2218,8 @@
 $L$SEH_end_ecp_nistz256_select_w5_nohw:
 
 
-
-
+; ###############################################################################
+; void ecp_nistz256_select_w7_nohw(uint64_t *val, uint64_t *in_t, int index);
 global	ecp_nistz256_select_w7_nohw
 
 ALIGN	32
@@ -2228,17 +2228,17 @@
 _CET_ENDBR
 	lea	rax,((-136))+rsp
 $L$SEH_begin_ecp_nistz256_select_w7_nohw:
-	DB	0x48,0x8d,0x60,0xe0
-	DB	0x0f,0x29,0x70,0xe0
-	DB	0x0f,0x29,0x78,0xf0
-	DB	0x44,0x0f,0x29,0x00
-	DB	0x44,0x0f,0x29,0x48,0x10
-	DB	0x44,0x0f,0x29,0x50,0x20
-	DB	0x44,0x0f,0x29,0x58,0x30
-	DB	0x44,0x0f,0x29,0x60,0x40
-	DB	0x44,0x0f,0x29,0x68,0x50
-	DB	0x44,0x0f,0x29,0x70,0x60
-	DB	0x44,0x0f,0x29,0x78,0x70
+	DB	0x48,0x8d,0x60,0xe0  ; lea	-0x20(%rax), %rsp
+	DB	0x0f,0x29,0x70,0xe0  ; movaps	%xmm6, -0x20(%rax)
+	DB	0x0f,0x29,0x78,0xf0  ; movaps	%xmm7, -0x10(%rax)
+	DB	0x44,0x0f,0x29,0x00  ; movaps	%xmm8, 0(%rax)
+	DB	0x44,0x0f,0x29,0x48,0x10  ; movaps	%xmm9, 0x10(%rax)
+	DB	0x44,0x0f,0x29,0x50,0x20  ; movaps	%xmm10, 0x20(%rax)
+	DB	0x44,0x0f,0x29,0x58,0x30  ; movaps	%xmm11, 0x30(%rax)
+	DB	0x44,0x0f,0x29,0x60,0x40  ; movaps	%xmm12, 0x40(%rax)
+	DB	0x44,0x0f,0x29,0x68,0x50  ; movaps	%xmm13, 0x50(%rax)
+	DB	0x44,0x0f,0x29,0x70,0x60  ; movaps	%xmm14, 0x60(%rax)
+	DB	0x44,0x0f,0x29,0x78,0x70  ; movaps	%xmm15, 0x70(%rax)
 	movdqa	xmm8,XMMWORD$L$One
 	movd	xmm1,r8d
 
@@ -2293,8 +2293,8 @@
 
 $L$SEH_end_ecp_nistz256_select_w7_nohw:
 
-
-
+; ###############################################################################
+; void ecp_nistz256_select_w5_avx2(uint64_t *val, uint64_t *in_t, int index);
 global	ecp_nistz256_select_w5_avx2
 
 ALIGN	32
@@ -2305,17 +2305,17 @@
 	lea	rax,((-136))+rsp
 	mov	r11,rsp
 $L$SEH_begin_ecp_nistz256_select_w5_avx2:
-	DB	0x48,0x8d,0x60,0xe0
-	DB	0xc5,0xf8,0x29,0x70,0xe0
-	DB	0xc5,0xf8,0x29,0x78,0xf0
-	DB	0xc5,0x78,0x29,0x40,0x00
-	DB	0xc5,0x78,0x29,0x48,0x10
-	DB	0xc5,0x78,0x29,0x50,0x20
-	DB	0xc5,0x78,0x29,0x58,0x30
-	DB	0xc5,0x78,0x29,0x60,0x40
-	DB	0xc5,0x78,0x29,0x68,0x50
-	DB	0xc5,0x78,0x29,0x70,0x60
-	DB	0xc5,0x78,0x29,0x78,0x70
+	DB	0x48,0x8d,0x60,0xe0  ; lea	-0x20(%rax), %rsp
+	DB	0xc5,0xf8,0x29,0x70,0xe0  ; vmovaps %xmm6, -0x20(%rax)
+	DB	0xc5,0xf8,0x29,0x78,0xf0  ; vmovaps %xmm7, -0x10(%rax)
+	DB	0xc5,0x78,0x29,0x40,0x00  ; vmovaps %xmm8, 8(%rax)
+	DB	0xc5,0x78,0x29,0x48,0x10  ; vmovaps %xmm9, 0x10(%rax)
+	DB	0xc5,0x78,0x29,0x50,0x20  ; vmovaps %xmm10, 0x20(%rax)
+	DB	0xc5,0x78,0x29,0x58,0x30  ; vmovaps %xmm11, 0x30(%rax)
+	DB	0xc5,0x78,0x29,0x60,0x40  ; vmovaps %xmm12, 0x40(%rax)
+	DB	0xc5,0x78,0x29,0x68,0x50  ; vmovaps %xmm13, 0x50(%rax)
+	DB	0xc5,0x78,0x29,0x70,0x60  ; vmovaps %xmm14, 0x60(%rax)
+	DB	0xc5,0x78,0x29,0x78,0x70  ; vmovaps %xmm15, 0x70(%rax)
 	vmovdqa	ymm0,YMMWORD$L$Two
 
 	vpxor	ymm2,ymm2,ymm2
@@ -2383,8 +2383,8 @@
 $L$SEH_end_ecp_nistz256_select_w5_avx2:
 
 
-
-
+; ###############################################################################
+; void ecp_nistz256_select_w7_avx2(uint64_t *val, uint64_t *in_t, int index);
 global	ecp_nistz256_select_w7_avx2
 
 ALIGN	32
@@ -2395,17 +2395,17 @@
 	mov	r11,rsp
 	lea	rax,((-136))+rsp
 $L$SEH_begin_ecp_nistz256_select_w7_avx2:
-	DB	0x48,0x8d,0x60,0xe0
-	DB	0xc5,0xf8,0x29,0x70,0xe0
-	DB	0xc5,0xf8,0x29,0x78,0xf0
-	DB	0xc5,0x78,0x29,0x40,0x00
-	DB	0xc5,0x78,0x29,0x48,0x10
-	DB	0xc5,0x78,0x29,0x50,0x20
-	DB	0xc5,0x78,0x29,0x58,0x30
-	DB	0xc5,0x78,0x29,0x60,0x40
-	DB	0xc5,0x78,0x29,0x68,0x50
-	DB	0xc5,0x78,0x29,0x70,0x60
-	DB	0xc5,0x78,0x29,0x78,0x70
+	DB	0x48,0x8d,0x60,0xe0  ; lea	-0x20(%rax), %rsp
+	DB	0xc5,0xf8,0x29,0x70,0xe0  ; vmovaps %xmm6, -0x20(%rax)
+	DB	0xc5,0xf8,0x29,0x78,0xf0  ; vmovaps %xmm7, -0x10(%rax)
+	DB	0xc5,0x78,0x29,0x40,0x00  ; vmovaps %xmm8, 8(%rax)
+	DB	0xc5,0x78,0x29,0x48,0x10  ; vmovaps %xmm9, 0x10(%rax)
+	DB	0xc5,0x78,0x29,0x50,0x20  ; vmovaps %xmm10, 0x20(%rax)
+	DB	0xc5,0x78,0x29,0x58,0x30  ; vmovaps %xmm11, 0x30(%rax)
+	DB	0xc5,0x78,0x29,0x60,0x40  ; vmovaps %xmm12, 0x40(%rax)
+	DB	0xc5,0x78,0x29,0x68,0x50  ; vmovaps %xmm13, 0x50(%rax)
+	DB	0xc5,0x78,0x29,0x70,0x60  ; vmovaps %xmm14, 0x60(%rax)
+	DB	0xc5,0x78,0x29,0x78,0x70  ; vmovaps %xmm15, 0x70(%rax)
 	vmovdqa	ymm0,YMMWORD$L$Three
 
 	vpxor	ymm2,ymm2,ymm2
@@ -2417,7 +2417,7 @@
 
 	vmovd	xmm1,r8d
 	vpermd	ymm1,ymm2,ymm1
-
+; Skip index = 0, because it is implicitly the point at infinity
 
 	mov	rax,21
 $L$select_loop_avx2_w7:
@@ -2588,7 +2588,7 @@
 __ecp_nistz256_mul_by_2q:
 
 	xor	r11,r11
-	add	r12,r12
+	add	r12,r12  ; a0:a3+a0:a3
 	adc	r13,r13
 	mov	rax,r12
 	adc	r8,r8
@@ -2647,10 +2647,10 @@
 $L$point_doubleq_body:
 
 $L$point_double_shortcutq:
-	movdqu	xmm0,XMMWORDrsi
-	mov	rbx,rsi
+	movdqu	xmm0,XMMWORDrsi  ; copy	*(P256_POINT *)%rsi.x
+	mov	rbx,rsi  ; backup copy
 	movdqu	xmm1,XMMWORD16+rsi
-	mov	r12,QWORD((32+0))+rsi
+	mov	r12,QWORD((32+0))+rsi  ; load in_y in "5-4-0-1" order
 	mov	r13,QWORD((32+8))+rsi
 	mov	r8,QWORD((32+16))+rsi
 	mov	r9,QWORD((32+24))+rsi
@@ -2665,7 +2665,7 @@
 	movq	xmm2,r11
 
 	lea	rdi,rsp
-	call	__ecp_nistz256_mul_by_2q
+	call	__ecp_nistz256_mul_by_2q  ; p256_mul_by_2(S, in_y);
 
 	mov	rax,QWORD((64+0))+rsi
 	mov	r14,QWORD((64+8))+rsi
@@ -2673,7 +2673,7 @@
 	mov	r8,QWORD((64+24))+rsi
 	lea	rsi,((64-0))+rsi
 	lea	rdi,64+rsp
-	call	__ecp_nistz256_sqr_montq
+	call	__ecp_nistz256_sqr_montq  ; p256_sqr_mont(Zsqr, in_z);
 
 	mov	rax,QWORD((0+0))+rsp
 	mov	r14,QWORD((8+0))+rsp
@@ -2681,9 +2681,9 @@
 	mov	r15,QWORD((16+0))+rsp
 	mov	r8,QWORD((24+0))+rsp
 	lea	rdi,rsp
-	call	__ecp_nistz256_sqr_montq
+	call	__ecp_nistz256_sqr_montq  ; p256_sqr_mont(S, S);
 
-	mov	rax,QWORD32+rbx
+	mov	rax,QWORD32+rbx  ; %rbx is still valid
 	mov	r9,QWORD((64+0))+rbx
 	mov	r10,QWORD((64+8))+rbx
 	mov	r11,QWORD((64+16))+rbx
@@ -2691,24 +2691,24 @@
 	lea	rsi,((64-0))+rbx
 	lea	rbx,32+rbx
 	movq	rdi,xmm2
-	call	__ecp_nistz256_mul_montq
-	call	__ecp_nistz256_mul_by_2q
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(res_z, in_z, in_y);
+	call	__ecp_nistz256_mul_by_2q  ; p256_mul_by_2(res_z, res_z);
 
-	mov	r12,QWORD((96+0))+rsp
+	mov	r12,QWORD((96+0))+rsp  ; "5-4-0-1" order
 	mov	r13,QWORD((96+8))+rsp
 	lea	rbx,64+rsp
 	mov	r8,QWORD((96+16))+rsp
 	mov	r9,QWORD((96+24))+rsp
 	lea	rdi,32+rsp
-	call	__ecp_nistz256_add_toq
+	call	__ecp_nistz256_add_toq  ; p256_add(M, in_x, Zsqr);
 
-	mov	r12,QWORD((96+0))+rsp
+	mov	r12,QWORD((96+0))+rsp  ; "5-4-0-1" order
 	mov	r13,QWORD((96+8))+rsp
 	lea	rbx,64+rsp
 	mov	r8,QWORD((96+16))+rsp
 	mov	r9,QWORD((96+24))+rsp
 	lea	rdi,64+rsp
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  ; p256_sub(Zsqr, in_x, Zsqr);
 
 	mov	rax,QWORD((0+0))+rsp
 	mov	r14,QWORD((8+0))+rsp
@@ -2716,7 +2716,7 @@
 	mov	r15,QWORD((16+0))+rsp
 	mov	r8,QWORD((24+0))+rsp
 	movq	rdi,xmm1
-	call	__ecp_nistz256_sqr_montq
+	call	__ecp_nistz256_sqr_montq  ; p256_sqr_mont(res_y, S);
 	xor	r9,r9
 	mov	rax,r12
 	add	r12,-1
@@ -2727,7 +2727,7 @@
 	mov	r8,r15
 	adc	r15,rbp
 	adc	r9,0
-	xor	rsi,rsi
+	xor	rsi,rsi  ; borrow %rsi
 	test	rax,1
 
 	cmovz	r12,rax
@@ -2736,7 +2736,7 @@
 	cmovz	r15,r8
 	cmovz	r9,rsi
 
-	mov	rax,r13
+	mov	rax,r13  ; a0:a3>>1
 	shr	r12,1
 	shl	rax,63
 	mov	r10,r14
@@ -2763,14 +2763,14 @@
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
 	lea	rdi,32+rsp
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(M, M, Zsqr);
 
 	lea	rdi,128+rsp
 	call	__ecp_nistz256_mul_by_2q
 
 	lea	rbx,32+rsp
 	lea	rdi,32+rsp
-	call	__ecp_nistz256_add_toq
+	call	__ecp_nistz256_add_toq  ; p256_mul_by_3(M, M);
 
 	mov	rax,QWORD96+rsp
 	lea	rbx,96+rsp
@@ -2780,10 +2780,10 @@
 	mov	r11,QWORD((16+0))+rsp
 	mov	r12,QWORD((24+0))+rsp
 	lea	rdi,rsp
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(S, S, in_x);
 
 	lea	rdi,128+rsp
-	call	__ecp_nistz256_mul_by_2q
+	call	__ecp_nistz256_mul_by_2q  ; p256_mul_by_2(tmp0, S);
 
 	mov	rax,QWORD((0+32))+rsp
 	mov	r14,QWORD((8+32))+rsp
@@ -2791,27 +2791,27 @@
 	mov	r15,QWORD((16+32))+rsp
 	mov	r8,QWORD((24+32))+rsp
 	movq	rdi,xmm0
-	call	__ecp_nistz256_sqr_montq
+	call	__ecp_nistz256_sqr_montq  ; p256_sqr_mont(res_x, M);
 
 	lea	rbx,128+rsp
-	mov	r8,r14
+	mov	r8,r14  ; harmonize sqr output and sub input
 	mov	r9,r15
 	mov	r14,rsi
 	mov	r15,rbp
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  ; p256_sub(res_x, res_x, tmp0);
 
 	mov	rax,QWORD((0+0))+rsp
 	mov	rbp,QWORD((0+8))+rsp
 	mov	rcx,QWORD((0+16))+rsp
-	mov	r10,QWORD((0+24))+rsp
+	mov	r10,QWORD((0+24))+rsp  ; "4-5-0-1" order
 	lea	rdi,rsp
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  ; p256_sub(S, S, res_x);
 
 	mov	rax,QWORD32+rsp
 	lea	rbx,32+rsp
-	mov	r14,r12
+	mov	r14,r12  ; harmonize sub output and mul input
 	xor	ecx,ecx
-	mov	QWORD((0+0))+rsp,r12
+	mov	QWORD((0+0))+rsp,r12  ; have to save:-(
 	mov	r10,r13
 	mov	QWORD((0+8))+rsp,r13
 	cmovz	r11,r8
@@ -2821,11 +2821,11 @@
 	mov	QWORD((0+24))+rsp,r9
 	mov	r9,r14
 	lea	rdi,rsp
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(S, S, M);
 
 	movq	rbx,xmm1
 	movq	rdi,xmm1
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  ; p256_sub(res_y, S, res_y);
 
 	lea	rsi,((160+56))+rsp
 
@@ -2880,14 +2880,14 @@
 
 $L$point_addq_body:
 
-	movdqu	xmm0,XMMWORDrsi
+	movdqu	xmm0,XMMWORDrsi  ; copy	*(P256_POINT *)%rsi
 	movdqu	xmm1,XMMWORD16+rsi
 	movdqu	xmm2,XMMWORD32+rsi
 	movdqu	xmm3,XMMWORD48+rsi
 	movdqu	xmm4,XMMWORD64+rsi
 	movdqu	xmm5,XMMWORD80+rsi
-	mov	rbx,rsi
-	mov	rsi,rdx
+	mov	rbx,rsi  ; reassign
+	mov	rsi,rdx  ; reassign
 	movdqa	XMMWORD384+rsp,xmm0
 	movdqa	XMMWORD(384+16)+rsp,xmm1
 	movdqa	XMMWORD416+rsp,xmm2
@@ -2896,54 +2896,54 @@
 	movdqa	XMMWORD(448+16)+rsp,xmm5
 	por	xmm5,xmm4
 
-	movdqu	xmm0,XMMWORDrsi
+	movdqu	xmm0,XMMWORDrsi  ; copy	*(P256_POINT *)%rbx
 	pshufd	xmm3,xmm5,0xb1
 	movdqu	xmm1,XMMWORD16+rsi
 	movdqu	xmm2,XMMWORD32+rsi
 	por	xmm5,xmm3
 	movdqu	xmm3,XMMWORD48+rsi
-	mov	rax,QWORD((64+0))+rsi
+	mov	rax,QWORD((64+0))+rsi  ; load original in2_z
 	mov	r14,QWORD((64+8))+rsi
 	mov	r15,QWORD((64+16))+rsi
 	mov	r8,QWORD((64+24))+rsi
 	movdqa	XMMWORD480+rsp,xmm0
 	pshufd	xmm4,xmm5,0x1e
 	movdqa	XMMWORD(480+16)+rsp,xmm1
-	movdqu	xmm0,XMMWORD64+rsi
+	movdqu	xmm0,XMMWORD64+rsi  ; in2_z again
 	movdqu	xmm1,XMMWORD80+rsi
 	movdqa	XMMWORD512+rsp,xmm2
 	movdqa	XMMWORD(512+16)+rsp,xmm3
 	por	xmm5,xmm4
 	pxor	xmm4,xmm4
 	por	xmm1,xmm0
-	movq	xmm0,rdi
+	movq	xmm0,rdi  ; save %rdi
 
-	lea	rsi,((64-0))+rsi
-	mov	QWORD((544+0))+rsp,rax
+	lea	rsi,((64-0))+rsi  ; %rsi is still valid
+	mov	QWORD((544+0))+rsp,rax  ; make in2_z copy
 	mov	QWORD((544+8))+rsp,r14
 	mov	QWORD((544+16))+rsp,r15
 	mov	QWORD((544+24))+rsp,r8
-	lea	rdi,96+rsp
-	call	__ecp_nistz256_sqr_montq
+	lea	rdi,96+rsp  ; Z2^2
+	call	__ecp_nistz256_sqr_montq  ; p256_sqr_mont(Z2sqr, in2_z);
 
 	pcmpeqd	xmm5,xmm4
 	pshufd	xmm4,xmm1,0xb1
 	por	xmm4,xmm1
-	pshufd	xmm5,xmm5,0
+	pshufd	xmm5,xmm5,0  ; in1infty
 	pshufd	xmm3,xmm4,0x1e
 	por	xmm4,xmm3
 	pxor	xmm3,xmm3
 	pcmpeqd	xmm4,xmm3
-	pshufd	xmm4,xmm4,0
-	mov	rax,QWORD((64+0))+rbx
+	pshufd	xmm4,xmm4,0  ; in2infty
+	mov	rax,QWORD((64+0))+rbx  ; load original in1_z
 	mov	r14,QWORD((64+8))+rbx
 	mov	r15,QWORD((64+16))+rbx
 	mov	r8,QWORD((64+24))+rbx
 	movq	xmm1,rbx
 
 	lea	rsi,((64-0))+rbx
-	lea	rdi,32+rsp
-	call	__ecp_nistz256_sqr_montq
+	lea	rdi,32+rsp  ; Z1^2
+	call	__ecp_nistz256_sqr_montq  ; p256_sqr_mont(Z1sqr, in1_z);
 
 	mov	rax,QWORD544+rsp
 	lea	rbx,544+rsp
@@ -2952,8 +2952,8 @@
 	lea	rsi,((0+96))+rsp
 	mov	r11,QWORD((16+96))+rsp
 	mov	r12,QWORD((24+96))+rsp
-	lea	rdi,224+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,224+rsp  ; S1 = Z2^3
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(S1, Z2sqr, in2_z);
 
 	mov	rax,QWORD448+rsp
 	lea	rbx,448+rsp
@@ -2962,8 +2962,8 @@
 	lea	rsi,((0+32))+rsp
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
-	lea	rdi,256+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,256+rsp  ; S2 = Z1^3
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(S2, Z1sqr, in1_z);
 
 	mov	rax,QWORD416+rsp
 	lea	rbx,416+rsp
@@ -2972,8 +2972,8 @@
 	lea	rsi,((0+224))+rsp
 	mov	r11,QWORD((16+224))+rsp
 	mov	r12,QWORD((24+224))+rsp
-	lea	rdi,224+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,224+rsp  ; S1 = Y1*Z2^3
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(S1, S1, in1_y);
 
 	mov	rax,QWORD512+rsp
 	lea	rbx,512+rsp
@@ -2982,18 +2982,18 @@
 	lea	rsi,((0+256))+rsp
 	mov	r11,QWORD((16+256))+rsp
 	mov	r12,QWORD((24+256))+rsp
-	lea	rdi,256+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,256+rsp  ; S2 = Y2*Z1^3
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(S2, S2, in2_y);
 
 	lea	rbx,224+rsp
-	lea	rdi,64+rsp
-	call	__ecp_nistz256_sub_fromq
+	lea	rdi,64+rsp  ; R = S2 - S1
+	call	__ecp_nistz256_sub_fromq  ; p256_sub(R, S2, S1);
 
-	or	r12,r13
+	or	r12,r13  ; see if result is zero
 	movdqa	xmm2,xmm4
 	or	r12,r8
 	or	r12,r9
-	por	xmm2,xmm5
+	por	xmm2,xmm5  ; in1infty || in2infty
 	movq	xmm3,r12
 
 	mov	rax,QWORD384+rsp
@@ -3003,8 +3003,8 @@
 	lea	rsi,((0+96))+rsp
 	mov	r11,QWORD((16+96))+rsp
 	mov	r12,QWORD((24+96))+rsp
-	lea	rdi,160+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,160+rsp  ; U1 = X1*Z2^2
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(U1, in1_x, Z2sqr);
 
 	mov	rax,QWORD480+rsp
 	lea	rbx,480+rsp
@@ -3013,34 +3013,34 @@
 	lea	rsi,((0+32))+rsp
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
-	lea	rdi,192+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,192+rsp  ; U2 = X2*Z1^2
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(U2, in2_x, Z1sqr);
 
 	lea	rbx,160+rsp
-	lea	rdi,rsp
-	call	__ecp_nistz256_sub_fromq
+	lea	rdi,rsp  ; H = U2 - U1
+	call	__ecp_nistz256_sub_fromq  ; p256_sub(H, U2, U1);
 
-	or	r12,r13
+	or	r12,r13  ; see if result is zero
 	or	r12,r8
-	or	r12,r9
+	or	r12,r9  ; !is_equal(U1, U2)
 
 	movq	r8,xmm2
 	movq	r9,xmm3
 	or	r12,r8
-	DB	0x3e
-	jnz	NEAR $L$add_proceedq
-
-
+	DB	0x3e  ; predict taken
+	jnz	NEAR $L$add_proceedq  ; !is_equal(U1, U2) || in1infty || in2infty
 
+; We now know A = B or A = -B and neither is infinity. Compare the
+; y-coordinates via S1 and S2.
 	test	r9,r9
-	jz	NEAR $L$add_doubleq
+	jz	NEAR $L$add_doubleq  ; is_equal(S1, S2)
 
-
-
-
-
-
-	movq	rdi,xmm0
+; A = -B, so the result is infinity.
+; 
+; TODO(davidben): Does .Ladd_proceed handle this case? It seems to, in
+; which case we should eliminate this special-case and simplify the
+; timing analysis.
+	movq	rdi,xmm0  ; restore %rdi
 	pxor	xmm0,xmm0
 	movdqu	XMMWORDrdi,xmm0
 	movdqu	XMMWORD16+rdi,xmm0
@@ -3052,9 +3052,9 @@
 
 ALIGN	32
 $L$add_doubleq:
-	movq	rsi,xmm1
-	movq	rdi,xmm0
-	add	rsp,416
+	movq	rsi,xmm1  ; restore %rsi
+	movq	rdi,xmm0  ; restore %rdi
+	add	rsp,416  ; difference in frame sizes
 
 	jmp	NEAR $L$point_double_shortcutq
 
@@ -3066,8 +3066,8 @@
 	lea	rsi,((0+64))+rsp
 	mov	r15,QWORD((16+64))+rsp
 	mov	r8,QWORD((24+64))+rsp
-	lea	rdi,96+rsp
-	call	__ecp_nistz256_sqr_montq
+	lea	rdi,96+rsp  ; R^2
+	call	__ecp_nistz256_sqr_montq  ; p256_sqr_mont(Rsqr, R);
 
 	mov	rax,QWORD448+rsp
 	lea	rbx,448+rsp
@@ -3076,16 +3076,16 @@
 	lea	rsi,((0+0))+rsp
 	mov	r11,QWORD((16+0))+rsp
 	mov	r12,QWORD((24+0))+rsp
-	lea	rdi,352+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,352+rsp  ; Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(res_z, H, in1_z);
 
 	mov	rax,QWORD((0+0))+rsp
 	mov	r14,QWORD((8+0))+rsp
 	lea	rsi,((0+0))+rsp
 	mov	r15,QWORD((16+0))+rsp
 	mov	r8,QWORD((24+0))+rsp
-	lea	rdi,32+rsp
-	call	__ecp_nistz256_sqr_montq
+	lea	rdi,32+rsp  ; H^2
+	call	__ecp_nistz256_sqr_montq  ; p256_sqr_mont(Hsqr, H);
 
 	mov	rax,QWORD544+rsp
 	lea	rbx,544+rsp
@@ -3094,8 +3094,8 @@
 	lea	rsi,((0+352))+rsp
 	mov	r11,QWORD((16+352))+rsp
 	mov	r12,QWORD((24+352))+rsp
-	lea	rdi,352+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,352+rsp  ; Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(res_z, res_z, in2_z);
 
 	mov	rax,QWORDrsp
 	lea	rbx,rsp
@@ -3104,8 +3104,8 @@
 	lea	rsi,((0+32))+rsp
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
-	lea	rdi,128+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,128+rsp  ; H^3
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(Hcub, Hsqr, H);
 
 	mov	rax,QWORD160+rsp
 	lea	rbx,160+rsp
@@ -3114,14 +3114,14 @@
 	lea	rsi,((0+32))+rsp
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
-	lea	rdi,192+rsp
-	call	__ecp_nistz256_mul_montq
-
-
-
+	lea	rdi,192+rsp  ; U1*H^2
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(U2, U1, Hsqr);
+; lea	192(%rsp), %rsi
+; lea	32(%rsp), %rdi	# 2*U1*H^2
+; call	__ecp_nistz256_mul_by_2	# ecp_nistz256_mul_by_2(Hsqr, U2);
 
 	xor	r11,r11
-	add	r12,r12
+	add	r12,r12  ; a0:a3+a0:a3
 	lea	rsi,96+rsp
 	adc	r13,r13
 	mov	rax,r12
@@ -3147,11 +3147,11 @@
 	cmovc	r9,r10
 	mov	r10,QWORD24+rsi
 
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  ; p256_sub(res_x, Rsqr, Hsqr);
 
 	lea	rbx,128+rsp
 	lea	rdi,288+rsp
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  ; p256_sub(res_x, res_x, Hcub);
 
 	mov	rax,QWORD((192+0))+rsp
 	mov	rbp,QWORD((192+8))+rsp
@@ -3159,10 +3159,10 @@
 	mov	r10,QWORD((192+24))+rsp
 	lea	rdi,320+rsp
 
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  ; p256_sub(res_y, U2, res_x);
 
-	mov	QWORDrdi,r12
-	mov	QWORD8+rdi,r13
+	mov	QWORDrdi,r12  ; save the result, as
+	mov	QWORD8+rdi,r13  ; __ecp_nistz256_sub doesn't
 	mov	QWORD16+rdi,r8
 	mov	QWORD24+rdi,r9
 	mov	rax,QWORD128+rsp
@@ -3173,7 +3173,7 @@
 	mov	r11,QWORD((16+224))+rsp
 	mov	r12,QWORD((24+224))+rsp
 	lea	rdi,256+rsp
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(S2, S1, Hcub);
 
 	mov	rax,QWORD320+rsp
 	lea	rbx,320+rsp
@@ -3183,15 +3183,15 @@
 	mov	r11,QWORD((16+64))+rsp
 	mov	r12,QWORD((24+64))+rsp
 	lea	rdi,320+rsp
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(res_y, R, res_y);
 
 	lea	rbx,256+rsp
 	lea	rdi,320+rsp
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  ; p256_sub(res_y, res_y, S2);
 
-	movq	rdi,xmm0
+	movq	rdi,xmm0  ; restore %rdi
 
-	movdqa	xmm0,xmm5
+	movdqa	xmm0,xmm5  ; copy_conditional(res_z, in2_z, in1infty);
 	movdqa	xmm1,xmm5
 	pandn	xmm0,XMMWORD352+rsp
 	movdqa	xmm2,xmm5
@@ -3202,7 +3202,7 @@
 	por	xmm2,xmm0
 	por	xmm3,xmm1
 
-	movdqa	xmm0,xmm4
+	movdqa	xmm0,xmm4  ; copy_conditional(res_z, in1_z, in2infty);
 	movdqa	xmm1,xmm4
 	pandn	xmm0,xmm2
 	movdqa	xmm2,xmm4
@@ -3215,7 +3215,7 @@
 	movdqu	XMMWORD64+rdi,xmm2
 	movdqu	XMMWORD80+rdi,xmm3
 
-	movdqa	xmm0,xmm5
+	movdqa	xmm0,xmm5  ; copy_conditional(res_x, in2_x, in1infty);
 	movdqa	xmm1,xmm5
 	pandn	xmm0,XMMWORD288+rsp
 	movdqa	xmm2,xmm5
@@ -3226,7 +3226,7 @@
 	por	xmm2,xmm0
 	por	xmm3,xmm1
 
-	movdqa	xmm0,xmm4
+	movdqa	xmm0,xmm4  ; copy_conditional(res_x, in1_x, in2infty);
 	movdqa	xmm1,xmm4
 	pandn	xmm0,xmm2
 	movdqa	xmm2,xmm4
@@ -3239,7 +3239,7 @@
 	movdqu	XMMWORDrdi,xmm2
 	movdqu	XMMWORD16+rdi,xmm3
 
-	movdqa	xmm0,xmm5
+	movdqa	xmm0,xmm5  ; copy_conditional(res_y, in2_y, in1infty);
 	movdqa	xmm1,xmm5
 	pandn	xmm0,XMMWORD320+rsp
 	movdqa	xmm2,xmm5
@@ -3250,7 +3250,7 @@
 	por	xmm2,xmm0
 	por	xmm3,xmm1
 
-	movdqa	xmm0,xmm4
+	movdqa	xmm0,xmm4  ; copy_conditional(res_y, in1_y, in2infty);
 	movdqa	xmm1,xmm4
 	pandn	xmm0,xmm2
 	movdqa	xmm2,xmm4
@@ -3317,14 +3317,14 @@
 
 $L$add_affineq_body:
 
-	movdqu	xmm0,XMMWORDrsi
-	mov	rbx,rdx
+	movdqu	xmm0,XMMWORDrsi  ; copy	*(P256_POINT *)%rsi
+	mov	rbx,rdx  ; reassign
 	movdqu	xmm1,XMMWORD16+rsi
 	movdqu	xmm2,XMMWORD32+rsi
 	movdqu	xmm3,XMMWORD48+rsi
 	movdqu	xmm4,XMMWORD64+rsi
 	movdqu	xmm5,XMMWORD80+rsi
-	mov	rax,QWORD((64+0))+rsi
+	mov	rax,QWORD((64+0))+rsi  ; load original in1_z
 	mov	r14,QWORD((64+8))+rsi
 	mov	r15,QWORD((64+16))+rsi
 	mov	r8,QWORD((64+24))+rsi
@@ -3336,7 +3336,7 @@
 	movdqa	XMMWORD(384+16)+rsp,xmm5
 	por	xmm5,xmm4
 
-	movdqu	xmm0,XMMWORDrbx
+	movdqu	xmm0,XMMWORDrbx  ; copy	*(P256_POINT_AFFINE *)%rbx
 	pshufd	xmm3,xmm5,0xb1
 	movdqu	xmm1,XMMWORD16+rbx
 	movdqu	xmm2,XMMWORD32+rbx
@@ -3346,7 +3346,7 @@
 	pshufd	xmm4,xmm5,0x1e
 	movdqa	XMMWORD(416+16)+rsp,xmm1
 	por	xmm1,xmm0
-	movq	xmm0,rdi
+	movq	xmm0,rdi  ; save %rdi
 	movdqa	XMMWORD448+rsp,xmm2
 	movdqa	XMMWORD(448+16)+rsp,xmm3
 	por	xmm3,xmm2
@@ -3354,33 +3354,33 @@
 	pxor	xmm4,xmm4
 	por	xmm3,xmm1
 
-	lea	rsi,((64-0))+rsi
-	lea	rdi,32+rsp
-	call	__ecp_nistz256_sqr_montq
+	lea	rsi,((64-0))+rsi  ; %rsi is still valid
+	lea	rdi,32+rsp  ; Z1^2
+	call	__ecp_nistz256_sqr_montq  ; p256_sqr_mont(Z1sqr, in1_z);
 
 	pcmpeqd	xmm5,xmm4
 	pshufd	xmm4,xmm3,0xb1
-	mov	rax,QWORDrbx
-
-	mov	r9,r12
+	mov	rax,QWORDrbx  ; %rbx is still valid
+; lea	0x00(%rbx), %rbx
+	mov	r9,r12  ; harmonize sqr output and mul input
 	por	xmm4,xmm3
-	pshufd	xmm5,xmm5,0
+	pshufd	xmm5,xmm5,0  ; in1infty
 	pshufd	xmm3,xmm4,0x1e
 	mov	r10,r13
 	por	xmm4,xmm3
 	pxor	xmm3,xmm3
 	mov	r11,r14
 	pcmpeqd	xmm4,xmm3
-	pshufd	xmm4,xmm4,0
+	pshufd	xmm4,xmm4,0  ; in2infty
 
 	lea	rsi,((32-0))+rsp
 	mov	r12,r15
-	lea	rdi,rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,rsp  ; U2 = X2*Z1^2
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(U2, Z1sqr, in2_x);
 
 	lea	rbx,320+rsp
-	lea	rdi,64+rsp
-	call	__ecp_nistz256_sub_fromq
+	lea	rdi,64+rsp  ; H = U2 - U1
+	call	__ecp_nistz256_sub_fromq  ; p256_sub(H, U2, in1_x);
 
 	mov	rax,QWORD384+rsp
 	lea	rbx,384+rsp
@@ -3389,8 +3389,8 @@
 	lea	rsi,((0+32))+rsp
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
-	lea	rdi,32+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,32+rsp  ; S2 = Z1^3
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(S2, Z1sqr, in1_z);
 
 	mov	rax,QWORD384+rsp
 	lea	rbx,384+rsp
@@ -3399,8 +3399,8 @@
 	lea	rsi,((0+64))+rsp
 	mov	r11,QWORD((16+64))+rsp
 	mov	r12,QWORD((24+64))+rsp
-	lea	rdi,288+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,288+rsp  ; Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(res_z, H, in1_z);
 
 	mov	rax,QWORD448+rsp
 	lea	rbx,448+rsp
@@ -3409,28 +3409,28 @@
 	lea	rsi,((0+32))+rsp
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
-	lea	rdi,32+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,32+rsp  ; S2 = Y2*Z1^3
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(S2, S2, in2_y);
 
 	lea	rbx,352+rsp
-	lea	rdi,96+rsp
-	call	__ecp_nistz256_sub_fromq
+	lea	rdi,96+rsp  ; R = S2 - S1
+	call	__ecp_nistz256_sub_fromq  ; p256_sub(R, S2, in1_y);
 
 	mov	rax,QWORD((0+64))+rsp
 	mov	r14,QWORD((8+64))+rsp
 	lea	rsi,((0+64))+rsp
 	mov	r15,QWORD((16+64))+rsp
 	mov	r8,QWORD((24+64))+rsp
-	lea	rdi,128+rsp
-	call	__ecp_nistz256_sqr_montq
+	lea	rdi,128+rsp  ; H^2
+	call	__ecp_nistz256_sqr_montq  ; p256_sqr_mont(Hsqr, H);
 
 	mov	rax,QWORD((0+96))+rsp
 	mov	r14,QWORD((8+96))+rsp
 	lea	rsi,((0+96))+rsp
 	mov	r15,QWORD((16+96))+rsp
 	mov	r8,QWORD((24+96))+rsp
-	lea	rdi,192+rsp
-	call	__ecp_nistz256_sqr_montq
+	lea	rdi,192+rsp  ; R^2
+	call	__ecp_nistz256_sqr_montq  ; p256_sqr_mont(Rsqr, R);
 
 	mov	rax,QWORD128+rsp
 	lea	rbx,128+rsp
@@ -3439,8 +3439,8 @@
 	lea	rsi,((0+64))+rsp
 	mov	r11,QWORD((16+64))+rsp
 	mov	r12,QWORD((24+64))+rsp
-	lea	rdi,160+rsp
-	call	__ecp_nistz256_mul_montq
+	lea	rdi,160+rsp  ; H^3
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(Hcub, Hsqr, H);
 
 	mov	rax,QWORD320+rsp
 	lea	rbx,320+rsp
@@ -3449,14 +3449,14 @@
 	lea	rsi,((0+128))+rsp
 	mov	r11,QWORD((16+128))+rsp
 	mov	r12,QWORD((24+128))+rsp
-	lea	rdi,rsp
-	call	__ecp_nistz256_mul_montq
-
-
-
+	lea	rdi,rsp  ; U1*H^2
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(U2, in1_x, Hsqr);
+; lea	0(%rsp), %rsi
+; lea	128(%rsp), %rdi	# 2*U1*H^2
+; call	__ecp_nistz256_mul_by_2	# ecp_nistz256_mul_by_2(Hsqr, U2);
 
 	xor	r11,r11
-	add	r12,r12
+	add	r12,r12  ; a0:a3+a0:a3
 	lea	rsi,192+rsp
 	adc	r13,r13
 	mov	rax,r12
@@ -3482,11 +3482,11 @@
 	cmovc	r9,r10
 	mov	r10,QWORD24+rsi
 
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  ; p256_sub(res_x, Rsqr, Hsqr);
 
 	lea	rbx,160+rsp
 	lea	rdi,224+rsp
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  ; p256_sub(res_x, res_x, Hcub);
 
 	mov	rax,QWORD((0+0))+rsp
 	mov	rbp,QWORD((0+8))+rsp
@@ -3494,10 +3494,10 @@
 	mov	r10,QWORD((0+24))+rsp
 	lea	rdi,64+rsp
 
-	call	__ecp_nistz256_subq
+	call	__ecp_nistz256_subq  ; p256_sub(H, U2, res_x);
 
-	mov	QWORDrdi,r12
-	mov	QWORD8+rdi,r13
+	mov	QWORDrdi,r12  ; save the result, as
+	mov	QWORD8+rdi,r13  ; __ecp_nistz256_sub doesn't
 	mov	QWORD16+rdi,r8
 	mov	QWORD24+rdi,r9
 	mov	rax,QWORD352+rsp
@@ -3508,7 +3508,7 @@
 	mov	r11,QWORD((16+160))+rsp
 	mov	r12,QWORD((24+160))+rsp
 	lea	rdi,32+rsp
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(S2, Hcub, in1_y);
 
 	mov	rax,QWORD96+rsp
 	lea	rbx,96+rsp
@@ -3518,15 +3518,15 @@
 	mov	r11,QWORD((16+64))+rsp
 	mov	r12,QWORD((24+64))+rsp
 	lea	rdi,64+rsp
-	call	__ecp_nistz256_mul_montq
+	call	__ecp_nistz256_mul_montq  ; p256_mul_mont(H, H, R);
 
 	lea	rbx,32+rsp
 	lea	rdi,256+rsp
-	call	__ecp_nistz256_sub_fromq
+	call	__ecp_nistz256_sub_fromq  ; p256_sub(res_y, H, S2);
 
-	movq	rdi,xmm0
+	movq	rdi,xmm0  ; restore %rdi
 
-	movdqa	xmm0,xmm5
+	movdqa	xmm0,xmm5  ; copy_conditional(res_z, ONE, in1infty);
 	movdqa	xmm1,xmm5
 	pandn	xmm0,XMMWORD288+rsp
 	movdqa	xmm2,xmm5
@@ -3537,7 +3537,7 @@
 	por	xmm2,xmm0
 	por	xmm3,xmm1
 
-	movdqa	xmm0,xmm4
+	movdqa	xmm0,xmm4  ; copy_conditional(res_z, in1_z, in2infty);
 	movdqa	xmm1,xmm4
 	pandn	xmm0,xmm2
 	movdqa	xmm2,xmm4
@@ -3550,7 +3550,7 @@
 	movdqu	XMMWORD64+rdi,xmm2
 	movdqu	XMMWORD80+rdi,xmm3
 
-	movdqa	xmm0,xmm5
+	movdqa	xmm0,xmm5  ; copy_conditional(res_x, in2_x, in1infty);
 	movdqa	xmm1,xmm5
 	pandn	xmm0,XMMWORD224+rsp
 	movdqa	xmm2,xmm5
@@ -3561,7 +3561,7 @@
 	por	xmm2,xmm0
 	por	xmm3,xmm1
 
-	movdqa	xmm0,xmm4
+	movdqa	xmm0,xmm4  ; copy_conditional(res_x, in1_x, in2infty);
 	movdqa	xmm1,xmm4
 	pandn	xmm0,xmm2
 	movdqa	xmm2,xmm4
@@ -3574,7 +3574,7 @@
 	movdqu	XMMWORDrdi,xmm2
 	movdqu	XMMWORD16+rdi,xmm3
 
-	movdqa	xmm0,xmm5
+	movdqa	xmm0,xmm5  ; copy_conditional(res_y, in2_y, in1infty);
 	movdqa	xmm1,xmm5
 	pandn	xmm0,XMMWORD256+rsp
 	movdqa	xmm2,xmm5
@@ -3585,7 +3585,7 @@
 	por	xmm2,xmm0
 	por	xmm3,xmm1
 
-	movdqa	xmm0,xmm4
+	movdqa	xmm0,xmm4  ; copy_conditional(res_y, in1_y, in2infty);
 	movdqa	xmm1,xmm4
 	pandn	xmm0,xmm2
 	movdqa	xmm2,xmm4
@@ -3726,7 +3726,7 @@
 __ecp_nistz256_mul_by_2x:
 
 	xor	r11,r11
-	adc	r12,r12
+	adc	r12,r12  ; a0:a3+a0:a3
 	adc	r13,r13
 	mov	rax,r12
 	adc	r8,r8
@@ -3786,10 +3786,10 @@
 $L$point_doublex_body:
 
 $L$point_double_shortcutx:
-	movdqu	xmm0,XMMWORDrsi
-	mov	rbx,rsi
+	movdqu	xmm0,XMMWORDrsi  ; copy	*(P256_POINT *)%rsi.x
+	mov	rbx,rsi  ; backup copy
 	movdqu	xmm1,XMMWORD16+rsi
-	mov	r12,QWORD((32+0))+rsi
+	mov	r12,QWORD((32+0))+rsi  ; load in_y in "5-4-0-1" order
 	mov	r13,QWORD((32+8))+rsi
 	mov	r8,QWORD((32+16))+rsi
 	mov	r9,QWORD((32+24))+rsi
@@ -3804,7 +3804,7 @@
 	movq	xmm2,r11
 
 	lea	rdi,rsp
-	call	__ecp_nistz256_mul_by_2x
+	call	__ecp_nistz256_mul_by_2x  ; p256_mul_by_2(S, in_y);
 
 	mov	rdx,QWORD((64+0))+rsi
 	mov	r14,QWORD((64+8))+rsi
@@ -3812,7 +3812,7 @@
 	mov	r8,QWORD((64+24))+rsi
 	lea	rsi,((64-128))+rsi
 	lea	rdi,64+rsp
-	call	__ecp_nistz256_sqr_montx
+	call	__ecp_nistz256_sqr_montx  ; p256_sqr_mont(Zsqr, in_z);
 
 	mov	rdx,QWORD((0+0))+rsp
 	mov	r14,QWORD((8+0))+rsp
@@ -3820,9 +3820,9 @@
 	mov	r15,QWORD((16+0))+rsp
 	mov	r8,QWORD((24+0))+rsp
 	lea	rdi,rsp
-	call	__ecp_nistz256_sqr_montx
+	call	__ecp_nistz256_sqr_montx  ; p256_sqr_mont(S, S);
 
-	mov	rdx,QWORD32+rbx
+	mov	rdx,QWORD32+rbx  ; %rbx is still valid
 	mov	r9,QWORD((64+0))+rbx
 	mov	r10,QWORD((64+8))+rbx
 	mov	r11,QWORD((64+16))+rbx
@@ -3830,24 +3830,24 @@
 	lea	rsi,((64-128))+rbx
 	lea	rbx,32+rbx
 	movq	rdi,xmm2
-	call	__ecp_nistz256_mul_montx
-	call	__ecp_nistz256_mul_by_2x
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(res_z, in_z, in_y);
+	call	__ecp_nistz256_mul_by_2x  ; p256_mul_by_2(res_z, res_z);
 
-	mov	r12,QWORD((96+0))+rsp
+	mov	r12,QWORD((96+0))+rsp  ; "5-4-0-1" order
 	mov	r13,QWORD((96+8))+rsp
 	lea	rbx,64+rsp
 	mov	r8,QWORD((96+16))+rsp
 	mov	r9,QWORD((96+24))+rsp
 	lea	rdi,32+rsp
-	call	__ecp_nistz256_add_tox
+	call	__ecp_nistz256_add_tox  ; p256_add(M, in_x, Zsqr);
 
-	mov	r12,QWORD((96+0))+rsp
+	mov	r12,QWORD((96+0))+rsp  ; "5-4-0-1" order
 	mov	r13,QWORD((96+8))+rsp
 	lea	rbx,64+rsp
 	mov	r8,QWORD((96+16))+rsp
 	mov	r9,QWORD((96+24))+rsp
 	lea	rdi,64+rsp
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  ; p256_sub(Zsqr, in_x, Zsqr);
 
 	mov	rdx,QWORD((0+0))+rsp
 	mov	r14,QWORD((8+0))+rsp
@@ -3855,7 +3855,7 @@
 	mov	r15,QWORD((16+0))+rsp
 	mov	r8,QWORD((24+0))+rsp
 	movq	rdi,xmm1
-	call	__ecp_nistz256_sqr_montx
+	call	__ecp_nistz256_sqr_montx  ; p256_sqr_mont(res_y, S);
 	xor	r9,r9
 	mov	rax,r12
 	add	r12,-1
@@ -3866,7 +3866,7 @@
 	mov	r8,r15
 	adc	r15,rbp
 	adc	r9,0
-	xor	rsi,rsi
+	xor	rsi,rsi  ; borrow %rsi
 	test	rax,1
 
 	cmovz	r12,rax
@@ -3875,7 +3875,7 @@
 	cmovz	r15,r8
 	cmovz	r9,rsi
 
-	mov	rax,r13
+	mov	rax,r13  ; a0:a3>>1
 	shr	r12,1
 	shl	rax,63
 	mov	r10,r14
@@ -3902,14 +3902,14 @@
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
 	lea	rdi,32+rsp
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(M, M, Zsqr);
 
 	lea	rdi,128+rsp
 	call	__ecp_nistz256_mul_by_2x
 
 	lea	rbx,32+rsp
 	lea	rdi,32+rsp
-	call	__ecp_nistz256_add_tox
+	call	__ecp_nistz256_add_tox  ; p256_mul_by_3(M, M);
 
 	mov	rdx,QWORD96+rsp
 	lea	rbx,96+rsp
@@ -3919,10 +3919,10 @@
 	mov	r11,QWORD((16+0))+rsp
 	mov	r12,QWORD((24+0))+rsp
 	lea	rdi,rsp
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(S, S, in_x);
 
 	lea	rdi,128+rsp
-	call	__ecp_nistz256_mul_by_2x
+	call	__ecp_nistz256_mul_by_2x  ; p256_mul_by_2(tmp0, S);
 
 	mov	rdx,QWORD((0+32))+rsp
 	mov	r14,QWORD((8+32))+rsp
@@ -3930,27 +3930,27 @@
 	mov	r15,QWORD((16+32))+rsp
 	mov	r8,QWORD((24+32))+rsp
 	movq	rdi,xmm0
-	call	__ecp_nistz256_sqr_montx
+	call	__ecp_nistz256_sqr_montx  ; p256_sqr_mont(res_x, M);
 
 	lea	rbx,128+rsp
-	mov	r8,r14
+	mov	r8,r14  ; harmonize sqr output and sub input
 	mov	r9,r15
 	mov	r14,rsi
 	mov	r15,rbp
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  ; p256_sub(res_x, res_x, tmp0);
 
 	mov	rax,QWORD((0+0))+rsp
 	mov	rbp,QWORD((0+8))+rsp
 	mov	rcx,QWORD((0+16))+rsp
-	mov	r10,QWORD((0+24))+rsp
+	mov	r10,QWORD((0+24))+rsp  ; "4-5-0-1" order
 	lea	rdi,rsp
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  ; p256_sub(S, S, res_x);
 
 	mov	rdx,QWORD32+rsp
 	lea	rbx,32+rsp
-	mov	r14,r12
+	mov	r14,r12  ; harmonize sub output and mul input
 	xor	ecx,ecx
-	mov	QWORD((0+0))+rsp,r12
+	mov	QWORD((0+0))+rsp,r12  ; have to save:-(
 	mov	r10,r13
 	mov	QWORD((0+8))+rsp,r13
 	cmovz	r11,r8
@@ -3960,11 +3960,11 @@
 	mov	QWORD((0+24))+rsp,r9
 	mov	r9,r14
 	lea	rdi,rsp
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(S, S, M);
 
 	movq	rbx,xmm1
 	movq	rdi,xmm1
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  ; p256_sub(res_y, S, res_y);
 
 	lea	rsi,((160+56))+rsp
 
@@ -4019,14 +4019,14 @@
 
 $L$point_addx_body:
 
-	movdqu	xmm0,XMMWORDrsi
+	movdqu	xmm0,XMMWORDrsi  ; copy	*(P256_POINT *)%rsi
 	movdqu	xmm1,XMMWORD16+rsi
 	movdqu	xmm2,XMMWORD32+rsi
 	movdqu	xmm3,XMMWORD48+rsi
 	movdqu	xmm4,XMMWORD64+rsi
 	movdqu	xmm5,XMMWORD80+rsi
-	mov	rbx,rsi
-	mov	rsi,rdx
+	mov	rbx,rsi  ; reassign
+	mov	rsi,rdx  ; reassign
 	movdqa	XMMWORD384+rsp,xmm0
 	movdqa	XMMWORD(384+16)+rsp,xmm1
 	movdqa	XMMWORD416+rsp,xmm2
@@ -4035,54 +4035,54 @@
 	movdqa	XMMWORD(448+16)+rsp,xmm5
 	por	xmm5,xmm4
 
-	movdqu	xmm0,XMMWORDrsi
+	movdqu	xmm0,XMMWORDrsi  ; copy	*(P256_POINT *)%rbx
 	pshufd	xmm3,xmm5,0xb1
 	movdqu	xmm1,XMMWORD16+rsi
 	movdqu	xmm2,XMMWORD32+rsi
 	por	xmm5,xmm3
 	movdqu	xmm3,XMMWORD48+rsi
-	mov	rdx,QWORD((64+0))+rsi
+	mov	rdx,QWORD((64+0))+rsi  ; load original in2_z
 	mov	r14,QWORD((64+8))+rsi
 	mov	r15,QWORD((64+16))+rsi
 	mov	r8,QWORD((64+24))+rsi
 	movdqa	XMMWORD480+rsp,xmm0
 	pshufd	xmm4,xmm5,0x1e
 	movdqa	XMMWORD(480+16)+rsp,xmm1
-	movdqu	xmm0,XMMWORD64+rsi
+	movdqu	xmm0,XMMWORD64+rsi  ; in2_z again
 	movdqu	xmm1,XMMWORD80+rsi
 	movdqa	XMMWORD512+rsp,xmm2
 	movdqa	XMMWORD(512+16)+rsp,xmm3
 	por	xmm5,xmm4
 	pxor	xmm4,xmm4
 	por	xmm1,xmm0
-	movq	xmm0,rdi
+	movq	xmm0,rdi  ; save %rdi
 
-	lea	rsi,((64-128))+rsi
-	mov	QWORD((544+0))+rsp,rdx
+	lea	rsi,((64-128))+rsi  ; %rsi is still valid
+	mov	QWORD((544+0))+rsp,rdx  ; make in2_z copy
 	mov	QWORD((544+8))+rsp,r14
 	mov	QWORD((544+16))+rsp,r15
 	mov	QWORD((544+24))+rsp,r8
-	lea	rdi,96+rsp
-	call	__ecp_nistz256_sqr_montx
+	lea	rdi,96+rsp  ; Z2^2
+	call	__ecp_nistz256_sqr_montx  ; p256_sqr_mont(Z2sqr, in2_z);
 
 	pcmpeqd	xmm5,xmm4
 	pshufd	xmm4,xmm1,0xb1
 	por	xmm4,xmm1
-	pshufd	xmm5,xmm5,0
+	pshufd	xmm5,xmm5,0  ; in1infty
 	pshufd	xmm3,xmm4,0x1e
 	por	xmm4,xmm3
 	pxor	xmm3,xmm3
 	pcmpeqd	xmm4,xmm3
-	pshufd	xmm4,xmm4,0
-	mov	rdx,QWORD((64+0))+rbx
+	pshufd	xmm4,xmm4,0  ; in2infty
+	mov	rdx,QWORD((64+0))+rbx  ; load original in1_z
 	mov	r14,QWORD((64+8))+rbx
 	mov	r15,QWORD((64+16))+rbx
 	mov	r8,QWORD((64+24))+rbx
 	movq	xmm1,rbx
 
 	lea	rsi,((64-128))+rbx
-	lea	rdi,32+rsp
-	call	__ecp_nistz256_sqr_montx
+	lea	rdi,32+rsp  ; Z1^2
+	call	__ecp_nistz256_sqr_montx  ; p256_sqr_mont(Z1sqr, in1_z);
 
 	mov	rdx,QWORD544+rsp
 	lea	rbx,544+rsp
@@ -4091,8 +4091,8 @@
 	lea	rsi,((-128+96))+rsp
 	mov	r11,QWORD((16+96))+rsp
 	mov	r12,QWORD((24+96))+rsp
-	lea	rdi,224+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,224+rsp  ; S1 = Z2^3
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(S1, Z2sqr, in2_z);
 
 	mov	rdx,QWORD448+rsp
 	lea	rbx,448+rsp
@@ -4101,8 +4101,8 @@
 	lea	rsi,((-128+32))+rsp
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
-	lea	rdi,256+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,256+rsp  ; S2 = Z1^3
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(S2, Z1sqr, in1_z);
 
 	mov	rdx,QWORD416+rsp
 	lea	rbx,416+rsp
@@ -4111,8 +4111,8 @@
 	lea	rsi,((-128+224))+rsp
 	mov	r11,QWORD((16+224))+rsp
 	mov	r12,QWORD((24+224))+rsp
-	lea	rdi,224+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,224+rsp  ; S1 = Y1*Z2^3
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(S1, S1, in1_y);
 
 	mov	rdx,QWORD512+rsp
 	lea	rbx,512+rsp
@@ -4121,18 +4121,18 @@
 	lea	rsi,((-128+256))+rsp
 	mov	r11,QWORD((16+256))+rsp
 	mov	r12,QWORD((24+256))+rsp
-	lea	rdi,256+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,256+rsp  ; S2 = Y2*Z1^3
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(S2, S2, in2_y);
 
 	lea	rbx,224+rsp
-	lea	rdi,64+rsp
-	call	__ecp_nistz256_sub_fromx
+	lea	rdi,64+rsp  ; R = S2 - S1
+	call	__ecp_nistz256_sub_fromx  ; p256_sub(R, S2, S1);
 
-	or	r12,r13
+	or	r12,r13  ; see if result is zero
 	movdqa	xmm2,xmm4
 	or	r12,r8
 	or	r12,r9
-	por	xmm2,xmm5
+	por	xmm2,xmm5  ; in1infty || in2infty
 	movq	xmm3,r12
 
 	mov	rdx,QWORD384+rsp
@@ -4142,8 +4142,8 @@
 	lea	rsi,((-128+96))+rsp
 	mov	r11,QWORD((16+96))+rsp
 	mov	r12,QWORD((24+96))+rsp
-	lea	rdi,160+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,160+rsp  ; U1 = X1*Z2^2
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(U1, in1_x, Z2sqr);
 
 	mov	rdx,QWORD480+rsp
 	lea	rbx,480+rsp
@@ -4152,34 +4152,34 @@
 	lea	rsi,((-128+32))+rsp
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
-	lea	rdi,192+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,192+rsp  ; U2 = X2*Z1^2
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(U2, in2_x, Z1sqr);
 
 	lea	rbx,160+rsp
-	lea	rdi,rsp
-	call	__ecp_nistz256_sub_fromx
+	lea	rdi,rsp  ; H = U2 - U1
+	call	__ecp_nistz256_sub_fromx  ; p256_sub(H, U2, U1);
 
-	or	r12,r13
+	or	r12,r13  ; see if result is zero
 	or	r12,r8
-	or	r12,r9
+	or	r12,r9  ; !is_equal(U1, U2)
 
 	movq	r8,xmm2
 	movq	r9,xmm3
 	or	r12,r8
-	DB	0x3e
-	jnz	NEAR $L$add_proceedx
-
-
+	DB	0x3e  ; predict taken
+	jnz	NEAR $L$add_proceedx  ; !is_equal(U1, U2) || in1infty || in2infty
 
+; We now know A = B or A = -B and neither is infinity. Compare the
+; y-coordinates via S1 and S2.
 	test	r9,r9
-	jz	NEAR $L$add_doublex
-
+	jz	NEAR $L$add_doublex  ; is_equal(S1, S2)
 
-
-
-
-
-	movq	rdi,xmm0
+; A = -B, so the result is infinity.
+; 
+; TODO(davidben): Does .Ladd_proceed handle this case? It seems to, in
+; which case we should eliminate this special-case and simplify the
+; timing analysis.
+	movq	rdi,xmm0  ; restore %rdi
 	pxor	xmm0,xmm0
 	movdqu	XMMWORDrdi,xmm0
 	movdqu	XMMWORD16+rdi,xmm0
@@ -4191,9 +4191,9 @@
 
 ALIGN	32
 $L$add_doublex:
-	movq	rsi,xmm1
-	movq	rdi,xmm0
-	add	rsp,416
+	movq	rsi,xmm1  ; restore %rsi
+	movq	rdi,xmm0  ; restore %rdi
+	add	rsp,416  ; difference in frame sizes
 
 	jmp	NEAR $L$point_double_shortcutx
 
@@ -4205,8 +4205,8 @@
 	lea	rsi,((-128+64))+rsp
 	mov	r15,QWORD((16+64))+rsp
 	mov	r8,QWORD((24+64))+rsp
-	lea	rdi,96+rsp
-	call	__ecp_nistz256_sqr_montx
+	lea	rdi,96+rsp  ; R^2
+	call	__ecp_nistz256_sqr_montx  ; p256_sqr_mont(Rsqr, R);
 
 	mov	rdx,QWORD448+rsp
 	lea	rbx,448+rsp
@@ -4215,16 +4215,16 @@
 	lea	rsi,((-128+0))+rsp
 	mov	r11,QWORD((16+0))+rsp
 	mov	r12,QWORD((24+0))+rsp
-	lea	rdi,352+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,352+rsp  ; Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(res_z, H, in1_z);
 
 	mov	rdx,QWORD((0+0))+rsp
 	mov	r14,QWORD((8+0))+rsp
 	lea	rsi,((-128+0))+rsp
 	mov	r15,QWORD((16+0))+rsp
 	mov	r8,QWORD((24+0))+rsp
-	lea	rdi,32+rsp
-	call	__ecp_nistz256_sqr_montx
+	lea	rdi,32+rsp  ; H^2
+	call	__ecp_nistz256_sqr_montx  ; p256_sqr_mont(Hsqr, H);
 
 	mov	rdx,QWORD544+rsp
 	lea	rbx,544+rsp
@@ -4233,8 +4233,8 @@
 	lea	rsi,((-128+352))+rsp
 	mov	r11,QWORD((16+352))+rsp
 	mov	r12,QWORD((24+352))+rsp
-	lea	rdi,352+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,352+rsp  ; Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(res_z, res_z, in2_z);
 
 	mov	rdx,QWORDrsp
 	lea	rbx,rsp
@@ -4243,8 +4243,8 @@
 	lea	rsi,((-128+32))+rsp
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
-	lea	rdi,128+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,128+rsp  ; H^3
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(Hcub, Hsqr, H);
 
 	mov	rdx,QWORD160+rsp
 	lea	rbx,160+rsp
@@ -4253,14 +4253,14 @@
 	lea	rsi,((-128+32))+rsp
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
-	lea	rdi,192+rsp
-	call	__ecp_nistz256_mul_montx
-
-
-
+	lea	rdi,192+rsp  ; U1*H^2
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(U2, U1, Hsqr);
+; lea	192(%rsp), %rsi
+; lea	32(%rsp), %rdi	# 2*U1*H^2
+; call	__ecp_nistz256_mul_by_2	# ecp_nistz256_mul_by_2(Hsqr, U2);
 
 	xor	r11,r11
-	add	r12,r12
+	add	r12,r12  ; a0:a3+a0:a3
 	lea	rsi,96+rsp
 	adc	r13,r13
 	mov	rax,r12
@@ -4286,11 +4286,11 @@
 	cmovc	r9,r10
 	mov	r10,QWORD24+rsi
 
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  ; p256_sub(res_x, Rsqr, Hsqr);
 
 	lea	rbx,128+rsp
 	lea	rdi,288+rsp
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  ; p256_sub(res_x, res_x, Hcub);
 
 	mov	rax,QWORD((192+0))+rsp
 	mov	rbp,QWORD((192+8))+rsp
@@ -4298,10 +4298,10 @@
 	mov	r10,QWORD((192+24))+rsp
 	lea	rdi,320+rsp
 
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  ; p256_sub(res_y, U2, res_x);
 
-	mov	QWORDrdi,r12
-	mov	QWORD8+rdi,r13
+	mov	QWORDrdi,r12  ; save the result, as
+	mov	QWORD8+rdi,r13  ; __ecp_nistz256_sub doesn't
 	mov	QWORD16+rdi,r8
 	mov	QWORD24+rdi,r9
 	mov	rdx,QWORD128+rsp
@@ -4312,7 +4312,7 @@
 	mov	r11,QWORD((16+224))+rsp
 	mov	r12,QWORD((24+224))+rsp
 	lea	rdi,256+rsp
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(S2, S1, Hcub);
 
 	mov	rdx,QWORD320+rsp
 	lea	rbx,320+rsp
@@ -4322,15 +4322,15 @@
 	mov	r11,QWORD((16+64))+rsp
 	mov	r12,QWORD((24+64))+rsp
 	lea	rdi,320+rsp
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(res_y, R, res_y);
 
 	lea	rbx,256+rsp
 	lea	rdi,320+rsp
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  ; p256_sub(res_y, res_y, S2);
 
-	movq	rdi,xmm0
+	movq	rdi,xmm0  ; restore %rdi
 
-	movdqa	xmm0,xmm5
+	movdqa	xmm0,xmm5  ; copy_conditional(res_z, in2_z, in1infty);
 	movdqa	xmm1,xmm5
 	pandn	xmm0,XMMWORD352+rsp
 	movdqa	xmm2,xmm5
@@ -4341,7 +4341,7 @@
 	por	xmm2,xmm0
 	por	xmm3,xmm1
 
-	movdqa	xmm0,xmm4
+	movdqa	xmm0,xmm4  ; copy_conditional(res_z, in1_z, in2infty);
 	movdqa	xmm1,xmm4
 	pandn	xmm0,xmm2
 	movdqa	xmm2,xmm4
@@ -4354,7 +4354,7 @@
 	movdqu	XMMWORD64+rdi,xmm2
 	movdqu	XMMWORD80+rdi,xmm3
 
-	movdqa	xmm0,xmm5
+	movdqa	xmm0,xmm5  ; copy_conditional(res_x, in2_x, in1infty);
 	movdqa	xmm1,xmm5
 	pandn	xmm0,XMMWORD288+rsp
 	movdqa	xmm2,xmm5
@@ -4365,7 +4365,7 @@
 	por	xmm2,xmm0
 	por	xmm3,xmm1
 
-	movdqa	xmm0,xmm4
+	movdqa	xmm0,xmm4  ; copy_conditional(res_x, in1_x, in2infty);
 	movdqa	xmm1,xmm4
 	pandn	xmm0,xmm2
 	movdqa	xmm2,xmm4
@@ -4378,7 +4378,7 @@
 	movdqu	XMMWORDrdi,xmm2
 	movdqu	XMMWORD16+rdi,xmm3
 
-	movdqa	xmm0,xmm5
+	movdqa	xmm0,xmm5  ; copy_conditional(res_y, in2_y, in1infty);
 	movdqa	xmm1,xmm5
 	pandn	xmm0,XMMWORD320+rsp
 	movdqa	xmm2,xmm5
@@ -4389,7 +4389,7 @@
 	por	xmm2,xmm0
 	por	xmm3,xmm1
 
-	movdqa	xmm0,xmm4
+	movdqa	xmm0,xmm4  ; copy_conditional(res_y, in1_y, in2infty);
 	movdqa	xmm1,xmm4
 	pandn	xmm0,xmm2
 	movdqa	xmm2,xmm4
@@ -4456,14 +4456,14 @@
 
 $L$add_affinex_body:
 
-	movdqu	xmm0,XMMWORDrsi
-	mov	rbx,rdx
+	movdqu	xmm0,XMMWORDrsi  ; copy	*(P256_POINT *)%rsi
+	mov	rbx,rdx  ; reassign
 	movdqu	xmm1,XMMWORD16+rsi
 	movdqu	xmm2,XMMWORD32+rsi
 	movdqu	xmm3,XMMWORD48+rsi
 	movdqu	xmm4,XMMWORD64+rsi
 	movdqu	xmm5,XMMWORD80+rsi
-	mov	rdx,QWORD((64+0))+rsi
+	mov	rdx,QWORD((64+0))+rsi  ; load original in1_z
 	mov	r14,QWORD((64+8))+rsi
 	mov	r15,QWORD((64+16))+rsi
 	mov	r8,QWORD((64+24))+rsi
@@ -4475,7 +4475,7 @@
 	movdqa	XMMWORD(384+16)+rsp,xmm5
 	por	xmm5,xmm4
 
-	movdqu	xmm0,XMMWORDrbx
+	movdqu	xmm0,XMMWORDrbx  ; copy	*(P256_POINT_AFFINE *)%rbx
 	pshufd	xmm3,xmm5,0xb1
 	movdqu	xmm1,XMMWORD16+rbx
 	movdqu	xmm2,XMMWORD32+rbx
@@ -4485,7 +4485,7 @@
 	pshufd	xmm4,xmm5,0x1e
 	movdqa	XMMWORD(416+16)+rsp,xmm1
 	por	xmm1,xmm0
-	movq	xmm0,rdi
+	movq	xmm0,rdi  ; save %rdi
 	movdqa	XMMWORD448+rsp,xmm2
 	movdqa	XMMWORD(448+16)+rsp,xmm3
 	por	xmm3,xmm2
@@ -4493,33 +4493,33 @@
 	pxor	xmm4,xmm4
 	por	xmm3,xmm1
 
-	lea	rsi,((64-128))+rsi
-	lea	rdi,32+rsp
-	call	__ecp_nistz256_sqr_montx
+	lea	rsi,((64-128))+rsi  ; %rsi is still valid
+	lea	rdi,32+rsp  ; Z1^2
+	call	__ecp_nistz256_sqr_montx  ; p256_sqr_mont(Z1sqr, in1_z);
 
 	pcmpeqd	xmm5,xmm4
 	pshufd	xmm4,xmm3,0xb1
-	mov	rdx,QWORDrbx
-
-	mov	r9,r12
+	mov	rdx,QWORDrbx  ; %rbx is still valid
+; lea	0x00(%rbx), %rbx
+	mov	r9,r12  ; harmonize sqr output and mul input
 	por	xmm4,xmm3
-	pshufd	xmm5,xmm5,0
+	pshufd	xmm5,xmm5,0  ; in1infty
 	pshufd	xmm3,xmm4,0x1e
 	mov	r10,r13
 	por	xmm4,xmm3
 	pxor	xmm3,xmm3
 	mov	r11,r14
 	pcmpeqd	xmm4,xmm3
-	pshufd	xmm4,xmm4,0
+	pshufd	xmm4,xmm4,0  ; in2infty
 
 	lea	rsi,((32-128))+rsp
 	mov	r12,r15
-	lea	rdi,rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,rsp  ; U2 = X2*Z1^2
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(U2, Z1sqr, in2_x);
 
 	lea	rbx,320+rsp
-	lea	rdi,64+rsp
-	call	__ecp_nistz256_sub_fromx
+	lea	rdi,64+rsp  ; H = U2 - U1
+	call	__ecp_nistz256_sub_fromx  ; p256_sub(H, U2, in1_x);
 
 	mov	rdx,QWORD384+rsp
 	lea	rbx,384+rsp
@@ -4528,8 +4528,8 @@
 	lea	rsi,((-128+32))+rsp
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
-	lea	rdi,32+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,32+rsp  ; S2 = Z1^3
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(S2, Z1sqr, in1_z);
 
 	mov	rdx,QWORD384+rsp
 	lea	rbx,384+rsp
@@ -4538,8 +4538,8 @@
 	lea	rsi,((-128+64))+rsp
 	mov	r11,QWORD((16+64))+rsp
 	mov	r12,QWORD((24+64))+rsp
-	lea	rdi,288+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,288+rsp  ; Z3 = H*Z1*Z2
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(res_z, H, in1_z);
 
 	mov	rdx,QWORD448+rsp
 	lea	rbx,448+rsp
@@ -4548,28 +4548,28 @@
 	lea	rsi,((-128+32))+rsp
 	mov	r11,QWORD((16+32))+rsp
 	mov	r12,QWORD((24+32))+rsp
-	lea	rdi,32+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,32+rsp  ; S2 = Y2*Z1^3
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(S2, S2, in2_y);
 
 	lea	rbx,352+rsp
-	lea	rdi,96+rsp
-	call	__ecp_nistz256_sub_fromx
+	lea	rdi,96+rsp  ; R = S2 - S1
+	call	__ecp_nistz256_sub_fromx  ; p256_sub(R, S2, in1_y);
 
 	mov	rdx,QWORD((0+64))+rsp
 	mov	r14,QWORD((8+64))+rsp
 	lea	rsi,((-128+64))+rsp
 	mov	r15,QWORD((16+64))+rsp
 	mov	r8,QWORD((24+64))+rsp
-	lea	rdi,128+rsp
-	call	__ecp_nistz256_sqr_montx
+	lea	rdi,128+rsp  ; H^2
+	call	__ecp_nistz256_sqr_montx  ; p256_sqr_mont(Hsqr, H);
 
 	mov	rdx,QWORD((0+96))+rsp
 	mov	r14,QWORD((8+96))+rsp
 	lea	rsi,((-128+96))+rsp
 	mov	r15,QWORD((16+96))+rsp
 	mov	r8,QWORD((24+96))+rsp
-	lea	rdi,192+rsp
-	call	__ecp_nistz256_sqr_montx
+	lea	rdi,192+rsp  ; R^2
+	call	__ecp_nistz256_sqr_montx  ; p256_sqr_mont(Rsqr, R);
 
 	mov	rdx,QWORD128+rsp
 	lea	rbx,128+rsp
@@ -4578,8 +4578,8 @@
 	lea	rsi,((-128+64))+rsp
 	mov	r11,QWORD((16+64))+rsp
 	mov	r12,QWORD((24+64))+rsp
-	lea	rdi,160+rsp
-	call	__ecp_nistz256_mul_montx
+	lea	rdi,160+rsp  ; H^3
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(Hcub, Hsqr, H);
 
 	mov	rdx,QWORD320+rsp
 	lea	rbx,320+rsp
@@ -4588,14 +4588,14 @@
 	lea	rsi,((-128+128))+rsp
 	mov	r11,QWORD((16+128))+rsp
 	mov	r12,QWORD((24+128))+rsp
-	lea	rdi,rsp
-	call	__ecp_nistz256_mul_montx
-
-
-
+	lea	rdi,rsp  ; U1*H^2
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(U2, in1_x, Hsqr);
+; lea	0(%rsp), %rsi
+; lea	128(%rsp), %rdi	# 2*U1*H^2
+; call	__ecp_nistz256_mul_by_2	# ecp_nistz256_mul_by_2(Hsqr, U2);
 
 	xor	r11,r11
-	add	r12,r12
+	add	r12,r12  ; a0:a3+a0:a3
 	lea	rsi,192+rsp
 	adc	r13,r13
 	mov	rax,r12
@@ -4621,11 +4621,11 @@
 	cmovc	r9,r10
 	mov	r10,QWORD24+rsi
 
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  ; p256_sub(res_x, Rsqr, Hsqr);
 
 	lea	rbx,160+rsp
 	lea	rdi,224+rsp
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  ; p256_sub(res_x, res_x, Hcub);
 
 	mov	rax,QWORD((0+0))+rsp
 	mov	rbp,QWORD((0+8))+rsp
@@ -4633,10 +4633,10 @@
 	mov	r10,QWORD((0+24))+rsp
 	lea	rdi,64+rsp
 
-	call	__ecp_nistz256_subx
+	call	__ecp_nistz256_subx  ; p256_sub(H, U2, res_x);
 
-	mov	QWORDrdi,r12
-	mov	QWORD8+rdi,r13
+	mov	QWORDrdi,r12  ; save the result, as
+	mov	QWORD8+rdi,r13  ; __ecp_nistz256_sub doesn't
 	mov	QWORD16+rdi,r8
 	mov	QWORD24+rdi,r9
 	mov	rdx,QWORD352+rsp
@@ -4647,7 +4647,7 @@
 	mov	r11,QWORD((16+160))+rsp
 	mov	r12,QWORD((24+160))+rsp
 	lea	rdi,32+rsp
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(S2, Hcub, in1_y);
 
 	mov	rdx,QWORD96+rsp
 	lea	rbx,96+rsp
@@ -4657,15 +4657,15 @@
 	mov	r11,QWORD((16+64))+rsp
 	mov	r12,QWORD((24+64))+rsp
 	lea	rdi,64+rsp
-	call	__ecp_nistz256_mul_montx
+	call	__ecp_nistz256_mul_montx  ; p256_mul_mont(H, H, R);
 
 	lea	rbx,32+rsp
 	lea	rdi,256+rsp
-	call	__ecp_nistz256_sub_fromx
+	call	__ecp_nistz256_sub_fromx  ; p256_sub(res_y, H, S2);
 
-	movq	rdi,xmm0
+	movq	rdi,xmm0  ; restore %rdi
 
-	movdqa	xmm0,xmm5
+	movdqa	xmm0,xmm5  ; copy_conditional(res_z, ONE, in1infty);
 	movdqa	xmm1,xmm5
 	pandn	xmm0,XMMWORD288+rsp
 	movdqa	xmm2,xmm5
@@ -4676,7 +4676,7 @@
 	por	xmm2,xmm0
 	por	xmm3,xmm1
 
-	movdqa	xmm0,xmm4
+	movdqa	xmm0,xmm4  ; copy_conditional(res_z, in1_z, in2infty);
 	movdqa	xmm1,xmm4
 	pandn	xmm0,xmm2
 	movdqa	xmm2,xmm4
@@ -4689,7 +4689,7 @@
 	movdqu	XMMWORD64+rdi,xmm2
 	movdqu	XMMWORD80+rdi,xmm3
 
-	movdqa	xmm0,xmm5
+	movdqa	xmm0,xmm5  ; copy_conditional(res_x, in2_x, in1infty);
 	movdqa	xmm1,xmm5
 	pandn	xmm0,XMMWORD224+rsp
 	movdqa	xmm2,xmm5
@@ -4700,7 +4700,7 @@
 	por	xmm2,xmm0
 	por	xmm3,xmm1
 
-	movdqa	xmm0,xmm4
+	movdqa	xmm0,xmm4  ; copy_conditional(res_x, in1_x, in2infty);
 	movdqa	xmm1,xmm4
 	pandn	xmm0,xmm2
 	movdqa	xmm2,xmm4
@@ -4713,7 +4713,7 @@
 	movdqu	XMMWORDrdi,xmm2
 	movdqu	XMMWORD16+rdi,xmm3
 
-	movdqa	xmm0,xmm5
+	movdqa	xmm0,xmm5  ; copy_conditional(res_y, in2_y, in1infty);
 	movdqa	xmm1,xmm5
 	pandn	xmm0,XMMWORD256+rsp
 	movdqa	xmm2,xmm5
@@ -4724,7 +4724,7 @@
 	por	xmm2,xmm0
 	por	xmm3,xmm1
 
-	movdqa	xmm0,xmm4
+	movdqa	xmm0,xmm4  ; copy_conditional(res_y, in1_y, in2infty);
 	movdqa	xmm1,xmm4
 	pandn	xmm0,xmm2
 	movdqa	xmm2,xmm4
@@ -4775,30 +4775,30 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; end of prologue label
+	cmp	rbx,r10  ; context->Rip<end of prologue label
 	jb	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$common_seh_tail
 
 	lea	rax,16+rax
 
 	mov	r12,QWORD((-8))+rax
 	mov	r13,QWORD((-16))+rax
-	mov	QWORD216+r8,r12
-	mov	QWORD224+r8,r13
+	mov	QWORD216+r8,r12  ; restore context->R12
+	mov	QWORD224+r8,r13  ; restore context->R13
 
 	jmp	NEAR $L$common_seh_tail
 
@@ -4817,25 +4817,25 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; end of prologue label
+	cmp	rbx,r10  ; context->Rip<end of prologue label
 	jb	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$common_seh_tail
 
-	mov	r10d,DWORD8+r11
+	mov	r10d,DWORD8+r11  ; HandlerData2
 	lea	rax,r10*1+rax
 
 	mov	rbp,QWORD((-8))+rax
@@ -4844,40 +4844,40 @@
 	mov	r13,QWORD((-32))+rax
 	mov	r14,QWORD((-40))+rax
 	mov	r15,QWORD((-48))+rax
-	mov	QWORD144+r8,rbx
-	mov	QWORD160+r8,rbp
-	mov	QWORD216+r8,r12
-	mov	QWORD224+r8,r13
-	mov	QWORD232+r8,r14
-	mov	QWORD240+r8,r15
+	mov	QWORD144+r8,rbx  ; restore context->Rbx
+	mov	QWORD160+r8,rbp  ; restore context->Rbp
+	mov	QWORD216+r8,r12  ; restore context->R12
+	mov	QWORD224+r8,r13  ; restore context->R13
+	mov	QWORD232+r8,r14  ; restore context->R14
+	mov	QWORD240+r8,r15  ; restore context->R15
 
 $L$common_seh_tail:
 	mov	rdi,QWORD8+rax
 	mov	rsi,QWORD16+rax
-	mov	QWORD152+r8,rax
-	mov	QWORD168+r8,rsi
-	mov	QWORD176+r8,rdi
-
-	mov	rdi,QWORD40+r9
-	mov	rsi,r8
-	mov	ecx,154
-	DD	0xa548f3fc
+	mov	QWORD152+r8,rax  ; restore context->Rsp
+	mov	QWORD168+r8,rsi  ; restore context->Rsi
+	mov	QWORD176+r8,rdi  ; restore context->Rdi
+
+	mov	rdi,QWORD40+r9  ; disp->ContextRecord
+	mov	rsi,r8  ; context
+	mov	ecx,154  ; sizeof(CONTEXT)
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	mov	rsi,r9
-	xor	rcx,rcx
-	mov	rdx,QWORD8+rsi
-	mov	r8,QWORDrsi
-	mov	r9,QWORD16+rsi
-	mov	r10,QWORD40+rsi
-	lea	r11,56+rsi
-	lea	r12,24+rsi
-	mov	QWORD32+rsp,r10
-	mov	QWORD40+rsp,r11
-	mov	QWORD48+rsp,r12
-	mov	QWORD56+rsp,rcx
+	xor	rcx,rcx  ; arg1, UNW_FLAG_NHANDLER
+	mov	rdx,QWORD8+rsi  ; arg2, disp->ImageBase
+	mov	r8,QWORDrsi  ; arg3, disp->ControlPc
+	mov	r9,QWORD16+rsi  ; arg4, disp->FunctionEntry
+	mov	r10,QWORD40+rsi  ; disp->ContextRecord
+	lea	r11,56+rsi  ; &disp->HandlerData
+	lea	r12,24+rsi  ; &disp->EstablisherFrame
+	mov	QWORD32+rsp,r10  ; arg5
+	mov	QWORD40+rsp,r11  ; arg6
+	mov	QWORD48+rsp,r12  ; arg7
+	mov	QWORD56+rsp,rcx  ; arg8, (NULL)
 	call	QWORD__imp_RtlVirtualUnwind
 
-	mov	eax,1
+	mov	eax,1  ; ExceptionContinueSearch
 	add	rsp,64
 	popfq
 	pop	r15
@@ -4967,106 +4967,106 @@
 $L$SEH_info_ecp_nistz256_neg:
 	DB	9,0,0,0
 	DD	short_handler wrt ..imagebase
-	DD	$L$neg_body wrt ..imagebase,$L$neg_epilogue wrt ..imagebase
+	DD	$L$neg_body wrt ..imagebase,$L$neg_epilogue wrt ..imagebase  ; HandlerData
 $L$SEH_info_ecp_nistz256_ord_mul_mont_nohw:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$ord_mul_body wrt ..imagebase,$L$ord_mul_epilogue wrt ..imagebase
+	DD	$L$ord_mul_body wrt ..imagebase,$L$ord_mul_epilogue wrt ..imagebase  ; HandlerData
 	DD	48,0
 $L$SEH_info_ecp_nistz256_ord_sqr_mont_nohw:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$ord_sqr_body wrt ..imagebase,$L$ord_sqr_epilogue wrt ..imagebase
+	DD	$L$ord_sqr_body wrt ..imagebase,$L$ord_sqr_epilogue wrt ..imagebase  ; HandlerData
 	DD	48,0
 $L$SEH_info_ecp_nistz256_ord_mul_mont_adx:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$ord_mulx_body wrt ..imagebase,$L$ord_mulx_epilogue wrt ..imagebase
+	DD	$L$ord_mulx_body wrt ..imagebase,$L$ord_mulx_epilogue wrt ..imagebase  ; HandlerData
 	DD	48,0
 $L$SEH_info_ecp_nistz256_ord_sqr_mont_adx:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$ord_sqrx_body wrt ..imagebase,$L$ord_sqrx_epilogue wrt ..imagebase
+	DD	$L$ord_sqrx_body wrt ..imagebase,$L$ord_sqrx_epilogue wrt ..imagebase  ; HandlerData
 	DD	48,0
 $L$SEH_info_ecp_nistz256_mul_mont_nohw:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$mul_body wrt ..imagebase,$L$mul_epilogue wrt ..imagebase
+	DD	$L$mul_body wrt ..imagebase,$L$mul_epilogue wrt ..imagebase  ; HandlerData
 	DD	48,0
 $L$SEH_info_ecp_nistz256_sqr_mont_nohw:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$sqr_body wrt ..imagebase,$L$sqr_epilogue wrt ..imagebase
+	DD	$L$sqr_body wrt ..imagebase,$L$sqr_epilogue wrt ..imagebase  ; HandlerData
 	DD	48,0
 $L$SEH_info_ecp_nistz256_mul_mont_adx:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$mulx_body wrt ..imagebase,$L$mulx_epilogue wrt ..imagebase
+	DD	$L$mulx_body wrt ..imagebase,$L$mulx_epilogue wrt ..imagebase  ; HandlerData
 	DD	48,0
 $L$SEH_info_ecp_nistz256_sqr_mont_adx:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$sqrx_body wrt ..imagebase,$L$sqrx_epilogue wrt ..imagebase
+	DD	$L$sqrx_body wrt ..imagebase,$L$sqrx_epilogue wrt ..imagebase  ; HandlerData
 	DD	48,0
 $L$SEH_info_ecp_nistz256_select_wX_nohw:
 	DB	0x01,0x33,0x16,0x00
-	DB	0x33,0xf8,0x09,0x00
-	DB	0x2e,0xe8,0x08,0x00
-	DB	0x29,0xd8,0x07,0x00
-	DB	0x24,0xc8,0x06,0x00
-	DB	0x1f,0xb8,0x05,0x00
-	DB	0x1a,0xa8,0x04,0x00
-	DB	0x15,0x98,0x03,0x00
-	DB	0x10,0x88,0x02,0x00
-	DB	0x0c,0x78,0x01,0x00
-	DB	0x08,0x68,0x00,0x00
-	DB	0x04,0x01,0x15,0x00
+	DB	0x33,0xf8,0x09,0x00  ; movaps 0x90(rsp),xmm15
+	DB	0x2e,0xe8,0x08,0x00  ; movaps 0x80(rsp),xmm14
+	DB	0x29,0xd8,0x07,0x00  ; movaps 0x70(rsp),xmm13
+	DB	0x24,0xc8,0x06,0x00  ; movaps 0x60(rsp),xmm12
+	DB	0x1f,0xb8,0x05,0x00  ; movaps 0x50(rsp),xmm11
+	DB	0x1a,0xa8,0x04,0x00  ; movaps 0x40(rsp),xmm10
+	DB	0x15,0x98,0x03,0x00  ; movaps 0x30(rsp),xmm9
+	DB	0x10,0x88,0x02,0x00  ; movaps 0x20(rsp),xmm8
+	DB	0x0c,0x78,0x01,0x00  ; movaps 0x10(rsp),xmm7
+	DB	0x08,0x68,0x00,0x00  ; movaps 0x00(rsp),xmm6
+	DB	0x04,0x01,0x15,0x00  ; sub	rsp,0xa8
 ALIGN	8
 $L$SEH_info_ecp_nistz256_select_wX_avx2:
 	DB	0x01,0x36,0x17,0x0b
-	DB	0x36,0xf8,0x09,0x00
-	DB	0x31,0xe8,0x08,0x00
-	DB	0x2c,0xd8,0x07,0x00
-	DB	0x27,0xc8,0x06,0x00
-	DB	0x22,0xb8,0x05,0x00
-	DB	0x1d,0xa8,0x04,0x00
-	DB	0x18,0x98,0x03,0x00
-	DB	0x13,0x88,0x02,0x00
-	DB	0x0e,0x78,0x01,0x00
-	DB	0x09,0x68,0x00,0x00
-	DB	0x04,0x01,0x15,0x00
-	DB	0x00,0xb3,0x00,0x00
+	DB	0x36,0xf8,0x09,0x00  ; vmovaps 0x90(rsp),xmm15
+	DB	0x31,0xe8,0x08,0x00  ; vmovaps 0x80(rsp),xmm14
+	DB	0x2c,0xd8,0x07,0x00  ; vmovaps 0x70(rsp),xmm13
+	DB	0x27,0xc8,0x06,0x00  ; vmovaps 0x60(rsp),xmm12
+	DB	0x22,0xb8,0x05,0x00  ; vmovaps 0x50(rsp),xmm11
+	DB	0x1d,0xa8,0x04,0x00  ; vmovaps 0x40(rsp),xmm10
+	DB	0x18,0x98,0x03,0x00  ; vmovaps 0x30(rsp),xmm9
+	DB	0x13,0x88,0x02,0x00  ; vmovaps 0x20(rsp),xmm8
+	DB	0x0e,0x78,0x01,0x00  ; vmovaps 0x10(rsp),xmm7
+	DB	0x09,0x68,0x00,0x00  ; vmovaps 0x00(rsp),xmm6
+	DB	0x04,0x01,0x15,0x00  ; sub	  rsp,0xa8
+	DB	0x00,0xb3,0x00,0x00  ; set_frame r11
 ALIGN	8
 $L$SEH_info_ecp_nistz256_point_double_nohw:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$point_doubleq_body wrt ..imagebase,$L$point_doubleq_epilogue wrt ..imagebase
+	DD	$L$point_doubleq_body wrt ..imagebase,$L$point_doubleq_epilogue wrt ..imagebase  ; HandlerData
 	DD	32*5+56,0
 $L$SEH_info_ecp_nistz256_point_add_nohw:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$point_addq_body wrt ..imagebase,$L$point_addq_epilogue wrt ..imagebase
+	DD	$L$point_addq_body wrt ..imagebase,$L$point_addq_epilogue wrt ..imagebase  ; HandlerData
 	DD	32*18+56,0
 $L$SEH_info_ecp_nistz256_point_add_affine_nohw:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$add_affineq_body wrt ..imagebase,$L$add_affineq_epilogue wrt ..imagebase
+	DD	$L$add_affineq_body wrt ..imagebase,$L$add_affineq_epilogue wrt ..imagebase  ; HandlerData
 	DD	32*15+56,0
 ALIGN	8
 $L$SEH_info_ecp_nistz256_point_double_adx:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$point_doublex_body wrt ..imagebase,$L$point_doublex_epilogue wrt ..imagebase
+	DD	$L$point_doublex_body wrt ..imagebase,$L$point_doublex_epilogue wrt ..imagebase  ; HandlerData
 	DD	32*5+56,0
 $L$SEH_info_ecp_nistz256_point_add_adx:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$point_addx_body wrt ..imagebase,$L$point_addx_epilogue wrt ..imagebase
+	DD	$L$point_addx_body wrt ..imagebase,$L$point_addx_epilogue wrt ..imagebase  ; HandlerData
 	DD	32*18+56,0
 $L$SEH_info_ecp_nistz256_point_add_affine_adx:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$add_affinex_body wrt ..imagebase,$L$add_affinex_epilogue wrt ..imagebase
+	DD	$L$add_affinex_body wrt ..imagebase,$L$add_affinex_epilogue wrt ..imagebase  ; HandlerData
 	DD	32*15+56,0
 %else
 ; Work around https://bugzilla.nasm.us/show_bug.cgi?id=3392738

boringssl-0.20260708.tar.xz/gen/bcm/p256_beeu-x86_64-asm-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/p256_beeu-x86_64-asm-apple.S Changed

@@ -32,7 +32,7 @@
 
 	movq	%rdi,0(%rsp)
 
-
+// X=1, Y=0
 	movq	$1,%r8
 	xorq	%r9,%r9
 	xorq	%r10,%r10
@@ -45,7 +45,7 @@
 	xorq	%r15,%r15
 	xorq	%rbp,%rbp
 
-
+// Copy a/n into B/A on the stack.
 	vmovdqu	0(%rsi),%xmm0
 	vmovdqu	16(%rsi),%xmm1
 	vmovdqu	%xmm0,48(%rsp)
@@ -65,23 +65,23 @@
 	jz	L$beeu_loop_end
 
 
+// 0 < B < |n|,
+// 0 < A <= |n|,
+// (1)      X*a  ==  B   (mod |n|),
+// (2) (-1)*Y*a  ==  A   (mod |n|)
 
-
-
-
-
-
-
-
+// Now divide B by the maximum possible power of two in the
+// integers, and divide X by the same value mod |n|. When we're
+// done, (1) still holds.
 	movq	$1,%rcx
 
-
+// Note that B > 0
 L$beeu_shift_loop_XB:
 	movq	%rcx,%rbx
 	andq	48(%rsp),%rbx
 	jnz	L$beeu_shift_loop_end_XB
 
-
+// Ensure X is even and divide by two.
 	movq	$1,%rbx
 	andq	%r8,%rbx
 	jz	L$shift1_0
@@ -100,10 +100,10 @@
 
 	shlq	$1,%rcx
 
-
-
-
-
+// Test wraparound of the shift parameter. The probability to have 32 zeroes
+// in a row is small Therefore having the value below equal $0x8000000 or
+// $0x8000 does not affect the performance. We choose 0x8000000 because it
+// is the maximal immediate value possible.
 	cmpq	$0x8000000,%rcx
 	jne	L$beeu_shift_loop_XB
 
@@ -112,8 +112,8 @@
 	testq	%rcx,%rcx
 	jz	L$beeu_no_shift_XB
 
-
-
+// Copy shifted values.
+// Remember not to override t3=rcx
 	movq	8+48(%rsp),%rax
 	movq	16+48(%rsp),%rbx
 	movq	24+48(%rsp),%rsi
@@ -127,16 +127,16 @@
 
 
 L$beeu_no_shift_XB:
-
+// Same for A and Y.  Afterwards, (2) still holds.
 	movq	$1,%rcx
 
-
+// Note that A > 0
 L$beeu_shift_loop_YA:
 	movq	%rcx,%rbx
 	andq	16(%rsp),%rbx
 	jnz	L$beeu_shift_loop_end_YA
 
-
+// Ensure X is even and divide by two.
 	movq	$1,%rbx
 	andq	%r12,%rbx
 	jz	L$shift1_1
@@ -155,10 +155,10 @@
 
 	shlq	$1,%rcx
 
-
-
-
-
+// Test wraparound of the shift parameter. The probability to have 32 zeroes
+// in a row is small therefore having the value below equal $0x8000000 or
+// $0x8000 Does not affect the performance. We choose 0x8000000 because it
+// is the maximal immediate value possible.
 	cmpq	$0x8000000,%rcx
 	jne	L$beeu_shift_loop_YA
 
@@ -167,8 +167,8 @@
 	testq	%rcx,%rcx
 	jz	L$beeu_no_shift_YA
 
-
-
+// Copy shifted values.
+// Remember not to override t3=rcx
 	movq	8+16(%rsp),%rax
 	movq	16+16(%rsp),%rbx
 	movq	24+16(%rsp),%rsi
@@ -182,7 +182,7 @@
 
 
 L$beeu_no_shift_YA:
-
+// T = B-A (A,B < 2^256)
 	movq	48(%rsp),%rax
 	movq	56(%rsp),%rbx
 	movq	64(%rsp),%rsi
@@ -190,10 +190,10 @@
 	subq	16(%rsp),%rax
 	sbbq	24(%rsp),%rbx
 	sbbq	32(%rsp),%rsi
-	sbbq	40(%rsp),%rcx
+	sbbq	40(%rsp),%rcx  // borrow from shift
 	jnc	L$beeu_B_bigger_than_A
 
-
+// A = A - B
 	movq	16(%rsp),%rax
 	movq	24(%rsp),%rbx
 	movq	32(%rsp),%rsi
@@ -207,7 +207,7 @@
 	movq	%rsi,32(%rsp)
 	movq	%rcx,40(%rsp)
 
-
+// Y = Y + X
 	addq	%r8,%r12
 	adcq	%r9,%r13
 	adcq	%r10,%r14
@@ -216,13 +216,13 @@
 	jmp	L$beeu_loop
 
 L$beeu_B_bigger_than_A:
-
+// B = T = B - A
 	movq	%rax,48(%rsp)
 	movq	%rbx,56(%rsp)
 	movq	%rsi,64(%rsp)
 	movq	%rcx,72(%rsp)
 
-
+// X = Y + X
 	addq	%r12,%r8
 	adcq	%r13,%r9
 	adcq	%r14,%r10
@@ -232,21 +232,21 @@
 	jmp	L$beeu_loop
 
 L$beeu_loop_end:
+// The Euclid's algorithm loop ends when A == beeu(a,n);
+// Therefore (-1)*Y*a == A (mod |n|), Y>0
 
-
-
-
+// Verify that A = 1 ==> (-1)*Y*a = A = 1  (mod |n|)
 	movq	16(%rsp),%rbx
 	subq	$1,%rbx
 	orq	24(%rsp),%rbx
 	orq	32(%rsp),%rbx
 	orq	40(%rsp),%rbx
-
+// If not, fail.
 	jnz	L$beeu_err
 
-
-
-
+// From this point on, we no longer need X
+// Therefore we use it as a temporary storage.
+// X = n
 	movq	0(%rdx),%r8
 	movq	8(%rdx),%r9
 	movq	16(%rdx),%r10
@@ -260,28 +260,28 @@
 	movq	%r15,40(%rsp)
 	movq	%rbp,48(%rsp)
 
-
+// If Y>n ==> Y=Y-n
 	subq	%r8,%r12
 	sbbq	%r9,%r13
 	sbbq	%r10,%r14
 	sbbq	%r11,%r15
 	sbbq	$0,%rbp
 
-
+// Choose old Y or new Y
 	cmovcq	16(%rsp),%r12
 	cmovcq	24(%rsp),%r13
 	cmovcq	32(%rsp),%r14
 	cmovcq	40(%rsp),%r15
 	jnc	L$beeu_reduction_loop
 
-
+// X = n - Y (n, Y < 2^256), (Cancel the (-1))
 	subq	%r12,%r8
 	sbbq	%r13,%r9
 	sbbq	%r14,%r10
 	sbbq	%r15,%r11
 
 L$beeu_save:
-
+// Save the inverse(<2^256) to out.
 	movq	0(%rsp),%rdi
 
 	movq	%r8,0(%rdi)
@@ -289,12 +289,12 @@
 	movq	%r10,16(%rdi)
 	movq	%r11,24(%rdi)
 
-
+// Return 1.
 	movq	$1,%rax
 	jmp	L$beeu_finish
 
 L$beeu_err:
-
+// Return 0.
 	xorq	%rax,%rax
 
 L$beeu_finish:

boringssl-0.20260708.tar.xz/gen/bcm/p256_beeu-x86_64-asm-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/p256_beeu-x86_64-asm-linux.S Changed

@@ -39,7 +39,7 @@
 .cfi_adjust_cfa_offset	80
 	movq	%rdi,0(%rsp)
 
-
+// X=1, Y=0
 	movq	$1,%r8
 	xorq	%r9,%r9
 	xorq	%r10,%r10
@@ -52,7 +52,7 @@
 	xorq	%r15,%r15
 	xorq	%rbp,%rbp
 
-
+// Copy a/n into B/A on the stack.
 	vmovdqu	0(%rsi),%xmm0
 	vmovdqu	16(%rsi),%xmm1
 	vmovdqu	%xmm0,48(%rsp)
@@ -72,23 +72,23 @@
 	jz	.Lbeeu_loop_end
 
 
+// 0 < B < |n|,
+// 0 < A <= |n|,
+// (1)      X*a  ==  B   (mod |n|),
+// (2) (-1)*Y*a  ==  A   (mod |n|)
 
-
-
-
-
-
-
-
+// Now divide B by the maximum possible power of two in the
+// integers, and divide X by the same value mod |n|. When we're
+// done, (1) still holds.
 	movq	$1,%rcx
 
-
+// Note that B > 0
 .Lbeeu_shift_loop_XB:
 	movq	%rcx,%rbx
 	andq	48(%rsp),%rbx
 	jnz	.Lbeeu_shift_loop_end_XB
 
-
+// Ensure X is even and divide by two.
 	movq	$1,%rbx
 	andq	%r8,%rbx
 	jz	.Lshift1_0
@@ -107,10 +107,10 @@
 
 	shlq	$1,%rcx
 
-
-
-
-
+// Test wraparound of the shift parameter. The probability to have 32 zeroes
+// in a row is small Therefore having the value below equal $0x8000000 or
+// $0x8000 does not affect the performance. We choose 0x8000000 because it
+// is the maximal immediate value possible.
 	cmpq	$0x8000000,%rcx
 	jne	.Lbeeu_shift_loop_XB
 
@@ -119,8 +119,8 @@
 	testq	%rcx,%rcx
 	jz	.Lbeeu_no_shift_XB
 
-
-
+// Copy shifted values.
+// Remember not to override t3=rcx
 	movq	8+48(%rsp),%rax
 	movq	16+48(%rsp),%rbx
 	movq	24+48(%rsp),%rsi
@@ -134,16 +134,16 @@
 
 
 .Lbeeu_no_shift_XB:
-
+// Same for A and Y.  Afterwards, (2) still holds.
 	movq	$1,%rcx
 
-
+// Note that A > 0
 .Lbeeu_shift_loop_YA:
 	movq	%rcx,%rbx
 	andq	16(%rsp),%rbx
 	jnz	.Lbeeu_shift_loop_end_YA
 
-
+// Ensure X is even and divide by two.
 	movq	$1,%rbx
 	andq	%r12,%rbx
 	jz	.Lshift1_1
@@ -162,10 +162,10 @@
 
 	shlq	$1,%rcx
 
-
-
-
-
+// Test wraparound of the shift parameter. The probability to have 32 zeroes
+// in a row is small therefore having the value below equal $0x8000000 or
+// $0x8000 Does not affect the performance. We choose 0x8000000 because it
+// is the maximal immediate value possible.
 	cmpq	$0x8000000,%rcx
 	jne	.Lbeeu_shift_loop_YA
 
@@ -174,8 +174,8 @@
 	testq	%rcx,%rcx
 	jz	.Lbeeu_no_shift_YA
 
-
-
+// Copy shifted values.
+// Remember not to override t3=rcx
 	movq	8+16(%rsp),%rax
 	movq	16+16(%rsp),%rbx
 	movq	24+16(%rsp),%rsi
@@ -189,7 +189,7 @@
 
 
 .Lbeeu_no_shift_YA:
-
+// T = B-A (A,B < 2^256)
 	movq	48(%rsp),%rax
 	movq	56(%rsp),%rbx
 	movq	64(%rsp),%rsi
@@ -197,10 +197,10 @@
 	subq	16(%rsp),%rax
 	sbbq	24(%rsp),%rbx
 	sbbq	32(%rsp),%rsi
-	sbbq	40(%rsp),%rcx
+	sbbq	40(%rsp),%rcx  // borrow from shift
 	jnc	.Lbeeu_B_bigger_than_A
 
-
+// A = A - B
 	movq	16(%rsp),%rax
 	movq	24(%rsp),%rbx
 	movq	32(%rsp),%rsi
@@ -214,7 +214,7 @@
 	movq	%rsi,32(%rsp)
 	movq	%rcx,40(%rsp)
 
-
+// Y = Y + X
 	addq	%r8,%r12
 	adcq	%r9,%r13
 	adcq	%r10,%r14
@@ -223,13 +223,13 @@
 	jmp	.Lbeeu_loop
 
 .Lbeeu_B_bigger_than_A:
-
+// B = T = B - A
 	movq	%rax,48(%rsp)
 	movq	%rbx,56(%rsp)
 	movq	%rsi,64(%rsp)
 	movq	%rcx,72(%rsp)
 
-
+// X = Y + X
 	addq	%r12,%r8
 	adcq	%r13,%r9
 	adcq	%r14,%r10
@@ -239,21 +239,21 @@
 	jmp	.Lbeeu_loop
 
 .Lbeeu_loop_end:
+// The Euclid's algorithm loop ends when A == beeu(a,n);
+// Therefore (-1)*Y*a == A (mod |n|), Y>0
 
-
-
-
+// Verify that A = 1 ==> (-1)*Y*a = A = 1  (mod |n|)
 	movq	16(%rsp),%rbx
 	subq	$1,%rbx
 	orq	24(%rsp),%rbx
 	orq	32(%rsp),%rbx
 	orq	40(%rsp),%rbx
-
+// If not, fail.
 	jnz	.Lbeeu_err
 
-
-
-
+// From this point on, we no longer need X
+// Therefore we use it as a temporary storage.
+// X = n
 	movq	0(%rdx),%r8
 	movq	8(%rdx),%r9
 	movq	16(%rdx),%r10
@@ -267,28 +267,28 @@
 	movq	%r15,40(%rsp)
 	movq	%rbp,48(%rsp)
 
-
+// If Y>n ==> Y=Y-n
 	subq	%r8,%r12
 	sbbq	%r9,%r13
 	sbbq	%r10,%r14
 	sbbq	%r11,%r15
 	sbbq	$0,%rbp
 
-
+// Choose old Y or new Y
 	cmovcq	16(%rsp),%r12
 	cmovcq	24(%rsp),%r13
 	cmovcq	32(%rsp),%r14
 	cmovcq	40(%rsp),%r15
 	jnc	.Lbeeu_reduction_loop
 
-
+// X = n - Y (n, Y < 2^256), (Cancel the (-1))
 	subq	%r12,%r8
 	sbbq	%r13,%r9
 	sbbq	%r14,%r10
 	sbbq	%r15,%r11
 
 .Lbeeu_save:
-
+// Save the inverse(<2^256) to out.
 	movq	0(%rsp),%rdi
 
 	movq	%r8,0(%rdi)
@@ -296,12 +296,12 @@
 	movq	%r10,16(%rdi)
 	movq	%r11,24(%rdi)
 
-
+// Return 1.
 	movq	$1,%rax
 	jmp	.Lbeeu_finish
 
 .Lbeeu_err:
-
+// Return 0.
 	xorq	%rax,%rax
 
 .Lbeeu_finish:

boringssl-0.20260708.tar.xz/gen/bcm/p256_beeu-x86_64-asm-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/p256_beeu-x86_64-asm-win.asm Changed

@@ -51,7 +51,7 @@
 
 	mov	QWORDrsp,rdi
 
-
+; X=1, Y=0
 	mov	r8,1
 	xor	r9,r9
 	xor	r10,r10
@@ -64,7 +64,7 @@
 	xor	r15,r15
 	xor	rbp,rbp
 
-
+; Copy a/n into B/A on the stack.
 	vmovdqu	xmm0,XMMWORDrsi
 	vmovdqu	xmm1,XMMWORD16+rsi
 	vmovdqu	XMMWORD48+rsp,xmm0
@@ -84,23 +84,23 @@
 	jz	NEAR $L$beeu_loop_end
 
 
+; 0 < B < |n|,
+; 0 < A <= |n|,
+; (1)      X*a  ==  B   (mod |n|),
+; (2) (-1)*Y*a  ==  A   (mod |n|)
 
-
-
-
-
-
-
-
+; Now divide B by the maximum possible power of two in the
+; integers, and divide X by the same value mod |n|. When we're
+; done, (1) still holds.
 	mov	rcx,1
 
-
+; Note that B > 0
 $L$beeu_shift_loop_XB:
 	mov	rbx,rcx
 	and	rbx,QWORD48+rsp
 	jnz	NEAR $L$beeu_shift_loop_end_XB
 
-
+; Ensure X is even and divide by two.
 	mov	rbx,1
 	and	rbx,r8
 	jz	NEAR $L$shift1_0
@@ -119,10 +119,10 @@
 
 	shl	rcx,1
 
-
-
-
-
+; Test wraparound of the shift parameter. The probability to have 32 zeroes
+; in a row is small Therefore having the value below equal $0x8000000 or
+; $0x8000 does not affect the performance. We choose 0x8000000 because it
+; is the maximal immediate value possible.
 	cmp	rcx,0x8000000
 	jne	NEAR $L$beeu_shift_loop_XB
 
@@ -131,8 +131,8 @@
 	test	rcx,rcx
 	jz	NEAR $L$beeu_no_shift_XB
 
-
-
+; Copy shifted values.
+; Remember not to override t3=rcx
 	mov	rax,QWORD((8+48))+rsp
 	mov	rbx,QWORD((16+48))+rsp
 	mov	rsi,QWORD((24+48))+rsp
@@ -146,16 +146,16 @@
 
 
 $L$beeu_no_shift_XB:
-
+; Same for A and Y.  Afterwards, (2) still holds.
 	mov	rcx,1
 
-
+; Note that A > 0
 $L$beeu_shift_loop_YA:
 	mov	rbx,rcx
 	and	rbx,QWORD16+rsp
 	jnz	NEAR $L$beeu_shift_loop_end_YA
 
-
+; Ensure X is even and divide by two.
 	mov	rbx,1
 	and	rbx,r12
 	jz	NEAR $L$shift1_1
@@ -174,10 +174,10 @@
 
 	shl	rcx,1
 
-
-
-
-
+; Test wraparound of the shift parameter. The probability to have 32 zeroes
+; in a row is small therefore having the value below equal $0x8000000 or
+; $0x8000 Does not affect the performance. We choose 0x8000000 because it
+; is the maximal immediate value possible.
 	cmp	rcx,0x8000000
 	jne	NEAR $L$beeu_shift_loop_YA
 
@@ -186,8 +186,8 @@
 	test	rcx,rcx
 	jz	NEAR $L$beeu_no_shift_YA
 
-
-
+; Copy shifted values.
+; Remember not to override t3=rcx
 	mov	rax,QWORD((8+16))+rsp
 	mov	rbx,QWORD((16+16))+rsp
 	mov	rsi,QWORD((24+16))+rsp
@@ -201,7 +201,7 @@
 
 
 $L$beeu_no_shift_YA:
-
+; T = B-A (A,B < 2^256)
 	mov	rax,QWORD48+rsp
 	mov	rbx,QWORD56+rsp
 	mov	rsi,QWORD64+rsp
@@ -209,10 +209,10 @@
 	sub	rax,QWORD16+rsp
 	sbb	rbx,QWORD24+rsp
 	sbb	rsi,QWORD32+rsp
-	sbb	rcx,QWORD40+rsp
+	sbb	rcx,QWORD40+rsp  ; borrow from shift
 	jnc	NEAR $L$beeu_B_bigger_than_A
 
-
+; A = A - B
 	mov	rax,QWORD16+rsp
 	mov	rbx,QWORD24+rsp
 	mov	rsi,QWORD32+rsp
@@ -226,7 +226,7 @@
 	mov	QWORD32+rsp,rsi
 	mov	QWORD40+rsp,rcx
 
-
+; Y = Y + X
 	add	r12,r8
 	adc	r13,r9
 	adc	r14,r10
@@ -235,13 +235,13 @@
 	jmp	NEAR $L$beeu_loop
 
 $L$beeu_B_bigger_than_A:
-
+; B = T = B - A
 	mov	QWORD48+rsp,rax
 	mov	QWORD56+rsp,rbx
 	mov	QWORD64+rsp,rsi
 	mov	QWORD72+rsp,rcx
 
-
+; X = Y + X
 	add	r8,r12
 	adc	r9,r13
 	adc	r10,r14
@@ -251,21 +251,21 @@
 	jmp	NEAR $L$beeu_loop
 
 $L$beeu_loop_end:
+; The Euclid's algorithm loop ends when A == beeu(a,n);
+; Therefore (-1)*Y*a == A (mod |n|), Y>0
 
-
-
-
+; Verify that A = 1 ==> (-1)*Y*a = A = 1  (mod |n|)
 	mov	rbx,QWORD16+rsp
 	sub	rbx,1
 	or	rbx,QWORD24+rsp
 	or	rbx,QWORD32+rsp
 	or	rbx,QWORD40+rsp
-
+; If not, fail.
 	jnz	NEAR $L$beeu_err
 
-
-
-
+; From this point on, we no longer need X
+; Therefore we use it as a temporary storage.
+; X = n
 	mov	r8,QWORDrdx
 	mov	r9,QWORD8+rdx
 	mov	r10,QWORD16+rdx
@@ -279,28 +279,28 @@
 	mov	QWORD40+rsp,r15
 	mov	QWORD48+rsp,rbp
 
-
+; If Y>n ==> Y=Y-n
 	sub	r12,r8
 	sbb	r13,r9
 	sbb	r14,r10
 	sbb	r15,r11
 	sbb	rbp,0
 
-
+; Choose old Y or new Y
 	cmovc	r12,QWORD16+rsp
 	cmovc	r13,QWORD24+rsp
 	cmovc	r14,QWORD32+rsp
 	cmovc	r15,QWORD40+rsp
 	jnc	NEAR $L$beeu_reduction_loop
 
-
+; X = n - Y (n, Y < 2^256), (Cancel the (-1))
 	sub	r8,r12
 	sbb	r9,r13
 	sbb	r10,r14
 	sbb	r11,r15
 
 $L$beeu_save:
-
+; Save the inverse(<2^256) to out.
 	mov	rdi,QWORDrsp
 
 	mov	QWORDrdi,r8
@@ -308,12 +308,12 @@
 	mov	QWORD16+rdi,r10
 	mov	QWORD24+rdi,r11
 
-
+; Return 1.
 	mov	rax,1
 	jmp	NEAR $L$beeu_finish
 
 $L$beeu_err:
-
+; Return 0.
 	xor	rax,rax
 
 $L$beeu_finish:

boringssl-0.20260708.tar.xz/gen/bcm/rdrand-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/rdrand-x86_64-apple.S Changed

boringssl-0.20260708.tar.xz/gen/bcm/rdrand-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/rdrand-x86_64-linux.S Changed

boringssl-0.20260708.tar.xz/gen/bcm/rdrand-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/rdrand-x86_64-win.asm Changed

boringssl-0.20260708.tar.xz/gen/bcm/rsaz-avx2-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/rsaz-avx2-apple.S Changed

@@ -10,7 +10,7 @@
 .private_extern _rsaz_1024_sqr_avx2
 
 .p2align	6
-_rsaz_1024_sqr_avx2:
+_rsaz_1024_sqr_avx2:  // 702 cycles, 14% faster than rsaz_1024_mul_avx2
 
 _CET_ENDBR
 	leaq	(%rsp),%rax
@@ -30,23 +30,23 @@
 	vzeroupper
 	movq	%rax,%rbp
 
-	movq	%rdx,%r13
+	movq	%rdx,%r13  // reassigned argument
 	subq	$832,%rsp
 	movq	%r13,%r15
-	subq	$-128,%rdi
+	subq	$-128,%rdi  // size optimization
 	subq	$-128,%rsi
 	subq	$-128,%r13
 
-	andq	$4095,%r15
+	andq	$4095,%r15  // see if %r13 crosses page
 	addq	$320,%r15
 	shrq	$12,%r15
 	vpxor	%ymm9,%ymm9,%ymm9
 	jz	L$sqr_1024_no_n_copy
 
-
-
-
-
+// unaligned 256-bit load that crosses page boundary can
+// cause >2x performance degradation here, so if %r13 does
+// cross page boundary, copy it to stack and make sure stack
+// frame doesn't...
 	subq	$320,%rsp
 	vmovdqu	0-128(%r13),%ymm0
 	andq	$-2048,%rsp
@@ -68,7 +68,7 @@
 	vmovdqu	%ymm6,192-128(%r13)
 	vmovdqu	%ymm7,224-128(%r13)
 	vmovdqu	%ymm8,256-128(%r13)
-	vmovdqu	%ymm9,288-128(%r13)
+	vmovdqu	%ymm9,288-128(%r13)  // %ymm9 is zero
 
 L$sqr_1024_no_n_copy:
 	andq	$-1024,%rsp
@@ -82,18 +82,18 @@
 	vmovdqu	224-128(%rsi),%ymm7
 	vmovdqu	256-128(%rsi),%ymm8
 
-	leaq	192(%rsp),%rbx
+	leaq	192(%rsp),%rbx  // 64+128=192
 	vmovdqu	L$and_mask(%rip),%ymm15
 	jmp	L$OOP_GRANDE_SQR_1024
 
 .p2align	5
 L$OOP_GRANDE_SQR_1024:
-	leaq	576+128(%rsp),%r9
-	leaq	448(%rsp),%r12
-
-
-
+	leaq	576+128(%rsp),%r9  // size optimization
+	leaq	448(%rsp),%r12  // 64+128+256=448
 
+// the squaring is performed as described in Variant B of
+// "Speeding up Big-Number Squaring", so start by calculating
+// the A*2=A+A vector
 	vpaddq	%ymm1,%ymm1,%ymm1
 	vpbroadcastq	0-128(%rsi),%ymm10
 	vpaddq	%ymm2,%ymm2,%ymm2
@@ -115,7 +115,7 @@
 
 	vpmuludq	0-128(%rsi),%ymm10,%ymm0
 	vpbroadcastq	32-128(%rsi),%ymm11
-	vmovdqu	%ymm9,288-192(%rbx)
+	vmovdqu	%ymm9,288-192(%rbx)  // zero upper half
 	vpmuludq	%ymm10,%ymm1,%ymm1
 	vmovdqu	%ymm9,320-448(%r12)
 	vpmuludq	%ymm10,%ymm2,%ymm2
@@ -252,10 +252,10 @@
 	vpmuludq	192-128(%rsi),%ymm10,%ymm12
 	vpaddq	%ymm12,%ymm3,%ymm3
 	vpmuludq	192-128(%r9),%ymm10,%ymm14
-	vpbroadcastq	256-128(%r15),%ymm0
+	vpbroadcastq	256-128(%r15),%ymm0  // borrow %ymm0 for %ymm10
 	vpaddq	%ymm14,%ymm4,%ymm4
 	vpmuludq	224-128(%r9),%ymm10,%ymm5
-	vpbroadcastq	0+8-128(%r15),%ymm10
+	vpbroadcastq	0+8-128(%r15),%ymm10  // for next iteration
 	vpaddq	448-448(%r12),%ymm5,%ymm5
 
 	vmovdqu	%ymm3,384-448(%r12)
@@ -276,11 +276,11 @@
 
 	decl	%r14d
 	jnz	L$OOP_SQR_1024
-
-	vmovdqu	256(%rsp),%ymm8
-	vmovdqu	288(%rsp),%ymm1
-	vmovdqu	320(%rsp),%ymm2
-	leaq	192(%rsp),%rbx
+// we need to fix indices 32-39 to avoid overflow
+	vmovdqu	256(%rsp),%ymm8  // 32*8-192(%rbx),
+	vmovdqu	288(%rsp),%ymm1  // 32*9-192(%rbx)
+	vmovdqu	320(%rsp),%ymm2  // 32*10-192(%rbx)
+	leaq	192(%rsp),%rbx  // 64+128=192
 
 	vpsrlq	$29,%ymm8,%ymm14
 	vpand	%ymm15,%ymm8,%ymm8
@@ -376,17 +376,17 @@
 	vpaddq	%ymm10,%ymm7,%ymm7
 	vpmuludq	256-128(%r13),%ymm12,%ymm14
 	vmovd	%eax,%xmm12
-
+// vmovdqu	32*1-8-128(%r13), %ymm11		# moved below
 	vpaddq	%ymm14,%ymm8,%ymm8
-
+// vmovdqu	32*2-8-128(%r13), %ymm10		# moved below
 	vpbroadcastq	%xmm12,%ymm12
 
-	vpmuludq	32-8-128(%r13),%ymm13,%ymm11
+	vpmuludq	32-8-128(%r13),%ymm13,%ymm11  // see above
 	vmovdqu	96-8-128(%r13),%ymm14
 	movq	%rax,%rdx
 	imulq	-128(%r13),%rax
 	vpaddq	%ymm11,%ymm1,%ymm1
-	vpmuludq	64-8-128(%r13),%ymm13,%ymm10
+	vpmuludq	64-8-128(%r13),%ymm13,%ymm10  // see above
 	vmovdqu	128-8-128(%r13),%ymm11
 	addq	%rax,%r11
 	movq	%rdx,%rax
@@ -405,7 +405,7 @@
 	imull	%ecx,%eax
 	vpaddq	%ymm11,%ymm4,%ymm4
 	vpmuludq	%ymm13,%ymm10,%ymm10
-.byte	0xc4,0x41,0x7e,0x6f,0x9d,0x58,0x00,0x00,0x00
+.byte	0xc4,0x41,0x7e,0x6f,0x9d,0x58,0x00,0x00,0x00  // vmovdqu		32*7-8-128(%r13), %ymm11
 	andl	$0x1fffffff,%eax
 	vpaddq	%ymm10,%ymm5,%ymm5
 	vpmuludq	%ymm13,%ymm14,%ymm14
@@ -413,7 +413,7 @@
 	vpaddq	%ymm14,%ymm6,%ymm6
 	vpmuludq	%ymm13,%ymm11,%ymm11
 	vmovdqu	288-8-128(%r13),%ymm9
-	vmovd	%eax,%xmm0
+	vmovd	%eax,%xmm0  // borrow ACC0 for Y2
 	imulq	-128(%r13),%rax
 	vpaddq	%ymm11,%ymm7,%ymm7
 	vpmuludq	%ymm13,%ymm10,%ymm10
@@ -430,14 +430,14 @@
 	vpaddq	%ymm14,%ymm1,%ymm1
 	vpmuludq	%ymm0,%ymm13,%ymm13
 	vpmuludq	%ymm12,%ymm11,%ymm11
-.byte	0xc4,0x41,0x7e,0x6f,0xb5,0xf0,0xff,0xff,0xff
+.byte	0xc4,0x41,0x7e,0x6f,0xb5,0xf0,0xff,0xff,0xff  // vmovdqu		32*4-16-128(%r13), %ymm14
 	vpaddq	%ymm1,%ymm13,%ymm13
 	vpaddq	%ymm11,%ymm2,%ymm2
 	vpmuludq	%ymm12,%ymm10,%ymm10
 	vmovdqu	160-16-128(%r13),%ymm11
 .byte	0x67
 	vmovq	%xmm13,%rax
-	vmovdqu	%ymm13,(%rsp)
+	vmovdqu	%ymm13,(%rsp)  // transfer %r9-%r12
 	vpaddq	%ymm10,%ymm3,%ymm3
 	vpmuludq	%ymm12,%ymm14,%ymm14
 	vmovdqu	192-16-128(%r13),%ymm10
@@ -454,7 +454,7 @@
 	addq	%r12,%rax
 	vpaddq	%ymm14,%ymm7,%ymm7
 	vpmuludq	%ymm12,%ymm11,%ymm11
-
+// vmovdqu	32*2-24-128(%r13), %ymm14	# moved below
 	movq	%rax,%r9
 	imull	%ecx,%eax
 	vpaddq	%ymm11,%ymm8,%ymm8
@@ -466,7 +466,7 @@
 	vpaddq	%ymm10,%ymm9,%ymm9
 	vpbroadcastq	%xmm12,%ymm12
 
-	vpmuludq	64-24-128(%r13),%ymm0,%ymm14
+	vpmuludq	64-24-128(%r13),%ymm0,%ymm14  // see above
 	vmovdqu	128-24-128(%r13),%ymm10
 	movq	%rax,%rdx
 	imulq	-128(%r13),%rax
@@ -489,7 +489,7 @@
 	vpaddq	%ymm10,%ymm4,%ymm3
 	vpmuludq	%ymm0,%ymm14,%ymm14
 	vmovdqu	224-24-128(%r13),%ymm10
-	imulq	24-128(%r13),%rdx
+	imulq	24-128(%r13),%rdx  // future %r12
 	addq	%rax,%r11
 	leaq	(%r9,%r10,1),%rax
 	vpaddq	%ymm14,%ymm5,%ymm4
@@ -512,7 +512,7 @@
 
 	decl	%r14d
 	jnz	L$OOP_REDUCE_1024
-	leaq	448(%rsp),%r12
+	leaq	448(%rsp),%r12  // size optimization
 	vpaddq	%ymm9,%ymm13,%ymm0
 	vpxor	%ymm9,%ymm9,%ymm9
 
@@ -655,7 +655,7 @@
 
 	movq	-8(%rax),%rbx
 
-	leaq	(%rax),%rsp
+	leaq	(%rax),%rsp  // restore %rsp
 
 L$sqr_1024_epilogue:
 	ret
@@ -686,14 +686,14 @@
 	movq	%rax,%rbp
 
 	vzeroall
-	movq	%rdx,%r13
+	movq	%rdx,%r13  // reassigned argument
 	subq	$64,%rsp
 
-
-
-
-
-
+// unaligned 256-bit load that crosses page boundary can
+// cause severe performance degradation here, so if %rsi does
+// cross page boundary, swap it with %r13 meaning that caller
+// is advised to lay down %rsi and %r13 next to each other, so
+// that only one can cross page boundary.
 .byte	0x67,0x67
 	movq	%rsi,%r15
 	andq	$4095,%r15
@@ -704,20 +704,20 @@
 	cmovnzq	%r15,%r13
 
 	movq	%rcx,%r15
-	subq	$-128,%rsi
+	subq	$-128,%rsi  // size optimization
 	subq	$-128,%rcx
 	subq	$-128,%rdi
 
-	andq	$4095,%r15
+	andq	$4095,%r15  // see if %rcx crosses page
 	addq	$320,%r15
 .byte	0x67,0x67
 	shrq	$12,%r15
 	jz	L$mul_1024_no_n_copy
 
-
-
-
-
+// unaligned 256-bit load that crosses page boundary can
+// cause severe performance degradation here, so if %rcx does
+// cross page boundary, copy it to stack and make sure stack
+// frame doesn't...
 	subq	$320,%rsp
 	vmovdqu	0-128(%rcx),%ymm0
 	andq	$-512,%rsp
@@ -748,13 +748,13 @@
 	vpxor	%ymm7,%ymm7,%ymm7
 	vmovdqu	%ymm8,256-128(%rcx)
 	vmovdqa	%ymm0,%ymm8
-	vmovdqu	%ymm9,288-128(%rcx)
+	vmovdqu	%ymm9,288-128(%rcx)  // %ymm9 is zero after vzeroall
 L$mul_1024_no_n_copy:
 	andq	$-64,%rsp
 
 	movq	(%r13),%rbx
 	vpbroadcastq	(%r13),%ymm10
-	vmovdqu	%ymm0,(%rsp)
+	vmovdqu	%ymm0,(%rsp)  // clear top of stack
 	xorq	%r9,%r9
 .byte	0x67
 	xorq	%r10,%r10
@@ -763,12 +763,12 @@
 
 	vmovdqu	L$and_mask(%rip),%ymm15
 	movl	$9,%r14d
-	vmovdqu	%ymm9,288-128(%rdi)
+	vmovdqu	%ymm9,288-128(%rdi)  // %ymm9 is zero after vzeroall
 	jmp	L$oop_mul_1024
 
 .p2align	5
 L$oop_mul_1024:
-	vpsrlq	$29,%ymm3,%ymm9
+	vpsrlq	$29,%ymm3,%ymm9  // correct %ymm3(*)
 	movq	%rbx,%rax
 	imulq	-128(%rsi),%rax
 	addq	%r9,%rax
@@ -794,7 +794,7 @@
 	vpbroadcastq	%xmm11,%ymm11
 	vpaddq	%ymm12,%ymm2,%ymm2
 	vpmuludq	96-128(%rsi),%ymm10,%ymm13
-	vpand	%ymm15,%ymm3,%ymm3
+	vpand	%ymm15,%ymm3,%ymm3  // correct %ymm3
 	vpaddq	%ymm13,%ymm3,%ymm3
 	vpmuludq	128-128(%rsi),%ymm10,%ymm0
 	vpaddq	%ymm0,%ymm4,%ymm4
@@ -803,7 +803,7 @@
 	vpmuludq	192-128(%rsi),%ymm10,%ymm13
 	vpaddq	%ymm13,%ymm6,%ymm6
 	vpmuludq	224-128(%rsi),%ymm10,%ymm0
-	vpermq	$0x93,%ymm9,%ymm9
+	vpermq	$0x93,%ymm9,%ymm9  // correct %ymm3
 	vpaddq	%ymm0,%ymm7,%ymm7
 	vpmuludq	256-128(%rsi),%ymm10,%ymm12
 	vpbroadcastq	8(%r13),%ymm10
@@ -837,10 +837,10 @@
 	vpmuludq	192-128(%rcx),%ymm11,%ymm12
 	vpaddq	%ymm12,%ymm6,%ymm6
 	vpmuludq	224-128(%rcx),%ymm11,%ymm13
-	vpblendd	$3,%ymm14,%ymm9,%ymm12
+	vpblendd	$3,%ymm14,%ymm9,%ymm12  // correct %ymm3
 	vpaddq	%ymm13,%ymm7,%ymm7
 	vpmuludq	256-128(%rcx),%ymm11,%ymm0
-	vpaddq	%ymm12,%ymm3,%ymm3
+	vpaddq	%ymm12,%ymm3,%ymm3  // correct %ymm3
 	vpaddq	%ymm0,%ymm8,%ymm8
 
 	movq	%rbx,%rax
@@ -853,9 +853,9 @@
 	vmovdqu	-8+64-128(%rsi),%ymm13
 
 	movq	%r10,%rax
-	vpblendd	$0xfc,%ymm14,%ymm9,%ymm9
+	vpblendd	$0xfc,%ymm14,%ymm9,%ymm9  // correct %ymm3
 	imull	%r8d,%eax
-	vpaddq	%ymm9,%ymm4,%ymm4
+	vpaddq	%ymm9,%ymm4,%ymm4  // correct %ymm3
 	andl	$0x1fffffff,%eax
 
 	imulq	16-128(%rsi),%rbx
@@ -1043,7 +1043,7 @@
 	vpmuludq	%ymm10,%ymm13,%ymm13
 	vpbroadcastq	32(%r13),%ymm10
 	vpaddq	%ymm13,%ymm9,%ymm9
-	addq	$32,%r13
+	addq	$32,%r13  // %r13++
 
 	vmovdqu	-24+32-128(%rcx),%ymm0
 	imulq	-128(%rcx),%rax
@@ -1054,9 +1054,9 @@
 	vpmuludq	%ymm11,%ymm0,%ymm0
 	vmovq	%xmm10,%rbx
 	vmovdqu	-24+96-128(%rcx),%ymm13
-	vpaddq	%ymm0,%ymm1,%ymm0
+	vpaddq	%ymm0,%ymm1,%ymm0  // %ymm0==%ymm0
 	vpmuludq	%ymm11,%ymm12,%ymm12
-	vmovdqu	%ymm0,(%rsp)
+	vmovdqu	%ymm0,(%rsp)  // transfer %r9-%r12
 	vpaddq	%ymm12,%ymm2,%ymm1
 	vmovdqu	-24+128-128(%rcx),%ymm0
 	vpmuludq	%ymm11,%ymm13,%ymm13
@@ -1213,7 +1213,7 @@
 
 	movq	-8(%rax),%rbx
 
-	leaq	(%rax),%rsp
+	leaq	(%rax),%rsp  // restore %rsp
 
 L$mul_1024_epilogue:
 	ret
@@ -1227,7 +1227,7 @@
 _rsaz_1024_red2norm_avx2:
 
 _CET_ENDBR
-	subq	$-128,%rsi
+	subq	$-128,%rsi  // size optimization
 	xorq	%rax,%rax
 	movq	-128(%rsi),%r8
 	movq	-120(%rsi),%r9
@@ -1240,7 +1240,7 @@
 	addq	%r8,%rax
 	addq	%r9,%rax
 	addq	%r10,%rax
-	adcq	$0,%r11
+	adcq	$0,%r11  // consume eventual carry
 	movq	%rax,0(%rdi)
 	movq	%r11,%rax
 	movq	-104(%rsi),%r8
@@ -1251,7 +1251,7 @@
 	shrq	$12,%r10
 	addq	%r8,%rax
 	addq	%r9,%rax
-	adcq	$0,%r10
+	adcq	$0,%r10  // consume eventual carry
 	movq	%rax,8(%rdi)
 	movq	%r10,%rax
 	movq	-88(%rsi),%r11
@@ -1262,7 +1262,7 @@
 	shrq	$18,%r9
 	addq	%r11,%rax
 	addq	%r8,%rax
-	adcq	$0,%r9
+	adcq	$0,%r9  // consume eventual carry
 	movq	%rax,16(%rdi)
 	movq	%r9,%rax
 	movq	-72(%rsi),%r10
@@ -1273,7 +1273,7 @@
 	shrq	$24,%r8
 	addq	%r10,%rax
 	addq	%r11,%rax
-	adcq	$0,%r8
+	adcq	$0,%r8  // consume eventual carry
 	movq	%rax,24(%rdi)
 	movq	%r8,%rax
 	movq	-56(%rsi),%r9
@@ -1287,7 +1287,7 @@
 	addq	%r9,%rax
 	addq	%r10,%rax
 	addq	%r11,%rax
-	adcq	$0,%r8
+	adcq	$0,%r8  // consume eventual carry
 	movq	%rax,32(%rdi)
 	movq	%r8,%rax
 	movq	-32(%rsi),%r9
@@ -1298,7 +1298,7 @@
 	shrq	$7,%r11
 	addq	%r9,%rax
 	addq	%r10,%rax
-	adcq	$0,%r11
+	adcq	$0,%r11  // consume eventual carry
 	movq	%rax,40(%rdi)
 	movq	%r11,%rax
 	movq	-16(%rsi),%r8
@@ -1309,7 +1309,7 @@
 	shrq	$13,%r10
 	addq	%r8,%rax
 	addq	%r9,%rax
-	adcq	$0,%r10
+	adcq	$0,%r10  // consume eventual carry
 	movq	%rax,48(%rdi)
 	movq	%r10,%rax
 	movq	0(%rsi),%r11
@@ -1320,7 +1320,7 @@
 	shrq	$19,%r9
 	addq	%r11,%rax
 	addq	%r8,%rax
-	adcq	$0,%r9
+	adcq	$0,%r9  // consume eventual carry
 	movq	%rax,56(%rdi)
 	movq	%r9,%rax
 	movq	16(%rsi),%r10
@@ -1331,7 +1331,7 @@
 	shrq	$25,%r8
 	addq	%r10,%rax
 	addq	%r11,%rax
-	adcq	$0,%r8
+	adcq	$0,%r8  // consume eventual carry
 	movq	%rax,64(%rdi)
 	movq	%r8,%rax
 	movq	32(%rsi),%r9
@@ -1345,7 +1345,7 @@
 	addq	%r9,%rax
 	addq	%r10,%rax
 	addq	%r11,%rax
-	adcq	$0,%r8
+	adcq	$0,%r8  // consume eventual carry
 	movq	%rax,72(%rdi)
 	movq	%r8,%rax
 	movq	56(%rsi),%r9
@@ -1356,7 +1356,7 @@
 	shrq	$8,%r11
 	addq	%r9,%rax
 	addq	%r10,%rax
-	adcq	$0,%r11
+	adcq	$0,%r11  // consume eventual carry
 	movq	%rax,80(%rdi)
 	movq	%r11,%rax
 	movq	72(%rsi),%r8
@@ -1367,7 +1367,7 @@
 	shrq	$14,%r10
 	addq	%r8,%rax
 	addq	%r9,%rax
-	adcq	$0,%r10
+	adcq	$0,%r10  // consume eventual carry
 	movq	%rax,88(%rdi)
 	movq	%r10,%rax
 	movq	88(%rsi),%r11
@@ -1378,7 +1378,7 @@
 	shrq	$20,%r9
 	addq	%r11,%rax
 	addq	%r8,%rax
-	adcq	$0,%r9
+	adcq	$0,%r9  // consume eventual carry
 	movq	%rax,96(%rdi)
 	movq	%r9,%rax
 	movq	104(%rsi),%r10
@@ -1389,7 +1389,7 @@
 	shrq	$26,%r8
 	addq	%r10,%rax
 	addq	%r11,%rax
-	adcq	$0,%r8
+	adcq	$0,%r8  // consume eventual carry
 	movq	%rax,104(%rdi)
 	movq	%r8,%rax
 	movq	120(%rsi),%r9
@@ -1403,7 +1403,7 @@
 	addq	%r9,%rax
 	addq	%r10,%rax
 	addq	%r11,%rax
-	adcq	$0,%r8
+	adcq	$0,%r8  // consume eventual carry
 	movq	%rax,112(%rdi)
 	movq	%r8,%rax
 	movq	144(%rsi),%r9
@@ -1414,7 +1414,7 @@
 	shrq	$9,%r11
 	addq	%r9,%rax
 	addq	%r10,%rax
-	adcq	$0,%r11
+	adcq	$0,%r11  // consume eventual carry
 	movq	%rax,120(%rdi)
 	movq	%r11,%rax
 	ret
@@ -1429,17 +1429,17 @@
 _rsaz_1024_norm2red_avx2:
 
 _CET_ENDBR
-	subq	$-128,%rdi
+	subq	$-128,%rdi  // size optimization
 	movq	(%rsi),%r8
 	movl	$0x1fffffff,%eax
 	movq	8(%rsi),%r9
 	movq	%r8,%r11
 	shrq	$0,%r11
-	andq	%rax,%r11
+	andq	%rax,%r11  // &0x1fffffff
 	movq	%r11,-128(%rdi)
 	movq	%r8,%r10
 	shrq	$29,%r10
-	andq	%rax,%r10
+	andq	%rax,%r10  // &0x1fffffff
 	movq	%r10,-120(%rdi)
 	shrdq	$58,%r9,%r8
 	andq	%rax,%r8
@@ -1447,7 +1447,7 @@
 	movq	16(%rsi),%r10
 	movq	%r9,%r8
 	shrq	$23,%r8
-	andq	%rax,%r8
+	andq	%rax,%r8  // &0x1fffffff
 	movq	%r8,-104(%rdi)
 	shrdq	$52,%r10,%r9
 	andq	%rax,%r9
@@ -1455,7 +1455,7 @@
 	movq	24(%rsi),%r11
 	movq	%r10,%r9
 	shrq	$17,%r9
-	andq	%rax,%r9
+	andq	%rax,%r9  // &0x1fffffff
 	movq	%r9,-88(%rdi)
 	shrdq	$46,%r11,%r10
 	andq	%rax,%r10
@@ -1463,7 +1463,7 @@
 	movq	32(%rsi),%r8
 	movq	%r11,%r10
 	shrq	$11,%r10
-	andq	%rax,%r10
+	andq	%rax,%r10  // &0x1fffffff
 	movq	%r10,-72(%rdi)
 	shrdq	$40,%r8,%r11
 	andq	%rax,%r11
@@ -1471,11 +1471,11 @@
 	movq	40(%rsi),%r9
 	movq	%r8,%r11
 	shrq	$5,%r11
-	andq	%rax,%r11
+	andq	%rax,%r11  // &0x1fffffff
 	movq	%r11,-56(%rdi)
 	movq	%r8,%r10
 	shrq	$34,%r10
-	andq	%rax,%r10
+	andq	%rax,%r10  // &0x1fffffff
 	movq	%r10,-48(%rdi)
 	shrdq	$63,%r9,%r8
 	andq	%rax,%r8
@@ -1483,7 +1483,7 @@
 	movq	48(%rsi),%r10
 	movq	%r9,%r8
 	shrq	$28,%r8
-	andq	%rax,%r8
+	andq	%rax,%r8  // &0x1fffffff
 	movq	%r8,-32(%rdi)
 	shrdq	$57,%r10,%r9
 	andq	%rax,%r9
@@ -1491,7 +1491,7 @@
 	movq	56(%rsi),%r11
 	movq	%r10,%r9
 	shrq	$22,%r9
-	andq	%rax,%r9
+	andq	%rax,%r9  // &0x1fffffff
 	movq	%r9,-16(%rdi)
 	shrdq	$51,%r11,%r10
 	andq	%rax,%r10
@@ -1499,7 +1499,7 @@
 	movq	64(%rsi),%r8
 	movq	%r11,%r10
 	shrq	$16,%r10
-	andq	%rax,%r10
+	andq	%rax,%r10  // &0x1fffffff
 	movq	%r10,0(%rdi)
 	shrdq	$45,%r8,%r11
 	andq	%rax,%r11
@@ -1507,7 +1507,7 @@
 	movq	72(%rsi),%r9
 	movq	%r8,%r11
 	shrq	$10,%r11
-	andq	%rax,%r11
+	andq	%rax,%r11  // &0x1fffffff
 	movq	%r11,16(%rdi)
 	shrdq	$39,%r9,%r8
 	andq	%rax,%r8
@@ -1515,11 +1515,11 @@
 	movq	80(%rsi),%r10
 	movq	%r9,%r8
 	shrq	$4,%r8
-	andq	%rax,%r8
+	andq	%rax,%r8  // &0x1fffffff
 	movq	%r8,32(%rdi)
 	movq	%r9,%r11
 	shrq	$33,%r11
-	andq	%rax,%r11
+	andq	%rax,%r11  // &0x1fffffff
 	movq	%r11,40(%rdi)
 	shrdq	$62,%r10,%r9
 	andq	%rax,%r9
@@ -1527,7 +1527,7 @@
 	movq	88(%rsi),%r11
 	movq	%r10,%r9
 	shrq	$27,%r9
-	andq	%rax,%r9
+	andq	%rax,%r9  // &0x1fffffff
 	movq	%r9,56(%rdi)
 	shrdq	$56,%r11,%r10
 	andq	%rax,%r10
@@ -1535,7 +1535,7 @@
 	movq	96(%rsi),%r8
 	movq	%r11,%r10
 	shrq	$21,%r10
-	andq	%rax,%r10
+	andq	%rax,%r10  // &0x1fffffff
 	movq	%r10,72(%rdi)
 	shrdq	$50,%r8,%r11
 	andq	%rax,%r11
@@ -1543,7 +1543,7 @@
 	movq	104(%rsi),%r9
 	movq	%r8,%r11
 	shrq	$15,%r11
-	andq	%rax,%r11
+	andq	%rax,%r11  // &0x1fffffff
 	movq	%r11,88(%rdi)
 	shrdq	$44,%r9,%r8
 	andq	%rax,%r8
@@ -1551,7 +1551,7 @@
 	movq	112(%rsi),%r10
 	movq	%r9,%r8
 	shrq	$9,%r8
-	andq	%rax,%r8
+	andq	%rax,%r8  // &0x1fffffff
 	movq	%r8,104(%rdi)
 	shrdq	$38,%r10,%r9
 	andq	%rax,%r9
@@ -1559,11 +1559,11 @@
 	movq	120(%rsi),%r11
 	movq	%r10,%r9
 	shrq	$3,%r9
-	andq	%rax,%r9
+	andq	%rax,%r9  // &0x1fffffff
 	movq	%r9,120(%rdi)
 	movq	%r10,%r8
 	shrq	$32,%r8
-	andq	%rax,%r8
+	andq	%rax,%r8  // &0x1fffffff
 	movq	%r8,128(%rdi)
 	shrdq	$61,%r11,%r10
 	andq	%rax,%r10
@@ -1571,12 +1571,12 @@
 	xorq	%r8,%r8
 	movq	%r11,%r10
 	shrq	$26,%r10
-	andq	%rax,%r10
+	andq	%rax,%r10  // &0x1fffffff
 	movq	%r10,144(%rdi)
 	shrdq	$55,%r8,%r11
 	andq	%rax,%r11
 	movq	%r11,152(%rdi)
-	movq	%r8,160(%rdi)
+	movq	%r8,160(%rdi)  // zero
 	movq	%r8,168(%rdi)
 	movq	%r8,176(%rdi)
 	movq	%r8,184(%rdi)
@@ -1627,7 +1627,7 @@
 	leaq	-256(%rsp),%rsp
 	andq	$-32,%rsp
 	leaq	L$inc(%rip),%r10
-	leaq	-128(%rsp),%rax
+	leaq	-128(%rsp),%rax  // control u-op density
 
 	vmovd	%edx,%xmm4
 	vmovdqa	(%r10),%ymm0
@@ -1674,7 +1674,7 @@
 	vpcmpeqd	%ymm4,%ymm14,%ymm14
 	vpcmpeqd	%ymm4,%ymm15,%ymm15
 
-	vmovdqa	-32(%r10),%ymm7
+	vmovdqa	-32(%r10),%ymm7  // .Lgather_permd
 	leaq	128(%rsi),%rsi
 	movl	$9,%edx
 
@@ -1720,7 +1720,7 @@
 	vpor	%ymm3,%ymm5,%ymm5
 
 	vpor	%ymm5,%ymm4,%ymm4
-	vextracti128	$1,%ymm4,%xmm5
+	vextracti128	$1,%ymm4,%xmm5  // upper half is cleared
 	vpor	%xmm4,%xmm5,%xmm5
 	vpermd	%ymm5,%ymm7,%ymm5
 	vmovdqu	%ymm5,(%rdi)

boringssl-0.20260708.tar.xz/gen/bcm/rsaz-avx2-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/rsaz-avx2-linux.S Changed

@@ -10,7 +10,7 @@
 .hidden rsaz_1024_sqr_avx2
 .type	rsaz_1024_sqr_avx2,@function
 .align	64
-rsaz_1024_sqr_avx2:
+rsaz_1024_sqr_avx2:  // 702 cycles, 14% faster than rsaz_1024_mul_avx2
 .cfi_startproc	
 _CET_ENDBR
 	leaq	(%rsp),%rax
@@ -30,23 +30,23 @@
 	vzeroupper
 	movq	%rax,%rbp
 .cfi_def_cfa_register	%rbp
-	movq	%rdx,%r13
+	movq	%rdx,%r13  // reassigned argument
 	subq	$832,%rsp
 	movq	%r13,%r15
-	subq	$-128,%rdi
+	subq	$-128,%rdi  // size optimization
 	subq	$-128,%rsi
 	subq	$-128,%r13
 
-	andq	$4095,%r15
+	andq	$4095,%r15  // see if %r13 crosses page
 	addq	$320,%r15
 	shrq	$12,%r15
 	vpxor	%ymm9,%ymm9,%ymm9
 	jz	.Lsqr_1024_no_n_copy
 
-
-
-
-
+// unaligned 256-bit load that crosses page boundary can
+// cause >2x performance degradation here, so if %r13 does
+// cross page boundary, copy it to stack and make sure stack
+// frame doesn't...
 	subq	$320,%rsp
 	vmovdqu	0-128(%r13),%ymm0
 	andq	$-2048,%rsp
@@ -68,7 +68,7 @@
 	vmovdqu	%ymm6,192-128(%r13)
 	vmovdqu	%ymm7,224-128(%r13)
 	vmovdqu	%ymm8,256-128(%r13)
-	vmovdqu	%ymm9,288-128(%r13)
+	vmovdqu	%ymm9,288-128(%r13)  // %ymm9 is zero
 
 .Lsqr_1024_no_n_copy:
 	andq	$-1024,%rsp
@@ -82,18 +82,18 @@
 	vmovdqu	224-128(%rsi),%ymm7
 	vmovdqu	256-128(%rsi),%ymm8
 
-	leaq	192(%rsp),%rbx
+	leaq	192(%rsp),%rbx  // 64+128=192
 	vmovdqu	.Land_mask(%rip),%ymm15
 	jmp	.LOOP_GRANDE_SQR_1024
 
 .align	32
 .LOOP_GRANDE_SQR_1024:
-	leaq	576+128(%rsp),%r9
-	leaq	448(%rsp),%r12
-
-
-
+	leaq	576+128(%rsp),%r9  // size optimization
+	leaq	448(%rsp),%r12  // 64+128+256=448
 
+// the squaring is performed as described in Variant B of
+// "Speeding up Big-Number Squaring", so start by calculating
+// the A*2=A+A vector
 	vpaddq	%ymm1,%ymm1,%ymm1
 	vpbroadcastq	0-128(%rsi),%ymm10
 	vpaddq	%ymm2,%ymm2,%ymm2
@@ -115,7 +115,7 @@
 
 	vpmuludq	0-128(%rsi),%ymm10,%ymm0
 	vpbroadcastq	32-128(%rsi),%ymm11
-	vmovdqu	%ymm9,288-192(%rbx)
+	vmovdqu	%ymm9,288-192(%rbx)  // zero upper half
 	vpmuludq	%ymm10,%ymm1,%ymm1
 	vmovdqu	%ymm9,320-448(%r12)
 	vpmuludq	%ymm10,%ymm2,%ymm2
@@ -252,10 +252,10 @@
 	vpmuludq	192-128(%rsi),%ymm10,%ymm12
 	vpaddq	%ymm12,%ymm3,%ymm3
 	vpmuludq	192-128(%r9),%ymm10,%ymm14
-	vpbroadcastq	256-128(%r15),%ymm0
+	vpbroadcastq	256-128(%r15),%ymm0  // borrow %ymm0 for %ymm10
 	vpaddq	%ymm14,%ymm4,%ymm4
 	vpmuludq	224-128(%r9),%ymm10,%ymm5
-	vpbroadcastq	0+8-128(%r15),%ymm10
+	vpbroadcastq	0+8-128(%r15),%ymm10  // for next iteration
 	vpaddq	448-448(%r12),%ymm5,%ymm5
 
 	vmovdqu	%ymm3,384-448(%r12)
@@ -276,11 +276,11 @@
 
 	decl	%r14d
 	jnz	.LOOP_SQR_1024
-
-	vmovdqu	256(%rsp),%ymm8
-	vmovdqu	288(%rsp),%ymm1
-	vmovdqu	320(%rsp),%ymm2
-	leaq	192(%rsp),%rbx
+// we need to fix indices 32-39 to avoid overflow
+	vmovdqu	256(%rsp),%ymm8  // 32*8-192(%rbx),
+	vmovdqu	288(%rsp),%ymm1  // 32*9-192(%rbx)
+	vmovdqu	320(%rsp),%ymm2  // 32*10-192(%rbx)
+	leaq	192(%rsp),%rbx  // 64+128=192
 
 	vpsrlq	$29,%ymm8,%ymm14
 	vpand	%ymm15,%ymm8,%ymm8
@@ -376,17 +376,17 @@
 	vpaddq	%ymm10,%ymm7,%ymm7
 	vpmuludq	256-128(%r13),%ymm12,%ymm14
 	vmovd	%eax,%xmm12
-
+// vmovdqu	32*1-8-128(%r13), %ymm11		# moved below
 	vpaddq	%ymm14,%ymm8,%ymm8
-
+// vmovdqu	32*2-8-128(%r13), %ymm10		# moved below
 	vpbroadcastq	%xmm12,%ymm12
 
-	vpmuludq	32-8-128(%r13),%ymm13,%ymm11
+	vpmuludq	32-8-128(%r13),%ymm13,%ymm11  // see above
 	vmovdqu	96-8-128(%r13),%ymm14
 	movq	%rax,%rdx
 	imulq	-128(%r13),%rax
 	vpaddq	%ymm11,%ymm1,%ymm1
-	vpmuludq	64-8-128(%r13),%ymm13,%ymm10
+	vpmuludq	64-8-128(%r13),%ymm13,%ymm10  // see above
 	vmovdqu	128-8-128(%r13),%ymm11
 	addq	%rax,%r11
 	movq	%rdx,%rax
@@ -405,7 +405,7 @@
 	imull	%ecx,%eax
 	vpaddq	%ymm11,%ymm4,%ymm4
 	vpmuludq	%ymm13,%ymm10,%ymm10
-.byte	0xc4,0x41,0x7e,0x6f,0x9d,0x58,0x00,0x00,0x00
+.byte	0xc4,0x41,0x7e,0x6f,0x9d,0x58,0x00,0x00,0x00  // vmovdqu		32*7-8-128(%r13), %ymm11
 	andl	$0x1fffffff,%eax
 	vpaddq	%ymm10,%ymm5,%ymm5
 	vpmuludq	%ymm13,%ymm14,%ymm14
@@ -413,7 +413,7 @@
 	vpaddq	%ymm14,%ymm6,%ymm6
 	vpmuludq	%ymm13,%ymm11,%ymm11
 	vmovdqu	288-8-128(%r13),%ymm9
-	vmovd	%eax,%xmm0
+	vmovd	%eax,%xmm0  // borrow ACC0 for Y2
 	imulq	-128(%r13),%rax
 	vpaddq	%ymm11,%ymm7,%ymm7
 	vpmuludq	%ymm13,%ymm10,%ymm10
@@ -430,14 +430,14 @@
 	vpaddq	%ymm14,%ymm1,%ymm1
 	vpmuludq	%ymm0,%ymm13,%ymm13
 	vpmuludq	%ymm12,%ymm11,%ymm11
-.byte	0xc4,0x41,0x7e,0x6f,0xb5,0xf0,0xff,0xff,0xff
+.byte	0xc4,0x41,0x7e,0x6f,0xb5,0xf0,0xff,0xff,0xff  // vmovdqu		32*4-16-128(%r13), %ymm14
 	vpaddq	%ymm1,%ymm13,%ymm13
 	vpaddq	%ymm11,%ymm2,%ymm2
 	vpmuludq	%ymm12,%ymm10,%ymm10
 	vmovdqu	160-16-128(%r13),%ymm11
 .byte	0x67
 	vmovq	%xmm13,%rax
-	vmovdqu	%ymm13,(%rsp)
+	vmovdqu	%ymm13,(%rsp)  // transfer %r9-%r12
 	vpaddq	%ymm10,%ymm3,%ymm3
 	vpmuludq	%ymm12,%ymm14,%ymm14
 	vmovdqu	192-16-128(%r13),%ymm10
@@ -454,7 +454,7 @@
 	addq	%r12,%rax
 	vpaddq	%ymm14,%ymm7,%ymm7
 	vpmuludq	%ymm12,%ymm11,%ymm11
-
+// vmovdqu	32*2-24-128(%r13), %ymm14	# moved below
 	movq	%rax,%r9
 	imull	%ecx,%eax
 	vpaddq	%ymm11,%ymm8,%ymm8
@@ -466,7 +466,7 @@
 	vpaddq	%ymm10,%ymm9,%ymm9
 	vpbroadcastq	%xmm12,%ymm12
 
-	vpmuludq	64-24-128(%r13),%ymm0,%ymm14
+	vpmuludq	64-24-128(%r13),%ymm0,%ymm14  // see above
 	vmovdqu	128-24-128(%r13),%ymm10
 	movq	%rax,%rdx
 	imulq	-128(%r13),%rax
@@ -489,7 +489,7 @@
 	vpaddq	%ymm10,%ymm4,%ymm3
 	vpmuludq	%ymm0,%ymm14,%ymm14
 	vmovdqu	224-24-128(%r13),%ymm10
-	imulq	24-128(%r13),%rdx
+	imulq	24-128(%r13),%rdx  // future %r12
 	addq	%rax,%r11
 	leaq	(%r9,%r10,1),%rax
 	vpaddq	%ymm14,%ymm5,%ymm4
@@ -512,7 +512,7 @@
 
 	decl	%r14d
 	jnz	.LOOP_REDUCE_1024
-	leaq	448(%rsp),%r12
+	leaq	448(%rsp),%r12  // size optimization
 	vpaddq	%ymm9,%ymm13,%ymm0
 	vpxor	%ymm9,%ymm9,%ymm9
 
@@ -655,7 +655,7 @@
 .cfi_restore	%rbp
 	movq	-8(%rax),%rbx
 .cfi_restore	%rbx
-	leaq	(%rax),%rsp
+	leaq	(%rax),%rsp  // restore %rsp
 .cfi_def_cfa_register	%rsp
 .Lsqr_1024_epilogue:
 	ret
@@ -685,14 +685,14 @@
 	movq	%rax,%rbp
 .cfi_def_cfa_register	%rbp
 	vzeroall
-	movq	%rdx,%r13
+	movq	%rdx,%r13  // reassigned argument
 	subq	$64,%rsp
 
-
-
-
-
-
+// unaligned 256-bit load that crosses page boundary can
+// cause severe performance degradation here, so if %rsi does
+// cross page boundary, swap it with %r13 meaning that caller
+// is advised to lay down %rsi and %r13 next to each other, so
+// that only one can cross page boundary.
 .byte	0x67,0x67
 	movq	%rsi,%r15
 	andq	$4095,%r15
@@ -703,20 +703,20 @@
 	cmovnzq	%r15,%r13
 
 	movq	%rcx,%r15
-	subq	$-128,%rsi
+	subq	$-128,%rsi  // size optimization
 	subq	$-128,%rcx
 	subq	$-128,%rdi
 
-	andq	$4095,%r15
+	andq	$4095,%r15  // see if %rcx crosses page
 	addq	$320,%r15
 .byte	0x67,0x67
 	shrq	$12,%r15
 	jz	.Lmul_1024_no_n_copy
 
-
-
-
-
+// unaligned 256-bit load that crosses page boundary can
+// cause severe performance degradation here, so if %rcx does
+// cross page boundary, copy it to stack and make sure stack
+// frame doesn't...
 	subq	$320,%rsp
 	vmovdqu	0-128(%rcx),%ymm0
 	andq	$-512,%rsp
@@ -747,13 +747,13 @@
 	vpxor	%ymm7,%ymm7,%ymm7
 	vmovdqu	%ymm8,256-128(%rcx)
 	vmovdqa	%ymm0,%ymm8
-	vmovdqu	%ymm9,288-128(%rcx)
+	vmovdqu	%ymm9,288-128(%rcx)  // %ymm9 is zero after vzeroall
 .Lmul_1024_no_n_copy:
 	andq	$-64,%rsp
 
 	movq	(%r13),%rbx
 	vpbroadcastq	(%r13),%ymm10
-	vmovdqu	%ymm0,(%rsp)
+	vmovdqu	%ymm0,(%rsp)  // clear top of stack
 	xorq	%r9,%r9
 .byte	0x67
 	xorq	%r10,%r10
@@ -762,12 +762,12 @@
 
 	vmovdqu	.Land_mask(%rip),%ymm15
 	movl	$9,%r14d
-	vmovdqu	%ymm9,288-128(%rdi)
+	vmovdqu	%ymm9,288-128(%rdi)  // %ymm9 is zero after vzeroall
 	jmp	.Loop_mul_1024
 
 .align	32
 .Loop_mul_1024:
-	vpsrlq	$29,%ymm3,%ymm9
+	vpsrlq	$29,%ymm3,%ymm9  // correct %ymm3(*)
 	movq	%rbx,%rax
 	imulq	-128(%rsi),%rax
 	addq	%r9,%rax
@@ -793,7 +793,7 @@
 	vpbroadcastq	%xmm11,%ymm11
 	vpaddq	%ymm12,%ymm2,%ymm2
 	vpmuludq	96-128(%rsi),%ymm10,%ymm13
-	vpand	%ymm15,%ymm3,%ymm3
+	vpand	%ymm15,%ymm3,%ymm3  // correct %ymm3
 	vpaddq	%ymm13,%ymm3,%ymm3
 	vpmuludq	128-128(%rsi),%ymm10,%ymm0
 	vpaddq	%ymm0,%ymm4,%ymm4
@@ -802,7 +802,7 @@
 	vpmuludq	192-128(%rsi),%ymm10,%ymm13
 	vpaddq	%ymm13,%ymm6,%ymm6
 	vpmuludq	224-128(%rsi),%ymm10,%ymm0
-	vpermq	$0x93,%ymm9,%ymm9
+	vpermq	$0x93,%ymm9,%ymm9  // correct %ymm3
 	vpaddq	%ymm0,%ymm7,%ymm7
 	vpmuludq	256-128(%rsi),%ymm10,%ymm12
 	vpbroadcastq	8(%r13),%ymm10
@@ -836,10 +836,10 @@
 	vpmuludq	192-128(%rcx),%ymm11,%ymm12
 	vpaddq	%ymm12,%ymm6,%ymm6
 	vpmuludq	224-128(%rcx),%ymm11,%ymm13
-	vpblendd	$3,%ymm14,%ymm9,%ymm12
+	vpblendd	$3,%ymm14,%ymm9,%ymm12  // correct %ymm3
 	vpaddq	%ymm13,%ymm7,%ymm7
 	vpmuludq	256-128(%rcx),%ymm11,%ymm0
-	vpaddq	%ymm12,%ymm3,%ymm3
+	vpaddq	%ymm12,%ymm3,%ymm3  // correct %ymm3
 	vpaddq	%ymm0,%ymm8,%ymm8
 
 	movq	%rbx,%rax
@@ -852,9 +852,9 @@
 	vmovdqu	-8+64-128(%rsi),%ymm13
 
 	movq	%r10,%rax
-	vpblendd	$0xfc,%ymm14,%ymm9,%ymm9
+	vpblendd	$0xfc,%ymm14,%ymm9,%ymm9  // correct %ymm3
 	imull	%r8d,%eax
-	vpaddq	%ymm9,%ymm4,%ymm4
+	vpaddq	%ymm9,%ymm4,%ymm4  // correct %ymm3
 	andl	$0x1fffffff,%eax
 
 	imulq	16-128(%rsi),%rbx
@@ -1042,7 +1042,7 @@
 	vpmuludq	%ymm10,%ymm13,%ymm13
 	vpbroadcastq	32(%r13),%ymm10
 	vpaddq	%ymm13,%ymm9,%ymm9
-	addq	$32,%r13
+	addq	$32,%r13  // %r13++
 
 	vmovdqu	-24+32-128(%rcx),%ymm0
 	imulq	-128(%rcx),%rax
@@ -1053,9 +1053,9 @@
 	vpmuludq	%ymm11,%ymm0,%ymm0
 	vmovq	%xmm10,%rbx
 	vmovdqu	-24+96-128(%rcx),%ymm13
-	vpaddq	%ymm0,%ymm1,%ymm0
+	vpaddq	%ymm0,%ymm1,%ymm0  // %ymm0==%ymm0
 	vpmuludq	%ymm11,%ymm12,%ymm12
-	vmovdqu	%ymm0,(%rsp)
+	vmovdqu	%ymm0,(%rsp)  // transfer %r9-%r12
 	vpaddq	%ymm12,%ymm2,%ymm1
 	vmovdqu	-24+128-128(%rcx),%ymm0
 	vpmuludq	%ymm11,%ymm13,%ymm13
@@ -1212,7 +1212,7 @@
 .cfi_restore	%rbp
 	movq	-8(%rax),%rbx
 .cfi_restore	%rbx
-	leaq	(%rax),%rsp
+	leaq	(%rax),%rsp  // restore %rsp
 .cfi_def_cfa_register	%rsp
 .Lmul_1024_epilogue:
 	ret
@@ -1225,7 +1225,7 @@
 rsaz_1024_red2norm_avx2:
 .cfi_startproc	
 _CET_ENDBR
-	subq	$-128,%rsi
+	subq	$-128,%rsi  // size optimization
 	xorq	%rax,%rax
 	movq	-128(%rsi),%r8
 	movq	-120(%rsi),%r9
@@ -1238,7 +1238,7 @@
 	addq	%r8,%rax
 	addq	%r9,%rax
 	addq	%r10,%rax
-	adcq	$0,%r11
+	adcq	$0,%r11  // consume eventual carry
 	movq	%rax,0(%rdi)
 	movq	%r11,%rax
 	movq	-104(%rsi),%r8
@@ -1249,7 +1249,7 @@
 	shrq	$12,%r10
 	addq	%r8,%rax
 	addq	%r9,%rax
-	adcq	$0,%r10
+	adcq	$0,%r10  // consume eventual carry
 	movq	%rax,8(%rdi)
 	movq	%r10,%rax
 	movq	-88(%rsi),%r11
@@ -1260,7 +1260,7 @@
 	shrq	$18,%r9
 	addq	%r11,%rax
 	addq	%r8,%rax
-	adcq	$0,%r9
+	adcq	$0,%r9  // consume eventual carry
 	movq	%rax,16(%rdi)
 	movq	%r9,%rax
 	movq	-72(%rsi),%r10
@@ -1271,7 +1271,7 @@
 	shrq	$24,%r8
 	addq	%r10,%rax
 	addq	%r11,%rax
-	adcq	$0,%r8
+	adcq	$0,%r8  // consume eventual carry
 	movq	%rax,24(%rdi)
 	movq	%r8,%rax
 	movq	-56(%rsi),%r9
@@ -1285,7 +1285,7 @@
 	addq	%r9,%rax
 	addq	%r10,%rax
 	addq	%r11,%rax
-	adcq	$0,%r8
+	adcq	$0,%r8  // consume eventual carry
 	movq	%rax,32(%rdi)
 	movq	%r8,%rax
 	movq	-32(%rsi),%r9
@@ -1296,7 +1296,7 @@
 	shrq	$7,%r11
 	addq	%r9,%rax
 	addq	%r10,%rax
-	adcq	$0,%r11
+	adcq	$0,%r11  // consume eventual carry
 	movq	%rax,40(%rdi)
 	movq	%r11,%rax
 	movq	-16(%rsi),%r8
@@ -1307,7 +1307,7 @@
 	shrq	$13,%r10
 	addq	%r8,%rax
 	addq	%r9,%rax
-	adcq	$0,%r10
+	adcq	$0,%r10  // consume eventual carry
 	movq	%rax,48(%rdi)
 	movq	%r10,%rax
 	movq	0(%rsi),%r11
@@ -1318,7 +1318,7 @@
 	shrq	$19,%r9
 	addq	%r11,%rax
 	addq	%r8,%rax
-	adcq	$0,%r9
+	adcq	$0,%r9  // consume eventual carry
 	movq	%rax,56(%rdi)
 	movq	%r9,%rax
 	movq	16(%rsi),%r10
@@ -1329,7 +1329,7 @@
 	shrq	$25,%r8
 	addq	%r10,%rax
 	addq	%r11,%rax
-	adcq	$0,%r8
+	adcq	$0,%r8  // consume eventual carry
 	movq	%rax,64(%rdi)
 	movq	%r8,%rax
 	movq	32(%rsi),%r9
@@ -1343,7 +1343,7 @@
 	addq	%r9,%rax
 	addq	%r10,%rax
 	addq	%r11,%rax
-	adcq	$0,%r8
+	adcq	$0,%r8  // consume eventual carry
 	movq	%rax,72(%rdi)
 	movq	%r8,%rax
 	movq	56(%rsi),%r9
@@ -1354,7 +1354,7 @@
 	shrq	$8,%r11
 	addq	%r9,%rax
 	addq	%r10,%rax
-	adcq	$0,%r11
+	adcq	$0,%r11  // consume eventual carry
 	movq	%rax,80(%rdi)
 	movq	%r11,%rax
 	movq	72(%rsi),%r8
@@ -1365,7 +1365,7 @@
 	shrq	$14,%r10
 	addq	%r8,%rax
 	addq	%r9,%rax
-	adcq	$0,%r10
+	adcq	$0,%r10  // consume eventual carry
 	movq	%rax,88(%rdi)
 	movq	%r10,%rax
 	movq	88(%rsi),%r11
@@ -1376,7 +1376,7 @@
 	shrq	$20,%r9
 	addq	%r11,%rax
 	addq	%r8,%rax
-	adcq	$0,%r9
+	adcq	$0,%r9  // consume eventual carry
 	movq	%rax,96(%rdi)
 	movq	%r9,%rax
 	movq	104(%rsi),%r10
@@ -1387,7 +1387,7 @@
 	shrq	$26,%r8
 	addq	%r10,%rax
 	addq	%r11,%rax
-	adcq	$0,%r8
+	adcq	$0,%r8  // consume eventual carry
 	movq	%rax,104(%rdi)
 	movq	%r8,%rax
 	movq	120(%rsi),%r9
@@ -1401,7 +1401,7 @@
 	addq	%r9,%rax
 	addq	%r10,%rax
 	addq	%r11,%rax
-	adcq	$0,%r8
+	adcq	$0,%r8  // consume eventual carry
 	movq	%rax,112(%rdi)
 	movq	%r8,%rax
 	movq	144(%rsi),%r9
@@ -1412,7 +1412,7 @@
 	shrq	$9,%r11
 	addq	%r9,%rax
 	addq	%r10,%rax
-	adcq	$0,%r11
+	adcq	$0,%r11  // consume eventual carry
 	movq	%rax,120(%rdi)
 	movq	%r11,%rax
 	ret
@@ -1426,17 +1426,17 @@
 rsaz_1024_norm2red_avx2:
 .cfi_startproc	
 _CET_ENDBR
-	subq	$-128,%rdi
+	subq	$-128,%rdi  // size optimization
 	movq	(%rsi),%r8
 	movl	$0x1fffffff,%eax
 	movq	8(%rsi),%r9
 	movq	%r8,%r11
 	shrq	$0,%r11
-	andq	%rax,%r11
+	andq	%rax,%r11  // &0x1fffffff
 	movq	%r11,-128(%rdi)
 	movq	%r8,%r10
 	shrq	$29,%r10
-	andq	%rax,%r10
+	andq	%rax,%r10  // &0x1fffffff
 	movq	%r10,-120(%rdi)
 	shrdq	$58,%r9,%r8
 	andq	%rax,%r8
@@ -1444,7 +1444,7 @@
 	movq	16(%rsi),%r10
 	movq	%r9,%r8
 	shrq	$23,%r8
-	andq	%rax,%r8
+	andq	%rax,%r8  // &0x1fffffff
 	movq	%r8,-104(%rdi)
 	shrdq	$52,%r10,%r9
 	andq	%rax,%r9
@@ -1452,7 +1452,7 @@
 	movq	24(%rsi),%r11
 	movq	%r10,%r9
 	shrq	$17,%r9
-	andq	%rax,%r9
+	andq	%rax,%r9  // &0x1fffffff
 	movq	%r9,-88(%rdi)
 	shrdq	$46,%r11,%r10
 	andq	%rax,%r10
@@ -1460,7 +1460,7 @@
 	movq	32(%rsi),%r8
 	movq	%r11,%r10
 	shrq	$11,%r10
-	andq	%rax,%r10
+	andq	%rax,%r10  // &0x1fffffff
 	movq	%r10,-72(%rdi)
 	shrdq	$40,%r8,%r11
 	andq	%rax,%r11
@@ -1468,11 +1468,11 @@
 	movq	40(%rsi),%r9
 	movq	%r8,%r11
 	shrq	$5,%r11
-	andq	%rax,%r11
+	andq	%rax,%r11  // &0x1fffffff
 	movq	%r11,-56(%rdi)
 	movq	%r8,%r10
 	shrq	$34,%r10
-	andq	%rax,%r10
+	andq	%rax,%r10  // &0x1fffffff
 	movq	%r10,-48(%rdi)
 	shrdq	$63,%r9,%r8
 	andq	%rax,%r8
@@ -1480,7 +1480,7 @@
 	movq	48(%rsi),%r10
 	movq	%r9,%r8
 	shrq	$28,%r8
-	andq	%rax,%r8
+	andq	%rax,%r8  // &0x1fffffff
 	movq	%r8,-32(%rdi)
 	shrdq	$57,%r10,%r9
 	andq	%rax,%r9
@@ -1488,7 +1488,7 @@
 	movq	56(%rsi),%r11
 	movq	%r10,%r9
 	shrq	$22,%r9
-	andq	%rax,%r9
+	andq	%rax,%r9  // &0x1fffffff
 	movq	%r9,-16(%rdi)
 	shrdq	$51,%r11,%r10
 	andq	%rax,%r10
@@ -1496,7 +1496,7 @@
 	movq	64(%rsi),%r8
 	movq	%r11,%r10
 	shrq	$16,%r10
-	andq	%rax,%r10
+	andq	%rax,%r10  // &0x1fffffff
 	movq	%r10,0(%rdi)
 	shrdq	$45,%r8,%r11
 	andq	%rax,%r11
@@ -1504,7 +1504,7 @@
 	movq	72(%rsi),%r9
 	movq	%r8,%r11
 	shrq	$10,%r11
-	andq	%rax,%r11
+	andq	%rax,%r11  // &0x1fffffff
 	movq	%r11,16(%rdi)
 	shrdq	$39,%r9,%r8
 	andq	%rax,%r8
@@ -1512,11 +1512,11 @@
 	movq	80(%rsi),%r10
 	movq	%r9,%r8
 	shrq	$4,%r8
-	andq	%rax,%r8
+	andq	%rax,%r8  // &0x1fffffff
 	movq	%r8,32(%rdi)
 	movq	%r9,%r11
 	shrq	$33,%r11
-	andq	%rax,%r11
+	andq	%rax,%r11  // &0x1fffffff
 	movq	%r11,40(%rdi)
 	shrdq	$62,%r10,%r9
 	andq	%rax,%r9
@@ -1524,7 +1524,7 @@
 	movq	88(%rsi),%r11
 	movq	%r10,%r9
 	shrq	$27,%r9
-	andq	%rax,%r9
+	andq	%rax,%r9  // &0x1fffffff
 	movq	%r9,56(%rdi)
 	shrdq	$56,%r11,%r10
 	andq	%rax,%r10
@@ -1532,7 +1532,7 @@
 	movq	96(%rsi),%r8
 	movq	%r11,%r10
 	shrq	$21,%r10
-	andq	%rax,%r10
+	andq	%rax,%r10  // &0x1fffffff
 	movq	%r10,72(%rdi)
 	shrdq	$50,%r8,%r11
 	andq	%rax,%r11
@@ -1540,7 +1540,7 @@
 	movq	104(%rsi),%r9
 	movq	%r8,%r11
 	shrq	$15,%r11
-	andq	%rax,%r11
+	andq	%rax,%r11  // &0x1fffffff
 	movq	%r11,88(%rdi)
 	shrdq	$44,%r9,%r8
 	andq	%rax,%r8
@@ -1548,7 +1548,7 @@
 	movq	112(%rsi),%r10
 	movq	%r9,%r8
 	shrq	$9,%r8
-	andq	%rax,%r8
+	andq	%rax,%r8  // &0x1fffffff
 	movq	%r8,104(%rdi)
 	shrdq	$38,%r10,%r9
 	andq	%rax,%r9
@@ -1556,11 +1556,11 @@
 	movq	120(%rsi),%r11
 	movq	%r10,%r9
 	shrq	$3,%r9
-	andq	%rax,%r9
+	andq	%rax,%r9  // &0x1fffffff
 	movq	%r9,120(%rdi)
 	movq	%r10,%r8
 	shrq	$32,%r8
-	andq	%rax,%r8
+	andq	%rax,%r8  // &0x1fffffff
 	movq	%r8,128(%rdi)
 	shrdq	$61,%r11,%r10
 	andq	%rax,%r10
@@ -1568,12 +1568,12 @@
 	xorq	%r8,%r8
 	movq	%r11,%r10
 	shrq	$26,%r10
-	andq	%rax,%r10
+	andq	%rax,%r10  // &0x1fffffff
 	movq	%r10,144(%rdi)
 	shrdq	$55,%r8,%r11
 	andq	%rax,%r11
 	movq	%r11,152(%rdi)
-	movq	%r8,160(%rdi)
+	movq	%r8,160(%rdi)  // zero
 	movq	%r8,168(%rdi)
 	movq	%r8,176(%rdi)
 	movq	%r8,184(%rdi)
@@ -1622,7 +1622,7 @@
 	leaq	-256(%rsp),%rsp
 	andq	$-32,%rsp
 	leaq	.Linc(%rip),%r10
-	leaq	-128(%rsp),%rax
+	leaq	-128(%rsp),%rax  // control u-op density
 
 	vmovd	%edx,%xmm4
 	vmovdqa	(%r10),%ymm0
@@ -1669,7 +1669,7 @@
 	vpcmpeqd	%ymm4,%ymm14,%ymm14
 	vpcmpeqd	%ymm4,%ymm15,%ymm15
 
-	vmovdqa	-32(%r10),%ymm7
+	vmovdqa	-32(%r10),%ymm7  // .Lgather_permd
 	leaq	128(%rsi),%rsi
 	movl	$9,%edx
 
@@ -1715,7 +1715,7 @@
 	vpor	%ymm3,%ymm5,%ymm5
 
 	vpor	%ymm5,%ymm4,%ymm4
-	vextracti128	$1,%ymm4,%xmm5
+	vextracti128	$1,%ymm4,%xmm5  // upper half is cleared
 	vpor	%xmm4,%xmm5,%xmm5
 	vpermd	%ymm5,%ymm7,%ymm5
 	vmovdqu	%ymm5,(%rdi)

boringssl-0.20260708.tar.xz/gen/bcm/rsaz-avx2-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/rsaz-avx2-win.asm Changed

@@ -28,7 +28,7 @@
 	mov	rcx,r9
 	mov	r8,QWORD40+rsp
 
-
+; 702 cycles, 14% faster than rsaz_1024_mul_avx2
 
 _CET_ENDBR
 	lea	rax,rsp
@@ -60,23 +60,23 @@
 $L$sqr_1024_body:
 	mov	rbp,rax
 
-	mov	r13,rdx
+	mov	r13,rdx  ; reassigned argument
 	sub	rsp,832
 	mov	r15,r13
-	sub	rdi,-128
+	sub	rdi,-128  ; size optimization
 	sub	rsi,-128
 	sub	r13,-128
 
-	and	r15,4095
+	and	r15,4095  ; see if %r13 crosses page
 	add	r15,32*10
 	shr	r15,12
 	vpxor	ymm9,ymm9,ymm9
 	jz	NEAR $L$sqr_1024_no_n_copy
 
-
-
-
-
+; unaligned 256-bit load that crosses page boundary can
+; cause >2x performance degradation here, so if %r13 does
+; cross page boundary, copy it to stack and make sure stack
+; frame doesn't...
 	sub	rsp,32*10
 	vmovdqu	ymm0,YMMWORD((0-128))+r13
 	and	rsp,-2048
@@ -98,7 +98,7 @@
 	vmovdqu	YMMWORD(192-128)+r13,ymm6
 	vmovdqu	YMMWORD(224-128)+r13,ymm7
 	vmovdqu	YMMWORD(256-128)+r13,ymm8
-	vmovdqu	YMMWORD(288-128)+r13,ymm9
+	vmovdqu	YMMWORD(288-128)+r13,ymm9  ; %ymm9 is zero
 
 $L$sqr_1024_no_n_copy:
 	and	rsp,-1024
@@ -112,18 +112,18 @@
 	vmovdqu	ymm7,YMMWORD((224-128))+rsi
 	vmovdqu	ymm8,YMMWORD((256-128))+rsi
 
-	lea	rbx,192+rsp
+	lea	rbx,192+rsp  ; 64+128=192
 	vmovdqu	ymm15,YMMWORD$L$and_mask
 	jmp	NEAR $L$OOP_GRANDE_SQR_1024
 
 ALIGN	32
 $L$OOP_GRANDE_SQR_1024:
-	lea	r9,((576+128))+rsp
-	lea	r12,448+rsp
-
-
-
+	lea	r9,((576+128))+rsp  ; size optimization
+	lea	r12,448+rsp  ; 64+128+256=448
 
+; the squaring is performed as described in Variant B of
+; "Speeding up Big-Number Squaring", so start by calculating
+; the A*2=A+A vector
 	vpaddq	ymm1,ymm1,ymm1
 	vpbroadcastq	ymm10,QWORD((0-128))+rsi
 	vpaddq	ymm2,ymm2,ymm2
@@ -145,7 +145,7 @@
 
 	vpmuludq	ymm0,ymm10,YMMWORD((0-128))+rsi
 	vpbroadcastq	ymm11,QWORD((32-128))+rsi
-	vmovdqu	YMMWORD(288-192)+rbx,ymm9
+	vmovdqu	YMMWORD(288-192)+rbx,ymm9  ; zero upper half
 	vpmuludq	ymm1,ymm1,ymm10
 	vmovdqu	YMMWORD(320-448)+r12,ymm9
 	vpmuludq	ymm2,ymm2,ymm10
@@ -282,10 +282,10 @@
 	vpmuludq	ymm12,ymm10,YMMWORD((192-128))+rsi
 	vpaddq	ymm3,ymm3,ymm12
 	vpmuludq	ymm14,ymm10,YMMWORD((192-128))+r9
-	vpbroadcastq	ymm0,QWORD((256-128))+r15
+	vpbroadcastq	ymm0,QWORD((256-128))+r15  ; borrow %ymm0 for %ymm10
 	vpaddq	ymm4,ymm4,ymm14
 	vpmuludq	ymm5,ymm10,YMMWORD((224-128))+r9
-	vpbroadcastq	ymm10,QWORD((0+8-128))+r15
+	vpbroadcastq	ymm10,QWORD((0+8-128))+r15  ; for next iteration
 	vpaddq	ymm5,ymm5,YMMWORD((448-448))+r12
 
 	vmovdqu	YMMWORD(384-448)+r12,ymm3
@@ -306,11 +306,11 @@
 
 	dec	r14d
 	jnz	NEAR $L$OOP_SQR_1024
-
-	vmovdqu	ymm8,YMMWORD256+rsp
-	vmovdqu	ymm1,YMMWORD288+rsp
-	vmovdqu	ymm2,YMMWORD320+rsp
-	lea	rbx,192+rsp
+; we need to fix indices 32-39 to avoid overflow
+	vmovdqu	ymm8,YMMWORD256+rsp  ; 32*8-192(%rbx),
+	vmovdqu	ymm1,YMMWORD288+rsp  ; 32*9-192(%rbx)
+	vmovdqu	ymm2,YMMWORD320+rsp  ; 32*10-192(%rbx)
+	lea	rbx,192+rsp  ; 64+128=192
 
 	vpsrlq	ymm14,ymm8,29
 	vpand	ymm8,ymm8,ymm15
@@ -406,17 +406,17 @@
 	vpaddq	ymm7,ymm7,ymm10
 	vpmuludq	ymm14,ymm12,YMMWORD((256-128))+r13
 	vmovd	xmm12,eax
-
+; vmovdqu	32*1-8-128(%r13), %ymm11		# moved below
 	vpaddq	ymm8,ymm8,ymm14
-
+; vmovdqu	32*2-8-128(%r13), %ymm10		# moved below
 	vpbroadcastq	ymm12,xmm12
 
-	vpmuludq	ymm11,ymm13,YMMWORD((32-8-128))+r13
+	vpmuludq	ymm11,ymm13,YMMWORD((32-8-128))+r13  ; see above
 	vmovdqu	ymm14,YMMWORD((96-8-128))+r13
 	mov	rdx,rax
 	imul	rax,QWORD((-128))+r13
 	vpaddq	ymm1,ymm1,ymm11
-	vpmuludq	ymm10,ymm13,YMMWORD((64-8-128))+r13
+	vpmuludq	ymm10,ymm13,YMMWORD((64-8-128))+r13  ; see above
 	vmovdqu	ymm11,YMMWORD((128-8-128))+r13
 	add	r11,rax
 	mov	rax,rdx
@@ -435,7 +435,7 @@
 	imul	eax,ecx
 	vpaddq	ymm4,ymm4,ymm11
 	vpmuludq	ymm10,ymm10,ymm13
-	DB	0xc4,0x41,0x7e,0x6f,0x9d,0x58,0x00,0x00,0x00
+	DB	0xc4,0x41,0x7e,0x6f,0x9d,0x58,0x00,0x00,0x00  ; vmovdqu		32*7-8-128(%r13), %ymm11
 	and	eax,0x1fffffff
 	vpaddq	ymm5,ymm5,ymm10
 	vpmuludq	ymm14,ymm14,ymm13
@@ -443,7 +443,7 @@
 	vpaddq	ymm6,ymm6,ymm14
 	vpmuludq	ymm11,ymm11,ymm13
 	vmovdqu	ymm9,YMMWORD((288-8-128))+r13
-	vmovd	xmm0,eax
+	vmovd	xmm0,eax  ; borrow ACC0 for Y2
 	imul	rax,QWORD((-128))+r13
 	vpaddq	ymm7,ymm7,ymm11
 	vpmuludq	ymm10,ymm10,ymm13
@@ -460,14 +460,14 @@
 	vpaddq	ymm1,ymm1,ymm14
 	vpmuludq	ymm13,ymm13,ymm0
 	vpmuludq	ymm11,ymm11,ymm12
-	DB	0xc4,0x41,0x7e,0x6f,0xb5,0xf0,0xff,0xff,0xff
+	DB	0xc4,0x41,0x7e,0x6f,0xb5,0xf0,0xff,0xff,0xff  ; vmovdqu		32*4-16-128(%r13), %ymm14
 	vpaddq	ymm13,ymm13,ymm1
 	vpaddq	ymm2,ymm2,ymm11
 	vpmuludq	ymm10,ymm10,ymm12
 	vmovdqu	ymm11,YMMWORD((160-16-128))+r13
 	DB	0x67
 	vmovq	rax,xmm13
-	vmovdqu	YMMWORDrsp,ymm13
+	vmovdqu	YMMWORDrsp,ymm13  ; transfer %r9-%r12
 	vpaddq	ymm3,ymm3,ymm10
 	vpmuludq	ymm14,ymm14,ymm12
 	vmovdqu	ymm10,YMMWORD((192-16-128))+r13
@@ -484,7 +484,7 @@
 	add	rax,r12
 	vpaddq	ymm7,ymm7,ymm14
 	vpmuludq	ymm11,ymm11,ymm12
-
+; vmovdqu	32*2-24-128(%r13), %ymm14	# moved below
 	mov	r9,rax
 	imul	eax,ecx
 	vpaddq	ymm8,ymm8,ymm11
@@ -496,7 +496,7 @@
 	vpaddq	ymm9,ymm9,ymm10
 	vpbroadcastq	ymm12,xmm12
 
-	vpmuludq	ymm14,ymm0,YMMWORD((64-24-128))+r13
+	vpmuludq	ymm14,ymm0,YMMWORD((64-24-128))+r13  ; see above
 	vmovdqu	ymm10,YMMWORD((128-24-128))+r13
 	mov	rdx,rax
 	imul	rax,QWORD((-128))+r13
@@ -519,7 +519,7 @@
 	vpaddq	ymm3,ymm4,ymm10
 	vpmuludq	ymm14,ymm14,ymm0
 	vmovdqu	ymm10,YMMWORD((224-24-128))+r13
-	imul	rdx,QWORD((24-128))+r13
+	imul	rdx,QWORD((24-128))+r13  ; future %r12
 	add	r11,rax
 	lea	rax,r10*1+r9
 	vpaddq	ymm4,ymm5,ymm14
@@ -542,7 +542,7 @@
 
 	dec	r14d
 	jnz	NEAR $L$OOP_REDUCE_1024
-	lea	r12,448+rsp
+	lea	r12,448+rsp  ; size optimization
 	vpaddq	ymm0,ymm13,ymm9
 	vpxor	ymm9,ymm9,ymm9
 
@@ -696,7 +696,7 @@
 
 	mov	rbx,QWORD((-8))+rax
 
-	lea	rsp,rax
+	lea	rsp,rax  ; restore %rsp
 
 $L$sqr_1024_epilogue:
 	mov	rdi,QWORD8+rsp	;WIN64 epilogue
@@ -751,14 +751,14 @@
 	mov	rbp,rax
 
 	vzeroall
-	mov	r13,rdx
+	mov	r13,rdx  ; reassigned argument
 	sub	rsp,64
 
-
-
-
-
-
+; unaligned 256-bit load that crosses page boundary can
+; cause severe performance degradation here, so if %rsi does
+; cross page boundary, swap it with %r13 meaning that caller
+; is advised to lay down %rsi and %r13 next to each other, so
+; that only one can cross page boundary.
 	DB	0x67,0x67
 	mov	r15,rsi
 	and	r15,4095
@@ -769,20 +769,20 @@
 	cmovnz	r13,r15
 
 	mov	r15,rcx
-	sub	rsi,-128
+	sub	rsi,-128  ; size optimization
 	sub	rcx,-128
 	sub	rdi,-128
 
-	and	r15,4095
+	and	r15,4095  ; see if %rcx crosses page
 	add	r15,32*10
 	DB	0x67,0x67
 	shr	r15,12
 	jz	NEAR $L$mul_1024_no_n_copy
 
-
-
-
-
+; unaligned 256-bit load that crosses page boundary can
+; cause severe performance degradation here, so if %rcx does
+; cross page boundary, copy it to stack and make sure stack
+; frame doesn't...
 	sub	rsp,32*10
 	vmovdqu	ymm0,YMMWORD((0-128))+rcx
 	and	rsp,-512
@@ -813,13 +813,13 @@
 	vpxor	ymm7,ymm7,ymm7
 	vmovdqu	YMMWORD(256-128)+rcx,ymm8
 	vmovdqa	ymm8,ymm0
-	vmovdqu	YMMWORD(288-128)+rcx,ymm9
+	vmovdqu	YMMWORD(288-128)+rcx,ymm9  ; %ymm9 is zero after vzeroall
 $L$mul_1024_no_n_copy:
 	and	rsp,-64
 
 	mov	rbx,QWORDr13
 	vpbroadcastq	ymm10,QWORDr13
-	vmovdqu	YMMWORDrsp,ymm0
+	vmovdqu	YMMWORDrsp,ymm0  ; clear top of stack
 	xor	r9,r9
 	DB	0x67
 	xor	r10,r10
@@ -828,12 +828,12 @@
 
 	vmovdqu	ymm15,YMMWORD$L$and_mask
 	mov	r14d,9
-	vmovdqu	YMMWORD(288-128)+rdi,ymm9
+	vmovdqu	YMMWORD(288-128)+rdi,ymm9  ; %ymm9 is zero after vzeroall
 	jmp	NEAR $L$oop_mul_1024
 
 ALIGN	32
 $L$oop_mul_1024:
-	vpsrlq	ymm9,ymm3,29
+	vpsrlq	ymm9,ymm3,29  ; correct %ymm3(*)
 	mov	rax,rbx
 	imul	rax,QWORD((-128))+rsi
 	add	rax,r9
@@ -859,7 +859,7 @@
 	vpbroadcastq	ymm11,xmm11
 	vpaddq	ymm2,ymm2,ymm12
 	vpmuludq	ymm13,ymm10,YMMWORD((96-128))+rsi
-	vpand	ymm3,ymm3,ymm15
+	vpand	ymm3,ymm3,ymm15  ; correct %ymm3
 	vpaddq	ymm3,ymm3,ymm13
 	vpmuludq	ymm0,ymm10,YMMWORD((128-128))+rsi
 	vpaddq	ymm4,ymm4,ymm0
@@ -868,7 +868,7 @@
 	vpmuludq	ymm13,ymm10,YMMWORD((192-128))+rsi
 	vpaddq	ymm6,ymm6,ymm13
 	vpmuludq	ymm0,ymm10,YMMWORD((224-128))+rsi
-	vpermq	ymm9,ymm9,0x93
+	vpermq	ymm9,ymm9,0x93  ; correct %ymm3
 	vpaddq	ymm7,ymm7,ymm0
 	vpmuludq	ymm12,ymm10,YMMWORD((256-128))+rsi
 	vpbroadcastq	ymm10,QWORD8+r13
@@ -902,10 +902,10 @@
 	vpmuludq	ymm12,ymm11,YMMWORD((192-128))+rcx
 	vpaddq	ymm6,ymm6,ymm12
 	vpmuludq	ymm13,ymm11,YMMWORD((224-128))+rcx
-	vpblendd	ymm12,ymm9,ymm14,3
+	vpblendd	ymm12,ymm9,ymm14,3  ; correct %ymm3
 	vpaddq	ymm7,ymm7,ymm13
 	vpmuludq	ymm0,ymm11,YMMWORD((256-128))+rcx
-	vpaddq	ymm3,ymm3,ymm12
+	vpaddq	ymm3,ymm3,ymm12  ; correct %ymm3
 	vpaddq	ymm8,ymm8,ymm0
 
 	mov	rax,rbx
@@ -918,9 +918,9 @@
 	vmovdqu	ymm13,YMMWORD((-8+64-128))+rsi
 
 	mov	rax,r10
-	vpblendd	ymm9,ymm9,ymm14,0xfc
+	vpblendd	ymm9,ymm9,ymm14,0xfc  ; correct %ymm3
 	imul	eax,r8d
-	vpaddq	ymm4,ymm4,ymm9
+	vpaddq	ymm4,ymm4,ymm9  ; correct %ymm3
 	and	eax,0x1fffffff
 
 	imul	rbx,QWORD((16-128))+rsi
@@ -1108,7 +1108,7 @@
 	vpmuludq	ymm13,ymm13,ymm10
 	vpbroadcastq	ymm10,QWORD32+r13
 	vpaddq	ymm9,ymm9,ymm13
-	add	r13,32
+	add	r13,32  ; %r13++
 
 	vmovdqu	ymm0,YMMWORD((-24+32-128))+rcx
 	imul	rax,QWORD((-128))+rcx
@@ -1119,9 +1119,9 @@
 	vpmuludq	ymm0,ymm0,ymm11
 	vmovq	rbx,xmm10
 	vmovdqu	ymm13,YMMWORD((-24+96-128))+rcx
-	vpaddq	ymm0,ymm1,ymm0
+	vpaddq	ymm0,ymm1,ymm0  ; %ymm0==%ymm0
 	vpmuludq	ymm12,ymm12,ymm11
-	vmovdqu	YMMWORDrsp,ymm0
+	vmovdqu	YMMWORDrsp,ymm0  ; transfer %r9-%r12
 	vpaddq	ymm1,ymm2,ymm12
 	vmovdqu	ymm0,YMMWORD((-24+128-128))+rcx
 	vpmuludq	ymm13,ymm13,ymm11
@@ -1289,7 +1289,7 @@
 
 	mov	rbx,QWORD((-8))+rax
 
-	lea	rsp,rax
+	lea	rsp,rax  ; restore %rsp
 
 $L$mul_1024_epilogue:
 	mov	rdi,QWORD8+rsp	;WIN64 epilogue
@@ -1303,7 +1303,7 @@
 rsaz_1024_red2norm_avx2:
 
 _CET_ENDBR
-	sub	rdx,-128
+	sub	rdx,-128  ; size optimization
 	xor	rax,rax
 	mov	r8,QWORD((-128))+rdx
 	mov	r9,QWORD((-120))+rdx
@@ -1316,7 +1316,7 @@
 	add	rax,r8
 	add	rax,r9
 	add	rax,r10
-	adc	r11,0
+	adc	r11,0  ; consume eventual carry
 	mov	QWORDrcx,rax
 	mov	rax,r11
 	mov	r8,QWORD((-104))+rdx
@@ -1327,7 +1327,7 @@
 	shr	r10,12
 	add	rax,r8
 	add	rax,r9
-	adc	r10,0
+	adc	r10,0  ; consume eventual carry
 	mov	QWORD8+rcx,rax
 	mov	rax,r10
 	mov	r11,QWORD((-88))+rdx
@@ -1338,7 +1338,7 @@
 	shr	r9,18
 	add	rax,r11
 	add	rax,r8
-	adc	r9,0
+	adc	r9,0  ; consume eventual carry
 	mov	QWORD16+rcx,rax
 	mov	rax,r9
 	mov	r10,QWORD((-72))+rdx
@@ -1349,7 +1349,7 @@
 	shr	r8,24
 	add	rax,r10
 	add	rax,r11
-	adc	r8,0
+	adc	r8,0  ; consume eventual carry
 	mov	QWORD24+rcx,rax
 	mov	rax,r8
 	mov	r9,QWORD((-56))+rdx
@@ -1363,7 +1363,7 @@
 	add	rax,r9
 	add	rax,r10
 	add	rax,r11
-	adc	r8,0
+	adc	r8,0  ; consume eventual carry
 	mov	QWORD32+rcx,rax
 	mov	rax,r8
 	mov	r9,QWORD((-32))+rdx
@@ -1374,7 +1374,7 @@
 	shr	r11,7
 	add	rax,r9
 	add	rax,r10
-	adc	r11,0
+	adc	r11,0  ; consume eventual carry
 	mov	QWORD40+rcx,rax
 	mov	rax,r11
 	mov	r8,QWORD((-16))+rdx
@@ -1385,7 +1385,7 @@
 	shr	r10,13
 	add	rax,r8
 	add	rax,r9
-	adc	r10,0
+	adc	r10,0  ; consume eventual carry
 	mov	QWORD48+rcx,rax
 	mov	rax,r10
 	mov	r11,QWORDrdx
@@ -1396,7 +1396,7 @@
 	shr	r9,19
 	add	rax,r11
 	add	rax,r8
-	adc	r9,0
+	adc	r9,0  ; consume eventual carry
 	mov	QWORD56+rcx,rax
 	mov	rax,r9
 	mov	r10,QWORD16+rdx
@@ -1407,7 +1407,7 @@
 	shr	r8,25
 	add	rax,r10
 	add	rax,r11
-	adc	r8,0
+	adc	r8,0  ; consume eventual carry
 	mov	QWORD64+rcx,rax
 	mov	rax,r8
 	mov	r9,QWORD32+rdx
@@ -1421,7 +1421,7 @@
 	add	rax,r9
 	add	rax,r10
 	add	rax,r11
-	adc	r8,0
+	adc	r8,0  ; consume eventual carry
 	mov	QWORD72+rcx,rax
 	mov	rax,r8
 	mov	r9,QWORD56+rdx
@@ -1432,7 +1432,7 @@
 	shr	r11,8
 	add	rax,r9
 	add	rax,r10
-	adc	r11,0
+	adc	r11,0  ; consume eventual carry
 	mov	QWORD80+rcx,rax
 	mov	rax,r11
 	mov	r8,QWORD72+rdx
@@ -1443,7 +1443,7 @@
 	shr	r10,14
 	add	rax,r8
 	add	rax,r9
-	adc	r10,0
+	adc	r10,0  ; consume eventual carry
 	mov	QWORD88+rcx,rax
 	mov	rax,r10
 	mov	r11,QWORD88+rdx
@@ -1454,7 +1454,7 @@
 	shr	r9,20
 	add	rax,r11
 	add	rax,r8
-	adc	r9,0
+	adc	r9,0  ; consume eventual carry
 	mov	QWORD96+rcx,rax
 	mov	rax,r9
 	mov	r10,QWORD104+rdx
@@ -1465,7 +1465,7 @@
 	shr	r8,26
 	add	rax,r10
 	add	rax,r11
-	adc	r8,0
+	adc	r8,0  ; consume eventual carry
 	mov	QWORD104+rcx,rax
 	mov	rax,r8
 	mov	r9,QWORD120+rdx
@@ -1479,7 +1479,7 @@
 	add	rax,r9
 	add	rax,r10
 	add	rax,r11
-	adc	r8,0
+	adc	r8,0  ; consume eventual carry
 	mov	QWORD112+rcx,rax
 	mov	rax,r8
 	mov	r9,QWORD144+rdx
@@ -1490,7 +1490,7 @@
 	shr	r11,9
 	add	rax,r9
 	add	rax,r10
-	adc	r11,0
+	adc	r11,0  ; consume eventual carry
 	mov	QWORD120+rcx,rax
 	mov	rax,r11
 	ret
@@ -1503,17 +1503,17 @@
 rsaz_1024_norm2red_avx2:
 
 _CET_ENDBR
-	sub	rcx,-128
+	sub	rcx,-128  ; size optimization
 	mov	r8,QWORDrdx
 	mov	eax,0x1fffffff
 	mov	r9,QWORD8+rdx
 	mov	r11,r8
 	shr	r11,0
-	and	r11,rax
+	and	r11,rax  ; &0x1fffffff
 	mov	QWORD((-128))+rcx,r11
 	mov	r10,r8
 	shr	r10,29
-	and	r10,rax
+	and	r10,rax  ; &0x1fffffff
 	mov	QWORD((-120))+rcx,r10
 	shrd	r8,r9,58
 	and	r8,rax
@@ -1521,7 +1521,7 @@
 	mov	r10,QWORD16+rdx
 	mov	r8,r9
 	shr	r8,23
-	and	r8,rax
+	and	r8,rax  ; &0x1fffffff
 	mov	QWORD((-104))+rcx,r8
 	shrd	r9,r10,52
 	and	r9,rax
@@ -1529,7 +1529,7 @@
 	mov	r11,QWORD24+rdx
 	mov	r9,r10
 	shr	r9,17
-	and	r9,rax
+	and	r9,rax  ; &0x1fffffff
 	mov	QWORD((-88))+rcx,r9
 	shrd	r10,r11,46
 	and	r10,rax
@@ -1537,7 +1537,7 @@
 	mov	r8,QWORD32+rdx
 	mov	r10,r11
 	shr	r10,11
-	and	r10,rax
+	and	r10,rax  ; &0x1fffffff
 	mov	QWORD((-72))+rcx,r10
 	shrd	r11,r8,40
 	and	r11,rax
@@ -1545,11 +1545,11 @@
 	mov	r9,QWORD40+rdx
 	mov	r11,r8
 	shr	r11,5
-	and	r11,rax
+	and	r11,rax  ; &0x1fffffff
 	mov	QWORD((-56))+rcx,r11
 	mov	r10,r8
 	shr	r10,34
-	and	r10,rax
+	and	r10,rax  ; &0x1fffffff
 	mov	QWORD((-48))+rcx,r10
 	shrd	r8,r9,63
 	and	r8,rax
@@ -1557,7 +1557,7 @@
 	mov	r10,QWORD48+rdx
 	mov	r8,r9
 	shr	r8,28
-	and	r8,rax
+	and	r8,rax  ; &0x1fffffff
 	mov	QWORD((-32))+rcx,r8
 	shrd	r9,r10,57
 	and	r9,rax
@@ -1565,7 +1565,7 @@
 	mov	r11,QWORD56+rdx
 	mov	r9,r10
 	shr	r9,22
-	and	r9,rax
+	and	r9,rax  ; &0x1fffffff
 	mov	QWORD((-16))+rcx,r9
 	shrd	r10,r11,51
 	and	r10,rax
@@ -1573,7 +1573,7 @@
 	mov	r8,QWORD64+rdx
 	mov	r10,r11
 	shr	r10,16
-	and	r10,rax
+	and	r10,rax  ; &0x1fffffff
 	mov	QWORDrcx,r10
 	shrd	r11,r8,45
 	and	r11,rax
@@ -1581,7 +1581,7 @@
 	mov	r9,QWORD72+rdx
 	mov	r11,r8
 	shr	r11,10
-	and	r11,rax
+	and	r11,rax  ; &0x1fffffff
 	mov	QWORD16+rcx,r11
 	shrd	r8,r9,39
 	and	r8,rax
@@ -1589,11 +1589,11 @@
 	mov	r10,QWORD80+rdx
 	mov	r8,r9
 	shr	r8,4
-	and	r8,rax
+	and	r8,rax  ; &0x1fffffff
 	mov	QWORD32+rcx,r8
 	mov	r11,r9
 	shr	r11,33
-	and	r11,rax
+	and	r11,rax  ; &0x1fffffff
 	mov	QWORD40+rcx,r11
 	shrd	r9,r10,62
 	and	r9,rax
@@ -1601,7 +1601,7 @@
 	mov	r11,QWORD88+rdx
 	mov	r9,r10
 	shr	r9,27
-	and	r9,rax
+	and	r9,rax  ; &0x1fffffff
 	mov	QWORD56+rcx,r9
 	shrd	r10,r11,56
 	and	r10,rax
@@ -1609,7 +1609,7 @@
 	mov	r8,QWORD96+rdx
 	mov	r10,r11
 	shr	r10,21
-	and	r10,rax
+	and	r10,rax  ; &0x1fffffff
 	mov	QWORD72+rcx,r10
 	shrd	r11,r8,50
 	and	r11,rax
@@ -1617,7 +1617,7 @@
 	mov	r9,QWORD104+rdx
 	mov	r11,r8
 	shr	r11,15
-	and	r11,rax
+	and	r11,rax  ; &0x1fffffff
 	mov	QWORD88+rcx,r11
 	shrd	r8,r9,44
 	and	r8,rax
@@ -1625,7 +1625,7 @@
 	mov	r10,QWORD112+rdx
 	mov	r8,r9
 	shr	r8,9
-	and	r8,rax
+	and	r8,rax  ; &0x1fffffff
 	mov	QWORD104+rcx,r8
 	shrd	r9,r10,38
 	and	r9,rax
@@ -1633,11 +1633,11 @@
 	mov	r11,QWORD120+rdx
 	mov	r9,r10
 	shr	r9,3
-	and	r9,rax
+	and	r9,rax  ; &0x1fffffff
 	mov	QWORD120+rcx,r9
 	mov	r8,r10
 	shr	r8,32
-	and	r8,rax
+	and	r8,rax  ; &0x1fffffff
 	mov	QWORD128+rcx,r8
 	shrd	r10,r11,61
 	and	r10,rax
@@ -1645,12 +1645,12 @@
 	xor	r8,r8
 	mov	r10,r11
 	shr	r10,26
-	and	r10,rax
+	and	r10,rax  ; &0x1fffffff
 	mov	QWORD144+rcx,r10
 	shrd	r11,r8,55
 	and	r11,rax
 	mov	QWORD152+rcx,r11
-	mov	QWORD160+rcx,r8
+	mov	QWORD160+rcx,r8  ; zero
 	mov	QWORD168+rcx,r8
 	mov	QWORD176+rcx,r8
 	mov	QWORD184+rcx,r8
@@ -1696,22 +1696,22 @@
 
 	lea	rax,((-136))+rsp
 $L$SEH_begin_rsaz_1024_gather5:
-
-	DB	0x48,0x8d,0x60,0xe0
-	DB	0xc5,0xf8,0x29,0x70,0xe0
-	DB	0xc5,0xf8,0x29,0x78,0xf0
-	DB	0xc5,0x78,0x29,0x40,0x00
-	DB	0xc5,0x78,0x29,0x48,0x10
-	DB	0xc5,0x78,0x29,0x50,0x20
-	DB	0xc5,0x78,0x29,0x58,0x30
-	DB	0xc5,0x78,0x29,0x60,0x40
-	DB	0xc5,0x78,0x29,0x68,0x50
-	DB	0xc5,0x78,0x29,0x70,0x60
-	DB	0xc5,0x78,0x29,0x78,0x70
+; I can't trust assembler to use specific encoding:-(
+	DB	0x48,0x8d,0x60,0xe0  ; lea	-0x20(%rax),%rsp
+	DB	0xc5,0xf8,0x29,0x70,0xe0  ; vmovaps %xmm6,-0x20(%rax)
+	DB	0xc5,0xf8,0x29,0x78,0xf0  ; vmovaps %xmm7,-0x10(%rax)
+	DB	0xc5,0x78,0x29,0x40,0x00  ; vmovaps %xmm8,0(%rax)
+	DB	0xc5,0x78,0x29,0x48,0x10  ; vmovaps %xmm9,0x10(%rax)
+	DB	0xc5,0x78,0x29,0x50,0x20  ; vmovaps %xmm10,0x20(%rax)
+	DB	0xc5,0x78,0x29,0x58,0x30  ; vmovaps %xmm11,0x30(%rax)
+	DB	0xc5,0x78,0x29,0x60,0x40  ; vmovaps %xmm12,0x40(%rax)
+	DB	0xc5,0x78,0x29,0x68,0x50  ; vmovaps %xmm13,0x50(%rax)
+	DB	0xc5,0x78,0x29,0x70,0x60  ; vmovaps %xmm14,0x60(%rax)
+	DB	0xc5,0x78,0x29,0x78,0x70  ; vmovaps %xmm15,0x70(%rax)
 	lea	rsp,((-256))+rsp
 	and	rsp,-32
 	lea	r10,$L$inc
-	lea	rax,((-128))+rsp
+	lea	rax,((-128))+rsp  ; control u-op density
 
 	vmovd	xmm4,r8d
 	vmovdqa	ymm0,YMMWORDr10
@@ -1758,7 +1758,7 @@
 	vpcmpeqd	ymm14,ymm14,ymm4
 	vpcmpeqd	ymm15,ymm15,ymm4
 
-	vmovdqa	ymm7,YMMWORD((-32))+r10
+	vmovdqa	ymm7,YMMWORD((-32))+r10  ; .Lgather_permd
 	lea	rdx,128+rdx
 	mov	r8d,9
 
@@ -1804,7 +1804,7 @@
 	vpor	ymm5,ymm5,ymm3
 
 	vpor	ymm4,ymm4,ymm5
-	vextracti128	xmm5,ymm4,1
+	vextracti128	xmm5,ymm4,1  ; upper half is cleared
 	vpor	xmm5,xmm5,xmm4
 	vpermd	ymm5,ymm7,ymm5
 	vmovdqu	YMMWORDrcx,ymm5
@@ -1846,7 +1846,7 @@
 	DD	2,2,2,2,3,3,3,3
 	DD	4,4,4,4,4,4,4,4
 ALIGN	64
-section	.text
+section	.text code align=64
 
 EXTERN	__imp_RtlVirtualUnwind
 
@@ -1863,27 +1863,27 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; prologue label
+	cmp	rbx,r10  ; context->Rip<prologue label
 	jb	NEAR $L$common_seh_tail
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$common_seh_tail
 
-	mov	rbp,QWORD160+r8
+	mov	rbp,QWORD160+r8  ; pull context->Rbp
 
-	mov	r10d,DWORD8+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD8+r11  ; HandlerData2
+	lea	r10,r10*1+rsi  ; "in tail" label
+	cmp	rbx,r10  ; context->Rip>="in tail" label
 	cmovc	rax,rbp
 
 	mov	r15,QWORD((-48))+rax
@@ -1899,38 +1899,38 @@
 	mov	QWORD160+r8,rbp
 	mov	QWORD144+r8,rbx
 
-	lea	rsi,((-216))+rax
-	lea	rdi,512+r8
-	mov	ecx,20
-	DD	0xa548f3fc
+	lea	rsi,((-216))+rax  ; %xmm save area
+	lea	rdi,512+r8  ; & context.Xmm6
+	mov	ecx,20  ; 10*sizeof(%xmm0)/sizeof(%rax)
+	DD	0xa548f3fc  ; cld; rep movsq
 
 $L$common_seh_tail:
 	mov	rdi,QWORD8+rax
 	mov	rsi,QWORD16+rax
-	mov	QWORD152+r8,rax
-	mov	QWORD168+r8,rsi
-	mov	QWORD176+r8,rdi
+	mov	QWORD152+r8,rax  ; restore context->Rsp
+	mov	QWORD168+r8,rsi  ; restore context->Rsi
+	mov	QWORD176+r8,rdi  ; restore context->Rdi
 
-	mov	rdi,QWORD40+r9
-	mov	rsi,r8
-	mov	ecx,154
-	DD	0xa548f3fc
+	mov	rdi,QWORD40+r9  ; disp->ContextRecord
+	mov	rsi,r8  ; context
+	mov	ecx,154  ; sizeof(CONTEXT)
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	mov	rsi,r9
-	xor	rcx,rcx
-	mov	rdx,QWORD8+rsi
-	mov	r8,QWORDrsi
-	mov	r9,QWORD16+rsi
-	mov	r10,QWORD40+rsi
-	lea	r11,56+rsi
-	lea	r12,24+rsi
-	mov	QWORD32+rsp,r10
-	mov	QWORD40+rsp,r11
-	mov	QWORD48+rsp,r12
-	mov	QWORD56+rsp,rcx
+	xor	rcx,rcx  ; arg1, UNW_FLAG_NHANDLER
+	mov	rdx,QWORD8+rsi  ; arg2, disp->ImageBase
+	mov	r8,QWORDrsi  ; arg3, disp->ControlPc
+	mov	r9,QWORD16+rsi  ; arg4, disp->FunctionEntry
+	mov	r10,QWORD40+rsi  ; disp->ContextRecord
+	lea	r11,56+rsi  ; &disp->HandlerData
+	lea	r12,24+rsi  ; &disp->EstablisherFrame
+	mov	QWORD32+rsp,r10  ; arg5
+	mov	QWORD40+rsp,r11  ; arg6
+	mov	QWORD48+rsp,r12  ; arg7
+	mov	QWORD56+rsp,rcx  ; arg8, (NULL)
 	call	QWORD__imp_RtlVirtualUnwind
 
-	mov	eax,1
+	mov	eax,1  ; ExceptionContinueSearch
 	add	rsp,64
 	popfq
 	pop	r15
@@ -1971,18 +1971,18 @@
 	DD	0
 $L$SEH_info_rsaz_1024_gather5:
 	DB	0x01,0x36,0x17,0x0b
-	DB	0x36,0xf8,0x09,0x00
-	DB	0x31,0xe8,0x08,0x00
-	DB	0x2c,0xd8,0x07,0x00
-	DB	0x27,0xc8,0x06,0x00
-	DB	0x22,0xb8,0x05,0x00
-	DB	0x1d,0xa8,0x04,0x00
-	DB	0x18,0x98,0x03,0x00
-	DB	0x13,0x88,0x02,0x00
-	DB	0x0e,0x78,0x01,0x00
-	DB	0x09,0x68,0x00,0x00
-	DB	0x04,0x01,0x15,0x00
-	DB	0x00,0xb3,0x00,0x00
+	DB	0x36,0xf8,0x09,0x00  ; vmovaps 0x90(rsp),xmm15
+	DB	0x31,0xe8,0x08,0x00  ; vmovaps 0x80(rsp),xmm14
+	DB	0x2c,0xd8,0x07,0x00  ; vmovaps 0x70(rsp),xmm13
+	DB	0x27,0xc8,0x06,0x00  ; vmovaps 0x60(rsp),xmm12
+	DB	0x22,0xb8,0x05,0x00  ; vmovaps 0x50(rsp),xmm11
+	DB	0x1d,0xa8,0x04,0x00  ; vmovaps 0x40(rsp),xmm10
+	DB	0x18,0x98,0x03,0x00  ; vmovaps 0x30(rsp),xmm9
+	DB	0x13,0x88,0x02,0x00  ; vmovaps 0x20(rsp),xmm8
+	DB	0x0e,0x78,0x01,0x00  ; vmovaps 0x10(rsp),xmm7
+	DB	0x09,0x68,0x00,0x00  ; vmovaps 0x00(rsp),xmm6
+	DB	0x04,0x01,0x15,0x00  ; sub	  rsp,0xa8
+	DB	0x00,0xb3,0x00,0x00  ; set_frame r11
 %else
 ; Work around https://bugzilla.nasm.us/show_bug.cgi?id=3392738
 ret

boringssl-0.20260708.tar.xz/gen/bcm/sha1-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/sha1-x86_64-apple.S Changed

@@ -25,11 +25,11 @@
 
 	pushq	%r14
 
-	movq	%rdi,%r8
+	movq	%rdi,%r8  // reassigned argument
 	subq	$72,%rsp
-	movq	%rsi,%r9
+	movq	%rsi,%r9  // reassigned argument
 	andq	$-64,%rsp
-	movq	%rdx,%r10
+	movq	%rdx,%r10  // reassigned argument
 	movq	%rax,64(%rsp)
 
 L$prologue:
@@ -1253,32 +1253,32 @@
 _CET_ENDBR
 	movdqu	(%rdi),%xmm0
 	movd	16(%rdi),%xmm1
-	movdqa	K_XX_XX+160(%rip),%xmm3
+	movdqa	K_XX_XX+160(%rip),%xmm3  // byte-n-word swap
 
 	movdqu	(%rsi),%xmm4
-	pshufd	$27,%xmm0,%xmm0
+	pshufd	$27,%xmm0,%xmm0  // flip word order
 	movdqu	16(%rsi),%xmm5
-	pshufd	$27,%xmm1,%xmm1
+	pshufd	$27,%xmm1,%xmm1  // flip word order
 	movdqu	32(%rsi),%xmm6
 	pshufb	%xmm3,%xmm4
 	movdqu	48(%rsi),%xmm7
 	pshufb	%xmm3,%xmm5
 	pshufb	%xmm3,%xmm6
-	movdqa	%xmm1,%xmm9
+	movdqa	%xmm1,%xmm9  // offload %xmm1
 	pshufb	%xmm3,%xmm7
 	jmp	L$oop_shaext
 
 .p2align	4
 L$oop_shaext:
 	decq	%rdx
-	leaq	64(%rsi),%r8
+	leaq	64(%rsi),%r8  // next input block
 	paddd	%xmm4,%xmm1
 	cmovneq	%r8,%rsi
 	prefetcht0	512(%rsi)
-	movdqa	%xmm0,%xmm8
+	movdqa	%xmm0,%xmm8  // offload %xmm0
 	sha1msg1	%xmm5,%xmm4
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$0,%xmm1,%xmm0
+	sha1rnds4	$0,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm5,%xmm2
 	pxor	%xmm6,%xmm4
 	sha1msg1	%xmm6,%xmm5
@@ -1291,7 +1291,7 @@
 	sha1msg2	%xmm4,%xmm5
 	sha1msg1	%xmm7,%xmm6
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$0,%xmm1,%xmm0
+	sha1rnds4	$0,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm7,%xmm2
 	pxor	%xmm4,%xmm6
 	sha1msg1	%xmm4,%xmm7
@@ -1304,7 +1304,7 @@
 	sha1msg2	%xmm6,%xmm7
 	sha1msg1	%xmm5,%xmm4
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$0,%xmm1,%xmm0
+	sha1rnds4	$0,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm5,%xmm2
 	pxor	%xmm6,%xmm4
 	sha1msg1	%xmm6,%xmm5
@@ -1317,7 +1317,7 @@
 	sha1msg2	%xmm4,%xmm5
 	sha1msg1	%xmm7,%xmm6
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$1,%xmm1,%xmm0
+	sha1rnds4	$1,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm7,%xmm2
 	pxor	%xmm4,%xmm6
 	sha1msg1	%xmm4,%xmm7
@@ -1330,7 +1330,7 @@
 	sha1msg2	%xmm6,%xmm7
 	sha1msg1	%xmm5,%xmm4
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$1,%xmm1,%xmm0
+	sha1rnds4	$1,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm5,%xmm2
 	pxor	%xmm6,%xmm4
 	sha1msg1	%xmm6,%xmm5
@@ -1343,7 +1343,7 @@
 	sha1msg2	%xmm4,%xmm5
 	sha1msg1	%xmm7,%xmm6
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$2,%xmm1,%xmm0
+	sha1rnds4	$2,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm7,%xmm2
 	pxor	%xmm4,%xmm6
 	sha1msg1	%xmm4,%xmm7
@@ -1356,7 +1356,7 @@
 	sha1msg2	%xmm6,%xmm7
 	sha1msg1	%xmm5,%xmm4
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$2,%xmm1,%xmm0
+	sha1rnds4	$2,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm5,%xmm2
 	pxor	%xmm6,%xmm4
 	sha1msg1	%xmm6,%xmm5
@@ -1369,7 +1369,7 @@
 	sha1msg2	%xmm4,%xmm5
 	sha1msg1	%xmm7,%xmm6
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$2,%xmm1,%xmm0
+	sha1rnds4	$2,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm7,%xmm2
 	pxor	%xmm4,%xmm6
 	sha1msg1	%xmm4,%xmm7
@@ -1382,30 +1382,30 @@
 	sha1msg2	%xmm6,%xmm7
 	movdqu	(%rsi),%xmm4
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$3,%xmm1,%xmm0
+	sha1rnds4	$3,%xmm1,%xmm0  // 64-67
 	sha1nexte	%xmm5,%xmm2
 	movdqu	16(%rsi),%xmm5
 	pshufb	%xmm3,%xmm4
 
 	movdqa	%xmm0,%xmm1
-	sha1rnds4	$3,%xmm2,%xmm0
+	sha1rnds4	$3,%xmm2,%xmm0  // 68-71
 	sha1nexte	%xmm6,%xmm1
 	movdqu	32(%rsi),%xmm6
 	pshufb	%xmm3,%xmm5
 
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$3,%xmm1,%xmm0
+	sha1rnds4	$3,%xmm1,%xmm0  // 72-75
 	sha1nexte	%xmm7,%xmm2
 	movdqu	48(%rsi),%xmm7
 	pshufb	%xmm3,%xmm6
 
 	movdqa	%xmm0,%xmm1
-	sha1rnds4	$3,%xmm2,%xmm0
+	sha1rnds4	$3,%xmm2,%xmm0  // 76-79
 	sha1nexte	%xmm9,%xmm1
 	pshufb	%xmm3,%xmm7
 
 	paddd	%xmm8,%xmm0
-	movdqa	%xmm1,%xmm9
+	movdqa	%xmm1,%xmm9  // offload %xmm1
 
 	jnz	L$oop_shaext
 
@@ -1424,7 +1424,7 @@
 _sha1_block_data_order_ssse3:
 
 _CET_ENDBR
-	movq	%rsp,%r11
+	movq	%rsp,%r11  // frame pointer
 
 	pushq	%rbx
 
@@ -1432,46 +1432,46 @@
 
 	pushq	%r12
 
-	pushq	%r13
+	pushq	%r13  // redundant, done to share Win64 SE handler
 
 	pushq	%r14
 
 	leaq	-64(%rsp),%rsp
 	andq	$-64,%rsp
-	movq	%rdi,%r8
-	movq	%rsi,%r9
-	movq	%rdx,%r10
+	movq	%rdi,%r8  // reassigned argument
+	movq	%rsi,%r9  // reassigned argument
+	movq	%rdx,%r10  // reassigned argument
 
 	shlq	$6,%r10
 	addq	%r9,%r10
 	leaq	K_XX_XX+64(%rip),%r14
 
-	movl	0(%r8),%eax
+	movl	0(%r8),%eax  // load context
 	movl	4(%r8),%ebx
 	movl	8(%r8),%ecx
 	movl	12(%r8),%edx
-	movl	%ebx,%esi
+	movl	%ebx,%esi  // magic seed
 	movl	16(%r8),%ebp
 	movl	%ecx,%edi
 	xorl	%edx,%edi
 	andl	%edi,%esi
 
-	movdqa	64(%r14),%xmm6
-	movdqa	-64(%r14),%xmm9
-	movdqu	0(%r9),%xmm0
+	movdqa	64(%r14),%xmm6  // pbswap mask
+	movdqa	-64(%r14),%xmm9  // K_00_19
+	movdqu	0(%r9),%xmm0  // load input to %xmm0-3
 	movdqu	16(%r9),%xmm1
 	movdqu	32(%r9),%xmm2
 	movdqu	48(%r9),%xmm3
-	pshufb	%xmm6,%xmm0
+	pshufb	%xmm6,%xmm0  // byte swap
 	pshufb	%xmm6,%xmm1
 	pshufb	%xmm6,%xmm2
 	addq	$64,%r9
-	paddd	%xmm9,%xmm0
+	paddd	%xmm9,%xmm0  // add K_00_19
 	pshufb	%xmm6,%xmm3
 	paddd	%xmm9,%xmm1
 	paddd	%xmm9,%xmm2
-	movdqa	%xmm0,0(%rsp)
-	psubd	%xmm9,%xmm0
+	movdqa	%xmm0,0(%rsp)  // X+K xfer to IALU
+	psubd	%xmm9,%xmm0  // restore X
 	movdqa	%xmm1,16(%rsp)
 	psubd	%xmm9,%xmm1
 	movdqa	%xmm2,32(%rsp)
@@ -2468,14 +2468,14 @@
 	addl	%edi,%eax
 	rorl	$7,%ecx
 	addl	%ebx,%eax
-	addl	0(%r8),%eax
+	addl	0(%r8),%eax  // update context
 	addl	4(%r8),%esi
 	addl	8(%r8),%ecx
 	addl	12(%r8),%edx
 	movl	%eax,0(%r8)
 	addl	16(%r8),%ebp
 	movl	%esi,4(%r8)
-	movl	%esi,%ebx
+	movl	%esi,%ebx  // magic seed
 	movl	%ecx,8(%r8)
 	movl	%ecx,%edi
 	movl	%edx,12(%r8)
@@ -2581,7 +2581,7 @@
 	addl	%edi,%eax
 	rorl	$7,%ecx
 	addl	%ebx,%eax
-	addl	0(%r8),%eax
+	addl	0(%r8),%eax  // update context
 	addl	4(%r8),%esi
 	addl	8(%r8),%ecx
 	movl	%eax,0(%r8)
@@ -2623,46 +2623,46 @@
 
 	pushq	%r12
 
-	pushq	%r13
+	pushq	%r13  // redundant, done to share Win64 SE handler
 
 	pushq	%r14
 
 	leaq	-64(%rsp),%rsp
 	vzeroupper
 	andq	$-64,%rsp
-	movq	%rdi,%r8
-	movq	%rsi,%r9
-	movq	%rdx,%r10
+	movq	%rdi,%r8  // reassigned argument
+	movq	%rsi,%r9  // reassigned argument
+	movq	%rdx,%r10  // reassigned argument
 
 	shlq	$6,%r10
 	addq	%r9,%r10
 	leaq	K_XX_XX+64(%rip),%r14
 
-	movl	0(%r8),%eax
+	movl	0(%r8),%eax  // load context
 	movl	4(%r8),%ebx
 	movl	8(%r8),%ecx
 	movl	12(%r8),%edx
-	movl	%ebx,%esi
+	movl	%ebx,%esi  // magic seed
 	movl	16(%r8),%ebp
 	movl	%ecx,%edi
 	xorl	%edx,%edi
 	andl	%edi,%esi
 
-	vmovdqa	64(%r14),%xmm6
-	vmovdqa	-64(%r14),%xmm11
-	vmovdqu	0(%r9),%xmm0
+	vmovdqa	64(%r14),%xmm6  // pbswap mask
+	vmovdqa	-64(%r14),%xmm11  // K_00_19
+	vmovdqu	0(%r9),%xmm0  // load input to %xmm0-3
 	vmovdqu	16(%r9),%xmm1
 	vmovdqu	32(%r9),%xmm2
 	vmovdqu	48(%r9),%xmm3
-	vpshufb	%xmm6,%xmm0,%xmm0
+	vpshufb	%xmm6,%xmm0,%xmm0  // byte swap
 	addq	$64,%r9
 	vpshufb	%xmm6,%xmm1,%xmm1
 	vpshufb	%xmm6,%xmm2,%xmm2
 	vpshufb	%xmm6,%xmm3,%xmm3
-	vpaddd	%xmm11,%xmm0,%xmm4
+	vpaddd	%xmm11,%xmm0,%xmm4  // add K_00_19
 	vpaddd	%xmm11,%xmm1,%xmm5
 	vpaddd	%xmm11,%xmm2,%xmm6
-	vmovdqa	%xmm4,0(%rsp)
+	vmovdqa	%xmm4,0(%rsp)  // X+K xfer to IALU
 	vmovdqa	%xmm5,16(%rsp)
 	vmovdqa	%xmm6,32(%rsp)
 	jmp	L$oop_avx
@@ -3597,14 +3597,14 @@
 	addl	%edi,%eax
 	shrdl	$7,%ecx,%ecx
 	addl	%ebx,%eax
-	addl	0(%r8),%eax
+	addl	0(%r8),%eax  // update context
 	addl	4(%r8),%esi
 	addl	8(%r8),%ecx
 	addl	12(%r8),%edx
 	movl	%eax,0(%r8)
 	addl	16(%r8),%ebp
 	movl	%esi,4(%r8)
-	movl	%esi,%ebx
+	movl	%esi,%ebx  // magic seed
 	movl	%ecx,8(%r8)
 	movl	%ecx,%edi
 	movl	%edx,12(%r8)
@@ -3712,7 +3712,7 @@
 	addl	%ebx,%eax
 	vzeroupper
 
-	addl	0(%r8),%eax
+	addl	0(%r8),%eax  // update context
 	addl	4(%r8),%esi
 	addl	8(%r8),%ecx
 	movl	%eax,0(%r8)
@@ -3759,9 +3759,9 @@
 	pushq	%r14
 
 	vzeroupper
-	movq	%rdi,%r8
-	movq	%rsi,%r9
-	movq	%rdx,%r10
+	movq	%rdi,%r8  // reassigned argument
+	movq	%rsi,%r9  // reassigned argument
+	movq	%rdx,%r10  // reassigned argument
 
 	leaq	-640(%rsp),%rsp
 	shlq	$6,%r10
@@ -3770,14 +3770,14 @@
 	addq	%r9,%r10
 	leaq	K_XX_XX+64(%rip),%r14
 
-	movl	0(%r8),%eax
+	movl	0(%r8),%eax  // load context
 	cmpq	%r10,%r13
-	cmovaeq	%r9,%r13
+	cmovaeq	%r9,%r13  // next or same block
 	movl	4(%r8),%ebp
 	movl	8(%r8),%ecx
 	movl	12(%r8),%edx
 	movl	16(%r8),%esi
-	vmovdqu	64(%r14),%ymm6
+	vmovdqu	64(%r14),%ymm6  // pbswap mask
 
 	vmovdqu	(%r9),%xmm0
 	vmovdqu	16(%r9),%xmm1
@@ -3791,12 +3791,12 @@
 	vpshufb	%ymm6,%ymm1,%ymm1
 	vinserti128	$1,48(%r13),%ymm3,%ymm3
 	vpshufb	%ymm6,%ymm2,%ymm2
-	vmovdqu	-64(%r14),%ymm11
+	vmovdqu	-64(%r14),%ymm11  // K_00_19
 	vpshufb	%ymm6,%ymm3,%ymm3
 
-	vpaddd	%ymm11,%ymm0,%ymm4
+	vpaddd	%ymm11,%ymm0,%ymm4  // add K_00_19
 	vpaddd	%ymm11,%ymm1,%ymm5
-	vmovdqu	%ymm4,0(%rsp)
+	vmovdqu	%ymm4,0(%rsp)  // X+K xfer to IALU
 	vpaddd	%ymm11,%ymm2,%ymm6
 	vmovdqu	%ymm5,32(%rsp)
 	vpaddd	%ymm11,%ymm3,%ymm7
@@ -3871,7 +3871,7 @@
 	andnl	%edx,%ebp,%edi
 	andl	%ecx,%ebp
 	xorl	%edi,%ebp
-	jmp	L$align32_1
+	jmp	L$align32_1  // see "Decoded ICache" in manual
 .p2align	5
 L$align32_1:
 	vpalignr	$8,%ymm6,%ymm7,%ymm8
@@ -4250,7 +4250,7 @@
 	xorl	%esi,%ecx
 	addl	%r12d,%ebx
 	andl	%edi,%ecx
-	jmp	L$align32_2
+	jmp	L$align32_2  // see "Decoded ICache" in manual
 .p2align	5
 L$align32_2:
 	vpalignr	$8,%ymm6,%ymm7,%ymm8
@@ -4626,38 +4626,38 @@
 	rorxl	$27,%esi,%r12d
 	addl	%r12d,%edx
 	leaq	128(%r9),%r13
-	leaq	128(%r9),%rdi
+	leaq	128(%r9),%rdi  // borrow %edi
 	cmpq	%r10,%r13
-	cmovaeq	%r9,%r13
+	cmovaeq	%r9,%r13  // next or previous block
 
-
-	addl	0(%r8),%edx
+// output is d-e-a-f-b-c => A=d,F=e,C=f,D=b,E=c
+	addl	0(%r8),%edx  // update context
 	addl	4(%r8),%esi
 	addl	8(%r8),%ebp
 	movl	%edx,0(%r8)
 	addl	12(%r8),%ebx
 	movl	%esi,4(%r8)
-	movl	%edx,%eax
+	movl	%edx,%eax  // A=d
 	addl	16(%r8),%ecx
 	movl	%ebp,%r12d
 	movl	%ebp,8(%r8)
-	movl	%ebx,%edx
-
+	movl	%ebx,%edx  // D=b
+// xchg	%ecx,%ebp			# F=c, C=f
 	movl	%ebx,12(%r8)
-	movl	%esi,%ebp
+	movl	%esi,%ebp  // F=e
 	movl	%ecx,16(%r8)
-
-	movl	%ecx,%esi
-	movl	%r12d,%ecx
-
+// mov	%ebp,16(%r8)
+	movl	%ecx,%esi  // E=c
+	movl	%r12d,%ecx  // C=f
+// xchg	%ebp,%esi				# E=c, F=e
 
 	cmpq	%r10,%r9
 	je	L$done_avx2
-	vmovdqu	64(%r14),%ymm6
-	cmpq	%r10,%rdi
+	vmovdqu	64(%r14),%ymm6  // pbswap mask
+	cmpq	%r10,%rdi  // borrowed %edi
 	ja	L$ast_avx2
 
-	vmovdqu	-64(%rdi),%xmm0
+	vmovdqu	-64(%rdi),%xmm0  // low part of %ymm0
 	vmovdqu	-48(%rdi),%xmm1
 	vmovdqu	-32(%rdi),%xmm2
 	vmovdqu	-16(%rdi),%xmm3
@@ -5037,7 +5037,7 @@
 	xorl	%eax,%edx
 	addl	%r12d,%ecx
 	andl	%edi,%edx
-	jmp	L$align32_3
+	jmp	L$align32_3  // see "Decoded ICache" in manual
 .p2align	5
 L$align32_3:
 	vmovdqu	%ymm6,64(%rsp)
@@ -5392,26 +5392,26 @@
 	addl	%r12d,%edx
 	leaq	128(%rsp),%r13
 
-
-	addl	0(%r8),%edx
+// output is d-e-a-f-b-c => A=d,F=e,C=f,D=b,E=c
+	addl	0(%r8),%edx  // update context
 	addl	4(%r8),%esi
 	addl	8(%r8),%ebp
 	movl	%edx,0(%r8)
 	addl	12(%r8),%ebx
 	movl	%esi,4(%r8)
-	movl	%edx,%eax
+	movl	%edx,%eax  // A=d
 	addl	16(%r8),%ecx
 	movl	%ebp,%r12d
 	movl	%ebp,8(%r8)
-	movl	%ebx,%edx
-
+	movl	%ebx,%edx  // D=b
+// xchg	%ecx,%ebp			# F=c, C=f
 	movl	%ebx,12(%r8)
-	movl	%esi,%ebp
+	movl	%esi,%ebp  // F=e
 	movl	%ecx,16(%r8)
-
-	movl	%ecx,%esi
-	movl	%r12d,%ecx
-
+// mov	%ebp,16(%r8)
+	movl	%ecx,%esi  // E=c
+	movl	%r12d,%ecx  // C=f
+// xchg	%ebp,%esi				# E=c, F=e
 
 	cmpq	%r10,%r9
 	jbe	L$oop_avx2
@@ -5437,16 +5437,16 @@
 .section	__DATA,__const
 .p2align	6
 K_XX_XX:
-.long	0x5a827999,0x5a827999,0x5a827999,0x5a827999
-.long	0x5a827999,0x5a827999,0x5a827999,0x5a827999
-.long	0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1
-.long	0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1
-.long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc
-.long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc
-.long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6
-.long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6
-.long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f
-.long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f
+.long	0x5a827999,0x5a827999,0x5a827999,0x5a827999  // K_00_19
+.long	0x5a827999,0x5a827999,0x5a827999,0x5a827999  // K_00_19
+.long	0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1  // K_20_39
+.long	0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1  // K_20_39
+.long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc  // K_40_59
+.long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc  // K_40_59
+.long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6  // K_60_79
+.long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6  // K_60_79
+.long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f  // pbswap mask
+.long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f  // pbswap mask
 .byte	0xf,0xe,0xd,0xc,0xb,0xa,0x9,0x8,0x7,0x6,0x5,0x4,0x3,0x2,0x1,0x0
 .byte	83,72,65,49,32,98,108,111,99,107,32,116,114,97,110,115,102,111,114,109,32,102,111,114,32,120,56,54,95,54,52,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 .p2align	6

boringssl-0.20260708.tar.xz/gen/bcm/sha1-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/sha1-x86_64-linux.S Changed

@@ -25,11 +25,11 @@
 .cfi_offset	%r13,-40
 	pushq	%r14
 .cfi_offset	%r14,-48
-	movq	%rdi,%r8
+	movq	%rdi,%r8  // reassigned argument
 	subq	$72,%rsp
-	movq	%rsi,%r9
+	movq	%rsi,%r9  // reassigned argument
 	andq	$-64,%rsp
-	movq	%rdx,%r10
+	movq	%rdx,%r10  // reassigned argument
 	movq	%rax,64(%rsp)
 .cfi_escape	0x0f,0x06,0x77,0xc0,0x00,0x06,0x23,0x08
 .Lprologue:
@@ -1252,32 +1252,32 @@
 _CET_ENDBR
 	movdqu	(%rdi),%xmm0
 	movd	16(%rdi),%xmm1
-	movdqa	K_XX_XX+160(%rip),%xmm3
+	movdqa	K_XX_XX+160(%rip),%xmm3  // byte-n-word swap
 
 	movdqu	(%rsi),%xmm4
-	pshufd	$27,%xmm0,%xmm0
+	pshufd	$27,%xmm0,%xmm0  // flip word order
 	movdqu	16(%rsi),%xmm5
-	pshufd	$27,%xmm1,%xmm1
+	pshufd	$27,%xmm1,%xmm1  // flip word order
 	movdqu	32(%rsi),%xmm6
 	pshufb	%xmm3,%xmm4
 	movdqu	48(%rsi),%xmm7
 	pshufb	%xmm3,%xmm5
 	pshufb	%xmm3,%xmm6
-	movdqa	%xmm1,%xmm9
+	movdqa	%xmm1,%xmm9  // offload %xmm1
 	pshufb	%xmm3,%xmm7
 	jmp	.Loop_shaext
 
 .align	16
 .Loop_shaext:
 	decq	%rdx
-	leaq	64(%rsi),%r8
+	leaq	64(%rsi),%r8  // next input block
 	paddd	%xmm4,%xmm1
 	cmovneq	%r8,%rsi
 	prefetcht0	512(%rsi)
-	movdqa	%xmm0,%xmm8
+	movdqa	%xmm0,%xmm8  // offload %xmm0
 	sha1msg1	%xmm5,%xmm4
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$0,%xmm1,%xmm0
+	sha1rnds4	$0,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm5,%xmm2
 	pxor	%xmm6,%xmm4
 	sha1msg1	%xmm6,%xmm5
@@ -1290,7 +1290,7 @@
 	sha1msg2	%xmm4,%xmm5
 	sha1msg1	%xmm7,%xmm6
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$0,%xmm1,%xmm0
+	sha1rnds4	$0,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm7,%xmm2
 	pxor	%xmm4,%xmm6
 	sha1msg1	%xmm4,%xmm7
@@ -1303,7 +1303,7 @@
 	sha1msg2	%xmm6,%xmm7
 	sha1msg1	%xmm5,%xmm4
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$0,%xmm1,%xmm0
+	sha1rnds4	$0,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm5,%xmm2
 	pxor	%xmm6,%xmm4
 	sha1msg1	%xmm6,%xmm5
@@ -1316,7 +1316,7 @@
 	sha1msg2	%xmm4,%xmm5
 	sha1msg1	%xmm7,%xmm6
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$1,%xmm1,%xmm0
+	sha1rnds4	$1,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm7,%xmm2
 	pxor	%xmm4,%xmm6
 	sha1msg1	%xmm4,%xmm7
@@ -1329,7 +1329,7 @@
 	sha1msg2	%xmm6,%xmm7
 	sha1msg1	%xmm5,%xmm4
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$1,%xmm1,%xmm0
+	sha1rnds4	$1,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm5,%xmm2
 	pxor	%xmm6,%xmm4
 	sha1msg1	%xmm6,%xmm5
@@ -1342,7 +1342,7 @@
 	sha1msg2	%xmm4,%xmm5
 	sha1msg1	%xmm7,%xmm6
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$2,%xmm1,%xmm0
+	sha1rnds4	$2,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm7,%xmm2
 	pxor	%xmm4,%xmm6
 	sha1msg1	%xmm4,%xmm7
@@ -1355,7 +1355,7 @@
 	sha1msg2	%xmm6,%xmm7
 	sha1msg1	%xmm5,%xmm4
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$2,%xmm1,%xmm0
+	sha1rnds4	$2,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm5,%xmm2
 	pxor	%xmm6,%xmm4
 	sha1msg1	%xmm6,%xmm5
@@ -1368,7 +1368,7 @@
 	sha1msg2	%xmm4,%xmm5
 	sha1msg1	%xmm7,%xmm6
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$2,%xmm1,%xmm0
+	sha1rnds4	$2,%xmm1,%xmm0  // 0-3...
 	sha1nexte	%xmm7,%xmm2
 	pxor	%xmm4,%xmm6
 	sha1msg1	%xmm4,%xmm7
@@ -1381,30 +1381,30 @@
 	sha1msg2	%xmm6,%xmm7
 	movdqu	(%rsi),%xmm4
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$3,%xmm1,%xmm0
+	sha1rnds4	$3,%xmm1,%xmm0  // 64-67
 	sha1nexte	%xmm5,%xmm2
 	movdqu	16(%rsi),%xmm5
 	pshufb	%xmm3,%xmm4
 
 	movdqa	%xmm0,%xmm1
-	sha1rnds4	$3,%xmm2,%xmm0
+	sha1rnds4	$3,%xmm2,%xmm0  // 68-71
 	sha1nexte	%xmm6,%xmm1
 	movdqu	32(%rsi),%xmm6
 	pshufb	%xmm3,%xmm5
 
 	movdqa	%xmm0,%xmm2
-	sha1rnds4	$3,%xmm1,%xmm0
+	sha1rnds4	$3,%xmm1,%xmm0  // 72-75
 	sha1nexte	%xmm7,%xmm2
 	movdqu	48(%rsi),%xmm7
 	pshufb	%xmm3,%xmm6
 
 	movdqa	%xmm0,%xmm1
-	sha1rnds4	$3,%xmm2,%xmm0
+	sha1rnds4	$3,%xmm2,%xmm0  // 76-79
 	sha1nexte	%xmm9,%xmm1
 	pshufb	%xmm3,%xmm7
 
 	paddd	%xmm8,%xmm0
-	movdqa	%xmm1,%xmm9
+	movdqa	%xmm1,%xmm9  // offload %xmm1
 
 	jnz	.Loop_shaext
 
@@ -1422,7 +1422,7 @@
 sha1_block_data_order_ssse3:
 .cfi_startproc	
 _CET_ENDBR
-	movq	%rsp,%r11
+	movq	%rsp,%r11  // frame pointer
 .cfi_def_cfa_register	%r11
 	pushq	%rbx
 .cfi_offset	%rbx,-16
@@ -1430,46 +1430,46 @@
 .cfi_offset	%rbp,-24
 	pushq	%r12
 .cfi_offset	%r12,-32
-	pushq	%r13
+	pushq	%r13  // redundant, done to share Win64 SE handler
 .cfi_offset	%r13,-40
 	pushq	%r14
 .cfi_offset	%r14,-48
 	leaq	-64(%rsp),%rsp
 	andq	$-64,%rsp
-	movq	%rdi,%r8
-	movq	%rsi,%r9
-	movq	%rdx,%r10
+	movq	%rdi,%r8  // reassigned argument
+	movq	%rsi,%r9  // reassigned argument
+	movq	%rdx,%r10  // reassigned argument
 
 	shlq	$6,%r10
 	addq	%r9,%r10
 	leaq	K_XX_XX+64(%rip),%r14
 
-	movl	0(%r8),%eax
+	movl	0(%r8),%eax  // load context
 	movl	4(%r8),%ebx
 	movl	8(%r8),%ecx
 	movl	12(%r8),%edx
-	movl	%ebx,%esi
+	movl	%ebx,%esi  // magic seed
 	movl	16(%r8),%ebp
 	movl	%ecx,%edi
 	xorl	%edx,%edi
 	andl	%edi,%esi
 
-	movdqa	64(%r14),%xmm6
-	movdqa	-64(%r14),%xmm9
-	movdqu	0(%r9),%xmm0
+	movdqa	64(%r14),%xmm6  // pbswap mask
+	movdqa	-64(%r14),%xmm9  // K_00_19
+	movdqu	0(%r9),%xmm0  // load input to %xmm0-3
 	movdqu	16(%r9),%xmm1
 	movdqu	32(%r9),%xmm2
 	movdqu	48(%r9),%xmm3
-	pshufb	%xmm6,%xmm0
+	pshufb	%xmm6,%xmm0  // byte swap
 	pshufb	%xmm6,%xmm1
 	pshufb	%xmm6,%xmm2
 	addq	$64,%r9
-	paddd	%xmm9,%xmm0
+	paddd	%xmm9,%xmm0  // add K_00_19
 	pshufb	%xmm6,%xmm3
 	paddd	%xmm9,%xmm1
 	paddd	%xmm9,%xmm2
-	movdqa	%xmm0,0(%rsp)
-	psubd	%xmm9,%xmm0
+	movdqa	%xmm0,0(%rsp)  // X+K xfer to IALU
+	psubd	%xmm9,%xmm0  // restore X
 	movdqa	%xmm1,16(%rsp)
 	psubd	%xmm9,%xmm1
 	movdqa	%xmm2,32(%rsp)
@@ -2466,14 +2466,14 @@
 	addl	%edi,%eax
 	rorl	$7,%ecx
 	addl	%ebx,%eax
-	addl	0(%r8),%eax
+	addl	0(%r8),%eax  // update context
 	addl	4(%r8),%esi
 	addl	8(%r8),%ecx
 	addl	12(%r8),%edx
 	movl	%eax,0(%r8)
 	addl	16(%r8),%ebp
 	movl	%esi,4(%r8)
-	movl	%esi,%ebx
+	movl	%esi,%ebx  // magic seed
 	movl	%ecx,8(%r8)
 	movl	%ecx,%edi
 	movl	%edx,12(%r8)
@@ -2579,7 +2579,7 @@
 	addl	%edi,%eax
 	rorl	$7,%ecx
 	addl	%ebx,%eax
-	addl	0(%r8),%eax
+	addl	0(%r8),%eax  // update context
 	addl	4(%r8),%esi
 	addl	8(%r8),%ecx
 	movl	%eax,0(%r8)
@@ -2620,46 +2620,46 @@
 .cfi_offset	%rbp,-24
 	pushq	%r12
 .cfi_offset	%r12,-32
-	pushq	%r13
+	pushq	%r13  // redundant, done to share Win64 SE handler
 .cfi_offset	%r13,-40
 	pushq	%r14
 .cfi_offset	%r14,-48
 	leaq	-64(%rsp),%rsp
 	vzeroupper
 	andq	$-64,%rsp
-	movq	%rdi,%r8
-	movq	%rsi,%r9
-	movq	%rdx,%r10
+	movq	%rdi,%r8  // reassigned argument
+	movq	%rsi,%r9  // reassigned argument
+	movq	%rdx,%r10  // reassigned argument
 
 	shlq	$6,%r10
 	addq	%r9,%r10
 	leaq	K_XX_XX+64(%rip),%r14
 
-	movl	0(%r8),%eax
+	movl	0(%r8),%eax  // load context
 	movl	4(%r8),%ebx
 	movl	8(%r8),%ecx
 	movl	12(%r8),%edx
-	movl	%ebx,%esi
+	movl	%ebx,%esi  // magic seed
 	movl	16(%r8),%ebp
 	movl	%ecx,%edi
 	xorl	%edx,%edi
 	andl	%edi,%esi
 
-	vmovdqa	64(%r14),%xmm6
-	vmovdqa	-64(%r14),%xmm11
-	vmovdqu	0(%r9),%xmm0
+	vmovdqa	64(%r14),%xmm6  // pbswap mask
+	vmovdqa	-64(%r14),%xmm11  // K_00_19
+	vmovdqu	0(%r9),%xmm0  // load input to %xmm0-3
 	vmovdqu	16(%r9),%xmm1
 	vmovdqu	32(%r9),%xmm2
 	vmovdqu	48(%r9),%xmm3
-	vpshufb	%xmm6,%xmm0,%xmm0
+	vpshufb	%xmm6,%xmm0,%xmm0  // byte swap
 	addq	$64,%r9
 	vpshufb	%xmm6,%xmm1,%xmm1
 	vpshufb	%xmm6,%xmm2,%xmm2
 	vpshufb	%xmm6,%xmm3,%xmm3
-	vpaddd	%xmm11,%xmm0,%xmm4
+	vpaddd	%xmm11,%xmm0,%xmm4  // add K_00_19
 	vpaddd	%xmm11,%xmm1,%xmm5
 	vpaddd	%xmm11,%xmm2,%xmm6
-	vmovdqa	%xmm4,0(%rsp)
+	vmovdqa	%xmm4,0(%rsp)  // X+K xfer to IALU
 	vmovdqa	%xmm5,16(%rsp)
 	vmovdqa	%xmm6,32(%rsp)
 	jmp	.Loop_avx
@@ -3594,14 +3594,14 @@
 	addl	%edi,%eax
 	shrdl	$7,%ecx,%ecx
 	addl	%ebx,%eax
-	addl	0(%r8),%eax
+	addl	0(%r8),%eax  // update context
 	addl	4(%r8),%esi
 	addl	8(%r8),%ecx
 	addl	12(%r8),%edx
 	movl	%eax,0(%r8)
 	addl	16(%r8),%ebp
 	movl	%esi,4(%r8)
-	movl	%esi,%ebx
+	movl	%esi,%ebx  // magic seed
 	movl	%ecx,8(%r8)
 	movl	%ecx,%edi
 	movl	%edx,12(%r8)
@@ -3709,7 +3709,7 @@
 	addl	%ebx,%eax
 	vzeroupper
 
-	addl	0(%r8),%eax
+	addl	0(%r8),%eax  // update context
 	addl	4(%r8),%esi
 	addl	8(%r8),%ecx
 	movl	%eax,0(%r8)
@@ -3755,9 +3755,9 @@
 	pushq	%r14
 .cfi_offset	%r14,-48
 	vzeroupper
-	movq	%rdi,%r8
-	movq	%rsi,%r9
-	movq	%rdx,%r10
+	movq	%rdi,%r8  // reassigned argument
+	movq	%rsi,%r9  // reassigned argument
+	movq	%rdx,%r10  // reassigned argument
 
 	leaq	-640(%rsp),%rsp
 	shlq	$6,%r10
@@ -3766,14 +3766,14 @@
 	addq	%r9,%r10
 	leaq	K_XX_XX+64(%rip),%r14
 
-	movl	0(%r8),%eax
+	movl	0(%r8),%eax  // load context
 	cmpq	%r10,%r13
-	cmovaeq	%r9,%r13
+	cmovaeq	%r9,%r13  // next or same block
 	movl	4(%r8),%ebp
 	movl	8(%r8),%ecx
 	movl	12(%r8),%edx
 	movl	16(%r8),%esi
-	vmovdqu	64(%r14),%ymm6
+	vmovdqu	64(%r14),%ymm6  // pbswap mask
 
 	vmovdqu	(%r9),%xmm0
 	vmovdqu	16(%r9),%xmm1
@@ -3787,12 +3787,12 @@
 	vpshufb	%ymm6,%ymm1,%ymm1
 	vinserti128	$1,48(%r13),%ymm3,%ymm3
 	vpshufb	%ymm6,%ymm2,%ymm2
-	vmovdqu	-64(%r14),%ymm11
+	vmovdqu	-64(%r14),%ymm11  // K_00_19
 	vpshufb	%ymm6,%ymm3,%ymm3
 
-	vpaddd	%ymm11,%ymm0,%ymm4
+	vpaddd	%ymm11,%ymm0,%ymm4  // add K_00_19
 	vpaddd	%ymm11,%ymm1,%ymm5
-	vmovdqu	%ymm4,0(%rsp)
+	vmovdqu	%ymm4,0(%rsp)  // X+K xfer to IALU
 	vpaddd	%ymm11,%ymm2,%ymm6
 	vmovdqu	%ymm5,32(%rsp)
 	vpaddd	%ymm11,%ymm3,%ymm7
@@ -3867,7 +3867,7 @@
 	andnl	%edx,%ebp,%edi
 	andl	%ecx,%ebp
 	xorl	%edi,%ebp
-	jmp	.Lalign32_1
+	jmp	.Lalign32_1  // see "Decoded ICache" in manual
 .align	32
 .Lalign32_1:
 	vpalignr	$8,%ymm6,%ymm7,%ymm8
@@ -4246,7 +4246,7 @@
 	xorl	%esi,%ecx
 	addl	%r12d,%ebx
 	andl	%edi,%ecx
-	jmp	.Lalign32_2
+	jmp	.Lalign32_2  // see "Decoded ICache" in manual
 .align	32
 .Lalign32_2:
 	vpalignr	$8,%ymm6,%ymm7,%ymm8
@@ -4622,38 +4622,38 @@
 	rorxl	$27,%esi,%r12d
 	addl	%r12d,%edx
 	leaq	128(%r9),%r13
-	leaq	128(%r9),%rdi
+	leaq	128(%r9),%rdi  // borrow %edi
 	cmpq	%r10,%r13
-	cmovaeq	%r9,%r13
+	cmovaeq	%r9,%r13  // next or previous block
 
-
-	addl	0(%r8),%edx
+// output is d-e-a-f-b-c => A=d,F=e,C=f,D=b,E=c
+	addl	0(%r8),%edx  // update context
 	addl	4(%r8),%esi
 	addl	8(%r8),%ebp
 	movl	%edx,0(%r8)
 	addl	12(%r8),%ebx
 	movl	%esi,4(%r8)
-	movl	%edx,%eax
+	movl	%edx,%eax  // A=d
 	addl	16(%r8),%ecx
 	movl	%ebp,%r12d
 	movl	%ebp,8(%r8)
-	movl	%ebx,%edx
-
+	movl	%ebx,%edx  // D=b
+// xchg	%ecx,%ebp			# F=c, C=f
 	movl	%ebx,12(%r8)
-	movl	%esi,%ebp
+	movl	%esi,%ebp  // F=e
 	movl	%ecx,16(%r8)
-
-	movl	%ecx,%esi
-	movl	%r12d,%ecx
-
+// mov	%ebp,16(%r8)
+	movl	%ecx,%esi  // E=c
+	movl	%r12d,%ecx  // C=f
+// xchg	%ebp,%esi				# E=c, F=e
 
 	cmpq	%r10,%r9
 	je	.Ldone_avx2
-	vmovdqu	64(%r14),%ymm6
-	cmpq	%r10,%rdi
+	vmovdqu	64(%r14),%ymm6  // pbswap mask
+	cmpq	%r10,%rdi  // borrowed %edi
 	ja	.Last_avx2
 
-	vmovdqu	-64(%rdi),%xmm0
+	vmovdqu	-64(%rdi),%xmm0  // low part of %ymm0
 	vmovdqu	-48(%rdi),%xmm1
 	vmovdqu	-32(%rdi),%xmm2
 	vmovdqu	-16(%rdi),%xmm3
@@ -5033,7 +5033,7 @@
 	xorl	%eax,%edx
 	addl	%r12d,%ecx
 	andl	%edi,%edx
-	jmp	.Lalign32_3
+	jmp	.Lalign32_3  // see "Decoded ICache" in manual
 .align	32
 .Lalign32_3:
 	vmovdqu	%ymm6,64(%rsp)
@@ -5388,26 +5388,26 @@
 	addl	%r12d,%edx
 	leaq	128(%rsp),%r13
 
-
-	addl	0(%r8),%edx
+// output is d-e-a-f-b-c => A=d,F=e,C=f,D=b,E=c
+	addl	0(%r8),%edx  // update context
 	addl	4(%r8),%esi
 	addl	8(%r8),%ebp
 	movl	%edx,0(%r8)
 	addl	12(%r8),%ebx
 	movl	%esi,4(%r8)
-	movl	%edx,%eax
+	movl	%edx,%eax  // A=d
 	addl	16(%r8),%ecx
 	movl	%ebp,%r12d
 	movl	%ebp,8(%r8)
-	movl	%ebx,%edx
-
+	movl	%ebx,%edx  // D=b
+// xchg	%ecx,%ebp			# F=c, C=f
 	movl	%ebx,12(%r8)
-	movl	%esi,%ebp
+	movl	%esi,%ebp  // F=e
 	movl	%ecx,16(%r8)
-
-	movl	%ecx,%esi
-	movl	%r12d,%ecx
-
+// mov	%ebp,16(%r8)
+	movl	%ecx,%esi  // E=c
+	movl	%r12d,%ecx  // C=f
+// xchg	%ebp,%esi				# E=c, F=e
 
 	cmpq	%r10,%r9
 	jbe	.Loop_avx2
@@ -5433,16 +5433,16 @@
 .section	.rodata
 .align	64
 K_XX_XX:
-.long	0x5a827999,0x5a827999,0x5a827999,0x5a827999
-.long	0x5a827999,0x5a827999,0x5a827999,0x5a827999
-.long	0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1
-.long	0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1
-.long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc
-.long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc
-.long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6
-.long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6
-.long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f
-.long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f
+.long	0x5a827999,0x5a827999,0x5a827999,0x5a827999  // K_00_19
+.long	0x5a827999,0x5a827999,0x5a827999,0x5a827999  // K_00_19
+.long	0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1  // K_20_39
+.long	0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1  // K_20_39
+.long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc  // K_40_59
+.long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc  // K_40_59
+.long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6  // K_60_79
+.long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6  // K_60_79
+.long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f  // pbswap mask
+.long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f  // pbswap mask
 .byte	0xf,0xe,0xd,0xc,0xb,0xa,0x9,0x8,0x7,0x6,0x5,0x4,0x3,0x2,0x1,0x0
 .byte	83,72,65,49,32,98,108,111,99,107,32,116,114,97,110,115,102,111,114,109,32,102,111,114,32,120,56,54,95,54,52,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 .align	64

boringssl-0.20260708.tar.xz/gen/bcm/sha1-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/sha1-x86_64-win.asm Changed

@@ -41,11 +41,11 @@
 
 	push	r14
 
-	mov	r8,rdi
+	mov	r8,rdi  ; reassigned argument
 	sub	rsp,72
-	mov	r9,rsi
+	mov	r9,rsi  ; reassigned argument
 	and	rsp,-64
-	mov	r10,rdx
+	mov	r10,rdx  ; reassigned argument
 	mov	QWORD64+rsp,rax
 
 $L$prologue:
@@ -1284,32 +1284,32 @@
 $L$prologue_shaext:
 	movdqu	xmm0,XMMWORDrdi
 	movd	xmm1,DWORD16+rdi
-	movdqa	xmm3,XMMWORD((K_XX_XX+160))
+	movdqa	xmm3,XMMWORD((K_XX_XX+160))  ; byte-n-word swap
 
 	movdqu	xmm4,XMMWORDrsi
-	pshufd	xmm0,xmm0,27
+	pshufd	xmm0,xmm0,27  ; flip word order
 	movdqu	xmm5,XMMWORD16+rsi
-	pshufd	xmm1,xmm1,27
+	pshufd	xmm1,xmm1,27  ; flip word order
 	movdqu	xmm6,XMMWORD32+rsi
 	pshufb	xmm4,xmm3
 	movdqu	xmm7,XMMWORD48+rsi
 	pshufb	xmm5,xmm3
 	pshufb	xmm6,xmm3
-	movdqa	xmm9,xmm1
+	movdqa	xmm9,xmm1  ; offload %xmm1
 	pshufb	xmm7,xmm3
 	jmp	NEAR $L$oop_shaext
 
 ALIGN	16
 $L$oop_shaext:
 	dec	rdx
-	lea	r8,64+rsi
+	lea	r8,64+rsi  ; next input block
 	paddd	xmm1,xmm4
 	cmovne	rsi,r8
 	prefetcht0	512+rsi
-	movdqa	xmm8,xmm0
+	movdqa	xmm8,xmm0  ; offload %xmm0
 	sha1msg1	xmm4,xmm5
 	movdqa	xmm2,xmm0
-	sha1rnds4	xmm0,xmm1,0
+	sha1rnds4	xmm0,xmm1,0  ; 0-3...
 	sha1nexte	xmm2,xmm5
 	pxor	xmm4,xmm6
 	sha1msg1	xmm5,xmm6
@@ -1322,7 +1322,7 @@
 	sha1msg2	xmm5,xmm4
 	sha1msg1	xmm6,xmm7
 	movdqa	xmm2,xmm0
-	sha1rnds4	xmm0,xmm1,0
+	sha1rnds4	xmm0,xmm1,0  ; 0-3...
 	sha1nexte	xmm2,xmm7
 	pxor	xmm6,xmm4
 	sha1msg1	xmm7,xmm4
@@ -1335,7 +1335,7 @@
 	sha1msg2	xmm7,xmm6
 	sha1msg1	xmm4,xmm5
 	movdqa	xmm2,xmm0
-	sha1rnds4	xmm0,xmm1,0
+	sha1rnds4	xmm0,xmm1,0  ; 0-3...
 	sha1nexte	xmm2,xmm5
 	pxor	xmm4,xmm6
 	sha1msg1	xmm5,xmm6
@@ -1348,7 +1348,7 @@
 	sha1msg2	xmm5,xmm4
 	sha1msg1	xmm6,xmm7
 	movdqa	xmm2,xmm0
-	sha1rnds4	xmm0,xmm1,1
+	sha1rnds4	xmm0,xmm1,1  ; 0-3...
 	sha1nexte	xmm2,xmm7
 	pxor	xmm6,xmm4
 	sha1msg1	xmm7,xmm4
@@ -1361,7 +1361,7 @@
 	sha1msg2	xmm7,xmm6
 	sha1msg1	xmm4,xmm5
 	movdqa	xmm2,xmm0
-	sha1rnds4	xmm0,xmm1,1
+	sha1rnds4	xmm0,xmm1,1  ; 0-3...
 	sha1nexte	xmm2,xmm5
 	pxor	xmm4,xmm6
 	sha1msg1	xmm5,xmm6
@@ -1374,7 +1374,7 @@
 	sha1msg2	xmm5,xmm4
 	sha1msg1	xmm6,xmm7
 	movdqa	xmm2,xmm0
-	sha1rnds4	xmm0,xmm1,2
+	sha1rnds4	xmm0,xmm1,2  ; 0-3...
 	sha1nexte	xmm2,xmm7
 	pxor	xmm6,xmm4
 	sha1msg1	xmm7,xmm4
@@ -1387,7 +1387,7 @@
 	sha1msg2	xmm7,xmm6
 	sha1msg1	xmm4,xmm5
 	movdqa	xmm2,xmm0
-	sha1rnds4	xmm0,xmm1,2
+	sha1rnds4	xmm0,xmm1,2  ; 0-3...
 	sha1nexte	xmm2,xmm5
 	pxor	xmm4,xmm6
 	sha1msg1	xmm5,xmm6
@@ -1400,7 +1400,7 @@
 	sha1msg2	xmm5,xmm4
 	sha1msg1	xmm6,xmm7
 	movdqa	xmm2,xmm0
-	sha1rnds4	xmm0,xmm1,2
+	sha1rnds4	xmm0,xmm1,2  ; 0-3...
 	sha1nexte	xmm2,xmm7
 	pxor	xmm6,xmm4
 	sha1msg1	xmm7,xmm4
@@ -1413,30 +1413,30 @@
 	sha1msg2	xmm7,xmm6
 	movdqu	xmm4,XMMWORDrsi
 	movdqa	xmm2,xmm0
-	sha1rnds4	xmm0,xmm1,3
+	sha1rnds4	xmm0,xmm1,3  ; 64-67
 	sha1nexte	xmm2,xmm5
 	movdqu	xmm5,XMMWORD16+rsi
 	pshufb	xmm4,xmm3
 
 	movdqa	xmm1,xmm0
-	sha1rnds4	xmm0,xmm2,3
+	sha1rnds4	xmm0,xmm2,3  ; 68-71
 	sha1nexte	xmm1,xmm6
 	movdqu	xmm6,XMMWORD32+rsi
 	pshufb	xmm5,xmm3
 
 	movdqa	xmm2,xmm0
-	sha1rnds4	xmm0,xmm1,3
+	sha1rnds4	xmm0,xmm1,3  ; 72-75
 	sha1nexte	xmm2,xmm7
 	movdqu	xmm7,XMMWORD48+rsi
 	pshufb	xmm6,xmm3
 
 	movdqa	xmm1,xmm0
-	sha1rnds4	xmm0,xmm2,3
+	sha1rnds4	xmm0,xmm2,3  ; 76-79
 	sha1nexte	xmm1,xmm9
 	pshufb	xmm7,xmm3
 
 	paddd	xmm0,xmm8
-	movdqa	xmm9,xmm1
+	movdqa	xmm9,xmm1  ; offload %xmm1
 
 	jnz	NEAR $L$oop_shaext
 
@@ -1470,7 +1470,7 @@
 
 
 _CET_ENDBR
-	mov	r11,rsp
+	mov	r11,rsp  ; frame pointer
 
 	push	rbx
 
@@ -1478,7 +1478,7 @@
 
 	push	r12
 
-	push	r13
+	push	r13  ; redundant, done to share Win64 SE handler
 
 	push	r14
 
@@ -1491,40 +1491,40 @@
 	movaps	XMMWORD(-40-16)+r11,xmm11
 $L$prologue_ssse3:
 	and	rsp,-64
-	mov	r8,rdi
-	mov	r9,rsi
-	mov	r10,rdx
+	mov	r8,rdi  ; reassigned argument
+	mov	r9,rsi  ; reassigned argument
+	mov	r10,rdx  ; reassigned argument
 
 	shl	r10,6
 	add	r10,r9
 	lea	r14,((K_XX_XX+64))
 
-	mov	eax,DWORDr8
+	mov	eax,DWORDr8  ; load context
 	mov	ebx,DWORD4+r8
 	mov	ecx,DWORD8+r8
 	mov	edx,DWORD12+r8
-	mov	esi,ebx
+	mov	esi,ebx  ; magic seed
 	mov	ebp,DWORD16+r8
 	mov	edi,ecx
 	xor	edi,edx
 	and	esi,edi
 
-	movdqa	xmm6,XMMWORD64+r14
-	movdqa	xmm9,XMMWORD((-64))+r14
-	movdqu	xmm0,XMMWORDr9
+	movdqa	xmm6,XMMWORD64+r14  ; pbswap mask
+	movdqa	xmm9,XMMWORD((-64))+r14  ; K_00_19
+	movdqu	xmm0,XMMWORDr9  ; load input to %xmm0-3
 	movdqu	xmm1,XMMWORD16+r9
 	movdqu	xmm2,XMMWORD32+r9
 	movdqu	xmm3,XMMWORD48+r9
-	pshufb	xmm0,xmm6
+	pshufb	xmm0,xmm6  ; byte swap
 	pshufb	xmm1,xmm6
 	pshufb	xmm2,xmm6
 	add	r9,64
-	paddd	xmm0,xmm9
+	paddd	xmm0,xmm9  ; add K_00_19
 	pshufb	xmm3,xmm6
 	paddd	xmm1,xmm9
 	paddd	xmm2,xmm9
-	movdqa	XMMWORDrsp,xmm0
-	psubd	xmm0,xmm9
+	movdqa	XMMWORDrsp,xmm0  ; X+K xfer to IALU
+	psubd	xmm0,xmm9  ; restore X
 	movdqa	XMMWORD16+rsp,xmm1
 	psubd	xmm1,xmm9
 	movdqa	XMMWORD32+rsp,xmm2
@@ -2521,14 +2521,14 @@
 	add	eax,edi
 	ror	ecx,7
 	add	eax,ebx
-	add	eax,DWORDr8
+	add	eax,DWORDr8  ; update context
 	add	esi,DWORD4+r8
 	add	ecx,DWORD8+r8
 	add	edx,DWORD12+r8
 	mov	DWORDr8,eax
 	add	ebp,DWORD16+r8
 	mov	DWORD4+r8,esi
-	mov	ebx,esi
+	mov	ebx,esi  ; magic seed
 	mov	DWORD8+r8,ecx
 	mov	edi,ecx
 	mov	DWORD12+r8,edx
@@ -2634,7 +2634,7 @@
 	add	eax,edi
 	ror	ecx,7
 	add	eax,ebx
-	add	eax,DWORDr8
+	add	eax,DWORDr8  ; update context
 	add	esi,DWORD4+r8
 	add	ecx,DWORD8+r8
 	mov	DWORDr8,eax
@@ -2691,7 +2691,7 @@
 
 	push	r12
 
-	push	r13
+	push	r13  ; redundant, done to share Win64 SE handler
 
 	push	r14
 
@@ -2705,39 +2705,39 @@
 	vmovaps	XMMWORD(-40-16)+r11,xmm11
 $L$prologue_avx:
 	and	rsp,-64
-	mov	r8,rdi
-	mov	r9,rsi
-	mov	r10,rdx
+	mov	r8,rdi  ; reassigned argument
+	mov	r9,rsi  ; reassigned argument
+	mov	r10,rdx  ; reassigned argument
 
 	shl	r10,6
 	add	r10,r9
 	lea	r14,((K_XX_XX+64))
 
-	mov	eax,DWORDr8
+	mov	eax,DWORDr8  ; load context
 	mov	ebx,DWORD4+r8
 	mov	ecx,DWORD8+r8
 	mov	edx,DWORD12+r8
-	mov	esi,ebx
+	mov	esi,ebx  ; magic seed
 	mov	ebp,DWORD16+r8
 	mov	edi,ecx
 	xor	edi,edx
 	and	esi,edi
 
-	vmovdqa	xmm6,XMMWORD64+r14
-	vmovdqa	xmm11,XMMWORD((-64))+r14
-	vmovdqu	xmm0,XMMWORDr9
+	vmovdqa	xmm6,XMMWORD64+r14  ; pbswap mask
+	vmovdqa	xmm11,XMMWORD((-64))+r14  ; K_00_19
+	vmovdqu	xmm0,XMMWORDr9  ; load input to %xmm0-3
 	vmovdqu	xmm1,XMMWORD16+r9
 	vmovdqu	xmm2,XMMWORD32+r9
 	vmovdqu	xmm3,XMMWORD48+r9
-	vpshufb	xmm0,xmm0,xmm6
+	vpshufb	xmm0,xmm0,xmm6  ; byte swap
 	add	r9,64
 	vpshufb	xmm1,xmm1,xmm6
 	vpshufb	xmm2,xmm2,xmm6
 	vpshufb	xmm3,xmm3,xmm6
-	vpaddd	xmm4,xmm0,xmm11
+	vpaddd	xmm4,xmm0,xmm11  ; add K_00_19
 	vpaddd	xmm5,xmm1,xmm11
 	vpaddd	xmm6,xmm2,xmm11
-	vmovdqa	XMMWORDrsp,xmm4
+	vmovdqa	XMMWORDrsp,xmm4  ; X+K xfer to IALU
 	vmovdqa	XMMWORD16+rsp,xmm5
 	vmovdqa	XMMWORD32+rsp,xmm6
 	jmp	NEAR $L$oop_avx
@@ -3672,14 +3672,14 @@
 	add	eax,edi
 	shrd	ecx,ecx,7
 	add	eax,ebx
-	add	eax,DWORDr8
+	add	eax,DWORDr8  ; update context
 	add	esi,DWORD4+r8
 	add	ecx,DWORD8+r8
 	add	edx,DWORD12+r8
 	mov	DWORDr8,eax
 	add	ebp,DWORD16+r8
 	mov	DWORD4+r8,esi
-	mov	ebx,esi
+	mov	ebx,esi  ; magic seed
 	mov	DWORD8+r8,ecx
 	mov	edi,ecx
 	mov	DWORD12+r8,edx
@@ -3787,7 +3787,7 @@
 	add	eax,ebx
 	vzeroupper
 
-	add	eax,DWORDr8
+	add	eax,DWORDr8  ; update context
 	add	esi,DWORD4+r8
 	add	ecx,DWORD8+r8
 	mov	DWORDr8,eax
@@ -3857,9 +3857,9 @@
 	vmovaps	XMMWORD(-40-32)+r11,xmm10
 	vmovaps	XMMWORD(-40-16)+r11,xmm11
 $L$prologue_avx2:
-	mov	r8,rdi
-	mov	r9,rsi
-	mov	r10,rdx
+	mov	r8,rdi  ; reassigned argument
+	mov	r9,rsi  ; reassigned argument
+	mov	r10,rdx  ; reassigned argument
 
 	lea	rsp,((-640))+rsp
 	shl	r10,6
@@ -3868,14 +3868,14 @@
 	add	r10,r9
 	lea	r14,((K_XX_XX+64))
 
-	mov	eax,DWORDr8
+	mov	eax,DWORDr8  ; load context
 	cmp	r13,r10
-	cmovae	r13,r9
+	cmovae	r13,r9  ; next or same block
 	mov	ebp,DWORD4+r8
 	mov	ecx,DWORD8+r8
 	mov	edx,DWORD12+r8
 	mov	esi,DWORD16+r8
-	vmovdqu	ymm6,YMMWORD64+r14
+	vmovdqu	ymm6,YMMWORD64+r14  ; pbswap mask
 
 	vmovdqu	xmm0,XMMWORDr9
 	vmovdqu	xmm1,XMMWORD16+r9
@@ -3889,12 +3889,12 @@
 	vpshufb	ymm1,ymm1,ymm6
 	vinserti128	ymm3,ymm3,XMMWORD48+r13,1
 	vpshufb	ymm2,ymm2,ymm6
-	vmovdqu	ymm11,YMMWORD((-64))+r14
+	vmovdqu	ymm11,YMMWORD((-64))+r14  ; K_00_19
 	vpshufb	ymm3,ymm3,ymm6
 
-	vpaddd	ymm4,ymm0,ymm11
+	vpaddd	ymm4,ymm0,ymm11  ; add K_00_19
 	vpaddd	ymm5,ymm1,ymm11
-	vmovdqu	YMMWORDrsp,ymm4
+	vmovdqu	YMMWORDrsp,ymm4  ; X+K xfer to IALU
 	vpaddd	ymm6,ymm2,ymm11
 	vmovdqu	YMMWORD32+rsp,ymm5
 	vpaddd	ymm7,ymm3,ymm11
@@ -3969,7 +3969,7 @@
 	andn	edi,ebp,edx
 	and	ebp,ecx
 	xor	ebp,edi
-	jmp	NEAR $L$align32_1
+	jmp	NEAR $L$align32_1  ; see "Decoded ICache" in manual
 ALIGN	32
 $L$align32_1:
 	vpalignr	ymm8,ymm7,ymm6,8
@@ -4348,7 +4348,7 @@
 	xor	ecx,esi
 	add	ebx,r12d
 	and	ecx,edi
-	jmp	NEAR $L$align32_2
+	jmp	NEAR $L$align32_2  ; see "Decoded ICache" in manual
 ALIGN	32
 $L$align32_2:
 	vpalignr	ymm8,ymm7,ymm6,8
@@ -4724,38 +4724,38 @@
 	rorx	r12d,esi,27
 	add	edx,r12d
 	lea	r13,128+r9
-	lea	rdi,128+r9
+	lea	rdi,128+r9  ; borrow %edi
 	cmp	r13,r10
-	cmovae	r13,r9
+	cmovae	r13,r9  ; next or previous block
 
-
-	add	edx,DWORDr8
+; output is d-e-a-f-b-c => A=d,F=e,C=f,D=b,E=c
+	add	edx,DWORDr8  ; update context
 	add	esi,DWORD4+r8
 	add	ebp,DWORD8+r8
 	mov	DWORDr8,edx
 	add	ebx,DWORD12+r8
 	mov	DWORD4+r8,esi
-	mov	eax,edx
+	mov	eax,edx  ; A=d
 	add	ecx,DWORD16+r8
 	mov	r12d,ebp
 	mov	DWORD8+r8,ebp
-	mov	edx,ebx
-
+	mov	edx,ebx  ; D=b
+; xchg	%ecx,%ebp			# F=c, C=f
 	mov	DWORD12+r8,ebx
-	mov	ebp,esi
+	mov	ebp,esi  ; F=e
 	mov	DWORD16+r8,ecx
-
-	mov	esi,ecx
-	mov	ecx,r12d
-
+; mov	%ebp,16(%r8)
+	mov	esi,ecx  ; E=c
+	mov	ecx,r12d  ; C=f
+; xchg	%ebp,%esi				# E=c, F=e
 
 	cmp	r9,r10
 	je	NEAR $L$done_avx2
-	vmovdqu	ymm6,YMMWORD64+r14
-	cmp	rdi,r10
+	vmovdqu	ymm6,YMMWORD64+r14  ; pbswap mask
+	cmp	rdi,r10  ; borrowed %edi
 	ja	NEAR $L$ast_avx2
 
-	vmovdqu	xmm0,XMMWORD((-64))+rdi
+	vmovdqu	xmm0,XMMWORD((-64))+rdi  ; low part of %ymm0
 	vmovdqu	xmm1,XMMWORD((-48))+rdi
 	vmovdqu	xmm2,XMMWORD((-32))+rdi
 	vmovdqu	xmm3,XMMWORD((-16))+rdi
@@ -5135,7 +5135,7 @@
 	xor	edx,eax
 	add	ecx,r12d
 	and	edx,edi
-	jmp	NEAR $L$align32_3
+	jmp	NEAR $L$align32_3  ; see "Decoded ICache" in manual
 ALIGN	32
 $L$align32_3:
 	vmovdqu	YMMWORD64+rsp,ymm6
@@ -5490,26 +5490,26 @@
 	add	edx,r12d
 	lea	r13,128+rsp
 
-
-	add	edx,DWORDr8
+; output is d-e-a-f-b-c => A=d,F=e,C=f,D=b,E=c
+	add	edx,DWORDr8  ; update context
 	add	esi,DWORD4+r8
 	add	ebp,DWORD8+r8
 	mov	DWORDr8,edx
 	add	ebx,DWORD12+r8
 	mov	DWORD4+r8,esi
-	mov	eax,edx
+	mov	eax,edx  ; A=d
 	add	ecx,DWORD16+r8
 	mov	r12d,ebp
 	mov	DWORD8+r8,ebp
-	mov	edx,ebx
-
+	mov	edx,ebx  ; D=b
+; xchg	%ecx,%ebp			# F=c, C=f
 	mov	DWORD12+r8,ebx
-	mov	ebp,esi
+	mov	ebp,esi  ; F=e
 	mov	DWORD16+r8,ecx
-
-	mov	esi,ecx
-	mov	ecx,r12d
-
+; mov	%ebp,16(%r8)
+	mov	esi,ecx  ; E=c
+	mov	ecx,r12d  ; C=f
+; xchg	%ebp,%esi				# E=c, F=e
 
 	cmp	r9,r10
 	jbe	NEAR $L$oop_avx2
@@ -5543,16 +5543,16 @@
 section	.rdata rdata align=8
 ALIGN	64
 K_XX_XX:
-	DD	0x5a827999,0x5a827999,0x5a827999,0x5a827999
-	DD	0x5a827999,0x5a827999,0x5a827999,0x5a827999
-	DD	0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1
-	DD	0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1
-	DD	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc
-	DD	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc
-	DD	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6
-	DD	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6
-	DD	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f
-	DD	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f
+	DD	0x5a827999,0x5a827999,0x5a827999,0x5a827999  ; K_00_19
+	DD	0x5a827999,0x5a827999,0x5a827999,0x5a827999  ; K_00_19
+	DD	0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1  ; K_20_39
+	DD	0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1  ; K_20_39
+	DD	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc  ; K_40_59
+	DD	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc  ; K_40_59
+	DD	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6  ; K_60_79
+	DD	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6  ; K_60_79
+	DD	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f  ; pbswap mask
+	DD	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f  ; pbswap mask
 	DB	0xf,0xe,0xd,0xc,0xb,0xa,0x9,0x8,0x7,0x6,0x5,0x4,0x3,0x2,0x1,0x0
 	DB	83,72,65,49,32,98,108,111,99,107,32,116,114,97,110,115
 	DB	102,111,114,109,32,102,111,114,32,120,56,54,95,54,52,44
@@ -5560,7 +5560,7 @@
 	DB	97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114
 	DB	103,62,0
 ALIGN	64
-section	.text
+section	.text code align=64
 
 EXTERN	__imp_RtlVirtualUnwind
 
@@ -5577,31 +5577,31 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
 	lea	r10,$L$prologue
-	cmp	rbx,r10
+	cmp	rbx,r10  ; context->Rip<.Lprologue
 	jb	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
 	lea	r10,$L$epilogue
-	cmp	rbx,r10
+	cmp	rbx,r10  ; context->Rip>=.Lepilogue
 	jae	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD64+rax
+	mov	rax,QWORD64+rax  ; pull saved stack pointer
 
 	mov	rbx,QWORD((-8))+rax
 	mov	rbp,QWORD((-16))+rax
 	mov	r12,QWORD((-24))+rax
 	mov	r13,QWORD((-32))+rax
 	mov	r14,QWORD((-40))+rax
-	mov	QWORD144+r8,rbx
-	mov	QWORD160+r8,rbp
-	mov	QWORD216+r8,r12
-	mov	QWORD224+r8,r13
-	mov	QWORD232+r8,r14
+	mov	QWORD144+r8,rbx  ; restore context->Rbx
+	mov	QWORD160+r8,rbp  ; restore context->Rbp
+	mov	QWORD216+r8,r12  ; restore context->R12
+	mov	QWORD224+r8,r13  ; restore context->R13
+	mov	QWORD232+r8,r14  ; restore context->R14
 
 	jmp	NEAR $L$common_seh_tail
 
@@ -5619,21 +5619,21 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
 	lea	r10,$L$prologue_shaext
-	cmp	rbx,r10
+	cmp	rbx,r10  ; context->Rip<.Lprologue
 	jb	NEAR $L$common_seh_tail
 
 	lea	r10,$L$epilogue_shaext
-	cmp	rbx,r10
+	cmp	rbx,r10  ; context->Rip>=.Lepilogue
 	jae	NEAR $L$common_seh_tail
 
 	lea	rsi,((-8-64))+rax
-	lea	rdi,512+r8
+	lea	rdi,512+r8  ; &context.Xmm6
 	mov	ecx,8
-	DD	0xa548f3fc
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	jmp	NEAR $L$common_seh_tail
 
@@ -5651,67 +5651,67 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; prologue label
+	cmp	rbx,r10  ; context->Rip<prologue label
 	jb	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD208+r8
+	mov	rax,QWORD208+r8  ; pull context->R11
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$common_seh_tail
 
 	lea	rsi,((-40-96))+rax
-	lea	rdi,512+r8
+	lea	rdi,512+r8  ; &context.Xmm6
 	mov	ecx,12
-	DD	0xa548f3fc
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	mov	rbx,QWORD((-8))+rax
 	mov	rbp,QWORD((-16))+rax
 	mov	r12,QWORD((-24))+rax
 	mov	r13,QWORD((-32))+rax
 	mov	r14,QWORD((-40))+rax
-	mov	QWORD144+r8,rbx
-	mov	QWORD160+r8,rbp
-	mov	QWORD216+r8,r12
-	mov	QWORD224+r8,r13
-	mov	QWORD232+r8,r14
+	mov	QWORD144+r8,rbx  ; restore context->Rbx
+	mov	QWORD160+r8,rbp  ; restore context->Rbp
+	mov	QWORD216+r8,r12  ; restore context->R12
+	mov	QWORD224+r8,r13  ; restore context->R13
+	mov	QWORD232+r8,r14  ; restore context->R14
 
 $L$common_seh_tail:
 	mov	rdi,QWORD8+rax
 	mov	rsi,QWORD16+rax
-	mov	QWORD152+r8,rax
-	mov	QWORD168+r8,rsi
-	mov	QWORD176+r8,rdi
-
-	mov	rdi,QWORD40+r9
-	mov	rsi,r8
-	mov	ecx,154
-	DD	0xa548f3fc
+	mov	QWORD152+r8,rax  ; restore context->Rsp
+	mov	QWORD168+r8,rsi  ; restore context->Rsi
+	mov	QWORD176+r8,rdi  ; restore context->Rdi
+
+	mov	rdi,QWORD40+r9  ; disp->ContextRecord
+	mov	rsi,r8  ; context
+	mov	ecx,154  ; sizeof(CONTEXT)
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	mov	rsi,r9
-	xor	rcx,rcx
-	mov	rdx,QWORD8+rsi
-	mov	r8,QWORDrsi
-	mov	r9,QWORD16+rsi
-	mov	r10,QWORD40+rsi
-	lea	r11,56+rsi
-	lea	r12,24+rsi
-	mov	QWORD32+rsp,r10
-	mov	QWORD40+rsp,r11
-	mov	QWORD48+rsp,r12
-	mov	QWORD56+rsp,rcx
+	xor	rcx,rcx  ; arg1, UNW_FLAG_NHANDLER
+	mov	rdx,QWORD8+rsi  ; arg2, disp->ImageBase
+	mov	r8,QWORDrsi  ; arg3, disp->ControlPc
+	mov	r9,QWORD16+rsi  ; arg4, disp->FunctionEntry
+	mov	r10,QWORD40+rsi  ; disp->ContextRecord
+	lea	r11,56+rsi  ; &disp->HandlerData
+	lea	r12,24+rsi  ; &disp->EstablisherFrame
+	mov	QWORD32+rsp,r10  ; arg5
+	mov	QWORD40+rsp,r11  ; arg6
+	mov	QWORD48+rsp,r12  ; arg7
+	mov	QWORD56+rsp,rcx  ; arg8, (NULL)
 	call	QWORD__imp_RtlVirtualUnwind
 
-	mov	eax,1
+	mov	eax,1  ; ExceptionContinueSearch
 	add	rsp,64
 	popfq
 	pop	r15
@@ -5753,15 +5753,15 @@
 $L$SEH_info_sha1_block_data_order_ssse3:
 	DB	9,0,0,0
 	DD	ssse3_handler wrt ..imagebase
-	DD	$L$prologue_ssse3 wrt ..imagebase,$L$epilogue_ssse3 wrt ..imagebase
+	DD	$L$prologue_ssse3 wrt ..imagebase,$L$epilogue_ssse3 wrt ..imagebase  ; HandlerData
 $L$SEH_info_sha1_block_data_order_avx:
 	DB	9,0,0,0
 	DD	ssse3_handler wrt ..imagebase
-	DD	$L$prologue_avx wrt ..imagebase,$L$epilogue_avx wrt ..imagebase
+	DD	$L$prologue_avx wrt ..imagebase,$L$epilogue_avx wrt ..imagebase  ; HandlerData
 $L$SEH_info_sha1_block_data_order_avx2:
 	DB	9,0,0,0
 	DD	ssse3_handler wrt ..imagebase
-	DD	$L$prologue_avx2 wrt ..imagebase,$L$epilogue_avx2 wrt ..imagebase
+	DD	$L$prologue_avx2 wrt ..imagebase,$L$epilogue_avx2 wrt ..imagebase  ; HandlerData
 %else
 ; Work around https://bugzilla.nasm.us/show_bug.cgi?id=3392738
 ret

boringssl-0.20260708.tar.xz/gen/bcm/sha256-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/sha256-x86_64-apple.S Changed

@@ -13,7 +13,7 @@
 _sha256_block_data_order_nohw:
 
 _CET_ENDBR
-	movq	%rsp,%rax
+	movq	%rsp,%rax  // copy %rsp
 
 	pushq	%rbx
 
@@ -27,14 +27,14 @@
 
 	pushq	%r15
 
-	shlq	$4,%rdx
+	shlq	$4,%rdx  // num*16
 	subq	$64+32,%rsp
-	leaq	(%rsi,%rdx,4),%rdx
-	andq	$-64,%rsp
-	movq	%rdi,64+0(%rsp)
-	movq	%rsi,64+8(%rsp)
-	movq	%rdx,64+16(%rsp)
-	movq	%rax,88(%rsp)
+	leaq	(%rsi,%rdx,4),%rdx  // inp+num*16*4
+	andq	$-64,%rsp  // align stack frame
+	movq	%rdi,64+0(%rsp)  // save ctx, 1st arg
+	movq	%rsi,64+8(%rsp)  // save inp, 2nd arh
+	movq	%rdx,64+16(%rsp)  // save end pointer, "3rd" arg
+	movq	%rax,88(%rsp)  // save copy of %rsp
 
 L$prologue:
 
@@ -52,7 +52,7 @@
 L$loop:
 	movl	%ebx,%edi
 	leaq	K256(%rip),%rbp
-	xorl	%ecx,%edi
+	xorl	%ecx,%edi  // magic
 	movl	0(%rsi),%r12d
 	movl	%r8d,%r13d
 	movl	%eax,%r14d
@@ -62,38 +62,38 @@
 
 	xorl	%r8d,%r13d
 	rorl	$9,%r14d
-	xorl	%r10d,%r15d
+	xorl	%r10d,%r15d  // f^g
 
 	movl	%r12d,0(%rsp)
 	xorl	%eax,%r14d
-	andl	%r8d,%r15d
+	andl	%r8d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r11d,%r12d
-	xorl	%r10d,%r15d
+	addl	%r11d,%r12d  // T1+=h
+	xorl	%r10d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r8d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%eax,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%eax,%r14d
 
-	xorl	%ebx,%r15d
-	rorl	$6,%r13d
+	xorl	%ebx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ebx,%r11d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r11d
-	addl	%r12d,%edx
-	addl	%r12d,%r11d
+	xorl	%edi,%r11d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%edx  // d+=T1
+	addl	%r12d,%r11d  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%r11d
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%r11d  // h+=Sigma0(a)
 	movl	4(%rsi),%r12d
 	movl	%edx,%r13d
 	movl	%r11d,%r14d
@@ -103,38 +103,38 @@
 
 	xorl	%edx,%r13d
 	rorl	$9,%r14d
-	xorl	%r9d,%edi
+	xorl	%r9d,%edi  // f^g
 
 	movl	%r12d,4(%rsp)
 	xorl	%r11d,%r14d
-	andl	%edx,%edi
+	andl	%edx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r10d,%r12d
-	xorl	%r9d,%edi
+	addl	%r10d,%r12d  // T1+=h
+	xorl	%r9d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%edx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r11d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r11d,%r14d
 
-	xorl	%eax,%edi
-	rorl	$6,%r13d
+	xorl	%eax,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%eax,%r10d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r10d
-	addl	%r12d,%ecx
-	addl	%r12d,%r10d
+	xorl	%r15d,%r10d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ecx  // d+=T1
+	addl	%r12d,%r10d  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%r10d
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%r10d  // h+=Sigma0(a)
 	movl	8(%rsi),%r12d
 	movl	%ecx,%r13d
 	movl	%r10d,%r14d
@@ -144,38 +144,38 @@
 
 	xorl	%ecx,%r13d
 	rorl	$9,%r14d
-	xorl	%r8d,%r15d
+	xorl	%r8d,%r15d  // f^g
 
 	movl	%r12d,8(%rsp)
 	xorl	%r10d,%r14d
-	andl	%ecx,%r15d
+	andl	%ecx,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r9d,%r12d
-	xorl	%r8d,%r15d
+	addl	%r9d,%r12d  // T1+=h
+	xorl	%r8d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ecx,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r10d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r10d,%r14d
 
-	xorl	%r11d,%r15d
-	rorl	$6,%r13d
+	xorl	%r11d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r11d,%r9d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r9d
-	addl	%r12d,%ebx
-	addl	%r12d,%r9d
+	xorl	%edi,%r9d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ebx  // d+=T1
+	addl	%r12d,%r9d  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%r9d
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%r9d  // h+=Sigma0(a)
 	movl	12(%rsi),%r12d
 	movl	%ebx,%r13d
 	movl	%r9d,%r14d
@@ -185,38 +185,38 @@
 
 	xorl	%ebx,%r13d
 	rorl	$9,%r14d
-	xorl	%edx,%edi
+	xorl	%edx,%edi  // f^g
 
 	movl	%r12d,12(%rsp)
 	xorl	%r9d,%r14d
-	andl	%ebx,%edi
+	andl	%ebx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r8d,%r12d
-	xorl	%edx,%edi
+	addl	%r8d,%r12d  // T1+=h
+	xorl	%edx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ebx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r9d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r9d,%r14d
 
-	xorl	%r10d,%edi
-	rorl	$6,%r13d
+	xorl	%r10d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r10d,%r8d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r8d
-	addl	%r12d,%eax
-	addl	%r12d,%r8d
+	xorl	%r15d,%r8d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%eax  // d+=T1
+	addl	%r12d,%r8d  // h+=T1
 
-	leaq	20(%rbp),%rbp
-	addl	%r14d,%r8d
+	leaq	20(%rbp),%rbp  // round++
+	addl	%r14d,%r8d  // h+=Sigma0(a)
 	movl	16(%rsi),%r12d
 	movl	%eax,%r13d
 	movl	%r8d,%r14d
@@ -226,38 +226,38 @@
 
 	xorl	%eax,%r13d
 	rorl	$9,%r14d
-	xorl	%ecx,%r15d
+	xorl	%ecx,%r15d  // f^g
 
 	movl	%r12d,16(%rsp)
 	xorl	%r8d,%r14d
-	andl	%eax,%r15d
+	andl	%eax,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%edx,%r12d
-	xorl	%ecx,%r15d
+	addl	%edx,%r12d  // T1+=h
+	xorl	%ecx,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%eax,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r8d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r8d,%r14d
 
-	xorl	%r9d,%r15d
-	rorl	$6,%r13d
+	xorl	%r9d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r9d,%edx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%edx
-	addl	%r12d,%r11d
-	addl	%r12d,%edx
+	xorl	%edi,%edx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r11d  // d+=T1
+	addl	%r12d,%edx  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%edx
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%edx  // h+=Sigma0(a)
 	movl	20(%rsi),%r12d
 	movl	%r11d,%r13d
 	movl	%edx,%r14d
@@ -267,38 +267,38 @@
 
 	xorl	%r11d,%r13d
 	rorl	$9,%r14d
-	xorl	%ebx,%edi
+	xorl	%ebx,%edi  // f^g
 
 	movl	%r12d,20(%rsp)
 	xorl	%edx,%r14d
-	andl	%r11d,%edi
+	andl	%r11d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ecx,%r12d
-	xorl	%ebx,%edi
+	addl	%ecx,%r12d  // T1+=h
+	xorl	%ebx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r11d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%edx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%edx,%r14d
 
-	xorl	%r8d,%edi
-	rorl	$6,%r13d
+	xorl	%r8d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r8d,%ecx
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%ecx
-	addl	%r12d,%r10d
-	addl	%r12d,%ecx
+	xorl	%r15d,%ecx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r10d  // d+=T1
+	addl	%r12d,%ecx  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%ecx
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%ecx  // h+=Sigma0(a)
 	movl	24(%rsi),%r12d
 	movl	%r10d,%r13d
 	movl	%ecx,%r14d
@@ -308,38 +308,38 @@
 
 	xorl	%r10d,%r13d
 	rorl	$9,%r14d
-	xorl	%eax,%r15d
+	xorl	%eax,%r15d  // f^g
 
 	movl	%r12d,24(%rsp)
 	xorl	%ecx,%r14d
-	andl	%r10d,%r15d
+	andl	%r10d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ebx,%r12d
-	xorl	%eax,%r15d
+	addl	%ebx,%r12d  // T1+=h
+	xorl	%eax,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r10d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ecx,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ecx,%r14d
 
-	xorl	%edx,%r15d
-	rorl	$6,%r13d
+	xorl	%edx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%edx,%ebx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%ebx
-	addl	%r12d,%r9d
-	addl	%r12d,%ebx
+	xorl	%edi,%ebx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r9d  // d+=T1
+	addl	%r12d,%ebx  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%ebx
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%ebx  // h+=Sigma0(a)
 	movl	28(%rsi),%r12d
 	movl	%r9d,%r13d
 	movl	%ebx,%r14d
@@ -349,38 +349,38 @@
 
 	xorl	%r9d,%r13d
 	rorl	$9,%r14d
-	xorl	%r11d,%edi
+	xorl	%r11d,%edi  // f^g
 
 	movl	%r12d,28(%rsp)
 	xorl	%ebx,%r14d
-	andl	%r9d,%edi
+	andl	%r9d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%eax,%r12d
-	xorl	%r11d,%edi
+	addl	%eax,%r12d  // T1+=h
+	xorl	%r11d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r9d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ebx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ebx,%r14d
 
-	xorl	%ecx,%edi
-	rorl	$6,%r13d
+	xorl	%ecx,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ecx,%eax
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%eax
-	addl	%r12d,%r8d
-	addl	%r12d,%eax
+	xorl	%r15d,%eax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r8d  // d+=T1
+	addl	%r12d,%eax  // h+=T1
 
-	leaq	20(%rbp),%rbp
-	addl	%r14d,%eax
+	leaq	20(%rbp),%rbp  // round++
+	addl	%r14d,%eax  // h+=Sigma0(a)
 	movl	32(%rsi),%r12d
 	movl	%r8d,%r13d
 	movl	%eax,%r14d
@@ -390,38 +390,38 @@
 
 	xorl	%r8d,%r13d
 	rorl	$9,%r14d
-	xorl	%r10d,%r15d
+	xorl	%r10d,%r15d  // f^g
 
 	movl	%r12d,32(%rsp)
 	xorl	%eax,%r14d
-	andl	%r8d,%r15d
+	andl	%r8d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r11d,%r12d
-	xorl	%r10d,%r15d
+	addl	%r11d,%r12d  // T1+=h
+	xorl	%r10d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r8d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%eax,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%eax,%r14d
 
-	xorl	%ebx,%r15d
-	rorl	$6,%r13d
+	xorl	%ebx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ebx,%r11d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r11d
-	addl	%r12d,%edx
-	addl	%r12d,%r11d
+	xorl	%edi,%r11d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%edx  // d+=T1
+	addl	%r12d,%r11d  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%r11d
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%r11d  // h+=Sigma0(a)
 	movl	36(%rsi),%r12d
 	movl	%edx,%r13d
 	movl	%r11d,%r14d
@@ -431,38 +431,38 @@
 
 	xorl	%edx,%r13d
 	rorl	$9,%r14d
-	xorl	%r9d,%edi
+	xorl	%r9d,%edi  // f^g
 
 	movl	%r12d,36(%rsp)
 	xorl	%r11d,%r14d
-	andl	%edx,%edi
+	andl	%edx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r10d,%r12d
-	xorl	%r9d,%edi
+	addl	%r10d,%r12d  // T1+=h
+	xorl	%r9d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%edx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r11d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r11d,%r14d
 
-	xorl	%eax,%edi
-	rorl	$6,%r13d
+	xorl	%eax,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%eax,%r10d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r10d
-	addl	%r12d,%ecx
-	addl	%r12d,%r10d
+	xorl	%r15d,%r10d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ecx  // d+=T1
+	addl	%r12d,%r10d  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%r10d
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%r10d  // h+=Sigma0(a)
 	movl	40(%rsi),%r12d
 	movl	%ecx,%r13d
 	movl	%r10d,%r14d
@@ -472,38 +472,38 @@
 
 	xorl	%ecx,%r13d
 	rorl	$9,%r14d
-	xorl	%r8d,%r15d
+	xorl	%r8d,%r15d  // f^g
 
 	movl	%r12d,40(%rsp)
 	xorl	%r10d,%r14d
-	andl	%ecx,%r15d
+	andl	%ecx,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r9d,%r12d
-	xorl	%r8d,%r15d
+	addl	%r9d,%r12d  // T1+=h
+	xorl	%r8d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ecx,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r10d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r10d,%r14d
 
-	xorl	%r11d,%r15d
-	rorl	$6,%r13d
+	xorl	%r11d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r11d,%r9d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r9d
-	addl	%r12d,%ebx
-	addl	%r12d,%r9d
+	xorl	%edi,%r9d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ebx  // d+=T1
+	addl	%r12d,%r9d  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%r9d
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%r9d  // h+=Sigma0(a)
 	movl	44(%rsi),%r12d
 	movl	%ebx,%r13d
 	movl	%r9d,%r14d
@@ -513,38 +513,38 @@
 
 	xorl	%ebx,%r13d
 	rorl	$9,%r14d
-	xorl	%edx,%edi
+	xorl	%edx,%edi  // f^g
 
 	movl	%r12d,44(%rsp)
 	xorl	%r9d,%r14d
-	andl	%ebx,%edi
+	andl	%ebx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r8d,%r12d
-	xorl	%edx,%edi
+	addl	%r8d,%r12d  // T1+=h
+	xorl	%edx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ebx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r9d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r9d,%r14d
 
-	xorl	%r10d,%edi
-	rorl	$6,%r13d
+	xorl	%r10d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r10d,%r8d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r8d
-	addl	%r12d,%eax
-	addl	%r12d,%r8d
+	xorl	%r15d,%r8d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%eax  // d+=T1
+	addl	%r12d,%r8d  // h+=T1
 
-	leaq	20(%rbp),%rbp
-	addl	%r14d,%r8d
+	leaq	20(%rbp),%rbp  // round++
+	addl	%r14d,%r8d  // h+=Sigma0(a)
 	movl	48(%rsi),%r12d
 	movl	%eax,%r13d
 	movl	%r8d,%r14d
@@ -554,38 +554,38 @@
 
 	xorl	%eax,%r13d
 	rorl	$9,%r14d
-	xorl	%ecx,%r15d
+	xorl	%ecx,%r15d  // f^g
 
 	movl	%r12d,48(%rsp)
 	xorl	%r8d,%r14d
-	andl	%eax,%r15d
+	andl	%eax,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%edx,%r12d
-	xorl	%ecx,%r15d
+	addl	%edx,%r12d  // T1+=h
+	xorl	%ecx,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%eax,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r8d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r8d,%r14d
 
-	xorl	%r9d,%r15d
-	rorl	$6,%r13d
+	xorl	%r9d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r9d,%edx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%edx
-	addl	%r12d,%r11d
-	addl	%r12d,%edx
+	xorl	%edi,%edx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r11d  // d+=T1
+	addl	%r12d,%edx  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%edx
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%edx  // h+=Sigma0(a)
 	movl	52(%rsi),%r12d
 	movl	%r11d,%r13d
 	movl	%edx,%r14d
@@ -595,38 +595,38 @@
 
 	xorl	%r11d,%r13d
 	rorl	$9,%r14d
-	xorl	%ebx,%edi
+	xorl	%ebx,%edi  // f^g
 
 	movl	%r12d,52(%rsp)
 	xorl	%edx,%r14d
-	andl	%r11d,%edi
+	andl	%r11d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ecx,%r12d
-	xorl	%ebx,%edi
+	addl	%ecx,%r12d  // T1+=h
+	xorl	%ebx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r11d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%edx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%edx,%r14d
 
-	xorl	%r8d,%edi
-	rorl	$6,%r13d
+	xorl	%r8d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r8d,%ecx
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%ecx
-	addl	%r12d,%r10d
-	addl	%r12d,%ecx
+	xorl	%r15d,%ecx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r10d  // d+=T1
+	addl	%r12d,%ecx  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%ecx
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%ecx  // h+=Sigma0(a)
 	movl	56(%rsi),%r12d
 	movl	%r10d,%r13d
 	movl	%ecx,%r14d
@@ -636,38 +636,38 @@
 
 	xorl	%r10d,%r13d
 	rorl	$9,%r14d
-	xorl	%eax,%r15d
+	xorl	%eax,%r15d  // f^g
 
 	movl	%r12d,56(%rsp)
 	xorl	%ecx,%r14d
-	andl	%r10d,%r15d
+	andl	%r10d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ebx,%r12d
-	xorl	%eax,%r15d
+	addl	%ebx,%r12d  // T1+=h
+	xorl	%eax,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r10d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ecx,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ecx,%r14d
 
-	xorl	%edx,%r15d
-	rorl	$6,%r13d
+	xorl	%edx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%edx,%ebx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%ebx
-	addl	%r12d,%r9d
-	addl	%r12d,%ebx
+	xorl	%edi,%ebx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r9d  // d+=T1
+	addl	%r12d,%ebx  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%ebx
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%ebx  // h+=Sigma0(a)
 	movl	60(%rsi),%r12d
 	movl	%r9d,%r13d
 	movl	%ebx,%r14d
@@ -677,37 +677,37 @@
 
 	xorl	%r9d,%r13d
 	rorl	$9,%r14d
-	xorl	%r11d,%edi
+	xorl	%r11d,%edi  // f^g
 
 	movl	%r12d,60(%rsp)
 	xorl	%ebx,%r14d
-	andl	%r9d,%edi
+	andl	%r9d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%eax,%r12d
-	xorl	%r11d,%edi
+	addl	%eax,%r12d  // T1+=h
+	xorl	%r11d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r9d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ebx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ebx,%r14d
 
-	xorl	%ecx,%edi
-	rorl	$6,%r13d
+	xorl	%ecx,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ecx,%eax
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%eax
-	addl	%r12d,%r8d
-	addl	%r12d,%eax
+	xorl	%r15d,%eax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r8d  // d+=T1
+	addl	%r12d,%eax  // h+=T1
 
-	leaq	20(%rbp),%rbp
+	leaq	20(%rbp),%rbp  // round++
 	jmp	L$rounds_16_xx
 .p2align	4
 L$rounds_16_xx:
@@ -716,7 +716,7 @@
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%eax
+	addl	%r14d,%eax  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -727,8 +727,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	36(%rsp),%r12d
 
 	addl	0(%rsp),%r12d
@@ -740,43 +740,43 @@
 
 	xorl	%r8d,%r13d
 	rorl	$9,%r14d
-	xorl	%r10d,%r15d
+	xorl	%r10d,%r15d  // f^g
 
 	movl	%r12d,0(%rsp)
 	xorl	%eax,%r14d
-	andl	%r8d,%r15d
+	andl	%r8d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r11d,%r12d
-	xorl	%r10d,%r15d
+	addl	%r11d,%r12d  // T1+=h
+	xorl	%r10d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r8d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%eax,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%eax,%r14d
 
-	xorl	%ebx,%r15d
-	rorl	$6,%r13d
+	xorl	%ebx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ebx,%r11d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r11d
-	addl	%r12d,%edx
-	addl	%r12d,%r11d
+	xorl	%edi,%r11d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%edx  // d+=T1
+	addl	%r12d,%r11d  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	8(%rsp),%r13d
 	movl	60(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r11d
+	addl	%r14d,%r11d  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -787,8 +787,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	40(%rsp),%r12d
 
 	addl	4(%rsp),%r12d
@@ -800,43 +800,43 @@
 
 	xorl	%edx,%r13d
 	rorl	$9,%r14d
-	xorl	%r9d,%edi
+	xorl	%r9d,%edi  // f^g
 
 	movl	%r12d,4(%rsp)
 	xorl	%r11d,%r14d
-	andl	%edx,%edi
+	andl	%edx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r10d,%r12d
-	xorl	%r9d,%edi
+	addl	%r10d,%r12d  // T1+=h
+	xorl	%r9d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%edx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r11d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r11d,%r14d
 
-	xorl	%eax,%edi
-	rorl	$6,%r13d
+	xorl	%eax,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%eax,%r10d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r10d
-	addl	%r12d,%ecx
-	addl	%r12d,%r10d
+	xorl	%r15d,%r10d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ecx  // d+=T1
+	addl	%r12d,%r10d  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	12(%rsp),%r13d
 	movl	0(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r10d
+	addl	%r14d,%r10d  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -847,8 +847,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	44(%rsp),%r12d
 
 	addl	8(%rsp),%r12d
@@ -860,43 +860,43 @@
 
 	xorl	%ecx,%r13d
 	rorl	$9,%r14d
-	xorl	%r8d,%r15d
+	xorl	%r8d,%r15d  // f^g
 
 	movl	%r12d,8(%rsp)
 	xorl	%r10d,%r14d
-	andl	%ecx,%r15d
+	andl	%ecx,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r9d,%r12d
-	xorl	%r8d,%r15d
+	addl	%r9d,%r12d  // T1+=h
+	xorl	%r8d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ecx,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r10d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r10d,%r14d
 
-	xorl	%r11d,%r15d
-	rorl	$6,%r13d
+	xorl	%r11d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r11d,%r9d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r9d
-	addl	%r12d,%ebx
-	addl	%r12d,%r9d
+	xorl	%edi,%r9d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ebx  // d+=T1
+	addl	%r12d,%r9d  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	16(%rsp),%r13d
 	movl	4(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r9d
+	addl	%r14d,%r9d  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -907,8 +907,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	48(%rsp),%r12d
 
 	addl	12(%rsp),%r12d
@@ -920,43 +920,43 @@
 
 	xorl	%ebx,%r13d
 	rorl	$9,%r14d
-	xorl	%edx,%edi
+	xorl	%edx,%edi  // f^g
 
 	movl	%r12d,12(%rsp)
 	xorl	%r9d,%r14d
-	andl	%ebx,%edi
+	andl	%ebx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r8d,%r12d
-	xorl	%edx,%edi
+	addl	%r8d,%r12d  // T1+=h
+	xorl	%edx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ebx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r9d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r9d,%r14d
 
-	xorl	%r10d,%edi
-	rorl	$6,%r13d
+	xorl	%r10d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r10d,%r8d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r8d
-	addl	%r12d,%eax
-	addl	%r12d,%r8d
+	xorl	%r15d,%r8d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%eax  // d+=T1
+	addl	%r12d,%r8d  // h+=T1
 
-	leaq	20(%rbp),%rbp
+	leaq	20(%rbp),%rbp  // round++
 	movl	20(%rsp),%r13d
 	movl	8(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r8d
+	addl	%r14d,%r8d  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -967,8 +967,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	52(%rsp),%r12d
 
 	addl	16(%rsp),%r12d
@@ -980,43 +980,43 @@
 
 	xorl	%eax,%r13d
 	rorl	$9,%r14d
-	xorl	%ecx,%r15d
+	xorl	%ecx,%r15d  // f^g
 
 	movl	%r12d,16(%rsp)
 	xorl	%r8d,%r14d
-	andl	%eax,%r15d
+	andl	%eax,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%edx,%r12d
-	xorl	%ecx,%r15d
+	addl	%edx,%r12d  // T1+=h
+	xorl	%ecx,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%eax,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r8d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r8d,%r14d
 
-	xorl	%r9d,%r15d
-	rorl	$6,%r13d
+	xorl	%r9d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r9d,%edx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%edx
-	addl	%r12d,%r11d
-	addl	%r12d,%edx
+	xorl	%edi,%edx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r11d  // d+=T1
+	addl	%r12d,%edx  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	24(%rsp),%r13d
 	movl	12(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%edx
+	addl	%r14d,%edx  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -1027,8 +1027,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	56(%rsp),%r12d
 
 	addl	20(%rsp),%r12d
@@ -1040,43 +1040,43 @@
 
 	xorl	%r11d,%r13d
 	rorl	$9,%r14d
-	xorl	%ebx,%edi
+	xorl	%ebx,%edi  // f^g
 
 	movl	%r12d,20(%rsp)
 	xorl	%edx,%r14d
-	andl	%r11d,%edi
+	andl	%r11d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ecx,%r12d
-	xorl	%ebx,%edi
+	addl	%ecx,%r12d  // T1+=h
+	xorl	%ebx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r11d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%edx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%edx,%r14d
 
-	xorl	%r8d,%edi
-	rorl	$6,%r13d
+	xorl	%r8d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r8d,%ecx
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%ecx
-	addl	%r12d,%r10d
-	addl	%r12d,%ecx
+	xorl	%r15d,%ecx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r10d  // d+=T1
+	addl	%r12d,%ecx  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	28(%rsp),%r13d
 	movl	16(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%ecx
+	addl	%r14d,%ecx  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -1087,8 +1087,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	60(%rsp),%r12d
 
 	addl	24(%rsp),%r12d
@@ -1100,43 +1100,43 @@
 
 	xorl	%r10d,%r13d
 	rorl	$9,%r14d
-	xorl	%eax,%r15d
+	xorl	%eax,%r15d  // f^g
 
 	movl	%r12d,24(%rsp)
 	xorl	%ecx,%r14d
-	andl	%r10d,%r15d
+	andl	%r10d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ebx,%r12d
-	xorl	%eax,%r15d
+	addl	%ebx,%r12d  // T1+=h
+	xorl	%eax,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r10d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ecx,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ecx,%r14d
 
-	xorl	%edx,%r15d
-	rorl	$6,%r13d
+	xorl	%edx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%edx,%ebx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%ebx
-	addl	%r12d,%r9d
-	addl	%r12d,%ebx
+	xorl	%edi,%ebx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r9d  // d+=T1
+	addl	%r12d,%ebx  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	32(%rsp),%r13d
 	movl	20(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%ebx
+	addl	%r14d,%ebx  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -1147,8 +1147,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	0(%rsp),%r12d
 
 	addl	28(%rsp),%r12d
@@ -1160,43 +1160,43 @@
 
 	xorl	%r9d,%r13d
 	rorl	$9,%r14d
-	xorl	%r11d,%edi
+	xorl	%r11d,%edi  // f^g
 
 	movl	%r12d,28(%rsp)
 	xorl	%ebx,%r14d
-	andl	%r9d,%edi
+	andl	%r9d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%eax,%r12d
-	xorl	%r11d,%edi
+	addl	%eax,%r12d  // T1+=h
+	xorl	%r11d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r9d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ebx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ebx,%r14d
 
-	xorl	%ecx,%edi
-	rorl	$6,%r13d
+	xorl	%ecx,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ecx,%eax
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%eax
-	addl	%r12d,%r8d
-	addl	%r12d,%eax
+	xorl	%r15d,%eax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r8d  // d+=T1
+	addl	%r12d,%eax  // h+=T1
 
-	leaq	20(%rbp),%rbp
+	leaq	20(%rbp),%rbp  // round++
 	movl	36(%rsp),%r13d
 	movl	24(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%eax
+	addl	%r14d,%eax  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -1207,8 +1207,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	4(%rsp),%r12d
 
 	addl	32(%rsp),%r12d
@@ -1220,43 +1220,43 @@
 
 	xorl	%r8d,%r13d
 	rorl	$9,%r14d
-	xorl	%r10d,%r15d
+	xorl	%r10d,%r15d  // f^g
 
 	movl	%r12d,32(%rsp)
 	xorl	%eax,%r14d
-	andl	%r8d,%r15d
+	andl	%r8d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r11d,%r12d
-	xorl	%r10d,%r15d
+	addl	%r11d,%r12d  // T1+=h
+	xorl	%r10d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r8d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%eax,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%eax,%r14d
 
-	xorl	%ebx,%r15d
-	rorl	$6,%r13d
+	xorl	%ebx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ebx,%r11d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r11d
-	addl	%r12d,%edx
-	addl	%r12d,%r11d
+	xorl	%edi,%r11d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%edx  // d+=T1
+	addl	%r12d,%r11d  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	40(%rsp),%r13d
 	movl	28(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r11d
+	addl	%r14d,%r11d  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -1267,8 +1267,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	8(%rsp),%r12d
 
 	addl	36(%rsp),%r12d
@@ -1280,43 +1280,43 @@
 
 	xorl	%edx,%r13d
 	rorl	$9,%r14d
-	xorl	%r9d,%edi
+	xorl	%r9d,%edi  // f^g
 
 	movl	%r12d,36(%rsp)
 	xorl	%r11d,%r14d
-	andl	%edx,%edi
+	andl	%edx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r10d,%r12d
-	xorl	%r9d,%edi
+	addl	%r10d,%r12d  // T1+=h
+	xorl	%r9d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%edx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r11d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r11d,%r14d
 
-	xorl	%eax,%edi
-	rorl	$6,%r13d
+	xorl	%eax,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%eax,%r10d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r10d
-	addl	%r12d,%ecx
-	addl	%r12d,%r10d
+	xorl	%r15d,%r10d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ecx  // d+=T1
+	addl	%r12d,%r10d  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	44(%rsp),%r13d
 	movl	32(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r10d
+	addl	%r14d,%r10d  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -1327,8 +1327,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	12(%rsp),%r12d
 
 	addl	40(%rsp),%r12d
@@ -1340,43 +1340,43 @@
 
 	xorl	%ecx,%r13d
 	rorl	$9,%r14d
-	xorl	%r8d,%r15d
+	xorl	%r8d,%r15d  // f^g
 
 	movl	%r12d,40(%rsp)
 	xorl	%r10d,%r14d
-	andl	%ecx,%r15d
+	andl	%ecx,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r9d,%r12d
-	xorl	%r8d,%r15d
+	addl	%r9d,%r12d  // T1+=h
+	xorl	%r8d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ecx,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r10d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r10d,%r14d
 
-	xorl	%r11d,%r15d
-	rorl	$6,%r13d
+	xorl	%r11d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r11d,%r9d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r9d
-	addl	%r12d,%ebx
-	addl	%r12d,%r9d
+	xorl	%edi,%r9d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ebx  // d+=T1
+	addl	%r12d,%r9d  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	48(%rsp),%r13d
 	movl	36(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r9d
+	addl	%r14d,%r9d  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -1387,8 +1387,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	16(%rsp),%r12d
 
 	addl	44(%rsp),%r12d
@@ -1400,43 +1400,43 @@
 
 	xorl	%ebx,%r13d
 	rorl	$9,%r14d
-	xorl	%edx,%edi
+	xorl	%edx,%edi  // f^g
 
 	movl	%r12d,44(%rsp)
 	xorl	%r9d,%r14d
-	andl	%ebx,%edi
+	andl	%ebx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r8d,%r12d
-	xorl	%edx,%edi
+	addl	%r8d,%r12d  // T1+=h
+	xorl	%edx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ebx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r9d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r9d,%r14d
 
-	xorl	%r10d,%edi
-	rorl	$6,%r13d
+	xorl	%r10d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r10d,%r8d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r8d
-	addl	%r12d,%eax
-	addl	%r12d,%r8d
+	xorl	%r15d,%r8d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%eax  // d+=T1
+	addl	%r12d,%r8d  // h+=T1
 
-	leaq	20(%rbp),%rbp
+	leaq	20(%rbp),%rbp  // round++
 	movl	52(%rsp),%r13d
 	movl	40(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r8d
+	addl	%r14d,%r8d  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -1447,8 +1447,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	20(%rsp),%r12d
 
 	addl	48(%rsp),%r12d
@@ -1460,43 +1460,43 @@
 
 	xorl	%eax,%r13d
 	rorl	$9,%r14d
-	xorl	%ecx,%r15d
+	xorl	%ecx,%r15d  // f^g
 
 	movl	%r12d,48(%rsp)
 	xorl	%r8d,%r14d
-	andl	%eax,%r15d
+	andl	%eax,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%edx,%r12d
-	xorl	%ecx,%r15d
+	addl	%edx,%r12d  // T1+=h
+	xorl	%ecx,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%eax,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r8d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r8d,%r14d
 
-	xorl	%r9d,%r15d
-	rorl	$6,%r13d
+	xorl	%r9d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r9d,%edx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%edx
-	addl	%r12d,%r11d
-	addl	%r12d,%edx
+	xorl	%edi,%edx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r11d  // d+=T1
+	addl	%r12d,%edx  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	56(%rsp),%r13d
 	movl	44(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%edx
+	addl	%r14d,%edx  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -1507,8 +1507,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	24(%rsp),%r12d
 
 	addl	52(%rsp),%r12d
@@ -1520,43 +1520,43 @@
 
 	xorl	%r11d,%r13d
 	rorl	$9,%r14d
-	xorl	%ebx,%edi
+	xorl	%ebx,%edi  // f^g
 
 	movl	%r12d,52(%rsp)
 	xorl	%edx,%r14d
-	andl	%r11d,%edi
+	andl	%r11d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ecx,%r12d
-	xorl	%ebx,%edi
+	addl	%ecx,%r12d  // T1+=h
+	xorl	%ebx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r11d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%edx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%edx,%r14d
 
-	xorl	%r8d,%edi
-	rorl	$6,%r13d
+	xorl	%r8d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r8d,%ecx
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%ecx
-	addl	%r12d,%r10d
-	addl	%r12d,%ecx
+	xorl	%r15d,%ecx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r10d  // d+=T1
+	addl	%r12d,%ecx  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	60(%rsp),%r13d
 	movl	48(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%ecx
+	addl	%r14d,%ecx  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -1567,8 +1567,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	28(%rsp),%r12d
 
 	addl	56(%rsp),%r12d
@@ -1580,43 +1580,43 @@
 
 	xorl	%r10d,%r13d
 	rorl	$9,%r14d
-	xorl	%eax,%r15d
+	xorl	%eax,%r15d  // f^g
 
 	movl	%r12d,56(%rsp)
 	xorl	%ecx,%r14d
-	andl	%r10d,%r15d
+	andl	%r10d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ebx,%r12d
-	xorl	%eax,%r15d
+	addl	%ebx,%r12d  // T1+=h
+	xorl	%eax,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r10d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ecx,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ecx,%r14d
 
-	xorl	%edx,%r15d
-	rorl	$6,%r13d
+	xorl	%edx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%edx,%ebx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%ebx
-	addl	%r12d,%r9d
-	addl	%r12d,%ebx
+	xorl	%edi,%ebx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r9d  // d+=T1
+	addl	%r12d,%ebx  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	0(%rsp),%r13d
 	movl	52(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%ebx
+	addl	%r14d,%ebx  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -1627,8 +1627,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	32(%rsp),%r12d
 
 	addl	60(%rsp),%r12d
@@ -1640,42 +1640,42 @@
 
 	xorl	%r9d,%r13d
 	rorl	$9,%r14d
-	xorl	%r11d,%edi
+	xorl	%r11d,%edi  // f^g
 
 	movl	%r12d,60(%rsp)
 	xorl	%ebx,%r14d
-	andl	%r9d,%edi
+	andl	%r9d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%eax,%r12d
-	xorl	%r11d,%edi
+	addl	%eax,%r12d  // T1+=h
+	xorl	%r11d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r9d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ebx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ebx,%r14d
 
-	xorl	%ecx,%edi
-	rorl	$6,%r13d
+	xorl	%ecx,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ecx,%eax
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%eax
-	addl	%r12d,%r8d
-	addl	%r12d,%eax
+	xorl	%r15d,%eax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r8d  // d+=T1
+	addl	%r12d,%eax  // h+=T1
 
-	leaq	20(%rbp),%rbp
+	leaq	20(%rbp),%rbp  // round++
 	cmpb	$0,3(%rbp)
 	jnz	L$rounds_16_xx
 
 	movq	64+0(%rsp),%rdi
-	addl	%r14d,%eax
+	addl	%r14d,%eax  // modulo-scheduled h+=Sigma0(a)
 	leaq	64(%rsi),%rsi
 
 	addl	0(%rdi),%eax
@@ -1773,16 +1773,16 @@
 
 _CET_ENDBR
 	leaq	K256+128(%rip),%rcx
-	movdqu	(%rdi),%xmm1
-	movdqu	16(%rdi),%xmm2
-	movdqa	512-128(%rcx),%xmm7
-
-	pshufd	$0x1b,%xmm1,%xmm0
-	pshufd	$0xb1,%xmm1,%xmm1
-	pshufd	$0x1b,%xmm2,%xmm2
-	movdqa	%xmm7,%xmm8
-	palignr	$8,%xmm2,%xmm1
-	punpcklqdq	%xmm0,%xmm2
+	movdqu	(%rdi),%xmm1  // DCBA
+	movdqu	16(%rdi),%xmm2  // HGFE
+	movdqa	512-128(%rcx),%xmm7  // byte swap mask
+
+	pshufd	$0x1b,%xmm1,%xmm0  // ABCD
+	pshufd	$0xb1,%xmm1,%xmm1  // CDAB
+	pshufd	$0x1b,%xmm2,%xmm2  // EFGH
+	movdqa	%xmm7,%xmm8  // offload
+	palignr	$8,%xmm2,%xmm1  // ABEF
+	punpcklqdq	%xmm0,%xmm2  // CDGH
 	jmp	L$oop_shaext
 
 .p2align	4
@@ -1796,17 +1796,17 @@
 	movdqa	0-128(%rcx),%xmm0
 	paddd	%xmm3,%xmm0
 	pshufb	%xmm7,%xmm4
-	movdqa	%xmm2,%xmm10
-	sha256rnds2	%xmm1,%xmm2
+	movdqa	%xmm2,%xmm10  // offload
+	sha256rnds2	%xmm1,%xmm2  // 0-3
 	pshufd	$0x0e,%xmm0,%xmm0
 	nop
-	movdqa	%xmm1,%xmm9
+	movdqa	%xmm1,%xmm9  // offload
 	sha256rnds2	%xmm2,%xmm1
 
 	movdqa	32-128(%rcx),%xmm0
 	paddd	%xmm4,%xmm0
 	pshufb	%xmm7,%xmm5
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 4-7
 	pshufd	$0x0e,%xmm0,%xmm0
 	leaq	64(%rsi),%rsi
 	sha256msg1	%xmm4,%xmm3
@@ -1815,7 +1815,7 @@
 	movdqa	64-128(%rcx),%xmm0
 	paddd	%xmm5,%xmm0
 	pshufb	%xmm7,%xmm6
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 8-11
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm6,%xmm7
 	palignr	$4,%xmm5,%xmm7
@@ -1827,7 +1827,7 @@
 	movdqa	96-128(%rcx),%xmm0
 	paddd	%xmm6,%xmm0
 	sha256msg2	%xmm6,%xmm3
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 12-15
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm3,%xmm7
 	palignr	$4,%xmm6,%xmm7
@@ -1838,7 +1838,7 @@
 	movdqa	128-128(%rcx),%xmm0
 	paddd	%xmm3,%xmm0
 	sha256msg2	%xmm3,%xmm4
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm4,%xmm7
 	palignr	$4,%xmm3,%xmm7
@@ -1849,7 +1849,7 @@
 	movdqa	160-128(%rcx),%xmm0
 	paddd	%xmm4,%xmm0
 	sha256msg2	%xmm4,%xmm5
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm5,%xmm7
 	palignr	$4,%xmm4,%xmm7
@@ -1860,7 +1860,7 @@
 	movdqa	192-128(%rcx),%xmm0
 	paddd	%xmm5,%xmm0
 	sha256msg2	%xmm5,%xmm6
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm6,%xmm7
 	palignr	$4,%xmm5,%xmm7
@@ -1871,7 +1871,7 @@
 	movdqa	224-128(%rcx),%xmm0
 	paddd	%xmm6,%xmm0
 	sha256msg2	%xmm6,%xmm3
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm3,%xmm7
 	palignr	$4,%xmm6,%xmm7
@@ -1882,7 +1882,7 @@
 	movdqa	256-128(%rcx),%xmm0
 	paddd	%xmm3,%xmm0
 	sha256msg2	%xmm3,%xmm4
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm4,%xmm7
 	palignr	$4,%xmm3,%xmm7
@@ -1893,7 +1893,7 @@
 	movdqa	288-128(%rcx),%xmm0
 	paddd	%xmm4,%xmm0
 	sha256msg2	%xmm4,%xmm5
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm5,%xmm7
 	palignr	$4,%xmm4,%xmm7
@@ -1904,7 +1904,7 @@
 	movdqa	320-128(%rcx),%xmm0
 	paddd	%xmm5,%xmm0
 	sha256msg2	%xmm5,%xmm6
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm6,%xmm7
 	palignr	$4,%xmm5,%xmm7
@@ -1915,7 +1915,7 @@
 	movdqa	352-128(%rcx),%xmm0
 	paddd	%xmm6,%xmm0
 	sha256msg2	%xmm6,%xmm3
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm3,%xmm7
 	palignr	$4,%xmm6,%xmm7
@@ -1926,7 +1926,7 @@
 	movdqa	384-128(%rcx),%xmm0
 	paddd	%xmm3,%xmm0
 	sha256msg2	%xmm3,%xmm4
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm4,%xmm7
 	palignr	$4,%xmm3,%xmm7
@@ -1937,7 +1937,7 @@
 	movdqa	416-128(%rcx),%xmm0
 	paddd	%xmm4,%xmm0
 	sha256msg2	%xmm4,%xmm5
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 52-55
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm5,%xmm7
 	palignr	$4,%xmm4,%xmm7
@@ -1946,7 +1946,7 @@
 
 	movdqa	448-128(%rcx),%xmm0
 	paddd	%xmm5,%xmm0
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 56-59
 	pshufd	$0x0e,%xmm0,%xmm0
 	sha256msg2	%xmm5,%xmm6
 	movdqa	%xmm8,%xmm7
@@ -1955,7 +1955,7 @@
 	movdqa	480-128(%rcx),%xmm0
 	paddd	%xmm6,%xmm0
 	nop
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 60-63
 	pshufd	$0x0e,%xmm0,%xmm0
 	decq	%rdx
 	nop
@@ -1965,11 +1965,11 @@
 	paddd	%xmm9,%xmm1
 	jnz	L$oop_shaext
 
-	pshufd	$0xb1,%xmm2,%xmm2
-	pshufd	$0x1b,%xmm1,%xmm7
-	pshufd	$0xb1,%xmm1,%xmm1
-	punpckhqdq	%xmm2,%xmm1
-	palignr	$8,%xmm7,%xmm2
+	pshufd	$0xb1,%xmm2,%xmm2  // DCHG
+	pshufd	$0x1b,%xmm1,%xmm7  // FEBA
+	pshufd	$0xb1,%xmm1,%xmm1  // BAFE
+	punpckhqdq	%xmm2,%xmm1  // DCBA
+	palignr	$8,%xmm7,%xmm2  // HGFE
 
 	movdqu	%xmm1,(%rdi)
 	movdqu	%xmm2,16(%rdi)
@@ -1984,7 +1984,7 @@
 _sha256_block_data_order_ssse3:
 
 _CET_ENDBR
-	movq	%rsp,%rax
+	movq	%rsp,%rax  // copy %rsp
 
 	pushq	%rbx
 
@@ -1998,14 +1998,14 @@
 
 	pushq	%r15
 
-	shlq	$4,%rdx
+	shlq	$4,%rdx  // num*16
 	subq	$96,%rsp
-	leaq	(%rsi,%rdx,4),%rdx
-	andq	$-64,%rsp
-	movq	%rdi,64+0(%rsp)
-	movq	%rsi,64+8(%rsp)
-	movq	%rdx,64+16(%rsp)
-	movq	%rax,88(%rsp)
+	leaq	(%rsi,%rdx,4),%rdx  // inp+num*16*4
+	andq	$-64,%rsp  // align stack frame
+	movq	%rdi,64+0(%rsp)  // save ctx, 1st arg
+	movq	%rsi,64+8(%rsp)  // save inp, 2nd arh
+	movq	%rdx,64+16(%rsp)  // save end pointer, "3rd" arg
+	movq	%rax,88(%rsp)  // save copy of %rsp
 
 L$prologue_ssse3:
 
@@ -2017,8 +2017,8 @@
 	movl	20(%rdi),%r9d
 	movl	24(%rdi),%r10d
 	movl	28(%rdi),%r11d
-
-
+// movdqa	K256+512+32(%rip),%xmm8
+// movdqa	K256+512+64(%rip),%xmm9
 	jmp	L$loop_ssse3
 .p2align	4
 L$loop_ssse3:
@@ -2045,14 +2045,14 @@
 	movdqa	%xmm5,16(%rsp)
 	movl	%ebx,%edi
 	movdqa	%xmm6,32(%rsp)
-	xorl	%ecx,%edi
+	xorl	%ecx,%edi  // magic
 	movdqa	%xmm7,48(%rsp)
 	movl	%r8d,%r13d
 	jmp	L$ssse3_00_47
 
 .p2align	4
 L$ssse3_00_47:
-	subq	$-128,%rbp
+	subq	$-128,%rbp  // size optimization
 	rorl	$14,%r13d
 	movdqa	%xmm1,%xmm4
 	movl	%r14d,%eax
@@ -3100,7 +3100,7 @@
 _sha256_block_data_order_avx:
 
 _CET_ENDBR
-	movq	%rsp,%rax
+	movq	%rsp,%rax  // copy %rsp
 
 	pushq	%rbx
 
@@ -3114,14 +3114,14 @@
 
 	pushq	%r15
 
-	shlq	$4,%rdx
+	shlq	$4,%rdx  // num*16
 	subq	$96,%rsp
-	leaq	(%rsi,%rdx,4),%rdx
-	andq	$-64,%rsp
-	movq	%rdi,64+0(%rsp)
-	movq	%rsi,64+8(%rsp)
-	movq	%rdx,64+16(%rsp)
-	movq	%rax,88(%rsp)
+	leaq	(%rsi,%rdx,4),%rdx  // inp+num*16*4
+	andq	$-64,%rsp  // align stack frame
+	movq	%rdi,64+0(%rsp)  // save ctx, 1st arg
+	movq	%rsi,64+8(%rsp)  // save inp, 2nd arh
+	movq	%rdx,64+16(%rsp)  // save end pointer, "3rd" arg
+	movq	%rax,88(%rsp)  // save copy of %rsp
 
 L$prologue_avx:
 
@@ -3158,14 +3158,14 @@
 	vmovdqa	%xmm5,16(%rsp)
 	movl	%ebx,%edi
 	vmovdqa	%xmm6,32(%rsp)
-	xorl	%ecx,%edi
+	xorl	%ecx,%edi  // magic
 	vmovdqa	%xmm7,48(%rsp)
 	movl	%r8d,%r13d
 	jmp	L$avx_00_47
 
 .p2align	4
 L$avx_00_47:
-	subq	$-128,%rbp
+	subq	$-128,%rbp  // size optimization
 	vpalignr	$4,%xmm0,%xmm1,%xmm4
 	shrdl	$14,%r13d,%r13d
 	movl	%r14d,%eax

boringssl-0.20260708.tar.xz/gen/bcm/sha256-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/sha256-x86_64-linux.S Changed

@@ -13,7 +13,7 @@
 sha256_block_data_order_nohw:
 .cfi_startproc	
 _CET_ENDBR
-	movq	%rsp,%rax
+	movq	%rsp,%rax  // copy %rsp
 .cfi_def_cfa_register	%rax
 	pushq	%rbx
 .cfi_offset	%rbx,-16
@@ -27,14 +27,14 @@
 .cfi_offset	%r14,-48
 	pushq	%r15
 .cfi_offset	%r15,-56
-	shlq	$4,%rdx
+	shlq	$4,%rdx  // num*16
 	subq	$64+32,%rsp
-	leaq	(%rsi,%rdx,4),%rdx
-	andq	$-64,%rsp
-	movq	%rdi,64+0(%rsp)
-	movq	%rsi,64+8(%rsp)
-	movq	%rdx,64+16(%rsp)
-	movq	%rax,88(%rsp)
+	leaq	(%rsi,%rdx,4),%rdx  // inp+num*16*4
+	andq	$-64,%rsp  // align stack frame
+	movq	%rdi,64+0(%rsp)  // save ctx, 1st arg
+	movq	%rsi,64+8(%rsp)  // save inp, 2nd arh
+	movq	%rdx,64+16(%rsp)  // save end pointer, "3rd" arg
+	movq	%rax,88(%rsp)  // save copy of %rsp
 .cfi_escape	0x0f,0x06,0x77,0xd8,0x00,0x06,0x23,0x08
 .Lprologue:
 
@@ -52,7 +52,7 @@
 .Lloop:
 	movl	%ebx,%edi
 	leaq	K256(%rip),%rbp
-	xorl	%ecx,%edi
+	xorl	%ecx,%edi  // magic
 	movl	0(%rsi),%r12d
 	movl	%r8d,%r13d
 	movl	%eax,%r14d
@@ -62,38 +62,38 @@
 
 	xorl	%r8d,%r13d
 	rorl	$9,%r14d
-	xorl	%r10d,%r15d
+	xorl	%r10d,%r15d  // f^g
 
 	movl	%r12d,0(%rsp)
 	xorl	%eax,%r14d
-	andl	%r8d,%r15d
+	andl	%r8d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r11d,%r12d
-	xorl	%r10d,%r15d
+	addl	%r11d,%r12d  // T1+=h
+	xorl	%r10d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r8d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%eax,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%eax,%r14d
 
-	xorl	%ebx,%r15d
-	rorl	$6,%r13d
+	xorl	%ebx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ebx,%r11d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r11d
-	addl	%r12d,%edx
-	addl	%r12d,%r11d
+	xorl	%edi,%r11d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%edx  // d+=T1
+	addl	%r12d,%r11d  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%r11d
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%r11d  // h+=Sigma0(a)
 	movl	4(%rsi),%r12d
 	movl	%edx,%r13d
 	movl	%r11d,%r14d
@@ -103,38 +103,38 @@
 
 	xorl	%edx,%r13d
 	rorl	$9,%r14d
-	xorl	%r9d,%edi
+	xorl	%r9d,%edi  // f^g
 
 	movl	%r12d,4(%rsp)
 	xorl	%r11d,%r14d
-	andl	%edx,%edi
+	andl	%edx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r10d,%r12d
-	xorl	%r9d,%edi
+	addl	%r10d,%r12d  // T1+=h
+	xorl	%r9d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%edx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r11d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r11d,%r14d
 
-	xorl	%eax,%edi
-	rorl	$6,%r13d
+	xorl	%eax,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%eax,%r10d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r10d
-	addl	%r12d,%ecx
-	addl	%r12d,%r10d
+	xorl	%r15d,%r10d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ecx  // d+=T1
+	addl	%r12d,%r10d  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%r10d
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%r10d  // h+=Sigma0(a)
 	movl	8(%rsi),%r12d
 	movl	%ecx,%r13d
 	movl	%r10d,%r14d
@@ -144,38 +144,38 @@
 
 	xorl	%ecx,%r13d
 	rorl	$9,%r14d
-	xorl	%r8d,%r15d
+	xorl	%r8d,%r15d  // f^g
 
 	movl	%r12d,8(%rsp)
 	xorl	%r10d,%r14d
-	andl	%ecx,%r15d
+	andl	%ecx,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r9d,%r12d
-	xorl	%r8d,%r15d
+	addl	%r9d,%r12d  // T1+=h
+	xorl	%r8d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ecx,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r10d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r10d,%r14d
 
-	xorl	%r11d,%r15d
-	rorl	$6,%r13d
+	xorl	%r11d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r11d,%r9d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r9d
-	addl	%r12d,%ebx
-	addl	%r12d,%r9d
+	xorl	%edi,%r9d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ebx  // d+=T1
+	addl	%r12d,%r9d  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%r9d
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%r9d  // h+=Sigma0(a)
 	movl	12(%rsi),%r12d
 	movl	%ebx,%r13d
 	movl	%r9d,%r14d
@@ -185,38 +185,38 @@
 
 	xorl	%ebx,%r13d
 	rorl	$9,%r14d
-	xorl	%edx,%edi
+	xorl	%edx,%edi  // f^g
 
 	movl	%r12d,12(%rsp)
 	xorl	%r9d,%r14d
-	andl	%ebx,%edi
+	andl	%ebx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r8d,%r12d
-	xorl	%edx,%edi
+	addl	%r8d,%r12d  // T1+=h
+	xorl	%edx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ebx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r9d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r9d,%r14d
 
-	xorl	%r10d,%edi
-	rorl	$6,%r13d
+	xorl	%r10d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r10d,%r8d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r8d
-	addl	%r12d,%eax
-	addl	%r12d,%r8d
+	xorl	%r15d,%r8d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%eax  // d+=T1
+	addl	%r12d,%r8d  // h+=T1
 
-	leaq	20(%rbp),%rbp
-	addl	%r14d,%r8d
+	leaq	20(%rbp),%rbp  // round++
+	addl	%r14d,%r8d  // h+=Sigma0(a)
 	movl	16(%rsi),%r12d
 	movl	%eax,%r13d
 	movl	%r8d,%r14d
@@ -226,38 +226,38 @@
 
 	xorl	%eax,%r13d
 	rorl	$9,%r14d
-	xorl	%ecx,%r15d
+	xorl	%ecx,%r15d  // f^g
 
 	movl	%r12d,16(%rsp)
 	xorl	%r8d,%r14d
-	andl	%eax,%r15d
+	andl	%eax,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%edx,%r12d
-	xorl	%ecx,%r15d
+	addl	%edx,%r12d  // T1+=h
+	xorl	%ecx,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%eax,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r8d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r8d,%r14d
 
-	xorl	%r9d,%r15d
-	rorl	$6,%r13d
+	xorl	%r9d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r9d,%edx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%edx
-	addl	%r12d,%r11d
-	addl	%r12d,%edx
+	xorl	%edi,%edx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r11d  // d+=T1
+	addl	%r12d,%edx  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%edx
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%edx  // h+=Sigma0(a)
 	movl	20(%rsi),%r12d
 	movl	%r11d,%r13d
 	movl	%edx,%r14d
@@ -267,38 +267,38 @@
 
 	xorl	%r11d,%r13d
 	rorl	$9,%r14d
-	xorl	%ebx,%edi
+	xorl	%ebx,%edi  // f^g
 
 	movl	%r12d,20(%rsp)
 	xorl	%edx,%r14d
-	andl	%r11d,%edi
+	andl	%r11d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ecx,%r12d
-	xorl	%ebx,%edi
+	addl	%ecx,%r12d  // T1+=h
+	xorl	%ebx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r11d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%edx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%edx,%r14d
 
-	xorl	%r8d,%edi
-	rorl	$6,%r13d
+	xorl	%r8d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r8d,%ecx
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%ecx
-	addl	%r12d,%r10d
-	addl	%r12d,%ecx
+	xorl	%r15d,%ecx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r10d  // d+=T1
+	addl	%r12d,%ecx  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%ecx
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%ecx  // h+=Sigma0(a)
 	movl	24(%rsi),%r12d
 	movl	%r10d,%r13d
 	movl	%ecx,%r14d
@@ -308,38 +308,38 @@
 
 	xorl	%r10d,%r13d
 	rorl	$9,%r14d
-	xorl	%eax,%r15d
+	xorl	%eax,%r15d  // f^g
 
 	movl	%r12d,24(%rsp)
 	xorl	%ecx,%r14d
-	andl	%r10d,%r15d
+	andl	%r10d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ebx,%r12d
-	xorl	%eax,%r15d
+	addl	%ebx,%r12d  // T1+=h
+	xorl	%eax,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r10d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ecx,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ecx,%r14d
 
-	xorl	%edx,%r15d
-	rorl	$6,%r13d
+	xorl	%edx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%edx,%ebx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%ebx
-	addl	%r12d,%r9d
-	addl	%r12d,%ebx
+	xorl	%edi,%ebx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r9d  // d+=T1
+	addl	%r12d,%ebx  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%ebx
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%ebx  // h+=Sigma0(a)
 	movl	28(%rsi),%r12d
 	movl	%r9d,%r13d
 	movl	%ebx,%r14d
@@ -349,38 +349,38 @@
 
 	xorl	%r9d,%r13d
 	rorl	$9,%r14d
-	xorl	%r11d,%edi
+	xorl	%r11d,%edi  // f^g
 
 	movl	%r12d,28(%rsp)
 	xorl	%ebx,%r14d
-	andl	%r9d,%edi
+	andl	%r9d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%eax,%r12d
-	xorl	%r11d,%edi
+	addl	%eax,%r12d  // T1+=h
+	xorl	%r11d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r9d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ebx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ebx,%r14d
 
-	xorl	%ecx,%edi
-	rorl	$6,%r13d
+	xorl	%ecx,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ecx,%eax
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%eax
-	addl	%r12d,%r8d
-	addl	%r12d,%eax
+	xorl	%r15d,%eax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r8d  // d+=T1
+	addl	%r12d,%eax  // h+=T1
 
-	leaq	20(%rbp),%rbp
-	addl	%r14d,%eax
+	leaq	20(%rbp),%rbp  // round++
+	addl	%r14d,%eax  // h+=Sigma0(a)
 	movl	32(%rsi),%r12d
 	movl	%r8d,%r13d
 	movl	%eax,%r14d
@@ -390,38 +390,38 @@
 
 	xorl	%r8d,%r13d
 	rorl	$9,%r14d
-	xorl	%r10d,%r15d
+	xorl	%r10d,%r15d  // f^g
 
 	movl	%r12d,32(%rsp)
 	xorl	%eax,%r14d
-	andl	%r8d,%r15d
+	andl	%r8d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r11d,%r12d
-	xorl	%r10d,%r15d
+	addl	%r11d,%r12d  // T1+=h
+	xorl	%r10d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r8d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%eax,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%eax,%r14d
 
-	xorl	%ebx,%r15d
-	rorl	$6,%r13d
+	xorl	%ebx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ebx,%r11d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r11d
-	addl	%r12d,%edx
-	addl	%r12d,%r11d
+	xorl	%edi,%r11d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%edx  // d+=T1
+	addl	%r12d,%r11d  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%r11d
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%r11d  // h+=Sigma0(a)
 	movl	36(%rsi),%r12d
 	movl	%edx,%r13d
 	movl	%r11d,%r14d
@@ -431,38 +431,38 @@
 
 	xorl	%edx,%r13d
 	rorl	$9,%r14d
-	xorl	%r9d,%edi
+	xorl	%r9d,%edi  // f^g
 
 	movl	%r12d,36(%rsp)
 	xorl	%r11d,%r14d
-	andl	%edx,%edi
+	andl	%edx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r10d,%r12d
-	xorl	%r9d,%edi
+	addl	%r10d,%r12d  // T1+=h
+	xorl	%r9d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%edx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r11d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r11d,%r14d
 
-	xorl	%eax,%edi
-	rorl	$6,%r13d
+	xorl	%eax,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%eax,%r10d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r10d
-	addl	%r12d,%ecx
-	addl	%r12d,%r10d
+	xorl	%r15d,%r10d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ecx  // d+=T1
+	addl	%r12d,%r10d  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%r10d
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%r10d  // h+=Sigma0(a)
 	movl	40(%rsi),%r12d
 	movl	%ecx,%r13d
 	movl	%r10d,%r14d
@@ -472,38 +472,38 @@
 
 	xorl	%ecx,%r13d
 	rorl	$9,%r14d
-	xorl	%r8d,%r15d
+	xorl	%r8d,%r15d  // f^g
 
 	movl	%r12d,40(%rsp)
 	xorl	%r10d,%r14d
-	andl	%ecx,%r15d
+	andl	%ecx,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r9d,%r12d
-	xorl	%r8d,%r15d
+	addl	%r9d,%r12d  // T1+=h
+	xorl	%r8d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ecx,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r10d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r10d,%r14d
 
-	xorl	%r11d,%r15d
-	rorl	$6,%r13d
+	xorl	%r11d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r11d,%r9d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r9d
-	addl	%r12d,%ebx
-	addl	%r12d,%r9d
+	xorl	%edi,%r9d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ebx  // d+=T1
+	addl	%r12d,%r9d  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%r9d
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%r9d  // h+=Sigma0(a)
 	movl	44(%rsi),%r12d
 	movl	%ebx,%r13d
 	movl	%r9d,%r14d
@@ -513,38 +513,38 @@
 
 	xorl	%ebx,%r13d
 	rorl	$9,%r14d
-	xorl	%edx,%edi
+	xorl	%edx,%edi  // f^g
 
 	movl	%r12d,44(%rsp)
 	xorl	%r9d,%r14d
-	andl	%ebx,%edi
+	andl	%ebx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r8d,%r12d
-	xorl	%edx,%edi
+	addl	%r8d,%r12d  // T1+=h
+	xorl	%edx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ebx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r9d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r9d,%r14d
 
-	xorl	%r10d,%edi
-	rorl	$6,%r13d
+	xorl	%r10d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r10d,%r8d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r8d
-	addl	%r12d,%eax
-	addl	%r12d,%r8d
+	xorl	%r15d,%r8d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%eax  // d+=T1
+	addl	%r12d,%r8d  // h+=T1
 
-	leaq	20(%rbp),%rbp
-	addl	%r14d,%r8d
+	leaq	20(%rbp),%rbp  // round++
+	addl	%r14d,%r8d  // h+=Sigma0(a)
 	movl	48(%rsi),%r12d
 	movl	%eax,%r13d
 	movl	%r8d,%r14d
@@ -554,38 +554,38 @@
 
 	xorl	%eax,%r13d
 	rorl	$9,%r14d
-	xorl	%ecx,%r15d
+	xorl	%ecx,%r15d  // f^g
 
 	movl	%r12d,48(%rsp)
 	xorl	%r8d,%r14d
-	andl	%eax,%r15d
+	andl	%eax,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%edx,%r12d
-	xorl	%ecx,%r15d
+	addl	%edx,%r12d  // T1+=h
+	xorl	%ecx,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%eax,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r8d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r8d,%r14d
 
-	xorl	%r9d,%r15d
-	rorl	$6,%r13d
+	xorl	%r9d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r9d,%edx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%edx
-	addl	%r12d,%r11d
-	addl	%r12d,%edx
+	xorl	%edi,%edx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r11d  // d+=T1
+	addl	%r12d,%edx  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%edx
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%edx  // h+=Sigma0(a)
 	movl	52(%rsi),%r12d
 	movl	%r11d,%r13d
 	movl	%edx,%r14d
@@ -595,38 +595,38 @@
 
 	xorl	%r11d,%r13d
 	rorl	$9,%r14d
-	xorl	%ebx,%edi
+	xorl	%ebx,%edi  // f^g
 
 	movl	%r12d,52(%rsp)
 	xorl	%edx,%r14d
-	andl	%r11d,%edi
+	andl	%r11d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ecx,%r12d
-	xorl	%ebx,%edi
+	addl	%ecx,%r12d  // T1+=h
+	xorl	%ebx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r11d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%edx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%edx,%r14d
 
-	xorl	%r8d,%edi
-	rorl	$6,%r13d
+	xorl	%r8d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r8d,%ecx
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%ecx
-	addl	%r12d,%r10d
-	addl	%r12d,%ecx
+	xorl	%r15d,%ecx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r10d  // d+=T1
+	addl	%r12d,%ecx  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%ecx
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%ecx  // h+=Sigma0(a)
 	movl	56(%rsi),%r12d
 	movl	%r10d,%r13d
 	movl	%ecx,%r14d
@@ -636,38 +636,38 @@
 
 	xorl	%r10d,%r13d
 	rorl	$9,%r14d
-	xorl	%eax,%r15d
+	xorl	%eax,%r15d  // f^g
 
 	movl	%r12d,56(%rsp)
 	xorl	%ecx,%r14d
-	andl	%r10d,%r15d
+	andl	%r10d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ebx,%r12d
-	xorl	%eax,%r15d
+	addl	%ebx,%r12d  // T1+=h
+	xorl	%eax,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r10d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ecx,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ecx,%r14d
 
-	xorl	%edx,%r15d
-	rorl	$6,%r13d
+	xorl	%edx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%edx,%ebx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%ebx
-	addl	%r12d,%r9d
-	addl	%r12d,%ebx
+	xorl	%edi,%ebx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r9d  // d+=T1
+	addl	%r12d,%ebx  // h+=T1
 
-	leaq	4(%rbp),%rbp
-	addl	%r14d,%ebx
+	leaq	4(%rbp),%rbp  // round++
+	addl	%r14d,%ebx  // h+=Sigma0(a)
 	movl	60(%rsi),%r12d
 	movl	%r9d,%r13d
 	movl	%ebx,%r14d
@@ -677,37 +677,37 @@
 
 	xorl	%r9d,%r13d
 	rorl	$9,%r14d
-	xorl	%r11d,%edi
+	xorl	%r11d,%edi  // f^g
 
 	movl	%r12d,60(%rsp)
 	xorl	%ebx,%r14d
-	andl	%r9d,%edi
+	andl	%r9d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%eax,%r12d
-	xorl	%r11d,%edi
+	addl	%eax,%r12d  // T1+=h
+	xorl	%r11d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r9d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ebx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ebx,%r14d
 
-	xorl	%ecx,%edi
-	rorl	$6,%r13d
+	xorl	%ecx,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ecx,%eax
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%eax
-	addl	%r12d,%r8d
-	addl	%r12d,%eax
+	xorl	%r15d,%eax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r8d  // d+=T1
+	addl	%r12d,%eax  // h+=T1
 
-	leaq	20(%rbp),%rbp
+	leaq	20(%rbp),%rbp  // round++
 	jmp	.Lrounds_16_xx
 .align	16
 .Lrounds_16_xx:
@@ -716,7 +716,7 @@
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%eax
+	addl	%r14d,%eax  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -727,8 +727,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	36(%rsp),%r12d
 
 	addl	0(%rsp),%r12d
@@ -740,43 +740,43 @@
 
 	xorl	%r8d,%r13d
 	rorl	$9,%r14d
-	xorl	%r10d,%r15d
+	xorl	%r10d,%r15d  // f^g
 
 	movl	%r12d,0(%rsp)
 	xorl	%eax,%r14d
-	andl	%r8d,%r15d
+	andl	%r8d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r11d,%r12d
-	xorl	%r10d,%r15d
+	addl	%r11d,%r12d  // T1+=h
+	xorl	%r10d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r8d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%eax,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%eax,%r14d
 
-	xorl	%ebx,%r15d
-	rorl	$6,%r13d
+	xorl	%ebx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ebx,%r11d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r11d
-	addl	%r12d,%edx
-	addl	%r12d,%r11d
+	xorl	%edi,%r11d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%edx  // d+=T1
+	addl	%r12d,%r11d  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	8(%rsp),%r13d
 	movl	60(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r11d
+	addl	%r14d,%r11d  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -787,8 +787,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	40(%rsp),%r12d
 
 	addl	4(%rsp),%r12d
@@ -800,43 +800,43 @@
 
 	xorl	%edx,%r13d
 	rorl	$9,%r14d
-	xorl	%r9d,%edi
+	xorl	%r9d,%edi  // f^g
 
 	movl	%r12d,4(%rsp)
 	xorl	%r11d,%r14d
-	andl	%edx,%edi
+	andl	%edx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r10d,%r12d
-	xorl	%r9d,%edi
+	addl	%r10d,%r12d  // T1+=h
+	xorl	%r9d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%edx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r11d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r11d,%r14d
 
-	xorl	%eax,%edi
-	rorl	$6,%r13d
+	xorl	%eax,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%eax,%r10d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r10d
-	addl	%r12d,%ecx
-	addl	%r12d,%r10d
+	xorl	%r15d,%r10d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ecx  // d+=T1
+	addl	%r12d,%r10d  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	12(%rsp),%r13d
 	movl	0(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r10d
+	addl	%r14d,%r10d  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -847,8 +847,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	44(%rsp),%r12d
 
 	addl	8(%rsp),%r12d
@@ -860,43 +860,43 @@
 
 	xorl	%ecx,%r13d
 	rorl	$9,%r14d
-	xorl	%r8d,%r15d
+	xorl	%r8d,%r15d  // f^g
 
 	movl	%r12d,8(%rsp)
 	xorl	%r10d,%r14d
-	andl	%ecx,%r15d
+	andl	%ecx,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r9d,%r12d
-	xorl	%r8d,%r15d
+	addl	%r9d,%r12d  // T1+=h
+	xorl	%r8d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ecx,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r10d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r10d,%r14d
 
-	xorl	%r11d,%r15d
-	rorl	$6,%r13d
+	xorl	%r11d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r11d,%r9d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r9d
-	addl	%r12d,%ebx
-	addl	%r12d,%r9d
+	xorl	%edi,%r9d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ebx  // d+=T1
+	addl	%r12d,%r9d  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	16(%rsp),%r13d
 	movl	4(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r9d
+	addl	%r14d,%r9d  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -907,8 +907,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	48(%rsp),%r12d
 
 	addl	12(%rsp),%r12d
@@ -920,43 +920,43 @@
 
 	xorl	%ebx,%r13d
 	rorl	$9,%r14d
-	xorl	%edx,%edi
+	xorl	%edx,%edi  // f^g
 
 	movl	%r12d,12(%rsp)
 	xorl	%r9d,%r14d
-	andl	%ebx,%edi
+	andl	%ebx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r8d,%r12d
-	xorl	%edx,%edi
+	addl	%r8d,%r12d  // T1+=h
+	xorl	%edx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ebx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r9d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r9d,%r14d
 
-	xorl	%r10d,%edi
-	rorl	$6,%r13d
+	xorl	%r10d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r10d,%r8d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r8d
-	addl	%r12d,%eax
-	addl	%r12d,%r8d
+	xorl	%r15d,%r8d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%eax  // d+=T1
+	addl	%r12d,%r8d  // h+=T1
 
-	leaq	20(%rbp),%rbp
+	leaq	20(%rbp),%rbp  // round++
 	movl	20(%rsp),%r13d
 	movl	8(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r8d
+	addl	%r14d,%r8d  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -967,8 +967,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	52(%rsp),%r12d
 
 	addl	16(%rsp),%r12d
@@ -980,43 +980,43 @@
 
 	xorl	%eax,%r13d
 	rorl	$9,%r14d
-	xorl	%ecx,%r15d
+	xorl	%ecx,%r15d  // f^g
 
 	movl	%r12d,16(%rsp)
 	xorl	%r8d,%r14d
-	andl	%eax,%r15d
+	andl	%eax,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%edx,%r12d
-	xorl	%ecx,%r15d
+	addl	%edx,%r12d  // T1+=h
+	xorl	%ecx,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%eax,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r8d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r8d,%r14d
 
-	xorl	%r9d,%r15d
-	rorl	$6,%r13d
+	xorl	%r9d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r9d,%edx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%edx
-	addl	%r12d,%r11d
-	addl	%r12d,%edx
+	xorl	%edi,%edx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r11d  // d+=T1
+	addl	%r12d,%edx  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	24(%rsp),%r13d
 	movl	12(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%edx
+	addl	%r14d,%edx  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -1027,8 +1027,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	56(%rsp),%r12d
 
 	addl	20(%rsp),%r12d
@@ -1040,43 +1040,43 @@
 
 	xorl	%r11d,%r13d
 	rorl	$9,%r14d
-	xorl	%ebx,%edi
+	xorl	%ebx,%edi  // f^g
 
 	movl	%r12d,20(%rsp)
 	xorl	%edx,%r14d
-	andl	%r11d,%edi
+	andl	%r11d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ecx,%r12d
-	xorl	%ebx,%edi
+	addl	%ecx,%r12d  // T1+=h
+	xorl	%ebx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r11d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%edx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%edx,%r14d
 
-	xorl	%r8d,%edi
-	rorl	$6,%r13d
+	xorl	%r8d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r8d,%ecx
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%ecx
-	addl	%r12d,%r10d
-	addl	%r12d,%ecx
+	xorl	%r15d,%ecx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r10d  // d+=T1
+	addl	%r12d,%ecx  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	28(%rsp),%r13d
 	movl	16(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%ecx
+	addl	%r14d,%ecx  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -1087,8 +1087,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	60(%rsp),%r12d
 
 	addl	24(%rsp),%r12d
@@ -1100,43 +1100,43 @@
 
 	xorl	%r10d,%r13d
 	rorl	$9,%r14d
-	xorl	%eax,%r15d
+	xorl	%eax,%r15d  // f^g
 
 	movl	%r12d,24(%rsp)
 	xorl	%ecx,%r14d
-	andl	%r10d,%r15d
+	andl	%r10d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ebx,%r12d
-	xorl	%eax,%r15d
+	addl	%ebx,%r12d  // T1+=h
+	xorl	%eax,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r10d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ecx,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ecx,%r14d
 
-	xorl	%edx,%r15d
-	rorl	$6,%r13d
+	xorl	%edx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%edx,%ebx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%ebx
-	addl	%r12d,%r9d
-	addl	%r12d,%ebx
+	xorl	%edi,%ebx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r9d  // d+=T1
+	addl	%r12d,%ebx  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	32(%rsp),%r13d
 	movl	20(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%ebx
+	addl	%r14d,%ebx  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -1147,8 +1147,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	0(%rsp),%r12d
 
 	addl	28(%rsp),%r12d
@@ -1160,43 +1160,43 @@
 
 	xorl	%r9d,%r13d
 	rorl	$9,%r14d
-	xorl	%r11d,%edi
+	xorl	%r11d,%edi  // f^g
 
 	movl	%r12d,28(%rsp)
 	xorl	%ebx,%r14d
-	andl	%r9d,%edi
+	andl	%r9d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%eax,%r12d
-	xorl	%r11d,%edi
+	addl	%eax,%r12d  // T1+=h
+	xorl	%r11d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r9d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ebx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ebx,%r14d
 
-	xorl	%ecx,%edi
-	rorl	$6,%r13d
+	xorl	%ecx,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ecx,%eax
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%eax
-	addl	%r12d,%r8d
-	addl	%r12d,%eax
+	xorl	%r15d,%eax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r8d  // d+=T1
+	addl	%r12d,%eax  // h+=T1
 
-	leaq	20(%rbp),%rbp
+	leaq	20(%rbp),%rbp  // round++
 	movl	36(%rsp),%r13d
 	movl	24(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%eax
+	addl	%r14d,%eax  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -1207,8 +1207,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	4(%rsp),%r12d
 
 	addl	32(%rsp),%r12d
@@ -1220,43 +1220,43 @@
 
 	xorl	%r8d,%r13d
 	rorl	$9,%r14d
-	xorl	%r10d,%r15d
+	xorl	%r10d,%r15d  // f^g
 
 	movl	%r12d,32(%rsp)
 	xorl	%eax,%r14d
-	andl	%r8d,%r15d
+	andl	%r8d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r11d,%r12d
-	xorl	%r10d,%r15d
+	addl	%r11d,%r12d  // T1+=h
+	xorl	%r10d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r8d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%eax,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%eax,%r14d
 
-	xorl	%ebx,%r15d
-	rorl	$6,%r13d
+	xorl	%ebx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ebx,%r11d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r11d
-	addl	%r12d,%edx
-	addl	%r12d,%r11d
+	xorl	%edi,%r11d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%edx  // d+=T1
+	addl	%r12d,%r11d  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	40(%rsp),%r13d
 	movl	28(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r11d
+	addl	%r14d,%r11d  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -1267,8 +1267,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	8(%rsp),%r12d
 
 	addl	36(%rsp),%r12d
@@ -1280,43 +1280,43 @@
 
 	xorl	%edx,%r13d
 	rorl	$9,%r14d
-	xorl	%r9d,%edi
+	xorl	%r9d,%edi  // f^g
 
 	movl	%r12d,36(%rsp)
 	xorl	%r11d,%r14d
-	andl	%edx,%edi
+	andl	%edx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r10d,%r12d
-	xorl	%r9d,%edi
+	addl	%r10d,%r12d  // T1+=h
+	xorl	%r9d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%edx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r11d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r11d,%r14d
 
-	xorl	%eax,%edi
-	rorl	$6,%r13d
+	xorl	%eax,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%eax,%r10d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r10d
-	addl	%r12d,%ecx
-	addl	%r12d,%r10d
+	xorl	%r15d,%r10d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ecx  // d+=T1
+	addl	%r12d,%r10d  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	44(%rsp),%r13d
 	movl	32(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r10d
+	addl	%r14d,%r10d  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -1327,8 +1327,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	12(%rsp),%r12d
 
 	addl	40(%rsp),%r12d
@@ -1340,43 +1340,43 @@
 
 	xorl	%ecx,%r13d
 	rorl	$9,%r14d
-	xorl	%r8d,%r15d
+	xorl	%r8d,%r15d  // f^g
 
 	movl	%r12d,40(%rsp)
 	xorl	%r10d,%r14d
-	andl	%ecx,%r15d
+	andl	%ecx,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r9d,%r12d
-	xorl	%r8d,%r15d
+	addl	%r9d,%r12d  // T1+=h
+	xorl	%r8d,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ecx,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r10d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r10d,%r14d
 
-	xorl	%r11d,%r15d
-	rorl	$6,%r13d
+	xorl	%r11d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r11d,%r9d
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%r9d
-	addl	%r12d,%ebx
-	addl	%r12d,%r9d
+	xorl	%edi,%r9d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%ebx  // d+=T1
+	addl	%r12d,%r9d  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	48(%rsp),%r13d
 	movl	36(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r9d
+	addl	%r14d,%r9d  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -1387,8 +1387,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	16(%rsp),%r12d
 
 	addl	44(%rsp),%r12d
@@ -1400,43 +1400,43 @@
 
 	xorl	%ebx,%r13d
 	rorl	$9,%r14d
-	xorl	%edx,%edi
+	xorl	%edx,%edi  // f^g
 
 	movl	%r12d,44(%rsp)
 	xorl	%r9d,%r14d
-	andl	%ebx,%edi
+	andl	%ebx,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%r8d,%r12d
-	xorl	%edx,%edi
+	addl	%r8d,%r12d  // T1+=h
+	xorl	%edx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%ebx,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r9d,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r9d,%r14d
 
-	xorl	%r10d,%edi
-	rorl	$6,%r13d
+	xorl	%r10d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r10d,%r8d
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%r8d
-	addl	%r12d,%eax
-	addl	%r12d,%r8d
+	xorl	%r15d,%r8d  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%eax  // d+=T1
+	addl	%r12d,%r8d  // h+=T1
 
-	leaq	20(%rbp),%rbp
+	leaq	20(%rbp),%rbp  // round++
 	movl	52(%rsp),%r13d
 	movl	40(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%r8d
+	addl	%r14d,%r8d  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -1447,8 +1447,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	20(%rsp),%r12d
 
 	addl	48(%rsp),%r12d
@@ -1460,43 +1460,43 @@
 
 	xorl	%eax,%r13d
 	rorl	$9,%r14d
-	xorl	%ecx,%r15d
+	xorl	%ecx,%r15d  // f^g
 
 	movl	%r12d,48(%rsp)
 	xorl	%r8d,%r14d
-	andl	%eax,%r15d
+	andl	%eax,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%edx,%r12d
-	xorl	%ecx,%r15d
+	addl	%edx,%r12d  // T1+=h
+	xorl	%ecx,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%eax,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%r8d,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%r8d,%r14d
 
-	xorl	%r9d,%r15d
-	rorl	$6,%r13d
+	xorl	%r9d,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r9d,%edx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%edx
-	addl	%r12d,%r11d
-	addl	%r12d,%edx
+	xorl	%edi,%edx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r11d  // d+=T1
+	addl	%r12d,%edx  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	56(%rsp),%r13d
 	movl	44(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%edx
+	addl	%r14d,%edx  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -1507,8 +1507,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	24(%rsp),%r12d
 
 	addl	52(%rsp),%r12d
@@ -1520,43 +1520,43 @@
 
 	xorl	%r11d,%r13d
 	rorl	$9,%r14d
-	xorl	%ebx,%edi
+	xorl	%ebx,%edi  // f^g
 
 	movl	%r12d,52(%rsp)
 	xorl	%edx,%r14d
-	andl	%r11d,%edi
+	andl	%r11d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ecx,%r12d
-	xorl	%ebx,%edi
+	addl	%ecx,%r12d  // T1+=h
+	xorl	%ebx,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r11d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%edx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%edx,%r14d
 
-	xorl	%r8d,%edi
-	rorl	$6,%r13d
+	xorl	%r8d,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%r8d,%ecx
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%ecx
-	addl	%r12d,%r10d
-	addl	%r12d,%ecx
+	xorl	%r15d,%ecx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r10d  // d+=T1
+	addl	%r12d,%ecx  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	60(%rsp),%r13d
 	movl	48(%rsp),%r15d
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%ecx
+	addl	%r14d,%ecx  // modulo-scheduled h+=Sigma0(a)
 	movl	%r15d,%r14d
 	rorl	$2,%r15d
 
@@ -1567,8 +1567,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%r15d
-	xorl	%r13d,%r12d
-	xorl	%r14d,%r15d
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%r15d  // sigma1(X(i+14)&0xf)
 	addl	28(%rsp),%r12d
 
 	addl	56(%rsp),%r12d
@@ -1580,43 +1580,43 @@
 
 	xorl	%r10d,%r13d
 	rorl	$9,%r14d
-	xorl	%eax,%r15d
+	xorl	%eax,%r15d  // f^g
 
 	movl	%r12d,56(%rsp)
 	xorl	%ecx,%r14d
-	andl	%r10d,%r15d
+	andl	%r10d,%r15d  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%ebx,%r12d
-	xorl	%eax,%r15d
+	addl	%ebx,%r12d  // T1+=h
+	xorl	%eax,%r15d  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r10d,%r13d
-	addl	%r15d,%r12d
+	addl	%r15d,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ecx,%r15d
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ecx,%r14d
 
-	xorl	%edx,%r15d
-	rorl	$6,%r13d
+	xorl	%edx,%r15d  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%edx,%ebx
 
 	andl	%r15d,%edi
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%edi,%ebx
-	addl	%r12d,%r9d
-	addl	%r12d,%ebx
+	xorl	%edi,%ebx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r9d  // d+=T1
+	addl	%r12d,%ebx  // h+=T1
 
-	leaq	4(%rbp),%rbp
+	leaq	4(%rbp),%rbp  // round++
 	movl	0(%rsp),%r13d
 	movl	52(%rsp),%edi
 
 	movl	%r13d,%r12d
 	rorl	$11,%r13d
-	addl	%r14d,%ebx
+	addl	%r14d,%ebx  // modulo-scheduled h+=Sigma0(a)
 	movl	%edi,%r14d
 	rorl	$2,%edi
 
@@ -1627,8 +1627,8 @@
 	shrl	$10,%r14d
 
 	rorl	$17,%edi
-	xorl	%r13d,%r12d
-	xorl	%r14d,%edi
+	xorl	%r13d,%r12d  // sigma0(X(i+1)&0xf)
+	xorl	%r14d,%edi  // sigma1(X(i+14)&0xf)
 	addl	32(%rsp),%r12d
 
 	addl	60(%rsp),%r12d
@@ -1640,42 +1640,42 @@
 
 	xorl	%r9d,%r13d
 	rorl	$9,%r14d
-	xorl	%r11d,%edi
+	xorl	%r11d,%edi  // f^g
 
 	movl	%r12d,60(%rsp)
 	xorl	%ebx,%r14d
-	andl	%r9d,%edi
+	andl	%r9d,%edi  // (f^g)&e
 
 	rorl	$5,%r13d
-	addl	%eax,%r12d
-	xorl	%r11d,%edi
+	addl	%eax,%r12d  // T1+=h
+	xorl	%r11d,%edi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorl	$11,%r14d
 	xorl	%r9d,%r13d
-	addl	%edi,%r12d
+	addl	%edi,%r12d  // T1+=Ch(e,f,g)
 
 	movl	%ebx,%edi
-	addl	(%rbp),%r12d
+	addl	(%rbp),%r12d  // T1+=Kround
 	xorl	%ebx,%r14d
 
-	xorl	%ecx,%edi
-	rorl	$6,%r13d
+	xorl	%ecx,%edi  // a^b, b^c in next round
+	rorl	$6,%r13d  // Sigma1(e)
 	movl	%ecx,%eax
 
 	andl	%edi,%r15d
-	rorl	$2,%r14d
-	addl	%r13d,%r12d
+	rorl	$2,%r14d  // Sigma0(a)
+	addl	%r13d,%r12d  // T1+=Sigma1(e)
 
-	xorl	%r15d,%eax
-	addl	%r12d,%r8d
-	addl	%r12d,%eax
+	xorl	%r15d,%eax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addl	%r12d,%r8d  // d+=T1
+	addl	%r12d,%eax  // h+=T1
 
-	leaq	20(%rbp),%rbp
+	leaq	20(%rbp),%rbp  // round++
 	cmpb	$0,3(%rbp)
 	jnz	.Lrounds_16_xx
 
 	movq	64+0(%rsp),%rdi
-	addl	%r14d,%eax
+	addl	%r14d,%eax  // modulo-scheduled h+=Sigma0(a)
 	leaq	64(%rsi),%rsi
 
 	addl	0(%rdi),%eax
@@ -1772,16 +1772,16 @@
 .cfi_startproc	
 _CET_ENDBR
 	leaq	K256+128(%rip),%rcx
-	movdqu	(%rdi),%xmm1
-	movdqu	16(%rdi),%xmm2
-	movdqa	512-128(%rcx),%xmm7
-
-	pshufd	$0x1b,%xmm1,%xmm0
-	pshufd	$0xb1,%xmm1,%xmm1
-	pshufd	$0x1b,%xmm2,%xmm2
-	movdqa	%xmm7,%xmm8
-	palignr	$8,%xmm2,%xmm1
-	punpcklqdq	%xmm0,%xmm2
+	movdqu	(%rdi),%xmm1  // DCBA
+	movdqu	16(%rdi),%xmm2  // HGFE
+	movdqa	512-128(%rcx),%xmm7  // byte swap mask
+
+	pshufd	$0x1b,%xmm1,%xmm0  // ABCD
+	pshufd	$0xb1,%xmm1,%xmm1  // CDAB
+	pshufd	$0x1b,%xmm2,%xmm2  // EFGH
+	movdqa	%xmm7,%xmm8  // offload
+	palignr	$8,%xmm2,%xmm1  // ABEF
+	punpcklqdq	%xmm0,%xmm2  // CDGH
 	jmp	.Loop_shaext
 
 .align	16
@@ -1795,17 +1795,17 @@
 	movdqa	0-128(%rcx),%xmm0
 	paddd	%xmm3,%xmm0
 	pshufb	%xmm7,%xmm4
-	movdqa	%xmm2,%xmm10
-	sha256rnds2	%xmm1,%xmm2
+	movdqa	%xmm2,%xmm10  // offload
+	sha256rnds2	%xmm1,%xmm2  // 0-3
 	pshufd	$0x0e,%xmm0,%xmm0
 	nop
-	movdqa	%xmm1,%xmm9
+	movdqa	%xmm1,%xmm9  // offload
 	sha256rnds2	%xmm2,%xmm1
 
 	movdqa	32-128(%rcx),%xmm0
 	paddd	%xmm4,%xmm0
 	pshufb	%xmm7,%xmm5
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 4-7
 	pshufd	$0x0e,%xmm0,%xmm0
 	leaq	64(%rsi),%rsi
 	sha256msg1	%xmm4,%xmm3
@@ -1814,7 +1814,7 @@
 	movdqa	64-128(%rcx),%xmm0
 	paddd	%xmm5,%xmm0
 	pshufb	%xmm7,%xmm6
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 8-11
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm6,%xmm7
 	palignr	$4,%xmm5,%xmm7
@@ -1826,7 +1826,7 @@
 	movdqa	96-128(%rcx),%xmm0
 	paddd	%xmm6,%xmm0
 	sha256msg2	%xmm6,%xmm3
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 12-15
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm3,%xmm7
 	palignr	$4,%xmm6,%xmm7
@@ -1837,7 +1837,7 @@
 	movdqa	128-128(%rcx),%xmm0
 	paddd	%xmm3,%xmm0
 	sha256msg2	%xmm3,%xmm4
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm4,%xmm7
 	palignr	$4,%xmm3,%xmm7
@@ -1848,7 +1848,7 @@
 	movdqa	160-128(%rcx),%xmm0
 	paddd	%xmm4,%xmm0
 	sha256msg2	%xmm4,%xmm5
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm5,%xmm7
 	palignr	$4,%xmm4,%xmm7
@@ -1859,7 +1859,7 @@
 	movdqa	192-128(%rcx),%xmm0
 	paddd	%xmm5,%xmm0
 	sha256msg2	%xmm5,%xmm6
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm6,%xmm7
 	palignr	$4,%xmm5,%xmm7
@@ -1870,7 +1870,7 @@
 	movdqa	224-128(%rcx),%xmm0
 	paddd	%xmm6,%xmm0
 	sha256msg2	%xmm6,%xmm3
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm3,%xmm7
 	palignr	$4,%xmm6,%xmm7
@@ -1881,7 +1881,7 @@
 	movdqa	256-128(%rcx),%xmm0
 	paddd	%xmm3,%xmm0
 	sha256msg2	%xmm3,%xmm4
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm4,%xmm7
 	palignr	$4,%xmm3,%xmm7
@@ -1892,7 +1892,7 @@
 	movdqa	288-128(%rcx),%xmm0
 	paddd	%xmm4,%xmm0
 	sha256msg2	%xmm4,%xmm5
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm5,%xmm7
 	palignr	$4,%xmm4,%xmm7
@@ -1903,7 +1903,7 @@
 	movdqa	320-128(%rcx),%xmm0
 	paddd	%xmm5,%xmm0
 	sha256msg2	%xmm5,%xmm6
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm6,%xmm7
 	palignr	$4,%xmm5,%xmm7
@@ -1914,7 +1914,7 @@
 	movdqa	352-128(%rcx),%xmm0
 	paddd	%xmm6,%xmm0
 	sha256msg2	%xmm6,%xmm3
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm3,%xmm7
 	palignr	$4,%xmm6,%xmm7
@@ -1925,7 +1925,7 @@
 	movdqa	384-128(%rcx),%xmm0
 	paddd	%xmm3,%xmm0
 	sha256msg2	%xmm3,%xmm4
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 16-19...
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm4,%xmm7
 	palignr	$4,%xmm3,%xmm7
@@ -1936,7 +1936,7 @@
 	movdqa	416-128(%rcx),%xmm0
 	paddd	%xmm4,%xmm0
 	sha256msg2	%xmm4,%xmm5
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 52-55
 	pshufd	$0x0e,%xmm0,%xmm0
 	movdqa	%xmm5,%xmm7
 	palignr	$4,%xmm4,%xmm7
@@ -1945,7 +1945,7 @@
 
 	movdqa	448-128(%rcx),%xmm0
 	paddd	%xmm5,%xmm0
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 56-59
 	pshufd	$0x0e,%xmm0,%xmm0
 	sha256msg2	%xmm5,%xmm6
 	movdqa	%xmm8,%xmm7
@@ -1954,7 +1954,7 @@
 	movdqa	480-128(%rcx),%xmm0
 	paddd	%xmm6,%xmm0
 	nop
-	sha256rnds2	%xmm1,%xmm2
+	sha256rnds2	%xmm1,%xmm2  // 60-63
 	pshufd	$0x0e,%xmm0,%xmm0
 	decq	%rdx
 	nop
@@ -1964,11 +1964,11 @@
 	paddd	%xmm9,%xmm1
 	jnz	.Loop_shaext
 
-	pshufd	$0xb1,%xmm2,%xmm2
-	pshufd	$0x1b,%xmm1,%xmm7
-	pshufd	$0xb1,%xmm1,%xmm1
-	punpckhqdq	%xmm2,%xmm1
-	palignr	$8,%xmm7,%xmm2
+	pshufd	$0xb1,%xmm2,%xmm2  // DCHG
+	pshufd	$0x1b,%xmm1,%xmm7  // FEBA
+	pshufd	$0xb1,%xmm1,%xmm1  // BAFE
+	punpckhqdq	%xmm2,%xmm1  // DCBA
+	palignr	$8,%xmm7,%xmm2  // HGFE
 
 	movdqu	%xmm1,(%rdi)
 	movdqu	%xmm2,16(%rdi)
@@ -1982,7 +1982,7 @@
 sha256_block_data_order_ssse3:
 .cfi_startproc	
 _CET_ENDBR
-	movq	%rsp,%rax
+	movq	%rsp,%rax  // copy %rsp
 .cfi_def_cfa_register	%rax
 	pushq	%rbx
 .cfi_offset	%rbx,-16
@@ -1996,14 +1996,14 @@
 .cfi_offset	%r14,-48
 	pushq	%r15
 .cfi_offset	%r15,-56
-	shlq	$4,%rdx
+	shlq	$4,%rdx  // num*16
 	subq	$96,%rsp
-	leaq	(%rsi,%rdx,4),%rdx
-	andq	$-64,%rsp
-	movq	%rdi,64+0(%rsp)
-	movq	%rsi,64+8(%rsp)
-	movq	%rdx,64+16(%rsp)
-	movq	%rax,88(%rsp)
+	leaq	(%rsi,%rdx,4),%rdx  // inp+num*16*4
+	andq	$-64,%rsp  // align stack frame
+	movq	%rdi,64+0(%rsp)  // save ctx, 1st arg
+	movq	%rsi,64+8(%rsp)  // save inp, 2nd arh
+	movq	%rdx,64+16(%rsp)  // save end pointer, "3rd" arg
+	movq	%rax,88(%rsp)  // save copy of %rsp
 .cfi_escape	0x0f,0x06,0x77,0xd8,0x00,0x06,0x23,0x08
 .Lprologue_ssse3:
 
@@ -2015,8 +2015,8 @@
 	movl	20(%rdi),%r9d
 	movl	24(%rdi),%r10d
 	movl	28(%rdi),%r11d
-
-
+// movdqa	K256+512+32(%rip),%xmm8
+// movdqa	K256+512+64(%rip),%xmm9
 	jmp	.Lloop_ssse3
 .align	16
 .Lloop_ssse3:
@@ -2043,14 +2043,14 @@
 	movdqa	%xmm5,16(%rsp)
 	movl	%ebx,%edi
 	movdqa	%xmm6,32(%rsp)
-	xorl	%ecx,%edi
+	xorl	%ecx,%edi  // magic
 	movdqa	%xmm7,48(%rsp)
 	movl	%r8d,%r13d
 	jmp	.Lssse3_00_47
 
 .align	16
 .Lssse3_00_47:
-	subq	$-128,%rbp
+	subq	$-128,%rbp  // size optimization
 	rorl	$14,%r13d
 	movdqa	%xmm1,%xmm4
 	movl	%r14d,%eax
@@ -3097,7 +3097,7 @@
 sha256_block_data_order_avx:
 .cfi_startproc	
 _CET_ENDBR
-	movq	%rsp,%rax
+	movq	%rsp,%rax  // copy %rsp
 .cfi_def_cfa_register	%rax
 	pushq	%rbx
 .cfi_offset	%rbx,-16
@@ -3111,14 +3111,14 @@
 .cfi_offset	%r14,-48
 	pushq	%r15
 .cfi_offset	%r15,-56
-	shlq	$4,%rdx
+	shlq	$4,%rdx  // num*16
 	subq	$96,%rsp
-	leaq	(%rsi,%rdx,4),%rdx
-	andq	$-64,%rsp
-	movq	%rdi,64+0(%rsp)
-	movq	%rsi,64+8(%rsp)
-	movq	%rdx,64+16(%rsp)
-	movq	%rax,88(%rsp)
+	leaq	(%rsi,%rdx,4),%rdx  // inp+num*16*4
+	andq	$-64,%rsp  // align stack frame
+	movq	%rdi,64+0(%rsp)  // save ctx, 1st arg
+	movq	%rsi,64+8(%rsp)  // save inp, 2nd arh
+	movq	%rdx,64+16(%rsp)  // save end pointer, "3rd" arg
+	movq	%rax,88(%rsp)  // save copy of %rsp
 .cfi_escape	0x0f,0x06,0x77,0xd8,0x00,0x06,0x23,0x08
 .Lprologue_avx:
 
@@ -3155,14 +3155,14 @@
 	vmovdqa	%xmm5,16(%rsp)
 	movl	%ebx,%edi
 	vmovdqa	%xmm6,32(%rsp)
-	xorl	%ecx,%edi
+	xorl	%ecx,%edi  // magic
 	vmovdqa	%xmm7,48(%rsp)
 	movl	%r8d,%r13d
 	jmp	.Lavx_00_47
 
 .align	16
 .Lavx_00_47:
-	subq	$-128,%rbp
+	subq	$-128,%rbp  // size optimization
 	vpalignr	$4,%xmm0,%xmm1,%xmm4
 	shrdl	$14,%r13d,%r13d
 	movl	%r14d,%eax

boringssl-0.20260708.tar.xz/gen/bcm/sha256-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/sha256-x86_64-win.asm Changed

@@ -29,7 +29,7 @@
 
 
 _CET_ENDBR
-	mov	rax,rsp
+	mov	rax,rsp  ; copy %rsp
 
 	push	rbx
 
@@ -43,14 +43,14 @@
 
 	push	r15
 
-	shl	rdx,4
+	shl	rdx,4  ; num*16
 	sub	rsp,16*4+4*8
-	lea	rdx,rdx*4+rsi
-	and	rsp,-64
-	mov	QWORD((64+0))+rsp,rdi
-	mov	QWORD((64+8))+rsp,rsi
-	mov	QWORD((64+16))+rsp,rdx
-	mov	QWORD88+rsp,rax
+	lea	rdx,rdx*4+rsi  ; inp+num*16*4
+	and	rsp,-64  ; align stack frame
+	mov	QWORD((64+0))+rsp,rdi  ; save ctx, 1st arg
+	mov	QWORD((64+8))+rsp,rsi  ; save inp, 2nd arh
+	mov	QWORD((64+16))+rsp,rdx  ; save end pointer, "3rd" arg
+	mov	QWORD88+rsp,rax  ; save copy of %rsp
 
 $L$prologue:
 
@@ -68,7 +68,7 @@
 $L$loop:
 	mov	edi,ebx
 	lea	rbp,K256
-	xor	edi,ecx
+	xor	edi,ecx  ; magic
 	mov	r12d,DWORDrsi
 	mov	r13d,r8d
 	mov	r14d,eax
@@ -78,38 +78,38 @@
 
 	xor	r13d,r8d
 	ror	r14d,9
-	xor	r15d,r10d
+	xor	r15d,r10d  ; f^g
 
 	mov	DWORDrsp,r12d
 	xor	r14d,eax
-	and	r15d,r8d
+	and	r15d,r8d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r11d
-	xor	r15d,r10d
+	add	r12d,r11d  ; T1+=h
+	xor	r15d,r10d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r8d
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,eax
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,eax
 
-	xor	r15d,ebx
-	ror	r13d,6
+	xor	r15d,ebx  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r11d,ebx
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r11d,edi
-	add	edx,r12d
-	add	r11d,r12d
+	xor	r11d,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	edx,r12d  ; d+=T1
+	add	r11d,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
-	add	r11d,r14d
+	lea	rbp,4+rbp  ; round++
+	add	r11d,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD4+rsi
 	mov	r13d,edx
 	mov	r14d,r11d
@@ -119,38 +119,38 @@
 
 	xor	r13d,edx
 	ror	r14d,9
-	xor	edi,r9d
+	xor	edi,r9d  ; f^g
 
 	mov	DWORD4+rsp,r12d
 	xor	r14d,r11d
-	and	edi,edx
+	and	edi,edx  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r10d
-	xor	edi,r9d
+	add	r12d,r10d  ; T1+=h
+	xor	edi,r9d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,edx
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,r11d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r11d
 
-	xor	edi,eax
-	ror	r13d,6
+	xor	edi,eax  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r10d,eax
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r10d,r15d
-	add	ecx,r12d
-	add	r10d,r12d
+	xor	r10d,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	ecx,r12d  ; d+=T1
+	add	r10d,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
-	add	r10d,r14d
+	lea	rbp,4+rbp  ; round++
+	add	r10d,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD8+rsi
 	mov	r13d,ecx
 	mov	r14d,r10d
@@ -160,38 +160,38 @@
 
 	xor	r13d,ecx
 	ror	r14d,9
-	xor	r15d,r8d
+	xor	r15d,r8d  ; f^g
 
 	mov	DWORD8+rsp,r12d
 	xor	r14d,r10d
-	and	r15d,ecx
+	and	r15d,ecx  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r9d
-	xor	r15d,r8d
+	add	r12d,r9d  ; T1+=h
+	xor	r15d,r8d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,ecx
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,r10d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r10d
 
-	xor	r15d,r11d
-	ror	r13d,6
+	xor	r15d,r11d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r9d,r11d
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r9d,edi
-	add	ebx,r12d
-	add	r9d,r12d
+	xor	r9d,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	ebx,r12d  ; d+=T1
+	add	r9d,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
-	add	r9d,r14d
+	lea	rbp,4+rbp  ; round++
+	add	r9d,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD12+rsi
 	mov	r13d,ebx
 	mov	r14d,r9d
@@ -201,38 +201,38 @@
 
 	xor	r13d,ebx
 	ror	r14d,9
-	xor	edi,edx
+	xor	edi,edx  ; f^g
 
 	mov	DWORD12+rsp,r12d
 	xor	r14d,r9d
-	and	edi,ebx
+	and	edi,ebx  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r8d
-	xor	edi,edx
+	add	r12d,r8d  ; T1+=h
+	xor	edi,edx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,ebx
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,r9d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r9d
 
-	xor	edi,r10d
-	ror	r13d,6
+	xor	edi,r10d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r8d,r10d
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r8d,r15d
-	add	eax,r12d
-	add	r8d,r12d
+	xor	r8d,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	eax,r12d  ; d+=T1
+	add	r8d,r12d  ; h+=T1
 
-	lea	rbp,20+rbp
-	add	r8d,r14d
+	lea	rbp,20+rbp  ; round++
+	add	r8d,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD16+rsi
 	mov	r13d,eax
 	mov	r14d,r8d
@@ -242,38 +242,38 @@
 
 	xor	r13d,eax
 	ror	r14d,9
-	xor	r15d,ecx
+	xor	r15d,ecx  ; f^g
 
 	mov	DWORD16+rsp,r12d
 	xor	r14d,r8d
-	and	r15d,eax
+	and	r15d,eax  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,edx
-	xor	r15d,ecx
+	add	r12d,edx  ; T1+=h
+	xor	r15d,ecx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,eax
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,r8d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r8d
 
-	xor	r15d,r9d
-	ror	r13d,6
+	xor	r15d,r9d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	edx,r9d
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	edx,edi
-	add	r11d,r12d
-	add	edx,r12d
+	xor	edx,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r11d,r12d  ; d+=T1
+	add	edx,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
-	add	edx,r14d
+	lea	rbp,4+rbp  ; round++
+	add	edx,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD20+rsi
 	mov	r13d,r11d
 	mov	r14d,edx
@@ -283,38 +283,38 @@
 
 	xor	r13d,r11d
 	ror	r14d,9
-	xor	edi,ebx
+	xor	edi,ebx  ; f^g
 
 	mov	DWORD20+rsp,r12d
 	xor	r14d,edx
-	and	edi,r11d
+	and	edi,r11d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,ecx
-	xor	edi,ebx
+	add	r12d,ecx  ; T1+=h
+	xor	edi,ebx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r11d
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,edx
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,edx
 
-	xor	edi,r8d
-	ror	r13d,6
+	xor	edi,r8d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	ecx,r8d
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	ecx,r15d
-	add	r10d,r12d
-	add	ecx,r12d
+	xor	ecx,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r10d,r12d  ; d+=T1
+	add	ecx,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
-	add	ecx,r14d
+	lea	rbp,4+rbp  ; round++
+	add	ecx,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD24+rsi
 	mov	r13d,r10d
 	mov	r14d,ecx
@@ -324,38 +324,38 @@
 
 	xor	r13d,r10d
 	ror	r14d,9
-	xor	r15d,eax
+	xor	r15d,eax  ; f^g
 
 	mov	DWORD24+rsp,r12d
 	xor	r14d,ecx
-	and	r15d,r10d
+	and	r15d,r10d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,ebx
-	xor	r15d,eax
+	add	r12d,ebx  ; T1+=h
+	xor	r15d,eax  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r10d
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,ecx
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,ecx
 
-	xor	r15d,edx
-	ror	r13d,6
+	xor	r15d,edx  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	ebx,edx
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	ebx,edi
-	add	r9d,r12d
-	add	ebx,r12d
+	xor	ebx,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r9d,r12d  ; d+=T1
+	add	ebx,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
-	add	ebx,r14d
+	lea	rbp,4+rbp  ; round++
+	add	ebx,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD28+rsi
 	mov	r13d,r9d
 	mov	r14d,ebx
@@ -365,38 +365,38 @@
 
 	xor	r13d,r9d
 	ror	r14d,9
-	xor	edi,r11d
+	xor	edi,r11d  ; f^g
 
 	mov	DWORD28+rsp,r12d
 	xor	r14d,ebx
-	and	edi,r9d
+	and	edi,r9d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,eax
-	xor	edi,r11d
+	add	r12d,eax  ; T1+=h
+	xor	edi,r11d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r9d
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,ebx
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,ebx
 
-	xor	edi,ecx
-	ror	r13d,6
+	xor	edi,ecx  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	eax,ecx
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	eax,r15d
-	add	r8d,r12d
-	add	eax,r12d
+	xor	eax,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r8d,r12d  ; d+=T1
+	add	eax,r12d  ; h+=T1
 
-	lea	rbp,20+rbp
-	add	eax,r14d
+	lea	rbp,20+rbp  ; round++
+	add	eax,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD32+rsi
 	mov	r13d,r8d
 	mov	r14d,eax
@@ -406,38 +406,38 @@
 
 	xor	r13d,r8d
 	ror	r14d,9
-	xor	r15d,r10d
+	xor	r15d,r10d  ; f^g
 
 	mov	DWORD32+rsp,r12d
 	xor	r14d,eax
-	and	r15d,r8d
+	and	r15d,r8d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r11d
-	xor	r15d,r10d
+	add	r12d,r11d  ; T1+=h
+	xor	r15d,r10d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r8d
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,eax
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,eax
 
-	xor	r15d,ebx
-	ror	r13d,6
+	xor	r15d,ebx  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r11d,ebx
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r11d,edi
-	add	edx,r12d
-	add	r11d,r12d
+	xor	r11d,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	edx,r12d  ; d+=T1
+	add	r11d,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
-	add	r11d,r14d
+	lea	rbp,4+rbp  ; round++
+	add	r11d,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD36+rsi
 	mov	r13d,edx
 	mov	r14d,r11d
@@ -447,38 +447,38 @@
 
 	xor	r13d,edx
 	ror	r14d,9
-	xor	edi,r9d
+	xor	edi,r9d  ; f^g
 
 	mov	DWORD36+rsp,r12d
 	xor	r14d,r11d
-	and	edi,edx
+	and	edi,edx  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r10d
-	xor	edi,r9d
+	add	r12d,r10d  ; T1+=h
+	xor	edi,r9d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,edx
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,r11d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r11d
 
-	xor	edi,eax
-	ror	r13d,6
+	xor	edi,eax  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r10d,eax
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r10d,r15d
-	add	ecx,r12d
-	add	r10d,r12d
+	xor	r10d,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	ecx,r12d  ; d+=T1
+	add	r10d,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
-	add	r10d,r14d
+	lea	rbp,4+rbp  ; round++
+	add	r10d,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD40+rsi
 	mov	r13d,ecx
 	mov	r14d,r10d
@@ -488,38 +488,38 @@
 
 	xor	r13d,ecx
 	ror	r14d,9
-	xor	r15d,r8d
+	xor	r15d,r8d  ; f^g
 
 	mov	DWORD40+rsp,r12d
 	xor	r14d,r10d
-	and	r15d,ecx
+	and	r15d,ecx  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r9d
-	xor	r15d,r8d
+	add	r12d,r9d  ; T1+=h
+	xor	r15d,r8d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,ecx
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,r10d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r10d
 
-	xor	r15d,r11d
-	ror	r13d,6
+	xor	r15d,r11d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r9d,r11d
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r9d,edi
-	add	ebx,r12d
-	add	r9d,r12d
+	xor	r9d,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	ebx,r12d  ; d+=T1
+	add	r9d,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
-	add	r9d,r14d
+	lea	rbp,4+rbp  ; round++
+	add	r9d,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD44+rsi
 	mov	r13d,ebx
 	mov	r14d,r9d
@@ -529,38 +529,38 @@
 
 	xor	r13d,ebx
 	ror	r14d,9
-	xor	edi,edx
+	xor	edi,edx  ; f^g
 
 	mov	DWORD44+rsp,r12d
 	xor	r14d,r9d
-	and	edi,ebx
+	and	edi,ebx  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r8d
-	xor	edi,edx
+	add	r12d,r8d  ; T1+=h
+	xor	edi,edx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,ebx
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,r9d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r9d
 
-	xor	edi,r10d
-	ror	r13d,6
+	xor	edi,r10d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r8d,r10d
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r8d,r15d
-	add	eax,r12d
-	add	r8d,r12d
+	xor	r8d,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	eax,r12d  ; d+=T1
+	add	r8d,r12d  ; h+=T1
 
-	lea	rbp,20+rbp
-	add	r8d,r14d
+	lea	rbp,20+rbp  ; round++
+	add	r8d,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD48+rsi
 	mov	r13d,eax
 	mov	r14d,r8d
@@ -570,38 +570,38 @@
 
 	xor	r13d,eax
 	ror	r14d,9
-	xor	r15d,ecx
+	xor	r15d,ecx  ; f^g
 
 	mov	DWORD48+rsp,r12d
 	xor	r14d,r8d
-	and	r15d,eax
+	and	r15d,eax  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,edx
-	xor	r15d,ecx
+	add	r12d,edx  ; T1+=h
+	xor	r15d,ecx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,eax
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,r8d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r8d
 
-	xor	r15d,r9d
-	ror	r13d,6
+	xor	r15d,r9d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	edx,r9d
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	edx,edi
-	add	r11d,r12d
-	add	edx,r12d
+	xor	edx,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r11d,r12d  ; d+=T1
+	add	edx,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
-	add	edx,r14d
+	lea	rbp,4+rbp  ; round++
+	add	edx,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD52+rsi
 	mov	r13d,r11d
 	mov	r14d,edx
@@ -611,38 +611,38 @@
 
 	xor	r13d,r11d
 	ror	r14d,9
-	xor	edi,ebx
+	xor	edi,ebx  ; f^g
 
 	mov	DWORD52+rsp,r12d
 	xor	r14d,edx
-	and	edi,r11d
+	and	edi,r11d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,ecx
-	xor	edi,ebx
+	add	r12d,ecx  ; T1+=h
+	xor	edi,ebx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r11d
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,edx
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,edx
 
-	xor	edi,r8d
-	ror	r13d,6
+	xor	edi,r8d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	ecx,r8d
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	ecx,r15d
-	add	r10d,r12d
-	add	ecx,r12d
+	xor	ecx,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r10d,r12d  ; d+=T1
+	add	ecx,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
-	add	ecx,r14d
+	lea	rbp,4+rbp  ; round++
+	add	ecx,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD56+rsi
 	mov	r13d,r10d
 	mov	r14d,ecx
@@ -652,38 +652,38 @@
 
 	xor	r13d,r10d
 	ror	r14d,9
-	xor	r15d,eax
+	xor	r15d,eax  ; f^g
 
 	mov	DWORD56+rsp,r12d
 	xor	r14d,ecx
-	and	r15d,r10d
+	and	r15d,r10d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,ebx
-	xor	r15d,eax
+	add	r12d,ebx  ; T1+=h
+	xor	r15d,eax  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r10d
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,ecx
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,ecx
 
-	xor	r15d,edx
-	ror	r13d,6
+	xor	r15d,edx  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	ebx,edx
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	ebx,edi
-	add	r9d,r12d
-	add	ebx,r12d
+	xor	ebx,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r9d,r12d  ; d+=T1
+	add	ebx,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
-	add	ebx,r14d
+	lea	rbp,4+rbp  ; round++
+	add	ebx,r14d  ; h+=Sigma0(a)
 	mov	r12d,DWORD60+rsi
 	mov	r13d,r9d
 	mov	r14d,ebx
@@ -693,37 +693,37 @@
 
 	xor	r13d,r9d
 	ror	r14d,9
-	xor	edi,r11d
+	xor	edi,r11d  ; f^g
 
 	mov	DWORD60+rsp,r12d
 	xor	r14d,ebx
-	and	edi,r9d
+	and	edi,r9d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,eax
-	xor	edi,r11d
+	add	r12d,eax  ; T1+=h
+	xor	edi,r11d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r9d
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,ebx
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,ebx
 
-	xor	edi,ecx
-	ror	r13d,6
+	xor	edi,ecx  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	eax,ecx
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	eax,r15d
-	add	r8d,r12d
-	add	eax,r12d
+	xor	eax,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r8d,r12d  ; d+=T1
+	add	eax,r12d  ; h+=T1
 
-	lea	rbp,20+rbp
+	lea	rbp,20+rbp  ; round++
 	jmp	NEAR $L$rounds_16_xx
 ALIGN	16
 $L$rounds_16_xx:
@@ -732,7 +732,7 @@
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	eax,r14d
+	add	eax,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,r15d
 	ror	r15d,2
 
@@ -743,8 +743,8 @@
 	shr	r14d,10
 
 	ror	r15d,17
-	xor	r12d,r13d
-	xor	r15d,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	r15d,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD36+rsp
 
 	add	r12d,DWORDrsp
@@ -756,43 +756,43 @@
 
 	xor	r13d,r8d
 	ror	r14d,9
-	xor	r15d,r10d
+	xor	r15d,r10d  ; f^g
 
 	mov	DWORDrsp,r12d
 	xor	r14d,eax
-	and	r15d,r8d
+	and	r15d,r8d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r11d
-	xor	r15d,r10d
+	add	r12d,r11d  ; T1+=h
+	xor	r15d,r10d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r8d
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,eax
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,eax
 
-	xor	r15d,ebx
-	ror	r13d,6
+	xor	r15d,ebx  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r11d,ebx
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r11d,edi
-	add	edx,r12d
-	add	r11d,r12d
+	xor	r11d,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	edx,r12d  ; d+=T1
+	add	r11d,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
+	lea	rbp,4+rbp  ; round++
 	mov	r13d,DWORD8+rsp
 	mov	edi,DWORD60+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	r11d,r14d
+	add	r11d,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,edi
 	ror	edi,2
 
@@ -803,8 +803,8 @@
 	shr	r14d,10
 
 	ror	edi,17
-	xor	r12d,r13d
-	xor	edi,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	edi,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD40+rsp
 
 	add	r12d,DWORD4+rsp
@@ -816,43 +816,43 @@
 
 	xor	r13d,edx
 	ror	r14d,9
-	xor	edi,r9d
+	xor	edi,r9d  ; f^g
 
 	mov	DWORD4+rsp,r12d
 	xor	r14d,r11d
-	and	edi,edx
+	and	edi,edx  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r10d
-	xor	edi,r9d
+	add	r12d,r10d  ; T1+=h
+	xor	edi,r9d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,edx
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,r11d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r11d
 
-	xor	edi,eax
-	ror	r13d,6
+	xor	edi,eax  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r10d,eax
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r10d,r15d
-	add	ecx,r12d
-	add	r10d,r12d
+	xor	r10d,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	ecx,r12d  ; d+=T1
+	add	r10d,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
+	lea	rbp,4+rbp  ; round++
 	mov	r13d,DWORD12+rsp
 	mov	r15d,DWORDrsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	r10d,r14d
+	add	r10d,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,r15d
 	ror	r15d,2
 
@@ -863,8 +863,8 @@
 	shr	r14d,10
 
 	ror	r15d,17
-	xor	r12d,r13d
-	xor	r15d,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	r15d,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD44+rsp
 
 	add	r12d,DWORD8+rsp
@@ -876,43 +876,43 @@
 
 	xor	r13d,ecx
 	ror	r14d,9
-	xor	r15d,r8d
+	xor	r15d,r8d  ; f^g
 
 	mov	DWORD8+rsp,r12d
 	xor	r14d,r10d
-	and	r15d,ecx
+	and	r15d,ecx  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r9d
-	xor	r15d,r8d
+	add	r12d,r9d  ; T1+=h
+	xor	r15d,r8d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,ecx
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,r10d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r10d
 
-	xor	r15d,r11d
-	ror	r13d,6
+	xor	r15d,r11d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r9d,r11d
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r9d,edi
-	add	ebx,r12d
-	add	r9d,r12d
+	xor	r9d,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	ebx,r12d  ; d+=T1
+	add	r9d,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
+	lea	rbp,4+rbp  ; round++
 	mov	r13d,DWORD16+rsp
 	mov	edi,DWORD4+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	r9d,r14d
+	add	r9d,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,edi
 	ror	edi,2
 
@@ -923,8 +923,8 @@
 	shr	r14d,10
 
 	ror	edi,17
-	xor	r12d,r13d
-	xor	edi,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	edi,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD48+rsp
 
 	add	r12d,DWORD12+rsp
@@ -936,43 +936,43 @@
 
 	xor	r13d,ebx
 	ror	r14d,9
-	xor	edi,edx
+	xor	edi,edx  ; f^g
 
 	mov	DWORD12+rsp,r12d
 	xor	r14d,r9d
-	and	edi,ebx
+	and	edi,ebx  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r8d
-	xor	edi,edx
+	add	r12d,r8d  ; T1+=h
+	xor	edi,edx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,ebx
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,r9d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r9d
 
-	xor	edi,r10d
-	ror	r13d,6
+	xor	edi,r10d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r8d,r10d
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r8d,r15d
-	add	eax,r12d
-	add	r8d,r12d
+	xor	r8d,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	eax,r12d  ; d+=T1
+	add	r8d,r12d  ; h+=T1
 
-	lea	rbp,20+rbp
+	lea	rbp,20+rbp  ; round++
 	mov	r13d,DWORD20+rsp
 	mov	r15d,DWORD8+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	r8d,r14d
+	add	r8d,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,r15d
 	ror	r15d,2
 
@@ -983,8 +983,8 @@
 	shr	r14d,10
 
 	ror	r15d,17
-	xor	r12d,r13d
-	xor	r15d,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	r15d,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD52+rsp
 
 	add	r12d,DWORD16+rsp
@@ -996,43 +996,43 @@
 
 	xor	r13d,eax
 	ror	r14d,9
-	xor	r15d,ecx
+	xor	r15d,ecx  ; f^g
 
 	mov	DWORD16+rsp,r12d
 	xor	r14d,r8d
-	and	r15d,eax
+	and	r15d,eax  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,edx
-	xor	r15d,ecx
+	add	r12d,edx  ; T1+=h
+	xor	r15d,ecx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,eax
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,r8d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r8d
 
-	xor	r15d,r9d
-	ror	r13d,6
+	xor	r15d,r9d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	edx,r9d
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	edx,edi
-	add	r11d,r12d
-	add	edx,r12d
+	xor	edx,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r11d,r12d  ; d+=T1
+	add	edx,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
+	lea	rbp,4+rbp  ; round++
 	mov	r13d,DWORD24+rsp
 	mov	edi,DWORD12+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	edx,r14d
+	add	edx,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,edi
 	ror	edi,2
 
@@ -1043,8 +1043,8 @@
 	shr	r14d,10
 
 	ror	edi,17
-	xor	r12d,r13d
-	xor	edi,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	edi,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD56+rsp
 
 	add	r12d,DWORD20+rsp
@@ -1056,43 +1056,43 @@
 
 	xor	r13d,r11d
 	ror	r14d,9
-	xor	edi,ebx
+	xor	edi,ebx  ; f^g
 
 	mov	DWORD20+rsp,r12d
 	xor	r14d,edx
-	and	edi,r11d
+	and	edi,r11d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,ecx
-	xor	edi,ebx
+	add	r12d,ecx  ; T1+=h
+	xor	edi,ebx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r11d
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,edx
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,edx
 
-	xor	edi,r8d
-	ror	r13d,6
+	xor	edi,r8d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	ecx,r8d
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	ecx,r15d
-	add	r10d,r12d
-	add	ecx,r12d
+	xor	ecx,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r10d,r12d  ; d+=T1
+	add	ecx,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
+	lea	rbp,4+rbp  ; round++
 	mov	r13d,DWORD28+rsp
 	mov	r15d,DWORD16+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	ecx,r14d
+	add	ecx,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,r15d
 	ror	r15d,2
 
@@ -1103,8 +1103,8 @@
 	shr	r14d,10
 
 	ror	r15d,17
-	xor	r12d,r13d
-	xor	r15d,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	r15d,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD60+rsp
 
 	add	r12d,DWORD24+rsp
@@ -1116,43 +1116,43 @@
 
 	xor	r13d,r10d
 	ror	r14d,9
-	xor	r15d,eax
+	xor	r15d,eax  ; f^g
 
 	mov	DWORD24+rsp,r12d
 	xor	r14d,ecx
-	and	r15d,r10d
+	and	r15d,r10d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,ebx
-	xor	r15d,eax
+	add	r12d,ebx  ; T1+=h
+	xor	r15d,eax  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r10d
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,ecx
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,ecx
 
-	xor	r15d,edx
-	ror	r13d,6
+	xor	r15d,edx  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	ebx,edx
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	ebx,edi
-	add	r9d,r12d
-	add	ebx,r12d
+	xor	ebx,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r9d,r12d  ; d+=T1
+	add	ebx,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
+	lea	rbp,4+rbp  ; round++
 	mov	r13d,DWORD32+rsp
 	mov	edi,DWORD20+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	ebx,r14d
+	add	ebx,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,edi
 	ror	edi,2
 
@@ -1163,8 +1163,8 @@
 	shr	r14d,10
 
 	ror	edi,17
-	xor	r12d,r13d
-	xor	edi,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	edi,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORDrsp
 
 	add	r12d,DWORD28+rsp
@@ -1176,43 +1176,43 @@
 
 	xor	r13d,r9d
 	ror	r14d,9
-	xor	edi,r11d
+	xor	edi,r11d  ; f^g
 
 	mov	DWORD28+rsp,r12d
 	xor	r14d,ebx
-	and	edi,r9d
+	and	edi,r9d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,eax
-	xor	edi,r11d
+	add	r12d,eax  ; T1+=h
+	xor	edi,r11d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r9d
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,ebx
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,ebx
 
-	xor	edi,ecx
-	ror	r13d,6
+	xor	edi,ecx  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	eax,ecx
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	eax,r15d
-	add	r8d,r12d
-	add	eax,r12d
+	xor	eax,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r8d,r12d  ; d+=T1
+	add	eax,r12d  ; h+=T1
 
-	lea	rbp,20+rbp
+	lea	rbp,20+rbp  ; round++
 	mov	r13d,DWORD36+rsp
 	mov	r15d,DWORD24+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	eax,r14d
+	add	eax,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,r15d
 	ror	r15d,2
 
@@ -1223,8 +1223,8 @@
 	shr	r14d,10
 
 	ror	r15d,17
-	xor	r12d,r13d
-	xor	r15d,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	r15d,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD4+rsp
 
 	add	r12d,DWORD32+rsp
@@ -1236,43 +1236,43 @@
 
 	xor	r13d,r8d
 	ror	r14d,9
-	xor	r15d,r10d
+	xor	r15d,r10d  ; f^g
 
 	mov	DWORD32+rsp,r12d
 	xor	r14d,eax
-	and	r15d,r8d
+	and	r15d,r8d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r11d
-	xor	r15d,r10d
+	add	r12d,r11d  ; T1+=h
+	xor	r15d,r10d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r8d
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,eax
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,eax
 
-	xor	r15d,ebx
-	ror	r13d,6
+	xor	r15d,ebx  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r11d,ebx
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r11d,edi
-	add	edx,r12d
-	add	r11d,r12d
+	xor	r11d,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	edx,r12d  ; d+=T1
+	add	r11d,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
+	lea	rbp,4+rbp  ; round++
 	mov	r13d,DWORD40+rsp
 	mov	edi,DWORD28+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	r11d,r14d
+	add	r11d,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,edi
 	ror	edi,2
 
@@ -1283,8 +1283,8 @@
 	shr	r14d,10
 
 	ror	edi,17
-	xor	r12d,r13d
-	xor	edi,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	edi,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD8+rsp
 
 	add	r12d,DWORD36+rsp
@@ -1296,43 +1296,43 @@
 
 	xor	r13d,edx
 	ror	r14d,9
-	xor	edi,r9d
+	xor	edi,r9d  ; f^g
 
 	mov	DWORD36+rsp,r12d
 	xor	r14d,r11d
-	and	edi,edx
+	and	edi,edx  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r10d
-	xor	edi,r9d
+	add	r12d,r10d  ; T1+=h
+	xor	edi,r9d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,edx
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,r11d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r11d
 
-	xor	edi,eax
-	ror	r13d,6
+	xor	edi,eax  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r10d,eax
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r10d,r15d
-	add	ecx,r12d
-	add	r10d,r12d
+	xor	r10d,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	ecx,r12d  ; d+=T1
+	add	r10d,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
+	lea	rbp,4+rbp  ; round++
 	mov	r13d,DWORD44+rsp
 	mov	r15d,DWORD32+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	r10d,r14d
+	add	r10d,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,r15d
 	ror	r15d,2
 
@@ -1343,8 +1343,8 @@
 	shr	r14d,10
 
 	ror	r15d,17
-	xor	r12d,r13d
-	xor	r15d,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	r15d,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD12+rsp
 
 	add	r12d,DWORD40+rsp
@@ -1356,43 +1356,43 @@
 
 	xor	r13d,ecx
 	ror	r14d,9
-	xor	r15d,r8d
+	xor	r15d,r8d  ; f^g
 
 	mov	DWORD40+rsp,r12d
 	xor	r14d,r10d
-	and	r15d,ecx
+	and	r15d,ecx  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r9d
-	xor	r15d,r8d
+	add	r12d,r9d  ; T1+=h
+	xor	r15d,r8d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,ecx
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,r10d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r10d
 
-	xor	r15d,r11d
-	ror	r13d,6
+	xor	r15d,r11d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r9d,r11d
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r9d,edi
-	add	ebx,r12d
-	add	r9d,r12d
+	xor	r9d,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	ebx,r12d  ; d+=T1
+	add	r9d,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
+	lea	rbp,4+rbp  ; round++
 	mov	r13d,DWORD48+rsp
 	mov	edi,DWORD36+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	r9d,r14d
+	add	r9d,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,edi
 	ror	edi,2
 
@@ -1403,8 +1403,8 @@
 	shr	r14d,10
 
 	ror	edi,17
-	xor	r12d,r13d
-	xor	edi,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	edi,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD16+rsp
 
 	add	r12d,DWORD44+rsp
@@ -1416,43 +1416,43 @@
 
 	xor	r13d,ebx
 	ror	r14d,9
-	xor	edi,edx
+	xor	edi,edx  ; f^g
 
 	mov	DWORD44+rsp,r12d
 	xor	r14d,r9d
-	and	edi,ebx
+	and	edi,ebx  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,r8d
-	xor	edi,edx
+	add	r12d,r8d  ; T1+=h
+	xor	edi,edx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,ebx
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,r9d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r9d
 
-	xor	edi,r10d
-	ror	r13d,6
+	xor	edi,r10d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	r8d,r10d
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	r8d,r15d
-	add	eax,r12d
-	add	r8d,r12d
+	xor	r8d,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	eax,r12d  ; d+=T1
+	add	r8d,r12d  ; h+=T1
 
-	lea	rbp,20+rbp
+	lea	rbp,20+rbp  ; round++
 	mov	r13d,DWORD52+rsp
 	mov	r15d,DWORD40+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	r8d,r14d
+	add	r8d,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,r15d
 	ror	r15d,2
 
@@ -1463,8 +1463,8 @@
 	shr	r14d,10
 
 	ror	r15d,17
-	xor	r12d,r13d
-	xor	r15d,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	r15d,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD20+rsp
 
 	add	r12d,DWORD48+rsp
@@ -1476,43 +1476,43 @@
 
 	xor	r13d,eax
 	ror	r14d,9
-	xor	r15d,ecx
+	xor	r15d,ecx  ; f^g
 
 	mov	DWORD48+rsp,r12d
 	xor	r14d,r8d
-	and	r15d,eax
+	and	r15d,eax  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,edx
-	xor	r15d,ecx
+	add	r12d,edx  ; T1+=h
+	xor	r15d,ecx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,eax
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,r8d
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,r8d
 
-	xor	r15d,r9d
-	ror	r13d,6
+	xor	r15d,r9d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	edx,r9d
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	edx,edi
-	add	r11d,r12d
-	add	edx,r12d
+	xor	edx,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r11d,r12d  ; d+=T1
+	add	edx,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
+	lea	rbp,4+rbp  ; round++
 	mov	r13d,DWORD56+rsp
 	mov	edi,DWORD44+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	edx,r14d
+	add	edx,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,edi
 	ror	edi,2
 
@@ -1523,8 +1523,8 @@
 	shr	r14d,10
 
 	ror	edi,17
-	xor	r12d,r13d
-	xor	edi,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	edi,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD24+rsp
 
 	add	r12d,DWORD52+rsp
@@ -1536,43 +1536,43 @@
 
 	xor	r13d,r11d
 	ror	r14d,9
-	xor	edi,ebx
+	xor	edi,ebx  ; f^g
 
 	mov	DWORD52+rsp,r12d
 	xor	r14d,edx
-	and	edi,r11d
+	and	edi,r11d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,ecx
-	xor	edi,ebx
+	add	r12d,ecx  ; T1+=h
+	xor	edi,ebx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r11d
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,edx
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,edx
 
-	xor	edi,r8d
-	ror	r13d,6
+	xor	edi,r8d  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	ecx,r8d
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	ecx,r15d
-	add	r10d,r12d
-	add	ecx,r12d
+	xor	ecx,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r10d,r12d  ; d+=T1
+	add	ecx,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
+	lea	rbp,4+rbp  ; round++
 	mov	r13d,DWORD60+rsp
 	mov	r15d,DWORD48+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	ecx,r14d
+	add	ecx,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,r15d
 	ror	r15d,2
 
@@ -1583,8 +1583,8 @@
 	shr	r14d,10
 
 	ror	r15d,17
-	xor	r12d,r13d
-	xor	r15d,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	r15d,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD28+rsp
 
 	add	r12d,DWORD56+rsp
@@ -1596,43 +1596,43 @@
 
 	xor	r13d,r10d
 	ror	r14d,9
-	xor	r15d,eax
+	xor	r15d,eax  ; f^g
 
 	mov	DWORD56+rsp,r12d
 	xor	r14d,ecx
-	and	r15d,r10d
+	and	r15d,r10d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,ebx
-	xor	r15d,eax
+	add	r12d,ebx  ; T1+=h
+	xor	r15d,eax  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r10d
-	add	r12d,r15d
+	add	r12d,r15d  ; T1+=Ch(e,f,g)
 
 	mov	r15d,ecx
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,ecx
 
-	xor	r15d,edx
-	ror	r13d,6
+	xor	r15d,edx  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	ebx,edx
 
 	and	edi,r15d
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	ebx,edi
-	add	r9d,r12d
-	add	ebx,r12d
+	xor	ebx,edi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r9d,r12d  ; d+=T1
+	add	ebx,r12d  ; h+=T1
 
-	lea	rbp,4+rbp
+	lea	rbp,4+rbp  ; round++
 	mov	r13d,DWORDrsp
 	mov	edi,DWORD52+rsp
 
 	mov	r12d,r13d
 	ror	r13d,11
-	add	ebx,r14d
+	add	ebx,r14d  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14d,edi
 	ror	edi,2
 
@@ -1643,8 +1643,8 @@
 	shr	r14d,10
 
 	ror	edi,17
-	xor	r12d,r13d
-	xor	edi,r14d
+	xor	r12d,r13d  ; sigma0(X(i+1)&0xf)
+	xor	edi,r14d  ; sigma1(X(i+14)&0xf)
 	add	r12d,DWORD32+rsp
 
 	add	r12d,DWORD60+rsp
@@ -1656,42 +1656,42 @@
 
 	xor	r13d,r9d
 	ror	r14d,9
-	xor	edi,r11d
+	xor	edi,r11d  ; f^g
 
 	mov	DWORD60+rsp,r12d
 	xor	r14d,ebx
-	and	edi,r9d
+	and	edi,r9d  ; (f^g)&e
 
 	ror	r13d,5
-	add	r12d,eax
-	xor	edi,r11d
+	add	r12d,eax  ; T1+=h
+	xor	edi,r11d  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14d,11
 	xor	r13d,r9d
-	add	r12d,edi
+	add	r12d,edi  ; T1+=Ch(e,f,g)
 
 	mov	edi,ebx
-	add	r12d,DWORDrbp
+	add	r12d,DWORDrbp  ; T1+=Kround
 	xor	r14d,ebx
 
-	xor	edi,ecx
-	ror	r13d,6
+	xor	edi,ecx  ; a^b, b^c in next round
+	ror	r13d,6  ; Sigma1(e)
 	mov	eax,ecx
 
 	and	r15d,edi
-	ror	r14d,2
-	add	r12d,r13d
+	ror	r14d,2  ; Sigma0(a)
+	add	r12d,r13d  ; T1+=Sigma1(e)
 
-	xor	eax,r15d
-	add	r8d,r12d
-	add	eax,r12d
+	xor	eax,r15d  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r8d,r12d  ; d+=T1
+	add	eax,r12d  ; h+=T1
 
-	lea	rbp,20+rbp
+	lea	rbp,20+rbp  ; round++
 	cmp	BYTE3+rbp,0
 	jnz	NEAR $L$rounds_16_xx
 
 	mov	rdi,QWORD((64+0))+rsp
-	add	eax,r14d
+	add	eax,r14d  ; modulo-scheduled h+=Sigma0(a)
 	lea	rsi,64+rsi
 
 	add	eax,DWORDrdi
@@ -1785,7 +1785,7 @@
 	DB	52,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121
 	DB	32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46
 	DB	111,114,103,62,0
-section	.text
+section	.text code align=64
 
 global	sha256_block_data_order_hw
 
@@ -1810,16 +1810,16 @@
 	movaps	XMMWORD(-8-16)+rax,xmm10
 $L$prologue_shaext:
 	lea	rcx,((K256+128))
-	movdqu	xmm1,XMMWORDrdi
-	movdqu	xmm2,XMMWORD16+rdi
-	movdqa	xmm7,XMMWORD((512-128))+rcx
-
-	pshufd	xmm0,xmm1,0x1b
-	pshufd	xmm1,xmm1,0xb1
-	pshufd	xmm2,xmm2,0x1b
-	movdqa	xmm8,xmm7
-	palignr	xmm1,xmm2,8
-	punpcklqdq	xmm2,xmm0
+	movdqu	xmm1,XMMWORDrdi  ; DCBA
+	movdqu	xmm2,XMMWORD16+rdi  ; HGFE
+	movdqa	xmm7,XMMWORD((512-128))+rcx  ; byte swap mask
+
+	pshufd	xmm0,xmm1,0x1b  ; ABCD
+	pshufd	xmm1,xmm1,0xb1  ; CDAB
+	pshufd	xmm2,xmm2,0x1b  ; EFGH
+	movdqa	xmm8,xmm7  ; offload
+	palignr	xmm1,xmm2,8  ; ABEF
+	punpcklqdq	xmm2,xmm0  ; CDGH
 	jmp	NEAR $L$oop_shaext
 
 ALIGN	16
@@ -1833,17 +1833,17 @@
 	movdqa	xmm0,XMMWORD((0-128))+rcx
 	paddd	xmm0,xmm3
 	pshufb	xmm4,xmm7
-	movdqa	xmm10,xmm2
-	sha256rnds2	xmm2,xmm1
+	movdqa	xmm10,xmm2  ; offload
+	sha256rnds2	xmm2,xmm1  ; 0-3
 	pshufd	xmm0,xmm0,0x0e
 	nop
-	movdqa	xmm9,xmm1
+	movdqa	xmm9,xmm1  ; offload
 	sha256rnds2	xmm1,xmm2
 
 	movdqa	xmm0,XMMWORD((32-128))+rcx
 	paddd	xmm0,xmm4
 	pshufb	xmm5,xmm7
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 4-7
 	pshufd	xmm0,xmm0,0x0e
 	lea	rsi,64+rsi
 	sha256msg1	xmm3,xmm4
@@ -1852,7 +1852,7 @@
 	movdqa	xmm0,XMMWORD((64-128))+rcx
 	paddd	xmm0,xmm5
 	pshufb	xmm6,xmm7
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 8-11
 	pshufd	xmm0,xmm0,0x0e
 	movdqa	xmm7,xmm6
 	palignr	xmm7,xmm5,4
@@ -1864,7 +1864,7 @@
 	movdqa	xmm0,XMMWORD((96-128))+rcx
 	paddd	xmm0,xmm6
 	sha256msg2	xmm3,xmm6
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 12-15
 	pshufd	xmm0,xmm0,0x0e
 	movdqa	xmm7,xmm3
 	palignr	xmm7,xmm6,4
@@ -1875,7 +1875,7 @@
 	movdqa	xmm0,XMMWORD((128-128))+rcx
 	paddd	xmm0,xmm3
 	sha256msg2	xmm4,xmm3
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 16-19...
 	pshufd	xmm0,xmm0,0x0e
 	movdqa	xmm7,xmm4
 	palignr	xmm7,xmm3,4
@@ -1886,7 +1886,7 @@
 	movdqa	xmm0,XMMWORD((160-128))+rcx
 	paddd	xmm0,xmm4
 	sha256msg2	xmm5,xmm4
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 16-19...
 	pshufd	xmm0,xmm0,0x0e
 	movdqa	xmm7,xmm5
 	palignr	xmm7,xmm4,4
@@ -1897,7 +1897,7 @@
 	movdqa	xmm0,XMMWORD((192-128))+rcx
 	paddd	xmm0,xmm5
 	sha256msg2	xmm6,xmm5
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 16-19...
 	pshufd	xmm0,xmm0,0x0e
 	movdqa	xmm7,xmm6
 	palignr	xmm7,xmm5,4
@@ -1908,7 +1908,7 @@
 	movdqa	xmm0,XMMWORD((224-128))+rcx
 	paddd	xmm0,xmm6
 	sha256msg2	xmm3,xmm6
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 16-19...
 	pshufd	xmm0,xmm0,0x0e
 	movdqa	xmm7,xmm3
 	palignr	xmm7,xmm6,4
@@ -1919,7 +1919,7 @@
 	movdqa	xmm0,XMMWORD((256-128))+rcx
 	paddd	xmm0,xmm3
 	sha256msg2	xmm4,xmm3
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 16-19...
 	pshufd	xmm0,xmm0,0x0e
 	movdqa	xmm7,xmm4
 	palignr	xmm7,xmm3,4
@@ -1930,7 +1930,7 @@
 	movdqa	xmm0,XMMWORD((288-128))+rcx
 	paddd	xmm0,xmm4
 	sha256msg2	xmm5,xmm4
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 16-19...
 	pshufd	xmm0,xmm0,0x0e
 	movdqa	xmm7,xmm5
 	palignr	xmm7,xmm4,4
@@ -1941,7 +1941,7 @@
 	movdqa	xmm0,XMMWORD((320-128))+rcx
 	paddd	xmm0,xmm5
 	sha256msg2	xmm6,xmm5
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 16-19...
 	pshufd	xmm0,xmm0,0x0e
 	movdqa	xmm7,xmm6
 	palignr	xmm7,xmm5,4
@@ -1952,7 +1952,7 @@
 	movdqa	xmm0,XMMWORD((352-128))+rcx
 	paddd	xmm0,xmm6
 	sha256msg2	xmm3,xmm6
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 16-19...
 	pshufd	xmm0,xmm0,0x0e
 	movdqa	xmm7,xmm3
 	palignr	xmm7,xmm6,4
@@ -1963,7 +1963,7 @@
 	movdqa	xmm0,XMMWORD((384-128))+rcx
 	paddd	xmm0,xmm3
 	sha256msg2	xmm4,xmm3
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 16-19...
 	pshufd	xmm0,xmm0,0x0e
 	movdqa	xmm7,xmm4
 	palignr	xmm7,xmm3,4
@@ -1974,7 +1974,7 @@
 	movdqa	xmm0,XMMWORD((416-128))+rcx
 	paddd	xmm0,xmm4
 	sha256msg2	xmm5,xmm4
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 52-55
 	pshufd	xmm0,xmm0,0x0e
 	movdqa	xmm7,xmm5
 	palignr	xmm7,xmm4,4
@@ -1983,7 +1983,7 @@
 
 	movdqa	xmm0,XMMWORD((448-128))+rcx
 	paddd	xmm0,xmm5
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 56-59
 	pshufd	xmm0,xmm0,0x0e
 	sha256msg2	xmm6,xmm5
 	movdqa	xmm7,xmm8
@@ -1992,7 +1992,7 @@
 	movdqa	xmm0,XMMWORD((480-128))+rcx
 	paddd	xmm0,xmm6
 	nop
-	sha256rnds2	xmm2,xmm1
+	sha256rnds2	xmm2,xmm1  ; 60-63
 	pshufd	xmm0,xmm0,0x0e
 	dec	rdx
 	nop
@@ -2002,11 +2002,11 @@
 	paddd	xmm1,xmm9
 	jnz	NEAR $L$oop_shaext
 
-	pshufd	xmm2,xmm2,0xb1
-	pshufd	xmm7,xmm1,0x1b
-	pshufd	xmm1,xmm1,0xb1
-	punpckhqdq	xmm1,xmm2
-	palignr	xmm2,xmm7,8
+	pshufd	xmm2,xmm2,0xb1  ; DCHG
+	pshufd	xmm7,xmm1,0x1b  ; FEBA
+	pshufd	xmm1,xmm1,0xb1  ; BAFE
+	punpckhqdq	xmm1,xmm2  ; DCBA
+	palignr	xmm2,xmm7,8  ; HGFE
 
 	movdqu	XMMWORDrdi,xmm1
 	movdqu	XMMWORD16+rdi,xmm2
@@ -2037,7 +2037,7 @@
 
 
 _CET_ENDBR
-	mov	rax,rsp
+	mov	rax,rsp  ; copy %rsp
 
 	push	rbx
 
@@ -2051,14 +2051,14 @@
 
 	push	r15
 
-	shl	rdx,4
+	shl	rdx,4  ; num*16
 	sub	rsp,160
-	lea	rdx,rdx*4+rsi
-	and	rsp,-64
-	mov	QWORD((64+0))+rsp,rdi
-	mov	QWORD((64+8))+rsp,rsi
-	mov	QWORD((64+16))+rsp,rdx
-	mov	QWORD88+rsp,rax
+	lea	rdx,rdx*4+rsi  ; inp+num*16*4
+	and	rsp,-64  ; align stack frame
+	mov	QWORD((64+0))+rsp,rdi  ; save ctx, 1st arg
+	mov	QWORD((64+8))+rsp,rsi  ; save inp, 2nd arh
+	mov	QWORD((64+16))+rsp,rdx  ; save end pointer, "3rd" arg
+	mov	QWORD88+rsp,rax  ; save copy of %rsp
 
 	movaps	XMMWORD(64+32)+rsp,xmm6
 	movaps	XMMWORD(64+48)+rsp,xmm7
@@ -2074,8 +2074,8 @@
 	mov	r9d,DWORD20+rdi
 	mov	r10d,DWORD24+rdi
 	mov	r11d,DWORD28+rdi
-
-
+; movdqa	K256+512+32(%rip),%xmm8
+; movdqa	K256+512+64(%rip),%xmm9
 	jmp	NEAR $L$loop_ssse3
 ALIGN	16
 $L$loop_ssse3:
@@ -2102,14 +2102,14 @@
 	movdqa	XMMWORD16+rsp,xmm5
 	mov	edi,ebx
 	movdqa	XMMWORD32+rsp,xmm6
-	xor	edi,ecx
+	xor	edi,ecx  ; magic
 	movdqa	XMMWORD48+rsp,xmm7
 	mov	r13d,r8d
 	jmp	NEAR $L$ssse3_00_47
 
 ALIGN	16
 $L$ssse3_00_47:
-	sub	rbp,-128
+	sub	rbp,-128  ; size optimization
 	ror	r13d,14
 	movdqa	xmm4,xmm1
 	mov	eax,r14d
@@ -3170,7 +3170,7 @@
 
 
 _CET_ENDBR
-	mov	rax,rsp
+	mov	rax,rsp  ; copy %rsp
 
 	push	rbx
 
@@ -3184,14 +3184,14 @@
 
 	push	r15
 
-	shl	rdx,4
+	shl	rdx,4  ; num*16
 	sub	rsp,160
-	lea	rdx,rdx*4+rsi
-	and	rsp,-64
-	mov	QWORD((64+0))+rsp,rdi
-	mov	QWORD((64+8))+rsp,rsi
-	mov	QWORD((64+16))+rsp,rdx
-	mov	QWORD88+rsp,rax
+	lea	rdx,rdx*4+rsi  ; inp+num*16*4
+	and	rsp,-64  ; align stack frame
+	mov	QWORD((64+0))+rsp,rdi  ; save ctx, 1st arg
+	mov	QWORD((64+8))+rsp,rsi  ; save inp, 2nd arh
+	mov	QWORD((64+16))+rsp,rdx  ; save end pointer, "3rd" arg
+	mov	QWORD88+rsp,rax  ; save copy of %rsp
 
 	movaps	XMMWORD(64+32)+rsp,xmm6
 	movaps	XMMWORD(64+48)+rsp,xmm7
@@ -3232,14 +3232,14 @@
 	vmovdqa	XMMWORD16+rsp,xmm5
 	mov	edi,ebx
 	vmovdqa	XMMWORD32+rsp,xmm6
-	xor	edi,ecx
+	xor	edi,ecx  ; magic
 	vmovdqa	XMMWORD48+rsp,xmm7
 	mov	r13d,r8d
 	jmp	NEAR $L$avx_00_47
 
 ALIGN	16
 $L$avx_00_47:
-	sub	rbp,-128
+	sub	rbp,-128  ; size optimization
 	vpalignr	xmm4,xmm1,xmm0,4
 	shrd	r13d,r13d,14
 	mov	eax,r14d
@@ -4265,25 +4265,25 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HanderlData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; prologue label
+	cmp	rbx,r10  ; context->Rip<prologue label
 	jb	NEAR $L$in_prologue
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$in_prologue
-	mov	rsi,rax
-	mov	rax,QWORD((64+24))+rax
+	mov	rsi,rax  ; put aside Rsp
+	mov	rax,QWORD((64+24))+rax  ; pull 88(%rsp)
 
 	mov	rbx,QWORD((-8))+rax
 	mov	rbp,QWORD((-16))+rax
@@ -4291,49 +4291,49 @@
 	mov	r13,QWORD((-32))+rax
 	mov	r14,QWORD((-40))+rax
 	mov	r15,QWORD((-48))+rax
-	mov	QWORD144+r8,rbx
-	mov	QWORD160+r8,rbp
-	mov	QWORD216+r8,r12
-	mov	QWORD224+r8,r13
-	mov	QWORD232+r8,r14
-	mov	QWORD240+r8,r15
+	mov	QWORD144+r8,rbx  ; restore context->Rbx
+	mov	QWORD160+r8,rbp  ; restore context->Rbp
+	mov	QWORD216+r8,r12  ; restore context->R12
+	mov	QWORD224+r8,r13  ; restore context->R13
+	mov	QWORD232+r8,r14  ; restore context->R14
+	mov	QWORD240+r8,r15  ; restore context->R15
 
 	lea	r10,$L$epilogue
 	cmp	rbx,r10
-	jb	NEAR $L$in_prologue
+	jb	NEAR $L$in_prologue  ; non-AVX code
 
-	lea	rsi,((64+32))+rsi
-	lea	rdi,512+r8
+	lea	rsi,((64+32))+rsi  ; Xmm6- save area
+	lea	rdi,512+r8  ; &context.Xmm6
 	mov	ecx,8
-	DD	0xa548f3fc
+	DD	0xa548f3fc  ; cld; rep movsq
 
 $L$in_prologue:
 	mov	rdi,QWORD8+rax
 	mov	rsi,QWORD16+rax
-	mov	QWORD152+r8,rax
-	mov	QWORD168+r8,rsi
-	mov	QWORD176+r8,rdi
+	mov	QWORD152+r8,rax  ; restore context->Rsp
+	mov	QWORD168+r8,rsi  ; restore context->Rsi
+	mov	QWORD176+r8,rdi  ; restore context->Rdi
 
-	mov	rdi,QWORD40+r9
-	mov	rsi,r8
-	mov	ecx,154
-	DD	0xa548f3fc
+	mov	rdi,QWORD40+r9  ; disp->ContextRecord
+	mov	rsi,r8  ; context
+	mov	ecx,154  ; sizeof(CONTEXT)
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	mov	rsi,r9
-	xor	rcx,rcx
-	mov	rdx,QWORD8+rsi
-	mov	r8,QWORDrsi
-	mov	r9,QWORD16+rsi
-	mov	r10,QWORD40+rsi
-	lea	r11,56+rsi
-	lea	r12,24+rsi
-	mov	QWORD32+rsp,r10
-	mov	QWORD40+rsp,r11
-	mov	QWORD48+rsp,r12
-	mov	QWORD56+rsp,rcx
+	xor	rcx,rcx  ; arg1, UNW_FLAG_NHANDLER
+	mov	rdx,QWORD8+rsi  ; arg2, disp->ImageBase
+	mov	r8,QWORDrsi  ; arg3, disp->ControlPc
+	mov	r9,QWORD16+rsi  ; arg4, disp->FunctionEntry
+	mov	r10,QWORD40+rsi  ; disp->ContextRecord
+	lea	r11,56+rsi  ; &disp->HandlerData
+	lea	r12,24+rsi  ; &disp->EstablisherFrame
+	mov	QWORD32+rsp,r10  ; arg5
+	mov	QWORD40+rsp,r11  ; arg6
+	mov	QWORD48+rsp,r12  ; arg7
+	mov	QWORD56+rsp,rcx  ; arg8, (NULL)
 	call	QWORD__imp_RtlVirtualUnwind
 
-	mov	eax,1
+	mov	eax,1  ; ExceptionContinueSearch
 	add	rsp,64
 	popfq
 	pop	r15
@@ -4360,21 +4360,21 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
 	lea	r10,$L$prologue_shaext
-	cmp	rbx,r10
+	cmp	rbx,r10  ; context->Rip<.Lprologue
 	jb	NEAR $L$in_prologue
 
 	lea	r10,$L$epilogue_shaext
-	cmp	rbx,r10
+	cmp	rbx,r10  ; context->Rip>=.Lepilogue
 	jae	NEAR $L$in_prologue
 
 	lea	rsi,((-8-80))+rax
-	lea	rdi,512+r8
+	lea	rdi,512+r8  ; &context.Xmm6
 	mov	ecx,10
-	DD	0xa548f3fc
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	jmp	NEAR $L$in_prologue
 
@@ -4397,18 +4397,18 @@
 $L$SEH_info_sha256_block_data_order_nohw:
 	DB	9,0,0,0
 	DD	se_handler wrt ..imagebase
-	DD	$L$prologue wrt ..imagebase,$L$epilogue wrt ..imagebase
+	DD	$L$prologue wrt ..imagebase,$L$epilogue wrt ..imagebase  ; HandlerData
 $L$SEH_info_sha256_block_data_order_hw:
 	DB	9,0,0,0
 	DD	shaext_handler wrt ..imagebase
 $L$SEH_info_sha256_block_data_order_ssse3:
 	DB	9,0,0,0
 	DD	se_handler wrt ..imagebase
-	DD	$L$prologue_ssse3 wrt ..imagebase,$L$epilogue_ssse3 wrt ..imagebase
+	DD	$L$prologue_ssse3 wrt ..imagebase,$L$epilogue_ssse3 wrt ..imagebase  ; HandlerData
 $L$SEH_info_sha256_block_data_order_avx:
 	DB	9,0,0,0
 	DD	se_handler wrt ..imagebase
-	DD	$L$prologue_avx wrt ..imagebase,$L$epilogue_avx wrt ..imagebase
+	DD	$L$prologue_avx wrt ..imagebase,$L$epilogue_avx wrt ..imagebase  ; HandlerData
 %else
 ; Work around https://bugzilla.nasm.us/show_bug.cgi?id=3392738
 ret

boringssl-0.20260708.tar.xz/gen/bcm/sha512-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/sha512-x86_64-apple.S Changed

@@ -13,7 +13,7 @@
 _sha512_block_data_order_nohw:
 
 _CET_ENDBR
-	movq	%rsp,%rax
+	movq	%rsp,%rax  // copy %rsp
 
 	pushq	%rbx
 
@@ -27,14 +27,14 @@
 
 	pushq	%r15
 
-	shlq	$4,%rdx
+	shlq	$4,%rdx  // num*16
 	subq	$128+32,%rsp
-	leaq	(%rsi,%rdx,8),%rdx
-	andq	$-64,%rsp
-	movq	%rdi,128+0(%rsp)
-	movq	%rsi,128+8(%rsp)
-	movq	%rdx,128+16(%rsp)
-	movq	%rax,152(%rsp)
+	leaq	(%rsi,%rdx,8),%rdx  // inp+num*16*8
+	andq	$-64,%rsp  // align stack frame
+	movq	%rdi,128+0(%rsp)  // save ctx, 1st arg
+	movq	%rsi,128+8(%rsp)  // save inp, 2nd arh
+	movq	%rdx,128+16(%rsp)  // save end pointer, "3rd" arg
+	movq	%rax,152(%rsp)  // save copy of %rsp
 
 L$prologue:
 
@@ -52,7 +52,7 @@
 L$loop:
 	movq	%rbx,%rdi
 	leaq	K512(%rip),%rbp
-	xorq	%rcx,%rdi
+	xorq	%rcx,%rdi  // magic
 	movq	0(%rsi),%r12
 	movq	%r8,%r13
 	movq	%rax,%r14
@@ -62,38 +62,38 @@
 
 	xorq	%r8,%r13
 	rorq	$5,%r14
-	xorq	%r10,%r15
+	xorq	%r10,%r15  // f^g
 
 	movq	%r12,0(%rsp)
 	xorq	%rax,%r14
-	andq	%r8,%r15
+	andq	%r8,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r11,%r12
-	xorq	%r10,%r15
+	addq	%r11,%r12  // T1+=h
+	xorq	%r10,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r8,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rax,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rax,%r14
 
-	xorq	%rbx,%r15
-	rorq	$14,%r13
+	xorq	%rbx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rbx,%r11
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r11
-	addq	%r12,%rdx
-	addq	%r12,%r11
+	xorq	%rdi,%r11  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rdx  // d+=T1
+	addq	%r12,%r11  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%r11
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%r11  // h+=Sigma0(a)
 	movq	8(%rsi),%r12
 	movq	%rdx,%r13
 	movq	%r11,%r14
@@ -103,38 +103,38 @@
 
 	xorq	%rdx,%r13
 	rorq	$5,%r14
-	xorq	%r9,%rdi
+	xorq	%r9,%rdi  // f^g
 
 	movq	%r12,8(%rsp)
 	xorq	%r11,%r14
-	andq	%rdx,%rdi
+	andq	%rdx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r10,%r12
-	xorq	%r9,%rdi
+	addq	%r10,%r12  // T1+=h
+	xorq	%r9,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rdx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r11,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r11,%r14
 
-	xorq	%rax,%rdi
-	rorq	$14,%r13
+	xorq	%rax,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rax,%r10
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r10
-	addq	%r12,%rcx
-	addq	%r12,%r10
+	xorq	%r15,%r10  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rcx  // d+=T1
+	addq	%r12,%r10  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%r10
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%r10  // h+=Sigma0(a)
 	movq	16(%rsi),%r12
 	movq	%rcx,%r13
 	movq	%r10,%r14
@@ -144,38 +144,38 @@
 
 	xorq	%rcx,%r13
 	rorq	$5,%r14
-	xorq	%r8,%r15
+	xorq	%r8,%r15  // f^g
 
 	movq	%r12,16(%rsp)
 	xorq	%r10,%r14
-	andq	%rcx,%r15
+	andq	%rcx,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r9,%r12
-	xorq	%r8,%r15
+	addq	%r9,%r12  // T1+=h
+	xorq	%r8,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rcx,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r10,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r10,%r14
 
-	xorq	%r11,%r15
-	rorq	$14,%r13
+	xorq	%r11,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r11,%r9
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r9
-	addq	%r12,%rbx
-	addq	%r12,%r9
+	xorq	%rdi,%r9  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rbx  // d+=T1
+	addq	%r12,%r9  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%r9
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%r9  // h+=Sigma0(a)
 	movq	24(%rsi),%r12
 	movq	%rbx,%r13
 	movq	%r9,%r14
@@ -185,38 +185,38 @@
 
 	xorq	%rbx,%r13
 	rorq	$5,%r14
-	xorq	%rdx,%rdi
+	xorq	%rdx,%rdi  // f^g
 
 	movq	%r12,24(%rsp)
 	xorq	%r9,%r14
-	andq	%rbx,%rdi
+	andq	%rbx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r8,%r12
-	xorq	%rdx,%rdi
+	addq	%r8,%r12  // T1+=h
+	xorq	%rdx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rbx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r9,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r9,%r14
 
-	xorq	%r10,%rdi
-	rorq	$14,%r13
+	xorq	%r10,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r10,%r8
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r8
-	addq	%r12,%rax
-	addq	%r12,%r8
+	xorq	%r15,%r8  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rax  // d+=T1
+	addq	%r12,%r8  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%r8
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%r8  // h+=Sigma0(a)
 	movq	32(%rsi),%r12
 	movq	%rax,%r13
 	movq	%r8,%r14
@@ -226,38 +226,38 @@
 
 	xorq	%rax,%r13
 	rorq	$5,%r14
-	xorq	%rcx,%r15
+	xorq	%rcx,%r15  // f^g
 
 	movq	%r12,32(%rsp)
 	xorq	%r8,%r14
-	andq	%rax,%r15
+	andq	%rax,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rdx,%r12
-	xorq	%rcx,%r15
+	addq	%rdx,%r12  // T1+=h
+	xorq	%rcx,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rax,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r8,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r8,%r14
 
-	xorq	%r9,%r15
-	rorq	$14,%r13
+	xorq	%r9,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r9,%rdx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rdx
-	addq	%r12,%r11
-	addq	%r12,%rdx
+	xorq	%rdi,%rdx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r11  // d+=T1
+	addq	%r12,%rdx  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%rdx
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%rdx  // h+=Sigma0(a)
 	movq	40(%rsi),%r12
 	movq	%r11,%r13
 	movq	%rdx,%r14
@@ -267,38 +267,38 @@
 
 	xorq	%r11,%r13
 	rorq	$5,%r14
-	xorq	%rbx,%rdi
+	xorq	%rbx,%rdi  // f^g
 
 	movq	%r12,40(%rsp)
 	xorq	%rdx,%r14
-	andq	%r11,%rdi
+	andq	%r11,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rcx,%r12
-	xorq	%rbx,%rdi
+	addq	%rcx,%r12  // T1+=h
+	xorq	%rbx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r11,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rdx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rdx,%r14
 
-	xorq	%r8,%rdi
-	rorq	$14,%r13
+	xorq	%r8,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r8,%rcx
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rcx
-	addq	%r12,%r10
-	addq	%r12,%rcx
+	xorq	%r15,%rcx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r10  // d+=T1
+	addq	%r12,%rcx  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%rcx
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%rcx  // h+=Sigma0(a)
 	movq	48(%rsi),%r12
 	movq	%r10,%r13
 	movq	%rcx,%r14
@@ -308,38 +308,38 @@
 
 	xorq	%r10,%r13
 	rorq	$5,%r14
-	xorq	%rax,%r15
+	xorq	%rax,%r15  // f^g
 
 	movq	%r12,48(%rsp)
 	xorq	%rcx,%r14
-	andq	%r10,%r15
+	andq	%r10,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rbx,%r12
-	xorq	%rax,%r15
+	addq	%rbx,%r12  // T1+=h
+	xorq	%rax,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r10,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rcx,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rcx,%r14
 
-	xorq	%rdx,%r15
-	rorq	$14,%r13
+	xorq	%rdx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rdx,%rbx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rbx
-	addq	%r12,%r9
-	addq	%r12,%rbx
+	xorq	%rdi,%rbx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r9  // d+=T1
+	addq	%r12,%rbx  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%rbx
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%rbx  // h+=Sigma0(a)
 	movq	56(%rsi),%r12
 	movq	%r9,%r13
 	movq	%rbx,%r14
@@ -349,38 +349,38 @@
 
 	xorq	%r9,%r13
 	rorq	$5,%r14
-	xorq	%r11,%rdi
+	xorq	%r11,%rdi  // f^g
 
 	movq	%r12,56(%rsp)
 	xorq	%rbx,%r14
-	andq	%r9,%rdi
+	andq	%r9,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rax,%r12
-	xorq	%r11,%rdi
+	addq	%rax,%r12  // T1+=h
+	xorq	%r11,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r9,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rbx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rbx,%r14
 
-	xorq	%rcx,%rdi
-	rorq	$14,%r13
+	xorq	%rcx,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rcx,%rax
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rax
-	addq	%r12,%r8
-	addq	%r12,%rax
+	xorq	%r15,%rax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r8  // d+=T1
+	addq	%r12,%rax  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%rax
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%rax  // h+=Sigma0(a)
 	movq	64(%rsi),%r12
 	movq	%r8,%r13
 	movq	%rax,%r14
@@ -390,38 +390,38 @@
 
 	xorq	%r8,%r13
 	rorq	$5,%r14
-	xorq	%r10,%r15
+	xorq	%r10,%r15  // f^g
 
 	movq	%r12,64(%rsp)
 	xorq	%rax,%r14
-	andq	%r8,%r15
+	andq	%r8,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r11,%r12
-	xorq	%r10,%r15
+	addq	%r11,%r12  // T1+=h
+	xorq	%r10,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r8,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rax,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rax,%r14
 
-	xorq	%rbx,%r15
-	rorq	$14,%r13
+	xorq	%rbx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rbx,%r11
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r11
-	addq	%r12,%rdx
-	addq	%r12,%r11
+	xorq	%rdi,%r11  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rdx  // d+=T1
+	addq	%r12,%r11  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%r11
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%r11  // h+=Sigma0(a)
 	movq	72(%rsi),%r12
 	movq	%rdx,%r13
 	movq	%r11,%r14
@@ -431,38 +431,38 @@
 
 	xorq	%rdx,%r13
 	rorq	$5,%r14
-	xorq	%r9,%rdi
+	xorq	%r9,%rdi  // f^g
 
 	movq	%r12,72(%rsp)
 	xorq	%r11,%r14
-	andq	%rdx,%rdi
+	andq	%rdx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r10,%r12
-	xorq	%r9,%rdi
+	addq	%r10,%r12  // T1+=h
+	xorq	%r9,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rdx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r11,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r11,%r14
 
-	xorq	%rax,%rdi
-	rorq	$14,%r13
+	xorq	%rax,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rax,%r10
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r10
-	addq	%r12,%rcx
-	addq	%r12,%r10
+	xorq	%r15,%r10  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rcx  // d+=T1
+	addq	%r12,%r10  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%r10
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%r10  // h+=Sigma0(a)
 	movq	80(%rsi),%r12
 	movq	%rcx,%r13
 	movq	%r10,%r14
@@ -472,38 +472,38 @@
 
 	xorq	%rcx,%r13
 	rorq	$5,%r14
-	xorq	%r8,%r15
+	xorq	%r8,%r15  // f^g
 
 	movq	%r12,80(%rsp)
 	xorq	%r10,%r14
-	andq	%rcx,%r15
+	andq	%rcx,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r9,%r12
-	xorq	%r8,%r15
+	addq	%r9,%r12  // T1+=h
+	xorq	%r8,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rcx,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r10,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r10,%r14
 
-	xorq	%r11,%r15
-	rorq	$14,%r13
+	xorq	%r11,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r11,%r9
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r9
-	addq	%r12,%rbx
-	addq	%r12,%r9
+	xorq	%rdi,%r9  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rbx  // d+=T1
+	addq	%r12,%r9  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%r9
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%r9  // h+=Sigma0(a)
 	movq	88(%rsi),%r12
 	movq	%rbx,%r13
 	movq	%r9,%r14
@@ -513,38 +513,38 @@
 
 	xorq	%rbx,%r13
 	rorq	$5,%r14
-	xorq	%rdx,%rdi
+	xorq	%rdx,%rdi  // f^g
 
 	movq	%r12,88(%rsp)
 	xorq	%r9,%r14
-	andq	%rbx,%rdi
+	andq	%rbx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r8,%r12
-	xorq	%rdx,%rdi
+	addq	%r8,%r12  // T1+=h
+	xorq	%rdx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rbx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r9,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r9,%r14
 
-	xorq	%r10,%rdi
-	rorq	$14,%r13
+	xorq	%r10,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r10,%r8
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r8
-	addq	%r12,%rax
-	addq	%r12,%r8
+	xorq	%r15,%r8  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rax  // d+=T1
+	addq	%r12,%r8  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%r8
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%r8  // h+=Sigma0(a)
 	movq	96(%rsi),%r12
 	movq	%rax,%r13
 	movq	%r8,%r14
@@ -554,38 +554,38 @@
 
 	xorq	%rax,%r13
 	rorq	$5,%r14
-	xorq	%rcx,%r15
+	xorq	%rcx,%r15  // f^g
 
 	movq	%r12,96(%rsp)
 	xorq	%r8,%r14
-	andq	%rax,%r15
+	andq	%rax,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rdx,%r12
-	xorq	%rcx,%r15
+	addq	%rdx,%r12  // T1+=h
+	xorq	%rcx,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rax,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r8,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r8,%r14
 
-	xorq	%r9,%r15
-	rorq	$14,%r13
+	xorq	%r9,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r9,%rdx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rdx
-	addq	%r12,%r11
-	addq	%r12,%rdx
+	xorq	%rdi,%rdx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r11  // d+=T1
+	addq	%r12,%rdx  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%rdx
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%rdx  // h+=Sigma0(a)
 	movq	104(%rsi),%r12
 	movq	%r11,%r13
 	movq	%rdx,%r14
@@ -595,38 +595,38 @@
 
 	xorq	%r11,%r13
 	rorq	$5,%r14
-	xorq	%rbx,%rdi
+	xorq	%rbx,%rdi  // f^g
 
 	movq	%r12,104(%rsp)
 	xorq	%rdx,%r14
-	andq	%r11,%rdi
+	andq	%r11,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rcx,%r12
-	xorq	%rbx,%rdi
+	addq	%rcx,%r12  // T1+=h
+	xorq	%rbx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r11,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rdx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rdx,%r14
 
-	xorq	%r8,%rdi
-	rorq	$14,%r13
+	xorq	%r8,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r8,%rcx
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rcx
-	addq	%r12,%r10
-	addq	%r12,%rcx
+	xorq	%r15,%rcx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r10  // d+=T1
+	addq	%r12,%rcx  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%rcx
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%rcx  // h+=Sigma0(a)
 	movq	112(%rsi),%r12
 	movq	%r10,%r13
 	movq	%rcx,%r14
@@ -636,38 +636,38 @@
 
 	xorq	%r10,%r13
 	rorq	$5,%r14
-	xorq	%rax,%r15
+	xorq	%rax,%r15  // f^g
 
 	movq	%r12,112(%rsp)
 	xorq	%rcx,%r14
-	andq	%r10,%r15
+	andq	%r10,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rbx,%r12
-	xorq	%rax,%r15
+	addq	%rbx,%r12  // T1+=h
+	xorq	%rax,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r10,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rcx,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rcx,%r14
 
-	xorq	%rdx,%r15
-	rorq	$14,%r13
+	xorq	%rdx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rdx,%rbx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rbx
-	addq	%r12,%r9
-	addq	%r12,%rbx
+	xorq	%rdi,%rbx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r9  // d+=T1
+	addq	%r12,%rbx  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%rbx
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%rbx  // h+=Sigma0(a)
 	movq	120(%rsi),%r12
 	movq	%r9,%r13
 	movq	%rbx,%r14
@@ -677,37 +677,37 @@
 
 	xorq	%r9,%r13
 	rorq	$5,%r14
-	xorq	%r11,%rdi
+	xorq	%r11,%rdi  // f^g
 
 	movq	%r12,120(%rsp)
 	xorq	%rbx,%r14
-	andq	%r9,%rdi
+	andq	%r9,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rax,%r12
-	xorq	%r11,%rdi
+	addq	%rax,%r12  // T1+=h
+	xorq	%r11,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r9,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rbx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rbx,%r14
 
-	xorq	%rcx,%rdi
-	rorq	$14,%r13
+	xorq	%rcx,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rcx,%rax
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rax
-	addq	%r12,%r8
-	addq	%r12,%rax
+	xorq	%r15,%rax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r8  // d+=T1
+	addq	%r12,%rax  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	jmp	L$rounds_16_xx
 .p2align	4
 L$rounds_16_xx:
@@ -716,7 +716,7 @@
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rax
+	addq	%r14,%rax  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -727,8 +727,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	72(%rsp),%r12
 
 	addq	0(%rsp),%r12
@@ -740,43 +740,43 @@
 
 	xorq	%r8,%r13
 	rorq	$5,%r14
-	xorq	%r10,%r15
+	xorq	%r10,%r15  // f^g
 
 	movq	%r12,0(%rsp)
 	xorq	%rax,%r14
-	andq	%r8,%r15
+	andq	%r8,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r11,%r12
-	xorq	%r10,%r15
+	addq	%r11,%r12  // T1+=h
+	xorq	%r10,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r8,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rax,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rax,%r14
 
-	xorq	%rbx,%r15
-	rorq	$14,%r13
+	xorq	%rbx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rbx,%r11
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r11
-	addq	%r12,%rdx
-	addq	%r12,%r11
+	xorq	%rdi,%r11  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rdx  // d+=T1
+	addq	%r12,%r11  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	16(%rsp),%r13
 	movq	120(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r11
+	addq	%r14,%r11  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -787,8 +787,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	80(%rsp),%r12
 
 	addq	8(%rsp),%r12
@@ -800,43 +800,43 @@
 
 	xorq	%rdx,%r13
 	rorq	$5,%r14
-	xorq	%r9,%rdi
+	xorq	%r9,%rdi  // f^g
 
 	movq	%r12,8(%rsp)
 	xorq	%r11,%r14
-	andq	%rdx,%rdi
+	andq	%rdx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r10,%r12
-	xorq	%r9,%rdi
+	addq	%r10,%r12  // T1+=h
+	xorq	%r9,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rdx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r11,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r11,%r14
 
-	xorq	%rax,%rdi
-	rorq	$14,%r13
+	xorq	%rax,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rax,%r10
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r10
-	addq	%r12,%rcx
-	addq	%r12,%r10
+	xorq	%r15,%r10  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rcx  // d+=T1
+	addq	%r12,%r10  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	24(%rsp),%r13
 	movq	0(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r10
+	addq	%r14,%r10  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -847,8 +847,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	88(%rsp),%r12
 
 	addq	16(%rsp),%r12
@@ -860,43 +860,43 @@
 
 	xorq	%rcx,%r13
 	rorq	$5,%r14
-	xorq	%r8,%r15
+	xorq	%r8,%r15  // f^g
 
 	movq	%r12,16(%rsp)
 	xorq	%r10,%r14
-	andq	%rcx,%r15
+	andq	%rcx,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r9,%r12
-	xorq	%r8,%r15
+	addq	%r9,%r12  // T1+=h
+	xorq	%r8,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rcx,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r10,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r10,%r14
 
-	xorq	%r11,%r15
-	rorq	$14,%r13
+	xorq	%r11,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r11,%r9
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r9
-	addq	%r12,%rbx
-	addq	%r12,%r9
+	xorq	%rdi,%r9  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rbx  // d+=T1
+	addq	%r12,%r9  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	32(%rsp),%r13
 	movq	8(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r9
+	addq	%r14,%r9  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -907,8 +907,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	96(%rsp),%r12
 
 	addq	24(%rsp),%r12
@@ -920,43 +920,43 @@
 
 	xorq	%rbx,%r13
 	rorq	$5,%r14
-	xorq	%rdx,%rdi
+	xorq	%rdx,%rdi  // f^g
 
 	movq	%r12,24(%rsp)
 	xorq	%r9,%r14
-	andq	%rbx,%rdi
+	andq	%rbx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r8,%r12
-	xorq	%rdx,%rdi
+	addq	%r8,%r12  // T1+=h
+	xorq	%rdx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rbx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r9,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r9,%r14
 
-	xorq	%r10,%rdi
-	rorq	$14,%r13
+	xorq	%r10,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r10,%r8
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r8
-	addq	%r12,%rax
-	addq	%r12,%r8
+	xorq	%r15,%r8  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rax  // d+=T1
+	addq	%r12,%r8  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	40(%rsp),%r13
 	movq	16(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r8
+	addq	%r14,%r8  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -967,8 +967,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	104(%rsp),%r12
 
 	addq	32(%rsp),%r12
@@ -980,43 +980,43 @@
 
 	xorq	%rax,%r13
 	rorq	$5,%r14
-	xorq	%rcx,%r15
+	xorq	%rcx,%r15  // f^g
 
 	movq	%r12,32(%rsp)
 	xorq	%r8,%r14
-	andq	%rax,%r15
+	andq	%rax,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rdx,%r12
-	xorq	%rcx,%r15
+	addq	%rdx,%r12  // T1+=h
+	xorq	%rcx,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rax,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r8,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r8,%r14
 
-	xorq	%r9,%r15
-	rorq	$14,%r13
+	xorq	%r9,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r9,%rdx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rdx
-	addq	%r12,%r11
-	addq	%r12,%rdx
+	xorq	%rdi,%rdx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r11  // d+=T1
+	addq	%r12,%rdx  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	48(%rsp),%r13
 	movq	24(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rdx
+	addq	%r14,%rdx  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -1027,8 +1027,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	112(%rsp),%r12
 
 	addq	40(%rsp),%r12
@@ -1040,43 +1040,43 @@
 
 	xorq	%r11,%r13
 	rorq	$5,%r14
-	xorq	%rbx,%rdi
+	xorq	%rbx,%rdi  // f^g
 
 	movq	%r12,40(%rsp)
 	xorq	%rdx,%r14
-	andq	%r11,%rdi
+	andq	%r11,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rcx,%r12
-	xorq	%rbx,%rdi
+	addq	%rcx,%r12  // T1+=h
+	xorq	%rbx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r11,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rdx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rdx,%r14
 
-	xorq	%r8,%rdi
-	rorq	$14,%r13
+	xorq	%r8,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r8,%rcx
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rcx
-	addq	%r12,%r10
-	addq	%r12,%rcx
+	xorq	%r15,%rcx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r10  // d+=T1
+	addq	%r12,%rcx  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	56(%rsp),%r13
 	movq	32(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rcx
+	addq	%r14,%rcx  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -1087,8 +1087,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	120(%rsp),%r12
 
 	addq	48(%rsp),%r12
@@ -1100,43 +1100,43 @@
 
 	xorq	%r10,%r13
 	rorq	$5,%r14
-	xorq	%rax,%r15
+	xorq	%rax,%r15  // f^g
 
 	movq	%r12,48(%rsp)
 	xorq	%rcx,%r14
-	andq	%r10,%r15
+	andq	%r10,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rbx,%r12
-	xorq	%rax,%r15
+	addq	%rbx,%r12  // T1+=h
+	xorq	%rax,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r10,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rcx,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rcx,%r14
 
-	xorq	%rdx,%r15
-	rorq	$14,%r13
+	xorq	%rdx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rdx,%rbx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rbx
-	addq	%r12,%r9
-	addq	%r12,%rbx
+	xorq	%rdi,%rbx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r9  // d+=T1
+	addq	%r12,%rbx  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	64(%rsp),%r13
 	movq	40(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rbx
+	addq	%r14,%rbx  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -1147,8 +1147,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	0(%rsp),%r12
 
 	addq	56(%rsp),%r12
@@ -1160,43 +1160,43 @@
 
 	xorq	%r9,%r13
 	rorq	$5,%r14
-	xorq	%r11,%rdi
+	xorq	%r11,%rdi  // f^g
 
 	movq	%r12,56(%rsp)
 	xorq	%rbx,%r14
-	andq	%r9,%rdi
+	andq	%r9,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rax,%r12
-	xorq	%r11,%rdi
+	addq	%rax,%r12  // T1+=h
+	xorq	%r11,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r9,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rbx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rbx,%r14
 
-	xorq	%rcx,%rdi
-	rorq	$14,%r13
+	xorq	%rcx,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rcx,%rax
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rax
-	addq	%r12,%r8
-	addq	%r12,%rax
+	xorq	%r15,%rax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r8  // d+=T1
+	addq	%r12,%rax  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	72(%rsp),%r13
 	movq	48(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rax
+	addq	%r14,%rax  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -1207,8 +1207,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	8(%rsp),%r12
 
 	addq	64(%rsp),%r12
@@ -1220,43 +1220,43 @@
 
 	xorq	%r8,%r13
 	rorq	$5,%r14
-	xorq	%r10,%r15
+	xorq	%r10,%r15  // f^g
 
 	movq	%r12,64(%rsp)
 	xorq	%rax,%r14
-	andq	%r8,%r15
+	andq	%r8,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r11,%r12
-	xorq	%r10,%r15
+	addq	%r11,%r12  // T1+=h
+	xorq	%r10,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r8,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rax,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rax,%r14
 
-	xorq	%rbx,%r15
-	rorq	$14,%r13
+	xorq	%rbx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rbx,%r11
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r11
-	addq	%r12,%rdx
-	addq	%r12,%r11
+	xorq	%rdi,%r11  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rdx  // d+=T1
+	addq	%r12,%r11  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	80(%rsp),%r13
 	movq	56(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r11
+	addq	%r14,%r11  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -1267,8 +1267,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	16(%rsp),%r12
 
 	addq	72(%rsp),%r12
@@ -1280,43 +1280,43 @@
 
 	xorq	%rdx,%r13
 	rorq	$5,%r14
-	xorq	%r9,%rdi
+	xorq	%r9,%rdi  // f^g
 
 	movq	%r12,72(%rsp)
 	xorq	%r11,%r14
-	andq	%rdx,%rdi
+	andq	%rdx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r10,%r12
-	xorq	%r9,%rdi
+	addq	%r10,%r12  // T1+=h
+	xorq	%r9,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rdx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r11,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r11,%r14
 
-	xorq	%rax,%rdi
-	rorq	$14,%r13
+	xorq	%rax,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rax,%r10
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r10
-	addq	%r12,%rcx
-	addq	%r12,%r10
+	xorq	%r15,%r10  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rcx  // d+=T1
+	addq	%r12,%r10  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	88(%rsp),%r13
 	movq	64(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r10
+	addq	%r14,%r10  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -1327,8 +1327,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	24(%rsp),%r12
 
 	addq	80(%rsp),%r12
@@ -1340,43 +1340,43 @@
 
 	xorq	%rcx,%r13
 	rorq	$5,%r14
-	xorq	%r8,%r15
+	xorq	%r8,%r15  // f^g
 
 	movq	%r12,80(%rsp)
 	xorq	%r10,%r14
-	andq	%rcx,%r15
+	andq	%rcx,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r9,%r12
-	xorq	%r8,%r15
+	addq	%r9,%r12  // T1+=h
+	xorq	%r8,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rcx,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r10,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r10,%r14
 
-	xorq	%r11,%r15
-	rorq	$14,%r13
+	xorq	%r11,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r11,%r9
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r9
-	addq	%r12,%rbx
-	addq	%r12,%r9
+	xorq	%rdi,%r9  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rbx  // d+=T1
+	addq	%r12,%r9  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	96(%rsp),%r13
 	movq	72(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r9
+	addq	%r14,%r9  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -1387,8 +1387,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	32(%rsp),%r12
 
 	addq	88(%rsp),%r12
@@ -1400,43 +1400,43 @@
 
 	xorq	%rbx,%r13
 	rorq	$5,%r14
-	xorq	%rdx,%rdi
+	xorq	%rdx,%rdi  // f^g
 
 	movq	%r12,88(%rsp)
 	xorq	%r9,%r14
-	andq	%rbx,%rdi
+	andq	%rbx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r8,%r12
-	xorq	%rdx,%rdi
+	addq	%r8,%r12  // T1+=h
+	xorq	%rdx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rbx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r9,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r9,%r14
 
-	xorq	%r10,%rdi
-	rorq	$14,%r13
+	xorq	%r10,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r10,%r8
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r8
-	addq	%r12,%rax
-	addq	%r12,%r8
+	xorq	%r15,%r8  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rax  // d+=T1
+	addq	%r12,%r8  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	104(%rsp),%r13
 	movq	80(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r8
+	addq	%r14,%r8  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -1447,8 +1447,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	40(%rsp),%r12
 
 	addq	96(%rsp),%r12
@@ -1460,43 +1460,43 @@
 
 	xorq	%rax,%r13
 	rorq	$5,%r14
-	xorq	%rcx,%r15
+	xorq	%rcx,%r15  // f^g
 
 	movq	%r12,96(%rsp)
 	xorq	%r8,%r14
-	andq	%rax,%r15
+	andq	%rax,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rdx,%r12
-	xorq	%rcx,%r15
+	addq	%rdx,%r12  // T1+=h
+	xorq	%rcx,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rax,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r8,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r8,%r14
 
-	xorq	%r9,%r15
-	rorq	$14,%r13
+	xorq	%r9,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r9,%rdx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rdx
-	addq	%r12,%r11
-	addq	%r12,%rdx
+	xorq	%rdi,%rdx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r11  // d+=T1
+	addq	%r12,%rdx  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	112(%rsp),%r13
 	movq	88(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rdx
+	addq	%r14,%rdx  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -1507,8 +1507,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	48(%rsp),%r12
 
 	addq	104(%rsp),%r12
@@ -1520,43 +1520,43 @@
 
 	xorq	%r11,%r13
 	rorq	$5,%r14
-	xorq	%rbx,%rdi
+	xorq	%rbx,%rdi  // f^g
 
 	movq	%r12,104(%rsp)
 	xorq	%rdx,%r14
-	andq	%r11,%rdi
+	andq	%r11,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rcx,%r12
-	xorq	%rbx,%rdi
+	addq	%rcx,%r12  // T1+=h
+	xorq	%rbx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r11,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rdx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rdx,%r14
 
-	xorq	%r8,%rdi
-	rorq	$14,%r13
+	xorq	%r8,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r8,%rcx
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rcx
-	addq	%r12,%r10
-	addq	%r12,%rcx
+	xorq	%r15,%rcx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r10  // d+=T1
+	addq	%r12,%rcx  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	120(%rsp),%r13
 	movq	96(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rcx
+	addq	%r14,%rcx  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -1567,8 +1567,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	56(%rsp),%r12
 
 	addq	112(%rsp),%r12
@@ -1580,43 +1580,43 @@
 
 	xorq	%r10,%r13
 	rorq	$5,%r14
-	xorq	%rax,%r15
+	xorq	%rax,%r15  // f^g
 
 	movq	%r12,112(%rsp)
 	xorq	%rcx,%r14
-	andq	%r10,%r15
+	andq	%r10,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rbx,%r12
-	xorq	%rax,%r15
+	addq	%rbx,%r12  // T1+=h
+	xorq	%rax,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r10,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rcx,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rcx,%r14
 
-	xorq	%rdx,%r15
-	rorq	$14,%r13
+	xorq	%rdx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rdx,%rbx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rbx
-	addq	%r12,%r9
-	addq	%r12,%rbx
+	xorq	%rdi,%rbx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r9  // d+=T1
+	addq	%r12,%rbx  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	0(%rsp),%r13
 	movq	104(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rbx
+	addq	%r14,%rbx  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -1627,8 +1627,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	64(%rsp),%r12
 
 	addq	120(%rsp),%r12
@@ -1640,42 +1640,42 @@
 
 	xorq	%r9,%r13
 	rorq	$5,%r14
-	xorq	%r11,%rdi
+	xorq	%r11,%rdi  // f^g
 
 	movq	%r12,120(%rsp)
 	xorq	%rbx,%r14
-	andq	%r9,%rdi
+	andq	%r9,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rax,%r12
-	xorq	%r11,%rdi
+	addq	%rax,%r12  // T1+=h
+	xorq	%r11,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r9,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rbx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rbx,%r14
 
-	xorq	%rcx,%rdi
-	rorq	$14,%r13
+	xorq	%rcx,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rcx,%rax
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rax
-	addq	%r12,%r8
-	addq	%r12,%rax
+	xorq	%r15,%rax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r8  // d+=T1
+	addq	%r12,%rax  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	cmpb	$0,7(%rbp)
 	jnz	L$rounds_16_xx
 
 	movq	128+0(%rsp),%rdi
-	addq	%r14,%rax
+	addq	%r14,%rax  // modulo-scheduled h+=Sigma0(a)
 	leaq	128(%rsi),%rsi
 
 	addq	0(%rdi),%rax
@@ -1816,7 +1816,7 @@
 _sha512_block_data_order_avx:
 
 _CET_ENDBR
-	movq	%rsp,%rax
+	movq	%rsp,%rax  // copy %rsp
 
 	pushq	%rbx
 
@@ -1830,14 +1830,14 @@
 
 	pushq	%r15
 
-	shlq	$4,%rdx
+	shlq	$4,%rdx  // num*16
 	subq	$160,%rsp
-	leaq	(%rsi,%rdx,8),%rdx
-	andq	$-64,%rsp
-	movq	%rdi,128+0(%rsp)
-	movq	%rsi,128+8(%rsp)
-	movq	%rdx,128+16(%rsp)
-	movq	%rax,152(%rsp)
+	leaq	(%rsi,%rdx,8),%rdx  // inp+num*16*8
+	andq	$-64,%rsp  // align stack frame
+	movq	%rdi,128+0(%rsp)  // save ctx, 1st arg
+	movq	%rsi,128+8(%rsp)  // save inp, 2nd arh
+	movq	%rdx,128+16(%rsp)  // save end pointer, "3rd" arg
+	movq	%rax,152(%rsp)  // save copy of %rsp
 
 L$prologue_avx:
 
@@ -1855,7 +1855,7 @@
 L$loop_avx:
 	vmovdqa	K512+1280(%rip),%xmm11
 	vmovdqu	0(%rsi),%xmm0
-	leaq	K512+128(%rip),%rbp
+	leaq	K512+128(%rip),%rbp  // size optimization
 	vmovdqu	16(%rsi),%xmm1
 	vmovdqu	32(%rsi),%xmm2
 	vpshufb	%xmm11,%xmm0,%xmm0
@@ -1888,7 +1888,7 @@
 	vmovdqa	%xmm9,80(%rsp)
 	movq	%rbx,%rdi
 	vmovdqa	%xmm10,96(%rsp)
-	xorq	%rcx,%rdi
+	xorq	%rcx,%rdi  // magic
 	vmovdqa	%xmm11,112(%rsp)
 	movq	%r8,%r13
 	jmp	L$avx_00_47

boringssl-0.20260708.tar.xz/gen/bcm/sha512-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/sha512-x86_64-linux.S Changed

@@ -13,7 +13,7 @@
 sha512_block_data_order_nohw:
 .cfi_startproc	
 _CET_ENDBR
-	movq	%rsp,%rax
+	movq	%rsp,%rax  // copy %rsp
 .cfi_def_cfa_register	%rax
 	pushq	%rbx
 .cfi_offset	%rbx,-16
@@ -27,14 +27,14 @@
 .cfi_offset	%r14,-48
 	pushq	%r15
 .cfi_offset	%r15,-56
-	shlq	$4,%rdx
+	shlq	$4,%rdx  // num*16
 	subq	$128+32,%rsp
-	leaq	(%rsi,%rdx,8),%rdx
-	andq	$-64,%rsp
-	movq	%rdi,128+0(%rsp)
-	movq	%rsi,128+8(%rsp)
-	movq	%rdx,128+16(%rsp)
-	movq	%rax,152(%rsp)
+	leaq	(%rsi,%rdx,8),%rdx  // inp+num*16*8
+	andq	$-64,%rsp  // align stack frame
+	movq	%rdi,128+0(%rsp)  // save ctx, 1st arg
+	movq	%rsi,128+8(%rsp)  // save inp, 2nd arh
+	movq	%rdx,128+16(%rsp)  // save end pointer, "3rd" arg
+	movq	%rax,152(%rsp)  // save copy of %rsp
 .cfi_escape	0x0f,0x06,0x77,0x98,0x01,0x06,0x23,0x08
 .Lprologue:
 
@@ -52,7 +52,7 @@
 .Lloop:
 	movq	%rbx,%rdi
 	leaq	K512(%rip),%rbp
-	xorq	%rcx,%rdi
+	xorq	%rcx,%rdi  // magic
 	movq	0(%rsi),%r12
 	movq	%r8,%r13
 	movq	%rax,%r14
@@ -62,38 +62,38 @@
 
 	xorq	%r8,%r13
 	rorq	$5,%r14
-	xorq	%r10,%r15
+	xorq	%r10,%r15  // f^g
 
 	movq	%r12,0(%rsp)
 	xorq	%rax,%r14
-	andq	%r8,%r15
+	andq	%r8,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r11,%r12
-	xorq	%r10,%r15
+	addq	%r11,%r12  // T1+=h
+	xorq	%r10,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r8,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rax,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rax,%r14
 
-	xorq	%rbx,%r15
-	rorq	$14,%r13
+	xorq	%rbx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rbx,%r11
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r11
-	addq	%r12,%rdx
-	addq	%r12,%r11
+	xorq	%rdi,%r11  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rdx  // d+=T1
+	addq	%r12,%r11  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%r11
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%r11  // h+=Sigma0(a)
 	movq	8(%rsi),%r12
 	movq	%rdx,%r13
 	movq	%r11,%r14
@@ -103,38 +103,38 @@
 
 	xorq	%rdx,%r13
 	rorq	$5,%r14
-	xorq	%r9,%rdi
+	xorq	%r9,%rdi  // f^g
 
 	movq	%r12,8(%rsp)
 	xorq	%r11,%r14
-	andq	%rdx,%rdi
+	andq	%rdx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r10,%r12
-	xorq	%r9,%rdi
+	addq	%r10,%r12  // T1+=h
+	xorq	%r9,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rdx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r11,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r11,%r14
 
-	xorq	%rax,%rdi
-	rorq	$14,%r13
+	xorq	%rax,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rax,%r10
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r10
-	addq	%r12,%rcx
-	addq	%r12,%r10
+	xorq	%r15,%r10  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rcx  // d+=T1
+	addq	%r12,%r10  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%r10
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%r10  // h+=Sigma0(a)
 	movq	16(%rsi),%r12
 	movq	%rcx,%r13
 	movq	%r10,%r14
@@ -144,38 +144,38 @@
 
 	xorq	%rcx,%r13
 	rorq	$5,%r14
-	xorq	%r8,%r15
+	xorq	%r8,%r15  // f^g
 
 	movq	%r12,16(%rsp)
 	xorq	%r10,%r14
-	andq	%rcx,%r15
+	andq	%rcx,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r9,%r12
-	xorq	%r8,%r15
+	addq	%r9,%r12  // T1+=h
+	xorq	%r8,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rcx,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r10,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r10,%r14
 
-	xorq	%r11,%r15
-	rorq	$14,%r13
+	xorq	%r11,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r11,%r9
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r9
-	addq	%r12,%rbx
-	addq	%r12,%r9
+	xorq	%rdi,%r9  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rbx  // d+=T1
+	addq	%r12,%r9  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%r9
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%r9  // h+=Sigma0(a)
 	movq	24(%rsi),%r12
 	movq	%rbx,%r13
 	movq	%r9,%r14
@@ -185,38 +185,38 @@
 
 	xorq	%rbx,%r13
 	rorq	$5,%r14
-	xorq	%rdx,%rdi
+	xorq	%rdx,%rdi  // f^g
 
 	movq	%r12,24(%rsp)
 	xorq	%r9,%r14
-	andq	%rbx,%rdi
+	andq	%rbx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r8,%r12
-	xorq	%rdx,%rdi
+	addq	%r8,%r12  // T1+=h
+	xorq	%rdx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rbx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r9,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r9,%r14
 
-	xorq	%r10,%rdi
-	rorq	$14,%r13
+	xorq	%r10,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r10,%r8
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r8
-	addq	%r12,%rax
-	addq	%r12,%r8
+	xorq	%r15,%r8  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rax  // d+=T1
+	addq	%r12,%r8  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%r8
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%r8  // h+=Sigma0(a)
 	movq	32(%rsi),%r12
 	movq	%rax,%r13
 	movq	%r8,%r14
@@ -226,38 +226,38 @@
 
 	xorq	%rax,%r13
 	rorq	$5,%r14
-	xorq	%rcx,%r15
+	xorq	%rcx,%r15  // f^g
 
 	movq	%r12,32(%rsp)
 	xorq	%r8,%r14
-	andq	%rax,%r15
+	andq	%rax,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rdx,%r12
-	xorq	%rcx,%r15
+	addq	%rdx,%r12  // T1+=h
+	xorq	%rcx,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rax,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r8,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r8,%r14
 
-	xorq	%r9,%r15
-	rorq	$14,%r13
+	xorq	%r9,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r9,%rdx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rdx
-	addq	%r12,%r11
-	addq	%r12,%rdx
+	xorq	%rdi,%rdx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r11  // d+=T1
+	addq	%r12,%rdx  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%rdx
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%rdx  // h+=Sigma0(a)
 	movq	40(%rsi),%r12
 	movq	%r11,%r13
 	movq	%rdx,%r14
@@ -267,38 +267,38 @@
 
 	xorq	%r11,%r13
 	rorq	$5,%r14
-	xorq	%rbx,%rdi
+	xorq	%rbx,%rdi  // f^g
 
 	movq	%r12,40(%rsp)
 	xorq	%rdx,%r14
-	andq	%r11,%rdi
+	andq	%r11,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rcx,%r12
-	xorq	%rbx,%rdi
+	addq	%rcx,%r12  // T1+=h
+	xorq	%rbx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r11,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rdx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rdx,%r14
 
-	xorq	%r8,%rdi
-	rorq	$14,%r13
+	xorq	%r8,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r8,%rcx
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rcx
-	addq	%r12,%r10
-	addq	%r12,%rcx
+	xorq	%r15,%rcx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r10  // d+=T1
+	addq	%r12,%rcx  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%rcx
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%rcx  // h+=Sigma0(a)
 	movq	48(%rsi),%r12
 	movq	%r10,%r13
 	movq	%rcx,%r14
@@ -308,38 +308,38 @@
 
 	xorq	%r10,%r13
 	rorq	$5,%r14
-	xorq	%rax,%r15
+	xorq	%rax,%r15  // f^g
 
 	movq	%r12,48(%rsp)
 	xorq	%rcx,%r14
-	andq	%r10,%r15
+	andq	%r10,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rbx,%r12
-	xorq	%rax,%r15
+	addq	%rbx,%r12  // T1+=h
+	xorq	%rax,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r10,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rcx,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rcx,%r14
 
-	xorq	%rdx,%r15
-	rorq	$14,%r13
+	xorq	%rdx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rdx,%rbx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rbx
-	addq	%r12,%r9
-	addq	%r12,%rbx
+	xorq	%rdi,%rbx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r9  // d+=T1
+	addq	%r12,%rbx  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%rbx
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%rbx  // h+=Sigma0(a)
 	movq	56(%rsi),%r12
 	movq	%r9,%r13
 	movq	%rbx,%r14
@@ -349,38 +349,38 @@
 
 	xorq	%r9,%r13
 	rorq	$5,%r14
-	xorq	%r11,%rdi
+	xorq	%r11,%rdi  // f^g
 
 	movq	%r12,56(%rsp)
 	xorq	%rbx,%r14
-	andq	%r9,%rdi
+	andq	%r9,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rax,%r12
-	xorq	%r11,%rdi
+	addq	%rax,%r12  // T1+=h
+	xorq	%r11,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r9,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rbx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rbx,%r14
 
-	xorq	%rcx,%rdi
-	rorq	$14,%r13
+	xorq	%rcx,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rcx,%rax
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rax
-	addq	%r12,%r8
-	addq	%r12,%rax
+	xorq	%r15,%rax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r8  // d+=T1
+	addq	%r12,%rax  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%rax
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%rax  // h+=Sigma0(a)
 	movq	64(%rsi),%r12
 	movq	%r8,%r13
 	movq	%rax,%r14
@@ -390,38 +390,38 @@
 
 	xorq	%r8,%r13
 	rorq	$5,%r14
-	xorq	%r10,%r15
+	xorq	%r10,%r15  // f^g
 
 	movq	%r12,64(%rsp)
 	xorq	%rax,%r14
-	andq	%r8,%r15
+	andq	%r8,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r11,%r12
-	xorq	%r10,%r15
+	addq	%r11,%r12  // T1+=h
+	xorq	%r10,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r8,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rax,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rax,%r14
 
-	xorq	%rbx,%r15
-	rorq	$14,%r13
+	xorq	%rbx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rbx,%r11
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r11
-	addq	%r12,%rdx
-	addq	%r12,%r11
+	xorq	%rdi,%r11  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rdx  // d+=T1
+	addq	%r12,%r11  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%r11
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%r11  // h+=Sigma0(a)
 	movq	72(%rsi),%r12
 	movq	%rdx,%r13
 	movq	%r11,%r14
@@ -431,38 +431,38 @@
 
 	xorq	%rdx,%r13
 	rorq	$5,%r14
-	xorq	%r9,%rdi
+	xorq	%r9,%rdi  // f^g
 
 	movq	%r12,72(%rsp)
 	xorq	%r11,%r14
-	andq	%rdx,%rdi
+	andq	%rdx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r10,%r12
-	xorq	%r9,%rdi
+	addq	%r10,%r12  // T1+=h
+	xorq	%r9,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rdx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r11,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r11,%r14
 
-	xorq	%rax,%rdi
-	rorq	$14,%r13
+	xorq	%rax,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rax,%r10
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r10
-	addq	%r12,%rcx
-	addq	%r12,%r10
+	xorq	%r15,%r10  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rcx  // d+=T1
+	addq	%r12,%r10  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%r10
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%r10  // h+=Sigma0(a)
 	movq	80(%rsi),%r12
 	movq	%rcx,%r13
 	movq	%r10,%r14
@@ -472,38 +472,38 @@
 
 	xorq	%rcx,%r13
 	rorq	$5,%r14
-	xorq	%r8,%r15
+	xorq	%r8,%r15  // f^g
 
 	movq	%r12,80(%rsp)
 	xorq	%r10,%r14
-	andq	%rcx,%r15
+	andq	%rcx,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r9,%r12
-	xorq	%r8,%r15
+	addq	%r9,%r12  // T1+=h
+	xorq	%r8,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rcx,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r10,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r10,%r14
 
-	xorq	%r11,%r15
-	rorq	$14,%r13
+	xorq	%r11,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r11,%r9
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r9
-	addq	%r12,%rbx
-	addq	%r12,%r9
+	xorq	%rdi,%r9  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rbx  // d+=T1
+	addq	%r12,%r9  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%r9
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%r9  // h+=Sigma0(a)
 	movq	88(%rsi),%r12
 	movq	%rbx,%r13
 	movq	%r9,%r14
@@ -513,38 +513,38 @@
 
 	xorq	%rbx,%r13
 	rorq	$5,%r14
-	xorq	%rdx,%rdi
+	xorq	%rdx,%rdi  // f^g
 
 	movq	%r12,88(%rsp)
 	xorq	%r9,%r14
-	andq	%rbx,%rdi
+	andq	%rbx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r8,%r12
-	xorq	%rdx,%rdi
+	addq	%r8,%r12  // T1+=h
+	xorq	%rdx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rbx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r9,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r9,%r14
 
-	xorq	%r10,%rdi
-	rorq	$14,%r13
+	xorq	%r10,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r10,%r8
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r8
-	addq	%r12,%rax
-	addq	%r12,%r8
+	xorq	%r15,%r8  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rax  // d+=T1
+	addq	%r12,%r8  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%r8
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%r8  // h+=Sigma0(a)
 	movq	96(%rsi),%r12
 	movq	%rax,%r13
 	movq	%r8,%r14
@@ -554,38 +554,38 @@
 
 	xorq	%rax,%r13
 	rorq	$5,%r14
-	xorq	%rcx,%r15
+	xorq	%rcx,%r15  // f^g
 
 	movq	%r12,96(%rsp)
 	xorq	%r8,%r14
-	andq	%rax,%r15
+	andq	%rax,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rdx,%r12
-	xorq	%rcx,%r15
+	addq	%rdx,%r12  // T1+=h
+	xorq	%rcx,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rax,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r8,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r8,%r14
 
-	xorq	%r9,%r15
-	rorq	$14,%r13
+	xorq	%r9,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r9,%rdx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rdx
-	addq	%r12,%r11
-	addq	%r12,%rdx
+	xorq	%rdi,%rdx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r11  // d+=T1
+	addq	%r12,%rdx  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%rdx
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%rdx  // h+=Sigma0(a)
 	movq	104(%rsi),%r12
 	movq	%r11,%r13
 	movq	%rdx,%r14
@@ -595,38 +595,38 @@
 
 	xorq	%r11,%r13
 	rorq	$5,%r14
-	xorq	%rbx,%rdi
+	xorq	%rbx,%rdi  // f^g
 
 	movq	%r12,104(%rsp)
 	xorq	%rdx,%r14
-	andq	%r11,%rdi
+	andq	%r11,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rcx,%r12
-	xorq	%rbx,%rdi
+	addq	%rcx,%r12  // T1+=h
+	xorq	%rbx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r11,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rdx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rdx,%r14
 
-	xorq	%r8,%rdi
-	rorq	$14,%r13
+	xorq	%r8,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r8,%rcx
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rcx
-	addq	%r12,%r10
-	addq	%r12,%rcx
+	xorq	%r15,%rcx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r10  // d+=T1
+	addq	%r12,%rcx  // h+=T1
 
-	leaq	24(%rbp),%rbp
-	addq	%r14,%rcx
+	leaq	24(%rbp),%rbp  // round++
+	addq	%r14,%rcx  // h+=Sigma0(a)
 	movq	112(%rsi),%r12
 	movq	%r10,%r13
 	movq	%rcx,%r14
@@ -636,38 +636,38 @@
 
 	xorq	%r10,%r13
 	rorq	$5,%r14
-	xorq	%rax,%r15
+	xorq	%rax,%r15  // f^g
 
 	movq	%r12,112(%rsp)
 	xorq	%rcx,%r14
-	andq	%r10,%r15
+	andq	%r10,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rbx,%r12
-	xorq	%rax,%r15
+	addq	%rbx,%r12  // T1+=h
+	xorq	%rax,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r10,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rcx,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rcx,%r14
 
-	xorq	%rdx,%r15
-	rorq	$14,%r13
+	xorq	%rdx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rdx,%rbx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rbx
-	addq	%r12,%r9
-	addq	%r12,%rbx
+	xorq	%rdi,%rbx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r9  // d+=T1
+	addq	%r12,%rbx  // h+=T1
 
-	leaq	8(%rbp),%rbp
-	addq	%r14,%rbx
+	leaq	8(%rbp),%rbp  // round++
+	addq	%r14,%rbx  // h+=Sigma0(a)
 	movq	120(%rsi),%r12
 	movq	%r9,%r13
 	movq	%rbx,%r14
@@ -677,37 +677,37 @@
 
 	xorq	%r9,%r13
 	rorq	$5,%r14
-	xorq	%r11,%rdi
+	xorq	%r11,%rdi  // f^g
 
 	movq	%r12,120(%rsp)
 	xorq	%rbx,%r14
-	andq	%r9,%rdi
+	andq	%r9,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rax,%r12
-	xorq	%r11,%rdi
+	addq	%rax,%r12  // T1+=h
+	xorq	%r11,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r9,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rbx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rbx,%r14
 
-	xorq	%rcx,%rdi
-	rorq	$14,%r13
+	xorq	%rcx,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rcx,%rax
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rax
-	addq	%r12,%r8
-	addq	%r12,%rax
+	xorq	%r15,%rax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r8  // d+=T1
+	addq	%r12,%rax  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	jmp	.Lrounds_16_xx
 .align	16
 .Lrounds_16_xx:
@@ -716,7 +716,7 @@
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rax
+	addq	%r14,%rax  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -727,8 +727,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	72(%rsp),%r12
 
 	addq	0(%rsp),%r12
@@ -740,43 +740,43 @@
 
 	xorq	%r8,%r13
 	rorq	$5,%r14
-	xorq	%r10,%r15
+	xorq	%r10,%r15  // f^g
 
 	movq	%r12,0(%rsp)
 	xorq	%rax,%r14
-	andq	%r8,%r15
+	andq	%r8,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r11,%r12
-	xorq	%r10,%r15
+	addq	%r11,%r12  // T1+=h
+	xorq	%r10,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r8,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rax,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rax,%r14
 
-	xorq	%rbx,%r15
-	rorq	$14,%r13
+	xorq	%rbx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rbx,%r11
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r11
-	addq	%r12,%rdx
-	addq	%r12,%r11
+	xorq	%rdi,%r11  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rdx  // d+=T1
+	addq	%r12,%r11  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	16(%rsp),%r13
 	movq	120(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r11
+	addq	%r14,%r11  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -787,8 +787,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	80(%rsp),%r12
 
 	addq	8(%rsp),%r12
@@ -800,43 +800,43 @@
 
 	xorq	%rdx,%r13
 	rorq	$5,%r14
-	xorq	%r9,%rdi
+	xorq	%r9,%rdi  // f^g
 
 	movq	%r12,8(%rsp)
 	xorq	%r11,%r14
-	andq	%rdx,%rdi
+	andq	%rdx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r10,%r12
-	xorq	%r9,%rdi
+	addq	%r10,%r12  // T1+=h
+	xorq	%r9,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rdx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r11,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r11,%r14
 
-	xorq	%rax,%rdi
-	rorq	$14,%r13
+	xorq	%rax,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rax,%r10
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r10
-	addq	%r12,%rcx
-	addq	%r12,%r10
+	xorq	%r15,%r10  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rcx  // d+=T1
+	addq	%r12,%r10  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	24(%rsp),%r13
 	movq	0(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r10
+	addq	%r14,%r10  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -847,8 +847,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	88(%rsp),%r12
 
 	addq	16(%rsp),%r12
@@ -860,43 +860,43 @@
 
 	xorq	%rcx,%r13
 	rorq	$5,%r14
-	xorq	%r8,%r15
+	xorq	%r8,%r15  // f^g
 
 	movq	%r12,16(%rsp)
 	xorq	%r10,%r14
-	andq	%rcx,%r15
+	andq	%rcx,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r9,%r12
-	xorq	%r8,%r15
+	addq	%r9,%r12  // T1+=h
+	xorq	%r8,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rcx,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r10,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r10,%r14
 
-	xorq	%r11,%r15
-	rorq	$14,%r13
+	xorq	%r11,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r11,%r9
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r9
-	addq	%r12,%rbx
-	addq	%r12,%r9
+	xorq	%rdi,%r9  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rbx  // d+=T1
+	addq	%r12,%r9  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	32(%rsp),%r13
 	movq	8(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r9
+	addq	%r14,%r9  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -907,8 +907,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	96(%rsp),%r12
 
 	addq	24(%rsp),%r12
@@ -920,43 +920,43 @@
 
 	xorq	%rbx,%r13
 	rorq	$5,%r14
-	xorq	%rdx,%rdi
+	xorq	%rdx,%rdi  // f^g
 
 	movq	%r12,24(%rsp)
 	xorq	%r9,%r14
-	andq	%rbx,%rdi
+	andq	%rbx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r8,%r12
-	xorq	%rdx,%rdi
+	addq	%r8,%r12  // T1+=h
+	xorq	%rdx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rbx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r9,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r9,%r14
 
-	xorq	%r10,%rdi
-	rorq	$14,%r13
+	xorq	%r10,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r10,%r8
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r8
-	addq	%r12,%rax
-	addq	%r12,%r8
+	xorq	%r15,%r8  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rax  // d+=T1
+	addq	%r12,%r8  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	40(%rsp),%r13
 	movq	16(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r8
+	addq	%r14,%r8  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -967,8 +967,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	104(%rsp),%r12
 
 	addq	32(%rsp),%r12
@@ -980,43 +980,43 @@
 
 	xorq	%rax,%r13
 	rorq	$5,%r14
-	xorq	%rcx,%r15
+	xorq	%rcx,%r15  // f^g
 
 	movq	%r12,32(%rsp)
 	xorq	%r8,%r14
-	andq	%rax,%r15
+	andq	%rax,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rdx,%r12
-	xorq	%rcx,%r15
+	addq	%rdx,%r12  // T1+=h
+	xorq	%rcx,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rax,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r8,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r8,%r14
 
-	xorq	%r9,%r15
-	rorq	$14,%r13
+	xorq	%r9,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r9,%rdx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rdx
-	addq	%r12,%r11
-	addq	%r12,%rdx
+	xorq	%rdi,%rdx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r11  // d+=T1
+	addq	%r12,%rdx  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	48(%rsp),%r13
 	movq	24(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rdx
+	addq	%r14,%rdx  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -1027,8 +1027,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	112(%rsp),%r12
 
 	addq	40(%rsp),%r12
@@ -1040,43 +1040,43 @@
 
 	xorq	%r11,%r13
 	rorq	$5,%r14
-	xorq	%rbx,%rdi
+	xorq	%rbx,%rdi  // f^g
 
 	movq	%r12,40(%rsp)
 	xorq	%rdx,%r14
-	andq	%r11,%rdi
+	andq	%r11,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rcx,%r12
-	xorq	%rbx,%rdi
+	addq	%rcx,%r12  // T1+=h
+	xorq	%rbx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r11,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rdx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rdx,%r14
 
-	xorq	%r8,%rdi
-	rorq	$14,%r13
+	xorq	%r8,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r8,%rcx
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rcx
-	addq	%r12,%r10
-	addq	%r12,%rcx
+	xorq	%r15,%rcx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r10  // d+=T1
+	addq	%r12,%rcx  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	56(%rsp),%r13
 	movq	32(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rcx
+	addq	%r14,%rcx  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -1087,8 +1087,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	120(%rsp),%r12
 
 	addq	48(%rsp),%r12
@@ -1100,43 +1100,43 @@
 
 	xorq	%r10,%r13
 	rorq	$5,%r14
-	xorq	%rax,%r15
+	xorq	%rax,%r15  // f^g
 
 	movq	%r12,48(%rsp)
 	xorq	%rcx,%r14
-	andq	%r10,%r15
+	andq	%r10,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rbx,%r12
-	xorq	%rax,%r15
+	addq	%rbx,%r12  // T1+=h
+	xorq	%rax,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r10,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rcx,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rcx,%r14
 
-	xorq	%rdx,%r15
-	rorq	$14,%r13
+	xorq	%rdx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rdx,%rbx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rbx
-	addq	%r12,%r9
-	addq	%r12,%rbx
+	xorq	%rdi,%rbx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r9  // d+=T1
+	addq	%r12,%rbx  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	64(%rsp),%r13
 	movq	40(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rbx
+	addq	%r14,%rbx  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -1147,8 +1147,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	0(%rsp),%r12
 
 	addq	56(%rsp),%r12
@@ -1160,43 +1160,43 @@
 
 	xorq	%r9,%r13
 	rorq	$5,%r14
-	xorq	%r11,%rdi
+	xorq	%r11,%rdi  // f^g
 
 	movq	%r12,56(%rsp)
 	xorq	%rbx,%r14
-	andq	%r9,%rdi
+	andq	%r9,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rax,%r12
-	xorq	%r11,%rdi
+	addq	%rax,%r12  // T1+=h
+	xorq	%r11,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r9,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rbx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rbx,%r14
 
-	xorq	%rcx,%rdi
-	rorq	$14,%r13
+	xorq	%rcx,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rcx,%rax
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rax
-	addq	%r12,%r8
-	addq	%r12,%rax
+	xorq	%r15,%rax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r8  // d+=T1
+	addq	%r12,%rax  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	72(%rsp),%r13
 	movq	48(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rax
+	addq	%r14,%rax  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -1207,8 +1207,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	8(%rsp),%r12
 
 	addq	64(%rsp),%r12
@@ -1220,43 +1220,43 @@
 
 	xorq	%r8,%r13
 	rorq	$5,%r14
-	xorq	%r10,%r15
+	xorq	%r10,%r15  // f^g
 
 	movq	%r12,64(%rsp)
 	xorq	%rax,%r14
-	andq	%r8,%r15
+	andq	%r8,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r11,%r12
-	xorq	%r10,%r15
+	addq	%r11,%r12  // T1+=h
+	xorq	%r10,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r8,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rax,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rax,%r14
 
-	xorq	%rbx,%r15
-	rorq	$14,%r13
+	xorq	%rbx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rbx,%r11
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r11
-	addq	%r12,%rdx
-	addq	%r12,%r11
+	xorq	%rdi,%r11  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rdx  // d+=T1
+	addq	%r12,%r11  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	80(%rsp),%r13
 	movq	56(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r11
+	addq	%r14,%r11  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -1267,8 +1267,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	16(%rsp),%r12
 
 	addq	72(%rsp),%r12
@@ -1280,43 +1280,43 @@
 
 	xorq	%rdx,%r13
 	rorq	$5,%r14
-	xorq	%r9,%rdi
+	xorq	%r9,%rdi  // f^g
 
 	movq	%r12,72(%rsp)
 	xorq	%r11,%r14
-	andq	%rdx,%rdi
+	andq	%rdx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r10,%r12
-	xorq	%r9,%rdi
+	addq	%r10,%r12  // T1+=h
+	xorq	%r9,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rdx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r11,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r11,%r14
 
-	xorq	%rax,%rdi
-	rorq	$14,%r13
+	xorq	%rax,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rax,%r10
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r10
-	addq	%r12,%rcx
-	addq	%r12,%r10
+	xorq	%r15,%r10  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rcx  // d+=T1
+	addq	%r12,%r10  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	88(%rsp),%r13
 	movq	64(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r10
+	addq	%r14,%r10  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -1327,8 +1327,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	24(%rsp),%r12
 
 	addq	80(%rsp),%r12
@@ -1340,43 +1340,43 @@
 
 	xorq	%rcx,%r13
 	rorq	$5,%r14
-	xorq	%r8,%r15
+	xorq	%r8,%r15  // f^g
 
 	movq	%r12,80(%rsp)
 	xorq	%r10,%r14
-	andq	%rcx,%r15
+	andq	%rcx,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r9,%r12
-	xorq	%r8,%r15
+	addq	%r9,%r12  // T1+=h
+	xorq	%r8,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rcx,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r10,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r10,%r14
 
-	xorq	%r11,%r15
-	rorq	$14,%r13
+	xorq	%r11,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r11,%r9
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%r9
-	addq	%r12,%rbx
-	addq	%r12,%r9
+	xorq	%rdi,%r9  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rbx  // d+=T1
+	addq	%r12,%r9  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	96(%rsp),%r13
 	movq	72(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r9
+	addq	%r14,%r9  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -1387,8 +1387,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	32(%rsp),%r12
 
 	addq	88(%rsp),%r12
@@ -1400,43 +1400,43 @@
 
 	xorq	%rbx,%r13
 	rorq	$5,%r14
-	xorq	%rdx,%rdi
+	xorq	%rdx,%rdi  // f^g
 
 	movq	%r12,88(%rsp)
 	xorq	%r9,%r14
-	andq	%rbx,%rdi
+	andq	%rbx,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%r8,%r12
-	xorq	%rdx,%rdi
+	addq	%r8,%r12  // T1+=h
+	xorq	%rdx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rbx,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r9,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r9,%r14
 
-	xorq	%r10,%rdi
-	rorq	$14,%r13
+	xorq	%r10,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r10,%r8
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%r8
-	addq	%r12,%rax
-	addq	%r12,%r8
+	xorq	%r15,%r8  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%rax  // d+=T1
+	addq	%r12,%r8  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	104(%rsp),%r13
 	movq	80(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%r8
+	addq	%r14,%r8  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -1447,8 +1447,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	40(%rsp),%r12
 
 	addq	96(%rsp),%r12
@@ -1460,43 +1460,43 @@
 
 	xorq	%rax,%r13
 	rorq	$5,%r14
-	xorq	%rcx,%r15
+	xorq	%rcx,%r15  // f^g
 
 	movq	%r12,96(%rsp)
 	xorq	%r8,%r14
-	andq	%rax,%r15
+	andq	%rax,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rdx,%r12
-	xorq	%rcx,%r15
+	addq	%rdx,%r12  // T1+=h
+	xorq	%rcx,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%rax,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%r8,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%r8,%r14
 
-	xorq	%r9,%r15
-	rorq	$14,%r13
+	xorq	%r9,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r9,%rdx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rdx
-	addq	%r12,%r11
-	addq	%r12,%rdx
+	xorq	%rdi,%rdx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r11  // d+=T1
+	addq	%r12,%rdx  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	112(%rsp),%r13
 	movq	88(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rdx
+	addq	%r14,%rdx  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -1507,8 +1507,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	48(%rsp),%r12
 
 	addq	104(%rsp),%r12
@@ -1520,43 +1520,43 @@
 
 	xorq	%r11,%r13
 	rorq	$5,%r14
-	xorq	%rbx,%rdi
+	xorq	%rbx,%rdi  // f^g
 
 	movq	%r12,104(%rsp)
 	xorq	%rdx,%r14
-	andq	%r11,%rdi
+	andq	%r11,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rcx,%r12
-	xorq	%rbx,%rdi
+	addq	%rcx,%r12  // T1+=h
+	xorq	%rbx,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r11,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rdx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rdx,%r14
 
-	xorq	%r8,%rdi
-	rorq	$14,%r13
+	xorq	%r8,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%r8,%rcx
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rcx
-	addq	%r12,%r10
-	addq	%r12,%rcx
+	xorq	%r15,%rcx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r10  // d+=T1
+	addq	%r12,%rcx  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	movq	120(%rsp),%r13
 	movq	96(%rsp),%r15
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rcx
+	addq	%r14,%rcx  // modulo-scheduled h+=Sigma0(a)
 	movq	%r15,%r14
 	rorq	$42,%r15
 
@@ -1567,8 +1567,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%r15
-	xorq	%r13,%r12
-	xorq	%r14,%r15
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%r15  // sigma1(X(i+14)&0xf)
 	addq	56(%rsp),%r12
 
 	addq	112(%rsp),%r12
@@ -1580,43 +1580,43 @@
 
 	xorq	%r10,%r13
 	rorq	$5,%r14
-	xorq	%rax,%r15
+	xorq	%rax,%r15  // f^g
 
 	movq	%r12,112(%rsp)
 	xorq	%rcx,%r14
-	andq	%r10,%r15
+	andq	%r10,%r15  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rbx,%r12
-	xorq	%rax,%r15
+	addq	%rbx,%r12  // T1+=h
+	xorq	%rax,%r15  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r10,%r13
-	addq	%r15,%r12
+	addq	%r15,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rcx,%r15
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rcx,%r14
 
-	xorq	%rdx,%r15
-	rorq	$14,%r13
+	xorq	%rdx,%r15  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rdx,%rbx
 
 	andq	%r15,%rdi
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%rdi,%rbx
-	addq	%r12,%r9
-	addq	%r12,%rbx
+	xorq	%rdi,%rbx  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r9  // d+=T1
+	addq	%r12,%rbx  // h+=T1
 
-	leaq	8(%rbp),%rbp
+	leaq	8(%rbp),%rbp  // round++
 	movq	0(%rsp),%r13
 	movq	104(%rsp),%rdi
 
 	movq	%r13,%r12
 	rorq	$7,%r13
-	addq	%r14,%rbx
+	addq	%r14,%rbx  // modulo-scheduled h+=Sigma0(a)
 	movq	%rdi,%r14
 	rorq	$42,%rdi
 
@@ -1627,8 +1627,8 @@
 	shrq	$6,%r14
 
 	rorq	$19,%rdi
-	xorq	%r13,%r12
-	xorq	%r14,%rdi
+	xorq	%r13,%r12  // sigma0(X(i+1)&0xf)
+	xorq	%r14,%rdi  // sigma1(X(i+14)&0xf)
 	addq	64(%rsp),%r12
 
 	addq	120(%rsp),%r12
@@ -1640,42 +1640,42 @@
 
 	xorq	%r9,%r13
 	rorq	$5,%r14
-	xorq	%r11,%rdi
+	xorq	%r11,%rdi  // f^g
 
 	movq	%r12,120(%rsp)
 	xorq	%rbx,%r14
-	andq	%r9,%rdi
+	andq	%r9,%rdi  // (f^g)&e
 
 	rorq	$4,%r13
-	addq	%rax,%r12
-	xorq	%r11,%rdi
+	addq	%rax,%r12  // T1+=h
+	xorq	%r11,%rdi  // Ch(e,f,g)=((f^g)&e)^g
 
 	rorq	$6,%r14
 	xorq	%r9,%r13
-	addq	%rdi,%r12
+	addq	%rdi,%r12  // T1+=Ch(e,f,g)
 
 	movq	%rbx,%rdi
-	addq	(%rbp),%r12
+	addq	(%rbp),%r12  // T1+=Kround
 	xorq	%rbx,%r14
 
-	xorq	%rcx,%rdi
-	rorq	$14,%r13
+	xorq	%rcx,%rdi  // a^b, b^c in next round
+	rorq	$14,%r13  // Sigma1(e)
 	movq	%rcx,%rax
 
 	andq	%rdi,%r15
-	rorq	$28,%r14
-	addq	%r13,%r12
+	rorq	$28,%r14  // Sigma0(a)
+	addq	%r13,%r12  // T1+=Sigma1(e)
 
-	xorq	%r15,%rax
-	addq	%r12,%r8
-	addq	%r12,%rax
+	xorq	%r15,%rax  // h=Maj(a,b,c)=Ch(a^b,c,b)
+	addq	%r12,%r8  // d+=T1
+	addq	%r12,%rax  // h+=T1
 
-	leaq	24(%rbp),%rbp
+	leaq	24(%rbp),%rbp  // round++
 	cmpb	$0,7(%rbp)
 	jnz	.Lrounds_16_xx
 
 	movq	128+0(%rsp),%rdi
-	addq	%r14,%rax
+	addq	%r14,%rax  // modulo-scheduled h+=Sigma0(a)
 	leaq	128(%rsi),%rsi
 
 	addq	0(%rdi),%rax
@@ -1815,7 +1815,7 @@
 sha512_block_data_order_avx:
 .cfi_startproc	
 _CET_ENDBR
-	movq	%rsp,%rax
+	movq	%rsp,%rax  // copy %rsp
 .cfi_def_cfa_register	%rax
 	pushq	%rbx
 .cfi_offset	%rbx,-16
@@ -1829,14 +1829,14 @@
 .cfi_offset	%r14,-48
 	pushq	%r15
 .cfi_offset	%r15,-56
-	shlq	$4,%rdx
+	shlq	$4,%rdx  // num*16
 	subq	$160,%rsp
-	leaq	(%rsi,%rdx,8),%rdx
-	andq	$-64,%rsp
-	movq	%rdi,128+0(%rsp)
-	movq	%rsi,128+8(%rsp)
-	movq	%rdx,128+16(%rsp)
-	movq	%rax,152(%rsp)
+	leaq	(%rsi,%rdx,8),%rdx  // inp+num*16*8
+	andq	$-64,%rsp  // align stack frame
+	movq	%rdi,128+0(%rsp)  // save ctx, 1st arg
+	movq	%rsi,128+8(%rsp)  // save inp, 2nd arh
+	movq	%rdx,128+16(%rsp)  // save end pointer, "3rd" arg
+	movq	%rax,152(%rsp)  // save copy of %rsp
 .cfi_escape	0x0f,0x06,0x77,0x98,0x01,0x06,0x23,0x08
 .Lprologue_avx:
 
@@ -1854,7 +1854,7 @@
 .Lloop_avx:
 	vmovdqa	K512+1280(%rip),%xmm11
 	vmovdqu	0(%rsi),%xmm0
-	leaq	K512+128(%rip),%rbp
+	leaq	K512+128(%rip),%rbp  // size optimization
 	vmovdqu	16(%rsi),%xmm1
 	vmovdqu	32(%rsi),%xmm2
 	vpshufb	%xmm11,%xmm0,%xmm0
@@ -1887,7 +1887,7 @@
 	vmovdqa	%xmm9,80(%rsp)
 	movq	%rbx,%rdi
 	vmovdqa	%xmm10,96(%rsp)
-	xorq	%rcx,%rdi
+	xorq	%rcx,%rdi  // magic
 	vmovdqa	%xmm11,112(%rsp)
 	movq	%r8,%r13
 	jmp	.Lavx_00_47

boringssl-0.20260708.tar.xz/gen/bcm/sha512-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/sha512-x86_64-win.asm Changed

@@ -29,7 +29,7 @@
 
 
 _CET_ENDBR
-	mov	rax,rsp
+	mov	rax,rsp  ; copy %rsp
 
 	push	rbx
 
@@ -43,14 +43,14 @@
 
 	push	r15
 
-	shl	rdx,4
+	shl	rdx,4  ; num*16
 	sub	rsp,16*8+4*8
-	lea	rdx,rdx*8+rsi
-	and	rsp,-64
-	mov	QWORD((128+0))+rsp,rdi
-	mov	QWORD((128+8))+rsp,rsi
-	mov	QWORD((128+16))+rsp,rdx
-	mov	QWORD152+rsp,rax
+	lea	rdx,rdx*8+rsi  ; inp+num*16*8
+	and	rsp,-64  ; align stack frame
+	mov	QWORD((128+0))+rsp,rdi  ; save ctx, 1st arg
+	mov	QWORD((128+8))+rsp,rsi  ; save inp, 2nd arh
+	mov	QWORD((128+16))+rsp,rdx  ; save end pointer, "3rd" arg
+	mov	QWORD152+rsp,rax  ; save copy of %rsp
 
 $L$prologue:
 
@@ -68,7 +68,7 @@
 $L$loop:
 	mov	rdi,rbx
 	lea	rbp,K512
-	xor	rdi,rcx
+	xor	rdi,rcx  ; magic
 	mov	r12,QWORDrsi
 	mov	r13,r8
 	mov	r14,rax
@@ -78,38 +78,38 @@
 
 	xor	r13,r8
 	ror	r14,5
-	xor	r15,r10
+	xor	r15,r10  ; f^g
 
 	mov	QWORDrsp,r12
 	xor	r14,rax
-	and	r15,r8
+	and	r15,r8  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r11
-	xor	r15,r10
+	add	r12,r11  ; T1+=h
+	xor	r15,r10  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r8
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,rax
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rax
 
-	xor	r15,rbx
-	ror	r13,14
+	xor	r15,rbx  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r11,rbx
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r11,rdi
-	add	rdx,r12
-	add	r11,r12
+	xor	r11,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rdx,r12  ; d+=T1
+	add	r11,r12  ; h+=T1
 
-	lea	rbp,8+rbp
-	add	r11,r14
+	lea	rbp,8+rbp  ; round++
+	add	r11,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD8+rsi
 	mov	r13,rdx
 	mov	r14,r11
@@ -119,38 +119,38 @@
 
 	xor	r13,rdx
 	ror	r14,5
-	xor	rdi,r9
+	xor	rdi,r9  ; f^g
 
 	mov	QWORD8+rsp,r12
 	xor	r14,r11
-	and	rdi,rdx
+	and	rdi,rdx  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r10
-	xor	rdi,r9
+	add	r12,r10  ; T1+=h
+	xor	rdi,r9  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rdx
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,r11
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r11
 
-	xor	rdi,rax
-	ror	r13,14
+	xor	rdi,rax  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r10,rax
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r10,r15
-	add	rcx,r12
-	add	r10,r12
+	xor	r10,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rcx,r12  ; d+=T1
+	add	r10,r12  ; h+=T1
 
-	lea	rbp,24+rbp
-	add	r10,r14
+	lea	rbp,24+rbp  ; round++
+	add	r10,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD16+rsi
 	mov	r13,rcx
 	mov	r14,r10
@@ -160,38 +160,38 @@
 
 	xor	r13,rcx
 	ror	r14,5
-	xor	r15,r8
+	xor	r15,r8  ; f^g
 
 	mov	QWORD16+rsp,r12
 	xor	r14,r10
-	and	r15,rcx
+	and	r15,rcx  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r9
-	xor	r15,r8
+	add	r12,r9  ; T1+=h
+	xor	r15,r8  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rcx
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,r10
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r10
 
-	xor	r15,r11
-	ror	r13,14
+	xor	r15,r11  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r9,r11
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r9,rdi
-	add	rbx,r12
-	add	r9,r12
+	xor	r9,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rbx,r12  ; d+=T1
+	add	r9,r12  ; h+=T1
 
-	lea	rbp,8+rbp
-	add	r9,r14
+	lea	rbp,8+rbp  ; round++
+	add	r9,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD24+rsi
 	mov	r13,rbx
 	mov	r14,r9
@@ -201,38 +201,38 @@
 
 	xor	r13,rbx
 	ror	r14,5
-	xor	rdi,rdx
+	xor	rdi,rdx  ; f^g
 
 	mov	QWORD24+rsp,r12
 	xor	r14,r9
-	and	rdi,rbx
+	and	rdi,rbx  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r8
-	xor	rdi,rdx
+	add	r12,r8  ; T1+=h
+	xor	rdi,rdx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rbx
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,r9
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r9
 
-	xor	rdi,r10
-	ror	r13,14
+	xor	rdi,r10  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r8,r10
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r8,r15
-	add	rax,r12
-	add	r8,r12
+	xor	r8,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rax,r12  ; d+=T1
+	add	r8,r12  ; h+=T1
 
-	lea	rbp,24+rbp
-	add	r8,r14
+	lea	rbp,24+rbp  ; round++
+	add	r8,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD32+rsi
 	mov	r13,rax
 	mov	r14,r8
@@ -242,38 +242,38 @@
 
 	xor	r13,rax
 	ror	r14,5
-	xor	r15,rcx
+	xor	r15,rcx  ; f^g
 
 	mov	QWORD32+rsp,r12
 	xor	r14,r8
-	and	r15,rax
+	and	r15,rax  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rdx
-	xor	r15,rcx
+	add	r12,rdx  ; T1+=h
+	xor	r15,rcx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rax
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,r8
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r8
 
-	xor	r15,r9
-	ror	r13,14
+	xor	r15,r9  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rdx,r9
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rdx,rdi
-	add	r11,r12
-	add	rdx,r12
+	xor	rdx,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r11,r12  ; d+=T1
+	add	rdx,r12  ; h+=T1
 
-	lea	rbp,8+rbp
-	add	rdx,r14
+	lea	rbp,8+rbp  ; round++
+	add	rdx,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD40+rsi
 	mov	r13,r11
 	mov	r14,rdx
@@ -283,38 +283,38 @@
 
 	xor	r13,r11
 	ror	r14,5
-	xor	rdi,rbx
+	xor	rdi,rbx  ; f^g
 
 	mov	QWORD40+rsp,r12
 	xor	r14,rdx
-	and	rdi,r11
+	and	rdi,r11  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rcx
-	xor	rdi,rbx
+	add	r12,rcx  ; T1+=h
+	xor	rdi,rbx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r11
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,rdx
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rdx
 
-	xor	rdi,r8
-	ror	r13,14
+	xor	rdi,r8  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rcx,r8
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rcx,r15
-	add	r10,r12
-	add	rcx,r12
+	xor	rcx,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r10,r12  ; d+=T1
+	add	rcx,r12  ; h+=T1
 
-	lea	rbp,24+rbp
-	add	rcx,r14
+	lea	rbp,24+rbp  ; round++
+	add	rcx,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD48+rsi
 	mov	r13,r10
 	mov	r14,rcx
@@ -324,38 +324,38 @@
 
 	xor	r13,r10
 	ror	r14,5
-	xor	r15,rax
+	xor	r15,rax  ; f^g
 
 	mov	QWORD48+rsp,r12
 	xor	r14,rcx
-	and	r15,r10
+	and	r15,r10  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rbx
-	xor	r15,rax
+	add	r12,rbx  ; T1+=h
+	xor	r15,rax  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r10
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,rcx
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rcx
 
-	xor	r15,rdx
-	ror	r13,14
+	xor	r15,rdx  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rbx,rdx
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rbx,rdi
-	add	r9,r12
-	add	rbx,r12
+	xor	rbx,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r9,r12  ; d+=T1
+	add	rbx,r12  ; h+=T1
 
-	lea	rbp,8+rbp
-	add	rbx,r14
+	lea	rbp,8+rbp  ; round++
+	add	rbx,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD56+rsi
 	mov	r13,r9
 	mov	r14,rbx
@@ -365,38 +365,38 @@
 
 	xor	r13,r9
 	ror	r14,5
-	xor	rdi,r11
+	xor	rdi,r11  ; f^g
 
 	mov	QWORD56+rsp,r12
 	xor	r14,rbx
-	and	rdi,r9
+	and	rdi,r9  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rax
-	xor	rdi,r11
+	add	r12,rax  ; T1+=h
+	xor	rdi,r11  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r9
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,rbx
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rbx
 
-	xor	rdi,rcx
-	ror	r13,14
+	xor	rdi,rcx  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rax,rcx
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rax,r15
-	add	r8,r12
-	add	rax,r12
+	xor	rax,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r8,r12  ; d+=T1
+	add	rax,r12  ; h+=T1
 
-	lea	rbp,24+rbp
-	add	rax,r14
+	lea	rbp,24+rbp  ; round++
+	add	rax,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD64+rsi
 	mov	r13,r8
 	mov	r14,rax
@@ -406,38 +406,38 @@
 
 	xor	r13,r8
 	ror	r14,5
-	xor	r15,r10
+	xor	r15,r10  ; f^g
 
 	mov	QWORD64+rsp,r12
 	xor	r14,rax
-	and	r15,r8
+	and	r15,r8  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r11
-	xor	r15,r10
+	add	r12,r11  ; T1+=h
+	xor	r15,r10  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r8
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,rax
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rax
 
-	xor	r15,rbx
-	ror	r13,14
+	xor	r15,rbx  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r11,rbx
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r11,rdi
-	add	rdx,r12
-	add	r11,r12
+	xor	r11,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rdx,r12  ; d+=T1
+	add	r11,r12  ; h+=T1
 
-	lea	rbp,8+rbp
-	add	r11,r14
+	lea	rbp,8+rbp  ; round++
+	add	r11,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD72+rsi
 	mov	r13,rdx
 	mov	r14,r11
@@ -447,38 +447,38 @@
 
 	xor	r13,rdx
 	ror	r14,5
-	xor	rdi,r9
+	xor	rdi,r9  ; f^g
 
 	mov	QWORD72+rsp,r12
 	xor	r14,r11
-	and	rdi,rdx
+	and	rdi,rdx  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r10
-	xor	rdi,r9
+	add	r12,r10  ; T1+=h
+	xor	rdi,r9  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rdx
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,r11
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r11
 
-	xor	rdi,rax
-	ror	r13,14
+	xor	rdi,rax  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r10,rax
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r10,r15
-	add	rcx,r12
-	add	r10,r12
+	xor	r10,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rcx,r12  ; d+=T1
+	add	r10,r12  ; h+=T1
 
-	lea	rbp,24+rbp
-	add	r10,r14
+	lea	rbp,24+rbp  ; round++
+	add	r10,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD80+rsi
 	mov	r13,rcx
 	mov	r14,r10
@@ -488,38 +488,38 @@
 
 	xor	r13,rcx
 	ror	r14,5
-	xor	r15,r8
+	xor	r15,r8  ; f^g
 
 	mov	QWORD80+rsp,r12
 	xor	r14,r10
-	and	r15,rcx
+	and	r15,rcx  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r9
-	xor	r15,r8
+	add	r12,r9  ; T1+=h
+	xor	r15,r8  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rcx
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,r10
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r10
 
-	xor	r15,r11
-	ror	r13,14
+	xor	r15,r11  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r9,r11
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r9,rdi
-	add	rbx,r12
-	add	r9,r12
+	xor	r9,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rbx,r12  ; d+=T1
+	add	r9,r12  ; h+=T1
 
-	lea	rbp,8+rbp
-	add	r9,r14
+	lea	rbp,8+rbp  ; round++
+	add	r9,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD88+rsi
 	mov	r13,rbx
 	mov	r14,r9
@@ -529,38 +529,38 @@
 
 	xor	r13,rbx
 	ror	r14,5
-	xor	rdi,rdx
+	xor	rdi,rdx  ; f^g
 
 	mov	QWORD88+rsp,r12
 	xor	r14,r9
-	and	rdi,rbx
+	and	rdi,rbx  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r8
-	xor	rdi,rdx
+	add	r12,r8  ; T1+=h
+	xor	rdi,rdx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rbx
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,r9
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r9
 
-	xor	rdi,r10
-	ror	r13,14
+	xor	rdi,r10  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r8,r10
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r8,r15
-	add	rax,r12
-	add	r8,r12
+	xor	r8,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rax,r12  ; d+=T1
+	add	r8,r12  ; h+=T1
 
-	lea	rbp,24+rbp
-	add	r8,r14
+	lea	rbp,24+rbp  ; round++
+	add	r8,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD96+rsi
 	mov	r13,rax
 	mov	r14,r8
@@ -570,38 +570,38 @@
 
 	xor	r13,rax
 	ror	r14,5
-	xor	r15,rcx
+	xor	r15,rcx  ; f^g
 
 	mov	QWORD96+rsp,r12
 	xor	r14,r8
-	and	r15,rax
+	and	r15,rax  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rdx
-	xor	r15,rcx
+	add	r12,rdx  ; T1+=h
+	xor	r15,rcx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rax
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,r8
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r8
 
-	xor	r15,r9
-	ror	r13,14
+	xor	r15,r9  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rdx,r9
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rdx,rdi
-	add	r11,r12
-	add	rdx,r12
+	xor	rdx,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r11,r12  ; d+=T1
+	add	rdx,r12  ; h+=T1
 
-	lea	rbp,8+rbp
-	add	rdx,r14
+	lea	rbp,8+rbp  ; round++
+	add	rdx,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD104+rsi
 	mov	r13,r11
 	mov	r14,rdx
@@ -611,38 +611,38 @@
 
 	xor	r13,r11
 	ror	r14,5
-	xor	rdi,rbx
+	xor	rdi,rbx  ; f^g
 
 	mov	QWORD104+rsp,r12
 	xor	r14,rdx
-	and	rdi,r11
+	and	rdi,r11  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rcx
-	xor	rdi,rbx
+	add	r12,rcx  ; T1+=h
+	xor	rdi,rbx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r11
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,rdx
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rdx
 
-	xor	rdi,r8
-	ror	r13,14
+	xor	rdi,r8  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rcx,r8
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rcx,r15
-	add	r10,r12
-	add	rcx,r12
+	xor	rcx,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r10,r12  ; d+=T1
+	add	rcx,r12  ; h+=T1
 
-	lea	rbp,24+rbp
-	add	rcx,r14
+	lea	rbp,24+rbp  ; round++
+	add	rcx,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD112+rsi
 	mov	r13,r10
 	mov	r14,rcx
@@ -652,38 +652,38 @@
 
 	xor	r13,r10
 	ror	r14,5
-	xor	r15,rax
+	xor	r15,rax  ; f^g
 
 	mov	QWORD112+rsp,r12
 	xor	r14,rcx
-	and	r15,r10
+	and	r15,r10  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rbx
-	xor	r15,rax
+	add	r12,rbx  ; T1+=h
+	xor	r15,rax  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r10
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,rcx
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rcx
 
-	xor	r15,rdx
-	ror	r13,14
+	xor	r15,rdx  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rbx,rdx
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rbx,rdi
-	add	r9,r12
-	add	rbx,r12
+	xor	rbx,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r9,r12  ; d+=T1
+	add	rbx,r12  ; h+=T1
 
-	lea	rbp,8+rbp
-	add	rbx,r14
+	lea	rbp,8+rbp  ; round++
+	add	rbx,r14  ; h+=Sigma0(a)
 	mov	r12,QWORD120+rsi
 	mov	r13,r9
 	mov	r14,rbx
@@ -693,37 +693,37 @@
 
 	xor	r13,r9
 	ror	r14,5
-	xor	rdi,r11
+	xor	rdi,r11  ; f^g
 
 	mov	QWORD120+rsp,r12
 	xor	r14,rbx
-	and	rdi,r9
+	and	rdi,r9  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rax
-	xor	rdi,r11
+	add	r12,rax  ; T1+=h
+	xor	rdi,r11  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r9
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,rbx
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rbx
 
-	xor	rdi,rcx
-	ror	r13,14
+	xor	rdi,rcx  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rax,rcx
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rax,r15
-	add	r8,r12
-	add	rax,r12
+	xor	rax,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r8,r12  ; d+=T1
+	add	rax,r12  ; h+=T1
 
-	lea	rbp,24+rbp
+	lea	rbp,24+rbp  ; round++
 	jmp	NEAR $L$rounds_16_xx
 ALIGN	16
 $L$rounds_16_xx:
@@ -732,7 +732,7 @@
 
 	mov	r12,r13
 	ror	r13,7
-	add	rax,r14
+	add	rax,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,r15
 	ror	r15,42
 
@@ -743,8 +743,8 @@
 	shr	r14,6
 
 	ror	r15,19
-	xor	r12,r13
-	xor	r15,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	r15,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD72+rsp
 
 	add	r12,QWORDrsp
@@ -756,43 +756,43 @@
 
 	xor	r13,r8
 	ror	r14,5
-	xor	r15,r10
+	xor	r15,r10  ; f^g
 
 	mov	QWORDrsp,r12
 	xor	r14,rax
-	and	r15,r8
+	and	r15,r8  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r11
-	xor	r15,r10
+	add	r12,r11  ; T1+=h
+	xor	r15,r10  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r8
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,rax
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rax
 
-	xor	r15,rbx
-	ror	r13,14
+	xor	r15,rbx  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r11,rbx
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r11,rdi
-	add	rdx,r12
-	add	r11,r12
+	xor	r11,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rdx,r12  ; d+=T1
+	add	r11,r12  ; h+=T1
 
-	lea	rbp,8+rbp
+	lea	rbp,8+rbp  ; round++
 	mov	r13,QWORD16+rsp
 	mov	rdi,QWORD120+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	r11,r14
+	add	r11,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,rdi
 	ror	rdi,42
 
@@ -803,8 +803,8 @@
 	shr	r14,6
 
 	ror	rdi,19
-	xor	r12,r13
-	xor	rdi,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	rdi,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD80+rsp
 
 	add	r12,QWORD8+rsp
@@ -816,43 +816,43 @@
 
 	xor	r13,rdx
 	ror	r14,5
-	xor	rdi,r9
+	xor	rdi,r9  ; f^g
 
 	mov	QWORD8+rsp,r12
 	xor	r14,r11
-	and	rdi,rdx
+	and	rdi,rdx  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r10
-	xor	rdi,r9
+	add	r12,r10  ; T1+=h
+	xor	rdi,r9  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rdx
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,r11
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r11
 
-	xor	rdi,rax
-	ror	r13,14
+	xor	rdi,rax  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r10,rax
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r10,r15
-	add	rcx,r12
-	add	r10,r12
+	xor	r10,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rcx,r12  ; d+=T1
+	add	r10,r12  ; h+=T1
 
-	lea	rbp,24+rbp
+	lea	rbp,24+rbp  ; round++
 	mov	r13,QWORD24+rsp
 	mov	r15,QWORDrsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	r10,r14
+	add	r10,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,r15
 	ror	r15,42
 
@@ -863,8 +863,8 @@
 	shr	r14,6
 
 	ror	r15,19
-	xor	r12,r13
-	xor	r15,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	r15,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD88+rsp
 
 	add	r12,QWORD16+rsp
@@ -876,43 +876,43 @@
 
 	xor	r13,rcx
 	ror	r14,5
-	xor	r15,r8
+	xor	r15,r8  ; f^g
 
 	mov	QWORD16+rsp,r12
 	xor	r14,r10
-	and	r15,rcx
+	and	r15,rcx  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r9
-	xor	r15,r8
+	add	r12,r9  ; T1+=h
+	xor	r15,r8  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rcx
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,r10
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r10
 
-	xor	r15,r11
-	ror	r13,14
+	xor	r15,r11  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r9,r11
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r9,rdi
-	add	rbx,r12
-	add	r9,r12
+	xor	r9,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rbx,r12  ; d+=T1
+	add	r9,r12  ; h+=T1
 
-	lea	rbp,8+rbp
+	lea	rbp,8+rbp  ; round++
 	mov	r13,QWORD32+rsp
 	mov	rdi,QWORD8+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	r9,r14
+	add	r9,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,rdi
 	ror	rdi,42
 
@@ -923,8 +923,8 @@
 	shr	r14,6
 
 	ror	rdi,19
-	xor	r12,r13
-	xor	rdi,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	rdi,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD96+rsp
 
 	add	r12,QWORD24+rsp
@@ -936,43 +936,43 @@
 
 	xor	r13,rbx
 	ror	r14,5
-	xor	rdi,rdx
+	xor	rdi,rdx  ; f^g
 
 	mov	QWORD24+rsp,r12
 	xor	r14,r9
-	and	rdi,rbx
+	and	rdi,rbx  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r8
-	xor	rdi,rdx
+	add	r12,r8  ; T1+=h
+	xor	rdi,rdx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rbx
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,r9
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r9
 
-	xor	rdi,r10
-	ror	r13,14
+	xor	rdi,r10  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r8,r10
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r8,r15
-	add	rax,r12
-	add	r8,r12
+	xor	r8,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rax,r12  ; d+=T1
+	add	r8,r12  ; h+=T1
 
-	lea	rbp,24+rbp
+	lea	rbp,24+rbp  ; round++
 	mov	r13,QWORD40+rsp
 	mov	r15,QWORD16+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	r8,r14
+	add	r8,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,r15
 	ror	r15,42
 
@@ -983,8 +983,8 @@
 	shr	r14,6
 
 	ror	r15,19
-	xor	r12,r13
-	xor	r15,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	r15,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD104+rsp
 
 	add	r12,QWORD32+rsp
@@ -996,43 +996,43 @@
 
 	xor	r13,rax
 	ror	r14,5
-	xor	r15,rcx
+	xor	r15,rcx  ; f^g
 
 	mov	QWORD32+rsp,r12
 	xor	r14,r8
-	and	r15,rax
+	and	r15,rax  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rdx
-	xor	r15,rcx
+	add	r12,rdx  ; T1+=h
+	xor	r15,rcx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rax
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,r8
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r8
 
-	xor	r15,r9
-	ror	r13,14
+	xor	r15,r9  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rdx,r9
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rdx,rdi
-	add	r11,r12
-	add	rdx,r12
+	xor	rdx,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r11,r12  ; d+=T1
+	add	rdx,r12  ; h+=T1
 
-	lea	rbp,8+rbp
+	lea	rbp,8+rbp  ; round++
 	mov	r13,QWORD48+rsp
 	mov	rdi,QWORD24+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	rdx,r14
+	add	rdx,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,rdi
 	ror	rdi,42
 
@@ -1043,8 +1043,8 @@
 	shr	r14,6
 
 	ror	rdi,19
-	xor	r12,r13
-	xor	rdi,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	rdi,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD112+rsp
 
 	add	r12,QWORD40+rsp
@@ -1056,43 +1056,43 @@
 
 	xor	r13,r11
 	ror	r14,5
-	xor	rdi,rbx
+	xor	rdi,rbx  ; f^g
 
 	mov	QWORD40+rsp,r12
 	xor	r14,rdx
-	and	rdi,r11
+	and	rdi,r11  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rcx
-	xor	rdi,rbx
+	add	r12,rcx  ; T1+=h
+	xor	rdi,rbx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r11
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,rdx
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rdx
 
-	xor	rdi,r8
-	ror	r13,14
+	xor	rdi,r8  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rcx,r8
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rcx,r15
-	add	r10,r12
-	add	rcx,r12
+	xor	rcx,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r10,r12  ; d+=T1
+	add	rcx,r12  ; h+=T1
 
-	lea	rbp,24+rbp
+	lea	rbp,24+rbp  ; round++
 	mov	r13,QWORD56+rsp
 	mov	r15,QWORD32+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	rcx,r14
+	add	rcx,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,r15
 	ror	r15,42
 
@@ -1103,8 +1103,8 @@
 	shr	r14,6
 
 	ror	r15,19
-	xor	r12,r13
-	xor	r15,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	r15,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD120+rsp
 
 	add	r12,QWORD48+rsp
@@ -1116,43 +1116,43 @@
 
 	xor	r13,r10
 	ror	r14,5
-	xor	r15,rax
+	xor	r15,rax  ; f^g
 
 	mov	QWORD48+rsp,r12
 	xor	r14,rcx
-	and	r15,r10
+	and	r15,r10  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rbx
-	xor	r15,rax
+	add	r12,rbx  ; T1+=h
+	xor	r15,rax  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r10
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,rcx
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rcx
 
-	xor	r15,rdx
-	ror	r13,14
+	xor	r15,rdx  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rbx,rdx
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rbx,rdi
-	add	r9,r12
-	add	rbx,r12
+	xor	rbx,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r9,r12  ; d+=T1
+	add	rbx,r12  ; h+=T1
 
-	lea	rbp,8+rbp
+	lea	rbp,8+rbp  ; round++
 	mov	r13,QWORD64+rsp
 	mov	rdi,QWORD40+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	rbx,r14
+	add	rbx,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,rdi
 	ror	rdi,42
 
@@ -1163,8 +1163,8 @@
 	shr	r14,6
 
 	ror	rdi,19
-	xor	r12,r13
-	xor	rdi,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	rdi,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORDrsp
 
 	add	r12,QWORD56+rsp
@@ -1176,43 +1176,43 @@
 
 	xor	r13,r9
 	ror	r14,5
-	xor	rdi,r11
+	xor	rdi,r11  ; f^g
 
 	mov	QWORD56+rsp,r12
 	xor	r14,rbx
-	and	rdi,r9
+	and	rdi,r9  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rax
-	xor	rdi,r11
+	add	r12,rax  ; T1+=h
+	xor	rdi,r11  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r9
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,rbx
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rbx
 
-	xor	rdi,rcx
-	ror	r13,14
+	xor	rdi,rcx  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rax,rcx
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rax,r15
-	add	r8,r12
-	add	rax,r12
+	xor	rax,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r8,r12  ; d+=T1
+	add	rax,r12  ; h+=T1
 
-	lea	rbp,24+rbp
+	lea	rbp,24+rbp  ; round++
 	mov	r13,QWORD72+rsp
 	mov	r15,QWORD48+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	rax,r14
+	add	rax,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,r15
 	ror	r15,42
 
@@ -1223,8 +1223,8 @@
 	shr	r14,6
 
 	ror	r15,19
-	xor	r12,r13
-	xor	r15,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	r15,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD8+rsp
 
 	add	r12,QWORD64+rsp
@@ -1236,43 +1236,43 @@
 
 	xor	r13,r8
 	ror	r14,5
-	xor	r15,r10
+	xor	r15,r10  ; f^g
 
 	mov	QWORD64+rsp,r12
 	xor	r14,rax
-	and	r15,r8
+	and	r15,r8  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r11
-	xor	r15,r10
+	add	r12,r11  ; T1+=h
+	xor	r15,r10  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r8
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,rax
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rax
 
-	xor	r15,rbx
-	ror	r13,14
+	xor	r15,rbx  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r11,rbx
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r11,rdi
-	add	rdx,r12
-	add	r11,r12
+	xor	r11,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rdx,r12  ; d+=T1
+	add	r11,r12  ; h+=T1
 
-	lea	rbp,8+rbp
+	lea	rbp,8+rbp  ; round++
 	mov	r13,QWORD80+rsp
 	mov	rdi,QWORD56+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	r11,r14
+	add	r11,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,rdi
 	ror	rdi,42
 
@@ -1283,8 +1283,8 @@
 	shr	r14,6
 
 	ror	rdi,19
-	xor	r12,r13
-	xor	rdi,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	rdi,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD16+rsp
 
 	add	r12,QWORD72+rsp
@@ -1296,43 +1296,43 @@
 
 	xor	r13,rdx
 	ror	r14,5
-	xor	rdi,r9
+	xor	rdi,r9  ; f^g
 
 	mov	QWORD72+rsp,r12
 	xor	r14,r11
-	and	rdi,rdx
+	and	rdi,rdx  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r10
-	xor	rdi,r9
+	add	r12,r10  ; T1+=h
+	xor	rdi,r9  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rdx
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,r11
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r11
 
-	xor	rdi,rax
-	ror	r13,14
+	xor	rdi,rax  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r10,rax
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r10,r15
-	add	rcx,r12
-	add	r10,r12
+	xor	r10,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rcx,r12  ; d+=T1
+	add	r10,r12  ; h+=T1
 
-	lea	rbp,24+rbp
+	lea	rbp,24+rbp  ; round++
 	mov	r13,QWORD88+rsp
 	mov	r15,QWORD64+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	r10,r14
+	add	r10,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,r15
 	ror	r15,42
 
@@ -1343,8 +1343,8 @@
 	shr	r14,6
 
 	ror	r15,19
-	xor	r12,r13
-	xor	r15,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	r15,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD24+rsp
 
 	add	r12,QWORD80+rsp
@@ -1356,43 +1356,43 @@
 
 	xor	r13,rcx
 	ror	r14,5
-	xor	r15,r8
+	xor	r15,r8  ; f^g
 
 	mov	QWORD80+rsp,r12
 	xor	r14,r10
-	and	r15,rcx
+	and	r15,rcx  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r9
-	xor	r15,r8
+	add	r12,r9  ; T1+=h
+	xor	r15,r8  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rcx
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,r10
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r10
 
-	xor	r15,r11
-	ror	r13,14
+	xor	r15,r11  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r9,r11
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r9,rdi
-	add	rbx,r12
-	add	r9,r12
+	xor	r9,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rbx,r12  ; d+=T1
+	add	r9,r12  ; h+=T1
 
-	lea	rbp,8+rbp
+	lea	rbp,8+rbp  ; round++
 	mov	r13,QWORD96+rsp
 	mov	rdi,QWORD72+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	r9,r14
+	add	r9,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,rdi
 	ror	rdi,42
 
@@ -1403,8 +1403,8 @@
 	shr	r14,6
 
 	ror	rdi,19
-	xor	r12,r13
-	xor	rdi,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	rdi,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD32+rsp
 
 	add	r12,QWORD88+rsp
@@ -1416,43 +1416,43 @@
 
 	xor	r13,rbx
 	ror	r14,5
-	xor	rdi,rdx
+	xor	rdi,rdx  ; f^g
 
 	mov	QWORD88+rsp,r12
 	xor	r14,r9
-	and	rdi,rbx
+	and	rdi,rbx  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,r8
-	xor	rdi,rdx
+	add	r12,r8  ; T1+=h
+	xor	rdi,rdx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rbx
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,r9
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r9
 
-	xor	rdi,r10
-	ror	r13,14
+	xor	rdi,r10  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	r8,r10
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	r8,r15
-	add	rax,r12
-	add	r8,r12
+	xor	r8,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	rax,r12  ; d+=T1
+	add	r8,r12  ; h+=T1
 
-	lea	rbp,24+rbp
+	lea	rbp,24+rbp  ; round++
 	mov	r13,QWORD104+rsp
 	mov	r15,QWORD80+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	r8,r14
+	add	r8,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,r15
 	ror	r15,42
 
@@ -1463,8 +1463,8 @@
 	shr	r14,6
 
 	ror	r15,19
-	xor	r12,r13
-	xor	r15,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	r15,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD40+rsp
 
 	add	r12,QWORD96+rsp
@@ -1476,43 +1476,43 @@
 
 	xor	r13,rax
 	ror	r14,5
-	xor	r15,rcx
+	xor	r15,rcx  ; f^g
 
 	mov	QWORD96+rsp,r12
 	xor	r14,r8
-	and	r15,rax
+	and	r15,rax  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rdx
-	xor	r15,rcx
+	add	r12,rdx  ; T1+=h
+	xor	r15,rcx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,rax
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,r8
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,r8
 
-	xor	r15,r9
-	ror	r13,14
+	xor	r15,r9  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rdx,r9
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rdx,rdi
-	add	r11,r12
-	add	rdx,r12
+	xor	rdx,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r11,r12  ; d+=T1
+	add	rdx,r12  ; h+=T1
 
-	lea	rbp,8+rbp
+	lea	rbp,8+rbp  ; round++
 	mov	r13,QWORD112+rsp
 	mov	rdi,QWORD88+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	rdx,r14
+	add	rdx,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,rdi
 	ror	rdi,42
 
@@ -1523,8 +1523,8 @@
 	shr	r14,6
 
 	ror	rdi,19
-	xor	r12,r13
-	xor	rdi,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	rdi,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD48+rsp
 
 	add	r12,QWORD104+rsp
@@ -1536,43 +1536,43 @@
 
 	xor	r13,r11
 	ror	r14,5
-	xor	rdi,rbx
+	xor	rdi,rbx  ; f^g
 
 	mov	QWORD104+rsp,r12
 	xor	r14,rdx
-	and	rdi,r11
+	and	rdi,r11  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rcx
-	xor	rdi,rbx
+	add	r12,rcx  ; T1+=h
+	xor	rdi,rbx  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r11
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,rdx
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rdx
 
-	xor	rdi,r8
-	ror	r13,14
+	xor	rdi,r8  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rcx,r8
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rcx,r15
-	add	r10,r12
-	add	rcx,r12
+	xor	rcx,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r10,r12  ; d+=T1
+	add	rcx,r12  ; h+=T1
 
-	lea	rbp,24+rbp
+	lea	rbp,24+rbp  ; round++
 	mov	r13,QWORD120+rsp
 	mov	r15,QWORD96+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	rcx,r14
+	add	rcx,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,r15
 	ror	r15,42
 
@@ -1583,8 +1583,8 @@
 	shr	r14,6
 
 	ror	r15,19
-	xor	r12,r13
-	xor	r15,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	r15,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD56+rsp
 
 	add	r12,QWORD112+rsp
@@ -1596,43 +1596,43 @@
 
 	xor	r13,r10
 	ror	r14,5
-	xor	r15,rax
+	xor	r15,rax  ; f^g
 
 	mov	QWORD112+rsp,r12
 	xor	r14,rcx
-	and	r15,r10
+	and	r15,r10  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rbx
-	xor	r15,rax
+	add	r12,rbx  ; T1+=h
+	xor	r15,rax  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r10
-	add	r12,r15
+	add	r12,r15  ; T1+=Ch(e,f,g)
 
 	mov	r15,rcx
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rcx
 
-	xor	r15,rdx
-	ror	r13,14
+	xor	r15,rdx  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rbx,rdx
 
 	and	rdi,r15
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rbx,rdi
-	add	r9,r12
-	add	rbx,r12
+	xor	rbx,rdi  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r9,r12  ; d+=T1
+	add	rbx,r12  ; h+=T1
 
-	lea	rbp,8+rbp
+	lea	rbp,8+rbp  ; round++
 	mov	r13,QWORDrsp
 	mov	rdi,QWORD104+rsp
 
 	mov	r12,r13
 	ror	r13,7
-	add	rbx,r14
+	add	rbx,r14  ; modulo-scheduled h+=Sigma0(a)
 	mov	r14,rdi
 	ror	rdi,42
 
@@ -1643,8 +1643,8 @@
 	shr	r14,6
 
 	ror	rdi,19
-	xor	r12,r13
-	xor	rdi,r14
+	xor	r12,r13  ; sigma0(X(i+1)&0xf)
+	xor	rdi,r14  ; sigma1(X(i+14)&0xf)
 	add	r12,QWORD64+rsp
 
 	add	r12,QWORD120+rsp
@@ -1656,42 +1656,42 @@
 
 	xor	r13,r9
 	ror	r14,5
-	xor	rdi,r11
+	xor	rdi,r11  ; f^g
 
 	mov	QWORD120+rsp,r12
 	xor	r14,rbx
-	and	rdi,r9
+	and	rdi,r9  ; (f^g)&e
 
 	ror	r13,4
-	add	r12,rax
-	xor	rdi,r11
+	add	r12,rax  ; T1+=h
+	xor	rdi,r11  ; Ch(e,f,g)=((f^g)&e)^g
 
 	ror	r14,6
 	xor	r13,r9
-	add	r12,rdi
+	add	r12,rdi  ; T1+=Ch(e,f,g)
 
 	mov	rdi,rbx
-	add	r12,QWORDrbp
+	add	r12,QWORDrbp  ; T1+=Kround
 	xor	r14,rbx
 
-	xor	rdi,rcx
-	ror	r13,14
+	xor	rdi,rcx  ; a^b, b^c in next round
+	ror	r13,14  ; Sigma1(e)
 	mov	rax,rcx
 
 	and	r15,rdi
-	ror	r14,28
-	add	r12,r13
+	ror	r14,28  ; Sigma0(a)
+	add	r12,r13  ; T1+=Sigma1(e)
 
-	xor	rax,r15
-	add	r8,r12
-	add	rax,r12
+	xor	rax,r15  ; h=Maj(a,b,c)=Ch(a^b,c,b)
+	add	r8,r12  ; d+=T1
+	add	rax,r12  ; h+=T1
 
-	lea	rbp,24+rbp
+	lea	rbp,24+rbp  ; round++
 	cmp	BYTE7+rbp,0
 	jnz	NEAR $L$rounds_16_xx
 
 	mov	rdi,QWORD((128+0))+rsp
-	add	rax,r14
+	add	rax,r14  ; modulo-scheduled h+=Sigma0(a)
 	lea	rsi,128+rsi
 
 	add	rax,QWORDrdi
@@ -1829,7 +1829,7 @@
 	DB	52,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121
 	DB	32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46
 	DB	111,114,103,62,0
-section	.text
+section	.text code align=64
 
 global	sha512_block_data_order_avx
 
@@ -1846,7 +1846,7 @@
 
 
 _CET_ENDBR
-	mov	rax,rsp
+	mov	rax,rsp  ; copy %rsp
 
 	push	rbx
 
@@ -1860,14 +1860,14 @@
 
 	push	r15
 
-	shl	rdx,4
+	shl	rdx,4  ; num*16
 	sub	rsp,256
-	lea	rdx,rdx*8+rsi
-	and	rsp,-64
-	mov	QWORD((128+0))+rsp,rdi
-	mov	QWORD((128+8))+rsp,rsi
-	mov	QWORD((128+16))+rsp,rdx
-	mov	QWORD152+rsp,rax
+	lea	rdx,rdx*8+rsi  ; inp+num*16*8
+	and	rsp,-64  ; align stack frame
+	mov	QWORD((128+0))+rsp,rdi  ; save ctx, 1st arg
+	mov	QWORD((128+8))+rsp,rsi  ; save inp, 2nd arh
+	mov	QWORD((128+16))+rsp,rdx  ; save end pointer, "3rd" arg
+	mov	QWORD152+rsp,rax  ; save copy of %rsp
 
 	movaps	XMMWORD(128+32)+rsp,xmm6
 	movaps	XMMWORD(128+48)+rsp,xmm7
@@ -1891,7 +1891,7 @@
 $L$loop_avx:
 	vmovdqa	xmm11,XMMWORD((K512+1280))
 	vmovdqu	xmm0,XMMWORDrsi
-	lea	rbp,((K512+128))
+	lea	rbp,((K512+128))  ; size optimization
 	vmovdqu	xmm1,XMMWORD16+rsi
 	vmovdqu	xmm2,XMMWORD32+rsi
 	vpshufb	xmm0,xmm0,xmm11
@@ -1924,7 +1924,7 @@
 	vmovdqa	XMMWORD80+rsp,xmm9
 	mov	rdi,rbx
 	vmovdqa	XMMWORD96+rsp,xmm10
-	xor	rdi,rcx
+	xor	rdi,rcx  ; magic
 	vmovdqa	XMMWORD112+rsp,xmm11
 	mov	r13,r8
 	jmp	NEAR $L$avx_00_47
@@ -3035,25 +3035,25 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HanderlData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; prologue label
+	cmp	rbx,r10  ; context->Rip<prologue label
 	jb	NEAR $L$in_prologue
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$in_prologue
-	mov	rsi,rax
-	mov	rax,QWORD((128+24))+rax
+	mov	rsi,rax  ; put aside Rsp
+	mov	rax,QWORD((128+24))+rax  ; pull 152(%rsp)
 
 	mov	rbx,QWORD((-8))+rax
 	mov	rbp,QWORD((-16))+rax
@@ -3061,49 +3061,49 @@
 	mov	r13,QWORD((-32))+rax
 	mov	r14,QWORD((-40))+rax
 	mov	r15,QWORD((-48))+rax
-	mov	QWORD144+r8,rbx
-	mov	QWORD160+r8,rbp
-	mov	QWORD216+r8,r12
-	mov	QWORD224+r8,r13
-	mov	QWORD232+r8,r14
-	mov	QWORD240+r8,r15
+	mov	QWORD144+r8,rbx  ; restore context->Rbx
+	mov	QWORD160+r8,rbp  ; restore context->Rbp
+	mov	QWORD216+r8,r12  ; restore context->R12
+	mov	QWORD224+r8,r13  ; restore context->R13
+	mov	QWORD232+r8,r14  ; restore context->R14
+	mov	QWORD240+r8,r15  ; restore context->R15
 
 	lea	r10,$L$epilogue
 	cmp	rbx,r10
-	jb	NEAR $L$in_prologue
+	jb	NEAR $L$in_prologue  ; non-AVX code
 
-	lea	rsi,((128+32))+rsi
-	lea	rdi,512+r8
+	lea	rsi,((128+32))+rsi  ; Xmm6- save area
+	lea	rdi,512+r8  ; &context.Xmm6
 	mov	ecx,12
-	DD	0xa548f3fc
+	DD	0xa548f3fc  ; cld; rep movsq
 
 $L$in_prologue:
 	mov	rdi,QWORD8+rax
 	mov	rsi,QWORD16+rax
-	mov	QWORD152+r8,rax
-	mov	QWORD168+r8,rsi
-	mov	QWORD176+r8,rdi
+	mov	QWORD152+r8,rax  ; restore context->Rsp
+	mov	QWORD168+r8,rsi  ; restore context->Rsi
+	mov	QWORD176+r8,rdi  ; restore context->Rdi
 
-	mov	rdi,QWORD40+r9
-	mov	rsi,r8
-	mov	ecx,154
-	DD	0xa548f3fc
+	mov	rdi,QWORD40+r9  ; disp->ContextRecord
+	mov	rsi,r8  ; context
+	mov	ecx,154  ; sizeof(CONTEXT)
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	mov	rsi,r9
-	xor	rcx,rcx
-	mov	rdx,QWORD8+rsi
-	mov	r8,QWORDrsi
-	mov	r9,QWORD16+rsi
-	mov	r10,QWORD40+rsi
-	lea	r11,56+rsi
-	lea	r12,24+rsi
-	mov	QWORD32+rsp,r10
-	mov	QWORD40+rsp,r11
-	mov	QWORD48+rsp,r12
-	mov	QWORD56+rsp,rcx
+	xor	rcx,rcx  ; arg1, UNW_FLAG_NHANDLER
+	mov	rdx,QWORD8+rsi  ; arg2, disp->ImageBase
+	mov	r8,QWORDrsi  ; arg3, disp->ControlPc
+	mov	r9,QWORD16+rsi  ; arg4, disp->FunctionEntry
+	mov	r10,QWORD40+rsi  ; disp->ContextRecord
+	lea	r11,56+rsi  ; &disp->HandlerData
+	lea	r12,24+rsi  ; &disp->EstablisherFrame
+	mov	QWORD32+rsp,r10  ; arg5
+	mov	QWORD40+rsp,r11  ; arg6
+	mov	QWORD48+rsp,r12  ; arg7
+	mov	QWORD56+rsp,rcx  ; arg8, (NULL)
 	call	QWORD__imp_RtlVirtualUnwind
 
-	mov	eax,1
+	mov	eax,1  ; ExceptionContinueSearch
 	add	rsp,64
 	popfq
 	pop	r15
@@ -3129,11 +3129,11 @@
 $L$SEH_info_sha512_block_data_order_nohw:
 	DB	9,0,0,0
 	DD	se_handler wrt ..imagebase
-	DD	$L$prologue wrt ..imagebase,$L$epilogue wrt ..imagebase
+	DD	$L$prologue wrt ..imagebase,$L$epilogue wrt ..imagebase  ; HandlerData
 $L$SEH_info_sha512_block_data_order_avx:
 	DB	9,0,0,0
 	DD	se_handler wrt ..imagebase
-	DD	$L$prologue_avx wrt ..imagebase,$L$epilogue_avx wrt ..imagebase
+	DD	$L$prologue_avx wrt ..imagebase,$L$epilogue_avx wrt ..imagebase  ; HandlerData
 %else
 ; Work around https://bugzilla.nasm.us/show_bug.cgi?id=3392738
 ret

boringssl-0.20260708.tar.xz/gen/bcm/vpaes-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/vpaes-x86_64-apple.S Changed

@@ -6,21 +6,21 @@
 #if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && defined(__APPLE__)
 .text	
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+//  
+// _aes_encrypt_core 
+//  
+// AES-encrypt %xmm0. 
+//  
+// Inputs: 
+// %xmm0 = input 
+// %xmm9-%xmm15 as in _vpaes_preheat 
+// (%rdx) = scheduled keys 
+//  
+// Output in %xmm0 
+// Clobbers  %xmm1-%xmm5, %r9, %r10, %r11, %rax 
+// Preserves %xmm6 - %xmm8 so you get some local vectors 
+//  
+//  
 
 .p2align	4
 _vpaes_encrypt_core:
@@ -29,13 +29,13 @@
 	movq	$16,%r11
 	movl	240(%rdx),%eax
 	movdqa	%xmm9,%xmm1
-	movdqa	L$k_ipt(%rip),%xmm2
+	movdqa	L$k_ipt(%rip),%xmm2  // iptlo
 	pandn	%xmm0,%xmm1
-	movdqu	(%r9),%xmm5
+	movdqu	(%r9),%xmm5  // round0 key
 	psrld	$4,%xmm1
 	pand	%xmm9,%xmm0
 	pshufb	%xmm0,%xmm2
-	movdqa	L$k_ipt+16(%rip),%xmm0
+	movdqa	L$k_ipt+16(%rip),%xmm0  // ipthi
 	pshufb	%xmm1,%xmm0
 	pxor	%xmm5,%xmm2
 	addq	$16,%r9
@@ -45,98 +45,98 @@
 
 .p2align	4
 L$enc_loop:
-
-	movdqa	%xmm13,%xmm4
-	movdqa	%xmm12,%xmm0
-	pshufb	%xmm2,%xmm4
-	pshufb	%xmm3,%xmm0
-	pxor	%xmm5,%xmm4
-	movdqa	%xmm15,%xmm5
-	pxor	%xmm4,%xmm0
-	movdqa	-64(%r11,%r10,1),%xmm1
-	pshufb	%xmm2,%xmm5
-	movdqa	(%r11,%r10,1),%xmm4
-	movdqa	%xmm14,%xmm2
-	pshufb	%xmm3,%xmm2
-	movdqa	%xmm0,%xmm3
-	pxor	%xmm5,%xmm2
-	pshufb	%xmm1,%xmm0
-	addq	$16,%r9
-	pxor	%xmm2,%xmm0
-	pshufb	%xmm4,%xmm3
-	addq	$16,%r11
-	pxor	%xmm0,%xmm3
-	pshufb	%xmm1,%xmm0
-	andq	$0x30,%r11
-	subq	$1,%rax
-	pxor	%xmm3,%xmm0
+// middle of middle round
+	movdqa	%xmm13,%xmm4  // 4 : sb1u
+	movdqa	%xmm12,%xmm0  // 0 : sb1t
+	pshufb	%xmm2,%xmm4  // 4 = sb1u
+	pshufb	%xmm3,%xmm0  // 0 = sb1t
+	pxor	%xmm5,%xmm4  // 4 = sb1u + k
+	movdqa	%xmm15,%xmm5  // 4 : sb2u
+	pxor	%xmm4,%xmm0  // 0 = A
+	movdqa	-64(%r11,%r10,1),%xmm1  // .Lk_mc_forward
+	pshufb	%xmm2,%xmm5  // 4 = sb2u
+	movdqa	(%r11,%r10,1),%xmm4  // .Lk_mc_backward
+	movdqa	%xmm14,%xmm2  // 2 : sb2t
+	pshufb	%xmm3,%xmm2  // 2 = sb2t
+	movdqa	%xmm0,%xmm3  // 3 = A
+	pxor	%xmm5,%xmm2  // 2 = 2A
+	pshufb	%xmm1,%xmm0  // 0 = B
+	addq	$16,%r9  // next key
+	pxor	%xmm2,%xmm0  // 0 = 2A+B
+	pshufb	%xmm4,%xmm3  // 3 = D
+	addq	$16,%r11  // next mc
+	pxor	%xmm0,%xmm3  // 3 = 2A+B+D
+	pshufb	%xmm1,%xmm0  // 0 = 2B+C
+	andq	$0x30,%r11  // ... mod 4
+	subq	$1,%rax  // nr--
+	pxor	%xmm3,%xmm0  // 0 = 2A+3B+C+D
 
 L$enc_entry:
-
-	movdqa	%xmm9,%xmm1
-	movdqa	%xmm11,%xmm5
-	pandn	%xmm0,%xmm1
-	psrld	$4,%xmm1
-	pand	%xmm9,%xmm0
-	pshufb	%xmm0,%xmm5
-	movdqa	%xmm10,%xmm3
-	pxor	%xmm1,%xmm0
-	pshufb	%xmm1,%xmm3
-	movdqa	%xmm10,%xmm4
-	pxor	%xmm5,%xmm3
-	pshufb	%xmm0,%xmm4
-	movdqa	%xmm10,%xmm2
-	pxor	%xmm5,%xmm4
-	pshufb	%xmm3,%xmm2
-	movdqa	%xmm10,%xmm3
-	pxor	%xmm0,%xmm2
-	pshufb	%xmm4,%xmm3
+// top of round
+	movdqa	%xmm9,%xmm1  // 1 : i
+	movdqa	%xmm11,%xmm5  // 2 : a/k
+	pandn	%xmm0,%xmm1  // 1 = i<<4
+	psrld	$4,%xmm1  // 1 = i
+	pand	%xmm9,%xmm0  // 0 = k
+	pshufb	%xmm0,%xmm5  // 2 = a/k
+	movdqa	%xmm10,%xmm3  // 3 : 1/i
+	pxor	%xmm1,%xmm0  // 0 = j
+	pshufb	%xmm1,%xmm3  // 3 = 1/i
+	movdqa	%xmm10,%xmm4  // 4 : 1/j
+	pxor	%xmm5,%xmm3  // 3 = iak = 1/i + a/k
+	pshufb	%xmm0,%xmm4  // 4 = 1/j
+	movdqa	%xmm10,%xmm2  // 2 : 1/iak
+	pxor	%xmm5,%xmm4  // 4 = jak = 1/j + a/k
+	pshufb	%xmm3,%xmm2  // 2 = 1/iak
+	movdqa	%xmm10,%xmm3  // 3 : 1/jak
+	pxor	%xmm0,%xmm2  // 2 = io
+	pshufb	%xmm4,%xmm3  // 3 = 1/jak
 	movdqu	(%r9),%xmm5
-	pxor	%xmm1,%xmm3
+	pxor	%xmm1,%xmm3  // 3 = jo
 	jnz	L$enc_loop
 
-
-	movdqa	-96(%r10),%xmm4
-	movdqa	-80(%r10),%xmm0
-	pshufb	%xmm2,%xmm4
-	pxor	%xmm5,%xmm4
-	pshufb	%xmm3,%xmm0
-	movdqa	64(%r11,%r10,1),%xmm1
-	pxor	%xmm4,%xmm0
+// middle of last round
+	movdqa	-96(%r10),%xmm4  // 3 : sbou	.Lk_sbo
+	movdqa	-80(%r10),%xmm0  // 0 : sbot	.Lk_sbo+16
+	pshufb	%xmm2,%xmm4  // 4 = sbou
+	pxor	%xmm5,%xmm4  // 4 = sb1u + k
+	pshufb	%xmm3,%xmm0  // 0 = sb1t
+	movdqa	64(%r11,%r10,1),%xmm1  // .Lk_sr
+	pxor	%xmm4,%xmm0  // 0 = A
 	pshufb	%xmm1,%xmm0
 	ret
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+//  
+// _aes_encrypt_core_2x 
+//  
+// AES-encrypt %xmm0 and %xmm6 in parallel. 
+//  
+// Inputs: 
+// %xmm0 and %xmm6 = input 
+// %xmm9 and %xmm10 as in _vpaes_preheat 
+// (%rdx) = scheduled keys 
+//  
+// Output in %xmm0 and %xmm6 
+// Clobbers  %xmm1-%xmm5, %xmm7, %xmm8, %xmm11-%xmm13, %r9, %r10, %r11, %rax 
+// Preserves %xmm14 and %xmm15 
+//  
+// This function stitches two parallel instances of _vpaes_encrypt_core. x86_64 
+// provides 16 XMM registers. _vpaes_encrypt_core computes over six registers 
+// (%xmm0-%xmm5) and additionally uses seven registers with preloaded constants 
+// from _vpaes_preheat (%xmm9-%xmm15). This does not quite fit two instances, 
+// so we spill some of %xmm9 through %xmm15 back to memory. We keep %xmm9 and 
+// %xmm10 in registers as these values are used several times in a row. The 
+// remainder are read once per round and are spilled to memory. This leaves two 
+// registers preserved for the caller. 
+//  
+// Thus, of the two _vpaes_encrypt_core instances, the first uses (%xmm0-%xmm5) 
+// as before. The second uses %xmm6-%xmm8,%xmm11-%xmm13. (Add 6 to %xmm2 and 
+// below. Add 8 to %xmm3 and up.) Instructions in the second instance are 
+// indented by one space. 
+//  
+//  
 
 .p2align	4
 .alt_entry _vpaes_encrypt_core_2x
@@ -147,19 +147,19 @@
 	movl	240(%rdx),%eax
 	movdqa	%xmm9,%xmm1
 	movdqa	%xmm9,%xmm7
-	movdqa	L$k_ipt(%rip),%xmm2
+	movdqa	L$k_ipt(%rip),%xmm2  // iptlo
 	movdqa	%xmm2,%xmm8
 	pandn	%xmm0,%xmm1
 	pandn	%xmm6,%xmm7
-	movdqu	(%r9),%xmm5
-
+	movdqu	(%r9),%xmm5  // round0 key
+// Also use %xmm5 in the second instance.
 	psrld	$4,%xmm1
 	psrld	$4,%xmm7
 	pand	%xmm9,%xmm0
 	pand	%xmm9,%xmm6
 	pshufb	%xmm0,%xmm2
 	pshufb	%xmm6,%xmm8
-	movdqa	L$k_ipt+16(%rip),%xmm0
+	movdqa	L$k_ipt+16(%rip),%xmm0  // ipthi
 	movdqa	%xmm0,%xmm6
 	pshufb	%xmm1,%xmm0
 	pshufb	%xmm7,%xmm6
@@ -173,110 +173,110 @@
 
 .p2align	4
 L$enc2x_loop:
-
-	movdqa	L$k_sb1(%rip),%xmm4
-	movdqa	L$k_sb1+16(%rip),%xmm0
+// middle of middle round
+	movdqa	L$k_sb1(%rip),%xmm4  // 4 : sb1u
+	movdqa	L$k_sb1+16(%rip),%xmm0  // 0 : sb1t
 	movdqa	%xmm4,%xmm12
 	movdqa	%xmm0,%xmm6
-	pshufb	%xmm2,%xmm4
+	pshufb	%xmm2,%xmm4  // 4 = sb1u
 	pshufb	%xmm8,%xmm12
-	pshufb	%xmm3,%xmm0
+	pshufb	%xmm3,%xmm0  // 0 = sb1t
 	pshufb	%xmm11,%xmm6
-	pxor	%xmm5,%xmm4
+	pxor	%xmm5,%xmm4  // 4 = sb1u + k
 	pxor	%xmm5,%xmm12
-	movdqa	L$k_sb2(%rip),%xmm5
+	movdqa	L$k_sb2(%rip),%xmm5  // 4 : sb2u
 	movdqa	%xmm5,%xmm13
-	pxor	%xmm4,%xmm0
+	pxor	%xmm4,%xmm0  // 0 = A
 	pxor	%xmm12,%xmm6
-	movdqa	-64(%r11,%r10,1),%xmm1
-
-	pshufb	%xmm2,%xmm5
+	movdqa	-64(%r11,%r10,1),%xmm1  // .Lk_mc_forward
+// Also use %xmm1 in the second instance.
+	pshufb	%xmm2,%xmm5  // 4 = sb2u
 	pshufb	%xmm8,%xmm13
-	movdqa	(%r11,%r10,1),%xmm4
-
-	movdqa	L$k_sb2+16(%rip),%xmm2
+	movdqa	(%r11,%r10,1),%xmm4  // .Lk_mc_backward
+// Also use %xmm4 in the second instance.
+	movdqa	L$k_sb2+16(%rip),%xmm2  // 2 : sb2t
 	movdqa	%xmm2,%xmm8
-	pshufb	%xmm3,%xmm2
+	pshufb	%xmm3,%xmm2  // 2 = sb2t
 	pshufb	%xmm11,%xmm8
-	movdqa	%xmm0,%xmm3
+	movdqa	%xmm0,%xmm3  // 3 = A
 	movdqa	%xmm6,%xmm11
-	pxor	%xmm5,%xmm2
+	pxor	%xmm5,%xmm2  // 2 = 2A
 	pxor	%xmm13,%xmm8
-	pshufb	%xmm1,%xmm0
+	pshufb	%xmm1,%xmm0  // 0 = B
 	pshufb	%xmm1,%xmm6
-	addq	$16,%r9
-	pxor	%xmm2,%xmm0
+	addq	$16,%r9  // next key
+	pxor	%xmm2,%xmm0  // 0 = 2A+B
 	pxor	%xmm8,%xmm6
-	pshufb	%xmm4,%xmm3
+	pshufb	%xmm4,%xmm3  // 3 = D
 	pshufb	%xmm4,%xmm11
-	addq	$16,%r11
-	pxor	%xmm0,%xmm3
+	addq	$16,%r11  // next mc
+	pxor	%xmm0,%xmm3  // 3 = 2A+B+D
 	pxor	%xmm6,%xmm11
-	pshufb	%xmm1,%xmm0
+	pshufb	%xmm1,%xmm0  // 0 = 2B+C
 	pshufb	%xmm1,%xmm6
-	andq	$0x30,%r11
-	subq	$1,%rax
-	pxor	%xmm3,%xmm0
+	andq	$0x30,%r11  // ... mod 4
+	subq	$1,%rax  // nr--
+	pxor	%xmm3,%xmm0  // 0 = 2A+3B+C+D
 	pxor	%xmm11,%xmm6
 
 L$enc2x_entry:
-
-	movdqa	%xmm9,%xmm1
+// top of round
+	movdqa	%xmm9,%xmm1  // 1 : i
 	movdqa	%xmm9,%xmm7
-	movdqa	L$k_inv+16(%rip),%xmm5
+	movdqa	L$k_inv+16(%rip),%xmm5  // 2 : a/k
 	movdqa	%xmm5,%xmm13
-	pandn	%xmm0,%xmm1
+	pandn	%xmm0,%xmm1  // 1 = i<<4
 	pandn	%xmm6,%xmm7
-	psrld	$4,%xmm1
+	psrld	$4,%xmm1  // 1 = i
 	psrld	$4,%xmm7
-	pand	%xmm9,%xmm0
+	pand	%xmm9,%xmm0  // 0 = k
 	pand	%xmm9,%xmm6
-	pshufb	%xmm0,%xmm5
+	pshufb	%xmm0,%xmm5  // 2 = a/k
 	pshufb	%xmm6,%xmm13
-	movdqa	%xmm10,%xmm3
+	movdqa	%xmm10,%xmm3  // 3 : 1/i
 	movdqa	%xmm10,%xmm11
-	pxor	%xmm1,%xmm0
+	pxor	%xmm1,%xmm0  // 0 = j
 	pxor	%xmm7,%xmm6
-	pshufb	%xmm1,%xmm3
+	pshufb	%xmm1,%xmm3  // 3 = 1/i
 	pshufb	%xmm7,%xmm11
-	movdqa	%xmm10,%xmm4
+	movdqa	%xmm10,%xmm4  // 4 : 1/j
 	movdqa	%xmm10,%xmm12
-	pxor	%xmm5,%xmm3
+	pxor	%xmm5,%xmm3  // 3 = iak = 1/i + a/k
 	pxor	%xmm13,%xmm11
-	pshufb	%xmm0,%xmm4
+	pshufb	%xmm0,%xmm4  // 4 = 1/j
 	pshufb	%xmm6,%xmm12
-	movdqa	%xmm10,%xmm2
+	movdqa	%xmm10,%xmm2  // 2 : 1/iak
 	movdqa	%xmm10,%xmm8
-	pxor	%xmm5,%xmm4
+	pxor	%xmm5,%xmm4  // 4 = jak = 1/j + a/k
 	pxor	%xmm13,%xmm12
-	pshufb	%xmm3,%xmm2
+	pshufb	%xmm3,%xmm2  // 2 = 1/iak
 	pshufb	%xmm11,%xmm8
-	movdqa	%xmm10,%xmm3
+	movdqa	%xmm10,%xmm3  // 3 : 1/jak
 	movdqa	%xmm10,%xmm11
-	pxor	%xmm0,%xmm2
+	pxor	%xmm0,%xmm2  // 2 = io
 	pxor	%xmm6,%xmm8
-	pshufb	%xmm4,%xmm3
+	pshufb	%xmm4,%xmm3  // 3 = 1/jak
 	pshufb	%xmm12,%xmm11
 	movdqu	(%r9),%xmm5
-
-	pxor	%xmm1,%xmm3
+// Also use %xmm5 in the second instance.
+	pxor	%xmm1,%xmm3  // 3 = jo
 	pxor	%xmm7,%xmm11
 	jnz	L$enc2x_loop
 
-
-	movdqa	-96(%r10),%xmm4
-	movdqa	-80(%r10),%xmm0
+// middle of last round
+	movdqa	-96(%r10),%xmm4  // 3 : sbou	.Lk_sbo
+	movdqa	-80(%r10),%xmm0  // 0 : sbot	.Lk_sbo+16
 	movdqa	%xmm4,%xmm12
 	movdqa	%xmm0,%xmm6
-	pshufb	%xmm2,%xmm4
+	pshufb	%xmm2,%xmm4  // 4 = sbou
 	pshufb	%xmm8,%xmm12
-	pxor	%xmm5,%xmm4
+	pxor	%xmm5,%xmm4  // 4 = sb1u + k
 	pxor	%xmm5,%xmm12
-	pshufb	%xmm3,%xmm0
+	pshufb	%xmm3,%xmm0  // 0 = sb1t
 	pshufb	%xmm11,%xmm6
-	movdqa	64(%r11,%r10,1),%xmm1
-
-	pxor	%xmm4,%xmm0
+	movdqa	64(%r11,%r10,1),%xmm1  // .Lk_sr
+// Also use %xmm1 in the second instance.
+	pxor	%xmm4,%xmm0  // 0 = A
 	pxor	%xmm12,%xmm6
 	pshufb	%xmm1,%xmm0
 	pshufb	%xmm1,%xmm6
@@ -284,28 +284,28 @@
 
 
 
-
-
-
-
-
+//  
+// Decryption core 
+//  
+// Same API as encryption core. 
+//  
 
 .p2align	4
 .alt_entry _vpaes_decrypt_core
 _vpaes_decrypt_core:
 
-	movq	%rdx,%r9
+	movq	%rdx,%r9  // load key
 	movl	240(%rdx),%eax
 	movdqa	%xmm9,%xmm1
-	movdqa	L$k_dipt(%rip),%xmm2
+	movdqa	L$k_dipt(%rip),%xmm2  // iptlo
 	pandn	%xmm0,%xmm1
 	movq	%rax,%r11
 	psrld	$4,%xmm1
-	movdqu	(%r9),%xmm5
+	movdqu	(%r9),%xmm5  // round0 key
 	shlq	$4,%r11
 	pand	%xmm9,%xmm0
 	pshufb	%xmm0,%xmm2
-	movdqa	L$k_dipt+16(%rip),%xmm0
+	movdqa	L$k_dipt+16(%rip),%xmm0  // ipthi
 	xorq	$0x30,%r11
 	leaq	L$k_dsbd(%rip),%r10
 	pshufb	%xmm1,%xmm0
@@ -319,100 +319,100 @@
 
 .p2align	4
 L$dec_loop:
-
-
-
-	movdqa	-32(%r10),%xmm4
-	movdqa	-16(%r10),%xmm1
-	pshufb	%xmm2,%xmm4
-	pshufb	%xmm3,%xmm1
+//  
+// Inverse mix columns 
+//  
+	movdqa	-32(%r10),%xmm4  // 4 : sb9u
+	movdqa	-16(%r10),%xmm1  // 0 : sb9t
+	pshufb	%xmm2,%xmm4  // 4 = sb9u
+	pshufb	%xmm3,%xmm1  // 0 = sb9t
 	pxor	%xmm4,%xmm0
-	movdqa	0(%r10),%xmm4
-	pxor	%xmm1,%xmm0
-	movdqa	16(%r10),%xmm1
-
-	pshufb	%xmm2,%xmm4
-	pshufb	%xmm5,%xmm0
-	pshufb	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-	movdqa	32(%r10),%xmm4
-	pxor	%xmm1,%xmm0
-	movdqa	48(%r10),%xmm1
-
-	pshufb	%xmm2,%xmm4
-	pshufb	%xmm5,%xmm0
-	pshufb	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-	movdqa	64(%r10),%xmm4
-	pxor	%xmm1,%xmm0
-	movdqa	80(%r10),%xmm1
-
-	pshufb	%xmm2,%xmm4
-	pshufb	%xmm5,%xmm0
-	pshufb	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-	addq	$16,%r9
+	movdqa	0(%r10),%xmm4  // 4 : sbdu
+	pxor	%xmm1,%xmm0  // 0 = ch
+	movdqa	16(%r10),%xmm1  // 0 : sbdt
+
+	pshufb	%xmm2,%xmm4  // 4 = sbdu
+	pshufb	%xmm5,%xmm0  // MC ch
+	pshufb	%xmm3,%xmm1  // 0 = sbdt
+	pxor	%xmm4,%xmm0  // 4 = ch
+	movdqa	32(%r10),%xmm4  // 4 : sbbu
+	pxor	%xmm1,%xmm0  // 0 = ch
+	movdqa	48(%r10),%xmm1  // 0 : sbbt
+
+	pshufb	%xmm2,%xmm4  // 4 = sbbu
+	pshufb	%xmm5,%xmm0  // MC ch
+	pshufb	%xmm3,%xmm1  // 0 = sbbt
+	pxor	%xmm4,%xmm0  // 4 = ch
+	movdqa	64(%r10),%xmm4  // 4 : sbeu
+	pxor	%xmm1,%xmm0  // 0 = ch
+	movdqa	80(%r10),%xmm1  // 0 : sbet
+
+	pshufb	%xmm2,%xmm4  // 4 = sbeu
+	pshufb	%xmm5,%xmm0  // MC ch
+	pshufb	%xmm3,%xmm1  // 0 = sbet
+	pxor	%xmm4,%xmm0  // 4 = ch
+	addq	$16,%r9  // next round key
 	palignr	$12,%xmm5,%xmm5
-	pxor	%xmm1,%xmm0
-	subq	$1,%rax
+	pxor	%xmm1,%xmm0  // 0 = ch
+	subq	$1,%rax  // nr--
 
 L$dec_entry:
-
-	movdqa	%xmm9,%xmm1
-	pandn	%xmm0,%xmm1
-	movdqa	%xmm11,%xmm2
-	psrld	$4,%xmm1
-	pand	%xmm9,%xmm0
-	pshufb	%xmm0,%xmm2
-	movdqa	%xmm10,%xmm3
-	pxor	%xmm1,%xmm0
-	pshufb	%xmm1,%xmm3
-	movdqa	%xmm10,%xmm4
-	pxor	%xmm2,%xmm3
-	pshufb	%xmm0,%xmm4
-	pxor	%xmm2,%xmm4
-	movdqa	%xmm10,%xmm2
-	pshufb	%xmm3,%xmm2
-	movdqa	%xmm10,%xmm3
-	pxor	%xmm0,%xmm2
-	pshufb	%xmm4,%xmm3
+// top of round
+	movdqa	%xmm9,%xmm1  // 1 : i
+	pandn	%xmm0,%xmm1  // 1 = i<<4
+	movdqa	%xmm11,%xmm2  // 2 : a/k
+	psrld	$4,%xmm1  // 1 = i
+	pand	%xmm9,%xmm0  // 0 = k
+	pshufb	%xmm0,%xmm2  // 2 = a/k
+	movdqa	%xmm10,%xmm3  // 3 : 1/i
+	pxor	%xmm1,%xmm0  // 0 = j
+	pshufb	%xmm1,%xmm3  // 3 = 1/i
+	movdqa	%xmm10,%xmm4  // 4 : 1/j
+	pxor	%xmm2,%xmm3  // 3 = iak = 1/i + a/k
+	pshufb	%xmm0,%xmm4  // 4 = 1/j
+	pxor	%xmm2,%xmm4  // 4 = jak = 1/j + a/k
+	movdqa	%xmm10,%xmm2  // 2 : 1/iak
+	pshufb	%xmm3,%xmm2  // 2 = 1/iak
+	movdqa	%xmm10,%xmm3  // 3 : 1/jak
+	pxor	%xmm0,%xmm2  // 2 = io
+	pshufb	%xmm4,%xmm3  // 3 = 1/jak
 	movdqu	(%r9),%xmm0
-	pxor	%xmm1,%xmm3
+	pxor	%xmm1,%xmm3  // 3 = jo
 	jnz	L$dec_loop
 
-
-	movdqa	96(%r10),%xmm4
-	pshufb	%xmm2,%xmm4
-	pxor	%xmm0,%xmm4
-	movdqa	112(%r10),%xmm0
-	movdqa	-352(%r11),%xmm2
-	pshufb	%xmm3,%xmm0
-	pxor	%xmm4,%xmm0
+// middle of last round
+	movdqa	96(%r10),%xmm4  // 3 : sbou
+	pshufb	%xmm2,%xmm4  // 4 = sbou
+	pxor	%xmm0,%xmm4  // 4 = sb1u + k
+	movdqa	112(%r10),%xmm0  // 0 : sbot
+	movdqa	-352(%r11),%xmm2  // .Lk_sr-.Lk_dsbd=-0x160
+	pshufb	%xmm3,%xmm0  // 0 = sb1t
+	pxor	%xmm4,%xmm0  // 0 = A
 	pshufb	%xmm2,%xmm0
 	ret
 
 
 
-
-
-
-
-
+// ###################################################### 
+// ## 
+// AES key schedule                  ## 
+// ## 
+// ###################################################### 
 
 .p2align	4
 .alt_entry _vpaes_schedule_core
 _vpaes_schedule_core:
 
+// rdi = key
+// rsi = size in bits
+// rdx = buffer
+// rcx = direction.  0=encrypt, 1=decrypt
 
+	call	_vpaes_preheat  // load the tables
+	movdqa	L$k_rcon(%rip),%xmm8  // load rcon
+	movdqu	(%rdi),%xmm0  // load key (unaligned)
 
-
-
-
-	call	_vpaes_preheat
-	movdqa	L$k_rcon(%rip),%xmm8
-	movdqu	(%rdi),%xmm0
-
-
+// input transform
 	movdqa	%xmm0,%xmm3
 	leaq	L$k_ipt(%rip),%r11
 	call	_vpaes_schedule_transform
@@ -422,12 +422,12 @@
 	testq	%rcx,%rcx
 	jnz	L$schedule_am_decrypting
 
-
+// encrypting, output zeroth round key after transform
 	movdqu	%xmm0,(%rdx)
 	jmp	L$schedule_go
 
 L$schedule_am_decrypting:
-
+// decrypting, output zeroth round key after shiftrows
 	movdqa	(%r8,%r10,1),%xmm1
 	pshufb	%xmm1,%xmm3
 	movdqu	%xmm3,(%rdx)
@@ -437,16 +437,16 @@
 	cmpl	$192,%esi
 	ja	L$schedule_256
 	je	L$schedule_192
-
-
-
-
-
-
-
-
-
-
+// 128: fall though
+
+//  
+// .schedule_128 
+//  
+// 128-bit specific part of key schedule. 
+//  
+// This schedule is really simple, because all its parts 
+// are accomplished by the subroutines. 
+//  
 L$schedule_128:
 	movl	$10,%esi
 
@@ -454,73 +454,73 @@
 	call	_vpaes_schedule_round
 	decq	%rsi
 	jz	L$schedule_mangle_last
-	call	_vpaes_schedule_mangle
+	call	_vpaes_schedule_mangle  // write output
 	jmp	L$oop_schedule_128
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_192 
+//  
+// 192-bit specific part of key schedule. 
+//  
+// The main body of this schedule is the same as the 128-bit 
+// schedule, but with more smearing.  The long, high side is 
+// stored in %xmm7 as before, and the short, low side is in 
+// the high bits of %xmm6. 
+//  
+// This schedule is somewhat nastier, however, because each 
+// round produces 192 bits of key material, or 1.5 round keys. 
+// Therefore, on each cycle we do 2 rounds and produce 3 round 
+// keys. 
+//  
 .p2align	4
 L$schedule_192:
-	movdqu	8(%rdi),%xmm0
-	call	_vpaes_schedule_transform
-	movdqa	%xmm0,%xmm6
-	pxor	%xmm4,%xmm4
-	movhlps	%xmm4,%xmm6
+	movdqu	8(%rdi),%xmm0  // load key part 2 (very unaligned)
+	call	_vpaes_schedule_transform  // input transform
+	movdqa	%xmm0,%xmm6  // save short part
+	pxor	%xmm4,%xmm4  // clear 4
+	movhlps	%xmm4,%xmm6  // clobber low side with zeros
 	movl	$4,%esi
 
 L$oop_schedule_192:
 	call	_vpaes_schedule_round
 	palignr	$8,%xmm6,%xmm0
-	call	_vpaes_schedule_mangle
+	call	_vpaes_schedule_mangle  // save key n
 	call	_vpaes_schedule_192_smear
-	call	_vpaes_schedule_mangle
+	call	_vpaes_schedule_mangle  // save key n+1
 	call	_vpaes_schedule_round
 	decq	%rsi
 	jz	L$schedule_mangle_last
-	call	_vpaes_schedule_mangle
+	call	_vpaes_schedule_mangle  // save key n+2
 	call	_vpaes_schedule_192_smear
 	jmp	L$oop_schedule_192
 
-
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_256 
+//  
+// 256-bit specific part of key schedule. 
+//  
+// The structure here is very similar to the 128-bit 
+// schedule, but with an additional "low side" in 
+// %xmm6.  The low side's rounds are the same as the 
+// high side's, except no rcon and no rotation. 
+//  
 .p2align	4
 L$schedule_256:
-	movdqu	16(%rdi),%xmm0
-	call	_vpaes_schedule_transform
+	movdqu	16(%rdi),%xmm0  // load key part 2 (unaligned)
+	call	_vpaes_schedule_transform  // input transform
 	movl	$7,%esi
 
 L$oop_schedule_256:
-	call	_vpaes_schedule_mangle
-	movdqa	%xmm0,%xmm6
-
+	call	_vpaes_schedule_mangle  // output low result
+	movdqa	%xmm0,%xmm6  // save cur_lo in xmm6
 
+// high round
 	call	_vpaes_schedule_round
 	decq	%rsi
 	jz	L$schedule_mangle_last
 	call	_vpaes_schedule_mangle
 
-
+// low round. swap xmm7 and xmm6
 	pshufd	$0xFF,%xmm0,%xmm0
 	movdqa	%xmm7,%xmm5
 	movdqa	%xmm6,%xmm7
@@ -530,36 +530,36 @@
 	jmp	L$oop_schedule_256
 
 
-
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_mangle_last 
+//  
+// Mangler for last round of key schedule 
+// Mangles %xmm0 
+// when encrypting, outputs out(%xmm0) ^ 63 
+// when decrypting, outputs unskew(%xmm0) 
+//  
+// Always called right before return... jumps to cleanup and exits 
+//  
 .p2align	4
 L$schedule_mangle_last:
-
-	leaq	L$k_deskew(%rip),%r11
+// schedule last round key from xmm0
+	leaq	L$k_deskew(%rip),%r11  // prepare to deskew
 	testq	%rcx,%rcx
 	jnz	L$schedule_mangle_last_dec
 
-
+// encrypting
 	movdqa	(%r8,%r10,1),%xmm1
-	pshufb	%xmm1,%xmm0
-	leaq	L$k_opt(%rip),%r11
+	pshufb	%xmm1,%xmm0  // output permute
+	leaq	L$k_opt(%rip),%r11  // prepare to output transform
 	addq	$32,%rdx
 
 L$schedule_mangle_last_dec:
 	addq	$-16,%rdx
 	pxor	L$k_s63(%rip),%xmm0
-	call	_vpaes_schedule_transform
-	movdqu	%xmm0,(%rdx)
-
+	call	_vpaes_schedule_transform  // output transform
+	movdqu	%xmm0,(%rdx)  // save last key
 
+// cleanup
 	pxor	%xmm0,%xmm0
 	pxor	%xmm1,%xmm1
 	pxor	%xmm2,%xmm2
@@ -572,75 +572,75 @@
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_192_smear 
+//  
+// Smear the short, low side in the 192-bit key schedule. 
+//  
+// Inputs: 
+// %xmm7: high side, b  a  x  y 
+// %xmm6:  low side, d  c  0  0 
+// %xmm13: 0 
+//  
+// Outputs: 
+// %xmm6: b+c+d  b+c  0  0 
+// %xmm0: b+c+d  b+c  b  a 
+//  
 
 .p2align	4
 .alt_entry _vpaes_schedule_192_smear
 _vpaes_schedule_192_smear:
 
-	pshufd	$0x80,%xmm6,%xmm1
-	pshufd	$0xFE,%xmm7,%xmm0
-	pxor	%xmm1,%xmm6
+	pshufd	$0x80,%xmm6,%xmm1  // d c 0 0 -> c 0 0 0
+	pshufd	$0xFE,%xmm7,%xmm0  // b a _ _ -> b b b a
+	pxor	%xmm1,%xmm6  // -> c+d c 0 0
 	pxor	%xmm1,%xmm1
-	pxor	%xmm0,%xmm6
+	pxor	%xmm0,%xmm6  // -> b+c+d b+c b a
 	movdqa	%xmm6,%xmm0
-	movhlps	%xmm1,%xmm6
+	movhlps	%xmm1,%xmm6  // clobber low side with zeros
 	ret
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_round 
+//  
+// Runs one main round of the key schedule on %xmm0, %xmm7 
+//  
+// Specifically, runs subbytes on the high dword of %xmm0 
+// then rotates it by one byte and xors into the low dword of 
+// %xmm7. 
+//  
+// Adds rcon from low byte of %xmm8, then rotates %xmm8 for 
+// next rcon. 
+//  
+// Smears the dwords of %xmm7 by xoring the low into the 
+// second low, result into third, result into highest. 
+//  
+// Returns results in %xmm7 = %xmm0. 
+// Clobbers %xmm1-%xmm4, %r11. 
+//  
 
 .p2align	4
 .alt_entry _vpaes_schedule_round
 _vpaes_schedule_round:
 
-
+// extract rcon from xmm8
 	pxor	%xmm1,%xmm1
 	palignr	$15,%xmm8,%xmm1
 	palignr	$15,%xmm8,%xmm8
 	pxor	%xmm1,%xmm7
 
-
+// rotate
 	pshufd	$0xFF,%xmm0,%xmm0
 	palignr	$1,%xmm0,%xmm0
 
+// fall through...
 
-
-
+// low round: same as high round, but no rotation and no rcon.
 .alt_entry _vpaes_schedule_low_round
 _vpaes_schedule_low_round:
-
+// smear xmm7
 	movdqa	%xmm7,%xmm1
 	pslldq	$4,%xmm7
 	pxor	%xmm1,%xmm7
@@ -649,48 +649,48 @@
 	pxor	%xmm1,%xmm7
 	pxor	L$k_s63(%rip),%xmm7
 
-
+// subbytes
 	movdqa	%xmm9,%xmm1
 	pandn	%xmm0,%xmm1
-	psrld	$4,%xmm1
-	pand	%xmm9,%xmm0
-	movdqa	%xmm11,%xmm2
-	pshufb	%xmm0,%xmm2
-	pxor	%xmm1,%xmm0
-	movdqa	%xmm10,%xmm3
-	pshufb	%xmm1,%xmm3
-	pxor	%xmm2,%xmm3
-	movdqa	%xmm10,%xmm4
-	pshufb	%xmm0,%xmm4
-	pxor	%xmm2,%xmm4
-	movdqa	%xmm10,%xmm2
-	pshufb	%xmm3,%xmm2
-	pxor	%xmm0,%xmm2
-	movdqa	%xmm10,%xmm3
-	pshufb	%xmm4,%xmm3
-	pxor	%xmm1,%xmm3
-	movdqa	%xmm13,%xmm4
-	pshufb	%xmm2,%xmm4
-	movdqa	%xmm12,%xmm0
-	pshufb	%xmm3,%xmm0
-	pxor	%xmm4,%xmm0
-
-
+	psrld	$4,%xmm1  // 1 = i
+	pand	%xmm9,%xmm0  // 0 = k
+	movdqa	%xmm11,%xmm2  // 2 : a/k
+	pshufb	%xmm0,%xmm2  // 2 = a/k
+	pxor	%xmm1,%xmm0  // 0 = j
+	movdqa	%xmm10,%xmm3  // 3 : 1/i
+	pshufb	%xmm1,%xmm3  // 3 = 1/i
+	pxor	%xmm2,%xmm3  // 3 = iak = 1/i + a/k
+	movdqa	%xmm10,%xmm4  // 4 : 1/j
+	pshufb	%xmm0,%xmm4  // 4 = 1/j
+	pxor	%xmm2,%xmm4  // 4 = jak = 1/j + a/k
+	movdqa	%xmm10,%xmm2  // 2 : 1/iak
+	pshufb	%xmm3,%xmm2  // 2 = 1/iak
+	pxor	%xmm0,%xmm2  // 2 = io
+	movdqa	%xmm10,%xmm3  // 3 : 1/jak
+	pshufb	%xmm4,%xmm3  // 3 = 1/jak
+	pxor	%xmm1,%xmm3  // 3 = jo
+	movdqa	%xmm13,%xmm4  // 4 : sbou
+	pshufb	%xmm2,%xmm4  // 4 = sbou
+	movdqa	%xmm12,%xmm0  // 0 : sbot
+	pshufb	%xmm3,%xmm0  // 0 = sb1t
+	pxor	%xmm4,%xmm0  // 0 = sbox output
+
+// add in smeared stuff
 	pxor	%xmm7,%xmm0
 	movdqa	%xmm0,%xmm7
 	ret
 
 
 
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_transform 
+//  
+// Linear-transform %xmm0 according to tables at (%r11) 
+//  
+// Requires that %xmm9 = 0x0F0F... as in preheat 
+// Output in %xmm0 
+// Clobbers %xmm1, %xmm2 
+//  
 
 .p2align	4
 .alt_entry _vpaes_schedule_transform
@@ -700,49 +700,49 @@
 	pandn	%xmm0,%xmm1
 	psrld	$4,%xmm1
 	pand	%xmm9,%xmm0
-	movdqa	(%r11),%xmm2
+	movdqa	(%r11),%xmm2  // lo
 	pshufb	%xmm0,%xmm2
-	movdqa	16(%r11),%xmm0
+	movdqa	16(%r11),%xmm0  // hi
 	pshufb	%xmm1,%xmm0
 	pxor	%xmm2,%xmm0
 	ret
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_mangle 
+//  
+// Mangle xmm0 from (basis-transformed) standard version 
+// to our version. 
+//  
+// On encrypt, 
+// xor with 0x63 
+// multiply by circulant 0,1,1,1 
+// apply shiftrows transform 
+//  
+// On decrypt, 
+// xor with 0x63 
+// multiply by "inverse mixcolumns" circulant E,B,D,9 
+// deskew 
+// apply shiftrows transform 
+//  
+//  
+// Writes out to (%rdx), and increments or decrements it 
+// Keeps track of round number mod 4 in %r8 
+// Preserves xmm0 
+// Clobbers xmm1-xmm5 
+//  
 
 .p2align	4
 .alt_entry _vpaes_schedule_mangle
 _vpaes_schedule_mangle:
 
-	movdqa	%xmm0,%xmm4
+	movdqa	%xmm0,%xmm4  // save xmm0 for later
 	movdqa	L$k_mc_forward(%rip),%xmm5
 	testq	%rcx,%rcx
 	jnz	L$schedule_mangle_dec
 
-
+// encrypting
 	addq	$16,%rdx
 	pxor	L$k_s63(%rip),%xmm4
 	pshufb	%xmm5,%xmm4
@@ -755,12 +755,12 @@
 	jmp	L$schedule_mangle_both
 .p2align	4
 L$schedule_mangle_dec:
-
+// inverse mix columns
 	leaq	L$k_dksd(%rip),%r11
 	movdqa	%xmm9,%xmm1
 	pandn	%xmm4,%xmm1
-	psrld	$4,%xmm1
-	pand	%xmm9,%xmm4
+	psrld	$4,%xmm1  // 1 = hi
+	pand	%xmm9,%xmm4  // 4 = lo
 
 	movdqa	0(%r11),%xmm2
 	pshufb	%xmm4,%xmm2
@@ -804,9 +804,9 @@
 
 
 
-
-
-
+// 
+// Interface to OpenSSL
+// 
 .globl	_vpaes_set_encrypt_key
 .private_extern _vpaes_set_encrypt_key
 
@@ -823,7 +823,7 @@
 	movl	%esi,%eax
 	shrl	$5,%eax
 	addl	$5,%eax
-	movl	%eax,240(%rdx)
+	movl	%eax,240(%rdx)  // AES_KEY->rounds = nbits/32+5;
 
 	movl	$0,%ecx
 	movl	$0x30,%r8d
@@ -844,7 +844,7 @@
 	movl	%esi,%eax
 	shrl	$5,%eax
 	addl	$5,%eax
-	movl	%eax,240(%rdx)
+	movl	%eax,240(%rdx)  // AES_KEY->rounds = nbits/32+5;
 	shll	$4,%eax
 	leaq	16(%rdx,%rax,1),%rdx
 
@@ -852,7 +852,7 @@
 	movl	%esi,%r8d
 	shrl	$1,%r8d
 	andl	$32,%r8d
-	xorl	$32,%r8d
+	xorl	$32,%r8d  // nbits==192?0:32
 	call	_vpaes_schedule_core
 	xorl	%eax,%eax
 	ret
@@ -905,7 +905,7 @@
 	xchgq	%rcx,%rdx
 	subq	$16,%rcx
 	jc	L$cbc_abort
-	movdqu	(%r8),%xmm6
+	movdqu	(%r8),%xmm6  // load IV
 	subq	%rdi,%rsi
 	call	_vpaes_preheat
 	cmpl	$0,%r9d
@@ -934,7 +934,7 @@
 	subq	$16,%rcx
 	jnc	L$cbc_dec_loop
 L$cbc_done:
-	movdqu	%xmm6,(%r8)
+	movdqu	%xmm6,(%r8)  // save IV
 L$cbc_abort:
 	ret
 
@@ -947,13 +947,13 @@
 _vpaes_ctr32_encrypt_blocks:
 
 _CET_ENDBR
-
+// _vpaes_encrypt_core and _vpaes_encrypt_core_2x expect the key in %rdx.
 	xchgq	%rcx,%rdx
 	testq	%rcx,%rcx
 	jz	L$ctr32_abort
-	movdqu	(%r8),%xmm0
+	movdqu	(%r8),%xmm0  // Load IV.
 	movdqa	L$ctr_add_one(%rip),%xmm8
-	subq	%rdi,%rsi
+	subq	%rdi,%rsi  // This allows only incrementing %rdi.
 	call	_vpaes_preheat
 	movdqa	%xmm0,%xmm6
 	pshufb	L$rev_ctr(%rip),%xmm6
@@ -961,9 +961,9 @@
 	testq	$1,%rcx
 	jz	L$ctr32_prep_loop
 
-
-
-	movdqu	(%rdi),%xmm7
+// Handle one block so the remaining block count is even for
+// _vpaes_encrypt_core_2x.
+	movdqu	(%rdi),%xmm7  // Load input.
 	call	_vpaes_encrypt_core
 	pxor	%xmm7,%xmm0
 	paddd	%xmm8,%xmm6
@@ -973,29 +973,29 @@
 	jz	L$ctr32_done
 
 L$ctr32_prep_loop:
-
-
+// _vpaes_encrypt_core_2x leaves only %xmm14 and %xmm15 as spare
+// registers. We maintain two byte-swapped counters in them.
 	movdqa	%xmm6,%xmm14
 	movdqa	%xmm6,%xmm15
 	paddd	%xmm8,%xmm15
 
 L$ctr32_loop:
-	movdqa	L$rev_ctr(%rip),%xmm1
+	movdqa	L$rev_ctr(%rip),%xmm1  // Set up counters.
 	movdqa	%xmm14,%xmm0
 	movdqa	%xmm15,%xmm6
 	pshufb	%xmm1,%xmm0
 	pshufb	%xmm1,%xmm6
 	call	_vpaes_encrypt_core_2x
-	movdqu	(%rdi),%xmm1
+	movdqu	(%rdi),%xmm1  // Load input.
 	movdqu	16(%rdi),%xmm2
 	movdqa	L$ctr_add_two(%rip),%xmm3
-	pxor	%xmm1,%xmm0
+	pxor	%xmm1,%xmm0  // XOR input.
 	pxor	%xmm2,%xmm6
-	paddd	%xmm3,%xmm14
+	paddd	%xmm3,%xmm14  // Increment counters.
 	paddd	%xmm3,%xmm15
-	movdqu	%xmm0,(%rsi,%rdi,1)
+	movdqu	%xmm0,(%rsi,%rdi,1)  // Write output.
 	movdqu	%xmm6,16(%rsi,%rdi,1)
-	subq	$2,%rcx
+	subq	$2,%rcx  // Advance loop.
 	leaq	32(%rdi),%rdi
 	jnz	L$ctr32_loop
 
@@ -1004,136 +1004,136 @@
 	ret
 
 
-
-
-
-
-
-
+//  
+// _aes_preheat 
+//  
+// Fills register %r10 -> .aes_consts (so you can -fPIC) 
+// and %xmm9-%xmm15 as specified below. 
+//  
 
 .p2align	4
 .alt_entry _vpaes_preheat
 _vpaes_preheat:
 
 	leaq	L$k_s0F(%rip),%r10
-	movdqa	-32(%r10),%xmm10
-	movdqa	-16(%r10),%xmm11
-	movdqa	0(%r10),%xmm9
-	movdqa	48(%r10),%xmm13
-	movdqa	64(%r10),%xmm12
-	movdqa	80(%r10),%xmm15
-	movdqa	96(%r10),%xmm14
+	movdqa	-32(%r10),%xmm10  // .Lk_inv
+	movdqa	-16(%r10),%xmm11  // .Lk_inv+16
+	movdqa	0(%r10),%xmm9  // .Lk_s0F
+	movdqa	48(%r10),%xmm13  // .Lk_sb1
+	movdqa	64(%r10),%xmm12  // .Lk_sb1+16
+	movdqa	80(%r10),%xmm15  // .Lk_sb2
+	movdqa	96(%r10),%xmm14  // .Lk_sb2+16
 	ret
 
 
-
-
-
-
-
+// ###################################################### 
+// ## 
+// Constants                      ## 
+// ## 
+// ###################################################### 
 
 .section	__DATA,__const
 .p2align	6
 _vpaes_consts:
-L$k_inv:
+L$k_inv:  // inv, inva
 .quad	0x0E05060F0D080180, 0x040703090A0B0C02
 .quad	0x01040A060F0B0780, 0x030D0E0C02050809
 
-L$k_s0F:
+L$k_s0F:  // s0F
 .quad	0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F
 
-L$k_ipt:
+L$k_ipt:  // input transform (lo, hi)
 .quad	0xC2B2E8985A2A7000, 0xCABAE09052227808
 .quad	0x4C01307D317C4D00, 0xCD80B1FCB0FDCC81
 
-L$k_sb1:
+L$k_sb1:  // sb1u, sb1t
 .quad	0xB19BE18FCB503E00, 0xA5DF7A6E142AF544
 .quad	0x3618D415FAE22300, 0x3BF7CCC10D2ED9EF
-L$k_sb2:
+L$k_sb2:  // sb2u, sb2t
 .quad	0xE27A93C60B712400, 0x5EB7E955BC982FCD
 .quad	0x69EB88400AE12900, 0xC2A163C8AB82234A
-L$k_sbo:
+L$k_sbo:  // sbou, sbot
 .quad	0xD0D26D176FBDC700, 0x15AABF7AC502A878
 .quad	0xCFE474A55FBB6A00, 0x8E1E90D1412B35FA
 
-L$k_mc_forward:
+L$k_mc_forward:  // mc_forward
 .quad	0x0407060500030201, 0x0C0F0E0D080B0A09
 .quad	0x080B0A0904070605, 0x000302010C0F0E0D
 .quad	0x0C0F0E0D080B0A09, 0x0407060500030201
 .quad	0x000302010C0F0E0D, 0x080B0A0904070605
 
-L$k_mc_backward:
+L$k_mc_backward:  // mc_backward
 .quad	0x0605040702010003, 0x0E0D0C0F0A09080B
 .quad	0x020100030E0D0C0F, 0x0A09080B06050407
 .quad	0x0E0D0C0F0A09080B, 0x0605040702010003
 .quad	0x0A09080B06050407, 0x020100030E0D0C0F
 
-L$k_sr:
+L$k_sr:  // sr
 .quad	0x0706050403020100, 0x0F0E0D0C0B0A0908
 .quad	0x030E09040F0A0500, 0x0B06010C07020D08
 .quad	0x0F060D040B020900, 0x070E050C030A0108
 .quad	0x0B0E0104070A0D00, 0x0306090C0F020508
 
-L$k_rcon:
+L$k_rcon:  // rcon
 .quad	0x1F8391B9AF9DEEB6, 0x702A98084D7C7D81
 
-L$k_s63:
+L$k_s63:  // s63: all equal to 0x63 transformed
 .quad	0x5B5B5B5B5B5B5B5B, 0x5B5B5B5B5B5B5B5B
 
-L$k_opt:
+L$k_opt:  // output transform
 .quad	0xFF9F4929D6B66000, 0xF7974121DEBE6808
 .quad	0x01EDBD5150BCEC00, 0xE10D5DB1B05C0CE0
 
-L$k_deskew:
+L$k_deskew:  // deskew tables: inverts the sbox's "skew"
 .quad	0x07E4A34047A4E300, 0x1DFEB95A5DBEF91A
 .quad	0x5F36B5DC83EA6900, 0x2841C2ABF49D1E77
 
-
-
-
-
-L$k_dksd:
+//  
+// Decryption stuff 
+// Key schedule constants 
+//  
+L$k_dksd:  // decryption key schedule: invskew x*D
 .quad	0xFEB91A5DA3E44700, 0x0740E3A45A1DBEF9
 .quad	0x41C277F4B5368300, 0x5FDC69EAAB289D1E
-L$k_dksb:
+L$k_dksb:  // decryption key schedule: invskew x*B
 .quad	0x9A4FCA1F8550D500, 0x03D653861CC94C99
 .quad	0x115BEDA7B6FC4A00, 0xD993256F7E3482C8
-L$k_dkse:
+L$k_dkse:  // decryption key schedule: invskew x*E + 0x63
 .quad	0xD5031CCA1FC9D600, 0x53859A4C994F5086
 .quad	0xA23196054FDC7BE8, 0xCD5EF96A20B31487
-L$k_dks9:
+L$k_dks9:  // decryption key schedule: invskew x*9
 .quad	0xB6116FC87ED9A700, 0x4AED933482255BFC
 .quad	0x4576516227143300, 0x8BB89FACE9DAFDCE
 
-
-
-
-
-L$k_dipt:
+//  
+// Decryption stuff 
+// Round function constants 
+//  
+L$k_dipt:  // decryption input transform
 .quad	0x0F505B040B545F00, 0x154A411E114E451A
 .quad	0x86E383E660056500, 0x12771772F491F194
 
-L$k_dsb9:
+L$k_dsb9:  // decryption sbox output *9*u, *9*t
 .quad	0x851C03539A86D600, 0xCAD51F504F994CC9
 .quad	0xC03B1789ECD74900, 0x725E2C9EB2FBA565
-L$k_dsbd:
+L$k_dsbd:  // decryption sbox output *D*u, *D*t
 .quad	0x7D57CCDFE6B1A200, 0xF56E9B13882A4439
 .quad	0x3CE2FAF724C6CB00, 0x2931180D15DEEFD3
-L$k_dsbb:
+L$k_dsbb:  // decryption sbox output *B*u, *B*t
 .quad	0xD022649296B44200, 0x602646F6B0F2D404
 .quad	0xC19498A6CD596700, 0xF3FF0C3E3255AA6B
-L$k_dsbe:
+L$k_dsbe:  // decryption sbox output *E*u, *E*t
 .quad	0x46F2929626D4D000, 0x2242600464B4F6B0
 .quad	0x0C55A6CDFFAAC100, 0x9467F36B98593E32
-L$k_dsbo:
+L$k_dsbo:  // decryption sbox final output
 .quad	0x1387EA537EF94000, 0xC7AA6DB9D4943E2D
 .quad	0x12D7560F93441D00, 0xCA4B8159D8C58E9C
 
-
+// .Lrev_ctr is a permutation which byte-swaps the counter portion of the IV.
 L$rev_ctr:
 .quad	0x0706050403020100, 0x0c0d0e0f0b0a0908
-
-
+// .Lctr_add_* may be added to a byte-swapped xmm register to increment the
+// counter. The register must be byte-swapped again to form the actual input.
 L$ctr_add_one:
 .quad	0x0000000000000000, 0x0000000100000000
 L$ctr_add_two:

boringssl-0.20260708.tar.xz/gen/bcm/vpaes-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/vpaes-x86_64-linux.S Changed

@@ -6,21 +6,21 @@
 #if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && defined(__ELF__)
 .text	
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+//  
+// _aes_encrypt_core 
+//  
+// AES-encrypt %xmm0. 
+//  
+// Inputs: 
+// %xmm0 = input 
+// %xmm9-%xmm15 as in _vpaes_preheat 
+// (%rdx) = scheduled keys 
+//  
+// Output in %xmm0 
+// Clobbers  %xmm1-%xmm5, %r9, %r10, %r11, %rax 
+// Preserves %xmm6 - %xmm8 so you get some local vectors 
+//  
+//  
 .type	_vpaes_encrypt_core,@function
 .align	16
 _vpaes_encrypt_core:
@@ -29,13 +29,13 @@
 	movq	$16,%r11
 	movl	240(%rdx),%eax
 	movdqa	%xmm9,%xmm1
-	movdqa	.Lk_ipt(%rip),%xmm2
+	movdqa	.Lk_ipt(%rip),%xmm2  // iptlo
 	pandn	%xmm0,%xmm1
-	movdqu	(%r9),%xmm5
+	movdqu	(%r9),%xmm5  // round0 key
 	psrld	$4,%xmm1
 	pand	%xmm9,%xmm0
 	pshufb	%xmm0,%xmm2
-	movdqa	.Lk_ipt+16(%rip),%xmm0
+	movdqa	.Lk_ipt+16(%rip),%xmm0  // ipthi
 	pshufb	%xmm1,%xmm0
 	pxor	%xmm5,%xmm2
 	addq	$16,%r9
@@ -45,98 +45,98 @@
 
 .align	16
 .Lenc_loop:
-
-	movdqa	%xmm13,%xmm4
-	movdqa	%xmm12,%xmm0
-	pshufb	%xmm2,%xmm4
-	pshufb	%xmm3,%xmm0
-	pxor	%xmm5,%xmm4
-	movdqa	%xmm15,%xmm5
-	pxor	%xmm4,%xmm0
-	movdqa	-64(%r11,%r10,1),%xmm1
-	pshufb	%xmm2,%xmm5
-	movdqa	(%r11,%r10,1),%xmm4
-	movdqa	%xmm14,%xmm2
-	pshufb	%xmm3,%xmm2
-	movdqa	%xmm0,%xmm3
-	pxor	%xmm5,%xmm2
-	pshufb	%xmm1,%xmm0
-	addq	$16,%r9
-	pxor	%xmm2,%xmm0
-	pshufb	%xmm4,%xmm3
-	addq	$16,%r11
-	pxor	%xmm0,%xmm3
-	pshufb	%xmm1,%xmm0
-	andq	$0x30,%r11
-	subq	$1,%rax
-	pxor	%xmm3,%xmm0
+// middle of middle round
+	movdqa	%xmm13,%xmm4  // 4 : sb1u
+	movdqa	%xmm12,%xmm0  // 0 : sb1t
+	pshufb	%xmm2,%xmm4  // 4 = sb1u
+	pshufb	%xmm3,%xmm0  // 0 = sb1t
+	pxor	%xmm5,%xmm4  // 4 = sb1u + k
+	movdqa	%xmm15,%xmm5  // 4 : sb2u
+	pxor	%xmm4,%xmm0  // 0 = A
+	movdqa	-64(%r11,%r10,1),%xmm1  // .Lk_mc_forward
+	pshufb	%xmm2,%xmm5  // 4 = sb2u
+	movdqa	(%r11,%r10,1),%xmm4  // .Lk_mc_backward
+	movdqa	%xmm14,%xmm2  // 2 : sb2t
+	pshufb	%xmm3,%xmm2  // 2 = sb2t
+	movdqa	%xmm0,%xmm3  // 3 = A
+	pxor	%xmm5,%xmm2  // 2 = 2A
+	pshufb	%xmm1,%xmm0  // 0 = B
+	addq	$16,%r9  // next key
+	pxor	%xmm2,%xmm0  // 0 = 2A+B
+	pshufb	%xmm4,%xmm3  // 3 = D
+	addq	$16,%r11  // next mc
+	pxor	%xmm0,%xmm3  // 3 = 2A+B+D
+	pshufb	%xmm1,%xmm0  // 0 = 2B+C
+	andq	$0x30,%r11  // ... mod 4
+	subq	$1,%rax  // nr--
+	pxor	%xmm3,%xmm0  // 0 = 2A+3B+C+D
 
 .Lenc_entry:
-
-	movdqa	%xmm9,%xmm1
-	movdqa	%xmm11,%xmm5
-	pandn	%xmm0,%xmm1
-	psrld	$4,%xmm1
-	pand	%xmm9,%xmm0
-	pshufb	%xmm0,%xmm5
-	movdqa	%xmm10,%xmm3
-	pxor	%xmm1,%xmm0
-	pshufb	%xmm1,%xmm3
-	movdqa	%xmm10,%xmm4
-	pxor	%xmm5,%xmm3
-	pshufb	%xmm0,%xmm4
-	movdqa	%xmm10,%xmm2
-	pxor	%xmm5,%xmm4
-	pshufb	%xmm3,%xmm2
-	movdqa	%xmm10,%xmm3
-	pxor	%xmm0,%xmm2
-	pshufb	%xmm4,%xmm3
+// top of round
+	movdqa	%xmm9,%xmm1  // 1 : i
+	movdqa	%xmm11,%xmm5  // 2 : a/k
+	pandn	%xmm0,%xmm1  // 1 = i<<4
+	psrld	$4,%xmm1  // 1 = i
+	pand	%xmm9,%xmm0  // 0 = k
+	pshufb	%xmm0,%xmm5  // 2 = a/k
+	movdqa	%xmm10,%xmm3  // 3 : 1/i
+	pxor	%xmm1,%xmm0  // 0 = j
+	pshufb	%xmm1,%xmm3  // 3 = 1/i
+	movdqa	%xmm10,%xmm4  // 4 : 1/j
+	pxor	%xmm5,%xmm3  // 3 = iak = 1/i + a/k
+	pshufb	%xmm0,%xmm4  // 4 = 1/j
+	movdqa	%xmm10,%xmm2  // 2 : 1/iak
+	pxor	%xmm5,%xmm4  // 4 = jak = 1/j + a/k
+	pshufb	%xmm3,%xmm2  // 2 = 1/iak
+	movdqa	%xmm10,%xmm3  // 3 : 1/jak
+	pxor	%xmm0,%xmm2  // 2 = io
+	pshufb	%xmm4,%xmm3  // 3 = 1/jak
 	movdqu	(%r9),%xmm5
-	pxor	%xmm1,%xmm3
+	pxor	%xmm1,%xmm3  // 3 = jo
 	jnz	.Lenc_loop
 
-
-	movdqa	-96(%r10),%xmm4
-	movdqa	-80(%r10),%xmm0
-	pshufb	%xmm2,%xmm4
-	pxor	%xmm5,%xmm4
-	pshufb	%xmm3,%xmm0
-	movdqa	64(%r11,%r10,1),%xmm1
-	pxor	%xmm4,%xmm0
+// middle of last round
+	movdqa	-96(%r10),%xmm4  // 3 : sbou	.Lk_sbo
+	movdqa	-80(%r10),%xmm0  // 0 : sbot	.Lk_sbo+16
+	pshufb	%xmm2,%xmm4  // 4 = sbou
+	pxor	%xmm5,%xmm4  // 4 = sb1u + k
+	pshufb	%xmm3,%xmm0  // 0 = sb1t
+	movdqa	64(%r11,%r10,1),%xmm1  // .Lk_sr
+	pxor	%xmm4,%xmm0  // 0 = A
 	pshufb	%xmm1,%xmm0
 	ret
 .cfi_endproc	
 .size	_vpaes_encrypt_core,.-_vpaes_encrypt_core
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+//  
+// _aes_encrypt_core_2x 
+//  
+// AES-encrypt %xmm0 and %xmm6 in parallel. 
+//  
+// Inputs: 
+// %xmm0 and %xmm6 = input 
+// %xmm9 and %xmm10 as in _vpaes_preheat 
+// (%rdx) = scheduled keys 
+//  
+// Output in %xmm0 and %xmm6 
+// Clobbers  %xmm1-%xmm5, %xmm7, %xmm8, %xmm11-%xmm13, %r9, %r10, %r11, %rax 
+// Preserves %xmm14 and %xmm15 
+//  
+// This function stitches two parallel instances of _vpaes_encrypt_core. x86_64 
+// provides 16 XMM registers. _vpaes_encrypt_core computes over six registers 
+// (%xmm0-%xmm5) and additionally uses seven registers with preloaded constants 
+// from _vpaes_preheat (%xmm9-%xmm15). This does not quite fit two instances, 
+// so we spill some of %xmm9 through %xmm15 back to memory. We keep %xmm9 and 
+// %xmm10 in registers as these values are used several times in a row. The 
+// remainder are read once per round and are spilled to memory. This leaves two 
+// registers preserved for the caller. 
+//  
+// Thus, of the two _vpaes_encrypt_core instances, the first uses (%xmm0-%xmm5) 
+// as before. The second uses %xmm6-%xmm8,%xmm11-%xmm13. (Add 6 to %xmm2 and 
+// below. Add 8 to %xmm3 and up.) Instructions in the second instance are 
+// indented by one space. 
+//  
+//  
 .type	_vpaes_encrypt_core_2x,@function
 .align	16
 _vpaes_encrypt_core_2x:
@@ -146,19 +146,19 @@
 	movl	240(%rdx),%eax
 	movdqa	%xmm9,%xmm1
 	movdqa	%xmm9,%xmm7
-	movdqa	.Lk_ipt(%rip),%xmm2
+	movdqa	.Lk_ipt(%rip),%xmm2  // iptlo
 	movdqa	%xmm2,%xmm8
 	pandn	%xmm0,%xmm1
 	pandn	%xmm6,%xmm7
-	movdqu	(%r9),%xmm5
-
+	movdqu	(%r9),%xmm5  // round0 key
+// Also use %xmm5 in the second instance.
 	psrld	$4,%xmm1
 	psrld	$4,%xmm7
 	pand	%xmm9,%xmm0
 	pand	%xmm9,%xmm6
 	pshufb	%xmm0,%xmm2
 	pshufb	%xmm6,%xmm8
-	movdqa	.Lk_ipt+16(%rip),%xmm0
+	movdqa	.Lk_ipt+16(%rip),%xmm0  // ipthi
 	movdqa	%xmm0,%xmm6
 	pshufb	%xmm1,%xmm0
 	pshufb	%xmm7,%xmm6
@@ -172,110 +172,110 @@
 
 .align	16
 .Lenc2x_loop:
-
-	movdqa	.Lk_sb1(%rip),%xmm4
-	movdqa	.Lk_sb1+16(%rip),%xmm0
+// middle of middle round
+	movdqa	.Lk_sb1(%rip),%xmm4  // 4 : sb1u
+	movdqa	.Lk_sb1+16(%rip),%xmm0  // 0 : sb1t
 	movdqa	%xmm4,%xmm12
 	movdqa	%xmm0,%xmm6
-	pshufb	%xmm2,%xmm4
+	pshufb	%xmm2,%xmm4  // 4 = sb1u
 	pshufb	%xmm8,%xmm12
-	pshufb	%xmm3,%xmm0
+	pshufb	%xmm3,%xmm0  // 0 = sb1t
 	pshufb	%xmm11,%xmm6
-	pxor	%xmm5,%xmm4
+	pxor	%xmm5,%xmm4  // 4 = sb1u + k
 	pxor	%xmm5,%xmm12
-	movdqa	.Lk_sb2(%rip),%xmm5
+	movdqa	.Lk_sb2(%rip),%xmm5  // 4 : sb2u
 	movdqa	%xmm5,%xmm13
-	pxor	%xmm4,%xmm0
+	pxor	%xmm4,%xmm0  // 0 = A
 	pxor	%xmm12,%xmm6
-	movdqa	-64(%r11,%r10,1),%xmm1
-
-	pshufb	%xmm2,%xmm5
+	movdqa	-64(%r11,%r10,1),%xmm1  // .Lk_mc_forward
+// Also use %xmm1 in the second instance.
+	pshufb	%xmm2,%xmm5  // 4 = sb2u
 	pshufb	%xmm8,%xmm13
-	movdqa	(%r11,%r10,1),%xmm4
-
-	movdqa	.Lk_sb2+16(%rip),%xmm2
+	movdqa	(%r11,%r10,1),%xmm4  // .Lk_mc_backward
+// Also use %xmm4 in the second instance.
+	movdqa	.Lk_sb2+16(%rip),%xmm2  // 2 : sb2t
 	movdqa	%xmm2,%xmm8
-	pshufb	%xmm3,%xmm2
+	pshufb	%xmm3,%xmm2  // 2 = sb2t
 	pshufb	%xmm11,%xmm8
-	movdqa	%xmm0,%xmm3
+	movdqa	%xmm0,%xmm3  // 3 = A
 	movdqa	%xmm6,%xmm11
-	pxor	%xmm5,%xmm2
+	pxor	%xmm5,%xmm2  // 2 = 2A
 	pxor	%xmm13,%xmm8
-	pshufb	%xmm1,%xmm0
+	pshufb	%xmm1,%xmm0  // 0 = B
 	pshufb	%xmm1,%xmm6
-	addq	$16,%r9
-	pxor	%xmm2,%xmm0
+	addq	$16,%r9  // next key
+	pxor	%xmm2,%xmm0  // 0 = 2A+B
 	pxor	%xmm8,%xmm6
-	pshufb	%xmm4,%xmm3
+	pshufb	%xmm4,%xmm3  // 3 = D
 	pshufb	%xmm4,%xmm11
-	addq	$16,%r11
-	pxor	%xmm0,%xmm3
+	addq	$16,%r11  // next mc
+	pxor	%xmm0,%xmm3  // 3 = 2A+B+D
 	pxor	%xmm6,%xmm11
-	pshufb	%xmm1,%xmm0
+	pshufb	%xmm1,%xmm0  // 0 = 2B+C
 	pshufb	%xmm1,%xmm6
-	andq	$0x30,%r11
-	subq	$1,%rax
-	pxor	%xmm3,%xmm0
+	andq	$0x30,%r11  // ... mod 4
+	subq	$1,%rax  // nr--
+	pxor	%xmm3,%xmm0  // 0 = 2A+3B+C+D
 	pxor	%xmm11,%xmm6
 
 .Lenc2x_entry:
-
-	movdqa	%xmm9,%xmm1
+// top of round
+	movdqa	%xmm9,%xmm1  // 1 : i
 	movdqa	%xmm9,%xmm7
-	movdqa	.Lk_inv+16(%rip),%xmm5
+	movdqa	.Lk_inv+16(%rip),%xmm5  // 2 : a/k
 	movdqa	%xmm5,%xmm13
-	pandn	%xmm0,%xmm1
+	pandn	%xmm0,%xmm1  // 1 = i<<4
 	pandn	%xmm6,%xmm7
-	psrld	$4,%xmm1
+	psrld	$4,%xmm1  // 1 = i
 	psrld	$4,%xmm7
-	pand	%xmm9,%xmm0
+	pand	%xmm9,%xmm0  // 0 = k
 	pand	%xmm9,%xmm6
-	pshufb	%xmm0,%xmm5
+	pshufb	%xmm0,%xmm5  // 2 = a/k
 	pshufb	%xmm6,%xmm13
-	movdqa	%xmm10,%xmm3
+	movdqa	%xmm10,%xmm3  // 3 : 1/i
 	movdqa	%xmm10,%xmm11
-	pxor	%xmm1,%xmm0
+	pxor	%xmm1,%xmm0  // 0 = j
 	pxor	%xmm7,%xmm6
-	pshufb	%xmm1,%xmm3
+	pshufb	%xmm1,%xmm3  // 3 = 1/i
 	pshufb	%xmm7,%xmm11
-	movdqa	%xmm10,%xmm4
+	movdqa	%xmm10,%xmm4  // 4 : 1/j
 	movdqa	%xmm10,%xmm12
-	pxor	%xmm5,%xmm3
+	pxor	%xmm5,%xmm3  // 3 = iak = 1/i + a/k
 	pxor	%xmm13,%xmm11
-	pshufb	%xmm0,%xmm4
+	pshufb	%xmm0,%xmm4  // 4 = 1/j
 	pshufb	%xmm6,%xmm12
-	movdqa	%xmm10,%xmm2
+	movdqa	%xmm10,%xmm2  // 2 : 1/iak
 	movdqa	%xmm10,%xmm8
-	pxor	%xmm5,%xmm4
+	pxor	%xmm5,%xmm4  // 4 = jak = 1/j + a/k
 	pxor	%xmm13,%xmm12
-	pshufb	%xmm3,%xmm2
+	pshufb	%xmm3,%xmm2  // 2 = 1/iak
 	pshufb	%xmm11,%xmm8
-	movdqa	%xmm10,%xmm3
+	movdqa	%xmm10,%xmm3  // 3 : 1/jak
 	movdqa	%xmm10,%xmm11
-	pxor	%xmm0,%xmm2
+	pxor	%xmm0,%xmm2  // 2 = io
 	pxor	%xmm6,%xmm8
-	pshufb	%xmm4,%xmm3
+	pshufb	%xmm4,%xmm3  // 3 = 1/jak
 	pshufb	%xmm12,%xmm11
 	movdqu	(%r9),%xmm5
-
-	pxor	%xmm1,%xmm3
+// Also use %xmm5 in the second instance.
+	pxor	%xmm1,%xmm3  // 3 = jo
 	pxor	%xmm7,%xmm11
 	jnz	.Lenc2x_loop
 
-
-	movdqa	-96(%r10),%xmm4
-	movdqa	-80(%r10),%xmm0
+// middle of last round
+	movdqa	-96(%r10),%xmm4  // 3 : sbou	.Lk_sbo
+	movdqa	-80(%r10),%xmm0  // 0 : sbot	.Lk_sbo+16
 	movdqa	%xmm4,%xmm12
 	movdqa	%xmm0,%xmm6
-	pshufb	%xmm2,%xmm4
+	pshufb	%xmm2,%xmm4  // 4 = sbou
 	pshufb	%xmm8,%xmm12
-	pxor	%xmm5,%xmm4
+	pxor	%xmm5,%xmm4  // 4 = sb1u + k
 	pxor	%xmm5,%xmm12
-	pshufb	%xmm3,%xmm0
+	pshufb	%xmm3,%xmm0  // 0 = sb1t
 	pshufb	%xmm11,%xmm6
-	movdqa	64(%r11,%r10,1),%xmm1
-
-	pxor	%xmm4,%xmm0
+	movdqa	64(%r11,%r10,1),%xmm1  // .Lk_sr
+// Also use %xmm1 in the second instance.
+	pxor	%xmm4,%xmm0  // 0 = A
 	pxor	%xmm12,%xmm6
 	pshufb	%xmm1,%xmm0
 	pshufb	%xmm1,%xmm6
@@ -283,27 +283,27 @@
 .cfi_endproc	
 .size	_vpaes_encrypt_core_2x,.-_vpaes_encrypt_core_2x
 
-
-
-
-
-
+//  
+// Decryption core 
+//  
+// Same API as encryption core. 
+//  
 .type	_vpaes_decrypt_core,@function
 .align	16
 _vpaes_decrypt_core:
 .cfi_startproc	
-	movq	%rdx,%r9
+	movq	%rdx,%r9  // load key
 	movl	240(%rdx),%eax
 	movdqa	%xmm9,%xmm1
-	movdqa	.Lk_dipt(%rip),%xmm2
+	movdqa	.Lk_dipt(%rip),%xmm2  // iptlo
 	pandn	%xmm0,%xmm1
 	movq	%rax,%r11
 	psrld	$4,%xmm1
-	movdqu	(%r9),%xmm5
+	movdqu	(%r9),%xmm5  // round0 key
 	shlq	$4,%r11
 	pand	%xmm9,%xmm0
 	pshufb	%xmm0,%xmm2
-	movdqa	.Lk_dipt+16(%rip),%xmm0
+	movdqa	.Lk_dipt+16(%rip),%xmm0  // ipthi
 	xorq	$0x30,%r11
 	leaq	.Lk_dsbd(%rip),%r10
 	pshufb	%xmm1,%xmm0
@@ -317,99 +317,99 @@
 
 .align	16
 .Ldec_loop:
-
-
-
-	movdqa	-32(%r10),%xmm4
-	movdqa	-16(%r10),%xmm1
-	pshufb	%xmm2,%xmm4
-	pshufb	%xmm3,%xmm1
+//  
+// Inverse mix columns 
+//  
+	movdqa	-32(%r10),%xmm4  // 4 : sb9u
+	movdqa	-16(%r10),%xmm1  // 0 : sb9t
+	pshufb	%xmm2,%xmm4  // 4 = sb9u
+	pshufb	%xmm3,%xmm1  // 0 = sb9t
 	pxor	%xmm4,%xmm0
-	movdqa	0(%r10),%xmm4
-	pxor	%xmm1,%xmm0
-	movdqa	16(%r10),%xmm1
-
-	pshufb	%xmm2,%xmm4
-	pshufb	%xmm5,%xmm0
-	pshufb	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-	movdqa	32(%r10),%xmm4
-	pxor	%xmm1,%xmm0
-	movdqa	48(%r10),%xmm1
-
-	pshufb	%xmm2,%xmm4
-	pshufb	%xmm5,%xmm0
-	pshufb	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-	movdqa	64(%r10),%xmm4
-	pxor	%xmm1,%xmm0
-	movdqa	80(%r10),%xmm1
-
-	pshufb	%xmm2,%xmm4
-	pshufb	%xmm5,%xmm0
-	pshufb	%xmm3,%xmm1
-	pxor	%xmm4,%xmm0
-	addq	$16,%r9
+	movdqa	0(%r10),%xmm4  // 4 : sbdu
+	pxor	%xmm1,%xmm0  // 0 = ch
+	movdqa	16(%r10),%xmm1  // 0 : sbdt
+
+	pshufb	%xmm2,%xmm4  // 4 = sbdu
+	pshufb	%xmm5,%xmm0  // MC ch
+	pshufb	%xmm3,%xmm1  // 0 = sbdt
+	pxor	%xmm4,%xmm0  // 4 = ch
+	movdqa	32(%r10),%xmm4  // 4 : sbbu
+	pxor	%xmm1,%xmm0  // 0 = ch
+	movdqa	48(%r10),%xmm1  // 0 : sbbt
+
+	pshufb	%xmm2,%xmm4  // 4 = sbbu
+	pshufb	%xmm5,%xmm0  // MC ch
+	pshufb	%xmm3,%xmm1  // 0 = sbbt
+	pxor	%xmm4,%xmm0  // 4 = ch
+	movdqa	64(%r10),%xmm4  // 4 : sbeu
+	pxor	%xmm1,%xmm0  // 0 = ch
+	movdqa	80(%r10),%xmm1  // 0 : sbet
+
+	pshufb	%xmm2,%xmm4  // 4 = sbeu
+	pshufb	%xmm5,%xmm0  // MC ch
+	pshufb	%xmm3,%xmm1  // 0 = sbet
+	pxor	%xmm4,%xmm0  // 4 = ch
+	addq	$16,%r9  // next round key
 	palignr	$12,%xmm5,%xmm5
-	pxor	%xmm1,%xmm0
-	subq	$1,%rax
+	pxor	%xmm1,%xmm0  // 0 = ch
+	subq	$1,%rax  // nr--
 
 .Ldec_entry:
-
-	movdqa	%xmm9,%xmm1
-	pandn	%xmm0,%xmm1
-	movdqa	%xmm11,%xmm2
-	psrld	$4,%xmm1
-	pand	%xmm9,%xmm0
-	pshufb	%xmm0,%xmm2
-	movdqa	%xmm10,%xmm3
-	pxor	%xmm1,%xmm0
-	pshufb	%xmm1,%xmm3
-	movdqa	%xmm10,%xmm4
-	pxor	%xmm2,%xmm3
-	pshufb	%xmm0,%xmm4
-	pxor	%xmm2,%xmm4
-	movdqa	%xmm10,%xmm2
-	pshufb	%xmm3,%xmm2
-	movdqa	%xmm10,%xmm3
-	pxor	%xmm0,%xmm2
-	pshufb	%xmm4,%xmm3
+// top of round
+	movdqa	%xmm9,%xmm1  // 1 : i
+	pandn	%xmm0,%xmm1  // 1 = i<<4
+	movdqa	%xmm11,%xmm2  // 2 : a/k
+	psrld	$4,%xmm1  // 1 = i
+	pand	%xmm9,%xmm0  // 0 = k
+	pshufb	%xmm0,%xmm2  // 2 = a/k
+	movdqa	%xmm10,%xmm3  // 3 : 1/i
+	pxor	%xmm1,%xmm0  // 0 = j
+	pshufb	%xmm1,%xmm3  // 3 = 1/i
+	movdqa	%xmm10,%xmm4  // 4 : 1/j
+	pxor	%xmm2,%xmm3  // 3 = iak = 1/i + a/k
+	pshufb	%xmm0,%xmm4  // 4 = 1/j
+	pxor	%xmm2,%xmm4  // 4 = jak = 1/j + a/k
+	movdqa	%xmm10,%xmm2  // 2 : 1/iak
+	pshufb	%xmm3,%xmm2  // 2 = 1/iak
+	movdqa	%xmm10,%xmm3  // 3 : 1/jak
+	pxor	%xmm0,%xmm2  // 2 = io
+	pshufb	%xmm4,%xmm3  // 3 = 1/jak
 	movdqu	(%r9),%xmm0
-	pxor	%xmm1,%xmm3
+	pxor	%xmm1,%xmm3  // 3 = jo
 	jnz	.Ldec_loop
 
-
-	movdqa	96(%r10),%xmm4
-	pshufb	%xmm2,%xmm4
-	pxor	%xmm0,%xmm4
-	movdqa	112(%r10),%xmm0
-	movdqa	-352(%r11),%xmm2
-	pshufb	%xmm3,%xmm0
-	pxor	%xmm4,%xmm0
+// middle of last round
+	movdqa	96(%r10),%xmm4  // 3 : sbou
+	pshufb	%xmm2,%xmm4  // 4 = sbou
+	pxor	%xmm0,%xmm4  // 4 = sb1u + k
+	movdqa	112(%r10),%xmm0  // 0 : sbot
+	movdqa	-352(%r11),%xmm2  // .Lk_sr-.Lk_dsbd=-0x160
+	pshufb	%xmm3,%xmm0  // 0 = sb1t
+	pxor	%xmm4,%xmm0  // 0 = A
 	pshufb	%xmm2,%xmm0
 	ret
 .cfi_endproc	
 .size	_vpaes_decrypt_core,.-_vpaes_decrypt_core
 
-
-
-
-
-
+// ###################################################### 
+// ## 
+// AES key schedule                  ## 
+// ## 
+// ###################################################### 
 .type	_vpaes_schedule_core,@function
 .align	16
 _vpaes_schedule_core:
 .cfi_startproc	
+// rdi = key
+// rsi = size in bits
+// rdx = buffer
+// rcx = direction.  0=encrypt, 1=decrypt
 
+	call	_vpaes_preheat  // load the tables
+	movdqa	.Lk_rcon(%rip),%xmm8  // load rcon
+	movdqu	(%rdi),%xmm0  // load key (unaligned)
 
-
-
-
-	call	_vpaes_preheat
-	movdqa	.Lk_rcon(%rip),%xmm8
-	movdqu	(%rdi),%xmm0
-
-
+// input transform
 	movdqa	%xmm0,%xmm3
 	leaq	.Lk_ipt(%rip),%r11
 	call	_vpaes_schedule_transform
@@ -419,12 +419,12 @@
 	testq	%rcx,%rcx
 	jnz	.Lschedule_am_decrypting
 
-
+// encrypting, output zeroth round key after transform
 	movdqu	%xmm0,(%rdx)
 	jmp	.Lschedule_go
 
 .Lschedule_am_decrypting:
-
+// decrypting, output zeroth round key after shiftrows
 	movdqa	(%r8,%r10,1),%xmm1
 	pshufb	%xmm1,%xmm3
 	movdqu	%xmm3,(%rdx)
@@ -434,16 +434,16 @@
 	cmpl	$192,%esi
 	ja	.Lschedule_256
 	je	.Lschedule_192
-
-
-
-
-
-
-
-
-
-
+// 128: fall though
+
+//  
+// .schedule_128 
+//  
+// 128-bit specific part of key schedule. 
+//  
+// This schedule is really simple, because all its parts 
+// are accomplished by the subroutines. 
+//  
 .Lschedule_128:
 	movl	$10,%esi
 
@@ -451,73 +451,73 @@
 	call	_vpaes_schedule_round
 	decq	%rsi
 	jz	.Lschedule_mangle_last
-	call	_vpaes_schedule_mangle
+	call	_vpaes_schedule_mangle  // write output
 	jmp	.Loop_schedule_128
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_192 
+//  
+// 192-bit specific part of key schedule. 
+//  
+// The main body of this schedule is the same as the 128-bit 
+// schedule, but with more smearing.  The long, high side is 
+// stored in %xmm7 as before, and the short, low side is in 
+// the high bits of %xmm6. 
+//  
+// This schedule is somewhat nastier, however, because each 
+// round produces 192 bits of key material, or 1.5 round keys. 
+// Therefore, on each cycle we do 2 rounds and produce 3 round 
+// keys. 
+//  
 .align	16
 .Lschedule_192:
-	movdqu	8(%rdi),%xmm0
-	call	_vpaes_schedule_transform
-	movdqa	%xmm0,%xmm6
-	pxor	%xmm4,%xmm4
-	movhlps	%xmm4,%xmm6
+	movdqu	8(%rdi),%xmm0  // load key part 2 (very unaligned)
+	call	_vpaes_schedule_transform  // input transform
+	movdqa	%xmm0,%xmm6  // save short part
+	pxor	%xmm4,%xmm4  // clear 4
+	movhlps	%xmm4,%xmm6  // clobber low side with zeros
 	movl	$4,%esi
 
 .Loop_schedule_192:
 	call	_vpaes_schedule_round
 	palignr	$8,%xmm6,%xmm0
-	call	_vpaes_schedule_mangle
+	call	_vpaes_schedule_mangle  // save key n
 	call	_vpaes_schedule_192_smear
-	call	_vpaes_schedule_mangle
+	call	_vpaes_schedule_mangle  // save key n+1
 	call	_vpaes_schedule_round
 	decq	%rsi
 	jz	.Lschedule_mangle_last
-	call	_vpaes_schedule_mangle
+	call	_vpaes_schedule_mangle  // save key n+2
 	call	_vpaes_schedule_192_smear
 	jmp	.Loop_schedule_192
 
-
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_256 
+//  
+// 256-bit specific part of key schedule. 
+//  
+// The structure here is very similar to the 128-bit 
+// schedule, but with an additional "low side" in 
+// %xmm6.  The low side's rounds are the same as the 
+// high side's, except no rcon and no rotation. 
+//  
 .align	16
 .Lschedule_256:
-	movdqu	16(%rdi),%xmm0
-	call	_vpaes_schedule_transform
+	movdqu	16(%rdi),%xmm0  // load key part 2 (unaligned)
+	call	_vpaes_schedule_transform  // input transform
 	movl	$7,%esi
 
 .Loop_schedule_256:
-	call	_vpaes_schedule_mangle
-	movdqa	%xmm0,%xmm6
-
+	call	_vpaes_schedule_mangle  // output low result
+	movdqa	%xmm0,%xmm6  // save cur_lo in xmm6
 
+// high round
 	call	_vpaes_schedule_round
 	decq	%rsi
 	jz	.Lschedule_mangle_last
 	call	_vpaes_schedule_mangle
 
-
+// low round. swap xmm7 and xmm6
 	pshufd	$0xFF,%xmm0,%xmm0
 	movdqa	%xmm7,%xmm5
 	movdqa	%xmm6,%xmm7
@@ -527,36 +527,36 @@
 	jmp	.Loop_schedule_256
 
 
-
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_mangle_last 
+//  
+// Mangler for last round of key schedule 
+// Mangles %xmm0 
+// when encrypting, outputs out(%xmm0) ^ 63 
+// when decrypting, outputs unskew(%xmm0) 
+//  
+// Always called right before return... jumps to cleanup and exits 
+//  
 .align	16
 .Lschedule_mangle_last:
-
-	leaq	.Lk_deskew(%rip),%r11
+// schedule last round key from xmm0
+	leaq	.Lk_deskew(%rip),%r11  // prepare to deskew
 	testq	%rcx,%rcx
 	jnz	.Lschedule_mangle_last_dec
 
-
+// encrypting
 	movdqa	(%r8,%r10,1),%xmm1
-	pshufb	%xmm1,%xmm0
-	leaq	.Lk_opt(%rip),%r11
+	pshufb	%xmm1,%xmm0  // output permute
+	leaq	.Lk_opt(%rip),%r11  // prepare to output transform
 	addq	$32,%rdx
 
 .Lschedule_mangle_last_dec:
 	addq	$-16,%rdx
 	pxor	.Lk_s63(%rip),%xmm0
-	call	_vpaes_schedule_transform
-	movdqu	%xmm0,(%rdx)
-
+	call	_vpaes_schedule_transform  // output transform
+	movdqu	%xmm0,(%rdx)  // save last key
 
+// cleanup
 	pxor	%xmm0,%xmm0
 	pxor	%xmm1,%xmm1
 	pxor	%xmm2,%xmm2
@@ -569,72 +569,72 @@
 .cfi_endproc	
 .size	_vpaes_schedule_core,.-_vpaes_schedule_core
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_192_smear 
+//  
+// Smear the short, low side in the 192-bit key schedule. 
+//  
+// Inputs: 
+// %xmm7: high side, b  a  x  y 
+// %xmm6:  low side, d  c  0  0 
+// %xmm13: 0 
+//  
+// Outputs: 
+// %xmm6: b+c+d  b+c  0  0 
+// %xmm0: b+c+d  b+c  b  a 
+//  
 .type	_vpaes_schedule_192_smear,@function
 .align	16
 _vpaes_schedule_192_smear:
 .cfi_startproc	
-	pshufd	$0x80,%xmm6,%xmm1
-	pshufd	$0xFE,%xmm7,%xmm0
-	pxor	%xmm1,%xmm6
+	pshufd	$0x80,%xmm6,%xmm1  // d c 0 0 -> c 0 0 0
+	pshufd	$0xFE,%xmm7,%xmm0  // b a _ _ -> b b b a
+	pxor	%xmm1,%xmm6  // -> c+d c 0 0
 	pxor	%xmm1,%xmm1
-	pxor	%xmm0,%xmm6
+	pxor	%xmm0,%xmm6  // -> b+c+d b+c b a
 	movdqa	%xmm6,%xmm0
-	movhlps	%xmm1,%xmm6
+	movhlps	%xmm1,%xmm6  // clobber low side with zeros
 	ret
 .cfi_endproc	
 .size	_vpaes_schedule_192_smear,.-_vpaes_schedule_192_smear
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_round 
+//  
+// Runs one main round of the key schedule on %xmm0, %xmm7 
+//  
+// Specifically, runs subbytes on the high dword of %xmm0 
+// then rotates it by one byte and xors into the low dword of 
+// %xmm7. 
+//  
+// Adds rcon from low byte of %xmm8, then rotates %xmm8 for 
+// next rcon. 
+//  
+// Smears the dwords of %xmm7 by xoring the low into the 
+// second low, result into third, result into highest. 
+//  
+// Returns results in %xmm7 = %xmm0. 
+// Clobbers %xmm1-%xmm4, %r11. 
+//  
 .type	_vpaes_schedule_round,@function
 .align	16
 _vpaes_schedule_round:
 .cfi_startproc	
-
+// extract rcon from xmm8
 	pxor	%xmm1,%xmm1
 	palignr	$15,%xmm8,%xmm1
 	palignr	$15,%xmm8,%xmm8
 	pxor	%xmm1,%xmm7
 
-
+// rotate
 	pshufd	$0xFF,%xmm0,%xmm0
 	palignr	$1,%xmm0,%xmm0
 
+// fall through...
 
-
-
+// low round: same as high round, but no rotation and no rcon.
 _vpaes_schedule_low_round:
-
+// smear xmm7
 	movdqa	%xmm7,%xmm1
 	pslldq	$4,%xmm7
 	pxor	%xmm1,%xmm7
@@ -643,48 +643,48 @@
 	pxor	%xmm1,%xmm7
 	pxor	.Lk_s63(%rip),%xmm7
 
-
+// subbytes
 	movdqa	%xmm9,%xmm1
 	pandn	%xmm0,%xmm1
-	psrld	$4,%xmm1
-	pand	%xmm9,%xmm0
-	movdqa	%xmm11,%xmm2
-	pshufb	%xmm0,%xmm2
-	pxor	%xmm1,%xmm0
-	movdqa	%xmm10,%xmm3
-	pshufb	%xmm1,%xmm3
-	pxor	%xmm2,%xmm3
-	movdqa	%xmm10,%xmm4
-	pshufb	%xmm0,%xmm4
-	pxor	%xmm2,%xmm4
-	movdqa	%xmm10,%xmm2
-	pshufb	%xmm3,%xmm2
-	pxor	%xmm0,%xmm2
-	movdqa	%xmm10,%xmm3
-	pshufb	%xmm4,%xmm3
-	pxor	%xmm1,%xmm3
-	movdqa	%xmm13,%xmm4
-	pshufb	%xmm2,%xmm4
-	movdqa	%xmm12,%xmm0
-	pshufb	%xmm3,%xmm0
-	pxor	%xmm4,%xmm0
-
-
+	psrld	$4,%xmm1  // 1 = i
+	pand	%xmm9,%xmm0  // 0 = k
+	movdqa	%xmm11,%xmm2  // 2 : a/k
+	pshufb	%xmm0,%xmm2  // 2 = a/k
+	pxor	%xmm1,%xmm0  // 0 = j
+	movdqa	%xmm10,%xmm3  // 3 : 1/i
+	pshufb	%xmm1,%xmm3  // 3 = 1/i
+	pxor	%xmm2,%xmm3  // 3 = iak = 1/i + a/k
+	movdqa	%xmm10,%xmm4  // 4 : 1/j
+	pshufb	%xmm0,%xmm4  // 4 = 1/j
+	pxor	%xmm2,%xmm4  // 4 = jak = 1/j + a/k
+	movdqa	%xmm10,%xmm2  // 2 : 1/iak
+	pshufb	%xmm3,%xmm2  // 2 = 1/iak
+	pxor	%xmm0,%xmm2  // 2 = io
+	movdqa	%xmm10,%xmm3  // 3 : 1/jak
+	pshufb	%xmm4,%xmm3  // 3 = 1/jak
+	pxor	%xmm1,%xmm3  // 3 = jo
+	movdqa	%xmm13,%xmm4  // 4 : sbou
+	pshufb	%xmm2,%xmm4  // 4 = sbou
+	movdqa	%xmm12,%xmm0  // 0 : sbot
+	pshufb	%xmm3,%xmm0  // 0 = sb1t
+	pxor	%xmm4,%xmm0  // 0 = sbox output
+
+// add in smeared stuff
 	pxor	%xmm7,%xmm0
 	movdqa	%xmm0,%xmm7
 	ret
 .cfi_endproc	
 .size	_vpaes_schedule_round,.-_vpaes_schedule_round
 
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_transform 
+//  
+// Linear-transform %xmm0 according to tables at (%r11) 
+//  
+// Requires that %xmm9 = 0x0F0F... as in preheat 
+// Output in %xmm0 
+// Clobbers %xmm1, %xmm2 
+//  
 .type	_vpaes_schedule_transform,@function
 .align	16
 _vpaes_schedule_transform:
@@ -693,48 +693,48 @@
 	pandn	%xmm0,%xmm1
 	psrld	$4,%xmm1
 	pand	%xmm9,%xmm0
-	movdqa	(%r11),%xmm2
+	movdqa	(%r11),%xmm2  // lo
 	pshufb	%xmm0,%xmm2
-	movdqa	16(%r11),%xmm0
+	movdqa	16(%r11),%xmm0  // hi
 	pshufb	%xmm1,%xmm0
 	pxor	%xmm2,%xmm0
 	ret
 .cfi_endproc	
 .size	_vpaes_schedule_transform,.-_vpaes_schedule_transform
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+//  
+// .aes_schedule_mangle 
+//  
+// Mangle xmm0 from (basis-transformed) standard version 
+// to our version. 
+//  
+// On encrypt, 
+// xor with 0x63 
+// multiply by circulant 0,1,1,1 
+// apply shiftrows transform 
+//  
+// On decrypt, 
+// xor with 0x63 
+// multiply by "inverse mixcolumns" circulant E,B,D,9 
+// deskew 
+// apply shiftrows transform 
+//  
+//  
+// Writes out to (%rdx), and increments or decrements it 
+// Keeps track of round number mod 4 in %r8 
+// Preserves xmm0 
+// Clobbers xmm1-xmm5 
+//  
 .type	_vpaes_schedule_mangle,@function
 .align	16
 _vpaes_schedule_mangle:
 .cfi_startproc	
-	movdqa	%xmm0,%xmm4
+	movdqa	%xmm0,%xmm4  // save xmm0 for later
 	movdqa	.Lk_mc_forward(%rip),%xmm5
 	testq	%rcx,%rcx
 	jnz	.Lschedule_mangle_dec
 
-
+// encrypting
 	addq	$16,%rdx
 	pxor	.Lk_s63(%rip),%xmm4
 	pshufb	%xmm5,%xmm4
@@ -747,12 +747,12 @@
 	jmp	.Lschedule_mangle_both
 .align	16
 .Lschedule_mangle_dec:
-
+// inverse mix columns
 	leaq	.Lk_dksd(%rip),%r11
 	movdqa	%xmm9,%xmm1
 	pandn	%xmm4,%xmm1
-	psrld	$4,%xmm1
-	pand	%xmm9,%xmm4
+	psrld	$4,%xmm1  // 1 = hi
+	pand	%xmm9,%xmm4  // 4 = lo
 
 	movdqa	0(%r11),%xmm2
 	pshufb	%xmm4,%xmm2
@@ -796,9 +796,9 @@
 .cfi_endproc	
 .size	_vpaes_schedule_mangle,.-_vpaes_schedule_mangle
 
-
-
-
+// 
+// Interface to OpenSSL
+// 
 .globl	vpaes_set_encrypt_key
 .hidden vpaes_set_encrypt_key
 .type	vpaes_set_encrypt_key,@function
@@ -815,7 +815,7 @@
 	movl	%esi,%eax
 	shrl	$5,%eax
 	addl	$5,%eax
-	movl	%eax,240(%rdx)
+	movl	%eax,240(%rdx)  // AES_KEY->rounds = nbits/32+5;
 
 	movl	$0,%ecx
 	movl	$0x30,%r8d
@@ -835,7 +835,7 @@
 	movl	%esi,%eax
 	shrl	$5,%eax
 	addl	$5,%eax
-	movl	%eax,240(%rdx)
+	movl	%eax,240(%rdx)  // AES_KEY->rounds = nbits/32+5;
 	shll	$4,%eax
 	leaq	16(%rdx,%rax,1),%rdx
 
@@ -843,7 +843,7 @@
 	movl	%esi,%r8d
 	shrl	$1,%r8d
 	andl	$32,%r8d
-	xorl	$32,%r8d
+	xorl	$32,%r8d  // nbits==192?0:32
 	call	_vpaes_schedule_core
 	xorl	%eax,%eax
 	ret
@@ -894,7 +894,7 @@
 	xchgq	%rcx,%rdx
 	subq	$16,%rcx
 	jc	.Lcbc_abort
-	movdqu	(%r8),%xmm6
+	movdqu	(%r8),%xmm6  // load IV
 	subq	%rdi,%rsi
 	call	_vpaes_preheat
 	cmpl	$0,%r9d
@@ -923,7 +923,7 @@
 	subq	$16,%rcx
 	jnc	.Lcbc_dec_loop
 .Lcbc_done:
-	movdqu	%xmm6,(%r8)
+	movdqu	%xmm6,(%r8)  // save IV
 .Lcbc_abort:
 	ret
 .cfi_endproc	
@@ -935,13 +935,13 @@
 vpaes_ctr32_encrypt_blocks:
 .cfi_startproc	
 _CET_ENDBR
-
+// _vpaes_encrypt_core and _vpaes_encrypt_core_2x expect the key in %rdx.
 	xchgq	%rcx,%rdx
 	testq	%rcx,%rcx
 	jz	.Lctr32_abort
-	movdqu	(%r8),%xmm0
+	movdqu	(%r8),%xmm0  // Load IV.
 	movdqa	.Lctr_add_one(%rip),%xmm8
-	subq	%rdi,%rsi
+	subq	%rdi,%rsi  // This allows only incrementing %rdi.
 	call	_vpaes_preheat
 	movdqa	%xmm0,%xmm6
 	pshufb	.Lrev_ctr(%rip),%xmm6
@@ -949,9 +949,9 @@
 	testq	$1,%rcx
 	jz	.Lctr32_prep_loop
 
-
-
-	movdqu	(%rdi),%xmm7
+// Handle one block so the remaining block count is even for
+// _vpaes_encrypt_core_2x.
+	movdqu	(%rdi),%xmm7  // Load input.
 	call	_vpaes_encrypt_core
 	pxor	%xmm7,%xmm0
 	paddd	%xmm8,%xmm6
@@ -961,29 +961,29 @@
 	jz	.Lctr32_done
 
 .Lctr32_prep_loop:
-
-
+// _vpaes_encrypt_core_2x leaves only %xmm14 and %xmm15 as spare
+// registers. We maintain two byte-swapped counters in them.
 	movdqa	%xmm6,%xmm14
 	movdqa	%xmm6,%xmm15
 	paddd	%xmm8,%xmm15
 
 .Lctr32_loop:
-	movdqa	.Lrev_ctr(%rip),%xmm1
+	movdqa	.Lrev_ctr(%rip),%xmm1  // Set up counters.
 	movdqa	%xmm14,%xmm0
 	movdqa	%xmm15,%xmm6
 	pshufb	%xmm1,%xmm0
 	pshufb	%xmm1,%xmm6
 	call	_vpaes_encrypt_core_2x
-	movdqu	(%rdi),%xmm1
+	movdqu	(%rdi),%xmm1  // Load input.
 	movdqu	16(%rdi),%xmm2
 	movdqa	.Lctr_add_two(%rip),%xmm3
-	pxor	%xmm1,%xmm0
+	pxor	%xmm1,%xmm0  // XOR input.
 	pxor	%xmm2,%xmm6
-	paddd	%xmm3,%xmm14
+	paddd	%xmm3,%xmm14  // Increment counters.
 	paddd	%xmm3,%xmm15
-	movdqu	%xmm0,(%rsi,%rdi,1)
+	movdqu	%xmm0,(%rsi,%rdi,1)  // Write output.
 	movdqu	%xmm6,16(%rsi,%rdi,1)
-	subq	$2,%rcx
+	subq	$2,%rcx  // Advance loop.
 	leaq	32(%rdi),%rdi
 	jnz	.Lctr32_loop
 
@@ -992,135 +992,135 @@
 	ret
 .cfi_endproc	
 .size	vpaes_ctr32_encrypt_blocks,.-vpaes_ctr32_encrypt_blocks
-
-
-
-
-
-
+//  
+// _aes_preheat 
+//  
+// Fills register %r10 -> .aes_consts (so you can -fPIC) 
+// and %xmm9-%xmm15 as specified below. 
+//  
 .type	_vpaes_preheat,@function
 .align	16
 _vpaes_preheat:
 .cfi_startproc	
 	leaq	.Lk_s0F(%rip),%r10
-	movdqa	-32(%r10),%xmm10
-	movdqa	-16(%r10),%xmm11
-	movdqa	0(%r10),%xmm9
-	movdqa	48(%r10),%xmm13
-	movdqa	64(%r10),%xmm12
-	movdqa	80(%r10),%xmm15
-	movdqa	96(%r10),%xmm14
+	movdqa	-32(%r10),%xmm10  // .Lk_inv
+	movdqa	-16(%r10),%xmm11  // .Lk_inv+16
+	movdqa	0(%r10),%xmm9  // .Lk_s0F
+	movdqa	48(%r10),%xmm13  // .Lk_sb1
+	movdqa	64(%r10),%xmm12  // .Lk_sb1+16
+	movdqa	80(%r10),%xmm15  // .Lk_sb2
+	movdqa	96(%r10),%xmm14  // .Lk_sb2+16
 	ret
 .cfi_endproc	
 .size	_vpaes_preheat,.-_vpaes_preheat
-
-
-
-
-
+// ###################################################### 
+// ## 
+// Constants                      ## 
+// ## 
+// ###################################################### 
 .type	_vpaes_consts,@object
 .section	.rodata
 .align	64
 _vpaes_consts:
-.Lk_inv:
+.Lk_inv:  // inv, inva
 .quad	0x0E05060F0D080180, 0x040703090A0B0C02
 .quad	0x01040A060F0B0780, 0x030D0E0C02050809
 
-.Lk_s0F:
+.Lk_s0F:  // s0F
 .quad	0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F
 
-.Lk_ipt:
+.Lk_ipt:  // input transform (lo, hi)
 .quad	0xC2B2E8985A2A7000, 0xCABAE09052227808
 .quad	0x4C01307D317C4D00, 0xCD80B1FCB0FDCC81
 
-.Lk_sb1:
+.Lk_sb1:  // sb1u, sb1t
 .quad	0xB19BE18FCB503E00, 0xA5DF7A6E142AF544
 .quad	0x3618D415FAE22300, 0x3BF7CCC10D2ED9EF
-.Lk_sb2:
+.Lk_sb2:  // sb2u, sb2t
 .quad	0xE27A93C60B712400, 0x5EB7E955BC982FCD
 .quad	0x69EB88400AE12900, 0xC2A163C8AB82234A
-.Lk_sbo:
+.Lk_sbo:  // sbou, sbot
 .quad	0xD0D26D176FBDC700, 0x15AABF7AC502A878
 .quad	0xCFE474A55FBB6A00, 0x8E1E90D1412B35FA
 
-.Lk_mc_forward:
+.Lk_mc_forward:  // mc_forward
 .quad	0x0407060500030201, 0x0C0F0E0D080B0A09
 .quad	0x080B0A0904070605, 0x000302010C0F0E0D
 .quad	0x0C0F0E0D080B0A09, 0x0407060500030201
 .quad	0x000302010C0F0E0D, 0x080B0A0904070605
 
-.Lk_mc_backward:
+.Lk_mc_backward:  // mc_backward
 .quad	0x0605040702010003, 0x0E0D0C0F0A09080B
 .quad	0x020100030E0D0C0F, 0x0A09080B06050407
 .quad	0x0E0D0C0F0A09080B, 0x0605040702010003
 .quad	0x0A09080B06050407, 0x020100030E0D0C0F
 
-.Lk_sr:
+.Lk_sr:  // sr
 .quad	0x0706050403020100, 0x0F0E0D0C0B0A0908
 .quad	0x030E09040F0A0500, 0x0B06010C07020D08
 .quad	0x0F060D040B020900, 0x070E050C030A0108
 .quad	0x0B0E0104070A0D00, 0x0306090C0F020508
 
-.Lk_rcon:
+.Lk_rcon:  // rcon
 .quad	0x1F8391B9AF9DEEB6, 0x702A98084D7C7D81
 
-.Lk_s63:
+.Lk_s63:  // s63: all equal to 0x63 transformed
 .quad	0x5B5B5B5B5B5B5B5B, 0x5B5B5B5B5B5B5B5B
 
-.Lk_opt:
+.Lk_opt:  // output transform
 .quad	0xFF9F4929D6B66000, 0xF7974121DEBE6808
 .quad	0x01EDBD5150BCEC00, 0xE10D5DB1B05C0CE0
 
-.Lk_deskew:
+.Lk_deskew:  // deskew tables: inverts the sbox's "skew"
 .quad	0x07E4A34047A4E300, 0x1DFEB95A5DBEF91A
 .quad	0x5F36B5DC83EA6900, 0x2841C2ABF49D1E77
 
-
-
-
-
-.Lk_dksd:
+//  
+// Decryption stuff 
+// Key schedule constants 
+//  
+.Lk_dksd:  // decryption key schedule: invskew x*D
 .quad	0xFEB91A5DA3E44700, 0x0740E3A45A1DBEF9
 .quad	0x41C277F4B5368300, 0x5FDC69EAAB289D1E
-.Lk_dksb:
+.Lk_dksb:  // decryption key schedule: invskew x*B
 .quad	0x9A4FCA1F8550D500, 0x03D653861CC94C99
 .quad	0x115BEDA7B6FC4A00, 0xD993256F7E3482C8
-.Lk_dkse:
+.Lk_dkse:  // decryption key schedule: invskew x*E + 0x63
 .quad	0xD5031CCA1FC9D600, 0x53859A4C994F5086
 .quad	0xA23196054FDC7BE8, 0xCD5EF96A20B31487
-.Lk_dks9:
+.Lk_dks9:  // decryption key schedule: invskew x*9
 .quad	0xB6116FC87ED9A700, 0x4AED933482255BFC
 .quad	0x4576516227143300, 0x8BB89FACE9DAFDCE
 
-
-
-
-
-.Lk_dipt:
+//  
+// Decryption stuff 
+// Round function constants 
+//  
+.Lk_dipt:  // decryption input transform
 .quad	0x0F505B040B545F00, 0x154A411E114E451A
 .quad	0x86E383E660056500, 0x12771772F491F194
 
-.Lk_dsb9:
+.Lk_dsb9:  // decryption sbox output *9*u, *9*t
 .quad	0x851C03539A86D600, 0xCAD51F504F994CC9
 .quad	0xC03B1789ECD74900, 0x725E2C9EB2FBA565
-.Lk_dsbd:
+.Lk_dsbd:  // decryption sbox output *D*u, *D*t
 .quad	0x7D57CCDFE6B1A200, 0xF56E9B13882A4439
 .quad	0x3CE2FAF724C6CB00, 0x2931180D15DEEFD3
-.Lk_dsbb:
+.Lk_dsbb:  // decryption sbox output *B*u, *B*t
 .quad	0xD022649296B44200, 0x602646F6B0F2D404
 .quad	0xC19498A6CD596700, 0xF3FF0C3E3255AA6B
-.Lk_dsbe:
+.Lk_dsbe:  // decryption sbox output *E*u, *E*t
 .quad	0x46F2929626D4D000, 0x2242600464B4F6B0
 .quad	0x0C55A6CDFFAAC100, 0x9467F36B98593E32
-.Lk_dsbo:
+.Lk_dsbo:  // decryption sbox final output
 .quad	0x1387EA537EF94000, 0xC7AA6DB9D4943E2D
 .quad	0x12D7560F93441D00, 0xCA4B8159D8C58E9C
 
-
+// .Lrev_ctr is a permutation which byte-swaps the counter portion of the IV.
 .Lrev_ctr:
 .quad	0x0706050403020100, 0x0c0d0e0f0b0a0908
-
-
+// .Lctr_add_* may be added to a byte-swapped xmm register to increment the
+// counter. The register must be byte-swapped again to form the actual input.
 .Lctr_add_one:
 .quad	0x0000000000000000, 0x0000000100000000
 .Lctr_add_two:

boringssl-0.20260708.tar.xz/gen/bcm/vpaes-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/vpaes-x86_64-win.asm Changed

@@ -14,21 +14,21 @@
 section	.text code align=64
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+; #
+; #  _aes_encrypt_core
+; #
+; #  AES-encrypt %xmm0.
+; #
+; #  Inputs:
+; #     %xmm0 = input
+; #     %xmm9-%xmm15 as in _vpaes_preheat
+; #    (%rdx) = scheduled keys
+; #
+; #  Output in %xmm0
+; #  Clobbers  %xmm1-%xmm5, %r9, %r10, %r11, %rax
+; #  Preserves %xmm6 - %xmm8 so you get some local vectors
+; #
+; #
 
 ALIGN	16
 _vpaes_encrypt_core:
@@ -37,13 +37,13 @@
 	mov	r11,16
 	mov	eax,DWORD240+rdx
 	movdqa	xmm1,xmm9
-	movdqa	xmm2,XMMWORD$L$k_ipt
+	movdqa	xmm2,XMMWORD$L$k_ipt  ; iptlo
 	pandn	xmm1,xmm0
-	movdqu	xmm5,XMMWORDr9
+	movdqu	xmm5,XMMWORDr9  ; round0 key
 	psrld	xmm1,4
 	pand	xmm0,xmm9
 	pshufb	xmm2,xmm0
-	movdqa	xmm0,XMMWORD(($L$k_ipt+16))
+	movdqa	xmm0,XMMWORD(($L$k_ipt+16))  ; ipthi
 	pshufb	xmm0,xmm1
 	pxor	xmm2,xmm5
 	add	r9,16
@@ -53,98 +53,98 @@
 
 ALIGN	16
 $L$enc_loop:
-
-	movdqa	xmm4,xmm13
-	movdqa	xmm0,xmm12
-	pshufb	xmm4,xmm2
-	pshufb	xmm0,xmm3
-	pxor	xmm4,xmm5
-	movdqa	xmm5,xmm15
-	pxor	xmm0,xmm4
-	movdqa	xmm1,XMMWORD((-64))+r10*1+r11
-	pshufb	xmm5,xmm2
-	movdqa	xmm4,XMMWORDr10*1+r11
-	movdqa	xmm2,xmm14
-	pshufb	xmm2,xmm3
-	movdqa	xmm3,xmm0
-	pxor	xmm2,xmm5
-	pshufb	xmm0,xmm1
-	add	r9,16
-	pxor	xmm0,xmm2
-	pshufb	xmm3,xmm4
-	add	r11,16
-	pxor	xmm3,xmm0
-	pshufb	xmm0,xmm1
-	and	r11,0x30
-	sub	rax,1
-	pxor	xmm0,xmm3
+; middle of middle round
+	movdqa	xmm4,xmm13  ; 4 : sb1u
+	movdqa	xmm0,xmm12  ; 0 : sb1t
+	pshufb	xmm4,xmm2  ; 4 = sb1u
+	pshufb	xmm0,xmm3  ; 0 = sb1t
+	pxor	xmm4,xmm5  ; 4 = sb1u + k
+	movdqa	xmm5,xmm15  ; 4 : sb2u
+	pxor	xmm0,xmm4  ; 0 = A
+	movdqa	xmm1,XMMWORD((-64))+r10*1+r11  ; .Lk_mc_forward
+	pshufb	xmm5,xmm2  ; 4 = sb2u
+	movdqa	xmm4,XMMWORDr10*1+r11  ; .Lk_mc_backward
+	movdqa	xmm2,xmm14  ; 2 : sb2t
+	pshufb	xmm2,xmm3  ; 2 = sb2t
+	movdqa	xmm3,xmm0  ; 3 = A
+	pxor	xmm2,xmm5  ; 2 = 2A
+	pshufb	xmm0,xmm1  ; 0 = B
+	add	r9,16  ; next key
+	pxor	xmm0,xmm2  ; 0 = 2A+B
+	pshufb	xmm3,xmm4  ; 3 = D
+	add	r11,16  ; next mc
+	pxor	xmm3,xmm0  ; 3 = 2A+B+D
+	pshufb	xmm0,xmm1  ; 0 = 2B+C
+	and	r11,0x30  ; ... mod 4
+	sub	rax,1  ; nr--
+	pxor	xmm0,xmm3  ; 0 = 2A+3B+C+D
 
 $L$enc_entry:
-
-	movdqa	xmm1,xmm9
-	movdqa	xmm5,xmm11
-	pandn	xmm1,xmm0
-	psrld	xmm1,4
-	pand	xmm0,xmm9
-	pshufb	xmm5,xmm0
-	movdqa	xmm3,xmm10
-	pxor	xmm0,xmm1
-	pshufb	xmm3,xmm1
-	movdqa	xmm4,xmm10
-	pxor	xmm3,xmm5
-	pshufb	xmm4,xmm0
-	movdqa	xmm2,xmm10
-	pxor	xmm4,xmm5
-	pshufb	xmm2,xmm3
-	movdqa	xmm3,xmm10
-	pxor	xmm2,xmm0
-	pshufb	xmm3,xmm4
+; top of round
+	movdqa	xmm1,xmm9  ; 1 : i
+	movdqa	xmm5,xmm11  ; 2 : a/k
+	pandn	xmm1,xmm0  ; 1 = i<<4
+	psrld	xmm1,4  ; 1 = i
+	pand	xmm0,xmm9  ; 0 = k
+	pshufb	xmm5,xmm0  ; 2 = a/k
+	movdqa	xmm3,xmm10  ; 3 : 1/i
+	pxor	xmm0,xmm1  ; 0 = j
+	pshufb	xmm3,xmm1  ; 3 = 1/i
+	movdqa	xmm4,xmm10  ; 4 : 1/j
+	pxor	xmm3,xmm5  ; 3 = iak = 1/i + a/k
+	pshufb	xmm4,xmm0  ; 4 = 1/j
+	movdqa	xmm2,xmm10  ; 2 : 1/iak
+	pxor	xmm4,xmm5  ; 4 = jak = 1/j + a/k
+	pshufb	xmm2,xmm3  ; 2 = 1/iak
+	movdqa	xmm3,xmm10  ; 3 : 1/jak
+	pxor	xmm2,xmm0  ; 2 = io
+	pshufb	xmm3,xmm4  ; 3 = 1/jak
 	movdqu	xmm5,XMMWORDr9
-	pxor	xmm3,xmm1
+	pxor	xmm3,xmm1  ; 3 = jo
 	jnz	NEAR $L$enc_loop
 
-
-	movdqa	xmm4,XMMWORD((-96))+r10
-	movdqa	xmm0,XMMWORD((-80))+r10
-	pshufb	xmm4,xmm2
-	pxor	xmm4,xmm5
-	pshufb	xmm0,xmm3
-	movdqa	xmm1,XMMWORD64+r10*1+r11
-	pxor	xmm0,xmm4
+; middle of last round
+	movdqa	xmm4,XMMWORD((-96))+r10  ; 3 : sbou	.Lk_sbo
+	movdqa	xmm0,XMMWORD((-80))+r10  ; 0 : sbot	.Lk_sbo+16
+	pshufb	xmm4,xmm2  ; 4 = sbou
+	pxor	xmm4,xmm5  ; 4 = sb1u + k
+	pshufb	xmm0,xmm3  ; 0 = sb1t
+	movdqa	xmm1,XMMWORD64+r10*1+r11  ; .Lk_sr
+	pxor	xmm0,xmm4  ; 0 = A
 	pshufb	xmm0,xmm1
 	ret
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+; #
+; #  _aes_encrypt_core_2x
+; #
+; #  AES-encrypt %xmm0 and %xmm6 in parallel.
+; #
+; #  Inputs:
+; #     %xmm0 and %xmm6 = input
+; #     %xmm9 and %xmm10 as in _vpaes_preheat
+; #    (%rdx) = scheduled keys
+; #
+; #  Output in %xmm0 and %xmm6
+; #  Clobbers  %xmm1-%xmm5, %xmm7, %xmm8, %xmm11-%xmm13, %r9, %r10, %r11, %rax
+; #  Preserves %xmm14 and %xmm15
+; #
+; #  This function stitches two parallel instances of _vpaes_encrypt_core. x86_64
+; #  provides 16 XMM registers. _vpaes_encrypt_core computes over six registers
+; #  (%xmm0-%xmm5) and additionally uses seven registers with preloaded constants
+; #  from _vpaes_preheat (%xmm9-%xmm15). This does not quite fit two instances,
+; #  so we spill some of %xmm9 through %xmm15 back to memory. We keep %xmm9 and
+; #  %xmm10 in registers as these values are used several times in a row. The
+; #  remainder are read once per round and are spilled to memory. This leaves two
+; #  registers preserved for the caller.
+; #
+; #  Thus, of the two _vpaes_encrypt_core instances, the first uses (%xmm0-%xmm5)
+; #  as before. The second uses %xmm6-%xmm8,%xmm11-%xmm13. (Add 6 to %xmm2 and
+; #  below. Add 8 to %xmm3 and up.) Instructions in the second instance are
+; #  indented by one space.
+; #
+; #
 
 ALIGN	16
 _vpaes_encrypt_core_2x:
@@ -154,19 +154,19 @@
 	mov	eax,DWORD240+rdx
 	movdqa	xmm1,xmm9
 	movdqa	xmm7,xmm9
-	movdqa	xmm2,XMMWORD$L$k_ipt
+	movdqa	xmm2,XMMWORD$L$k_ipt  ; iptlo
 	movdqa	xmm8,xmm2
 	pandn	xmm1,xmm0
 	pandn	xmm7,xmm6
-	movdqu	xmm5,XMMWORDr9
-
+	movdqu	xmm5,XMMWORDr9  ; round0 key
+; Also use %xmm5 in the second instance.
 	psrld	xmm1,4
 	psrld	xmm7,4
 	pand	xmm0,xmm9
 	pand	xmm6,xmm9
 	pshufb	xmm2,xmm0
 	pshufb	xmm8,xmm6
-	movdqa	xmm0,XMMWORD(($L$k_ipt+16))
+	movdqa	xmm0,XMMWORD(($L$k_ipt+16))  ; ipthi
 	movdqa	xmm6,xmm0
 	pshufb	xmm0,xmm1
 	pshufb	xmm6,xmm7
@@ -180,110 +180,110 @@
 
 ALIGN	16
 $L$enc2x_loop:
-
-	movdqa	xmm4,XMMWORD$L$k_sb1
-	movdqa	xmm0,XMMWORD(($L$k_sb1+16))
+; middle of middle round
+	movdqa	xmm4,XMMWORD$L$k_sb1  ; 4 : sb1u
+	movdqa	xmm0,XMMWORD(($L$k_sb1+16))  ; 0 : sb1t
 	movdqa	xmm12,xmm4
 	movdqa	xmm6,xmm0
-	pshufb	xmm4,xmm2
+	pshufb	xmm4,xmm2  ; 4 = sb1u
 	pshufb	xmm12,xmm8
-	pshufb	xmm0,xmm3
+	pshufb	xmm0,xmm3  ; 0 = sb1t
 	pshufb	xmm6,xmm11
-	pxor	xmm4,xmm5
+	pxor	xmm4,xmm5  ; 4 = sb1u + k
 	pxor	xmm12,xmm5
-	movdqa	xmm5,XMMWORD$L$k_sb2
+	movdqa	xmm5,XMMWORD$L$k_sb2  ; 4 : sb2u
 	movdqa	xmm13,xmm5
-	pxor	xmm0,xmm4
+	pxor	xmm0,xmm4  ; 0 = A
 	pxor	xmm6,xmm12
-	movdqa	xmm1,XMMWORD((-64))+r10*1+r11
-
-	pshufb	xmm5,xmm2
+	movdqa	xmm1,XMMWORD((-64))+r10*1+r11  ; .Lk_mc_forward
+; Also use %xmm1 in the second instance.
+	pshufb	xmm5,xmm2  ; 4 = sb2u
 	pshufb	xmm13,xmm8
-	movdqa	xmm4,XMMWORDr10*1+r11
-
-	movdqa	xmm2,XMMWORD(($L$k_sb2+16))
+	movdqa	xmm4,XMMWORDr10*1+r11  ; .Lk_mc_backward
+; Also use %xmm4 in the second instance.
+	movdqa	xmm2,XMMWORD(($L$k_sb2+16))  ; 2 : sb2t
 	movdqa	xmm8,xmm2
-	pshufb	xmm2,xmm3
+	pshufb	xmm2,xmm3  ; 2 = sb2t
 	pshufb	xmm8,xmm11
-	movdqa	xmm3,xmm0
+	movdqa	xmm3,xmm0  ; 3 = A
 	movdqa	xmm11,xmm6
-	pxor	xmm2,xmm5
+	pxor	xmm2,xmm5  ; 2 = 2A
 	pxor	xmm8,xmm13
-	pshufb	xmm0,xmm1
+	pshufb	xmm0,xmm1  ; 0 = B
 	pshufb	xmm6,xmm1
-	add	r9,16
-	pxor	xmm0,xmm2
+	add	r9,16  ; next key
+	pxor	xmm0,xmm2  ; 0 = 2A+B
 	pxor	xmm6,xmm8
-	pshufb	xmm3,xmm4
+	pshufb	xmm3,xmm4  ; 3 = D
 	pshufb	xmm11,xmm4
-	add	r11,16
-	pxor	xmm3,xmm0
+	add	r11,16  ; next mc
+	pxor	xmm3,xmm0  ; 3 = 2A+B+D
 	pxor	xmm11,xmm6
-	pshufb	xmm0,xmm1
+	pshufb	xmm0,xmm1  ; 0 = 2B+C
 	pshufb	xmm6,xmm1
-	and	r11,0x30
-	sub	rax,1
-	pxor	xmm0,xmm3
+	and	r11,0x30  ; ... mod 4
+	sub	rax,1  ; nr--
+	pxor	xmm0,xmm3  ; 0 = 2A+3B+C+D
 	pxor	xmm6,xmm11
 
 $L$enc2x_entry:
-
-	movdqa	xmm1,xmm9
+; top of round
+	movdqa	xmm1,xmm9  ; 1 : i
 	movdqa	xmm7,xmm9
-	movdqa	xmm5,XMMWORD(($L$k_inv+16))
+	movdqa	xmm5,XMMWORD(($L$k_inv+16))  ; 2 : a/k
 	movdqa	xmm13,xmm5
-	pandn	xmm1,xmm0
+	pandn	xmm1,xmm0  ; 1 = i<<4
 	pandn	xmm7,xmm6
-	psrld	xmm1,4
+	psrld	xmm1,4  ; 1 = i
 	psrld	xmm7,4
-	pand	xmm0,xmm9
+	pand	xmm0,xmm9  ; 0 = k
 	pand	xmm6,xmm9
-	pshufb	xmm5,xmm0
+	pshufb	xmm5,xmm0  ; 2 = a/k
 	pshufb	xmm13,xmm6
-	movdqa	xmm3,xmm10
+	movdqa	xmm3,xmm10  ; 3 : 1/i
 	movdqa	xmm11,xmm10
-	pxor	xmm0,xmm1
+	pxor	xmm0,xmm1  ; 0 = j
 	pxor	xmm6,xmm7
-	pshufb	xmm3,xmm1
+	pshufb	xmm3,xmm1  ; 3 = 1/i
 	pshufb	xmm11,xmm7
-	movdqa	xmm4,xmm10
+	movdqa	xmm4,xmm10  ; 4 : 1/j
 	movdqa	xmm12,xmm10
-	pxor	xmm3,xmm5
+	pxor	xmm3,xmm5  ; 3 = iak = 1/i + a/k
 	pxor	xmm11,xmm13
-	pshufb	xmm4,xmm0
+	pshufb	xmm4,xmm0  ; 4 = 1/j
 	pshufb	xmm12,xmm6
-	movdqa	xmm2,xmm10
+	movdqa	xmm2,xmm10  ; 2 : 1/iak
 	movdqa	xmm8,xmm10
-	pxor	xmm4,xmm5
+	pxor	xmm4,xmm5  ; 4 = jak = 1/j + a/k
 	pxor	xmm12,xmm13
-	pshufb	xmm2,xmm3
+	pshufb	xmm2,xmm3  ; 2 = 1/iak
 	pshufb	xmm8,xmm11
-	movdqa	xmm3,xmm10
+	movdqa	xmm3,xmm10  ; 3 : 1/jak
 	movdqa	xmm11,xmm10
-	pxor	xmm2,xmm0
+	pxor	xmm2,xmm0  ; 2 = io
 	pxor	xmm8,xmm6
-	pshufb	xmm3,xmm4
+	pshufb	xmm3,xmm4  ; 3 = 1/jak
 	pshufb	xmm11,xmm12
 	movdqu	xmm5,XMMWORDr9
-
-	pxor	xmm3,xmm1
+; Also use %xmm5 in the second instance.
+	pxor	xmm3,xmm1  ; 3 = jo
 	pxor	xmm11,xmm7
 	jnz	NEAR $L$enc2x_loop
 
-
-	movdqa	xmm4,XMMWORD((-96))+r10
-	movdqa	xmm0,XMMWORD((-80))+r10
+; middle of last round
+	movdqa	xmm4,XMMWORD((-96))+r10  ; 3 : sbou	.Lk_sbo
+	movdqa	xmm0,XMMWORD((-80))+r10  ; 0 : sbot	.Lk_sbo+16
 	movdqa	xmm12,xmm4
 	movdqa	xmm6,xmm0
-	pshufb	xmm4,xmm2
+	pshufb	xmm4,xmm2  ; 4 = sbou
 	pshufb	xmm12,xmm8
-	pxor	xmm4,xmm5
+	pxor	xmm4,xmm5  ; 4 = sb1u + k
 	pxor	xmm12,xmm5
-	pshufb	xmm0,xmm3
+	pshufb	xmm0,xmm3  ; 0 = sb1t
 	pshufb	xmm6,xmm11
-	movdqa	xmm1,XMMWORD64+r10*1+r11
-
-	pxor	xmm0,xmm4
+	movdqa	xmm1,XMMWORD64+r10*1+r11  ; .Lk_sr
+; Also use %xmm1 in the second instance.
+	pxor	xmm0,xmm4  ; 0 = A
 	pxor	xmm6,xmm12
 	pshufb	xmm0,xmm1
 	pshufb	xmm6,xmm1
@@ -291,27 +291,27 @@
 
 
 
-
-
-
-
-
+; #
+; #  Decryption core
+; #
+; #  Same API as encryption core.
+; #
 
 ALIGN	16
 _vpaes_decrypt_core:
 
-	mov	r9,rdx
+	mov	r9,rdx  ; load key
 	mov	eax,DWORD240+rdx
 	movdqa	xmm1,xmm9
-	movdqa	xmm2,XMMWORD$L$k_dipt
+	movdqa	xmm2,XMMWORD$L$k_dipt  ; iptlo
 	pandn	xmm1,xmm0
 	mov	r11,rax
 	psrld	xmm1,4
-	movdqu	xmm5,XMMWORDr9
+	movdqu	xmm5,XMMWORDr9  ; round0 key
 	shl	r11,4
 	pand	xmm0,xmm9
 	pshufb	xmm2,xmm0
-	movdqa	xmm0,XMMWORD(($L$k_dipt+16))
+	movdqa	xmm0,XMMWORD(($L$k_dipt+16))  ; ipthi
 	xor	r11,0x30
 	lea	r10,$L$k_dsbd
 	pshufb	xmm0,xmm1
@@ -325,99 +325,99 @@
 
 ALIGN	16
 $L$dec_loop:
-
-
-
-	movdqa	xmm4,XMMWORD((-32))+r10
-	movdqa	xmm1,XMMWORD((-16))+r10
-	pshufb	xmm4,xmm2
-	pshufb	xmm1,xmm3
+; #
+; #  Inverse mix columns
+; #
+	movdqa	xmm4,XMMWORD((-32))+r10  ; 4 : sb9u
+	movdqa	xmm1,XMMWORD((-16))+r10  ; 0 : sb9t
+	pshufb	xmm4,xmm2  ; 4 = sb9u
+	pshufb	xmm1,xmm3  ; 0 = sb9t
 	pxor	xmm0,xmm4
-	movdqa	xmm4,XMMWORDr10
-	pxor	xmm0,xmm1
-	movdqa	xmm1,XMMWORD16+r10
-
-	pshufb	xmm4,xmm2
-	pshufb	xmm0,xmm5
-	pshufb	xmm1,xmm3
-	pxor	xmm0,xmm4
-	movdqa	xmm4,XMMWORD32+r10
-	pxor	xmm0,xmm1
-	movdqa	xmm1,XMMWORD48+r10
-
-	pshufb	xmm4,xmm2
-	pshufb	xmm0,xmm5
-	pshufb	xmm1,xmm3
-	pxor	xmm0,xmm4
-	movdqa	xmm4,XMMWORD64+r10
-	pxor	xmm0,xmm1
-	movdqa	xmm1,XMMWORD80+r10
-
-	pshufb	xmm4,xmm2
-	pshufb	xmm0,xmm5
-	pshufb	xmm1,xmm3
-	pxor	xmm0,xmm4
-	add	r9,16
+	movdqa	xmm4,XMMWORDr10  ; 4 : sbdu
+	pxor	xmm0,xmm1  ; 0 = ch
+	movdqa	xmm1,XMMWORD16+r10  ; 0 : sbdt
+
+	pshufb	xmm4,xmm2  ; 4 = sbdu
+	pshufb	xmm0,xmm5  ; MC ch
+	pshufb	xmm1,xmm3  ; 0 = sbdt
+	pxor	xmm0,xmm4  ; 4 = ch
+	movdqa	xmm4,XMMWORD32+r10  ; 4 : sbbu
+	pxor	xmm0,xmm1  ; 0 = ch
+	movdqa	xmm1,XMMWORD48+r10  ; 0 : sbbt
+
+	pshufb	xmm4,xmm2  ; 4 = sbbu
+	pshufb	xmm0,xmm5  ; MC ch
+	pshufb	xmm1,xmm3  ; 0 = sbbt
+	pxor	xmm0,xmm4  ; 4 = ch
+	movdqa	xmm4,XMMWORD64+r10  ; 4 : sbeu
+	pxor	xmm0,xmm1  ; 0 = ch
+	movdqa	xmm1,XMMWORD80+r10  ; 0 : sbet
+
+	pshufb	xmm4,xmm2  ; 4 = sbeu
+	pshufb	xmm0,xmm5  ; MC ch
+	pshufb	xmm1,xmm3  ; 0 = sbet
+	pxor	xmm0,xmm4  ; 4 = ch
+	add	r9,16  ; next round key
 	palignr	xmm5,xmm5,12
-	pxor	xmm0,xmm1
-	sub	rax,1
+	pxor	xmm0,xmm1  ; 0 = ch
+	sub	rax,1  ; nr--
 
 $L$dec_entry:
-
-	movdqa	xmm1,xmm9
-	pandn	xmm1,xmm0
-	movdqa	xmm2,xmm11
-	psrld	xmm1,4
-	pand	xmm0,xmm9
-	pshufb	xmm2,xmm0
-	movdqa	xmm3,xmm10
-	pxor	xmm0,xmm1
-	pshufb	xmm3,xmm1
-	movdqa	xmm4,xmm10
-	pxor	xmm3,xmm2
-	pshufb	xmm4,xmm0
-	pxor	xmm4,xmm2
-	movdqa	xmm2,xmm10
-	pshufb	xmm2,xmm3
-	movdqa	xmm3,xmm10
-	pxor	xmm2,xmm0
-	pshufb	xmm3,xmm4
+; top of round
+	movdqa	xmm1,xmm9  ; 1 : i
+	pandn	xmm1,xmm0  ; 1 = i<<4
+	movdqa	xmm2,xmm11  ; 2 : a/k
+	psrld	xmm1,4  ; 1 = i
+	pand	xmm0,xmm9  ; 0 = k
+	pshufb	xmm2,xmm0  ; 2 = a/k
+	movdqa	xmm3,xmm10  ; 3 : 1/i
+	pxor	xmm0,xmm1  ; 0 = j
+	pshufb	xmm3,xmm1  ; 3 = 1/i
+	movdqa	xmm4,xmm10  ; 4 : 1/j
+	pxor	xmm3,xmm2  ; 3 = iak = 1/i + a/k
+	pshufb	xmm4,xmm0  ; 4 = 1/j
+	pxor	xmm4,xmm2  ; 4 = jak = 1/j + a/k
+	movdqa	xmm2,xmm10  ; 2 : 1/iak
+	pshufb	xmm2,xmm3  ; 2 = 1/iak
+	movdqa	xmm3,xmm10  ; 3 : 1/jak
+	pxor	xmm2,xmm0  ; 2 = io
+	pshufb	xmm3,xmm4  ; 3 = 1/jak
 	movdqu	xmm0,XMMWORDr9
-	pxor	xmm3,xmm1
+	pxor	xmm3,xmm1  ; 3 = jo
 	jnz	NEAR $L$dec_loop
 
-
-	movdqa	xmm4,XMMWORD96+r10
-	pshufb	xmm4,xmm2
-	pxor	xmm4,xmm0
-	movdqa	xmm0,XMMWORD112+r10
-	movdqa	xmm2,XMMWORD((-352))+r11
-	pshufb	xmm0,xmm3
-	pxor	xmm0,xmm4
+; middle of last round
+	movdqa	xmm4,XMMWORD96+r10  ; 3 : sbou
+	pshufb	xmm4,xmm2  ; 4 = sbou
+	pxor	xmm4,xmm0  ; 4 = sb1u + k
+	movdqa	xmm0,XMMWORD112+r10  ; 0 : sbot
+	movdqa	xmm2,XMMWORD((-352))+r11  ; .Lk_sr-.Lk_dsbd=-0x160
+	pshufb	xmm0,xmm3  ; 0 = sb1t
+	pxor	xmm0,xmm4  ; 0 = A
 	pshufb	xmm0,xmm2
 	ret
 
 
 
-
-
-
-
-
+; #######################################################
+; #                                                    ##
+; #                  AES key schedule                  ##
+; #                                                    ##
+; #######################################################
 
 ALIGN	16
 _vpaes_schedule_core:
 
+; rdi = key
+; rsi = size in bits
+; rdx = buffer
+; rcx = direction.  0=encrypt, 1=decrypt
 
+	call	_vpaes_preheat  ; load the tables
+	movdqa	xmm8,XMMWORD$L$k_rcon  ; load rcon
+	movdqu	xmm0,XMMWORDrdi  ; load key (unaligned)
 
-
-
-
-	call	_vpaes_preheat
-	movdqa	xmm8,XMMWORD$L$k_rcon
-	movdqu	xmm0,XMMWORDrdi
-
-
+; input transform
 	movdqa	xmm3,xmm0
 	lea	r11,$L$k_ipt
 	call	_vpaes_schedule_transform
@@ -427,12 +427,12 @@
 	test	rcx,rcx
 	jnz	NEAR $L$schedule_am_decrypting
 
-
+; encrypting, output zeroth round key after transform
 	movdqu	XMMWORDrdx,xmm0
 	jmp	NEAR $L$schedule_go
 
 $L$schedule_am_decrypting:
-
+; decrypting, output zeroth round key after shiftrows
 	movdqa	xmm1,XMMWORDr10*1+r8
 	pshufb	xmm3,xmm1
 	movdqu	XMMWORDrdx,xmm3
@@ -442,16 +442,16 @@
 	cmp	esi,192
 	ja	NEAR $L$schedule_256
 	je	NEAR $L$schedule_192
-
-
-
-
-
-
-
-
-
-
+; 128: fall though
+
+; #
+; #  .schedule_128
+; #
+; #  128-bit specific part of key schedule.
+; #
+; #  This schedule is really simple, because all its parts
+; #  are accomplished by the subroutines.
+; #
 $L$schedule_128:
 	mov	esi,10
 
@@ -459,73 +459,73 @@
 	call	_vpaes_schedule_round
 	dec	rsi
 	jz	NEAR $L$schedule_mangle_last
-	call	_vpaes_schedule_mangle
+	call	_vpaes_schedule_mangle  ; write output
 	jmp	NEAR $L$oop_schedule_128
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+; #
+; #  .aes_schedule_192
+; #
+; #  192-bit specific part of key schedule.
+; #
+; #  The main body of this schedule is the same as the 128-bit
+; #  schedule, but with more smearing.  The long, high side is
+; #  stored in %xmm7 as before, and the short, low side is in
+; #  the high bits of %xmm6.
+; #
+; #  This schedule is somewhat nastier, however, because each
+; #  round produces 192 bits of key material, or 1.5 round keys.
+; #  Therefore, on each cycle we do 2 rounds and produce 3 round
+; #  keys.
+; #
 ALIGN	16
 $L$schedule_192:
-	movdqu	xmm0,XMMWORD8+rdi
-	call	_vpaes_schedule_transform
-	movdqa	xmm6,xmm0
-	pxor	xmm4,xmm4
-	movhlps	xmm6,xmm4
+	movdqu	xmm0,XMMWORD8+rdi  ; load key part 2 (very unaligned)
+	call	_vpaes_schedule_transform  ; input transform
+	movdqa	xmm6,xmm0  ; save short part
+	pxor	xmm4,xmm4  ; clear 4
+	movhlps	xmm6,xmm4  ; clobber low side with zeros
 	mov	esi,4
 
 $L$oop_schedule_192:
 	call	_vpaes_schedule_round
 	palignr	xmm0,xmm6,8
-	call	_vpaes_schedule_mangle
+	call	_vpaes_schedule_mangle  ; save key n
 	call	_vpaes_schedule_192_smear
-	call	_vpaes_schedule_mangle
+	call	_vpaes_schedule_mangle  ; save key n+1
 	call	_vpaes_schedule_round
 	dec	rsi
 	jz	NEAR $L$schedule_mangle_last
-	call	_vpaes_schedule_mangle
+	call	_vpaes_schedule_mangle  ; save key n+2
 	call	_vpaes_schedule_192_smear
 	jmp	NEAR $L$oop_schedule_192
 
-
-
-
-
-
-
-
-
-
-
+; #
+; #  .aes_schedule_256
+; #
+; #  256-bit specific part of key schedule.
+; #
+; #  The structure here is very similar to the 128-bit
+; #  schedule, but with an additional "low side" in
+; #  %xmm6.  The low side's rounds are the same as the
+; #  high side's, except no rcon and no rotation.
+; #
 ALIGN	16
 $L$schedule_256:
-	movdqu	xmm0,XMMWORD16+rdi
-	call	_vpaes_schedule_transform
+	movdqu	xmm0,XMMWORD16+rdi  ; load key part 2 (unaligned)
+	call	_vpaes_schedule_transform  ; input transform
 	mov	esi,7
 
 $L$oop_schedule_256:
-	call	_vpaes_schedule_mangle
-	movdqa	xmm6,xmm0
-
+	call	_vpaes_schedule_mangle  ; output low result
+	movdqa	xmm6,xmm0  ; save cur_lo in xmm6
 
+; high round
 	call	_vpaes_schedule_round
 	dec	rsi
 	jz	NEAR $L$schedule_mangle_last
 	call	_vpaes_schedule_mangle
 
-
+; low round. swap xmm7 and xmm6
 	pshufd	xmm0,xmm0,0xFF
 	movdqa	xmm5,xmm7
 	movdqa	xmm7,xmm6
@@ -535,36 +535,36 @@
 	jmp	NEAR $L$oop_schedule_256
 
 
-
-
-
-
-
-
-
-
-
-
+; #
+; #  .aes_schedule_mangle_last
+; #
+; #  Mangler for last round of key schedule
+; #  Mangles %xmm0
+; #    when encrypting, outputs out(%xmm0) ^ 63
+; #    when decrypting, outputs unskew(%xmm0)
+; #
+; #  Always called right before return... jumps to cleanup and exits
+; #
 ALIGN	16
 $L$schedule_mangle_last:
-
-	lea	r11,$L$k_deskew
+; schedule last round key from xmm0
+	lea	r11,$L$k_deskew  ; prepare to deskew
 	test	rcx,rcx
 	jnz	NEAR $L$schedule_mangle_last_dec
 
-
+; encrypting
 	movdqa	xmm1,XMMWORDr10*1+r8
-	pshufb	xmm0,xmm1
-	lea	r11,$L$k_opt
+	pshufb	xmm0,xmm1  ; output permute
+	lea	r11,$L$k_opt  ; prepare to output transform
 	add	rdx,32
 
 $L$schedule_mangle_last_dec:
 	add	rdx,-16
 	pxor	xmm0,XMMWORD$L$k_s63
-	call	_vpaes_schedule_transform
-	movdqu	XMMWORDrdx,xmm0
-
+	call	_vpaes_schedule_transform  ; output transform
+	movdqu	XMMWORDrdx,xmm0  ; save last key
 
+; cleanup
 	pxor	xmm0,xmm0
 	pxor	xmm1,xmm1
 	pxor	xmm2,xmm2
@@ -577,72 +577,72 @@
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+; #
+; #  .aes_schedule_192_smear
+; #
+; #  Smear the short, low side in the 192-bit key schedule.
+; #
+; #  Inputs:
+; #    %xmm7: high side, b  a  x  y
+; #    %xmm6:  low side, d  c  0  0
+; #    %xmm13: 0
+; #
+; #  Outputs:
+; #    %xmm6: b+c+d  b+c  0  0
+; #    %xmm0: b+c+d  b+c  b  a
+; #
 
 ALIGN	16
 _vpaes_schedule_192_smear:
 
-	pshufd	xmm1,xmm6,0x80
-	pshufd	xmm0,xmm7,0xFE
-	pxor	xmm6,xmm1
+	pshufd	xmm1,xmm6,0x80  ; d c 0 0 -> c 0 0 0
+	pshufd	xmm0,xmm7,0xFE  ; b a _ _ -> b b b a
+	pxor	xmm6,xmm1  ; -> c+d c 0 0
 	pxor	xmm1,xmm1
-	pxor	xmm6,xmm0
+	pxor	xmm6,xmm0  ; -> b+c+d b+c b a
 	movdqa	xmm0,xmm6
-	movhlps	xmm6,xmm1
+	movhlps	xmm6,xmm1  ; clobber low side with zeros
 	ret
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+; #
+; #  .aes_schedule_round
+; #
+; #  Runs one main round of the key schedule on %xmm0, %xmm7
+; #
+; #  Specifically, runs subbytes on the high dword of %xmm0
+; #  then rotates it by one byte and xors into the low dword of
+; #  %xmm7.
+; #
+; #  Adds rcon from low byte of %xmm8, then rotates %xmm8 for
+; #  next rcon.
+; #
+; #  Smears the dwords of %xmm7 by xoring the low into the
+; #  second low, result into third, result into highest.
+; #
+; #  Returns results in %xmm7 = %xmm0.
+; #  Clobbers %xmm1-%xmm4, %r11.
+; #
 
 ALIGN	16
 _vpaes_schedule_round:
 
-
+; extract rcon from xmm8
 	pxor	xmm1,xmm1
 	palignr	xmm1,xmm8,15
 	palignr	xmm8,xmm8,15
 	pxor	xmm7,xmm1
 
-
+; rotate
 	pshufd	xmm0,xmm0,0xFF
 	palignr	xmm0,xmm0,1
 
+; fall through...
 
-
-
+; low round: same as high round, but no rotation and no rcon.
 _vpaes_schedule_low_round:
-
+; smear xmm7
 	movdqa	xmm1,xmm7
 	pslldq	xmm7,4
 	pxor	xmm7,xmm1
@@ -651,48 +651,48 @@
 	pxor	xmm7,xmm1
 	pxor	xmm7,XMMWORD$L$k_s63
 
-
+; subbytes
 	movdqa	xmm1,xmm9
 	pandn	xmm1,xmm0
-	psrld	xmm1,4
-	pand	xmm0,xmm9
-	movdqa	xmm2,xmm11
-	pshufb	xmm2,xmm0
-	pxor	xmm0,xmm1
-	movdqa	xmm3,xmm10
-	pshufb	xmm3,xmm1
-	pxor	xmm3,xmm2
-	movdqa	xmm4,xmm10
-	pshufb	xmm4,xmm0
-	pxor	xmm4,xmm2
-	movdqa	xmm2,xmm10
-	pshufb	xmm2,xmm3
-	pxor	xmm2,xmm0
-	movdqa	xmm3,xmm10
-	pshufb	xmm3,xmm4
-	pxor	xmm3,xmm1
-	movdqa	xmm4,xmm13
-	pshufb	xmm4,xmm2
-	movdqa	xmm0,xmm12
-	pshufb	xmm0,xmm3
-	pxor	xmm0,xmm4
-
-
+	psrld	xmm1,4  ; 1 = i
+	pand	xmm0,xmm9  ; 0 = k
+	movdqa	xmm2,xmm11  ; 2 : a/k
+	pshufb	xmm2,xmm0  ; 2 = a/k
+	pxor	xmm0,xmm1  ; 0 = j
+	movdqa	xmm3,xmm10  ; 3 : 1/i
+	pshufb	xmm3,xmm1  ; 3 = 1/i
+	pxor	xmm3,xmm2  ; 3 = iak = 1/i + a/k
+	movdqa	xmm4,xmm10  ; 4 : 1/j
+	pshufb	xmm4,xmm0  ; 4 = 1/j
+	pxor	xmm4,xmm2  ; 4 = jak = 1/j + a/k
+	movdqa	xmm2,xmm10  ; 2 : 1/iak
+	pshufb	xmm2,xmm3  ; 2 = 1/iak
+	pxor	xmm2,xmm0  ; 2 = io
+	movdqa	xmm3,xmm10  ; 3 : 1/jak
+	pshufb	xmm3,xmm4  ; 3 = 1/jak
+	pxor	xmm3,xmm1  ; 3 = jo
+	movdqa	xmm4,xmm13  ; 4 : sbou
+	pshufb	xmm4,xmm2  ; 4 = sbou
+	movdqa	xmm0,xmm12  ; 0 : sbot
+	pshufb	xmm0,xmm3  ; 0 = sb1t
+	pxor	xmm0,xmm4  ; 0 = sbox output
+
+; add in smeared stuff
 	pxor	xmm0,xmm7
 	movdqa	xmm7,xmm0
 	ret
 
 
 
-
-
-
-
-
-
-
-
-
+; #
+; #  .aes_schedule_transform
+; #
+; #  Linear-transform %xmm0 according to tables at (%r11)
+; #
+; #  Requires that %xmm9 = 0x0F0F... as in preheat
+; #  Output in %xmm0
+; #  Clobbers %xmm1, %xmm2
+; #
 
 ALIGN	16
 _vpaes_schedule_transform:
@@ -701,48 +701,48 @@
 	pandn	xmm1,xmm0
 	psrld	xmm1,4
 	pand	xmm0,xmm9
-	movdqa	xmm2,XMMWORDr11
+	movdqa	xmm2,XMMWORDr11  ; lo
 	pshufb	xmm2,xmm0
-	movdqa	xmm0,XMMWORD16+r11
+	movdqa	xmm0,XMMWORD16+r11  ; hi
 	pshufb	xmm0,xmm1
 	pxor	xmm0,xmm2
 	ret
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+; #
+; #  .aes_schedule_mangle
+; #
+; #  Mangle xmm0 from (basis-transformed) standard version
+; #  to our version.
+; #
+; #  On encrypt,
+; #    xor with 0x63
+; #    multiply by circulant 0,1,1,1
+; #    apply shiftrows transform
+; #
+; #  On decrypt,
+; #    xor with 0x63
+; #    multiply by "inverse mixcolumns" circulant E,B,D,9
+; #    deskew
+; #    apply shiftrows transform
+; #
+; #
+; #  Writes out to (%rdx), and increments or decrements it
+; #  Keeps track of round number mod 4 in %r8
+; #  Preserves xmm0
+; #  Clobbers xmm1-xmm5
+; #
 
 ALIGN	16
 _vpaes_schedule_mangle:
 
-	movdqa	xmm4,xmm0
+	movdqa	xmm4,xmm0  ; save xmm0 for later
 	movdqa	xmm5,XMMWORD$L$k_mc_forward
 	test	rcx,rcx
 	jnz	NEAR $L$schedule_mangle_dec
 
-
+; encrypting
 	add	rdx,16
 	pxor	xmm4,XMMWORD$L$k_s63
 	pshufb	xmm4,xmm5
@@ -755,12 +755,12 @@
 	jmp	NEAR $L$schedule_mangle_both
 ALIGN	16
 $L$schedule_mangle_dec:
-
+; inverse mix columns
 	lea	r11,$L$k_dksd
 	movdqa	xmm1,xmm9
 	pandn	xmm1,xmm4
-	psrld	xmm1,4
-	pand	xmm4,xmm9
+	psrld	xmm1,4  ; 1 = hi
+	pand	xmm4,xmm9  ; 4 = lo
 
 	movdqa	xmm2,XMMWORDr11
 	pshufb	xmm2,xmm4
@@ -804,9 +804,9 @@
 
 
 
-
-
-
+; 
+; Interface to OpenSSL
+; 
 global	vpaes_set_encrypt_key
 
 ALIGN	16
@@ -842,7 +842,7 @@
 	mov	eax,esi
 	shr	eax,5
 	add	eax,5
-	mov	DWORD240+rdx,eax
+	mov	DWORD240+rdx,eax  ; AES_KEY->rounds = nbits/32+5;
 
 	mov	ecx,0
 	mov	r8d,0x30
@@ -896,7 +896,7 @@
 	mov	eax,esi
 	shr	eax,5
 	add	eax,5
-	mov	DWORD240+rdx,eax
+	mov	DWORD240+rdx,eax  ; AES_KEY->rounds = nbits/32+5;
 	shl	eax,4
 	lea	rdx,16+rax*1+rdx
 
@@ -904,7 +904,7 @@
 	mov	r8d,esi
 	shr	r8d,1
 	and	r8d,32
-	xor	r8d,32
+	xor	r8d,32  ; nbits==192?0:32
 	call	_vpaes_schedule_core
 	movaps	xmm6,XMMWORD16+rsp
 	movaps	xmm7,XMMWORD32+rsp
@@ -1059,7 +1059,7 @@
 	movaps	XMMWORD144+rsp,xmm14
 	movaps	XMMWORD160+rsp,xmm15
 $L$cbc_body:
-	movdqu	xmm6,XMMWORDr8
+	movdqu	xmm6,XMMWORDr8  ; load IV
 	sub	rsi,rdi
 	call	_vpaes_preheat
 	cmp	r9d,0
@@ -1088,7 +1088,7 @@
 	sub	rcx,16
 	jnc	NEAR $L$cbc_dec_loop
 $L$cbc_done:
-	movdqu	XMMWORDr8,xmm6
+	movdqu	XMMWORDr8,xmm6  ; save IV
 	movaps	xmm6,XMMWORD16+rsp
 	movaps	xmm7,XMMWORD32+rsp
 	movaps	xmm8,XMMWORD48+rsp
@@ -1124,7 +1124,7 @@
 
 
 _CET_ENDBR
-
+; _vpaes_encrypt_core and _vpaes_encrypt_core_2x expect the key in %rdx.
 	xchg	rdx,rcx
 	test	rcx,rcx
 	jz	NEAR $L$ctr32_abort
@@ -1140,9 +1140,9 @@
 	movaps	XMMWORD144+rsp,xmm14
 	movaps	XMMWORD160+rsp,xmm15
 $L$ctr32_body:
-	movdqu	xmm0,XMMWORDr8
+	movdqu	xmm0,XMMWORDr8  ; Load IV.
 	movdqa	xmm8,XMMWORD$L$ctr_add_one
-	sub	rsi,rdi
+	sub	rsi,rdi  ; This allows only incrementing %rdi.
 	call	_vpaes_preheat
 	movdqa	xmm6,xmm0
 	pshufb	xmm6,XMMWORD$L$rev_ctr
@@ -1150,9 +1150,9 @@
 	test	rcx,1
 	jz	NEAR $L$ctr32_prep_loop
 
-
-
-	movdqu	xmm7,XMMWORDrdi
+; Handle one block so the remaining block count is even for
+; _vpaes_encrypt_core_2x.
+	movdqu	xmm7,XMMWORDrdi  ; Load input.
 	call	_vpaes_encrypt_core
 	pxor	xmm0,xmm7
 	paddd	xmm6,xmm8
@@ -1162,29 +1162,29 @@
 	jz	NEAR $L$ctr32_done
 
 $L$ctr32_prep_loop:
-
-
+; _vpaes_encrypt_core_2x leaves only %xmm14 and %xmm15 as spare
+; registers. We maintain two byte-swapped counters in them.
 	movdqa	xmm14,xmm6
 	movdqa	xmm15,xmm6
 	paddd	xmm15,xmm8
 
 $L$ctr32_loop:
-	movdqa	xmm1,XMMWORD$L$rev_ctr
+	movdqa	xmm1,XMMWORD$L$rev_ctr  ; Set up counters.
 	movdqa	xmm0,xmm14
 	movdqa	xmm6,xmm15
 	pshufb	xmm0,xmm1
 	pshufb	xmm6,xmm1
 	call	_vpaes_encrypt_core_2x
-	movdqu	xmm1,XMMWORDrdi
+	movdqu	xmm1,XMMWORDrdi  ; Load input.
 	movdqu	xmm2,XMMWORD16+rdi
 	movdqa	xmm3,XMMWORD$L$ctr_add_two
-	pxor	xmm0,xmm1
+	pxor	xmm0,xmm1  ; XOR input.
 	pxor	xmm6,xmm2
-	paddd	xmm14,xmm3
+	paddd	xmm14,xmm3  ; Increment counters.
 	paddd	xmm15,xmm3
-	movdqu	XMMWORDrdi*1+rsi,xmm0
+	movdqu	XMMWORDrdi*1+rsi,xmm0  ; Write output.
 	movdqu	XMMWORD16+rdi*1+rsi,xmm6
-	sub	rcx,2
+	sub	rcx,2  ; Advance loop.
 	lea	rdi,32+rdi
 	jnz	NEAR $L$ctr32_loop
 
@@ -1207,135 +1207,135 @@
 	ret
 
 $L$SEH_end_vpaes_ctr32_encrypt_blocks:
-
-
-
-
-
-
+; #
+; #  _aes_preheat
+; #
+; #  Fills register %r10 -> .aes_consts (so you can -fPIC)
+; #  and %xmm9-%xmm15 as specified below.
+; #
 
 ALIGN	16
 _vpaes_preheat:
 
 	lea	r10,$L$k_s0F
-	movdqa	xmm10,XMMWORD((-32))+r10
-	movdqa	xmm11,XMMWORD((-16))+r10
-	movdqa	xmm9,XMMWORDr10
-	movdqa	xmm13,XMMWORD48+r10
-	movdqa	xmm12,XMMWORD64+r10
-	movdqa	xmm15,XMMWORD80+r10
-	movdqa	xmm14,XMMWORD96+r10
+	movdqa	xmm10,XMMWORD((-32))+r10  ; .Lk_inv
+	movdqa	xmm11,XMMWORD((-16))+r10  ; .Lk_inv+16
+	movdqa	xmm9,XMMWORDr10  ; .Lk_s0F
+	movdqa	xmm13,XMMWORD48+r10  ; .Lk_sb1
+	movdqa	xmm12,XMMWORD64+r10  ; .Lk_sb1+16
+	movdqa	xmm15,XMMWORD80+r10  ; .Lk_sb2
+	movdqa	xmm14,XMMWORD96+r10  ; .Lk_sb2+16
 	ret
 
 
-
-
-
-
-
+; #######################################################
+; #                                                    ##
+; #                     Constants                      ##
+; #                                                    ##
+; #######################################################
 
 section	.rdata rdata align=8
 ALIGN	64
 _vpaes_consts:
-$L$k_inv:
+$L$k_inv:  ; inv, inva
 	DQ	0x0E05060F0D080180,0x040703090A0B0C02
 	DQ	0x01040A060F0B0780,0x030D0E0C02050809
 
-$L$k_s0F:
+$L$k_s0F:  ; s0F
 	DQ	0x0F0F0F0F0F0F0F0F,0x0F0F0F0F0F0F0F0F
 
-$L$k_ipt:
+$L$k_ipt:  ; input transform (lo, hi)
 	DQ	0xC2B2E8985A2A7000,0xCABAE09052227808
 	DQ	0x4C01307D317C4D00,0xCD80B1FCB0FDCC81
 
-$L$k_sb1:
+$L$k_sb1:  ; sb1u, sb1t
 	DQ	0xB19BE18FCB503E00,0xA5DF7A6E142AF544
 	DQ	0x3618D415FAE22300,0x3BF7CCC10D2ED9EF
-$L$k_sb2:
+$L$k_sb2:  ; sb2u, sb2t
 	DQ	0xE27A93C60B712400,0x5EB7E955BC982FCD
 	DQ	0x69EB88400AE12900,0xC2A163C8AB82234A
-$L$k_sbo:
+$L$k_sbo:  ; sbou, sbot
 	DQ	0xD0D26D176FBDC700,0x15AABF7AC502A878
 	DQ	0xCFE474A55FBB6A00,0x8E1E90D1412B35FA
 
-$L$k_mc_forward:
+$L$k_mc_forward:  ; mc_forward
 	DQ	0x0407060500030201,0x0C0F0E0D080B0A09
 	DQ	0x080B0A0904070605,0x000302010C0F0E0D
 	DQ	0x0C0F0E0D080B0A09,0x0407060500030201
 	DQ	0x000302010C0F0E0D,0x080B0A0904070605
 
-$L$k_mc_backward:
+$L$k_mc_backward:  ; mc_backward
 	DQ	0x0605040702010003,0x0E0D0C0F0A09080B
 	DQ	0x020100030E0D0C0F,0x0A09080B06050407
 	DQ	0x0E0D0C0F0A09080B,0x0605040702010003
 	DQ	0x0A09080B06050407,0x020100030E0D0C0F
 
-$L$k_sr:
+$L$k_sr:  ; sr
 	DQ	0x0706050403020100,0x0F0E0D0C0B0A0908
 	DQ	0x030E09040F0A0500,0x0B06010C07020D08
 	DQ	0x0F060D040B020900,0x070E050C030A0108
 	DQ	0x0B0E0104070A0D00,0x0306090C0F020508
 
-$L$k_rcon:
+$L$k_rcon:  ; rcon
 	DQ	0x1F8391B9AF9DEEB6,0x702A98084D7C7D81
 
-$L$k_s63:
+$L$k_s63:  ; s63: all equal to 0x63 transformed
 	DQ	0x5B5B5B5B5B5B5B5B,0x5B5B5B5B5B5B5B5B
 
-$L$k_opt:
+$L$k_opt:  ; output transform
 	DQ	0xFF9F4929D6B66000,0xF7974121DEBE6808
 	DQ	0x01EDBD5150BCEC00,0xE10D5DB1B05C0CE0
 
-$L$k_deskew:
+$L$k_deskew:  ; deskew tables: inverts the sbox's "skew"
 	DQ	0x07E4A34047A4E300,0x1DFEB95A5DBEF91A
 	DQ	0x5F36B5DC83EA6900,0x2841C2ABF49D1E77
 
-
-
-
-
-$L$k_dksd:
+; #
+; #  Decryption stuff
+; #  Key schedule constants
+; #
+$L$k_dksd:  ; decryption key schedule: invskew x*D
 	DQ	0xFEB91A5DA3E44700,0x0740E3A45A1DBEF9
 	DQ	0x41C277F4B5368300,0x5FDC69EAAB289D1E
-$L$k_dksb:
+$L$k_dksb:  ; decryption key schedule: invskew x*B
 	DQ	0x9A4FCA1F8550D500,0x03D653861CC94C99
 	DQ	0x115BEDA7B6FC4A00,0xD993256F7E3482C8
-$L$k_dkse:
+$L$k_dkse:  ; decryption key schedule: invskew x*E + 0x63
 	DQ	0xD5031CCA1FC9D600,0x53859A4C994F5086
 	DQ	0xA23196054FDC7BE8,0xCD5EF96A20B31487
-$L$k_dks9:
+$L$k_dks9:  ; decryption key schedule: invskew x*9
 	DQ	0xB6116FC87ED9A700,0x4AED933482255BFC
 	DQ	0x4576516227143300,0x8BB89FACE9DAFDCE
 
-
-
-
-
-$L$k_dipt:
+; #
+; #  Decryption stuff
+; #  Round function constants
+; #
+$L$k_dipt:  ; decryption input transform
 	DQ	0x0F505B040B545F00,0x154A411E114E451A
 	DQ	0x86E383E660056500,0x12771772F491F194
 
-$L$k_dsb9:
+$L$k_dsb9:  ; decryption sbox output *9*u, *9*t
 	DQ	0x851C03539A86D600,0xCAD51F504F994CC9
 	DQ	0xC03B1789ECD74900,0x725E2C9EB2FBA565
-$L$k_dsbd:
+$L$k_dsbd:  ; decryption sbox output *D*u, *D*t
 	DQ	0x7D57CCDFE6B1A200,0xF56E9B13882A4439
 	DQ	0x3CE2FAF724C6CB00,0x2931180D15DEEFD3
-$L$k_dsbb:
+$L$k_dsbb:  ; decryption sbox output *B*u, *B*t
 	DQ	0xD022649296B44200,0x602646F6B0F2D404
 	DQ	0xC19498A6CD596700,0xF3FF0C3E3255AA6B
-$L$k_dsbe:
+$L$k_dsbe:  ; decryption sbox output *E*u, *E*t
 	DQ	0x46F2929626D4D000,0x2242600464B4F6B0
 	DQ	0x0C55A6CDFFAAC100,0x9467F36B98593E32
-$L$k_dsbo:
+$L$k_dsbo:  ; decryption sbox final output
 	DQ	0x1387EA537EF94000,0xC7AA6DB9D4943E2D
 	DQ	0x12D7560F93441D00,0xCA4B8159D8C58E9C
 
-
+; .Lrev_ctr is a permutation which byte-swaps the counter portion of the IV.
 $L$rev_ctr:
 	DQ	0x0706050403020100,0x0c0d0e0f0b0a0908
-
-
+; .Lctr_add_* may be added to a byte-swapped xmm register to increment the
+; counter. The register must be byte-swapped again to form the actual input.
 $L$ctr_add_one:
 	DQ	0x0000000000000000,0x0000000100000000
 $L$ctr_add_two:
@@ -1348,7 +1348,7 @@
 	DB	85,110,105,118,101,114,115,105,116,121,41,0
 ALIGN	64
 
-section	.text
+section	.text code align=64
 
 EXTERN	__imp_RtlVirtualUnwind
 
@@ -1365,57 +1365,57 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; prologue label
+	cmp	rbx,r10  ; context->Rip<prologue label
 	jb	NEAR $L$in_prologue
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$in_prologue
 
-	lea	rsi,16+rax
-	lea	rdi,512+r8
-	mov	ecx,20
-	DD	0xa548f3fc
-	lea	rax,184+rax
+	lea	rsi,16+rax  ; %xmm save area
+	lea	rdi,512+r8  ; &context.Xmm6
+	mov	ecx,20  ; 10*sizeof(%xmm0)/sizeof(%rax)
+	DD	0xa548f3fc  ; cld; rep movsq
+	lea	rax,184+rax  ; adjust stack pointer
 
 $L$in_prologue:
 	mov	rdi,QWORD8+rax
 	mov	rsi,QWORD16+rax
-	mov	QWORD152+r8,rax
-	mov	QWORD168+r8,rsi
-	mov	QWORD176+r8,rdi
+	mov	QWORD152+r8,rax  ; restore context->Rsp
+	mov	QWORD168+r8,rsi  ; restore context->Rsi
+	mov	QWORD176+r8,rdi  ; restore context->Rdi
 
-	mov	rdi,QWORD40+r9
-	mov	rsi,r8
-	mov	ecx,154
-	DD	0xa548f3fc
+	mov	rdi,QWORD40+r9  ; disp->ContextRecord
+	mov	rsi,r8  ; context
+	mov	ecx,154  ; sizeof(CONTEXT)
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	mov	rsi,r9
-	xor	rcx,rcx
-	mov	rdx,QWORD8+rsi
-	mov	r8,QWORDrsi
-	mov	r9,QWORD16+rsi
-	mov	r10,QWORD40+rsi
-	lea	r11,56+rsi
-	lea	r12,24+rsi
-	mov	QWORD32+rsp,r10
-	mov	QWORD40+rsp,r11
-	mov	QWORD48+rsp,r12
-	mov	QWORD56+rsp,rcx
+	xor	rcx,rcx  ; arg1, UNW_FLAG_NHANDLER
+	mov	rdx,QWORD8+rsi  ; arg2, disp->ImageBase
+	mov	r8,QWORDrsi  ; arg3, disp->ControlPc
+	mov	r9,QWORD16+rsi  ; arg4, disp->FunctionEntry
+	mov	r10,QWORD40+rsi  ; disp->ContextRecord
+	lea	r11,56+rsi  ; &disp->HandlerData
+	lea	r12,24+rsi  ; &disp->EstablisherFrame
+	mov	QWORD32+rsp,r10  ; arg5
+	mov	QWORD40+rsp,r11  ; arg6
+	mov	QWORD48+rsp,r12  ; arg7
+	mov	QWORD56+rsp,rcx  ; arg8, (NULL)
 	call	QWORD__imp_RtlVirtualUnwind
 
-	mov	eax,1
+	mov	eax,1  ; ExceptionContinueSearch
 	add	rsp,64
 	popfq
 	pop	r15
@@ -1460,27 +1460,27 @@
 $L$SEH_info_vpaes_set_encrypt_key:
 	DB	9,0,0,0
 	DD	se_handler wrt ..imagebase
-	DD	$L$enc_key_body wrt ..imagebase,$L$enc_key_epilogue wrt ..imagebase
+	DD	$L$enc_key_body wrt ..imagebase,$L$enc_key_epilogue wrt ..imagebase  ; HandlerData
 $L$SEH_info_vpaes_set_decrypt_key:
 	DB	9,0,0,0
 	DD	se_handler wrt ..imagebase
-	DD	$L$dec_key_body wrt ..imagebase,$L$dec_key_epilogue wrt ..imagebase
+	DD	$L$dec_key_body wrt ..imagebase,$L$dec_key_epilogue wrt ..imagebase  ; HandlerData
 $L$SEH_info_vpaes_encrypt:
 	DB	9,0,0,0
 	DD	se_handler wrt ..imagebase
-	DD	$L$enc_body wrt ..imagebase,$L$enc_epilogue wrt ..imagebase
+	DD	$L$enc_body wrt ..imagebase,$L$enc_epilogue wrt ..imagebase  ; HandlerData
 $L$SEH_info_vpaes_decrypt:
 	DB	9,0,0,0
 	DD	se_handler wrt ..imagebase
-	DD	$L$dec_body wrt ..imagebase,$L$dec_epilogue wrt ..imagebase
+	DD	$L$dec_body wrt ..imagebase,$L$dec_epilogue wrt ..imagebase  ; HandlerData
 $L$SEH_info_vpaes_cbc_encrypt:
 	DB	9,0,0,0
 	DD	se_handler wrt ..imagebase
-	DD	$L$cbc_body wrt ..imagebase,$L$cbc_epilogue wrt ..imagebase
+	DD	$L$cbc_body wrt ..imagebase,$L$cbc_epilogue wrt ..imagebase  ; HandlerData
 $L$SEH_info_vpaes_ctr32_encrypt_blocks:
 	DB	9,0,0,0
 	DD	se_handler wrt ..imagebase
-	DD	$L$ctr32_body wrt ..imagebase,$L$ctr32_epilogue wrt ..imagebase
+	DD	$L$ctr32_body wrt ..imagebase,$L$ctr32_epilogue wrt ..imagebase  ; HandlerData
 %else
 ; Work around https://bugzilla.nasm.us/show_bug.cgi?id=3392738
 ret

boringssl-0.20260708.tar.xz/gen/bcm/x86_64-mont-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/x86_64-mont-apple.S Changed

@@ -31,18 +31,18 @@
 
 	negq	%r9
 	movq	%rsp,%r11
-	leaq	-16(%rsp,%r9,8),%r10
-	negq	%r9
-	andq	$-1024,%r10
-
-
-
-
-
-
-
-
-
+	leaq	-16(%rsp,%r9,8),%r10  // future alloca(8*(num+2))
+	negq	%r9  // restore %r9
+	andq	$-1024,%r10  // minimize TLB usage
+
+// An OS-agnostic version of __chkstk.
+// 
+// Some OSes (Windows) insist on stack being "wired" to
+// physical memory in strictly sequential manner, i.e. if stack
+// allocation spans two pages, then reference to farmost one can
+// be punishable by SEGV. But page walking can do good even on
+// other OSes, because it guarantees that villain thread hits
+// the guard page before it can make damage to innocent one...
 	subq	%r10,%r11
 	andq	$-4096,%r11
 	leaq	(%r10,%r11,1),%rsp
@@ -59,32 +59,32 @@
 	ja	L$mul_page_walk
 L$mul_page_walk_done:
 
-	movq	%rax,8(%rsp,%r9,8)
+	movq	%rax,8(%rsp,%r9,8)  // tpnum+1=%rsp
 
 L$mul_body:
-	movq	%rdx,%r12
-	movq	(%r8),%r8
-	movq	(%r12),%rbx
+	movq	%rdx,%r12  // reassign %rdx
+	movq	(%r8),%r8  // pull n00 value
+	movq	(%r12),%rbx  // m0=bp0
 	movq	(%rsi),%rax
 
-	xorq	%r14,%r14
-	xorq	%r15,%r15
+	xorq	%r14,%r14  // i=0
+	xorq	%r15,%r15  // j=0
 
 	movq	%r8,%rbp
-	mulq	%rbx
+	mulq	%rbx  // ap0*bp0
 	movq	%rax,%r10
 	movq	(%rcx),%rax
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // "tp0"*n0
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // discarded
 	movq	8(%rsi),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r13
 
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 	jmp	L$1st_enter
 
 .p2align	4
@@ -92,30 +92,30 @@
 	addq	%rax,%r13
 	movq	(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r11,%r13
+	addq	%r11,%r13  // npj*m1+apj*bp0
 	movq	%r10,%r11
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r15,8)
+	movq	%r13,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 L$1st_enter:
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	cmpq	%r9,%r15
 	jne	L$1st
 
 	addq	%rax,%r13
-	movq	(%rsi),%rax
+	movq	(%rsi),%rax  // ap0
 	adcq	$0,%rdx
-	addq	%r11,%r13
+	addq	%r11,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r15,8)
+	movq	%r13,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 	movq	%r10,%r11
 
@@ -123,32 +123,32 @@
 	addq	%r11,%r13
 	adcq	$0,%rdx
 	movq	%r13,-8(%rsp,%r9,8)
-	movq	%rdx,(%rsp,%r9,8)
+	movq	%rdx,(%rsp,%r9,8)  // store upmost overflow bit
 
-	leaq	1(%r14),%r14
+	leaq	1(%r14),%r14  // i++
 	jmp	L$outer
 .p2align	4
 L$outer:
-	movq	(%r12,%r14,8),%rbx
-	xorq	%r15,%r15
+	movq	(%r12,%r14,8),%rbx  // m0=bpi
+	xorq	%r15,%r15  // j=0
 	movq	%r8,%rbp
 	movq	(%rsp),%r10
-	mulq	%rbx
-	addq	%rax,%r10
+	mulq	%rbx  // ap0*bpi
+	addq	%rax,%r10  // ap0*bpi+tp0
 	movq	(%rcx),%rax
 	adcq	$0,%rdx
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // tp0*n0
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // discarded
 	movq	8(%rsi),%rax
 	adcq	$0,%rdx
-	movq	8(%rsp),%r10
+	movq	8(%rsp),%r10  // tp1
 	movq	%rdx,%r13
 
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 	jmp	L$inner_enter
 
 .p2align	4
@@ -156,80 +156,80 @@
 	addq	%rax,%r13
 	movq	(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bpi+tpj
 	movq	(%rsp,%r15,8),%r10
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r15,8)
+	movq	%r13,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 L$inner_enter:
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r11,%r10
+	addq	%r11,%r10  // apj*bpi+tpj
 	movq	%rdx,%r11
 	adcq	$0,%r11
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	cmpq	%r9,%r15
 	jne	L$inner
 
 	addq	%rax,%r13
-	movq	(%rsi),%rax
+	movq	(%rsi),%rax  // ap0
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bpi+tpj
 	movq	(%rsp,%r15,8),%r10
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r15,8)
+	movq	%r13,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 	xorq	%rdx,%rdx
 	addq	%r11,%r13
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // pull upmost overflow bit
 	adcq	$0,%rdx
 	movq	%r13,-8(%rsp,%r9,8)
-	movq	%rdx,(%rsp,%r9,8)
+	movq	%rdx,(%rsp,%r9,8)  // store upmost overflow bit
 
-	leaq	1(%r14),%r14
+	leaq	1(%r14),%r14  // i++
 	cmpq	%r9,%r14
 	jb	L$outer
 
-	xorq	%r14,%r14
-	movq	(%rsp),%rax
-	movq	%r9,%r15
+	xorq	%r14,%r14  // i=0 and clear CF
+	movq	(%rsp),%rax  // tp0
+	movq	%r9,%r15  // j=num
 
 .p2align	4
 L$sub:	sbbq	(%rcx,%r14,8),%rax
-	movq	%rax,(%rdi,%r14,8)
-	movq	8(%rsp,%r14,8),%rax
-	leaq	1(%r14),%r14
-	decq	%r15
+	movq	%rax,(%rdi,%r14,8)  // rpi=tpi-npi
+	movq	8(%rsp,%r14,8),%rax  // tpi+1
+	leaq	1(%r14),%r14  // i++
+	decq	%r15  // doesn't affect CF
 	jnz	L$sub
 
-	sbbq	$0,%rax
+	sbbq	$0,%rax  // handle upmost overflow bit
 	movq	$-1,%rbx
-	xorq	%rax,%rbx
+	xorq	%rax,%rbx  // not %rax
 	xorq	%r14,%r14
-	movq	%r9,%r15
+	movq	%r9,%r15  // j=num
 
-L$copy:
+L$copy:  // conditional copy
 	movq	(%rdi,%r14,8),%rcx
 	movq	(%rsp,%r14,8),%rdx
 	andq	%rbx,%rcx
 	andq	%rax,%rdx
-	movq	%r9,(%rsp,%r14,8)
+	movq	%r9,(%rsp,%r14,8)  // zap temporary vector
 	orq	%rcx,%rdx
-	movq	%rdx,(%rdi,%r14,8)
+	movq	%rdx,(%rdi,%r14,8)  // rpi=tpi
 	leaq	1(%r14),%r14
 	subq	$1,%r15
 	jnz	L$copy
 
-	movq	8(%rsp,%r9,8),%rsi
-
+	movq	8(%rsp,%r9,8),%rsi  // restore %rsp
 
+// No return value
 	movq	-48(%rsi),%r15
 
 	movq	-40(%rsi),%r14
@@ -274,9 +274,9 @@
 
 	negq	%r9
 	movq	%rsp,%r11
-	leaq	-32(%rsp,%r9,8),%r10
-	negq	%r9
-	andq	$-1024,%r10
+	leaq	-32(%rsp,%r9,8),%r10  // future alloca(8*(num+4))
+	negq	%r9  // restore
+	andq	$-1024,%r10  // minimize TLB usage
 
 	subq	%r10,%r11
 	andq	$-4096,%r11
@@ -293,28 +293,28 @@
 	ja	L$mul4x_page_walk
 L$mul4x_page_walk_done:
 
-	movq	%rax,8(%rsp,%r9,8)
+	movq	%rax,8(%rsp,%r9,8)  // tpnum+1=%rsp
 
 L$mul4x_body:
-	movq	%rdi,16(%rsp,%r9,8)
-	movq	%rdx,%r12
-	movq	(%r8),%r8
-	movq	(%r12),%rbx
+	movq	%rdi,16(%rsp,%r9,8)  // tpnum+2=%rdi
+	movq	%rdx,%r12  // reassign %r12
+	movq	(%r8),%r8  // pull n00 value
+	movq	(%r12),%rbx  // m0=bp0
 	movq	(%rsi),%rax
 
-	xorq	%r14,%r14
-	xorq	%r15,%r15
+	xorq	%r14,%r14  // i=0
+	xorq	%r15,%r15  // j=0
 
 	movq	%r8,%rbp
-	mulq	%rbx
+	mulq	%rbx  // ap0*bp0
 	movq	%rax,%r10
 	movq	(%rcx),%rax
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // "tp0"*n0
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // discarded
 	movq	8(%rsi),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rdi
@@ -330,171 +330,171 @@
 	movq	16(%rsi),%rax
 	adcq	$0,%rdx
 	addq	%r11,%rdi
-	leaq	4(%r15),%r15
+	leaq	4(%r15),%r15  // j++
 	adcq	$0,%rdx
 	movq	%rdi,(%rsp)
 	movq	%rdx,%r13
 	jmp	L$1st4x
 .p2align	4
 L$1st4x:
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r10
 	movq	-16(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-24(%rsp,%r15,8)
+	movq	%r13,-24(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	-8(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r11,%rdi
+	addq	%r11,%rdi  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%rdi,-16(%rsp,%r15,8)
+	movq	%rdi,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r10
 	movq	(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	8(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-8(%rsp,%r15,8)
+	movq	%r13,-8(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	8(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	leaq	4(%r15),%r15
+	leaq	4(%r15),%r15  // j++
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	-16(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r11,%rdi
+	addq	%r11,%rdi  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%rdi,-32(%rsp,%r15,8)
+	movq	%rdi,-32(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 	cmpq	%r9,%r15
 	jb	L$1st4x
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r10
 	movq	-16(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-24(%rsp,%r15,8)
+	movq	%r13,-24(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	-8(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
-	movq	(%rsi),%rax
+	movq	(%rsi),%rax  // ap0
 	adcq	$0,%rdx
-	addq	%r11,%rdi
+	addq	%r11,%rdi  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%rdi,-16(%rsp,%r15,8)
+	movq	%rdi,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 	xorq	%rdi,%rdi
 	addq	%r10,%r13
 	adcq	$0,%rdi
 	movq	%r13,-8(%rsp,%r15,8)
-	movq	%rdi,(%rsp,%r15,8)
+	movq	%rdi,(%rsp,%r15,8)  // store upmost overflow bit
 
-	leaq	1(%r14),%r14
+	leaq	1(%r14),%r14  // i++
 .p2align	2
 L$outer4x:
-	movq	(%r12,%r14,8),%rbx
-	xorq	%r15,%r15
+	movq	(%r12,%r14,8),%rbx  // m0=bpi
+	xorq	%r15,%r15  // j=0
 	movq	(%rsp),%r10
 	movq	%r8,%rbp
-	mulq	%rbx
-	addq	%rax,%r10
+	mulq	%rbx  // ap0*bpi
+	addq	%rax,%r10  // ap0*bpi+tp0
 	movq	(%rcx),%rax
 	adcq	$0,%rdx
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // tp0*n0
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // "%r13", discarded
 	movq	8(%rsi),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	8(%rcx),%rax
 	adcq	$0,%rdx
-	addq	8(%rsp),%r11
+	addq	8(%rsp),%r11  // +tp1
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	16(%rsi),%rax
 	adcq	$0,%rdx
-	addq	%r11,%rdi
-	leaq	4(%r15),%r15
+	addq	%r11,%rdi  // npj*m1+apj*bpi+tpj
+	leaq	4(%r15),%r15  // j+=2
 	adcq	$0,%rdx
-	movq	%rdi,(%rsp)
+	movq	%rdi,(%rsp)  // tpj-1
 	movq	%rdx,%r13
 	jmp	L$inner4x
 .p2align	4
 L$inner4x:
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r10
 	movq	-16(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	-16(%rsp,%r15,8),%r10
+	addq	-16(%rsp,%r15,8),%r10  // apj*bpi+tpj
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r13
 	adcq	$0,%rdx
-	movq	%r13,-24(%rsp,%r15,8)
+	movq	%r13,-24(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	-8(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
@@ -502,148 +502,148 @@
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	%r11,%rdi
 	adcq	$0,%rdx
-	movq	%rdi,-16(%rsp,%r15,8)
+	movq	%rdi,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r10
 	movq	(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	(%rsp,%r15,8),%r10
+	addq	(%rsp,%r15,8),%r10  // apj*bpi+tpj
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	8(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r13
 	adcq	$0,%rdx
-	movq	%r13,-8(%rsp,%r15,8)
+	movq	%r13,-8(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	8(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	8(%rsp,%r15,8),%r11
 	adcq	$0,%rdx
-	leaq	4(%r15),%r15
+	leaq	4(%r15),%r15  // j++
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	-16(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	%r11,%rdi
 	adcq	$0,%rdx
-	movq	%rdi,-32(%rsp,%r15,8)
+	movq	%rdi,-32(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 	cmpq	%r9,%r15
 	jb	L$inner4x
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r10
 	movq	-16(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	-16(%rsp,%r15,8),%r10
+	addq	-16(%rsp,%r15,8),%r10  // apj*bpi+tpj
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r13
 	adcq	$0,%rdx
-	movq	%r13,-24(%rsp,%r15,8)
+	movq	%r13,-24(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	-8(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	-8(%rsp,%r15,8),%r11
 	adcq	$0,%rdx
-	leaq	1(%r14),%r14
+	leaq	1(%r14),%r14  // i++
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
-	movq	(%rsi),%rax
+	movq	(%rsi),%rax  // ap0
 	adcq	$0,%rdx
 	addq	%r11,%rdi
 	adcq	$0,%rdx
-	movq	%rdi,-16(%rsp,%r15,8)
+	movq	%rdi,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 	xorq	%rdi,%rdi
 	addq	%r10,%r13
 	adcq	$0,%rdi
-	addq	(%rsp,%r9,8),%r13
+	addq	(%rsp,%r9,8),%r13  // pull upmost overflow bit
 	adcq	$0,%rdi
 	movq	%r13,-8(%rsp,%r15,8)
-	movq	%rdi,(%rsp,%r15,8)
+	movq	%rdi,(%rsp,%r15,8)  // store upmost overflow bit
 
 	cmpq	%r9,%r14
 	jb	L$outer4x
-	movq	16(%rsp,%r9,8),%rdi
+	movq	16(%rsp,%r9,8),%rdi  // restore %rdi
 	leaq	-4(%r9),%r15
-	movq	0(%rsp),%rax
-	movq	8(%rsp),%rdx
-	shrq	$2,%r15
-	leaq	(%rsp),%rsi
-	xorq	%r14,%r14
+	movq	0(%rsp),%rax  // tp0
+	movq	8(%rsp),%rdx  // tp1
+	shrq	$2,%r15  // j=num/4-1
+	leaq	(%rsp),%rsi  // borrow ap for tp
+	xorq	%r14,%r14  // i=0 and clear CF
 
 	subq	0(%rcx),%rax
-	movq	16(%rsi),%rbx
-	movq	24(%rsi),%rbp
+	movq	16(%rsi),%rbx  // tp2
+	movq	24(%rsi),%rbp  // tp3
 	sbbq	8(%rcx),%rdx
 
 L$sub4x:
-	movq	%rax,0(%rdi,%r14,8)
-	movq	%rdx,8(%rdi,%r14,8)
+	movq	%rax,0(%rdi,%r14,8)  // rpi=tpi-npi
+	movq	%rdx,8(%rdi,%r14,8)  // rpi=tpi-npi
 	sbbq	16(%rcx,%r14,8),%rbx
-	movq	32(%rsi,%r14,8),%rax
+	movq	32(%rsi,%r14,8),%rax  // tpi+1
 	movq	40(%rsi,%r14,8),%rdx
 	sbbq	24(%rcx,%r14,8),%rbp
-	movq	%rbx,16(%rdi,%r14,8)
-	movq	%rbp,24(%rdi,%r14,8)
+	movq	%rbx,16(%rdi,%r14,8)  // rpi=tpi-npi
+	movq	%rbp,24(%rdi,%r14,8)  // rpi=tpi-npi
 	sbbq	32(%rcx,%r14,8),%rax
 	movq	48(%rsi,%r14,8),%rbx
 	movq	56(%rsi,%r14,8),%rbp
 	sbbq	40(%rcx,%r14,8),%rdx
-	leaq	4(%r14),%r14
-	decq	%r15
+	leaq	4(%r14),%r14  // i++
+	decq	%r15  // doesn't affect CF
 	jnz	L$sub4x
 
-	movq	%rax,0(%rdi,%r14,8)
-	movq	32(%rsi,%r14,8),%rax
+	movq	%rax,0(%rdi,%r14,8)  // rpi=tpi-npi
+	movq	32(%rsi,%r14,8),%rax  // load overflow bit
 	sbbq	16(%rcx,%r14,8),%rbx
-	movq	%rdx,8(%rdi,%r14,8)
+	movq	%rdx,8(%rdi,%r14,8)  // rpi=tpi-npi
 	sbbq	24(%rcx,%r14,8),%rbp
-	movq	%rbx,16(%rdi,%r14,8)
+	movq	%rbx,16(%rdi,%r14,8)  // rpi=tpi-npi
 
-	sbbq	$0,%rax
-	movq	%rbp,24(%rdi,%r14,8)
+	sbbq	$0,%rax  // handle upmost overflow bit
+	movq	%rbp,24(%rdi,%r14,8)  // rpi=tpi-npi
 	pxor	%xmm0,%xmm0
 	movq	%rax,%xmm4
 	pcmpeqd	%xmm5,%xmm5
 	pshufd	$0,%xmm4,%xmm4
 	movq	%r9,%r15
 	pxor	%xmm4,%xmm5
-	shrq	$2,%r15
-	xorl	%eax,%eax
+	shrq	$2,%r15  // j=num/4
+	xorl	%eax,%eax  // i=0
 
 	jmp	L$copy4x
 .p2align	4
-L$copy4x:
+L$copy4x:  // conditional copy
 	movdqa	(%rsp,%rax,1),%xmm1
 	movdqu	(%rdi,%rax,1),%xmm2
 	pand	%xmm4,%xmm1
@@ -661,9 +661,9 @@
 	leaq	32(%rax),%rax
 	decq	%r15
 	jnz	L$copy4x
-	movq	8(%rsp,%r9,8),%rsi
-
+	movq	8(%rsp,%r9,8),%rsi  // restore %rsp
 
+// No return value
 	movq	-48(%rsi),%r15
 
 	movq	-40(%rsi),%r14
@@ -682,8 +682,8 @@
 	ret
 
 
-
-
+// see x86_64-mont5 module
+// see x86_64-mont5 module
 
 .globl	_bn_sqr8x_mont
 .private_extern _bn_sqr8x_mont
@@ -711,30 +711,30 @@
 L$sqr8x_prologue:
 
 	movl	%r9d,%r10d
-	shll	$3,%r9d
-	shlq	$3+2,%r10
+	shll	$3,%r9d  // convert %r9 to bytes
+	shlq	$3+2,%r10  // 4*%r9
 	negq	%r9
 
-
-
-
-
-
+// #############################################################
+// ensure that stack frame doesn't alias with %rsi modulo
+// 4096. this is done to allow memory disambiguation logic
+// do its job.
+// 
 	leaq	-64(%rsp,%r9,2),%r11
 	movq	%rsp,%rbp
-	movq	(%r8),%r8
+	movq	(%r8),%r8  // *n0
 	subq	%rsi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	L$sqr8x_sp_alt
-	subq	%r11,%rbp
-	leaq	-64(%rbp,%r9,2),%rbp
+	subq	%r11,%rbp  // align with %rsi
+	leaq	-64(%rbp,%r9,2),%rbp  // future alloca(frame+2*%r9)
 	jmp	L$sqr8x_sp_done
 
 .p2align	5
 L$sqr8x_sp_alt:
-	leaq	4096-64(,%r9,2),%r10
-	leaq	-64(%rbp,%r9,2),%rbp
+	leaq	4096-64(,%r9,2),%r10  // 4096-frame-2*%r9
+	leaq	-64(%rbp,%r9,2),%rbp  // future alloca(frame+2*%r9)
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
@@ -762,41 +762,41 @@
 	negq	%r9
 
 	movq	%r8,32(%rsp)
-	movq	%rax,40(%rsp)
+	movq	%rax,40(%rsp)  // save original %rsp
 
 L$sqr8x_body:
 
-	movq	%rcx,%xmm2
+	movq	%rcx,%xmm2  // save pointer to modulus
 	pxor	%xmm0,%xmm0
-	movq	%rdi,%xmm1
-	movq	%r10,%xmm3
+	movq	%rdi,%xmm1  // save %rdi
+	movq	%r10,%xmm3  // -%r9
 	testq	%rdx,%rdx
 	jz	L$sqr8x_nox
 
-	call	_bn_sqrx8x_internal
-
-
-
-
+	call	_bn_sqrx8x_internal  // see x86_64-mont5 module
+// %rax	top-most carry
+// %rbp	nptr
+// %rcx	-8*num
+// %r8	end of tp2*num
 	leaq	(%r8,%rcx,1),%rbx
 	movq	%rcx,%r9
 	movq	%rcx,%rdx
 	movq	%xmm1,%rdi
-	sarq	$3+2,%rcx
+	sarq	$3+2,%rcx  // %cf=0
 	jmp	L$sqr8x_sub
 
 .p2align	5
 L$sqr8x_nox:
-	call	_bn_sqr8x_internal
-
-
-
-
+	call	_bn_sqr8x_internal  // see x86_64-mont5 module
+// %rax	top-most carry
+// %rbp	nptr
+// %r8	-8*num
+// %rdi	end of tp2*num
 	leaq	(%rdi,%r9,1),%rbx
 	movq	%r9,%rcx
 	movq	%r9,%rdx
 	movq	%xmm1,%rdi
-	sarq	$3+2,%rcx
+	sarq	$3+2,%rcx  // %cf=0
 	jmp	L$sqr8x_sub
 
 .p2align	5
@@ -816,17 +816,17 @@
 	movq	%r14,16(%rdi)
 	movq	%r15,24(%rdi)
 	leaq	32(%rdi),%rdi
-	incq	%rcx
+	incq	%rcx  // preserves %cf
 	jnz	L$sqr8x_sub
 
-	sbbq	$0,%rax
-	leaq	(%rbx,%r9,1),%rbx
-	leaq	(%rdi,%r9,1),%rdi
+	sbbq	$0,%rax  // top-most carry
+	leaq	(%rbx,%r9,1),%rbx  // rewind
+	leaq	(%rdi,%r9,1),%rdi  // rewind
 
 	movq	%rax,%xmm1
 	pxor	%xmm0,%xmm0
 	pshufd	$0,%xmm1,%xmm1
-	movq	40(%rsp),%rsi
+	movq	40(%rsp),%rsi  // restore %rsp
 
 	jmp	L$sqr8x_cond_copy
 
@@ -838,7 +838,7 @@
 	movdqu	0(%rdi),%xmm4
 	movdqu	16(%rdi),%xmm5
 	leaq	32(%rdi),%rdi
-	movdqa	%xmm0,-32(%rbx)
+	movdqa	%xmm0,-32(%rbx)  // zero tp
 	movdqa	%xmm0,-16(%rbx)
 	movdqa	%xmm0,-32(%rbx,%rdx,1)
 	movdqa	%xmm0,-16(%rbx,%rdx,1)
@@ -855,7 +855,7 @@
 	addq	$32,%r9
 	jnz	L$sqr8x_cond_copy
 
-
+// No return value
 	movq	-48(%rsi),%r15
 
 	movq	-40(%rsi),%r14
@@ -898,11 +898,11 @@
 
 L$mulx4x_prologue:
 
-	shll	$3,%r9d
+	shll	$3,%r9d  // convert %r9 to bytes
 	xorq	%r10,%r10
-	subq	%r9,%r10
-	movq	(%r8),%r8
-	leaq	-72(%rsp,%r10,1),%rbp
+	subq	%r9,%r10  // -%r9
+	movq	(%r8),%r8  // *n0
+	leaq	-72(%rsp,%r10,1),%rbp  // future alloca(frame+%r9+8)
 	andq	$-128,%rbp
 	movq	%rsp,%r11
 	subq	%rbp,%r11
@@ -922,62 +922,62 @@
 L$mulx4x_page_walk_done:
 
 	leaq	(%rdx,%r9,1),%r10
-
-
-
-
-
-
-
-
-
-
-
-
-	movq	%r9,0(%rsp)
+// #############################################################
+// Stack layout
+// +0	num
+// +8	off-loaded &bi
+// +16	end of bnum
+// +24	saved n0
+// +32	saved rp
+// +40	saved %rsp
+// +48	inner counter
+// +56
+// +64	tmpnum+1
+// 
+	movq	%r9,0(%rsp)  // save %r9
 	shrq	$5,%r9
-	movq	%r10,16(%rsp)
+	movq	%r10,16(%rsp)  // end of bnum
 	subq	$1,%r9
-	movq	%r8,24(%rsp)
-	movq	%rdi,32(%rsp)
-	movq	%rax,40(%rsp)
+	movq	%r8,24(%rsp)  // save *n0
+	movq	%rdi,32(%rsp)  // save %rdi
+	movq	%rax,40(%rsp)  // save original %rsp
 
-	movq	%r9,48(%rsp)
+	movq	%r9,48(%rsp)  // inner counter
 	jmp	L$mulx4x_body
 
 .p2align	5
 L$mulx4x_body:
 	leaq	8(%rdx),%rdi
-	movq	(%rdx),%rdx
+	movq	(%rdx),%rdx  // b0, %rdx==%rdx actually
 	leaq	64+32(%rsp),%rbx
 	movq	%rdx,%r9
 
-	mulxq	0(%rsi),%r8,%rax
-	mulxq	8(%rsi),%r11,%r14
+	mulxq	0(%rsi),%r8,%rax  // a0*b0
+	mulxq	8(%rsi),%r11,%r14  // a1*b0
 	addq	%rax,%r11
-	movq	%rdi,8(%rsp)
-	mulxq	16(%rsi),%r12,%r13
+	movq	%rdi,8(%rsp)  // off-load &bi
+	mulxq	16(%rsi),%r12,%r13  // ...
 	adcq	%r14,%r12
 	adcq	$0,%r13
 
-	movq	%r8,%rdi
-	imulq	24(%rsp),%r8
-	xorq	%rbp,%rbp
+	movq	%r8,%rdi  // borrow %rdi
+	imulq	24(%rsp),%r8  // "t0"*n0
+	xorq	%rbp,%rbp  // cf=0, of=0
 
 	mulxq	24(%rsi),%rax,%r14
 	movq	%r8,%rdx
 	leaq	32(%rsi),%rsi
 	adcxq	%rax,%r13
-	adcxq	%rbp,%r14
+	adcxq	%rbp,%r14  // cf=0
 
 	mulxq	0(%rcx),%rax,%r10
-	adcxq	%rax,%rdi
+	adcxq	%rax,%rdi  // discarded
 	adoxq	%r11,%r10
 	mulxq	8(%rcx),%rax,%r11
 	adcxq	%rax,%r10
 	adoxq	%r12,%r11
-.byte	0xc4,0x62,0xfb,0xf6,0xa1,0x10,0x00,0x00,0x00
-	movq	48(%rsp),%rdi
+.byte	0xc4,0x62,0xfb,0xf6,0xa1,0x10,0x00,0x00,0x00  // mulx	2*8(%rcx),%rax,%r12
+	movq	48(%rsp),%rdi  // counter value
 	movq	%r10,-32(%rbx)
 	adcxq	%rax,%r11
 	adoxq	%r13,%r12
@@ -985,7 +985,7 @@
 	movq	%r9,%rdx
 	movq	%r11,-24(%rbx)
 	adcxq	%rax,%r12
-	adoxq	%rbp,%r15
+	adoxq	%rbp,%r15  // of=0
 	leaq	32(%rcx),%rcx
 	movq	%r12,-16(%rbx)
 
@@ -993,18 +993,18 @@
 
 .p2align	5
 L$mulx4x_1st:
-	adcxq	%rbp,%r15
-	mulxq	0(%rsi),%r10,%rax
+	adcxq	%rbp,%r15  // cf=0, modulo-scheduled
+	mulxq	0(%rsi),%r10,%rax  // a4*b0
 	adcxq	%r14,%r10
-	mulxq	8(%rsi),%r11,%r14
+	mulxq	8(%rsi),%r11,%r14  // a5*b0
 	adcxq	%rax,%r11
-	mulxq	16(%rsi),%r12,%rax
+	mulxq	16(%rsi),%r12,%rax  // ...
 	adcxq	%r14,%r12
 	mulxq	24(%rsi),%r13,%r14
 .byte	0x67,0x67
 	movq	%r8,%rdx
 	adcxq	%rax,%r13
-	adcxq	%rbp,%r14
+	adcxq	%rbp,%r14  // cf=0
 	leaq	32(%rsi),%rsi
 	leaq	32(%rbx),%rbx
 
@@ -1028,43 +1028,43 @@
 	leaq	32(%rcx),%rcx
 	movq	%r13,-16(%rbx)
 
-	decq	%rdi
+	decq	%rdi  // of=0, pass cf
 	jnz	L$mulx4x_1st
 
-	movq	0(%rsp),%rax
-	movq	8(%rsp),%rdi
-	adcq	%rbp,%r15
+	movq	0(%rsp),%rax  // load num
+	movq	8(%rsp),%rdi  // re-load &bi
+	adcq	%rbp,%r15  // modulo-scheduled
 	addq	%r15,%r14
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // top-most carry
 	movq	%r14,-8(%rbx)
 	jmp	L$mulx4x_outer
 
 .p2align	5
 L$mulx4x_outer:
-	movq	(%rdi),%rdx
-	leaq	8(%rdi),%rdi
-	subq	%rax,%rsi
-	movq	%r15,(%rbx)
+	movq	(%rdi),%rdx  // bi
+	leaq	8(%rdi),%rdi  // b++
+	subq	%rax,%rsi  // rewind %rsi
+	movq	%r15,(%rbx)  // save top-most carry
 	leaq	64+32(%rsp),%rbx
-	subq	%rax,%rcx
+	subq	%rax,%rcx  // rewind %rcx
 
-	mulxq	0(%rsi),%r8,%r11
-	xorl	%ebp,%ebp
+	mulxq	0(%rsi),%r8,%r11  // a0*bi
+	xorl	%ebp,%ebp  // xor	%rbp,%rbp	# cf=0, of=0
 	movq	%rdx,%r9
-	mulxq	8(%rsi),%r14,%r12
+	mulxq	8(%rsi),%r14,%r12  // a1*bi
 	adoxq	-32(%rbx),%r8
 	adcxq	%r14,%r11
-	mulxq	16(%rsi),%r15,%r13
+	mulxq	16(%rsi),%r15,%r13  // ...
 	adoxq	-24(%rbx),%r11
 	adcxq	%r15,%r12
 	adoxq	-16(%rbx),%r12
 	adcxq	%rbp,%r13
 	adoxq	%rbp,%r13
 
-	movq	%rdi,8(%rsp)
+	movq	%rdi,8(%rsp)  // off-load &bi
 	movq	%r8,%r15
-	imulq	24(%rsp),%r8
-	xorl	%ebp,%ebp
+	imulq	24(%rsp),%r8  // "t0"*n0
+	xorl	%ebp,%ebp  // xor	%rbp,%rbp	# cf=0, of=0
 
 	mulxq	24(%rsi),%rax,%r14
 	movq	%r8,%rdx
@@ -1075,7 +1075,7 @@
 	adoxq	%rbp,%r14
 
 	mulxq	0(%rcx),%rax,%r10
-	adcxq	%rax,%r15
+	adcxq	%rax,%r15  // discarded
 	adoxq	%r11,%r10
 	mulxq	8(%rcx),%rax,%r11
 	adcxq	%rax,%r10
@@ -1089,21 +1089,21 @@
 	movq	%r11,-24(%rbx)
 	leaq	32(%rcx),%rcx
 	adcxq	%rax,%r12
-	adoxq	%rbp,%r15
-	movq	48(%rsp),%rdi
+	adoxq	%rbp,%r15  // of=0
+	movq	48(%rsp),%rdi  // counter value
 	movq	%r12,-16(%rbx)
 
 	jmp	L$mulx4x_inner
 
 .p2align	5
 L$mulx4x_inner:
-	mulxq	0(%rsi),%r10,%rax
-	adcxq	%rbp,%r15
+	mulxq	0(%rsi),%r10,%rax  // a4*bi
+	adcxq	%rbp,%r15  // cf=0, modulo-scheduled
 	adoxq	%r14,%r10
-	mulxq	8(%rsi),%r11,%r14
+	mulxq	8(%rsi),%r11,%r14  // a5*bi
 	adcxq	0(%rbx),%r10
 	adoxq	%rax,%r11
-	mulxq	16(%rsi),%r12,%rax
+	mulxq	16(%rsi),%r12,%rax  // ...
 	adcxq	8(%rbx),%r11
 	adoxq	%r14,%r12
 	mulxq	24(%rsi),%r13,%r14
@@ -1111,10 +1111,10 @@
 	adcxq	16(%rbx),%r12
 	adoxq	%rax,%r13
 	adcxq	24(%rbx),%r13
-	adoxq	%rbp,%r14
+	adoxq	%rbp,%r14  // of=0
 	leaq	32(%rsi),%rsi
 	leaq	32(%rbx),%rbx
-	adcxq	%rbp,%r14
+	adcxq	%rbp,%r14  // cf=0
 
 	adoxq	%r15,%r10
 	mulxq	0(%rcx),%rax,%r15
@@ -1136,26 +1136,26 @@
 	leaq	32(%rcx),%rcx
 	movq	%r13,-16(%rbx)
 
-	decq	%rdi
+	decq	%rdi  // of=0, pass cf
 	jnz	L$mulx4x_inner
 
-	movq	0(%rsp),%rax
-	movq	8(%rsp),%rdi
-	adcq	%rbp,%r15
-	subq	0(%rbx),%rbp
+	movq	0(%rsp),%rax  // load num
+	movq	8(%rsp),%rdi  // re-load &bi
+	adcq	%rbp,%r15  // modulo-scheduled
+	subq	0(%rbx),%rbp  // pull top-most carry
 	adcq	%r15,%r14
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // top-most carry
 	movq	%r14,-8(%rbx)
 
 	cmpq	16(%rsp),%rdi
 	jne	L$mulx4x_outer
 
 	leaq	64(%rsp),%rbx
-	subq	%rax,%rcx
+	subq	%rax,%rcx  // rewind %rcx
 	negq	%r15
 	movq	%rax,%rdx
-	shrq	$3+2,%rax
-	movq	32(%rsp),%rdi
+	shrq	$3+2,%rax  // %cf=0
+	movq	32(%rsp),%rdi  // restore rp
 	jmp	L$mulx4x_sub
 
 .p2align	5
@@ -1175,17 +1175,17 @@
 	movq	%r13,16(%rdi)
 	movq	%r14,24(%rdi)
 	leaq	32(%rdi),%rdi
-	decq	%rax
+	decq	%rax  // preserves %cf
 	jnz	L$mulx4x_sub
 
-	sbbq	$0,%r15
+	sbbq	$0,%r15  // top-most carry
 	leaq	64(%rsp),%rbx
-	subq	%rdx,%rdi
+	subq	%rdx,%rdi  // rewind
 
 	movq	%r15,%xmm1
 	pxor	%xmm0,%xmm0
 	pshufd	$0,%xmm1,%xmm1
-	movq	40(%rsp),%rsi
+	movq	40(%rsp),%rsi  // restore %rsp
 
 	jmp	L$mulx4x_cond_copy
 
@@ -1197,7 +1197,7 @@
 	movdqu	0(%rdi),%xmm4
 	movdqu	16(%rdi),%xmm5
 	leaq	32(%rdi),%rdi
-	movdqa	%xmm0,-32(%rbx)
+	movdqa	%xmm0,-32(%rbx)  // zero tp
 	movdqa	%xmm0,-16(%rbx)
 	pcmpeqd	%xmm1,%xmm0
 	pand	%xmm1,%xmm2
@@ -1214,7 +1214,7 @@
 
 	movq	%rdx,(%rbx)
 
-
+// No return value
 	movq	-48(%rsi),%r15
 
 	movq	-40(%rsi),%r14

boringssl-0.20260708.tar.xz/gen/bcm/x86_64-mont-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/x86_64-mont-linux.S Changed

@@ -31,18 +31,18 @@
 
 	negq	%r9
 	movq	%rsp,%r11
-	leaq	-16(%rsp,%r9,8),%r10
-	negq	%r9
-	andq	$-1024,%r10
-
-
-
-
-
-
-
-
-
+	leaq	-16(%rsp,%r9,8),%r10  // future alloca(8*(num+2))
+	negq	%r9  // restore %r9
+	andq	$-1024,%r10  // minimize TLB usage
+
+// An OS-agnostic version of __chkstk.
+// 
+// Some OSes (Windows) insist on stack being "wired" to
+// physical memory in strictly sequential manner, i.e. if stack
+// allocation spans two pages, then reference to farmost one can
+// be punishable by SEGV. But page walking can do good even on
+// other OSes, because it guarantees that villain thread hits
+// the guard page before it can make damage to innocent one...
 	subq	%r10,%r11
 	andq	$-4096,%r11
 	leaq	(%r10,%r11,1),%rsp
@@ -59,32 +59,32 @@
 	ja	.Lmul_page_walk
 .Lmul_page_walk_done:
 
-	movq	%rax,8(%rsp,%r9,8)
+	movq	%rax,8(%rsp,%r9,8)  // tpnum+1=%rsp
 .cfi_escape	0x0f,0x0a,0x77,0x08,0x79,0x00,0x38,0x1e,0x22,0x06,0x23,0x08
 .Lmul_body:
-	movq	%rdx,%r12
-	movq	(%r8),%r8
-	movq	(%r12),%rbx
+	movq	%rdx,%r12  // reassign %rdx
+	movq	(%r8),%r8  // pull n00 value
+	movq	(%r12),%rbx  // m0=bp0
 	movq	(%rsi),%rax
 
-	xorq	%r14,%r14
-	xorq	%r15,%r15
+	xorq	%r14,%r14  // i=0
+	xorq	%r15,%r15  // j=0
 
 	movq	%r8,%rbp
-	mulq	%rbx
+	mulq	%rbx  // ap0*bp0
 	movq	%rax,%r10
 	movq	(%rcx),%rax
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // "tp0"*n0
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // discarded
 	movq	8(%rsi),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r13
 
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 	jmp	.L1st_enter
 
 .align	16
@@ -92,30 +92,30 @@
 	addq	%rax,%r13
 	movq	(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r11,%r13
+	addq	%r11,%r13  // npj*m1+apj*bp0
 	movq	%r10,%r11
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r15,8)
+	movq	%r13,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 .L1st_enter:
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	cmpq	%r9,%r15
 	jne	.L1st
 
 	addq	%rax,%r13
-	movq	(%rsi),%rax
+	movq	(%rsi),%rax  // ap0
 	adcq	$0,%rdx
-	addq	%r11,%r13
+	addq	%r11,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r15,8)
+	movq	%r13,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 	movq	%r10,%r11
 
@@ -123,32 +123,32 @@
 	addq	%r11,%r13
 	adcq	$0,%rdx
 	movq	%r13,-8(%rsp,%r9,8)
-	movq	%rdx,(%rsp,%r9,8)
+	movq	%rdx,(%rsp,%r9,8)  // store upmost overflow bit
 
-	leaq	1(%r14),%r14
+	leaq	1(%r14),%r14  // i++
 	jmp	.Louter
 .align	16
 .Louter:
-	movq	(%r12,%r14,8),%rbx
-	xorq	%r15,%r15
+	movq	(%r12,%r14,8),%rbx  // m0=bpi
+	xorq	%r15,%r15  // j=0
 	movq	%r8,%rbp
 	movq	(%rsp),%r10
-	mulq	%rbx
-	addq	%rax,%r10
+	mulq	%rbx  // ap0*bpi
+	addq	%rax,%r10  // ap0*bpi+tp0
 	movq	(%rcx),%rax
 	adcq	$0,%rdx
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // tp0*n0
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // discarded
 	movq	8(%rsi),%rax
 	adcq	$0,%rdx
-	movq	8(%rsp),%r10
+	movq	8(%rsp),%r10  // tp1
 	movq	%rdx,%r13
 
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 	jmp	.Linner_enter
 
 .align	16
@@ -156,80 +156,80 @@
 	addq	%rax,%r13
 	movq	(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bpi+tpj
 	movq	(%rsp,%r15,8),%r10
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r15,8)
+	movq	%r13,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 .Linner_enter:
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r11,%r10
+	addq	%r11,%r10  // apj*bpi+tpj
 	movq	%rdx,%r11
 	adcq	$0,%r11
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	cmpq	%r9,%r15
 	jne	.Linner
 
 	addq	%rax,%r13
-	movq	(%rsi),%rax
+	movq	(%rsi),%rax  // ap0
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bpi+tpj
 	movq	(%rsp,%r15,8),%r10
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r15,8)
+	movq	%r13,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 	xorq	%rdx,%rdx
 	addq	%r11,%r13
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // pull upmost overflow bit
 	adcq	$0,%rdx
 	movq	%r13,-8(%rsp,%r9,8)
-	movq	%rdx,(%rsp,%r9,8)
+	movq	%rdx,(%rsp,%r9,8)  // store upmost overflow bit
 
-	leaq	1(%r14),%r14
+	leaq	1(%r14),%r14  // i++
 	cmpq	%r9,%r14
 	jb	.Louter
 
-	xorq	%r14,%r14
-	movq	(%rsp),%rax
-	movq	%r9,%r15
+	xorq	%r14,%r14  // i=0 and clear CF
+	movq	(%rsp),%rax  // tp0
+	movq	%r9,%r15  // j=num
 
 .align	16
 .Lsub:	sbbq	(%rcx,%r14,8),%rax
-	movq	%rax,(%rdi,%r14,8)
-	movq	8(%rsp,%r14,8),%rax
-	leaq	1(%r14),%r14
-	decq	%r15
+	movq	%rax,(%rdi,%r14,8)  // rpi=tpi-npi
+	movq	8(%rsp,%r14,8),%rax  // tpi+1
+	leaq	1(%r14),%r14  // i++
+	decq	%r15  // doesn't affect CF
 	jnz	.Lsub
 
-	sbbq	$0,%rax
+	sbbq	$0,%rax  // handle upmost overflow bit
 	movq	$-1,%rbx
-	xorq	%rax,%rbx
+	xorq	%rax,%rbx  // not %rax
 	xorq	%r14,%r14
-	movq	%r9,%r15
+	movq	%r9,%r15  // j=num
 
-.Lcopy:
+.Lcopy:  // conditional copy
 	movq	(%rdi,%r14,8),%rcx
 	movq	(%rsp,%r14,8),%rdx
 	andq	%rbx,%rcx
 	andq	%rax,%rdx
-	movq	%r9,(%rsp,%r14,8)
+	movq	%r9,(%rsp,%r14,8)  // zap temporary vector
 	orq	%rcx,%rdx
-	movq	%rdx,(%rdi,%r14,8)
+	movq	%rdx,(%rdi,%r14,8)  // rpi=tpi
 	leaq	1(%r14),%r14
 	subq	$1,%r15
 	jnz	.Lcopy
 
-	movq	8(%rsp,%r9,8),%rsi
+	movq	8(%rsp,%r9,8),%rsi  // restore %rsp
 .cfi_def_cfa	%rsi,8
-
+// No return value
 	movq	-48(%rsi),%r15
 .cfi_restore	%r15
 	movq	-40(%rsi),%r14
@@ -273,9 +273,9 @@
 
 	negq	%r9
 	movq	%rsp,%r11
-	leaq	-32(%rsp,%r9,8),%r10
-	negq	%r9
-	andq	$-1024,%r10
+	leaq	-32(%rsp,%r9,8),%r10  // future alloca(8*(num+4))
+	negq	%r9  // restore
+	andq	$-1024,%r10  // minimize TLB usage
 
 	subq	%r10,%r11
 	andq	$-4096,%r11
@@ -292,28 +292,28 @@
 	ja	.Lmul4x_page_walk
 .Lmul4x_page_walk_done:
 
-	movq	%rax,8(%rsp,%r9,8)
+	movq	%rax,8(%rsp,%r9,8)  // tpnum+1=%rsp
 .cfi_escape	0x0f,0x0a,0x77,0x08,0x79,0x00,0x38,0x1e,0x22,0x06,0x23,0x08
 .Lmul4x_body:
-	movq	%rdi,16(%rsp,%r9,8)
-	movq	%rdx,%r12
-	movq	(%r8),%r8
-	movq	(%r12),%rbx
+	movq	%rdi,16(%rsp,%r9,8)  // tpnum+2=%rdi
+	movq	%rdx,%r12  // reassign %r12
+	movq	(%r8),%r8  // pull n00 value
+	movq	(%r12),%rbx  // m0=bp0
 	movq	(%rsi),%rax
 
-	xorq	%r14,%r14
-	xorq	%r15,%r15
+	xorq	%r14,%r14  // i=0
+	xorq	%r15,%r15  // j=0
 
 	movq	%r8,%rbp
-	mulq	%rbx
+	mulq	%rbx  // ap0*bp0
 	movq	%rax,%r10
 	movq	(%rcx),%rax
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // "tp0"*n0
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // discarded
 	movq	8(%rsi),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rdi
@@ -329,171 +329,171 @@
 	movq	16(%rsi),%rax
 	adcq	$0,%rdx
 	addq	%r11,%rdi
-	leaq	4(%r15),%r15
+	leaq	4(%r15),%r15  // j++
 	adcq	$0,%rdx
 	movq	%rdi,(%rsp)
 	movq	%rdx,%r13
 	jmp	.L1st4x
 .align	16
 .L1st4x:
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r10
 	movq	-16(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-24(%rsp,%r15,8)
+	movq	%r13,-24(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	-8(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r11,%rdi
+	addq	%r11,%rdi  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%rdi,-16(%rsp,%r15,8)
+	movq	%rdi,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r10
 	movq	(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	8(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-8(%rsp,%r15,8)
+	movq	%r13,-8(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	8(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	leaq	4(%r15),%r15
+	leaq	4(%r15),%r15  // j++
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	-16(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r11,%rdi
+	addq	%r11,%rdi  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%rdi,-32(%rsp,%r15,8)
+	movq	%rdi,-32(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 	cmpq	%r9,%r15
 	jb	.L1st4x
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r10
 	movq	-16(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-24(%rsp,%r15,8)
+	movq	%r13,-24(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	-8(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
-	movq	(%rsi),%rax
+	movq	(%rsi),%rax  // ap0
 	adcq	$0,%rdx
-	addq	%r11,%rdi
+	addq	%r11,%rdi  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%rdi,-16(%rsp,%r15,8)
+	movq	%rdi,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 	xorq	%rdi,%rdi
 	addq	%r10,%r13
 	adcq	$0,%rdi
 	movq	%r13,-8(%rsp,%r15,8)
-	movq	%rdi,(%rsp,%r15,8)
+	movq	%rdi,(%rsp,%r15,8)  // store upmost overflow bit
 
-	leaq	1(%r14),%r14
+	leaq	1(%r14),%r14  // i++
 .align	4
 .Louter4x:
-	movq	(%r12,%r14,8),%rbx
-	xorq	%r15,%r15
+	movq	(%r12,%r14,8),%rbx  // m0=bpi
+	xorq	%r15,%r15  // j=0
 	movq	(%rsp),%r10
 	movq	%r8,%rbp
-	mulq	%rbx
-	addq	%rax,%r10
+	mulq	%rbx  // ap0*bpi
+	addq	%rax,%r10  // ap0*bpi+tp0
 	movq	(%rcx),%rax
 	adcq	$0,%rdx
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // tp0*n0
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // "%r13", discarded
 	movq	8(%rsi),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	8(%rcx),%rax
 	adcq	$0,%rdx
-	addq	8(%rsp),%r11
+	addq	8(%rsp),%r11  // +tp1
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	16(%rsi),%rax
 	adcq	$0,%rdx
-	addq	%r11,%rdi
-	leaq	4(%r15),%r15
+	addq	%r11,%rdi  // npj*m1+apj*bpi+tpj
+	leaq	4(%r15),%r15  // j+=2
 	adcq	$0,%rdx
-	movq	%rdi,(%rsp)
+	movq	%rdi,(%rsp)  // tpj-1
 	movq	%rdx,%r13
 	jmp	.Linner4x
 .align	16
 .Linner4x:
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r10
 	movq	-16(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	-16(%rsp,%r15,8),%r10
+	addq	-16(%rsp,%r15,8),%r10  // apj*bpi+tpj
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r13
 	adcq	$0,%rdx
-	movq	%r13,-24(%rsp,%r15,8)
+	movq	%r13,-24(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	-8(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
@@ -501,148 +501,148 @@
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	%r11,%rdi
 	adcq	$0,%rdx
-	movq	%rdi,-16(%rsp,%r15,8)
+	movq	%rdi,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r10
 	movq	(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	(%rsp,%r15,8),%r10
+	addq	(%rsp,%r15,8),%r10  // apj*bpi+tpj
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	8(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r13
 	adcq	$0,%rdx
-	movq	%r13,-8(%rsp,%r15,8)
+	movq	%r13,-8(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	8(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	8(%rsp,%r15,8),%r11
 	adcq	$0,%rdx
-	leaq	4(%r15),%r15
+	leaq	4(%r15),%r15  // j++
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	-16(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	%r11,%rdi
 	adcq	$0,%rdx
-	movq	%rdi,-32(%rsp,%r15,8)
+	movq	%rdi,-32(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 	cmpq	%r9,%r15
 	jb	.Linner4x
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r10
 	movq	-16(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	-16(%rsp,%r15,8),%r10
+	addq	-16(%rsp,%r15,8),%r10  // apj*bpi+tpj
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r13
 	adcq	$0,%rdx
-	movq	%r13,-24(%rsp,%r15,8)
+	movq	%r13,-24(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	-8(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
 	addq	-8(%rsp,%r15,8),%r11
 	adcq	$0,%rdx
-	leaq	1(%r14),%r14
+	leaq	1(%r14),%r14  // i++
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
-	movq	(%rsi),%rax
+	movq	(%rsi),%rax  // ap0
 	adcq	$0,%rdx
 	addq	%r11,%rdi
 	adcq	$0,%rdx
-	movq	%rdi,-16(%rsp,%r15,8)
+	movq	%rdi,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 	xorq	%rdi,%rdi
 	addq	%r10,%r13
 	adcq	$0,%rdi
-	addq	(%rsp,%r9,8),%r13
+	addq	(%rsp,%r9,8),%r13  // pull upmost overflow bit
 	adcq	$0,%rdi
 	movq	%r13,-8(%rsp,%r15,8)
-	movq	%rdi,(%rsp,%r15,8)
+	movq	%rdi,(%rsp,%r15,8)  // store upmost overflow bit
 
 	cmpq	%r9,%r14
 	jb	.Louter4x
-	movq	16(%rsp,%r9,8),%rdi
+	movq	16(%rsp,%r9,8),%rdi  // restore %rdi
 	leaq	-4(%r9),%r15
-	movq	0(%rsp),%rax
-	movq	8(%rsp),%rdx
-	shrq	$2,%r15
-	leaq	(%rsp),%rsi
-	xorq	%r14,%r14
+	movq	0(%rsp),%rax  // tp0
+	movq	8(%rsp),%rdx  // tp1
+	shrq	$2,%r15  // j=num/4-1
+	leaq	(%rsp),%rsi  // borrow ap for tp
+	xorq	%r14,%r14  // i=0 and clear CF
 
 	subq	0(%rcx),%rax
-	movq	16(%rsi),%rbx
-	movq	24(%rsi),%rbp
+	movq	16(%rsi),%rbx  // tp2
+	movq	24(%rsi),%rbp  // tp3
 	sbbq	8(%rcx),%rdx
 
 .Lsub4x:
-	movq	%rax,0(%rdi,%r14,8)
-	movq	%rdx,8(%rdi,%r14,8)
+	movq	%rax,0(%rdi,%r14,8)  // rpi=tpi-npi
+	movq	%rdx,8(%rdi,%r14,8)  // rpi=tpi-npi
 	sbbq	16(%rcx,%r14,8),%rbx
-	movq	32(%rsi,%r14,8),%rax
+	movq	32(%rsi,%r14,8),%rax  // tpi+1
 	movq	40(%rsi,%r14,8),%rdx
 	sbbq	24(%rcx,%r14,8),%rbp
-	movq	%rbx,16(%rdi,%r14,8)
-	movq	%rbp,24(%rdi,%r14,8)
+	movq	%rbx,16(%rdi,%r14,8)  // rpi=tpi-npi
+	movq	%rbp,24(%rdi,%r14,8)  // rpi=tpi-npi
 	sbbq	32(%rcx,%r14,8),%rax
 	movq	48(%rsi,%r14,8),%rbx
 	movq	56(%rsi,%r14,8),%rbp
 	sbbq	40(%rcx,%r14,8),%rdx
-	leaq	4(%r14),%r14
-	decq	%r15
+	leaq	4(%r14),%r14  // i++
+	decq	%r15  // doesn't affect CF
 	jnz	.Lsub4x
 
-	movq	%rax,0(%rdi,%r14,8)
-	movq	32(%rsi,%r14,8),%rax
+	movq	%rax,0(%rdi,%r14,8)  // rpi=tpi-npi
+	movq	32(%rsi,%r14,8),%rax  // load overflow bit
 	sbbq	16(%rcx,%r14,8),%rbx
-	movq	%rdx,8(%rdi,%r14,8)
+	movq	%rdx,8(%rdi,%r14,8)  // rpi=tpi-npi
 	sbbq	24(%rcx,%r14,8),%rbp
-	movq	%rbx,16(%rdi,%r14,8)
+	movq	%rbx,16(%rdi,%r14,8)  // rpi=tpi-npi
 
-	sbbq	$0,%rax
-	movq	%rbp,24(%rdi,%r14,8)
+	sbbq	$0,%rax  // handle upmost overflow bit
+	movq	%rbp,24(%rdi,%r14,8)  // rpi=tpi-npi
 	pxor	%xmm0,%xmm0
 	movq	%rax,%xmm4
 	pcmpeqd	%xmm5,%xmm5
 	pshufd	$0,%xmm4,%xmm4
 	movq	%r9,%r15
 	pxor	%xmm4,%xmm5
-	shrq	$2,%r15
-	xorl	%eax,%eax
+	shrq	$2,%r15  // j=num/4
+	xorl	%eax,%eax  // i=0
 
 	jmp	.Lcopy4x
 .align	16
-.Lcopy4x:
+.Lcopy4x:  // conditional copy
 	movdqa	(%rsp,%rax,1),%xmm1
 	movdqu	(%rdi,%rax,1),%xmm2
 	pand	%xmm4,%xmm1
@@ -660,9 +660,9 @@
 	leaq	32(%rax),%rax
 	decq	%r15
 	jnz	.Lcopy4x
-	movq	8(%rsp,%r9,8),%rsi
+	movq	8(%rsp,%r9,8),%rsi  // restore %rsp
 .cfi_def_cfa	%rsi, 8
-
+// No return value
 	movq	-48(%rsi),%r15
 .cfi_restore	%r15
 	movq	-40(%rsi),%r14
@@ -682,9 +682,9 @@
 .cfi_endproc	
 .size	bn_mul4x_mont,.-bn_mul4x_mont
 .extern	bn_sqrx8x_internal
-.hidden bn_sqrx8x_internal
+.hidden bn_sqrx8x_internal  // see x86_64-mont5 module
 .extern	bn_sqr8x_internal
-.hidden bn_sqr8x_internal
+.hidden bn_sqr8x_internal  // see x86_64-mont5 module
 
 .globl	bn_sqr8x_mont
 .hidden bn_sqr8x_mont
@@ -711,30 +711,30 @@
 .Lsqr8x_prologue:
 
 	movl	%r9d,%r10d
-	shll	$3,%r9d
-	shlq	$3+2,%r10
+	shll	$3,%r9d  // convert %r9 to bytes
+	shlq	$3+2,%r10  // 4*%r9
 	negq	%r9
 
-
-
-
-
-
+// #############################################################
+// ensure that stack frame doesn't alias with %rsi modulo
+// 4096. this is done to allow memory disambiguation logic
+// do its job.
+// 
 	leaq	-64(%rsp,%r9,2),%r11
 	movq	%rsp,%rbp
-	movq	(%r8),%r8
+	movq	(%r8),%r8  // *n0
 	subq	%rsi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	.Lsqr8x_sp_alt
-	subq	%r11,%rbp
-	leaq	-64(%rbp,%r9,2),%rbp
+	subq	%r11,%rbp  // align with %rsi
+	leaq	-64(%rbp,%r9,2),%rbp  // future alloca(frame+2*%r9)
 	jmp	.Lsqr8x_sp_done
 
 .align	32
 .Lsqr8x_sp_alt:
-	leaq	4096-64(,%r9,2),%r10
-	leaq	-64(%rbp,%r9,2),%rbp
+	leaq	4096-64(,%r9,2),%r10  // 4096-frame-2*%r9
+	leaq	-64(%rbp,%r9,2),%rbp  // future alloca(frame+2*%r9)
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
@@ -762,41 +762,41 @@
 	negq	%r9
 
 	movq	%r8,32(%rsp)
-	movq	%rax,40(%rsp)
+	movq	%rax,40(%rsp)  // save original %rsp
 .cfi_escape	0x0f,0x05,0x77,0x28,0x06,0x23,0x08
 .Lsqr8x_body:
 
-	movq	%rcx,%xmm2
+	movq	%rcx,%xmm2  // save pointer to modulus
 	pxor	%xmm0,%xmm0
-	movq	%rdi,%xmm1
-	movq	%r10,%xmm3
+	movq	%rdi,%xmm1  // save %rdi
+	movq	%r10,%xmm3  // -%r9
 	testq	%rdx,%rdx
 	jz	.Lsqr8x_nox
 
-	call	bn_sqrx8x_internal
-
-
-
-
+	call	bn_sqrx8x_internal  // see x86_64-mont5 module
+// %rax	top-most carry
+// %rbp	nptr
+// %rcx	-8*num
+// %r8	end of tp2*num
 	leaq	(%r8,%rcx,1),%rbx
 	movq	%rcx,%r9
 	movq	%rcx,%rdx
 	movq	%xmm1,%rdi
-	sarq	$3+2,%rcx
+	sarq	$3+2,%rcx  // %cf=0
 	jmp	.Lsqr8x_sub
 
 .align	32
 .Lsqr8x_nox:
-	call	bn_sqr8x_internal
-
-
-
-
+	call	bn_sqr8x_internal  // see x86_64-mont5 module
+// %rax	top-most carry
+// %rbp	nptr
+// %r8	-8*num
+// %rdi	end of tp2*num
 	leaq	(%rdi,%r9,1),%rbx
 	movq	%r9,%rcx
 	movq	%r9,%rdx
 	movq	%xmm1,%rdi
-	sarq	$3+2,%rcx
+	sarq	$3+2,%rcx  // %cf=0
 	jmp	.Lsqr8x_sub
 
 .align	32
@@ -816,17 +816,17 @@
 	movq	%r14,16(%rdi)
 	movq	%r15,24(%rdi)
 	leaq	32(%rdi),%rdi
-	incq	%rcx
+	incq	%rcx  // preserves %cf
 	jnz	.Lsqr8x_sub
 
-	sbbq	$0,%rax
-	leaq	(%rbx,%r9,1),%rbx
-	leaq	(%rdi,%r9,1),%rdi
+	sbbq	$0,%rax  // top-most carry
+	leaq	(%rbx,%r9,1),%rbx  // rewind
+	leaq	(%rdi,%r9,1),%rdi  // rewind
 
 	movq	%rax,%xmm1
 	pxor	%xmm0,%xmm0
 	pshufd	$0,%xmm1,%xmm1
-	movq	40(%rsp),%rsi
+	movq	40(%rsp),%rsi  // restore %rsp
 .cfi_def_cfa	%rsi,8
 	jmp	.Lsqr8x_cond_copy
 
@@ -838,7 +838,7 @@
 	movdqu	0(%rdi),%xmm4
 	movdqu	16(%rdi),%xmm5
 	leaq	32(%rdi),%rdi
-	movdqa	%xmm0,-32(%rbx)
+	movdqa	%xmm0,-32(%rbx)  // zero tp
 	movdqa	%xmm0,-16(%rbx)
 	movdqa	%xmm0,-32(%rbx,%rdx,1)
 	movdqa	%xmm0,-16(%rbx,%rdx,1)
@@ -855,7 +855,7 @@
 	addq	$32,%r9
 	jnz	.Lsqr8x_cond_copy
 
-
+// No return value
 	movq	-48(%rsi),%r15
 .cfi_restore	%r15
 	movq	-40(%rsi),%r14
@@ -897,11 +897,11 @@
 .cfi_offset	%r15,-56
 .Lmulx4x_prologue:
 
-	shll	$3,%r9d
+	shll	$3,%r9d  // convert %r9 to bytes
 	xorq	%r10,%r10
-	subq	%r9,%r10
-	movq	(%r8),%r8
-	leaq	-72(%rsp,%r10,1),%rbp
+	subq	%r9,%r10  // -%r9
+	movq	(%r8),%r8  // *n0
+	leaq	-72(%rsp,%r10,1),%rbp  // future alloca(frame+%r9+8)
 	andq	$-128,%rbp
 	movq	%rsp,%r11
 	subq	%rbp,%r11
@@ -921,62 +921,62 @@
 .Lmulx4x_page_walk_done:
 
 	leaq	(%rdx,%r9,1),%r10
-
-
-
-
-
-
-
-
-
-
-
-
-	movq	%r9,0(%rsp)
+// #############################################################
+// Stack layout
+// +0	num
+// +8	off-loaded &bi
+// +16	end of bnum
+// +24	saved n0
+// +32	saved rp
+// +40	saved %rsp
+// +48	inner counter
+// +56
+// +64	tmpnum+1
+// 
+	movq	%r9,0(%rsp)  // save %r9
 	shrq	$5,%r9
-	movq	%r10,16(%rsp)
+	movq	%r10,16(%rsp)  // end of bnum
 	subq	$1,%r9
-	movq	%r8,24(%rsp)
-	movq	%rdi,32(%rsp)
-	movq	%rax,40(%rsp)
+	movq	%r8,24(%rsp)  // save *n0
+	movq	%rdi,32(%rsp)  // save %rdi
+	movq	%rax,40(%rsp)  // save original %rsp
 .cfi_escape	0x0f,0x05,0x77,0x28,0x06,0x23,0x08
-	movq	%r9,48(%rsp)
+	movq	%r9,48(%rsp)  // inner counter
 	jmp	.Lmulx4x_body
 
 .align	32
 .Lmulx4x_body:
 	leaq	8(%rdx),%rdi
-	movq	(%rdx),%rdx
+	movq	(%rdx),%rdx  // b0, %rdx==%rdx actually
 	leaq	64+32(%rsp),%rbx
 	movq	%rdx,%r9
 
-	mulxq	0(%rsi),%r8,%rax
-	mulxq	8(%rsi),%r11,%r14
+	mulxq	0(%rsi),%r8,%rax  // a0*b0
+	mulxq	8(%rsi),%r11,%r14  // a1*b0
 	addq	%rax,%r11
-	movq	%rdi,8(%rsp)
-	mulxq	16(%rsi),%r12,%r13
+	movq	%rdi,8(%rsp)  // off-load &bi
+	mulxq	16(%rsi),%r12,%r13  // ...
 	adcq	%r14,%r12
 	adcq	$0,%r13
 
-	movq	%r8,%rdi
-	imulq	24(%rsp),%r8
-	xorq	%rbp,%rbp
+	movq	%r8,%rdi  // borrow %rdi
+	imulq	24(%rsp),%r8  // "t0"*n0
+	xorq	%rbp,%rbp  // cf=0, of=0
 
 	mulxq	24(%rsi),%rax,%r14
 	movq	%r8,%rdx
 	leaq	32(%rsi),%rsi
 	adcxq	%rax,%r13
-	adcxq	%rbp,%r14
+	adcxq	%rbp,%r14  // cf=0
 
 	mulxq	0(%rcx),%rax,%r10
-	adcxq	%rax,%rdi
+	adcxq	%rax,%rdi  // discarded
 	adoxq	%r11,%r10
 	mulxq	8(%rcx),%rax,%r11
 	adcxq	%rax,%r10
 	adoxq	%r12,%r11
-.byte	0xc4,0x62,0xfb,0xf6,0xa1,0x10,0x00,0x00,0x00
-	movq	48(%rsp),%rdi
+.byte	0xc4,0x62,0xfb,0xf6,0xa1,0x10,0x00,0x00,0x00  // mulx	2*8(%rcx),%rax,%r12
+	movq	48(%rsp),%rdi  // counter value
 	movq	%r10,-32(%rbx)
 	adcxq	%rax,%r11
 	adoxq	%r13,%r12
@@ -984,7 +984,7 @@
 	movq	%r9,%rdx
 	movq	%r11,-24(%rbx)
 	adcxq	%rax,%r12
-	adoxq	%rbp,%r15
+	adoxq	%rbp,%r15  // of=0
 	leaq	32(%rcx),%rcx
 	movq	%r12,-16(%rbx)
 
@@ -992,18 +992,18 @@
 
 .align	32
 .Lmulx4x_1st:
-	adcxq	%rbp,%r15
-	mulxq	0(%rsi),%r10,%rax
+	adcxq	%rbp,%r15  // cf=0, modulo-scheduled
+	mulxq	0(%rsi),%r10,%rax  // a4*b0
 	adcxq	%r14,%r10
-	mulxq	8(%rsi),%r11,%r14
+	mulxq	8(%rsi),%r11,%r14  // a5*b0
 	adcxq	%rax,%r11
-	mulxq	16(%rsi),%r12,%rax
+	mulxq	16(%rsi),%r12,%rax  // ...
 	adcxq	%r14,%r12
 	mulxq	24(%rsi),%r13,%r14
 .byte	0x67,0x67
 	movq	%r8,%rdx
 	adcxq	%rax,%r13
-	adcxq	%rbp,%r14
+	adcxq	%rbp,%r14  // cf=0
 	leaq	32(%rsi),%rsi
 	leaq	32(%rbx),%rbx
 
@@ -1027,43 +1027,43 @@
 	leaq	32(%rcx),%rcx
 	movq	%r13,-16(%rbx)
 
-	decq	%rdi
+	decq	%rdi  // of=0, pass cf
 	jnz	.Lmulx4x_1st
 
-	movq	0(%rsp),%rax
-	movq	8(%rsp),%rdi
-	adcq	%rbp,%r15
+	movq	0(%rsp),%rax  // load num
+	movq	8(%rsp),%rdi  // re-load &bi
+	adcq	%rbp,%r15  // modulo-scheduled
 	addq	%r15,%r14
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // top-most carry
 	movq	%r14,-8(%rbx)
 	jmp	.Lmulx4x_outer
 
 .align	32
 .Lmulx4x_outer:
-	movq	(%rdi),%rdx
-	leaq	8(%rdi),%rdi
-	subq	%rax,%rsi
-	movq	%r15,(%rbx)
+	movq	(%rdi),%rdx  // bi
+	leaq	8(%rdi),%rdi  // b++
+	subq	%rax,%rsi  // rewind %rsi
+	movq	%r15,(%rbx)  // save top-most carry
 	leaq	64+32(%rsp),%rbx
-	subq	%rax,%rcx
+	subq	%rax,%rcx  // rewind %rcx
 
-	mulxq	0(%rsi),%r8,%r11
-	xorl	%ebp,%ebp
+	mulxq	0(%rsi),%r8,%r11  // a0*bi
+	xorl	%ebp,%ebp  // xor	%rbp,%rbp	# cf=0, of=0
 	movq	%rdx,%r9
-	mulxq	8(%rsi),%r14,%r12
+	mulxq	8(%rsi),%r14,%r12  // a1*bi
 	adoxq	-32(%rbx),%r8
 	adcxq	%r14,%r11
-	mulxq	16(%rsi),%r15,%r13
+	mulxq	16(%rsi),%r15,%r13  // ...
 	adoxq	-24(%rbx),%r11
 	adcxq	%r15,%r12
 	adoxq	-16(%rbx),%r12
 	adcxq	%rbp,%r13
 	adoxq	%rbp,%r13
 
-	movq	%rdi,8(%rsp)
+	movq	%rdi,8(%rsp)  // off-load &bi
 	movq	%r8,%r15
-	imulq	24(%rsp),%r8
-	xorl	%ebp,%ebp
+	imulq	24(%rsp),%r8  // "t0"*n0
+	xorl	%ebp,%ebp  // xor	%rbp,%rbp	# cf=0, of=0
 
 	mulxq	24(%rsi),%rax,%r14
 	movq	%r8,%rdx
@@ -1074,7 +1074,7 @@
 	adoxq	%rbp,%r14
 
 	mulxq	0(%rcx),%rax,%r10
-	adcxq	%rax,%r15
+	adcxq	%rax,%r15  // discarded
 	adoxq	%r11,%r10
 	mulxq	8(%rcx),%rax,%r11
 	adcxq	%rax,%r10
@@ -1088,21 +1088,21 @@
 	movq	%r11,-24(%rbx)
 	leaq	32(%rcx),%rcx
 	adcxq	%rax,%r12
-	adoxq	%rbp,%r15
-	movq	48(%rsp),%rdi
+	adoxq	%rbp,%r15  // of=0
+	movq	48(%rsp),%rdi  // counter value
 	movq	%r12,-16(%rbx)
 
 	jmp	.Lmulx4x_inner
 
 .align	32
 .Lmulx4x_inner:
-	mulxq	0(%rsi),%r10,%rax
-	adcxq	%rbp,%r15
+	mulxq	0(%rsi),%r10,%rax  // a4*bi
+	adcxq	%rbp,%r15  // cf=0, modulo-scheduled
 	adoxq	%r14,%r10
-	mulxq	8(%rsi),%r11,%r14
+	mulxq	8(%rsi),%r11,%r14  // a5*bi
 	adcxq	0(%rbx),%r10
 	adoxq	%rax,%r11
-	mulxq	16(%rsi),%r12,%rax
+	mulxq	16(%rsi),%r12,%rax  // ...
 	adcxq	8(%rbx),%r11
 	adoxq	%r14,%r12
 	mulxq	24(%rsi),%r13,%r14
@@ -1110,10 +1110,10 @@
 	adcxq	16(%rbx),%r12
 	adoxq	%rax,%r13
 	adcxq	24(%rbx),%r13
-	adoxq	%rbp,%r14
+	adoxq	%rbp,%r14  // of=0
 	leaq	32(%rsi),%rsi
 	leaq	32(%rbx),%rbx
-	adcxq	%rbp,%r14
+	adcxq	%rbp,%r14  // cf=0
 
 	adoxq	%r15,%r10
 	mulxq	0(%rcx),%rax,%r15
@@ -1135,26 +1135,26 @@
 	leaq	32(%rcx),%rcx
 	movq	%r13,-16(%rbx)
 
-	decq	%rdi
+	decq	%rdi  // of=0, pass cf
 	jnz	.Lmulx4x_inner
 
-	movq	0(%rsp),%rax
-	movq	8(%rsp),%rdi
-	adcq	%rbp,%r15
-	subq	0(%rbx),%rbp
+	movq	0(%rsp),%rax  // load num
+	movq	8(%rsp),%rdi  // re-load &bi
+	adcq	%rbp,%r15  // modulo-scheduled
+	subq	0(%rbx),%rbp  // pull top-most carry
 	adcq	%r15,%r14
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // top-most carry
 	movq	%r14,-8(%rbx)
 
 	cmpq	16(%rsp),%rdi
 	jne	.Lmulx4x_outer
 
 	leaq	64(%rsp),%rbx
-	subq	%rax,%rcx
+	subq	%rax,%rcx  // rewind %rcx
 	negq	%r15
 	movq	%rax,%rdx
-	shrq	$3+2,%rax
-	movq	32(%rsp),%rdi
+	shrq	$3+2,%rax  // %cf=0
+	movq	32(%rsp),%rdi  // restore rp
 	jmp	.Lmulx4x_sub
 
 .align	32
@@ -1174,17 +1174,17 @@
 	movq	%r13,16(%rdi)
 	movq	%r14,24(%rdi)
 	leaq	32(%rdi),%rdi
-	decq	%rax
+	decq	%rax  // preserves %cf
 	jnz	.Lmulx4x_sub
 
-	sbbq	$0,%r15
+	sbbq	$0,%r15  // top-most carry
 	leaq	64(%rsp),%rbx
-	subq	%rdx,%rdi
+	subq	%rdx,%rdi  // rewind
 
 	movq	%r15,%xmm1
 	pxor	%xmm0,%xmm0
 	pshufd	$0,%xmm1,%xmm1
-	movq	40(%rsp),%rsi
+	movq	40(%rsp),%rsi  // restore %rsp
 .cfi_def_cfa	%rsi,8
 	jmp	.Lmulx4x_cond_copy
 
@@ -1196,7 +1196,7 @@
 	movdqu	0(%rdi),%xmm4
 	movdqu	16(%rdi),%xmm5
 	leaq	32(%rdi),%rdi
-	movdqa	%xmm0,-32(%rbx)
+	movdqa	%xmm0,-32(%rbx)  // zero tp
 	movdqa	%xmm0,-16(%rbx)
 	pcmpeqd	%xmm1,%xmm0
 	pand	%xmm1,%xmm2
@@ -1213,7 +1213,7 @@
 
 	movq	%rdx,(%rbx)
 
-
+// No return value
 	movq	-48(%rsi),%r15
 .cfi_restore	%r15
 	movq	-40(%rsi),%r14

boringssl-0.20260708.tar.xz/gen/bcm/x86_64-mont-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/x86_64-mont-win.asm Changed

@@ -50,18 +50,18 @@
 
 	neg	r9
 	mov	r11,rsp
-	lea	r10,((-16))+r9*8+rsp
-	neg	r9
-	and	r10,-1024
-
-
-
-
-
-
-
-
-
+	lea	r10,((-16))+r9*8+rsp  ; future alloca(8*(num+2))
+	neg	r9  ; restore %r9
+	and	r10,-1024  ; minimize TLB usage
+
+; An OS-agnostic version of __chkstk.
+; 
+; Some OSes (Windows) insist on stack being "wired" to
+; physical memory in strictly sequential manner, i.e. if stack
+; allocation spans two pages, then reference to farmost one can
+; be punishable by SEGV. But page walking can do good even on
+; other OSes, because it guarantees that villain thread hits
+; the guard page before it can make damage to innocent one...
 	sub	r11,r10
 	and	r11,-4096
 	lea	rsp,r11*1+r10
@@ -78,32 +78,32 @@
 	ja	NEAR $L$mul_page_walk
 $L$mul_page_walk_done:
 
-	mov	QWORD8+r9*8+rsp,rax
+	mov	QWORD8+r9*8+rsp,rax  ; tpnum+1=%rsp
 
 $L$mul_body:
-	mov	r12,rdx
-	mov	r8,QWORDr8
-	mov	rbx,QWORDr12
+	mov	r12,rdx  ; reassign %rdx
+	mov	r8,QWORDr8  ; pull n00 value
+	mov	rbx,QWORDr12  ; m0=bp0
 	mov	rax,QWORDrsi
 
-	xor	r14,r14
-	xor	r15,r15
+	xor	r14,r14  ; i=0
+	xor	r15,r15  ; j=0
 
 	mov	rbp,r8
-	mul	rbx
+	mul	rbx  ; ap0*bp0
 	mov	r10,rax
 	mov	rax,QWORDrcx
 
-	imul	rbp,r10
+	imul	rbp,r10  ; "tp0"*n0
 	mov	r11,rdx
 
-	mul	rbp
-	add	r10,rax
+	mul	rbp  ; np0*m1
+	add	r10,rax  ; discarded
 	mov	rax,QWORD8+rsi
 	adc	rdx,0
 	mov	r13,rdx
 
-	lea	r15,1+r15
+	lea	r15,1+r15  ; j++
 	jmp	NEAR $L$1st_enter
 
 ALIGN	16
@@ -111,30 +111,30 @@
 	add	r13,rax
 	mov	rax,QWORDr15*8+rsi
 	adc	rdx,0
-	add	r13,r11
+	add	r13,r11  ; npj*m1+apj*bp0
 	mov	r11,r10
 	adc	rdx,0
-	mov	QWORD((-16))+r15*8+rsp,r13
+	mov	QWORD((-16))+r15*8+rsp,r13  ; tpj-1
 	mov	r13,rdx
 
 $L$1st_enter:
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r11,rax
 	mov	rax,QWORDr15*8+rcx
 	adc	rdx,0
-	lea	r15,1+r15
+	lea	r15,1+r15  ; j++
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	cmp	r15,r9
 	jne	NEAR $L$1st
 
 	add	r13,rax
-	mov	rax,QWORDrsi
+	mov	rax,QWORDrsi  ; ap0
 	adc	rdx,0
-	add	r13,r11
+	add	r13,r11  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-16))+r15*8+rsp,r13
+	mov	QWORD((-16))+r15*8+rsp,r13  ; tpj-1
 	mov	r13,rdx
 	mov	r11,r10
 
@@ -142,32 +142,32 @@
 	add	r13,r11
 	adc	rdx,0
 	mov	QWORD((-8))+r9*8+rsp,r13
-	mov	QWORDr9*8+rsp,rdx
+	mov	QWORDr9*8+rsp,rdx  ; store upmost overflow bit
 
-	lea	r14,1+r14
+	lea	r14,1+r14  ; i++
 	jmp	NEAR $L$outer
 ALIGN	16
 $L$outer:
-	mov	rbx,QWORDr14*8+r12
-	xor	r15,r15
+	mov	rbx,QWORDr14*8+r12  ; m0=bpi
+	xor	r15,r15  ; j=0
 	mov	rbp,r8
 	mov	r10,QWORDrsp
-	mul	rbx
-	add	r10,rax
+	mul	rbx  ; ap0*bpi
+	add	r10,rax  ; ap0*bpi+tp0
 	mov	rax,QWORDrcx
 	adc	rdx,0
 
-	imul	rbp,r10
+	imul	rbp,r10  ; tp0*n0
 	mov	r11,rdx
 
-	mul	rbp
-	add	r10,rax
+	mul	rbp  ; np0*m1
+	add	r10,rax  ; discarded
 	mov	rax,QWORD8+rsi
 	adc	rdx,0
-	mov	r10,QWORD8+rsp
+	mov	r10,QWORD8+rsp  ; tp1
 	mov	r13,rdx
 
-	lea	r15,1+r15
+	lea	r15,1+r15  ; j++
 	jmp	NEAR $L$inner_enter
 
 ALIGN	16
@@ -175,80 +175,80 @@
 	add	r13,rax
 	mov	rax,QWORDr15*8+rsi
 	adc	rdx,0
-	add	r13,r10
+	add	r13,r10  ; npj*m1+apj*bpi+tpj
 	mov	r10,QWORDr15*8+rsp
 	adc	rdx,0
-	mov	QWORD((-16))+r15*8+rsp,r13
+	mov	QWORD((-16))+r15*8+rsp,r13  ; tpj-1
 	mov	r13,rdx
 
 $L$inner_enter:
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r11,rax
 	mov	rax,QWORDr15*8+rcx
 	adc	rdx,0
-	add	r10,r11
+	add	r10,r11  ; apj*bpi+tpj
 	mov	r11,rdx
 	adc	r11,0
-	lea	r15,1+r15
+	lea	r15,1+r15  ; j++
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	cmp	r15,r9
 	jne	NEAR $L$inner
 
 	add	r13,rax
-	mov	rax,QWORDrsi
+	mov	rax,QWORDrsi  ; ap0
 	adc	rdx,0
-	add	r13,r10
+	add	r13,r10  ; npj*m1+apj*bpi+tpj
 	mov	r10,QWORDr15*8+rsp
 	adc	rdx,0
-	mov	QWORD((-16))+r15*8+rsp,r13
+	mov	QWORD((-16))+r15*8+rsp,r13  ; tpj-1
 	mov	r13,rdx
 
 	xor	rdx,rdx
 	add	r13,r11
 	adc	rdx,0
-	add	r13,r10
+	add	r13,r10  ; pull upmost overflow bit
 	adc	rdx,0
 	mov	QWORD((-8))+r9*8+rsp,r13
-	mov	QWORDr9*8+rsp,rdx
+	mov	QWORDr9*8+rsp,rdx  ; store upmost overflow bit
 
-	lea	r14,1+r14
+	lea	r14,1+r14  ; i++
 	cmp	r14,r9
 	jb	NEAR $L$outer
 
-	xor	r14,r14
-	mov	rax,QWORDrsp
-	mov	r15,r9
+	xor	r14,r14  ; i=0 and clear CF!
+	mov	rax,QWORDrsp  ; tp0
+	mov	r15,r9  ; j=num
 
 ALIGN	16
 $L$sub:	sbb	rax,QWORDr14*8+rcx
-	mov	QWORDr14*8+rdi,rax
-	mov	rax,QWORD8+r14*8+rsp
-	lea	r14,1+r14
-	dec	r15
+	mov	QWORDr14*8+rdi,rax  ; rpi=tpi-npi
+	mov	rax,QWORD8+r14*8+rsp  ; tpi+1
+	lea	r14,1+r14  ; i++
+	dec	r15  ; doesn't affect CF!
 	jnz	NEAR $L$sub
 
-	sbb	rax,0
+	sbb	rax,0  ; handle upmost overflow bit
 	mov	rbx,-1
-	xor	rbx,rax
+	xor	rbx,rax  ; not %rax
 	xor	r14,r14
-	mov	r15,r9
+	mov	r15,r9  ; j=num
 
-$L$copy:
+$L$copy:  ; conditional copy
 	mov	rcx,QWORDr14*8+rdi
 	mov	rdx,QWORDr14*8+rsp
 	and	rcx,rbx
 	and	rdx,rax
-	mov	QWORDr14*8+rsp,r9
+	mov	QWORDr14*8+rsp,r9  ; zap temporary vector
 	or	rdx,rcx
-	mov	QWORDr14*8+rdi,rdx
+	mov	QWORDr14*8+rdi,rdx  ; rpi=tpi
 	lea	r14,1+r14
 	sub	r15,1
 	jnz	NEAR $L$copy
 
-	mov	rsi,QWORD8+r9*8+rsp
-
+	mov	rsi,QWORD8+r9*8+rsp  ; restore %rsp
 
+; No return value
 	mov	r15,QWORD((-48))+rsi
 
 	mov	r14,QWORD((-40))+rsi
@@ -305,9 +305,9 @@
 
 	neg	r9
 	mov	r11,rsp
-	lea	r10,((-32))+r9*8+rsp
-	neg	r9
-	and	r10,-1024
+	lea	r10,((-32))+r9*8+rsp  ; future alloca(8*(num+4))
+	neg	r9  ; restore
+	and	r10,-1024  ; minimize TLB usage
 
 	sub	r11,r10
 	and	r11,-4096
@@ -324,28 +324,28 @@
 	ja	NEAR $L$mul4x_page_walk
 $L$mul4x_page_walk_done:
 
-	mov	QWORD8+r9*8+rsp,rax
+	mov	QWORD8+r9*8+rsp,rax  ; tpnum+1=%rsp
 
 $L$mul4x_body:
-	mov	QWORD16+r9*8+rsp,rdi
-	mov	r12,rdx
-	mov	r8,QWORDr8
-	mov	rbx,QWORDr12
+	mov	QWORD16+r9*8+rsp,rdi  ; tpnum+2=%rdi
+	mov	r12,rdx  ; reassign %r12
+	mov	r8,QWORDr8  ; pull n00 value
+	mov	rbx,QWORDr12  ; m0=bp0
 	mov	rax,QWORDrsi
 
-	xor	r14,r14
-	xor	r15,r15
+	xor	r14,r14  ; i=0
+	xor	r15,r15  ; j=0
 
 	mov	rbp,r8
-	mul	rbx
+	mul	rbx  ; ap0*bp0
 	mov	r10,rax
 	mov	rax,QWORDrcx
 
-	imul	rbp,r10
+	imul	rbp,r10  ; "tp0"*n0
 	mov	r11,rdx
 
-	mul	rbp
-	add	r10,rax
+	mul	rbp  ; np0*m1
+	add	r10,rax  ; discarded
 	mov	rax,QWORD8+rsi
 	adc	rdx,0
 	mov	rdi,rdx
@@ -361,171 +361,171 @@
 	mov	rax,QWORD16+rsi
 	adc	rdx,0
 	add	rdi,r11
-	lea	r15,4+r15
+	lea	r15,4+r15  ; j++
 	adc	rdx,0
 	mov	QWORDrsp,rdi
 	mov	r13,rdx
 	jmp	NEAR $L$1st4x
 ALIGN	16
 $L$1st4x:
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r10,rax
 	mov	rax,QWORD((-16))+r15*8+rcx
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	r13,rax
 	mov	rax,QWORD((-8))+r15*8+rsi
 	adc	rdx,0
-	add	r13,r10
+	add	r13,r10  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-24))+r15*8+rsp,r13
+	mov	QWORD((-24))+r15*8+rsp,r13  ; tpj-1
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r11,rax
 	mov	rax,QWORD((-8))+r15*8+rcx
 	adc	rdx,0
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
 	mov	rax,QWORDr15*8+rsi
 	adc	rdx,0
-	add	rdi,r11
+	add	rdi,r11  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-16))+r15*8+rsp,rdi
+	mov	QWORD((-16))+r15*8+rsp,rdi  ; tpj-1
 	mov	r13,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r10,rax
 	mov	rax,QWORDr15*8+rcx
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	r13,rax
 	mov	rax,QWORD8+r15*8+rsi
 	adc	rdx,0
-	add	r13,r10
+	add	r13,r10  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-8))+r15*8+rsp,r13
+	mov	QWORD((-8))+r15*8+rsp,r13  ; tpj-1
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r11,rax
 	mov	rax,QWORD8+r15*8+rcx
 	adc	rdx,0
-	lea	r15,4+r15
+	lea	r15,4+r15  ; j++
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
 	mov	rax,QWORD((-16))+r15*8+rsi
 	adc	rdx,0
-	add	rdi,r11
+	add	rdi,r11  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-32))+r15*8+rsp,rdi
+	mov	QWORD((-32))+r15*8+rsp,rdi  ; tpj-1
 	mov	r13,rdx
 	cmp	r15,r9
 	jb	NEAR $L$1st4x
 
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r10,rax
 	mov	rax,QWORD((-16))+r15*8+rcx
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	r13,rax
 	mov	rax,QWORD((-8))+r15*8+rsi
 	adc	rdx,0
-	add	r13,r10
+	add	r13,r10  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-24))+r15*8+rsp,r13
+	mov	QWORD((-24))+r15*8+rsp,r13  ; tpj-1
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r11,rax
 	mov	rax,QWORD((-8))+r15*8+rcx
 	adc	rdx,0
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
-	mov	rax,QWORDrsi
+	mov	rax,QWORDrsi  ; ap0
 	adc	rdx,0
-	add	rdi,r11
+	add	rdi,r11  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-16))+r15*8+rsp,rdi
+	mov	QWORD((-16))+r15*8+rsp,rdi  ; tpj-1
 	mov	r13,rdx
 
 	xor	rdi,rdi
 	add	r13,r10
 	adc	rdi,0
 	mov	QWORD((-8))+r15*8+rsp,r13
-	mov	QWORDr15*8+rsp,rdi
+	mov	QWORDr15*8+rsp,rdi  ; store upmost overflow bit
 
-	lea	r14,1+r14
+	lea	r14,1+r14  ; i++
 ALIGN	4
 $L$outer4x:
-	mov	rbx,QWORDr14*8+r12
-	xor	r15,r15
+	mov	rbx,QWORDr14*8+r12  ; m0=bpi
+	xor	r15,r15  ; j=0
 	mov	r10,QWORDrsp
 	mov	rbp,r8
-	mul	rbx
-	add	r10,rax
+	mul	rbx  ; ap0*bpi
+	add	r10,rax  ; ap0*bpi+tp0
 	mov	rax,QWORDrcx
 	adc	rdx,0
 
-	imul	rbp,r10
+	imul	rbp,r10  ; tp0*n0
 	mov	r11,rdx
 
-	mul	rbp
-	add	r10,rax
+	mul	rbp  ; np0*m1
+	add	r10,rax  ; "%r13", discarded
 	mov	rax,QWORD8+rsi
 	adc	rdx,0
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r11,rax
 	mov	rax,QWORD8+rcx
 	adc	rdx,0
-	add	r11,QWORD8+rsp
+	add	r11,QWORD8+rsp  ; +tp1
 	adc	rdx,0
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
 	mov	rax,QWORD16+rsi
 	adc	rdx,0
-	add	rdi,r11
-	lea	r15,4+r15
+	add	rdi,r11  ; npj*m1+apj*bpi+tpj
+	lea	r15,4+r15  ; j+=2
 	adc	rdx,0
-	mov	QWORDrsp,rdi
+	mov	QWORDrsp,rdi  ; tpj-1
 	mov	r13,rdx
 	jmp	NEAR $L$inner4x
 ALIGN	16
 $L$inner4x:
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r10,rax
 	mov	rax,QWORD((-16))+r15*8+rcx
 	adc	rdx,0
-	add	r10,QWORD((-16))+r15*8+rsp
+	add	r10,QWORD((-16))+r15*8+rsp  ; apj*bpi+tpj
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	r13,rax
 	mov	rax,QWORD((-8))+r15*8+rsi
 	adc	rdx,0
 	add	r13,r10
 	adc	rdx,0
-	mov	QWORD((-24))+r15*8+rsp,r13
+	mov	QWORD((-24))+r15*8+rsp,r13  ; tpj-1
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r11,rax
 	mov	rax,QWORD((-8))+r15*8+rcx
 	adc	rdx,0
@@ -533,148 +533,148 @@
 	adc	rdx,0
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
 	mov	rax,QWORDr15*8+rsi
 	adc	rdx,0
 	add	rdi,r11
 	adc	rdx,0
-	mov	QWORD((-16))+r15*8+rsp,rdi
+	mov	QWORD((-16))+r15*8+rsp,rdi  ; tpj-1
 	mov	r13,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r10,rax
 	mov	rax,QWORDr15*8+rcx
 	adc	rdx,0
-	add	r10,QWORDr15*8+rsp
+	add	r10,QWORDr15*8+rsp  ; apj*bpi+tpj
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	r13,rax
 	mov	rax,QWORD8+r15*8+rsi
 	adc	rdx,0
 	add	r13,r10
 	adc	rdx,0
-	mov	QWORD((-8))+r15*8+rsp,r13
+	mov	QWORD((-8))+r15*8+rsp,r13  ; tpj-1
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r11,rax
 	mov	rax,QWORD8+r15*8+rcx
 	adc	rdx,0
 	add	r11,QWORD8+r15*8+rsp
 	adc	rdx,0
-	lea	r15,4+r15
+	lea	r15,4+r15  ; j++
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
 	mov	rax,QWORD((-16))+r15*8+rsi
 	adc	rdx,0
 	add	rdi,r11
 	adc	rdx,0
-	mov	QWORD((-32))+r15*8+rsp,rdi
+	mov	QWORD((-32))+r15*8+rsp,rdi  ; tpj-1
 	mov	r13,rdx
 	cmp	r15,r9
 	jb	NEAR $L$inner4x
 
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r10,rax
 	mov	rax,QWORD((-16))+r15*8+rcx
 	adc	rdx,0
-	add	r10,QWORD((-16))+r15*8+rsp
+	add	r10,QWORD((-16))+r15*8+rsp  ; apj*bpi+tpj
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	r13,rax
 	mov	rax,QWORD((-8))+r15*8+rsi
 	adc	rdx,0
 	add	r13,r10
 	adc	rdx,0
-	mov	QWORD((-24))+r15*8+rsp,r13
+	mov	QWORD((-24))+r15*8+rsp,r13  ; tpj-1
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r11,rax
 	mov	rax,QWORD((-8))+r15*8+rcx
 	adc	rdx,0
 	add	r11,QWORD((-8))+r15*8+rsp
 	adc	rdx,0
-	lea	r14,1+r14
+	lea	r14,1+r14  ; i++
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
-	mov	rax,QWORDrsi
+	mov	rax,QWORDrsi  ; ap0
 	adc	rdx,0
 	add	rdi,r11
 	adc	rdx,0
-	mov	QWORD((-16))+r15*8+rsp,rdi
+	mov	QWORD((-16))+r15*8+rsp,rdi  ; tpj-1
 	mov	r13,rdx
 
 	xor	rdi,rdi
 	add	r13,r10
 	adc	rdi,0
-	add	r13,QWORDr9*8+rsp
+	add	r13,QWORDr9*8+rsp  ; pull upmost overflow bit
 	adc	rdi,0
 	mov	QWORD((-8))+r15*8+rsp,r13
-	mov	QWORDr15*8+rsp,rdi
+	mov	QWORDr15*8+rsp,rdi  ; store upmost overflow bit
 
 	cmp	r14,r9
 	jb	NEAR $L$outer4x
-	mov	rdi,QWORD16+r9*8+rsp
+	mov	rdi,QWORD16+r9*8+rsp  ; restore %rdi
 	lea	r15,((-4))+r9
-	mov	rax,QWORDrsp
-	mov	rdx,QWORD8+rsp
-	shr	r15,2
-	lea	rsi,rsp
-	xor	r14,r14
+	mov	rax,QWORDrsp  ; tp0
+	mov	rdx,QWORD8+rsp  ; tp1
+	shr	r15,2  ; j=num/4-1
+	lea	rsi,rsp  ; borrow ap for tp
+	xor	r14,r14  ; i=0 and clear CF!
 
 	sub	rax,QWORDrcx
-	mov	rbx,QWORD16+rsi
-	mov	rbp,QWORD24+rsi
+	mov	rbx,QWORD16+rsi  ; tp2
+	mov	rbp,QWORD24+rsi  ; tp3
 	sbb	rdx,QWORD8+rcx
 
 $L$sub4x:
-	mov	QWORDr14*8+rdi,rax
-	mov	QWORD8+r14*8+rdi,rdx
+	mov	QWORDr14*8+rdi,rax  ; rpi=tpi-npi
+	mov	QWORD8+r14*8+rdi,rdx  ; rpi=tpi-npi
 	sbb	rbx,QWORD16+r14*8+rcx
-	mov	rax,QWORD32+r14*8+rsi
+	mov	rax,QWORD32+r14*8+rsi  ; tpi+1
 	mov	rdx,QWORD40+r14*8+rsi
 	sbb	rbp,QWORD24+r14*8+rcx
-	mov	QWORD16+r14*8+rdi,rbx
-	mov	QWORD24+r14*8+rdi,rbp
+	mov	QWORD16+r14*8+rdi,rbx  ; rpi=tpi-npi
+	mov	QWORD24+r14*8+rdi,rbp  ; rpi=tpi-npi
 	sbb	rax,QWORD32+r14*8+rcx
 	mov	rbx,QWORD48+r14*8+rsi
 	mov	rbp,QWORD56+r14*8+rsi
 	sbb	rdx,QWORD40+r14*8+rcx
-	lea	r14,4+r14
-	dec	r15
+	lea	r14,4+r14  ; i++
+	dec	r15  ; doesn't affect CF!
 	jnz	NEAR $L$sub4x
 
-	mov	QWORDr14*8+rdi,rax
-	mov	rax,QWORD32+r14*8+rsi
+	mov	QWORDr14*8+rdi,rax  ; rpi=tpi-npi
+	mov	rax,QWORD32+r14*8+rsi  ; load overflow bit
 	sbb	rbx,QWORD16+r14*8+rcx
-	mov	QWORD8+r14*8+rdi,rdx
+	mov	QWORD8+r14*8+rdi,rdx  ; rpi=tpi-npi
 	sbb	rbp,QWORD24+r14*8+rcx
-	mov	QWORD16+r14*8+rdi,rbx
+	mov	QWORD16+r14*8+rdi,rbx  ; rpi=tpi-npi
 
-	sbb	rax,0
-	mov	QWORD24+r14*8+rdi,rbp
+	sbb	rax,0  ; handle upmost overflow bit
+	mov	QWORD24+r14*8+rdi,rbp  ; rpi=tpi-npi
 	pxor	xmm0,xmm0
 	movq	xmm4,rax
 	pcmpeqd	xmm5,xmm5
 	pshufd	xmm4,xmm4,0
 	mov	r15,r9
 	pxor	xmm5,xmm4
-	shr	r15,2
-	xor	eax,eax
+	shr	r15,2  ; j=num/4
+	xor	eax,eax  ; i=0
 
 	jmp	NEAR $L$copy4x
 ALIGN	16
-$L$copy4x:
+$L$copy4x:  ; conditional copy
 	movdqa	xmm1,XMMWORDrax*1+rsp
 	movdqu	xmm2,XMMWORDrax*1+rdi
 	pand	xmm1,xmm4
@@ -692,9 +692,9 @@
 	lea	rax,32+rax
 	dec	r15
 	jnz	NEAR $L$copy4x
-	mov	rsi,QWORD8+r9*8+rsp
-
+	mov	rsi,QWORD8+r9*8+rsp  ; restore %rsp
 
+; No return value
 	mov	r15,QWORD((-48))+rsi
 
 	mov	r14,QWORD((-40))+rsi
@@ -715,8 +715,8 @@
 	ret
 
 $L$SEH_end_bn_mul4x_mont:
-EXTERN	bn_sqrx8x_internal
-EXTERN	bn_sqr8x_internal
+EXTERN	bn_sqrx8x_internal  ; see x86_64-mont5 module
+EXTERN	bn_sqr8x_internal  ; see x86_64-mont5 module
 
 global	bn_sqr8x_mont
 
@@ -754,30 +754,30 @@
 $L$sqr8x_prologue:
 
 	mov	r10d,r9d
-	shl	r9d,3
-	shl	r10,3+2
+	shl	r9d,3  ; convert %r9 to bytes
+	shl	r10,3+2  ; 4*%r9
 	neg	r9
 
-
-
-
-
-
+; #############################################################
+; ensure that stack frame doesn't alias with %rsi modulo
+; 4096. this is done to allow memory disambiguation logic
+; do its job.
+; 
 	lea	r11,((-64))+r9*2+rsp
 	mov	rbp,rsp
-	mov	r8,QWORDr8
+	mov	r8,QWORDr8  ; *n0
 	sub	r11,rsi
 	and	r11,4095
 	cmp	r10,r11
 	jb	NEAR $L$sqr8x_sp_alt
-	sub	rbp,r11
-	lea	rbp,((-64))+r9*2+rbp
+	sub	rbp,r11  ; align with %rsi
+	lea	rbp,((-64))+r9*2+rbp  ; future alloca(frame+2*%r9)
 	jmp	NEAR $L$sqr8x_sp_done
 
 ALIGN	32
 $L$sqr8x_sp_alt:
-	lea	r10,((4096-64))+r9*2
-	lea	rbp,((-64))+r9*2+rbp
+	lea	r10,((4096-64))+r9*2  ; 4096-frame-2*%r9
+	lea	rbp,((-64))+r9*2+rbp  ; future alloca(frame+2*%r9)
 	sub	r11,r10
 	mov	r10,0
 	cmovc	r11,r10
@@ -805,41 +805,41 @@
 	neg	r9
 
 	mov	QWORD32+rsp,r8
-	mov	QWORD40+rsp,rax
+	mov	QWORD40+rsp,rax  ; save original %rsp
 
 $L$sqr8x_body:
 
-	movq	xmm2,rcx
+	movq	xmm2,rcx  ; save pointer to modulus
 	pxor	xmm0,xmm0
-	movq	xmm1,rdi
-	movq	xmm3,r10
+	movq	xmm1,rdi  ; save %rdi
+	movq	xmm3,r10  ; -%r9
 	test	rdx,rdx
 	jz	NEAR $L$sqr8x_nox
 
-	call	bn_sqrx8x_internal
-
-
-
-
+	call	bn_sqrx8x_internal  ; see x86_64-mont5 module
+; %rax	top-most carry
+; %rbp	nptr
+; %rcx	-8*num
+; %r8	end of tp2*num
 	lea	rbx,rcx*1+r8
 	mov	r9,rcx
 	mov	rdx,rcx
 	movq	rdi,xmm1
-	sar	rcx,3+2
+	sar	rcx,3+2  ; %cf=0
 	jmp	NEAR $L$sqr8x_sub
 
 ALIGN	32
 $L$sqr8x_nox:
-	call	bn_sqr8x_internal
-
-
-
-
+	call	bn_sqr8x_internal  ; see x86_64-mont5 module
+; %rax	top-most carry
+; %rbp	nptr
+; %r8	-8*num
+; %rdi	end of tp2*num
 	lea	rbx,r9*1+rdi
 	mov	rcx,r9
 	mov	rdx,r9
 	movq	rdi,xmm1
-	sar	rcx,3+2
+	sar	rcx,3+2  ; %cf=0
 	jmp	NEAR $L$sqr8x_sub
 
 ALIGN	32
@@ -859,17 +859,17 @@
 	mov	QWORD16+rdi,r14
 	mov	QWORD24+rdi,r15
 	lea	rdi,32+rdi
-	inc	rcx
+	inc	rcx  ; preserves %cf
 	jnz	NEAR $L$sqr8x_sub
 
-	sbb	rax,0
-	lea	rbx,r9*1+rbx
-	lea	rdi,r9*1+rdi
+	sbb	rax,0  ; top-most carry
+	lea	rbx,r9*1+rbx  ; rewind
+	lea	rdi,r9*1+rdi  ; rewind
 
 	movq	xmm1,rax
 	pxor	xmm0,xmm0
 	pshufd	xmm1,xmm1,0
-	mov	rsi,QWORD40+rsp
+	mov	rsi,QWORD40+rsp  ; restore %rsp
 
 	jmp	NEAR $L$sqr8x_cond_copy
 
@@ -881,7 +881,7 @@
 	movdqu	xmm4,XMMWORDrdi
 	movdqu	xmm5,XMMWORD16+rdi
 	lea	rdi,32+rdi
-	movdqa	XMMWORD(-32)+rbx,xmm0
+	movdqa	XMMWORD(-32)+rbx,xmm0  ; zero tp
 	movdqa	XMMWORD(-16)+rbx,xmm0
 	movdqa	XMMWORD(-32)+rdx*1+rbx,xmm0
 	movdqa	XMMWORD(-16)+rdx*1+rbx,xmm0
@@ -898,7 +898,7 @@
 	add	r9,32
 	jnz	NEAR $L$sqr8x_cond_copy
 
-
+; No return value
 	mov	r15,QWORD((-48))+rsi
 
 	mov	r14,QWORD((-40))+rsi
@@ -953,11 +953,11 @@
 
 $L$mulx4x_prologue:
 
-	shl	r9d,3
+	shl	r9d,3  ; convert %r9 to bytes
 	xor	r10,r10
-	sub	r10,r9
-	mov	r8,QWORDr8
-	lea	rbp,((-72))+r10*1+rsp
+	sub	r10,r9  ; -%r9
+	mov	r8,QWORDr8  ; *n0
+	lea	rbp,((-72))+r10*1+rsp  ; future alloca(frame+%r9+8)
 	and	rbp,-128
 	mov	r11,rsp
 	sub	r11,rbp
@@ -977,62 +977,62 @@
 $L$mulx4x_page_walk_done:
 
 	lea	r10,r9*1+rdx
-
-
-
-
-
-
-
-
-
-
-
-
-	mov	QWORDrsp,r9
+; #############################################################
+; Stack layout
+; +0	num
+; +8	off-loaded &bi
+; +16	end of bnum
+; +24	saved n0
+; +32	saved rp
+; +40	saved %rsp
+; +48	inner counter
+; +56
+; +64	tmpnum+1
+; 
+	mov	QWORDrsp,r9  ; save %r9
 	shr	r9,5
-	mov	QWORD16+rsp,r10
+	mov	QWORD16+rsp,r10  ; end of bnum
 	sub	r9,1
-	mov	QWORD24+rsp,r8
-	mov	QWORD32+rsp,rdi
-	mov	QWORD40+rsp,rax
+	mov	QWORD24+rsp,r8  ; save *n0
+	mov	QWORD32+rsp,rdi  ; save %rdi
+	mov	QWORD40+rsp,rax  ; save original %rsp
 
-	mov	QWORD48+rsp,r9
+	mov	QWORD48+rsp,r9  ; inner counter
 	jmp	NEAR $L$mulx4x_body
 
 ALIGN	32
 $L$mulx4x_body:
 	lea	rdi,8+rdx
-	mov	rdx,QWORDrdx
+	mov	rdx,QWORDrdx  ; b0, %rdx==%rdx actually
 	lea	rbx,((64+32))+rsp
 	mov	r9,rdx
 
-	mulx	rax,r8,QWORDrsi
-	mulx	r14,r11,QWORD8+rsi
+	mulx	rax,r8,QWORDrsi  ; a0*b0
+	mulx	r14,r11,QWORD8+rsi  ; a1*b0
 	add	r11,rax
-	mov	QWORD8+rsp,rdi
-	mulx	r13,r12,QWORD16+rsi
+	mov	QWORD8+rsp,rdi  ; off-load &bi
+	mulx	r13,r12,QWORD16+rsi  ; ...
 	adc	r12,r14
 	adc	r13,0
 
-	mov	rdi,r8
-	imul	r8,QWORD24+rsp
-	xor	rbp,rbp
+	mov	rdi,r8  ; borrow %rdi
+	imul	r8,QWORD24+rsp  ; "t0"*n0
+	xor	rbp,rbp  ; cf=0, of=0
 
 	mulx	r14,rax,QWORD24+rsi
 	mov	rdx,r8
 	lea	rsi,32+rsi
 	adcx	r13,rax
-	adcx	r14,rbp
+	adcx	r14,rbp  ; cf=0
 
 	mulx	r10,rax,QWORDrcx
-	adcx	rdi,rax
+	adcx	rdi,rax  ; discarded
 	adox	r10,r11
 	mulx	r11,rax,QWORD8+rcx
 	adcx	r10,rax
 	adox	r11,r12
-	DB	0xc4,0x62,0xfb,0xf6,0xa1,0x10,0x00,0x00,0x00
-	mov	rdi,QWORD48+rsp
+	DB	0xc4,0x62,0xfb,0xf6,0xa1,0x10,0x00,0x00,0x00  ; mulx	2*8(%rcx),%rax,%r12
+	mov	rdi,QWORD48+rsp  ; counter value
 	mov	QWORD((-32))+rbx,r10
 	adcx	r11,rax
 	adox	r12,r13
@@ -1040,7 +1040,7 @@
 	mov	rdx,r9
 	mov	QWORD((-24))+rbx,r11
 	adcx	r12,rax
-	adox	r15,rbp
+	adox	r15,rbp  ; of=0
 	lea	rcx,32+rcx
 	mov	QWORD((-16))+rbx,r12
 
@@ -1048,18 +1048,18 @@
 
 ALIGN	32
 $L$mulx4x_1st:
-	adcx	r15,rbp
-	mulx	rax,r10,QWORDrsi
+	adcx	r15,rbp  ; cf=0, modulo-scheduled
+	mulx	rax,r10,QWORDrsi  ; a4*b0
 	adcx	r10,r14
-	mulx	r14,r11,QWORD8+rsi
+	mulx	r14,r11,QWORD8+rsi  ; a5*b0
 	adcx	r11,rax
-	mulx	rax,r12,QWORD16+rsi
+	mulx	rax,r12,QWORD16+rsi  ; ...
 	adcx	r12,r14
 	mulx	r14,r13,QWORD24+rsi
 	DB	0x67,0x67
 	mov	rdx,r8
 	adcx	r13,rax
-	adcx	r14,rbp
+	adcx	r14,rbp  ; cf=0
 	lea	rsi,32+rsi
 	lea	rbx,32+rbx
 
@@ -1083,43 +1083,43 @@
 	lea	rcx,32+rcx
 	mov	QWORD((-16))+rbx,r13
 
-	dec	rdi
+	dec	rdi  ; of=0, pass cf
 	jnz	NEAR $L$mulx4x_1st
 
-	mov	rax,QWORDrsp
-	mov	rdi,QWORD8+rsp
-	adc	r15,rbp
+	mov	rax,QWORDrsp  ; load num
+	mov	rdi,QWORD8+rsp  ; re-load &bi
+	adc	r15,rbp  ; modulo-scheduled
 	add	r14,r15
-	sbb	r15,r15
+	sbb	r15,r15  ; top-most carry
 	mov	QWORD((-8))+rbx,r14
 	jmp	NEAR $L$mulx4x_outer
 
 ALIGN	32
 $L$mulx4x_outer:
-	mov	rdx,QWORDrdi
-	lea	rdi,8+rdi
-	sub	rsi,rax
-	mov	QWORDrbx,r15
+	mov	rdx,QWORDrdi  ; bi
+	lea	rdi,8+rdi  ; b++
+	sub	rsi,rax  ; rewind %rsi
+	mov	QWORDrbx,r15  ; save top-most carry
 	lea	rbx,((64+32))+rsp
-	sub	rcx,rax
+	sub	rcx,rax  ; rewind %rcx
 
-	mulx	r11,r8,QWORDrsi
-	xor	ebp,ebp
+	mulx	r11,r8,QWORDrsi  ; a0*bi
+	xor	ebp,ebp  ; xor	%rbp,%rbp	# cf=0, of=0
 	mov	r9,rdx
-	mulx	r12,r14,QWORD8+rsi
+	mulx	r12,r14,QWORD8+rsi  ; a1*bi
 	adox	r8,QWORD((-32))+rbx
 	adcx	r11,r14
-	mulx	r13,r15,QWORD16+rsi
+	mulx	r13,r15,QWORD16+rsi  ; ...
 	adox	r11,QWORD((-24))+rbx
 	adcx	r12,r15
 	adox	r12,QWORD((-16))+rbx
 	adcx	r13,rbp
 	adox	r13,rbp
 
-	mov	QWORD8+rsp,rdi
+	mov	QWORD8+rsp,rdi  ; off-load &bi
 	mov	r15,r8
-	imul	r8,QWORD24+rsp
-	xor	ebp,ebp
+	imul	r8,QWORD24+rsp  ; "t0"*n0
+	xor	ebp,ebp  ; xor	%rbp,%rbp	# cf=0, of=0
 
 	mulx	r14,rax,QWORD24+rsi
 	mov	rdx,r8
@@ -1130,7 +1130,7 @@
 	adox	r14,rbp
 
 	mulx	r10,rax,QWORDrcx
-	adcx	r15,rax
+	adcx	r15,rax  ; discarded
 	adox	r10,r11
 	mulx	r11,rax,QWORD8+rcx
 	adcx	r10,rax
@@ -1144,21 +1144,21 @@
 	mov	QWORD((-24))+rbx,r11
 	lea	rcx,32+rcx
 	adcx	r12,rax
-	adox	r15,rbp
-	mov	rdi,QWORD48+rsp
+	adox	r15,rbp  ; of=0
+	mov	rdi,QWORD48+rsp  ; counter value
 	mov	QWORD((-16))+rbx,r12
 
 	jmp	NEAR $L$mulx4x_inner
 
 ALIGN	32
 $L$mulx4x_inner:
-	mulx	rax,r10,QWORDrsi
-	adcx	r15,rbp
+	mulx	rax,r10,QWORDrsi  ; a4*bi
+	adcx	r15,rbp  ; cf=0, modulo-scheduled
 	adox	r10,r14
-	mulx	r14,r11,QWORD8+rsi
+	mulx	r14,r11,QWORD8+rsi  ; a5*bi
 	adcx	r10,QWORDrbx
 	adox	r11,rax
-	mulx	rax,r12,QWORD16+rsi
+	mulx	rax,r12,QWORD16+rsi  ; ...
 	adcx	r11,QWORD8+rbx
 	adox	r12,r14
 	mulx	r14,r13,QWORD24+rsi
@@ -1166,10 +1166,10 @@
 	adcx	r12,QWORD16+rbx
 	adox	r13,rax
 	adcx	r13,QWORD24+rbx
-	adox	r14,rbp
+	adox	r14,rbp  ; of=0
 	lea	rsi,32+rsi
 	lea	rbx,32+rbx
-	adcx	r14,rbp
+	adcx	r14,rbp  ; cf=0
 
 	adox	r10,r15
 	mulx	r15,rax,QWORDrcx
@@ -1191,26 +1191,26 @@
 	lea	rcx,32+rcx
 	mov	QWORD((-16))+rbx,r13
 
-	dec	rdi
+	dec	rdi  ; of=0, pass cf
 	jnz	NEAR $L$mulx4x_inner
 
-	mov	rax,QWORDrsp
-	mov	rdi,QWORD8+rsp
-	adc	r15,rbp
-	sub	rbp,QWORDrbx
+	mov	rax,QWORDrsp  ; load num
+	mov	rdi,QWORD8+rsp  ; re-load &bi
+	adc	r15,rbp  ; modulo-scheduled
+	sub	rbp,QWORDrbx  ; pull top-most carry
 	adc	r14,r15
-	sbb	r15,r15
+	sbb	r15,r15  ; top-most carry
 	mov	QWORD((-8))+rbx,r14
 
 	cmp	rdi,QWORD16+rsp
 	jne	NEAR $L$mulx4x_outer
 
 	lea	rbx,64+rsp
-	sub	rcx,rax
+	sub	rcx,rax  ; rewind %rcx
 	neg	r15
 	mov	rdx,rax
-	shr	rax,3+2
-	mov	rdi,QWORD32+rsp
+	shr	rax,3+2  ; %cf=0
+	mov	rdi,QWORD32+rsp  ; restore rp
 	jmp	NEAR $L$mulx4x_sub
 
 ALIGN	32
@@ -1230,17 +1230,17 @@
 	mov	QWORD16+rdi,r13
 	mov	QWORD24+rdi,r14
 	lea	rdi,32+rdi
-	dec	rax
+	dec	rax  ; preserves %cf
 	jnz	NEAR $L$mulx4x_sub
 
-	sbb	r15,0
+	sbb	r15,0  ; top-most carry
 	lea	rbx,64+rsp
-	sub	rdi,rdx
+	sub	rdi,rdx  ; rewind
 
 	movq	xmm1,r15
 	pxor	xmm0,xmm0
 	pshufd	xmm1,xmm1,0
-	mov	rsi,QWORD40+rsp
+	mov	rsi,QWORD40+rsp  ; restore %rsp
 
 	jmp	NEAR $L$mulx4x_cond_copy
 
@@ -1252,7 +1252,7 @@
 	movdqu	xmm4,XMMWORDrdi
 	movdqu	xmm5,XMMWORD16+rdi
 	lea	rdi,32+rdi
-	movdqa	XMMWORD(-32)+rbx,xmm0
+	movdqa	XMMWORD(-32)+rbx,xmm0  ; zero tp
 	movdqa	XMMWORD(-16)+rbx,xmm0
 	pcmpeqd	xmm0,xmm1
 	pand	xmm2,xmm1
@@ -1269,7 +1269,7 @@
 
 	mov	QWORDrbx,rdx
 
-
+; No return value
 	mov	r15,QWORD((-48))+rsi
 
 	mov	r14,QWORD((-40))+rsi
@@ -1311,26 +1311,26 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; end of prologue label
+	cmp	rbx,r10  ; context->Rip<end of prologue label
 	jb	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$common_seh_tail
 
-	mov	r10,QWORD192+r8
-	mov	rax,QWORD8+r10*8+rax
+	mov	r10,QWORD192+r8  ; pull %r9
+	mov	rax,QWORD8+r10*8+rax  ; pull saved stack pointer
 
 	jmp	NEAR $L$common_pop_regs
 
@@ -1349,30 +1349,30 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; end of prologue label
+	cmp	rbx,r10  ; context->Rip<.Lsqr_prologue
 	jb	NEAR $L$common_seh_tail
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; body label
+	cmp	rbx,r10  ; context->Rip<.Lsqr_body
 	jb	NEAR $L$common_pop_regs
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
-	mov	r10d,DWORD8+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD8+r11  ; HandlerData2
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=.Lsqr_epilogue
 	jae	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD40+rax
+	mov	rax,QWORD40+rax  ; pull saved stack pointer
 
 $L$common_pop_regs:
 	mov	rbx,QWORD((-8))+rax
@@ -1381,40 +1381,40 @@
 	mov	r13,QWORD((-32))+rax
 	mov	r14,QWORD((-40))+rax
 	mov	r15,QWORD((-48))+rax
-	mov	QWORD144+r8,rbx
-	mov	QWORD160+r8,rbp
-	mov	QWORD216+r8,r12
-	mov	QWORD224+r8,r13
-	mov	QWORD232+r8,r14
-	mov	QWORD240+r8,r15
+	mov	QWORD144+r8,rbx  ; restore context->Rbx
+	mov	QWORD160+r8,rbp  ; restore context->Rbp
+	mov	QWORD216+r8,r12  ; restore context->R12
+	mov	QWORD224+r8,r13  ; restore context->R13
+	mov	QWORD232+r8,r14  ; restore context->R14
+	mov	QWORD240+r8,r15  ; restore context->R15
 
 $L$common_seh_tail:
 	mov	rdi,QWORD8+rax
 	mov	rsi,QWORD16+rax
-	mov	QWORD152+r8,rax
-	mov	QWORD168+r8,rsi
-	mov	QWORD176+r8,rdi
+	mov	QWORD152+r8,rax  ; restore context->Rsp
+	mov	QWORD168+r8,rsi  ; restore context->Rsi
+	mov	QWORD176+r8,rdi  ; restore context->Rdi
 
-	mov	rdi,QWORD40+r9
-	mov	rsi,r8
-	mov	ecx,154
-	DD	0xa548f3fc
+	mov	rdi,QWORD40+r9  ; disp->ContextRecord
+	mov	rsi,r8  ; context
+	mov	ecx,154  ; sizeof(CONTEXT)
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	mov	rsi,r9
-	xor	rcx,rcx
-	mov	rdx,QWORD8+rsi
-	mov	r8,QWORDrsi
-	mov	r9,QWORD16+rsi
-	mov	r10,QWORD40+rsi
-	lea	r11,56+rsi
-	lea	r12,24+rsi
-	mov	QWORD32+rsp,r10
-	mov	QWORD40+rsp,r11
-	mov	QWORD48+rsp,r12
-	mov	QWORD56+rsp,rcx
+	xor	rcx,rcx  ; arg1, UNW_FLAG_NHANDLER
+	mov	rdx,QWORD8+rsi  ; arg2, disp->ImageBase
+	mov	r8,QWORDrsi  ; arg3, disp->ControlPc
+	mov	r9,QWORD16+rsi  ; arg4, disp->FunctionEntry
+	mov	r10,QWORD40+rsi  ; disp->ContextRecord
+	lea	r11,56+rsi  ; &disp->HandlerData
+	lea	r12,24+rsi  ; &disp->EstablisherFrame
+	mov	QWORD32+rsp,r10  ; arg5
+	mov	QWORD40+rsp,r11  ; arg6
+	mov	QWORD48+rsp,r12  ; arg7
+	mov	QWORD56+rsp,rcx  ; arg8, (NULL)
 	call	QWORD__imp_RtlVirtualUnwind
 
-	mov	eax,1
+	mov	eax,1  ; ExceptionContinueSearch
 	add	rsp,64
 	popfq
 	pop	r15
@@ -1449,20 +1449,20 @@
 $L$SEH_info_bn_mul_mont_nohw:
 	DB	9,0,0,0
 	DD	mul_handler wrt ..imagebase
-	DD	$L$mul_body wrt ..imagebase,$L$mul_epilogue wrt ..imagebase
+	DD	$L$mul_body wrt ..imagebase,$L$mul_epilogue wrt ..imagebase  ; HandlerData
 $L$SEH_info_bn_mul4x_mont:
 	DB	9,0,0,0
 	DD	mul_handler wrt ..imagebase
-	DD	$L$mul4x_body wrt ..imagebase,$L$mul4x_epilogue wrt ..imagebase
+	DD	$L$mul4x_body wrt ..imagebase,$L$mul4x_epilogue wrt ..imagebase  ; HandlerData
 $L$SEH_info_bn_sqr8x_mont:
 	DB	9,0,0,0
 	DD	sqr_handler wrt ..imagebase
-	DD	$L$sqr8x_prologue wrt ..imagebase,$L$sqr8x_body wrt ..imagebase,$L$sqr8x_epilogue wrt ..imagebase
+	DD	$L$sqr8x_prologue wrt ..imagebase,$L$sqr8x_body wrt ..imagebase,$L$sqr8x_epilogue wrt ..imagebase  ; HandlerData
 ALIGN	8
 $L$SEH_info_bn_mulx4x_mont:
 	DB	9,0,0,0
 	DD	sqr_handler wrt ..imagebase
-	DD	$L$mulx4x_prologue wrt ..imagebase,$L$mulx4x_body wrt ..imagebase,$L$mulx4x_epilogue wrt ..imagebase
+	DD	$L$mulx4x_prologue wrt ..imagebase,$L$mulx4x_body wrt ..imagebase,$L$mulx4x_epilogue wrt ..imagebase  ; HandlerData
 ALIGN	8
 %else
 ; Work around https://bugzilla.nasm.us/show_bug.cgi?id=3392738

boringssl-0.20260708.tar.xz/gen/bcm/x86_64-mont5-apple.S -> boringssl-0.20260813.tar.xz/gen/bcm/x86_64-mont5-apple.S Changed

@@ -13,12 +13,12 @@
 _bn_mul_mont_gather5_nohw:
 
 _CET_ENDBR
-
-
+// num is declared as an int, a 32-bit parameter, so the upper half is
+// undefined. Zero the upper half to normalize it.
 	movl	%r9d,%r9d
 	movq	%rsp,%rax
 
-	movd	8(%rsp),%xmm5
+	movd	8(%rsp),%xmm5  // load 7th argument
 	pushq	%rbx
 
 	pushq	%rbp
@@ -34,18 +34,18 @@
 
 	negq	%r9
 	movq	%rsp,%r11
-	leaq	-280(%rsp,%r9,8),%r10
-	negq	%r9
-	andq	$-1024,%r10
-
-
-
-
-
-
-
-
-
+	leaq	-280(%rsp,%r9,8),%r10  // future alloca(8*(num+2)+256+8)
+	negq	%r9  // restore %r9
+	andq	$-1024,%r10  // minimize TLB usage
+
+// An OS-agnostic version of __chkstk.
+// 
+// Some OSes (Windows) insist on stack being "wired" to
+// physical memory in strictly sequential manner, i.e. if stack
+// allocation spans two pages, then reference to farmost one can
+// be punishable by SEGV. But page walking can do good even on
+// other OSes, because it guarantees that villain thread hits
+// the guard page before it can make damage to innocent one...
 	subq	%r10,%r11
 	andq	$-4096,%r11
 	leaq	(%r10,%r11,1),%rsp
@@ -62,35 +62,35 @@
 L$mul_page_walk_done:
 
 	leaq	L$inc(%rip),%r10
-	movq	%rax,8(%rsp,%r9,8)
+	movq	%rax,8(%rsp,%r9,8)  // tpnum+1=%rsp
 
 L$mul_body:
 
-	leaq	128(%rdx),%r12
-	movdqa	0(%r10),%xmm0
-	movdqa	16(%r10),%xmm1
-	leaq	24-112(%rsp,%r9,8),%r10
+	leaq	128(%rdx),%r12  // reassign %rdx (+size optimization)
+	movdqa	0(%r10),%xmm0  // 00000001000000010000000000000000
+	movdqa	16(%r10),%xmm1  // 00000002000000020000000200000002
+	leaq	24-112(%rsp,%r9,8),%r10  // place the mask after tpnum+3 (+ICache optimization)
 	andq	$-16,%r10
 
-	pshufd	$0,%xmm5,%xmm5
+	pshufd	$0,%xmm5,%xmm5  // broadcast index
 	movdqa	%xmm1,%xmm4
 	movdqa	%xmm1,%xmm2
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 .byte	0x67
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,112(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,128(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,144(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -99,17 +99,17 @@
 	movdqa	%xmm3,160(%r10)
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,176(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,192(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,208(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -118,17 +118,17 @@
 	movdqa	%xmm3,224(%r10)
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,240(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,256(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,272(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -147,7 +147,7 @@
 
 	pcmpeqd	%xmm5,%xmm3
 	movdqa	%xmm2,336(%r10)
-	pand	64(%r12),%xmm0
+	pand	64(%r12),%xmm0  // while it's still in register
 
 	pand	80(%r12),%xmm1
 	pand	96(%r12),%xmm2
@@ -192,33 +192,33 @@
 	por	%xmm2,%xmm0
 	por	%xmm3,%xmm1
 	por	%xmm1,%xmm0
-
-	pshufd	$0x4e,%xmm0,%xmm1
+// Combine the upper and lower halves of %xmm0.
+	pshufd	$0x4e,%xmm0,%xmm1  // Swap upper and lower halves.
 	por	%xmm1,%xmm0
 	leaq	256(%r12),%r12
-	movq	%xmm0,%rbx
+	movq	%xmm0,%rbx  // m0=bp0
 
-	movq	(%r8),%r8
+	movq	(%r8),%r8  // pull n00 value
 	movq	(%rsi),%rax
 
-	xorq	%r14,%r14
-	xorq	%r15,%r15
+	xorq	%r14,%r14  // i=0
+	xorq	%r15,%r15  // j=0
 
 	movq	%r8,%rbp
-	mulq	%rbx
+	mulq	%rbx  // ap0*bp0
 	movq	%rax,%r10
 	movq	(%rcx),%rax
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // "tp0"*n0
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // discarded
 	movq	8(%rsi),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r13
 
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 	jmp	L$1st_enter
 
 .p2align	4
@@ -226,30 +226,30 @@
 	addq	%rax,%r13
 	movq	(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r11,%r13
+	addq	%r11,%r13  // npj*m1+apj*bp0
 	movq	%r10,%r11
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r15,8)
+	movq	%r13,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 L$1st_enter:
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	cmpq	%r9,%r15
-	jne	L$1st
-
+	jne	L$1st  // note that upon exit %r15==%r9, so
+// they can be used interchangeably
 
 	addq	%rax,%r13
 	adcq	$0,%rdx
-	addq	%r11,%r13
+	addq	%r11,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r9,8)
+	movq	%r13,-16(%rsp,%r9,8)  // tpnum-1
 	movq	%rdx,%r13
 	movq	%r10,%r11
 
@@ -257,13 +257,13 @@
 	addq	%r11,%r13
 	adcq	$0,%rdx
 	movq	%r13,-8(%rsp,%r9,8)
-	movq	%rdx,(%rsp,%r9,8)
+	movq	%rdx,(%rsp,%r9,8)  // store upmost overflow bit
 
-	leaq	1(%r14),%r14
+	leaq	1(%r14),%r14  // i++
 	jmp	L$outer
 .p2align	4
 L$outer:
-	leaq	24+128(%rsp,%r9,8),%rdx
+	leaq	24+128(%rsp,%r9,8),%rdx  // where 256-byte mask is (+size optimization)
 	andq	$-16,%rdx
 	pxor	%xmm4,%xmm4
 	pxor	%xmm5,%xmm5
@@ -316,34 +316,34 @@
 	por	%xmm2,%xmm4
 	por	%xmm3,%xmm5
 	por	%xmm5,%xmm4
-
-	pshufd	$0x4e,%xmm4,%xmm0
+// Combine the upper and lower halves of %xmm4 as %xmm0.
+	pshufd	$0x4e,%xmm4,%xmm0  // Swap upper and lower halves.
 	por	%xmm4,%xmm0
 	leaq	256(%r12),%r12
 
-	movq	(%rsi),%rax
-	movq	%xmm0,%rbx
+	movq	(%rsi),%rax  // ap0
+	movq	%xmm0,%rbx  // m0=bpi
 
-	xorq	%r15,%r15
+	xorq	%r15,%r15  // j=0
 	movq	%r8,%rbp
 	movq	(%rsp),%r10
 
-	mulq	%rbx
-	addq	%rax,%r10
+	mulq	%rbx  // ap0*bpi
+	addq	%rax,%r10  // ap0*bpi+tp0
 	movq	(%rcx),%rax
 	adcq	$0,%rdx
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // tp0*n0
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // discarded
 	movq	8(%rsi),%rax
 	adcq	$0,%rdx
-	movq	8(%rsp),%r10
+	movq	8(%rsp),%r10  // tp1
 	movq	%rdx,%r13
 
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 	jmp	L$inner_enter
 
 .p2align	4
@@ -351,78 +351,78 @@
 	addq	%rax,%r13
 	movq	(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bpi+tpj
 	movq	(%rsp,%r15,8),%r10
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r15,8)
+	movq	%r13,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 L$inner_enter:
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r11,%r10
+	addq	%r11,%r10  // apj*bpi+tpj
 	movq	%rdx,%r11
 	adcq	$0,%r11
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	cmpq	%r9,%r15
-	jne	L$inner
-
+	jne	L$inner  // note that upon exit %r15==%r9, so
+// they can be used interchangeably
 	addq	%rax,%r13
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bpi+tpj
 	movq	(%rsp,%r9,8),%r10
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r9,8)
+	movq	%r13,-16(%rsp,%r9,8)  // tpnum-1
 	movq	%rdx,%r13
 
 	xorq	%rdx,%rdx
 	addq	%r11,%r13
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // pull upmost overflow bit
 	adcq	$0,%rdx
 	movq	%r13,-8(%rsp,%r9,8)
-	movq	%rdx,(%rsp,%r9,8)
+	movq	%rdx,(%rsp,%r9,8)  // store upmost overflow bit
 
-	leaq	1(%r14),%r14
+	leaq	1(%r14),%r14  // i++
 	cmpq	%r9,%r14
 	jb	L$outer
 
-	xorq	%r14,%r14
-	movq	(%rsp),%rax
-	leaq	(%rsp),%rsi
-	movq	%r9,%r15
+	xorq	%r14,%r14  // i=0 and clear CF
+	movq	(%rsp),%rax  // tp0
+	leaq	(%rsp),%rsi  // borrow ap for tp
+	movq	%r9,%r15  // j=num
 	jmp	L$sub
 .p2align	4
 L$sub:	sbbq	(%rcx,%r14,8),%rax
-	movq	%rax,(%rdi,%r14,8)
-	movq	8(%rsi,%r14,8),%rax
-	leaq	1(%r14),%r14
-	decq	%r15
+	movq	%rax,(%rdi,%r14,8)  // rpi=tpi-npi
+	movq	8(%rsi,%r14,8),%rax  // tpi+1
+	leaq	1(%r14),%r14  // i++
+	decq	%r15  // doesn't affect CF
 	jnz	L$sub
 
-	sbbq	$0,%rax
+	sbbq	$0,%rax  // handle upmost overflow bit
 	movq	$-1,%rbx
 	xorq	%rax,%rbx
 	xorq	%r14,%r14
-	movq	%r9,%r15
+	movq	%r9,%r15  // j=num
 
-L$copy:
+L$copy:  // conditional copy
 	movq	(%rdi,%r14,8),%rcx
 	movq	(%rsp,%r14,8),%rdx
 	andq	%rbx,%rcx
 	andq	%rax,%rdx
-	movq	%r14,(%rsp,%r14,8)
+	movq	%r14,(%rsp,%r14,8)  // zap temporary vector
 	orq	%rcx,%rdx
-	movq	%rdx,(%rdi,%r14,8)
+	movq	%rdx,(%rdi,%r14,8)  // rpi=tpi
 	leaq	1(%r14),%r14
 	subq	$1,%r15
 	jnz	L$copy
 
-	movq	8(%rsp,%r9,8),%rsi
+	movq	8(%rsp,%r9,8),%rsi  // restore %rsp
 
 	movq	$1,%rax
 
@@ -470,36 +470,36 @@
 L$mul4x_prologue:
 
 .byte	0x67
-
-
-
-	shll	$3,%r9d
-	leaq	(%r9,%r9,2),%r10
-	negq	%r9
-
-
-
-
-
-
-
-
-
-
+// num is declared as an int, a 32-bit parameter, so the upper half is
+// undefined. It is important that this write to %r9, which zeros the
+// upper half, predates the first access.
+	shll	$3,%r9d  // convert %r9 to bytes
+	leaq	(%r9,%r9,2),%r10  // 3*%r9 in bytes
+	negq	%r9  // -%r9
+
+// #############################################################
+// Ensure that stack frame doesn't alias with +3*%r9
+// modulo 4096, which covers retnum, amnum and nnum
+// (see bn_exp.c). This is done to allow memory disambiguation
+// logic do its magic. Extra num is allocated in order
+// to align with bn_power5's frame, which is cleansed after
+// completing exponentiation. Extra 256 bytes is for power mask
+// calculated from 7th argument, the index.
+// 
 	leaq	-320(%rsp,%r9,2),%r11
 	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	L$mul4xsp_alt
-	subq	%r11,%rbp
-	leaq	-320(%rbp,%r9,2),%rbp
+	subq	%r11,%rbp  // align with %rdi
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*num*8+256)
 	jmp	L$mul4xsp_done
 
 .p2align	5
 L$mul4xsp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rbp,%r9,2),%rbp
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*num*8+256)
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
@@ -530,7 +530,7 @@
 
 	call	mul4x_internal
 
-	movq	40(%rsp),%rsi
+	movq	40(%rsp),%rsi  // restore %rsp
 
 	movq	$1,%rax
 
@@ -558,36 +558,36 @@
 .alt_entry mul4x_internal
 mul4x_internal:
 
-	shlq	$5,%r9
-	movd	8(%rax),%xmm5
+	shlq	$5,%r9  // %r9 was in bytes
+	movd	8(%rax),%xmm5  // load 7th argument, index
 	leaq	L$inc(%rip),%rax
-	leaq	128(%rdx,%r9,1),%r13
-	shrq	$5,%r9
-	movdqa	0(%rax),%xmm0
-	movdqa	16(%rax),%xmm1
-	leaq	88-112(%rsp,%r9,1),%r10
-	leaq	128(%rdx),%r12
-
-	pshufd	$0,%xmm5,%xmm5
+	leaq	128(%rdx,%r9,1),%r13  // end of powers table (+size optimization)
+	shrq	$5,%r9  // restore %r9
+	movdqa	0(%rax),%xmm0  // 00000001000000010000000000000000
+	movdqa	16(%rax),%xmm1  // 00000002000000020000000200000002
+	leaq	88-112(%rsp,%r9,1),%r10  // place the mask after tpnum+1 (+ICache optimization)
+	leaq	128(%rdx),%r12  // size optimization
+
+	pshufd	$0,%xmm5,%xmm5  // broadcast index
 	movdqa	%xmm1,%xmm4
 .byte	0x67,0x67
 	movdqa	%xmm1,%xmm2
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 .byte	0x67
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,112(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,128(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,144(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -596,17 +596,17 @@
 	movdqa	%xmm3,160(%r10)
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,176(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,192(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,208(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -615,17 +615,17 @@
 	movdqa	%xmm3,224(%r10)
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,240(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,256(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,272(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -644,7 +644,7 @@
 
 	pcmpeqd	%xmm5,%xmm3
 	movdqa	%xmm2,336(%r10)
-	pand	64(%r12),%xmm0
+	pand	64(%r12),%xmm0  // while it's still in register
 
 	pand	80(%r12),%xmm1
 	pand	96(%r12),%xmm2
@@ -689,31 +689,31 @@
 	por	%xmm2,%xmm0
 	por	%xmm3,%xmm1
 	por	%xmm1,%xmm0
-
-	pshufd	$0x4e,%xmm0,%xmm1
+// Combine the upper and lower halves of %xmm0.
+	pshufd	$0x4e,%xmm0,%xmm1  // Swap upper and lower halves.
 	por	%xmm1,%xmm0
 	leaq	256(%r12),%r12
-	movq	%xmm0,%rbx
+	movq	%xmm0,%rbx  // m0=bp0
 
-	movq	%r13,16+8(%rsp)
-	movq	%rdi,56+8(%rsp)
+	movq	%r13,16+8(%rsp)  // save end of bnum
+	movq	%rdi,56+8(%rsp)  // save %rdi
 
-	movq	(%r8),%r8
+	movq	(%r8),%r8  // pull n00 value
 	movq	(%rsi),%rax
-	leaq	(%rsi,%r9,1),%rsi
+	leaq	(%rsi,%r9,1),%rsi  // end of anum
 	negq	%r9
 
 	movq	%r8,%rbp
-	mulq	%rbx
+	mulq	%rbx  // ap0*bp0
 	movq	%rax,%r10
 	movq	(%rcx),%rax
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // "tp0"*n0
 	leaq	64+8(%rsp),%r14
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // discarded
 	movq	8(%rsi,%r9,1),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rdi
@@ -729,7 +729,7 @@
 	movq	16(%rsi,%r9,1),%rax
 	adcq	$0,%rdx
 	addq	%r11,%rdi
-	leaq	32(%r9),%r15
+	leaq	32(%r9),%r15  // j=4
 	leaq	32(%rcx),%rcx
 	adcq	$0,%rdx
 	movq	%rdi,(%r14)
@@ -738,103 +738,103 @@
 
 .p2align	5
 L$1st4x:
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r10
 	movq	-16(%rcx),%rax
 	leaq	32(%r14),%r14
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-24(%r14)
+	movq	%r13,-24(%r14)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	-8(%rcx),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
-	addq	%r11,%rdi
+	addq	%r11,%rdi  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%rdi,-16(%r14)
+	movq	%rdi,-16(%r14)  // tpj-1
 	movq	%rdx,%r13
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r10
 	movq	0(%rcx),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	8(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-8(%r14)
+	movq	%r13,-8(%r14)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	8(%rcx),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	16(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
-	addq	%r11,%rdi
+	addq	%r11,%rdi  // npj*m1+apj*bp0
 	leaq	32(%rcx),%rcx
 	adcq	$0,%rdx
-	movq	%rdi,(%r14)
+	movq	%rdi,(%r14)  // tpj-1
 	movq	%rdx,%r13
 
-	addq	$32,%r15
+	addq	$32,%r15  // j+=4
 	jnz	L$1st4x
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r10
 	movq	-16(%rcx),%rax
 	leaq	32(%r14),%r14
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-24(%r14)
+	movq	%r13,-24(%r14)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	-8(%rcx),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
-	movq	(%rsi,%r9,1),%rax
+	movq	(%rsi,%r9,1),%rax  // ap0
 	adcq	$0,%rdx
-	addq	%r11,%rdi
+	addq	%r11,%rdi  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%rdi,-16(%r14)
+	movq	%rdi,-16(%r14)  // tpj-1
 	movq	%rdx,%r13
 
-	leaq	(%rcx,%r9,1),%rcx
+	leaq	(%rcx,%r9,1),%rcx  // rewind %rcx
 
 	xorq	%rdi,%rdi
 	addq	%r10,%r13
@@ -845,7 +845,7 @@
 
 .p2align	5
 L$outer4x:
-	leaq	16+128(%r14),%rdx
+	leaq	16+128(%r14),%rdx  // where 256-byte mask is (+size optimization)
 	pxor	%xmm4,%xmm4
 	pxor	%xmm5,%xmm5
 	movdqa	-128(%r12),%xmm0
@@ -897,45 +897,45 @@
 	por	%xmm2,%xmm4
 	por	%xmm3,%xmm5
 	por	%xmm5,%xmm4
-
-	pshufd	$0x4e,%xmm4,%xmm0
+// Combine the upper and lower halves of %xmm4 as %xmm0.
+	pshufd	$0x4e,%xmm4,%xmm0  // Swap upper and lower halves.
 	por	%xmm4,%xmm0
 	leaq	256(%r12),%r12
-	movq	%xmm0,%rbx
+	movq	%xmm0,%rbx  // m0=bpi
 
 	movq	(%r14,%r9,1),%r10
 	movq	%r8,%rbp
-	mulq	%rbx
-	addq	%rax,%r10
+	mulq	%rbx  // ap0*bpi
+	addq	%rax,%r10  // ap0*bpi+tp0
 	movq	(%rcx),%rax
 	adcq	$0,%rdx
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // tp0*n0
 	movq	%rdx,%r11
-	movq	%rdi,(%r14)
+	movq	%rdi,(%r14)  // store upmost overflow bit
 
-	leaq	(%r14,%r9,1),%r14
+	leaq	(%r14,%r9,1),%r14  // rewind %r14
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // "%r13", discarded
 	movq	8(%rsi,%r9,1),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	8(%rcx),%rax
 	adcq	$0,%rdx
-	addq	8(%r14),%r11
+	addq	8(%r14),%r11  // +tp1
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	16(%rsi,%r9,1),%rax
 	adcq	$0,%rdx
-	addq	%r11,%rdi
-	leaq	32(%r9),%r15
+	addq	%r11,%rdi  // npj*m1+apj*bpi+tpj
+	leaq	32(%r9),%r15  // j=4
 	leaq	32(%rcx),%rcx
 	adcq	$0,%rdx
 	movq	%rdx,%r13
@@ -943,25 +943,25 @@
 
 .p2align	5
 L$inner4x:
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r10
 	movq	-16(%rcx),%rax
 	adcq	$0,%rdx
-	addq	16(%r14),%r10
+	addq	16(%r14),%r10  // apj*bpi+tpj
 	leaq	32(%r14),%r14
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r13
 	adcq	$0,%rdx
-	movq	%rdi,-32(%r14)
+	movq	%rdi,-32(%r14)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	-8(%rcx),%rax
 	adcq	$0,%rdx
@@ -969,33 +969,33 @@
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
 	addq	%r11,%rdi
 	adcq	$0,%rdx
-	movq	%r13,-24(%r14)
+	movq	%r13,-24(%r14)  // tpj-1
 	movq	%rdx,%r13
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r10
 	movq	0(%rcx),%rax
 	adcq	$0,%rdx
-	addq	(%r14),%r10
+	addq	(%r14),%r10  // apj*bpi+tpj
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	8(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r13
 	adcq	$0,%rdx
-	movq	%rdi,-16(%r14)
+	movq	%rdi,-16(%r14)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	8(%rcx),%rax
 	adcq	$0,%rdx
@@ -1003,38 +1003,38 @@
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	16(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
 	addq	%r11,%rdi
 	leaq	32(%rcx),%rcx
 	adcq	$0,%rdx
-	movq	%r13,-8(%r14)
+	movq	%r13,-8(%r14)  // tpj-1
 	movq	%rdx,%r13
 
-	addq	$32,%r15
+	addq	$32,%r15  // j+=4
 	jnz	L$inner4x
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r10
 	movq	-16(%rcx),%rax
 	adcq	$0,%rdx
-	addq	16(%r14),%r10
+	addq	16(%r14),%r10  // apj*bpi+tpj
 	leaq	32(%r14),%r14
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r13
 	adcq	$0,%rdx
-	movq	%rdi,-32(%r14)
+	movq	%rdi,-32(%r14)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	%rbp,%rax
 	movq	-8(%rcx),%rbp
@@ -1043,39 +1043,39 @@
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
-	movq	(%rsi,%r9,1),%rax
+	movq	(%rsi,%r9,1),%rax  // ap0
 	adcq	$0,%rdx
 	addq	%r11,%rdi
 	adcq	$0,%rdx
-	movq	%r13,-24(%r14)
+	movq	%r13,-24(%r14)  // tpj-1
 	movq	%rdx,%r13
 
-	movq	%rdi,-16(%r14)
-	leaq	(%rcx,%r9,1),%rcx
+	movq	%rdi,-16(%r14)  // tpj-1
+	leaq	(%rcx,%r9,1),%rcx  // rewind %rcx
 
 	xorq	%rdi,%rdi
 	addq	%r10,%r13
 	adcq	$0,%rdi
-	addq	(%r14),%r13
-	adcq	$0,%rdi
+	addq	(%r14),%r13  // pull upmost overflow bit
+	adcq	$0,%rdi  // upmost overflow bit
 	movq	%r13,-8(%r14)
 
 	cmpq	16+8(%rsp),%r12
 	jb	L$outer4x
 	xorq	%rax,%rax
-	subq	%r13,%rbp
-	adcq	%r15,%r15
+	subq	%r13,%rbp  // compare top-most words
+	adcq	%r15,%r15  // %r15 is zero
 	orq	%r15,%rdi
-	subq	%rdi,%rax
-	leaq	(%r14,%r9,1),%rbx
+	subq	%rdi,%rax  // %rax=-%rdi
+	leaq	(%r14,%r9,1),%rbx  // tptr in .sqr4x_sub
 	movq	(%rcx),%r12
-	leaq	(%rcx),%rbp
+	leaq	(%rcx),%rbp  // nptr in .sqr4x_sub
 	movq	%r9,%rcx
 	sarq	$3+2,%rcx
-	movq	56+8(%rsp),%rdi
-	decq	%r12
+	movq	56+8(%rsp),%rdi  // rptr in .sqr4x_sub
+	decq	%r12  // so that after 'not' we get -n0
 	xorq	%r10,%r10
 	movq	8(%rbp),%r13
 	movq	16(%rbp),%r14
@@ -1107,35 +1107,35 @@
 
 L$power5_prologue:
 
-
-
-
-	shll	$3,%r9d
-	leal	(%r9,%r9,2),%r10d
+// num is declared as an int, a 32-bit parameter, so the upper half is
+// undefined. It is important that this write to %r9, which zeros the
+// upper half, come before the first access.
+	shll	$3,%r9d  // convert %r9 to bytes
+	leal	(%r9,%r9,2),%r10d  // 3*%r9
 	negq	%r9
-	movq	(%r8),%r8
-
-
-
-
-
-
-
-
+	movq	(%r8),%r8  // *n0
+
+// #############################################################
+// Ensure that stack frame doesn't alias with %rdi+3*%r9
+// modulo 4096, which covers retnum, amnum and nnum
+// (see bn_exp.c). This is done to allow memory disambiguation
+// logic do its magic. Extra 256 bytes is for power mask
+// calculated from 7th argument, the index.
+// 
 	leaq	-320(%rsp,%r9,2),%r11
 	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	L$pwr_sp_alt
-	subq	%r11,%rbp
-	leaq	-320(%rbp,%r9,2),%rbp
+	subq	%r11,%rbp  // align with %rsi
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*num*8+256)
 	jmp	L$pwr_sp_done
 
 .p2align	5
 L$pwr_sp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rbp,%r9,2),%rbp
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*num*8+256)
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
@@ -1161,22 +1161,22 @@
 	movq	%r9,%r10
 	negq	%r9
 
-
-
-
-
-
-
-
-
-
+// #############################################################
+// Stack layout
+// 
+// +0	saved %r9, used in reduction section
+// +8	&t2*%r9, used in reduction section
+// +32	saved *n0
+// +40	saved %rsp
+// +48	t2*%r9
+// 
 	movq	%r8,32(%rsp)
-	movq	%rax,40(%rsp)
+	movq	%rax,40(%rsp)  // save original %rsp
 
 L$power5_body:
-	movq	%rdi,%xmm1
-	movq	%rcx,%xmm2
-	movq	%r10,%xmm3
+	movq	%rdi,%xmm1  // save %rdi, used in sqr8x
+	movq	%rcx,%xmm2  // save %rcx
+	movq	%r10,%xmm3  // -%r9, used in sqr8x
 	movq	%rdx,%xmm4
 
 	call	__bn_sqr8x_internal
@@ -1198,7 +1198,7 @@
 
 	call	mul4x_internal
 
-	movq	40(%rsp),%rsi
+	movq	40(%rsp),%rsi  // restore %rsp
 
 	movq	$1,%rax
 	movq	-48(%rsi),%r15
@@ -1231,261 +1231,261 @@
 __bn_sqr8x_internal:
 
 _CET_ENDBR
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-	leaq	32(%r10),%rbp
-	leaq	(%rsi,%r9,1),%rsi
-
-	movq	%r9,%rcx
-
-
-	movq	-32(%rsi,%rbp,1),%r14
-	leaq	48+8(%rsp,%r9,2),%rdi
-	movq	-24(%rsi,%rbp,1),%rax
-	leaq	-32(%rdi,%rbp,1),%rdi
-	movq	-16(%rsi,%rbp,1),%rbx
+// #############################################################
+// Squaring part:
+// 
+// a) multiply-n-add everything but ai*ai;
+// b) shift result of a) by 1 to the left and accumulate
+// ai*ai products;
+// 
+// #############################################################
+// a1a0
+// a2a0
+// a3a0
+// a2a1
+// a4a0
+// a3a1
+// a5a0
+// a4a1
+// a3a2
+// a6a0
+// a5a1
+// a4a2
+// a7a0
+// a6a1
+// a5a2
+// a4a3
+// a7a1
+// a6a2
+// a5a3
+// a7a2
+// a6a3
+// a5a4
+// a7a3
+// a6a4
+// a7a4
+// a6a5
+// a7a5
+// a7a6
+// a1a0
+// a2a0
+// a3a0
+// a4a0
+// a5a0
+// a6a0
+// a7a0
+// a2a1
+// a3a1
+// a4a1
+// a5a1
+// a6a1
+// a7a1
+// a3a2
+// a4a2
+// a5a2
+// a6a2
+// a7a2
+// a4a3
+// a5a3
+// a6a3
+// a7a3
+// a5a4
+// a6a4
+// a7a4
+// a6a5
+// a7a5
+// a7a6
+// a0a0
+// a1a1
+// a2a2
+// a3a3
+// a4a4
+// a5a5
+// a6a6
+// a7a7
+
+	leaq	32(%r10),%rbp  // %rbp=-(%r9-32)
+	leaq	(%rsi,%r9,1),%rsi  // end of a buffer, (%rsi,%rbp)=&ap2
+
+	movq	%r9,%rcx  // %rcx=%r9
+
+// comments apply to %r9==8 case
+	movq	-32(%rsi,%rbp,1),%r14  // a0
+	leaq	48+8(%rsp,%r9,2),%rdi  // end of tp buffer, &tp2*%r9
+	movq	-24(%rsi,%rbp,1),%rax  // a1
+	leaq	-32(%rdi,%rbp,1),%rdi  // end of tp window, &tp2*%r9-"%rbp"
+	movq	-16(%rsi,%rbp,1),%rbx  // a2
 	movq	%rax,%r15
 
-	mulq	%r14
-	movq	%rax,%r10
-	movq	%rbx,%rax
+	mulq	%r14  // a1*a0
+	movq	%rax,%r10  // a1*a0
+	movq	%rbx,%rax  // a2
 	movq	%rdx,%r11
-	movq	%r10,-24(%rdi,%rbp,1)
+	movq	%r10,-24(%rdi,%rbp,1)  // t1
 
-	mulq	%r14
+	mulq	%r14  // a2*a0
 	addq	%rax,%r11
 	movq	%rbx,%rax
 	adcq	$0,%rdx
-	movq	%r11,-16(%rdi,%rbp,1)
+	movq	%r11,-16(%rdi,%rbp,1)  // t2
 	movq	%rdx,%r10
 
 
-	movq	-8(%rsi,%rbp,1),%rbx
-	mulq	%r15
-	movq	%rax,%r12
+	movq	-8(%rsi,%rbp,1),%rbx  // a3
+	mulq	%r15  // a2*a1
+	movq	%rax,%r12  // a2*a1+t3
 	movq	%rbx,%rax
 	movq	%rdx,%r13
 
 	leaq	(%rbp),%rcx
-	mulq	%r14
-	addq	%rax,%r10
+	mulq	%r14  // a3*a0
+	addq	%rax,%r10  // a3*a0+a2*a1+t3
 	movq	%rbx,%rax
 	movq	%rdx,%r11
 	adcq	$0,%r11
 	addq	%r12,%r10
 	adcq	$0,%r11
-	movq	%r10,-8(%rdi,%rcx,1)
+	movq	%r10,-8(%rdi,%rcx,1)  // t3
 	jmp	L$sqr4x_1st
 
 .p2align	5
 L$sqr4x_1st:
-	movq	(%rsi,%rcx,1),%rbx
-	mulq	%r15
-	addq	%rax,%r13
+	movq	(%rsi,%rcx,1),%rbx  // a4
+	mulq	%r15  // a3*a1
+	addq	%rax,%r13  // a3*a1+t4
 	movq	%rbx,%rax
 	movq	%rdx,%r12
 	adcq	$0,%r12
 
-	mulq	%r14
-	addq	%rax,%r11
-	movq	%rbx,%rax
-	movq	8(%rsi,%rcx,1),%rbx
+	mulq	%r14  // a4*a0
+	addq	%rax,%r11  // a4*a0+a3*a1+t4
+	movq	%rbx,%rax  // a3
+	movq	8(%rsi,%rcx,1),%rbx  // a5
 	movq	%rdx,%r10
 	adcq	$0,%r10
 	addq	%r13,%r11
 	adcq	$0,%r10
 
 
-	mulq	%r15
-	addq	%rax,%r12
+	mulq	%r15  // a4*a3
+	addq	%rax,%r12  // a4*a3+t5
 	movq	%rbx,%rax
-	movq	%r11,(%rdi,%rcx,1)
+	movq	%r11,(%rdi,%rcx,1)  // t4
 	movq	%rdx,%r13
 	adcq	$0,%r13
 
-	mulq	%r14
-	addq	%rax,%r10
+	mulq	%r14  // a5*a2
+	addq	%rax,%r10  // a5*a2+a4*a3+t5
 	movq	%rbx,%rax
-	movq	16(%rsi,%rcx,1),%rbx
+	movq	16(%rsi,%rcx,1),%rbx  // a6
 	movq	%rdx,%r11
 	adcq	$0,%r11
 	addq	%r12,%r10
 	adcq	$0,%r11
 
-	mulq	%r15
-	addq	%rax,%r13
+	mulq	%r15  // a5*a3
+	addq	%rax,%r13  // a5*a3+t6
 	movq	%rbx,%rax
-	movq	%r10,8(%rdi,%rcx,1)
+	movq	%r10,8(%rdi,%rcx,1)  // t5
 	movq	%rdx,%r12
 	adcq	$0,%r12
 
-	mulq	%r14
-	addq	%rax,%r11
-	movq	%rbx,%rax
-	movq	24(%rsi,%rcx,1),%rbx
+	mulq	%r14  // a6*a2
+	addq	%rax,%r11  // a6*a2+a5*a3+t6
+	movq	%rbx,%rax  // a3
+	movq	24(%rsi,%rcx,1),%rbx  // a7
 	movq	%rdx,%r10
 	adcq	$0,%r10
 	addq	%r13,%r11
 	adcq	$0,%r10
 
 
-	mulq	%r15
-	addq	%rax,%r12
+	mulq	%r15  // a6*a5
+	addq	%rax,%r12  // a6*a5+t7
 	movq	%rbx,%rax
-	movq	%r11,16(%rdi,%rcx,1)
+	movq	%r11,16(%rdi,%rcx,1)  // t6
 	movq	%rdx,%r13
 	adcq	$0,%r13
 	leaq	32(%rcx),%rcx
 
-	mulq	%r14
-	addq	%rax,%r10
+	mulq	%r14  // a7*a4
+	addq	%rax,%r10  // a7*a4+a6*a5+t6
 	movq	%rbx,%rax
 	movq	%rdx,%r11
 	adcq	$0,%r11
 	addq	%r12,%r10
 	adcq	$0,%r11
-	movq	%r10,-8(%rdi,%rcx,1)
+	movq	%r10,-8(%rdi,%rcx,1)  // t7
 
 	cmpq	$0,%rcx
 	jne	L$sqr4x_1st
 
-	mulq	%r15
+	mulq	%r15  // a7*a5
 	addq	%rax,%r13
 	leaq	16(%rbp),%rbp
 	adcq	$0,%rdx
 	addq	%r11,%r13
 	adcq	$0,%rdx
 
-	movq	%r13,(%rdi)
+	movq	%r13,(%rdi)  // t8
 	movq	%rdx,%r12
-	movq	%rdx,8(%rdi)
+	movq	%rdx,8(%rdi)  // t9
 	jmp	L$sqr4x_outer
 
 .p2align	5
-L$sqr4x_outer:
-	movq	-32(%rsi,%rbp,1),%r14
-	leaq	48+8(%rsp,%r9,2),%rdi
-	movq	-24(%rsi,%rbp,1),%rax
-	leaq	-32(%rdi,%rbp,1),%rdi
-	movq	-16(%rsi,%rbp,1),%rbx
+L$sqr4x_outer:  // comments apply to %r9==6 case
+	movq	-32(%rsi,%rbp,1),%r14  // a0
+	leaq	48+8(%rsp,%r9,2),%rdi  // end of tp buffer, &tp2*%r9
+	movq	-24(%rsi,%rbp,1),%rax  // a1
+	leaq	-32(%rdi,%rbp,1),%rdi  // end of tp window, &tp2*%r9-"%rbp"
+	movq	-16(%rsi,%rbp,1),%rbx  // a2
 	movq	%rax,%r15
 
-	mulq	%r14
-	movq	-24(%rdi,%rbp,1),%r10
-	addq	%rax,%r10
-	movq	%rbx,%rax
+	mulq	%r14  // a1*a0
+	movq	-24(%rdi,%rbp,1),%r10  // t1
+	addq	%rax,%r10  // a1*a0+t1
+	movq	%rbx,%rax  // a2
 	adcq	$0,%rdx
-	movq	%r10,-24(%rdi,%rbp,1)
+	movq	%r10,-24(%rdi,%rbp,1)  // t1
 	movq	%rdx,%r11
 
-	mulq	%r14
+	mulq	%r14  // a2*a0
 	addq	%rax,%r11
 	movq	%rbx,%rax
 	adcq	$0,%rdx
-	addq	-16(%rdi,%rbp,1),%r11
+	addq	-16(%rdi,%rbp,1),%r11  // a2*a0+t2
 	movq	%rdx,%r10
 	adcq	$0,%r10
-	movq	%r11,-16(%rdi,%rbp,1)
+	movq	%r11,-16(%rdi,%rbp,1)  // t2
 
 	xorq	%r12,%r12
 
-	movq	-8(%rsi,%rbp,1),%rbx
-	mulq	%r15
-	addq	%rax,%r12
+	movq	-8(%rsi,%rbp,1),%rbx  // a3
+	mulq	%r15  // a2*a1
+	addq	%rax,%r12  // a2*a1+t3
 	movq	%rbx,%rax
 	adcq	$0,%rdx
 	addq	-8(%rdi,%rbp,1),%r12
 	movq	%rdx,%r13
 	adcq	$0,%r13
 
-	mulq	%r14
-	addq	%rax,%r10
+	mulq	%r14  // a3*a0
+	addq	%rax,%r10  // a3*a0+a2*a1+t3
 	movq	%rbx,%rax
 	adcq	$0,%rdx
 	addq	%r12,%r10
 	movq	%rdx,%r11
 	adcq	$0,%r11
-	movq	%r10,-8(%rdi,%rbp,1)
+	movq	%r10,-8(%rdi,%rbp,1)  // t3
 
 	leaq	(%rbp),%rcx
 	jmp	L$sqr4x_inner
 
 .p2align	5
 L$sqr4x_inner:
-	movq	(%rsi,%rcx,1),%rbx
-	mulq	%r15
-	addq	%rax,%r13
+	movq	(%rsi,%rcx,1),%rbx  // a4
+	mulq	%r15  // a3*a1
+	addq	%rax,%r13  // a3*a1+t4
 	movq	%rbx,%rax
 	movq	%rdx,%r12
 	adcq	$0,%r12
@@ -1493,254 +1493,254 @@
 	adcq	$0,%r12
 
 .byte	0x67
-	mulq	%r14
-	addq	%rax,%r11
-	movq	%rbx,%rax
-	movq	8(%rsi,%rcx,1),%rbx
+	mulq	%r14  // a4*a0
+	addq	%rax,%r11  // a4*a0+a3*a1+t4
+	movq	%rbx,%rax  // a3
+	movq	8(%rsi,%rcx,1),%rbx  // a5
 	movq	%rdx,%r10
 	adcq	$0,%r10
 	addq	%r13,%r11
 	adcq	$0,%r10
 
-	mulq	%r15
-	addq	%rax,%r12
-	movq	%r11,(%rdi,%rcx,1)
+	mulq	%r15  // a4*a3
+	addq	%rax,%r12  // a4*a3+t5
+	movq	%r11,(%rdi,%rcx,1)  // t4
 	movq	%rbx,%rax
 	movq	%rdx,%r13
 	adcq	$0,%r13
 	addq	8(%rdi,%rcx,1),%r12
-	leaq	16(%rcx),%rcx
+	leaq	16(%rcx),%rcx  // j++
 	adcq	$0,%r13
 
-	mulq	%r14
-	addq	%rax,%r10
+	mulq	%r14  // a5*a2
+	addq	%rax,%r10  // a5*a2+a4*a3+t5
 	movq	%rbx,%rax
 	adcq	$0,%rdx
 	addq	%r12,%r10
 	movq	%rdx,%r11
 	adcq	$0,%r11
-	movq	%r10,-8(%rdi,%rcx,1)
+	movq	%r10,-8(%rdi,%rcx,1)  // t5, "preloaded t1" below
 
 	cmpq	$0,%rcx
 	jne	L$sqr4x_inner
 
 .byte	0x67
-	mulq	%r15
+	mulq	%r15  // a5*a3
 	addq	%rax,%r13
 	adcq	$0,%rdx
 	addq	%r11,%r13
 	adcq	$0,%rdx
 
-	movq	%r13,(%rdi)
+	movq	%r13,(%rdi)  // t6, "preloaded t2" below
 	movq	%rdx,%r12
-	movq	%rdx,8(%rdi)
+	movq	%rdx,8(%rdi)  // t7, "preloaded t3" below
 
 	addq	$16,%rbp
 	jnz	L$sqr4x_outer
 
-
-	movq	-32(%rsi),%r14
-	leaq	48+8(%rsp,%r9,2),%rdi
-	movq	-24(%rsi),%rax
-	leaq	-32(%rdi,%rbp,1),%rdi
-	movq	-16(%rsi),%rbx
+// comments apply to %r9==4 case
+	movq	-32(%rsi),%r14  // a0
+	leaq	48+8(%rsp,%r9,2),%rdi  // end of tp buffer, &tp2*%r9
+	movq	-24(%rsi),%rax  // a1
+	leaq	-32(%rdi,%rbp,1),%rdi  // end of tp window, &tp2*%r9-"%rbp"
+	movq	-16(%rsi),%rbx  // a2
 	movq	%rax,%r15
 
-	mulq	%r14
-	addq	%rax,%r10
-	movq	%rbx,%rax
+	mulq	%r14  // a1*a0
+	addq	%rax,%r10  // a1*a0+t1, preloaded t1
+	movq	%rbx,%rax  // a2
 	movq	%rdx,%r11
 	adcq	$0,%r11
 
-	mulq	%r14
+	mulq	%r14  // a2*a0
 	addq	%rax,%r11
 	movq	%rbx,%rax
-	movq	%r10,-24(%rdi)
+	movq	%r10,-24(%rdi)  // t1
 	movq	%rdx,%r10
 	adcq	$0,%r10
-	addq	%r13,%r11
-	movq	-8(%rsi),%rbx
+	addq	%r13,%r11  // a2*a0+t2, preloaded t2
+	movq	-8(%rsi),%rbx  // a3
 	adcq	$0,%r10
 
-	mulq	%r15
-	addq	%rax,%r12
+	mulq	%r15  // a2*a1
+	addq	%rax,%r12  // a2*a1+t3, preloaded t3
 	movq	%rbx,%rax
-	movq	%r11,-16(%rdi)
+	movq	%r11,-16(%rdi)  // t2
 	movq	%rdx,%r13
 	adcq	$0,%r13
 
-	mulq	%r14
-	addq	%rax,%r10
+	mulq	%r14  // a3*a0
+	addq	%rax,%r10  // a3*a0+a2*a1+t3
 	movq	%rbx,%rax
 	movq	%rdx,%r11
 	adcq	$0,%r11
 	addq	%r12,%r10
 	adcq	$0,%r11
-	movq	%r10,-8(%rdi)
+	movq	%r10,-8(%rdi)  // t3
 
-	mulq	%r15
+	mulq	%r15  // a3*a1
 	addq	%rax,%r13
-	movq	-16(%rsi),%rax
+	movq	-16(%rsi),%rax  // a2
 	adcq	$0,%rdx
 	addq	%r11,%r13
 	adcq	$0,%rdx
 
-	movq	%r13,(%rdi)
+	movq	%r13,(%rdi)  // t4
 	movq	%rdx,%r12
-	movq	%rdx,8(%rdi)
+	movq	%rdx,8(%rdi)  // t5
 
-	mulq	%rbx
+	mulq	%rbx  // a2*a3
 	addq	$16,%rbp
 	xorq	%r14,%r14
-	subq	%r9,%rbp
+	subq	%r9,%rbp  // %rbp=16-%r9
 	xorq	%r15,%r15
 
-	addq	%r12,%rax
+	addq	%r12,%rax  // t5
 	adcq	$0,%rdx
-	movq	%rax,8(%rdi)
-	movq	%rdx,16(%rdi)
-	movq	%r15,24(%rdi)
+	movq	%rax,8(%rdi)  // t5
+	movq	%rdx,16(%rdi)  // t6
+	movq	%r15,24(%rdi)  // t7
 
-	movq	-16(%rsi,%rbp,1),%rax
+	movq	-16(%rsi,%rbp,1),%rax  // a0
 	leaq	48+8(%rsp),%rdi
-	xorq	%r10,%r10
-	movq	8(%rdi),%r11
+	xorq	%r10,%r10  // t0
+	movq	8(%rdi),%r11  // t1
 
-	leaq	(%r14,%r10,2),%r12
+	leaq	(%r14,%r10,2),%r12  // t2*i<<1 | shift
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r13
+	leaq	(%rcx,%r11,2),%r13  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r13
-	movq	16(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	24(%rdi),%r11
+	orq	%r10,%r13  // | t2*i>>63
+	movq	16(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	24(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%r12
-	movq	-8(%rsi,%rbp,1),%rax
+	movq	-8(%rsi,%rbp,1),%rax  // ai+1	# prefetch
 	movq	%r12,(%rdi)
 	adcq	%rdx,%r13
 
-	leaq	(%r14,%r10,2),%rbx
+	leaq	(%r14,%r10,2),%rbx  // t2*i<<1 | shift
 	movq	%r13,8(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r8
+	leaq	(%rcx,%r11,2),%r8  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r8
-	movq	32(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	40(%rdi),%r11
+	orq	%r10,%r8  // | t2*i>>63
+	movq	32(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	40(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%rbx
-	movq	0(%rsi,%rbp,1),%rax
+	movq	0(%rsi,%rbp,1),%rax  // ai+1	# prefetch
 	movq	%rbx,16(%rdi)
 	adcq	%rdx,%r8
 	leaq	16(%rbp),%rbp
 	movq	%r8,24(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	leaq	64(%rdi),%rdi
 	jmp	L$sqr4x_shift_n_add
 
 .p2align	5
 L$sqr4x_shift_n_add:
-	leaq	(%r14,%r10,2),%r12
+	leaq	(%r14,%r10,2),%r12  // t2*i<<1 | shift
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r13
+	leaq	(%rcx,%r11,2),%r13  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r13
-	movq	-16(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	-8(%rdi),%r11
+	orq	%r10,%r13  // | t2*i>>63
+	movq	-16(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	-8(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%r12
-	movq	-8(%rsi,%rbp,1),%rax
+	movq	-8(%rsi,%rbp,1),%rax  // ai+1	# prefetch
 	movq	%r12,-32(%rdi)
 	adcq	%rdx,%r13
 
-	leaq	(%r14,%r10,2),%rbx
+	leaq	(%r14,%r10,2),%rbx  // t2*i<<1 | shift
 	movq	%r13,-24(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r8
+	leaq	(%rcx,%r11,2),%r8  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r8
-	movq	0(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	8(%rdi),%r11
+	orq	%r10,%r8  // | t2*i>>63
+	movq	0(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	8(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%rbx
-	movq	0(%rsi,%rbp,1),%rax
+	movq	0(%rsi,%rbp,1),%rax  // ai+1	# prefetch
 	movq	%rbx,-16(%rdi)
 	adcq	%rdx,%r8
 
-	leaq	(%r14,%r10,2),%r12
+	leaq	(%r14,%r10,2),%r12  // t2*i<<1 | shift
 	movq	%r8,-8(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r13
+	leaq	(%rcx,%r11,2),%r13  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r13
-	movq	16(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	24(%rdi),%r11
+	orq	%r10,%r13  // | t2*i>>63
+	movq	16(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	24(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%r12
-	movq	8(%rsi,%rbp,1),%rax
+	movq	8(%rsi,%rbp,1),%rax  // ai+1	# prefetch
 	movq	%r12,0(%rdi)
 	adcq	%rdx,%r13
 
-	leaq	(%r14,%r10,2),%rbx
+	leaq	(%r14,%r10,2),%rbx  // t2*i<<1 | shift
 	movq	%r13,8(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r8
+	leaq	(%rcx,%r11,2),%r8  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r8
-	movq	32(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	40(%rdi),%r11
+	orq	%r10,%r8  // | t2*i>>63
+	movq	32(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	40(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%rbx
-	movq	16(%rsi,%rbp,1),%rax
+	movq	16(%rsi,%rbp,1),%rax  // ai+1	# prefetch
 	movq	%rbx,16(%rdi)
 	adcq	%rdx,%r8
 	movq	%r8,24(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	leaq	64(%rdi),%rdi
 	addq	$32,%rbp
 	jnz	L$sqr4x_shift_n_add
 
-	leaq	(%r14,%r10,2),%r12
+	leaq	(%r14,%r10,2),%r12  // t2*i<<1 | shift
 .byte	0x67
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r13
+	leaq	(%rcx,%r11,2),%r13  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r13
-	movq	-16(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	-8(%rdi),%r11
+	orq	%r10,%r13  // | t2*i>>63
+	movq	-16(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	-8(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%r12
-	movq	-8(%rsi),%rax
+	movq	-8(%rsi),%rax  // ai+1	# prefetch
 	movq	%r12,-32(%rdi)
 	adcq	%rdx,%r13
 
-	leaq	(%r14,%r10,2),%rbx
+	leaq	(%r14,%r10,2),%rbx  // t2*i<<1|shift
 	movq	%r13,-24(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r8
+	leaq	(%rcx,%r11,2),%r8  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r8
-	mulq	%rax
-	negq	%r15
+	orq	%r10,%r8  // | t2*i>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
 	adcq	%rax,%rbx
 	adcq	%rdx,%r8
 	movq	%rbx,-16(%rdi)
@@ -1749,17 +1749,17 @@
 .alt_entry __bn_sqr8x_reduction
 __bn_sqr8x_reduction:
 	xorq	%rax,%rax
-	leaq	(%r9,%rbp,1),%rcx
-	leaq	48+8(%rsp,%r9,2),%rdx
+	leaq	(%r9,%rbp,1),%rcx  // end of n
+	leaq	48+8(%rsp,%r9,2),%rdx  // end of t buffer
 	movq	%rcx,0+8(%rsp)
-	leaq	48+8(%rsp,%r9,1),%rdi
+	leaq	48+8(%rsp,%r9,1),%rdi  // end of initial t window
 	movq	%rdx,8+8(%rsp)
 	negq	%r9
 	jmp	L$8x_reduction_loop
 
 .p2align	5
 L$8x_reduction_loop:
-	leaq	(%rdi,%r9,1),%rdi
+	leaq	(%rdi,%r9,1),%rdi  // start of current t window
 .byte	0x66
 	movq	0(%rdi),%rbx
 	movq	8(%rdi),%r9
@@ -1769,20 +1769,20 @@
 	movq	40(%rdi),%r13
 	movq	48(%rdi),%r14
 	movq	56(%rdi),%r15
-	movq	%rax,(%rdx)
+	movq	%rax,(%rdx)  // store top-most carry bit
 	leaq	64(%rdi),%rdi
 
 .byte	0x67
 	movq	%rbx,%r8
-	imulq	32+8(%rsp),%rbx
-	movq	0(%rbp),%rax
+	imulq	32+8(%rsp),%rbx  // n0*a0
+	movq	0(%rbp),%rax  // n0
 	movl	$8,%ecx
 	jmp	L$8x_reduce
 
 .p2align	5
 L$8x_reduce:
 	mulq	%rbx
-	movq	8(%rbp),%rax
+	movq	8(%rbp),%rax  // n1
 	negq	%r8
 	movq	%rdx,%r8
 	adcq	$0,%r8
@@ -1792,7 +1792,7 @@
 	movq	16(%rbp),%rax
 	adcq	$0,%rdx
 	addq	%r9,%r8
-	movq	%rbx,48-8+8(%rsp,%rcx,8)
+	movq	%rbx,48-8+8(%rsp,%rcx,8)  // put aside n0*ai
 	movq	%rdx,%r9
 	adcq	$0,%r9
 
@@ -1801,7 +1801,7 @@
 	movq	24(%rbp),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r9
-	movq	32+8(%rsp),%rsi
+	movq	32+8(%rsp),%rsi  // pull n0, borrow %rsi
 	movq	%rdx,%r10
 	adcq	$0,%r10
 
@@ -1809,7 +1809,7 @@
 	addq	%rax,%r11
 	movq	32(%rbp),%rax
 	adcq	$0,%rdx
-	imulq	%r8,%rsi
+	imulq	%r8,%rsi  // modulo-scheduled
 	addq	%r11,%r10
 	movq	%rdx,%r11
 	adcq	$0,%r11
@@ -1839,9 +1839,9 @@
 	adcq	$0,%r14
 
 	mulq	%rbx
-	movq	%rsi,%rbx
+	movq	%rsi,%rbx  // n0*ai
 	addq	%rax,%r15
-	movq	0(%rbp),%rax
+	movq	0(%rbp),%rax  // n0
 	adcq	$0,%rdx
 	addq	%r15,%r14
 	movq	%rdx,%r15
@@ -1852,8 +1852,8 @@
 
 	leaq	64(%rbp),%rbp
 	xorq	%rax,%rax
-	movq	8+8(%rsp),%rdx
-	cmpq	0+8(%rsp),%rbp
+	movq	8+8(%rsp),%rdx  // pull end of t
+	cmpq	0+8(%rsp),%rbp  // end of n?
 	jae	L$8x_no_tail
 
 .byte	0x66
@@ -1865,9 +1865,9 @@
 	adcq	40(%rdi),%r13
 	adcq	48(%rdi),%r14
 	adcq	56(%rdi),%r15
-	sbbq	%rsi,%rsi
+	sbbq	%rsi,%rsi  // top carry
 
-	movq	48+56+8(%rsp),%rbx
+	movq	48+56+8(%rsp),%rbx  // pull n0*a0
 	movl	$8,%ecx
 	movq	0(%rbp),%rax
 	jmp	L$8x_tail
@@ -1877,7 +1877,7 @@
 	mulq	%rbx
 	addq	%rax,%r8
 	movq	8(%rbp),%rax
-	movq	%r8,(%rdi)
+	movq	%r8,(%rdi)  // save result
 	movq	%rdx,%r8
 	adcq	$0,%r8
 
@@ -1886,7 +1886,7 @@
 	movq	16(%rbp),%rax
 	adcq	$0,%rdx
 	addq	%r9,%r8
-	leaq	8(%rdi),%rdi
+	leaq	8(%rdi),%rdi  // %rdi++
 	movq	%rdx,%r9
 	adcq	$0,%r9
 
@@ -1931,11 +1931,11 @@
 	adcq	$0,%r14
 
 	mulq	%rbx
-	movq	48-16+8(%rsp,%rcx,8),%rbx
+	movq	48-16+8(%rsp,%rcx,8),%rbx  // pull n0*ai
 	addq	%rax,%r15
 	adcq	$0,%rdx
 	addq	%r15,%r14
-	movq	0(%rbp),%rax
+	movq	0(%rbp),%rax  // pull n0
 	movq	%rdx,%r15
 	adcq	$0,%r15
 
@@ -1943,13 +1943,13 @@
 	jnz	L$8x_tail
 
 	leaq	64(%rbp),%rbp
-	movq	8+8(%rsp),%rdx
-	cmpq	0+8(%rsp),%rbp
-	jae	L$8x_tail_done
+	movq	8+8(%rsp),%rdx  // pull end of t
+	cmpq	0+8(%rsp),%rbp  // end of n?
+	jae	L$8x_tail_done  // break out of loop
 
-	movq	48+56+8(%rsp),%rbx
+	movq	48+56+8(%rsp),%rbx  // pull n0*a0
 	negq	%rsi
-	movq	0(%rbp),%rax
+	movq	0(%rbp),%rax  // pull n0
 	adcq	0(%rdi),%r8
 	adcq	8(%rdi),%r9
 	adcq	16(%rdi),%r10
@@ -1958,7 +1958,7 @@
 	adcq	40(%rdi),%r13
 	adcq	48(%rdi),%r14
 	adcq	56(%rdi),%r15
-	sbbq	%rsi,%rsi
+	sbbq	%rsi,%rsi  // top carry
 
 	movl	$8,%ecx
 	jmp	L$8x_tail
@@ -1966,7 +1966,7 @@
 .p2align	5
 L$8x_tail_done:
 	xorq	%rax,%rax
-	addq	(%rdx),%r8
+	addq	(%rdx),%r8  // can this overflow?
 	adcq	$0,%r9
 	adcq	$0,%r10
 	adcq	$0,%r11
@@ -1986,15 +1986,15 @@
 	adcq	40(%rdi),%r13
 	adcq	48(%rdi),%r14
 	adcq	56(%rdi),%r15
-	adcq	$0,%rax
-	movq	-8(%rbp),%rcx
+	adcq	$0,%rax  // top-most carry
+	movq	-8(%rbp),%rcx  // npnum-1
 	xorq	%rsi,%rsi
 
-	movq	%xmm2,%rbp
+	movq	%xmm2,%rbp  // restore %rbp
 
-	movq	%r8,0(%rdi)
+	movq	%r8,0(%rdi)  // store top 512 bits
 	movq	%r9,8(%rdi)
-	movq	%xmm3,%r9
+	movq	%xmm3,%r9  // %r9 is %r9, can't be moved upwards
 	movq	%r10,16(%rdi)
 	movq	%r11,24(%rdi)
 	movq	%r12,32(%rdi)
@@ -2003,7 +2003,7 @@
 	movq	%r15,56(%rdi)
 	leaq	64(%rdi),%rdi
 
-	cmpq	%rdx,%rdi
+	cmpq	%rdx,%rdi  // end of t?
 	jb	L$8x_reduction_loop
 	ret
 
@@ -2014,13 +2014,13 @@
 __bn_post4x_internal:
 
 	movq	0(%rbp),%r12
-	leaq	(%rdi,%r9,1),%rbx
+	leaq	(%rdi,%r9,1),%rbx  // %rdi was %rbx above
 	movq	%r9,%rcx
-	movq	%xmm1,%rdi
+	movq	%xmm1,%rdi  // restore %rdi
 	negq	%rax
-	movq	%xmm1,%rsi
+	movq	%xmm1,%rsi  // prepare for back-to-back call
 	sarq	$3+2,%rcx
-	decq	%r12
+	decq	%r12  // so that after 'not' we get -n0
 	xorq	%r10,%r10
 	movq	8(%rbp),%r13
 	movq	16(%rbp),%r14
@@ -2044,7 +2044,7 @@
 	andq	%rax,%r14
 	andq	%rax,%r15
 
-	negq	%r10
+	negq	%r10  // mov %r10,%cf
 	adcq	0(%rbx),%r12
 	adcq	8(%rbx),%r13
 	adcq	16(%rbx),%r14
@@ -2052,16 +2052,16 @@
 	movq	%r12,0(%rdi)
 	leaq	32(%rbx),%rbx
 	movq	%r13,8(%rdi)
-	sbbq	%r10,%r10
+	sbbq	%r10,%r10  // mov %cf,%r10
 	movq	%r14,16(%rdi)
 	movq	%r15,24(%rdi)
 	leaq	32(%rdi),%rdi
 
-	incq	%rcx
+	incq	%rcx  // pass %cf
 	jnz	L$sqr4x_sub
 
-	movq	%r9,%r10
-	negq	%r9
+	movq	%r9,%r10  // prepare for back-to-back call
+	negq	%r9  // restore %r9
 	ret
 
 
@@ -2089,42 +2089,42 @@
 
 L$mulx4x_prologue:
 
-
-
-
-	shll	$3,%r9d
-	leaq	(%r9,%r9,2),%r10
-	negq	%r9
-	movq	(%r8),%r8
-
-
-
-
-
-
-
-
-
-
+// num is declared as an int, a 32-bit parameter, so the upper half is
+// undefined. It is important that this write to %r9, which zeros the
+// upper half, predates the first access.
+	shll	$3,%r9d  // convert %r9 to bytes
+	leaq	(%r9,%r9,2),%r10  // 3*%r9 in bytes
+	negq	%r9  // -%r9
+	movq	(%r8),%r8  // *n0
+
+// #############################################################
+// Ensure that stack frame doesn't alias with +3*%r9
+// modulo 4096, which covers retnum, amnum and nnum
+// (see bn_exp.c). This is done to allow memory disambiguation
+// logic do its magic. Extra num is allocated in order
+// to align with bn_power5's frame, which is cleansed after
+// completing exponentiation. Extra 256 bytes is for power mask
+// calculated from 7th argument, the index.
+// 
 	leaq	-320(%rsp,%r9,2),%r11
 	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	L$mulx4xsp_alt
-	subq	%r11,%rbp
-	leaq	-320(%rbp,%r9,2),%rbp
+	subq	%r11,%rbp  // align with
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*%r9*8+256)
 	jmp	L$mulx4xsp_done
 
 L$mulx4xsp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rbp,%r9,2),%rbp
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*%r9*8+256)
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
 	subq	%r11,%rbp
 L$mulx4xsp_done:
-	andq	$-64,%rbp
+	andq	$-64,%rbp  // ensure alignment
 	movq	%rsp,%r11
 	subq	%rbp,%r11
 	andq	$-4096,%r11
@@ -2141,25 +2141,25 @@
 	ja	L$mulx4x_page_walk
 L$mulx4x_page_walk_done:
 
-
-
-
-
-
-
-
-
-
-
-
-
-	movq	%r8,32(%rsp)
-	movq	%rax,40(%rsp)
+// #############################################################
+// Stack layout
+// +0	-num
+// +8	off-loaded &bi
+// +16	end of bnum
+// +24	inner counter
+// +32	saved n0
+// +40	saved %rsp
+// +48
+// +56	saved rp
+// +64	tmpnum+1
+// 
+	movq	%r8,32(%rsp)  // save *n0
+	movq	%rax,40(%rsp)  // save original %rsp
 
 L$mulx4x_body:
 	call	mulx4x_internal
 
-	movq	40(%rsp),%rsi
+	movq	40(%rsp),%rsi  // restore %rsp
 
 	movq	$1,%rax
 
@@ -2187,44 +2187,44 @@
 .alt_entry mulx4x_internal
 mulx4x_internal:
 
-	movq	%r9,8(%rsp)
+	movq	%r9,8(%rsp)  // save -%r9 (it was in bytes)
 	movq	%r9,%r10
-	negq	%r9
+	negq	%r9  // restore %r9
 	shlq	$5,%r9
-	negq	%r10
-	leaq	128(%rdx,%r9,1),%r13
+	negq	%r10  // restore %r9
+	leaq	128(%rdx,%r9,1),%r13  // end of powers table (+size optimization)
 	shrq	$5+5,%r9
-	movd	8(%rax),%xmm5
+	movd	8(%rax),%xmm5  // load 7th argument
 	subq	$1,%r9
 	leaq	L$inc(%rip),%rax
-	movq	%r13,16+8(%rsp)
-	movq	%r9,24+8(%rsp)
-	movq	%rdi,56+8(%rsp)
-	movdqa	0(%rax),%xmm0
-	movdqa	16(%rax),%xmm1
-	leaq	88-112(%rsp,%r10,1),%r10
-	leaq	128(%rdx),%rdi
-
-	pshufd	$0,%xmm5,%xmm5
+	movq	%r13,16+8(%rsp)  // end of bnum
+	movq	%r9,24+8(%rsp)  // inner counter
+	movq	%rdi,56+8(%rsp)  // save %rdi
+	movdqa	0(%rax),%xmm0  // 00000001000000010000000000000000
+	movdqa	16(%rax),%xmm1  // 00000002000000020000000200000002
+	leaq	88-112(%rsp,%r10,1),%r10  // place the mask after tpnum+1 (+ICache optimization)
+	leaq	128(%rdx),%rdi  // size optimization
+
+	pshufd	$0,%xmm5,%xmm5  // broadcast index
 	movdqa	%xmm1,%xmm4
 .byte	0x67
 	movdqa	%xmm1,%xmm2
 .byte	0x67
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,112(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,128(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,144(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -2233,17 +2233,17 @@
 	movdqa	%xmm3,160(%r10)
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,176(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,192(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,208(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -2252,17 +2252,17 @@
 	movdqa	%xmm3,224(%r10)
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,240(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,256(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,272(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -2282,7 +2282,7 @@
 	pcmpeqd	%xmm5,%xmm3
 	movdqa	%xmm2,336(%r10)
 
-	pand	64(%rdi),%xmm0
+	pand	64(%rdi),%xmm0  // while it's still in register
 	pand	80(%rdi),%xmm1
 	pand	96(%rdi),%xmm2
 	movdqa	%xmm3,352(%r10)
@@ -2326,41 +2326,41 @@
 	por	%xmm2,%xmm0
 	por	%xmm3,%xmm1
 	pxor	%xmm1,%xmm0
-
-	pshufd	$0x4e,%xmm0,%xmm1
+// Combine the upper and lower halves of %xmm0.
+	pshufd	$0x4e,%xmm0,%xmm1  // Swap upper and lower halves.
 	por	%xmm1,%xmm0
 	leaq	256(%rdi),%rdi
-	movq	%xmm0,%rdx
+	movq	%xmm0,%rdx  // bp0
 	leaq	64+32+8(%rsp),%rbx
 
 	movq	%rdx,%r9
-	mulxq	0(%rsi),%r8,%rax
-	mulxq	8(%rsi),%r11,%r12
+	mulxq	0(%rsi),%r8,%rax  // a0*b0
+	mulxq	8(%rsi),%r11,%r12  // a1*b0
 	addq	%rax,%r11
-	mulxq	16(%rsi),%rax,%r13
+	mulxq	16(%rsi),%rax,%r13  // ...
 	adcq	%rax,%r12
 	adcq	$0,%r13
 	mulxq	24(%rsi),%rax,%r14
 
 	movq	%r8,%r15
-	imulq	32+8(%rsp),%r8
-	xorq	%rbp,%rbp
+	imulq	32+8(%rsp),%r8  // "t0"*n0
+	xorq	%rbp,%rbp  // cf=0, of=0
 	movq	%r8,%rdx
 
-	movq	%rdi,8+8(%rsp)
+	movq	%rdi,8+8(%rsp)  // off-load &bi
 
 	leaq	32(%rsi),%rsi
 	adcxq	%rax,%r13
-	adcxq	%rbp,%r14
+	adcxq	%rbp,%r14  // cf=0
 
 	mulxq	0(%rcx),%rax,%r10
-	adcxq	%rax,%r15
+	adcxq	%rax,%r15  // discarded
 	adoxq	%r11,%r10
 	mulxq	8(%rcx),%rax,%r11
 	adcxq	%rax,%r10
 	adoxq	%r12,%r11
 	mulxq	16(%rcx),%rax,%r12
-	movq	24+8(%rsp),%rdi
+	movq	24+8(%rsp),%rdi  // counter value
 	movq	%r10,-32(%rbx)
 	adcxq	%rax,%r11
 	adoxq	%r13,%r12
@@ -2368,25 +2368,25 @@
 	movq	%r9,%rdx
 	movq	%r11,-24(%rbx)
 	adcxq	%rax,%r12
-	adoxq	%rbp,%r15
+	adoxq	%rbp,%r15  // of=0
 	leaq	32(%rcx),%rcx
 	movq	%r12,-16(%rbx)
 	jmp	L$mulx4x_1st
 
 .p2align	5
 L$mulx4x_1st:
-	adcxq	%rbp,%r15
-	mulxq	0(%rsi),%r10,%rax
+	adcxq	%rbp,%r15  // cf=0, modulo-scheduled
+	mulxq	0(%rsi),%r10,%rax  // a4*b0
 	adcxq	%r14,%r10
-	mulxq	8(%rsi),%r11,%r14
+	mulxq	8(%rsi),%r11,%r14  // a5*b0
 	adcxq	%rax,%r11
-	mulxq	16(%rsi),%r12,%rax
+	mulxq	16(%rsi),%r12,%rax  // ...
 	adcxq	%r14,%r12
 	mulxq	24(%rsi),%r13,%r14
 .byte	0x67,0x67
 	movq	%r8,%rdx
 	adcxq	%rax,%r13
-	adcxq	%rbp,%r14
+	adcxq	%rbp,%r14  // cf=0
 	leaq	32(%rsi),%rsi
 	leaq	32(%rbx),%rbx
 
@@ -2410,21 +2410,21 @@
 	leaq	32(%rcx),%rcx
 	movq	%r13,-16(%rbx)
 
-	decq	%rdi
+	decq	%rdi  // of=0, pass cf
 	jnz	L$mulx4x_1st
 
-	movq	8(%rsp),%rax
-	adcq	%rbp,%r15
-	leaq	(%rsi,%rax,1),%rsi
+	movq	8(%rsp),%rax  // load -num
+	adcq	%rbp,%r15  // modulo-scheduled
+	leaq	(%rsi,%rax,1),%rsi  // rewind %rsi
 	addq	%r15,%r14
-	movq	8+8(%rsp),%rdi
-	adcq	%rbp,%rbp
+	movq	8+8(%rsp),%rdi  // re-load &bi
+	adcq	%rbp,%rbp  // top-most carry
 	movq	%r14,-8(%rbx)
 	jmp	L$mulx4x_outer
 
 .p2align	5
 L$mulx4x_outer:
-	leaq	16-256(%rbx),%r10
+	leaq	16-256(%rbx),%r10  // where 256-byte mask is (+density control)
 	pxor	%xmm4,%xmm4
 .byte	0x67,0x67
 	pxor	%xmm5,%xmm5
@@ -2477,41 +2477,41 @@
 	por	%xmm2,%xmm4
 	por	%xmm3,%xmm5
 	por	%xmm5,%xmm4
-
-	pshufd	$0x4e,%xmm4,%xmm0
+// Combine the upper and lower halves of %xmm4 as %xmm0.
+	pshufd	$0x4e,%xmm4,%xmm0  // Swap upper and lower halves.
 	por	%xmm4,%xmm0
 	leaq	256(%rdi),%rdi
-	movq	%xmm0,%rdx
+	movq	%xmm0,%rdx  // m0=bpi
 
-	movq	%rbp,(%rbx)
-	leaq	32(%rbx,%rax,1),%rbx
-	mulxq	0(%rsi),%r8,%r11
-	xorq	%rbp,%rbp
+	movq	%rbp,(%rbx)  // save top-most carry
+	leaq	32(%rbx,%rax,1),%rbx  // rewind %rbx
+	mulxq	0(%rsi),%r8,%r11  // a0*bi
+	xorq	%rbp,%rbp  // cf=0, of=0
 	movq	%rdx,%r9
-	mulxq	8(%rsi),%r14,%r12
-	adoxq	-32(%rbx),%r8
+	mulxq	8(%rsi),%r14,%r12  // a1*bi
+	adoxq	-32(%rbx),%r8  // +t0
 	adcxq	%r14,%r11
-	mulxq	16(%rsi),%r15,%r13
+	mulxq	16(%rsi),%r15,%r13  // ...
 	adoxq	-24(%rbx),%r11
 	adcxq	%r15,%r12
 	mulxq	24(%rsi),%rdx,%r14
 	adoxq	-16(%rbx),%r12
 	adcxq	%rdx,%r13
-	leaq	(%rcx,%rax,1),%rcx
+	leaq	(%rcx,%rax,1),%rcx  // rewind %rcx
 	leaq	32(%rsi),%rsi
 	adoxq	-8(%rbx),%r13
 	adcxq	%rbp,%r14
 	adoxq	%rbp,%r14
 
 	movq	%r8,%r15
-	imulq	32+8(%rsp),%r8
+	imulq	32+8(%rsp),%r8  // "t0"*n0
 
 	movq	%r8,%rdx
-	xorq	%rbp,%rbp
-	movq	%rdi,8+8(%rsp)
+	xorq	%rbp,%rbp  // cf=0, of=0
+	movq	%rdi,8+8(%rsp)  // off-load &bi
 
 	mulxq	0(%rcx),%rax,%r10
-	adcxq	%rax,%r15
+	adcxq	%rax,%r15  // discarded
 	adoxq	%r11,%r10
 	mulxq	8(%rcx),%rax,%r11
 	adcxq	%rax,%r10
@@ -2521,24 +2521,24 @@
 	adoxq	%r13,%r12
 	mulxq	24(%rcx),%rax,%r15
 	movq	%r9,%rdx
-	movq	24+8(%rsp),%rdi
+	movq	24+8(%rsp),%rdi  // counter value
 	movq	%r10,-32(%rbx)
 	adcxq	%rax,%r12
 	movq	%r11,-24(%rbx)
-	adoxq	%rbp,%r15
+	adoxq	%rbp,%r15  // of=0
 	movq	%r12,-16(%rbx)
 	leaq	32(%rcx),%rcx
 	jmp	L$mulx4x_inner
 
 .p2align	5
 L$mulx4x_inner:
-	mulxq	0(%rsi),%r10,%rax
-	adcxq	%rbp,%r15
+	mulxq	0(%rsi),%r10,%rax  // a4*bi
+	adcxq	%rbp,%r15  // cf=0, modulo-scheduled
 	adoxq	%r14,%r10
-	mulxq	8(%rsi),%r11,%r14
+	mulxq	8(%rsi),%r11,%r14  // a5*bi
 	adcxq	0(%rbx),%r10
 	adoxq	%rax,%r11
-	mulxq	16(%rsi),%r12,%rax
+	mulxq	16(%rsi),%r12,%rax  // ...
 	adcxq	8(%rbx),%r11
 	adoxq	%r14,%r12
 	mulxq	24(%rsi),%r13,%r14
@@ -2546,10 +2546,10 @@
 	adcxq	16(%rbx),%r12
 	adoxq	%rax,%r13
 	adcxq	24(%rbx),%r13
-	adoxq	%rbp,%r14
+	adoxq	%rbp,%r14  // of=0
 	leaq	32(%rsi),%rsi
 	leaq	32(%rbx),%rbx
-	adcxq	%rbp,%r14
+	adcxq	%rbp,%r14  // cf=0
 
 	adoxq	%r15,%r10
 	mulxq	0(%rcx),%rax,%r15
@@ -2571,17 +2571,17 @@
 	adoxq	%rbp,%r15
 	movq	%r13,-16(%rbx)
 
-	decq	%rdi
+	decq	%rdi  // of=0, pass cf
 	jnz	L$mulx4x_inner
 
-	movq	0+8(%rsp),%rax
-	adcq	%rbp,%r15
-	subq	0(%rbx),%rdi
-	movq	8+8(%rsp),%rdi
+	movq	0+8(%rsp),%rax  // load -num
+	adcq	%rbp,%r15  // modulo-scheduled
+	subq	0(%rbx),%rdi  // pull top-most carry to %cf
+	movq	8+8(%rsp),%rdi  // re-load &bi
 	movq	16+8(%rsp),%r10
 	adcq	%r15,%r14
-	leaq	(%rsi,%rax,1),%rsi
-	adcq	%rbp,%rbp
+	leaq	(%rsi,%rax,1),%rsi  // rewind %rsi
+	adcq	%rbp,%rbp  // top-most carry
 	movq	%r14,-8(%rbx)
 
 	cmpq	%r10,%rdi
@@ -2590,23 +2590,23 @@
 	movq	-8(%rcx),%r10
 	movq	%rbp,%r8
 	movq	(%rcx,%rax,1),%r12
-	leaq	(%rcx,%rax,1),%rbp
+	leaq	(%rcx,%rax,1),%rbp  // rewind %rcx
 	movq	%rax,%rcx
-	leaq	(%rbx,%rax,1),%rdi
+	leaq	(%rbx,%rax,1),%rdi  // rewind %rbx
 	xorl	%eax,%eax
 	xorq	%r15,%r15
-	subq	%r14,%r10
+	subq	%r14,%r10  // compare top-most words
 	adcq	%r15,%r15
 	orq	%r15,%r8
 	sarq	$3+2,%rcx
-	subq	%r8,%rax
-	movq	56+8(%rsp),%rdx
-	decq	%r12
+	subq	%r8,%rax  // %rax=-%r8
+	movq	56+8(%rsp),%rdx  // restore rp
+	decq	%r12  // so that after 'not' we get -n0
 	movq	8(%rbp),%r13
 	xorq	%r8,%r8
 	movq	16(%rbp),%r14
 	movq	24(%rbp),%r15
-	jmp	L$sqrx4x_sub_entry
+	jmp	L$sqrx4x_sub_entry  // common post-condition
 
 
 .globl	_bn_powerx5
@@ -2633,35 +2633,35 @@
 
 L$powerx5_prologue:
 
-
-
-
-	shll	$3,%r9d
-	leaq	(%r9,%r9,2),%r10
+// num is declared as an int, a 32-bit parameter, so the upper half is
+// undefined. It is important that this write to %r9, which zeros the
+// upper half, predates the first access.
+	shll	$3,%r9d  // convert %r9 to bytes
+	leaq	(%r9,%r9,2),%r10  // 3*%r9 in bytes
 	negq	%r9
-	movq	(%r8),%r8
-
-
-
-
-
-
-
-
+	movq	(%r8),%r8  // *n0
+
+// #############################################################
+// Ensure that stack frame doesn't alias with %rdi+3*%r9
+// modulo 4096, which covers retnum, amnum and nnum
+// (see bn_exp.c). This is done to allow memory disambiguation
+// logic do its magic. Extra 256 bytes is for power mask
+// calculated from 7th argument, the index.
+// 
 	leaq	-320(%rsp,%r9,2),%r11
 	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	L$pwrx_sp_alt
-	subq	%r11,%rbp
-	leaq	-320(%rbp,%r9,2),%rbp
+	subq	%r11,%rbp  // align with %rsi
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*%r9*8+256)
 	jmp	L$pwrx_sp_done
 
 .p2align	5
 L$pwrx_sp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rbp,%r9,2),%rbp
+	leaq	-320(%rbp,%r9,2),%rbp  // alloca(frame+2*%r9*8+256)
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
@@ -2687,24 +2687,24 @@
 	movq	%r9,%r10
 	negq	%r9
 
-
-
-
-
-
-
-
-
-
-
-
+// #############################################################
+// Stack layout
+// 
+// +0	saved %r9, used in reduction section
+// +8	&t2*%r9, used in reduction section
+// +16	intermediate carry bit
+// +24	top-most carry bit, used in reduction section
+// +32	saved *n0
+// +40	saved %rsp
+// +48	t2*%r9
+// 
 	pxor	%xmm0,%xmm0
-	movq	%rdi,%xmm1
-	movq	%rcx,%xmm2
-	movq	%r10,%xmm3
+	movq	%rdi,%xmm1  // save %rdi
+	movq	%rcx,%xmm2  // save %rcx
+	movq	%r10,%xmm3  // -%r9
 	movq	%rdx,%xmm4
 	movq	%r8,32(%rsp)
-	movq	%rax,40(%rsp)
+	movq	%rax,40(%rsp)  // save original %rsp
 
 L$powerx5_body:
 
@@ -2719,7 +2719,7 @@
 	call	__bn_sqrx8x_internal
 	call	__bn_postx4x_internal
 
-	movq	%r10,%r9
+	movq	%r10,%r9  // -num
 	movq	%rsi,%rdi
 	movq	%xmm2,%rcx
 	movq	%xmm4,%rdx
@@ -2727,7 +2727,7 @@
 
 	call	mulx4x_internal
 
-	movq	40(%rsp),%rsi
+	movq	40(%rsp),%rsi  // restore %rsp
 
 	movq	$1,%rax
 
@@ -2761,50 +2761,50 @@
 __bn_sqrx8x_internal:
 
 _CET_ENDBR
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+// #################################################################
+// Squaring part:
+// 
+// a) multiply-n-add everything but ai*ai;
+// b) shift result of a) by 1 to the left and accumulate
+// ai*ai products;
+// 
+// #################################################################
+// a7a7a6a6a5a5a4a4a3a3a2a2a1a1a0a0
+// a1a0
+// a2a0
+// a3a0
+// a2a1
+// a3a1
+// a3a2
+// 
+// a4a0
+// a5a0
+// a6a0
+// a7a0
+// a4a1
+// a5a1
+// a6a1
+// a7a1
+// a4a2
+// a5a2
+// a6a2
+// a7a2
+// a4a3
+// a5a3
+// a6a3
+// a7a3
+// 
+// a5a4
+// a6a4
+// a7a4
+// a6a5
+// a7a5
+// a7a6
+// a7a7a6a6a5a5a4a4a3a3a2a2a1a1a0a0
 	leaq	48+8(%rsp),%rdi
 	leaq	(%rsi,%r9,1),%rbp
-	movq	%r9,0+8(%rsp)
-	movq	%rbp,8+8(%rsp)
+	movq	%r9,0+8(%rsp)  // save %r9
+	movq	%rbp,8+8(%rsp)  // save end of %rsi
 	jmp	L$sqr8x_zero_start
 
 .p2align	5
@@ -2815,7 +2815,7 @@
 	movdqa	%xmm0,16(%rdi)
 	movdqa	%xmm0,32(%rdi)
 	movdqa	%xmm0,48(%rdi)
-L$sqr8x_zero_start:
+L$sqr8x_zero_start:  // aligned at 32
 	movdqa	%xmm0,64(%rdi)
 	movdqa	%xmm0,80(%rdi)
 	movdqa	%xmm0,96(%rdi)
@@ -2824,8 +2824,8 @@
 	subq	$64,%r9
 	jnz	L$sqrx8x_zero
 
-	movq	0(%rsi),%rdx
-
+	movq	0(%rsi),%rdx  // a0, modulo-scheduled
+// xor	%r9,%r9			# t1, ex-%r9, zero already
 	xorq	%r10,%r10
 	xorq	%r11,%r11
 	xorq	%r12,%r12
@@ -2833,21 +2833,21 @@
 	xorq	%r14,%r14
 	xorq	%r15,%r15
 	leaq	48+8(%rsp),%rdi
-	xorq	%rbp,%rbp
+	xorq	%rbp,%rbp  // cf=0, cf=0
 	jmp	L$sqrx8x_outer_loop
 
 .p2align	5
 L$sqrx8x_outer_loop:
-	mulxq	8(%rsi),%r8,%rax
-	adcxq	%r9,%r8
+	mulxq	8(%rsi),%r8,%rax  // a1*a0
+	adcxq	%r9,%r8  // a1*a0+=t1
 	adoxq	%rax,%r10
-	mulxq	16(%rsi),%r9,%rax
+	mulxq	16(%rsi),%r9,%rax  // a2*a0
 	adcxq	%r10,%r9
 	adoxq	%rax,%r11
-.byte	0xc4,0xe2,0xab,0xf6,0x86,0x18,0x00,0x00,0x00
+.byte	0xc4,0xe2,0xab,0xf6,0x86,0x18,0x00,0x00,0x00  // mulx	3*8(%rsi),%r10,%rax	# ...
 	adcxq	%r11,%r10
 	adoxq	%rax,%r12
-.byte	0xc4,0xe2,0xa3,0xf6,0x86,0x20,0x00,0x00,0x00
+.byte	0xc4,0xe2,0xa3,0xf6,0x86,0x20,0x00,0x00,0x00  // mulx	4*8(%rsi),%r11,%rax
 	adcxq	%r12,%r11
 	adoxq	%rax,%r13
 	mulxq	40(%rsi),%r12,%rax
@@ -2857,97 +2857,97 @@
 	adcxq	%r14,%r13
 	adoxq	%r15,%rax
 	mulxq	56(%rsi),%r14,%r15
-	movq	8(%rsi),%rdx
+	movq	8(%rsi),%rdx  // a1
 	adcxq	%rax,%r14
 	adoxq	%rbp,%r15
 	adcq	64(%rdi),%r15
-	movq	%r8,8(%rdi)
-	movq	%r9,16(%rdi)
-	sbbq	%rcx,%rcx
-	xorq	%rbp,%rbp
+	movq	%r8,8(%rdi)  // t1
+	movq	%r9,16(%rdi)  // t2
+	sbbq	%rcx,%rcx  // mov %cf,%rcx
+	xorq	%rbp,%rbp  // cf=0, of=0
 
 
-	mulxq	16(%rsi),%r8,%rbx
-	mulxq	24(%rsi),%r9,%rax
+	mulxq	16(%rsi),%r8,%rbx  // a2*a1
+	mulxq	24(%rsi),%r9,%rax  // a3*a1
 	adcxq	%r10,%r8
 	adoxq	%rbx,%r9
-	mulxq	32(%rsi),%r10,%rbx
+	mulxq	32(%rsi),%r10,%rbx  // ...
 	adcxq	%r11,%r9
 	adoxq	%rax,%r10
-.byte	0xc4,0xe2,0xa3,0xf6,0x86,0x28,0x00,0x00,0x00
+.byte	0xc4,0xe2,0xa3,0xf6,0x86,0x28,0x00,0x00,0x00  // mulx	5*8(%rsi),%r11,%rax
 	adcxq	%r12,%r10
 	adoxq	%rbx,%r11
-.byte	0xc4,0xe2,0x9b,0xf6,0x9e,0x30,0x00,0x00,0x00
+.byte	0xc4,0xe2,0x9b,0xf6,0x9e,0x30,0x00,0x00,0x00  // mulx	6*8(%rsi),%r12,%rbx
 	adcxq	%r13,%r11
 	adoxq	%r14,%r12
-.byte	0xc4,0x62,0x93,0xf6,0xb6,0x38,0x00,0x00,0x00
-	movq	16(%rsi),%rdx
+.byte	0xc4,0x62,0x93,0xf6,0xb6,0x38,0x00,0x00,0x00  // mulx	7*8(%rsi),%r13,%r14
+	movq	16(%rsi),%rdx  // a2
 	adcxq	%rax,%r12
 	adoxq	%rbx,%r13
 	adcxq	%r15,%r13
-	adoxq	%rbp,%r14
-	adcxq	%rbp,%r14
+	adoxq	%rbp,%r14  // of=0
+	adcxq	%rbp,%r14  // cf=0
 
-	movq	%r8,24(%rdi)
-	movq	%r9,32(%rdi)
+	movq	%r8,24(%rdi)  // t3
+	movq	%r9,32(%rdi)  // t4
 
-	mulxq	24(%rsi),%r8,%rbx
-	mulxq	32(%rsi),%r9,%rax
+	mulxq	24(%rsi),%r8,%rbx  // a3*a2
+	mulxq	32(%rsi),%r9,%rax  // a4*a2
 	adcxq	%r10,%r8
 	adoxq	%rbx,%r9
-	mulxq	40(%rsi),%r10,%rbx
+	mulxq	40(%rsi),%r10,%rbx  // ...
 	adcxq	%r11,%r9
 	adoxq	%rax,%r10
-.byte	0xc4,0xe2,0xa3,0xf6,0x86,0x30,0x00,0x00,0x00
+.byte	0xc4,0xe2,0xa3,0xf6,0x86,0x30,0x00,0x00,0x00  // mulx	6*8(%rsi),%r11,%rax
 	adcxq	%r12,%r10
 	adoxq	%r13,%r11
-.byte	0xc4,0x62,0x9b,0xf6,0xae,0x38,0x00,0x00,0x00
+.byte	0xc4,0x62,0x9b,0xf6,0xae,0x38,0x00,0x00,0x00  // mulx	7*8(%rsi),%r12,%r13
 .byte	0x3e
-	movq	24(%rsi),%rdx
+	movq	24(%rsi),%rdx  // a3
 	adcxq	%rbx,%r11
 	adoxq	%rax,%r12
 	adcxq	%r14,%r12
-	movq	%r8,40(%rdi)
-	movq	%r9,48(%rdi)
-	mulxq	32(%rsi),%r8,%rax
-	adoxq	%rbp,%r13
-	adcxq	%rbp,%r13
+	movq	%r8,40(%rdi)  // t5
+	movq	%r9,48(%rdi)  // t6
+	mulxq	32(%rsi),%r8,%rax  // a4*a3
+	adoxq	%rbp,%r13  // of=0
+	adcxq	%rbp,%r13  // cf=0
 
-	mulxq	40(%rsi),%r9,%rbx
+	mulxq	40(%rsi),%r9,%rbx  // a5*a3
 	adcxq	%r10,%r8
 	adoxq	%rax,%r9
-	mulxq	48(%rsi),%r10,%rax
+	mulxq	48(%rsi),%r10,%rax  // ...
 	adcxq	%r11,%r9
 	adoxq	%r12,%r10
 	mulxq	56(%rsi),%r11,%r12
-	movq	32(%rsi),%rdx
-	movq	40(%rsi),%r14
+	movq	32(%rsi),%rdx  // a4
+	movq	40(%rsi),%r14  // a5
 	adcxq	%rbx,%r10
 	adoxq	%rax,%r11
-	movq	48(%rsi),%r15
+	movq	48(%rsi),%r15  // a6
 	adcxq	%r13,%r11
-	adoxq	%rbp,%r12
-	adcxq	%rbp,%r12
+	adoxq	%rbp,%r12  // of=0
+	adcxq	%rbp,%r12  // cf=0
 
-	movq	%r8,56(%rdi)
-	movq	%r9,64(%rdi)
+	movq	%r8,56(%rdi)  // t7
+	movq	%r9,64(%rdi)  // t8
 
-	mulxq	%r14,%r9,%rax
-	movq	56(%rsi),%r8
+	mulxq	%r14,%r9,%rax  // a5*a4
+	movq	56(%rsi),%r8  // a7
 	adcxq	%r10,%r9
-	mulxq	%r15,%r10,%rbx
+	mulxq	%r15,%r10,%rbx  // a6*a4
 	adoxq	%rax,%r10
 	adcxq	%r11,%r10
-	mulxq	%r8,%r11,%rax
-	movq	%r14,%rdx
+	mulxq	%r8,%r11,%rax  // a7*a4
+	movq	%r14,%rdx  // a5
 	adoxq	%rbx,%r11
 	adcxq	%r12,%r11
+// adox	%rbp,%rax		# of=0
+	adcxq	%rbp,%rax  // cf=0
 
-	adcxq	%rbp,%rax
-
-	mulxq	%r15,%r14,%rbx
-	mulxq	%r8,%r12,%r13
-	movq	%r15,%rdx
+	mulxq	%r15,%r14,%rbx  // a6*a5
+	mulxq	%r8,%r12,%r13  // a7*a5
+	movq	%r15,%rdx  // a6
 	leaq	64(%rsi),%rsi
 	adcxq	%r14,%r11
 	adoxq	%rbx,%r12
@@ -2955,19 +2955,19 @@
 	adoxq	%rbp,%r13
 
 .byte	0x67,0x67
-	mulxq	%r8,%r8,%r14
+	mulxq	%r8,%r8,%r14  // a7*a6
 	adcxq	%r8,%r13
 	adcxq	%rbp,%r14
 
 	cmpq	8+8(%rsp),%rsi
 	je	L$sqrx8x_outer_break
 
-	negq	%rcx
+	negq	%rcx  // mov %rcx,%cf
 	movq	$-8,%rcx
 	movq	%rbp,%r15
 	movq	64(%rdi),%r8
-	adcxq	72(%rdi),%r9
-	adcxq	80(%rdi),%r10
+	adcxq	72(%rdi),%r9  // +=t9
+	adcxq	80(%rdi),%r10  // ...
 	adcxq	88(%rdi),%r11
 	adcq	96(%rdi),%r12
 	adcq	104(%rdi),%r13
@@ -2975,24 +2975,24 @@
 	adcq	120(%rdi),%r15
 	leaq	(%rsi),%rbp
 	leaq	128(%rdi),%rdi
-	sbbq	%rax,%rax
+	sbbq	%rax,%rax  // mov %cf,%rcx
 
-	movq	-64(%rsi),%rdx
-	movq	%rax,16+8(%rsp)
+	movq	-64(%rsi),%rdx  // a0
+	movq	%rax,16+8(%rsp)  // offload %rcx
 	movq	%rdi,24+8(%rsp)
 
-
-	xorl	%eax,%eax
+// lea	8*8(%rdi),%rdi	# see 2*8*8(%rdi) above
+	xorl	%eax,%eax  // cf=0, of=0
 	jmp	L$sqrx8x_loop
 
 .p2align	5
 L$sqrx8x_loop:
 	movq	%r8,%rbx
-	mulxq	0(%rbp),%rax,%r8
-	adcxq	%rax,%rbx
+	mulxq	0(%rbp),%rax,%r8  // a8*ai
+	adcxq	%rax,%rbx  // +=t8
 	adoxq	%r9,%r8
 
-	mulxq	8(%rbp),%rax,%r9
+	mulxq	8(%rbp),%rax,%r9  // ...
 	adcxq	%rax,%r8
 	adoxq	%r10,%r9
 
@@ -3004,7 +3004,7 @@
 	adcxq	%rax,%r10
 	adoxq	%r12,%r11
 
-.byte	0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00
+.byte	0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00  // mulx	4*8(%rbp),%rax,%r12
 	adcxq	%rax,%r11
 	adoxq	%r13,%r12
 
@@ -3013,27 +3013,27 @@
 	adoxq	%r14,%r13
 
 	mulxq	48(%rbp),%rax,%r14
-	movq	%rbx,(%rdi,%rcx,8)
+	movq	%rbx,(%rdi,%rcx,8)  // store t8+i
 	movl	$0,%ebx
 	adcxq	%rax,%r13
 	adoxq	%r15,%r14
 
-.byte	0xc4,0x62,0xfb,0xf6,0xbd,0x38,0x00,0x00,0x00
-	movq	8(%rsi,%rcx,8),%rdx
+.byte	0xc4,0x62,0xfb,0xf6,0xbd,0x38,0x00,0x00,0x00  // mulx	7*8(%rbp),%rax,%r15
+	movq	8(%rsi,%rcx,8),%rdx  // ai
 	adcxq	%rax,%r14
-	adoxq	%rbx,%r15
-	adcxq	%rbx,%r15
+	adoxq	%rbx,%r15  // %rbx is 0, of=0
+	adcxq	%rbx,%r15  // cf=0
 
 .byte	0x67
-	incq	%rcx
+	incq	%rcx  // of=0
 	jnz	L$sqrx8x_loop
 
 	leaq	64(%rbp),%rbp
 	movq	$-8,%rcx
-	cmpq	8+8(%rsp),%rbp
+	cmpq	8+8(%rsp),%rbp  // done?
 	je	L$sqrx8x_break
 
-	subq	16+8(%rsp),%rbx
+	subq	16+8(%rsp),%rbx  // mov 16(%rsp),%cf
 .byte	0x66
 	movq	-64(%rsi),%rdx
 	adcxq	0(%rdi),%r8
@@ -3046,19 +3046,19 @@
 	adcq	56(%rdi),%r15
 	leaq	64(%rdi),%rdi
 .byte	0x67
-	sbbq	%rax,%rax
-	xorl	%ebx,%ebx
-	movq	%rax,16+8(%rsp)
+	sbbq	%rax,%rax  // mov %cf,%rax
+	xorl	%ebx,%ebx  // cf=0, of=0
+	movq	%rax,16+8(%rsp)  // offload carry
 	jmp	L$sqrx8x_loop
 
 .p2align	5
 L$sqrx8x_break:
 	xorq	%rbp,%rbp
-	subq	16+8(%rsp),%rbx
+	subq	16+8(%rsp),%rbx  // mov 16(%rsp),%cf
 	adcxq	%rbp,%r8
-	movq	24+8(%rsp),%rcx
+	movq	24+8(%rsp),%rcx  // initial %rdi, borrow %rcx
 	adcxq	%rbp,%r9
-	movq	0(%rsi),%rdx
+	movq	0(%rsi),%rdx  // a8, modulo-scheduled
 	adcq	$0,%r10
 	movq	%r8,0(%rdi)
 	adcq	$0,%r11
@@ -3066,7 +3066,7 @@
 	adcq	$0,%r13
 	adcq	$0,%r14
 	adcq	$0,%r15
-	cmpq	%rcx,%rdi
+	cmpq	%rcx,%rdi  // cf=0, of=0
 	je	L$sqrx8x_outer_loop
 
 	movq	%r9,8(%rdi)
@@ -3088,57 +3088,57 @@
 
 .p2align	5
 L$sqrx8x_outer_break:
-	movq	%r9,72(%rdi)
-	movq	%xmm3,%rcx
-	movq	%r10,80(%rdi)
+	movq	%r9,72(%rdi)  // t9
+	movq	%xmm3,%rcx  // -%r9
+	movq	%r10,80(%rdi)  // ...
 	movq	%r11,88(%rdi)
 	movq	%r12,96(%rdi)
 	movq	%r13,104(%rdi)
 	movq	%r14,112(%rdi)
 	leaq	48+8(%rsp),%rdi
-	movq	(%rsi,%rcx,1),%rdx
+	movq	(%rsi,%rcx,1),%rdx  // a0
 
-	movq	8(%rdi),%r11
-	xorq	%r10,%r10
-	movq	0+8(%rsp),%r9
+	movq	8(%rdi),%r11  // t1
+	xorq	%r10,%r10  // t0, of=0, cf=0
+	movq	0+8(%rsp),%r9  // restore %r9
 	adoxq	%r11,%r11
-	movq	16(%rdi),%r12
-	movq	24(%rdi),%r13
-
+	movq	16(%rdi),%r12  // t2	# prefetch
+	movq	24(%rdi),%r13  // t3	# prefetch
+// jmp	.Lsqrx4x_shift_n_add	# happens to be aligned
 
 .p2align	5
 L$sqrx4x_shift_n_add:
 	mulxq	%rdx,%rax,%rbx
 	adoxq	%r12,%r12
 	adcxq	%r10,%rax
-.byte	0x48,0x8b,0x94,0x0e,0x08,0x00,0x00,0x00
-.byte	0x4c,0x8b,0x97,0x20,0x00,0x00,0x00
+.byte	0x48,0x8b,0x94,0x0e,0x08,0x00,0x00,0x00  // mov	8(%rsi,%rcx),%rdx	# ai+1	# prefetch
+.byte	0x4c,0x8b,0x97,0x20,0x00,0x00,0x00  // mov	32(%rdi),%r10	# t2*i+4	# prefetch
 	adoxq	%r13,%r13
 	adcxq	%r11,%rbx
-	movq	40(%rdi),%r11
+	movq	40(%rdi),%r11  // t2*i+4+1	# prefetch
 	movq	%rax,0(%rdi)
 	movq	%rbx,8(%rdi)
 
 	mulxq	%rdx,%rax,%rbx
 	adoxq	%r10,%r10
 	adcxq	%r12,%rax
-	movq	16(%rsi,%rcx,1),%rdx
-	movq	48(%rdi),%r12
+	movq	16(%rsi,%rcx,1),%rdx  // ai+2	# prefetch
+	movq	48(%rdi),%r12  // t2*i+6	# prefetch
 	adoxq	%r11,%r11
 	adcxq	%r13,%rbx
-	movq	56(%rdi),%r13
+	movq	56(%rdi),%r13  // t2*i+6+1	# prefetch
 	movq	%rax,16(%rdi)
 	movq	%rbx,24(%rdi)
 
 	mulxq	%rdx,%rax,%rbx
 	adoxq	%r12,%r12
 	adcxq	%r10,%rax
-	movq	24(%rsi,%rcx,1),%rdx
+	movq	24(%rsi,%rcx,1),%rdx  // ai+3	# prefetch
 	leaq	32(%rcx),%rcx
-	movq	64(%rdi),%r10
+	movq	64(%rdi),%r10  // t2*i+8	# prefetch
 	adoxq	%r13,%r13
 	adcxq	%r11,%rbx
-	movq	72(%rdi),%r11
+	movq	72(%rdi),%r11  // t2*i+8+1	# prefetch
 	movq	%rax,32(%rdi)
 	movq	%rbx,40(%rdi)
 
@@ -3146,11 +3146,11 @@
 	adoxq	%r10,%r10
 	adcxq	%r12,%rax
 	jrcxz	L$sqrx4x_shift_n_add_break
-.byte	0x48,0x8b,0x94,0x0e,0x00,0x00,0x00,0x00
+.byte	0x48,0x8b,0x94,0x0e,0x00,0x00,0x00,0x00  // mov	0(%rsi,%rcx),%rdx	# ai+4	# prefetch
 	adoxq	%r11,%r11
 	adcxq	%r13,%rbx
-	movq	80(%rdi),%r12
-	movq	88(%rdi),%r13
+	movq	80(%rdi),%r12  // t2*i+10	# prefetch
+	movq	88(%rdi),%r13  // t2*i+10+1	# prefetch
 	movq	%rax,48(%rdi)
 	movq	%rbx,56(%rdi)
 	leaq	64(%rdi),%rdi
@@ -3162,19 +3162,19 @@
 	adcxq	%r13,%rbx
 	movq	%rax,48(%rdi)
 	movq	%rbx,56(%rdi)
-	leaq	64(%rdi),%rdi
+	leaq	64(%rdi),%rdi  // end of t buffer
 	movq	%xmm2,%rbp
 .alt_entry __bn_sqrx8x_reduction
 __bn_sqrx8x_reduction:
-	xorl	%eax,%eax
-	movq	32+8(%rsp),%rbx
-	movq	48+8(%rsp),%rdx
-	leaq	-64(%rbp,%r9,1),%rcx
-
-	movq	%rcx,0+8(%rsp)
-	movq	%rdi,8+8(%rsp)
-
-	leaq	48+8(%rsp),%rdi
+	xorl	%eax,%eax  // initial top-most carry bit
+	movq	32+8(%rsp),%rbx  // n0
+	movq	48+8(%rsp),%rdx  // "%r8", 8*0(%rdi)
+	leaq	-64(%rbp,%r9,1),%rcx  // end of n
+// lea	48+8(%rsp,%r9,2),%rdi	# end of t buffer
+	movq	%rcx,0+8(%rsp)  // save end of n
+	movq	%rdi,8+8(%rsp)  // save end of t
+
+	leaq	48+8(%rsp),%rdi  // initial t window
 	jmp	L$sqrx8x_reduction_loop
 
 .p2align	5
@@ -3184,25 +3184,25 @@
 	movq	24(%rdi),%r11
 	movq	32(%rdi),%r12
 	movq	%rdx,%r8
-	imulq	%rbx,%rdx
+	imulq	%rbx,%rdx  // n0*ai
 	movq	40(%rdi),%r13
 	movq	48(%rdi),%r14
 	movq	56(%rdi),%r15
-	movq	%rax,24+8(%rsp)
+	movq	%rax,24+8(%rsp)  // store top-most carry bit
 
 	leaq	64(%rdi),%rdi
-	xorq	%rsi,%rsi
+	xorq	%rsi,%rsi  // cf=0,of=0
 	movq	$-8,%rcx
 	jmp	L$sqrx8x_reduce
 
 .p2align	5
 L$sqrx8x_reduce:
 	movq	%r8,%rbx
-	mulxq	0(%rbp),%rax,%r8
-	adcxq	%rbx,%rax
+	mulxq	0(%rbp),%rax,%r8  // n0
+	adcxq	%rbx,%rax  // discarded
 	adoxq	%r9,%r8
 
-	mulxq	8(%rbp),%rbx,%r9
+	mulxq	8(%rbp),%rbx,%r9  // n1
 	adcxq	%rbx,%r8
 	adoxq	%r10,%r9
 
@@ -3214,15 +3214,15 @@
 	adcxq	%rbx,%r10
 	adoxq	%r12,%r11
 
-.byte	0xc4,0x62,0xe3,0xf6,0xa5,0x20,0x00,0x00,0x00
+.byte	0xc4,0x62,0xe3,0xf6,0xa5,0x20,0x00,0x00,0x00  // mulx	8*4(%rbp),%rbx,%r12
 	movq	%rdx,%rax
 	movq	%r8,%rdx
 	adcxq	%rbx,%r11
 	adoxq	%r13,%r12
 
-	mulxq	32+8(%rsp),%rbx,%rdx
+	mulxq	32+8(%rsp),%rbx,%rdx  // %rdx discarded
 	movq	%rax,%rdx
-	movq	%rax,64+48+8(%rsp,%rcx,8)
+	movq	%rax,64+48+8(%rsp,%rcx,8)  // put aside n0*ai
 
 	mulxq	40(%rbp),%rax,%r13
 	adcxq	%rax,%r12
@@ -3235,18 +3235,18 @@
 	mulxq	56(%rbp),%rax,%r15
 	movq	%rbx,%rdx
 	adcxq	%rax,%r14
-	adoxq	%rsi,%r15
-	adcxq	%rsi,%r15
+	adoxq	%rsi,%r15  // %rsi is 0
+	adcxq	%rsi,%r15  // cf=0
 
 .byte	0x67,0x67,0x67
-	incq	%rcx
+	incq	%rcx  // of=0
 	jnz	L$sqrx8x_reduce
 
-	movq	%rsi,%rax
-	cmpq	0+8(%rsp),%rbp
+	movq	%rsi,%rax  // xor	%rax,%rax
+	cmpq	0+8(%rsp),%rbp  // end of n?
 	jae	L$sqrx8x_no_tail
 
-	movq	48+8(%rsp),%rdx
+	movq	48+8(%rsp),%rdx  // pull n0*a0
 	addq	0(%rdi),%r8
 	leaq	64(%rbp),%rbp
 	movq	$-8,%rcx
@@ -3258,9 +3258,9 @@
 	adcq	48(%rdi),%r14
 	adcq	56(%rdi),%r15
 	leaq	64(%rdi),%rdi
-	sbbq	%rax,%rax
+	sbbq	%rax,%rax  // top carry
 
-	xorq	%rsi,%rsi
+	xorq	%rsi,%rsi  // of=0, cf=0
 	movq	%rax,16+8(%rsp)
 	jmp	L$sqrx8x_tail
 
@@ -3283,7 +3283,7 @@
 	adcxq	%rax,%r10
 	adoxq	%r12,%r11
 
-.byte	0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00
+.byte	0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00  // mulx	8*4(%rbp),%rax,%r12
 	adcxq	%rax,%r11
 	adoxq	%r13,%r12
 
@@ -3296,21 +3296,21 @@
 	adoxq	%r15,%r14
 
 	mulxq	56(%rbp),%rax,%r15
-	movq	72+48+8(%rsp,%rcx,8),%rdx
+	movq	72+48+8(%rsp,%rcx,8),%rdx  // pull n0*ai
 	adcxq	%rax,%r14
 	adoxq	%rsi,%r15
-	movq	%rbx,(%rdi,%rcx,8)
+	movq	%rbx,(%rdi,%rcx,8)  // save result
 	movq	%r8,%rbx
-	adcxq	%rsi,%r15
+	adcxq	%rsi,%r15  // cf=0
 
-	incq	%rcx
+	incq	%rcx  // of=0
 	jnz	L$sqrx8x_tail
 
-	cmpq	0+8(%rsp),%rbp
-	jae	L$sqrx8x_tail_done
+	cmpq	0+8(%rsp),%rbp  // end of n?
+	jae	L$sqrx8x_tail_done  // break out of loop
 
-	subq	16+8(%rsp),%rsi
-	movq	48+8(%rsp),%rdx
+	subq	16+8(%rsp),%rsi  // mov 16(%rsp),%cf
+	movq	48+8(%rsp),%rdx  // pull n0*a0
 	leaq	64(%rbp),%rbp
 	adcq	0(%rdi),%r8
 	adcq	8(%rdi),%r9
@@ -3322,16 +3322,16 @@
 	adcq	56(%rdi),%r15
 	leaq	64(%rdi),%rdi
 	sbbq	%rax,%rax
-	subq	$8,%rcx
+	subq	$8,%rcx  // mov	$-8,%rcx
 
-	xorq	%rsi,%rsi
+	xorq	%rsi,%rsi  // of=0, cf=0
 	movq	%rax,16+8(%rsp)
 	jmp	L$sqrx8x_tail
 
 .p2align	5
 L$sqrx8x_tail_done:
 	xorq	%rax,%rax
-	addq	24+8(%rsp),%r8
+	addq	24+8(%rsp),%r8  // can this overflow?
 	adcq	$0,%r9
 	adcq	$0,%r10
 	adcq	$0,%r11
@@ -3341,26 +3341,26 @@
 	adcq	$0,%r15
 	adcq	$0,%rax
 
-	subq	16+8(%rsp),%rsi
-L$sqrx8x_no_tail:
+	subq	16+8(%rsp),%rsi  // mov 16(%rsp),%cf
+L$sqrx8x_no_tail:  // %cf is 0 if jumped here
 	adcq	0(%rdi),%r8
 	movq	%xmm3,%rcx
 	adcq	8(%rdi),%r9
 	movq	56(%rbp),%rsi
-	movq	%xmm2,%rbp
+	movq	%xmm2,%rbp  // restore %rbp
 	adcq	16(%rdi),%r10
 	adcq	24(%rdi),%r11
 	adcq	32(%rdi),%r12
 	adcq	40(%rdi),%r13
 	adcq	48(%rdi),%r14
 	adcq	56(%rdi),%r15
-	adcq	$0,%rax
+	adcq	$0,%rax  // top-most carry
 
-	movq	32+8(%rsp),%rbx
-	movq	64(%rdi,%rcx,1),%rdx
+	movq	32+8(%rsp),%rbx  // n0
+	movq	64(%rdi,%rcx,1),%rdx  // modulo-scheduled "%r8"
 
-	movq	%r8,0(%rdi)
-	leaq	64(%rdi),%r8
+	movq	%r8,0(%rdi)  // store top 512 bits
+	leaq	64(%rdi),%r8  // borrow %r8
 	movq	%r9,8(%rdi)
 	movq	%r10,16(%rdi)
 	movq	%r11,24(%rdi)
@@ -3369,8 +3369,8 @@
 	movq	%r14,48(%rdi)
 	movq	%r15,56(%rdi)
 
-	leaq	64(%rdi,%rcx,1),%rdi
-	cmpq	8+8(%rsp),%r8
+	leaq	64(%rdi,%rcx,1),%rdi  // start of current t window
+	cmpq	8+8(%rsp),%r8  // end of t?
 	jb	L$sqrx8x_reduction_loop
 	ret
 
@@ -3381,14 +3381,14 @@
 __bn_postx4x_internal:
 
 	movq	0(%rbp),%r12
-	movq	%rcx,%r10
-	movq	%rcx,%r9
+	movq	%rcx,%r10  // -%r9
+	movq	%rcx,%r9  // -%r9
 	negq	%rax
 	sarq	$3+2,%rcx
-
-	movq	%xmm1,%rdx
-	movq	%xmm1,%rsi
-	decq	%r12
+// lea	48+8(%rsp,%r9),%rdi
+	movq	%xmm1,%rdx  // restore %rdx
+	movq	%xmm1,%rsi  // prepare for back-to-back call
+	decq	%r12  // so that after 'not' we get -n0
 	movq	8(%rbp),%r13
 	xorq	%r8,%r8
 	movq	16(%rbp),%r14
@@ -3408,7 +3408,7 @@
 	andnq	%rax,%r14,%r14
 	andnq	%rax,%r15,%r15
 
-	negq	%r8
+	negq	%r8  // mov %r8,%cf
 	adcq	0(%rdi),%r12
 	adcq	8(%rdi),%r13
 	adcq	16(%rdi),%r14
@@ -3416,7 +3416,7 @@
 	movq	%r12,0(%rdx)
 	leaq	32(%rdi),%rdi
 	movq	%r13,8(%rdx)
-	sbbq	%r8,%r8
+	sbbq	%r8,%r8  // mov %cf,%r8
 	movq	%r14,16(%rdx)
 	movq	%r15,24(%rdx)
 	leaq	32(%rdx),%rdx
@@ -3424,7 +3424,7 @@
 	incq	%rcx
 	jnz	L$sqrx4x_sub
 
-	negq	%r9
+	negq	%r9  // restore %r9
 
 	ret
 
@@ -3440,13 +3440,13 @@
 	cmpl	$0,%esi
 	jz	L$scatter_epilogue
 
-
-
-
-
-
-
-
+// %rdx stores 32 entries, t0 through t31. Each entry has %esi words.
+// They are interleaved in memory as follows:
+// 
+// t00      t10      t20      ... t310
+// t01      t11      t21      ... t311
+// ...
+// t0%esi-1 t1%esi-1 t2%esi-1 ... t31%esi-1
 
 	leaq	(%rdx,%rcx,8),%rdx
 L$scatter:
@@ -3468,97 +3468,97 @@
 .alt_entry _bn_gather5
 _bn_gather5:
 
-L$SEH_begin_bn_gather5:
+L$SEH_begin_bn_gather5:  // Win64 thing, but harmless in other cases
 _CET_ENDBR
+// I can't trust assembler to use specific encoding:-(
+.byte	0x4c,0x8d,0x14,0x24  // lea    (%rsp),%r10
 
-.byte	0x4c,0x8d,0x14,0x24
-
-.byte	0x48,0x81,0xec,0x08,0x01,0x00,0x00
+.byte	0x48,0x81,0xec,0x08,0x01,0x00,0x00  // sub	$0x108,%rsp
 	leaq	L$inc(%rip),%rax
-	andq	$-16,%rsp
+	andq	$-16,%rsp  // shouldn't be formally required
 
 	movd	%ecx,%xmm5
-	movdqa	0(%rax),%xmm0
-	movdqa	16(%rax),%xmm1
-	leaq	128(%rdx),%r11
-	leaq	128(%rsp),%rax
+	movdqa	0(%rax),%xmm0  // 00000001000000010000000000000000
+	movdqa	16(%rax),%xmm1  // 00000002000000020000000200000002
+	leaq	128(%rdx),%r11  // size optimization
+	leaq	128(%rsp),%rax  // size optimization
 
-	pshufd	$0,%xmm5,%xmm5
+	pshufd	$0,%xmm5,%xmm5  // broadcast %ecx
 	movdqa	%xmm1,%xmm4
 	movdqa	%xmm1,%xmm2
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 	movdqa	%xmm4,%xmm3
 
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,-128(%rax)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,-112(%rax)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,-96(%rax)
 	movdqa	%xmm4,%xmm2
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 	movdqa	%xmm3,-80(%rax)
 	movdqa	%xmm4,%xmm3
 
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,-64(%rax)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,-48(%rax)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,-32(%rax)
 	movdqa	%xmm4,%xmm2
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 	movdqa	%xmm3,-16(%rax)
 	movdqa	%xmm4,%xmm3
 
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,0(%rax)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,16(%rax)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,32(%rax)
 	movdqa	%xmm4,%xmm2
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 	movdqa	%xmm3,48(%rax)
 	movdqa	%xmm4,%xmm3
 
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,64(%rax)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,80(%rax)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,96(%rax)
 	movdqa	%xmm4,%xmm2
 	movdqa	%xmm3,112(%rax)
@@ -3618,10 +3618,10 @@
 	por	%xmm3,%xmm5
 	por	%xmm5,%xmm4
 	leaq	256(%r11),%r11
-
-	pshufd	$0x4e,%xmm4,%xmm0
+// Combine the upper and lower halves of %xmm0.
+	pshufd	$0x4e,%xmm4,%xmm0  // Swap upper and lower halves.
 	por	%xmm4,%xmm0
-	movq	%xmm0,(%rdi)
+	movq	%xmm0,(%rdi)  // m0=bp0
 	leaq	8(%rdi),%rdi
 	subl	$1,%esi
 	jnz	L$gather

boringssl-0.20260708.tar.xz/gen/bcm/x86_64-mont5-linux.S -> boringssl-0.20260813.tar.xz/gen/bcm/x86_64-mont5-linux.S Changed

@@ -13,12 +13,12 @@
 bn_mul_mont_gather5_nohw:
 .cfi_startproc	
 _CET_ENDBR
-
-
+// num is declared as an int, a 32-bit parameter, so the upper half is
+// undefined. Zero the upper half to normalize it.
 	movl	%r9d,%r9d
 	movq	%rsp,%rax
 .cfi_def_cfa_register	%rax
-	movd	8(%rsp),%xmm5
+	movd	8(%rsp),%xmm5  // load 7th argument
 	pushq	%rbx
 .cfi_offset	%rbx,-16
 	pushq	%rbp
@@ -34,18 +34,18 @@
 
 	negq	%r9
 	movq	%rsp,%r11
-	leaq	-280(%rsp,%r9,8),%r10
-	negq	%r9
-	andq	$-1024,%r10
-
-
-
-
-
-
-
-
-
+	leaq	-280(%rsp,%r9,8),%r10  // future alloca(8*(num+2)+256+8)
+	negq	%r9  // restore %r9
+	andq	$-1024,%r10  // minimize TLB usage
+
+// An OS-agnostic version of __chkstk.
+// 
+// Some OSes (Windows) insist on stack being "wired" to
+// physical memory in strictly sequential manner, i.e. if stack
+// allocation spans two pages, then reference to farmost one can
+// be punishable by SEGV. But page walking can do good even on
+// other OSes, because it guarantees that villain thread hits
+// the guard page before it can make damage to innocent one...
 	subq	%r10,%r11
 	andq	$-4096,%r11
 	leaq	(%r10,%r11,1),%rsp
@@ -62,35 +62,35 @@
 .Lmul_page_walk_done:
 
 	leaq	.Linc(%rip),%r10
-	movq	%rax,8(%rsp,%r9,8)
+	movq	%rax,8(%rsp,%r9,8)  // tpnum+1=%rsp
 .cfi_escape	0x0f,0x0a,0x77,0x08,0x79,0x00,0x38,0x1e,0x22,0x06,0x23,0x08
 .Lmul_body:
 
-	leaq	128(%rdx),%r12
-	movdqa	0(%r10),%xmm0
-	movdqa	16(%r10),%xmm1
-	leaq	24-112(%rsp,%r9,8),%r10
+	leaq	128(%rdx),%r12  // reassign %rdx (+size optimization)
+	movdqa	0(%r10),%xmm0  // 00000001000000010000000000000000
+	movdqa	16(%r10),%xmm1  // 00000002000000020000000200000002
+	leaq	24-112(%rsp,%r9,8),%r10  // place the mask after tpnum+3 (+ICache optimization)
 	andq	$-16,%r10
 
-	pshufd	$0,%xmm5,%xmm5
+	pshufd	$0,%xmm5,%xmm5  // broadcast index
 	movdqa	%xmm1,%xmm4
 	movdqa	%xmm1,%xmm2
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 .byte	0x67
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,112(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,128(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,144(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -99,17 +99,17 @@
 	movdqa	%xmm3,160(%r10)
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,176(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,192(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,208(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -118,17 +118,17 @@
 	movdqa	%xmm3,224(%r10)
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,240(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,256(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,272(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -147,7 +147,7 @@
 
 	pcmpeqd	%xmm5,%xmm3
 	movdqa	%xmm2,336(%r10)
-	pand	64(%r12),%xmm0
+	pand	64(%r12),%xmm0  // while it's still in register
 
 	pand	80(%r12),%xmm1
 	pand	96(%r12),%xmm2
@@ -192,33 +192,33 @@
 	por	%xmm2,%xmm0
 	por	%xmm3,%xmm1
 	por	%xmm1,%xmm0
-
-	pshufd	$0x4e,%xmm0,%xmm1
+// Combine the upper and lower halves of %xmm0.
+	pshufd	$0x4e,%xmm0,%xmm1  // Swap upper and lower halves.
 	por	%xmm1,%xmm0
 	leaq	256(%r12),%r12
-	movq	%xmm0,%rbx
+	movq	%xmm0,%rbx  // m0=bp0
 
-	movq	(%r8),%r8
+	movq	(%r8),%r8  // pull n00 value
 	movq	(%rsi),%rax
 
-	xorq	%r14,%r14
-	xorq	%r15,%r15
+	xorq	%r14,%r14  // i=0
+	xorq	%r15,%r15  // j=0
 
 	movq	%r8,%rbp
-	mulq	%rbx
+	mulq	%rbx  // ap0*bp0
 	movq	%rax,%r10
 	movq	(%rcx),%rax
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // "tp0"*n0
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // discarded
 	movq	8(%rsi),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r13
 
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 	jmp	.L1st_enter
 
 .align	16
@@ -226,30 +226,30 @@
 	addq	%rax,%r13
 	movq	(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r11,%r13
+	addq	%r11,%r13  // npj*m1+apj*bp0
 	movq	%r10,%r11
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r15,8)
+	movq	%r13,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 .L1st_enter:
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	cmpq	%r9,%r15
-	jne	.L1st
-
+	jne	.L1st  // note that upon exit %r15==%r9, so
+// they can be used interchangeably
 
 	addq	%rax,%r13
 	adcq	$0,%rdx
-	addq	%r11,%r13
+	addq	%r11,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r9,8)
+	movq	%r13,-16(%rsp,%r9,8)  // tpnum-1
 	movq	%rdx,%r13
 	movq	%r10,%r11
 
@@ -257,13 +257,13 @@
 	addq	%r11,%r13
 	adcq	$0,%rdx
 	movq	%r13,-8(%rsp,%r9,8)
-	movq	%rdx,(%rsp,%r9,8)
+	movq	%rdx,(%rsp,%r9,8)  // store upmost overflow bit
 
-	leaq	1(%r14),%r14
+	leaq	1(%r14),%r14  // i++
 	jmp	.Louter
 .align	16
 .Louter:
-	leaq	24+128(%rsp,%r9,8),%rdx
+	leaq	24+128(%rsp,%r9,8),%rdx  // where 256-byte mask is (+size optimization)
 	andq	$-16,%rdx
 	pxor	%xmm4,%xmm4
 	pxor	%xmm5,%xmm5
@@ -316,34 +316,34 @@
 	por	%xmm2,%xmm4
 	por	%xmm3,%xmm5
 	por	%xmm5,%xmm4
-
-	pshufd	$0x4e,%xmm4,%xmm0
+// Combine the upper and lower halves of %xmm4 as %xmm0.
+	pshufd	$0x4e,%xmm4,%xmm0  // Swap upper and lower halves.
 	por	%xmm4,%xmm0
 	leaq	256(%r12),%r12
 
-	movq	(%rsi),%rax
-	movq	%xmm0,%rbx
+	movq	(%rsi),%rax  // ap0
+	movq	%xmm0,%rbx  // m0=bpi
 
-	xorq	%r15,%r15
+	xorq	%r15,%r15  // j=0
 	movq	%r8,%rbp
 	movq	(%rsp),%r10
 
-	mulq	%rbx
-	addq	%rax,%r10
+	mulq	%rbx  // ap0*bpi
+	addq	%rax,%r10  // ap0*bpi+tp0
 	movq	(%rcx),%rax
 	adcq	$0,%rdx
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // tp0*n0
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // discarded
 	movq	8(%rsi),%rax
 	adcq	$0,%rdx
-	movq	8(%rsp),%r10
+	movq	8(%rsp),%r10  // tp1
 	movq	%rdx,%r13
 
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 	jmp	.Linner_enter
 
 .align	16
@@ -351,78 +351,78 @@
 	addq	%rax,%r13
 	movq	(%rsi,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bpi+tpj
 	movq	(%rsp,%r15,8),%r10
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r15,8)
+	movq	%r13,-16(%rsp,%r15,8)  // tpj-1
 	movq	%rdx,%r13
 
 .Linner_enter:
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	(%rcx,%r15,8),%rax
 	adcq	$0,%rdx
-	addq	%r11,%r10
+	addq	%r11,%r10  // apj*bpi+tpj
 	movq	%rdx,%r11
 	adcq	$0,%r11
-	leaq	1(%r15),%r15
+	leaq	1(%r15),%r15  // j++
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	cmpq	%r9,%r15
-	jne	.Linner
-
+	jne	.Linner  // note that upon exit %r15==%r9, so
+// they can be used interchangeably
 	addq	%rax,%r13
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bpi+tpj
 	movq	(%rsp,%r9,8),%r10
 	adcq	$0,%rdx
-	movq	%r13,-16(%rsp,%r9,8)
+	movq	%r13,-16(%rsp,%r9,8)  // tpnum-1
 	movq	%rdx,%r13
 
 	xorq	%rdx,%rdx
 	addq	%r11,%r13
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // pull upmost overflow bit
 	adcq	$0,%rdx
 	movq	%r13,-8(%rsp,%r9,8)
-	movq	%rdx,(%rsp,%r9,8)
+	movq	%rdx,(%rsp,%r9,8)  // store upmost overflow bit
 
-	leaq	1(%r14),%r14
+	leaq	1(%r14),%r14  // i++
 	cmpq	%r9,%r14
 	jb	.Louter
 
-	xorq	%r14,%r14
-	movq	(%rsp),%rax
-	leaq	(%rsp),%rsi
-	movq	%r9,%r15
+	xorq	%r14,%r14  // i=0 and clear CF
+	movq	(%rsp),%rax  // tp0
+	leaq	(%rsp),%rsi  // borrow ap for tp
+	movq	%r9,%r15  // j=num
 	jmp	.Lsub
 .align	16
 .Lsub:	sbbq	(%rcx,%r14,8),%rax
-	movq	%rax,(%rdi,%r14,8)
-	movq	8(%rsi,%r14,8),%rax
-	leaq	1(%r14),%r14
-	decq	%r15
+	movq	%rax,(%rdi,%r14,8)  // rpi=tpi-npi
+	movq	8(%rsi,%r14,8),%rax  // tpi+1
+	leaq	1(%r14),%r14  // i++
+	decq	%r15  // doesn't affect CF
 	jnz	.Lsub
 
-	sbbq	$0,%rax
+	sbbq	$0,%rax  // handle upmost overflow bit
 	movq	$-1,%rbx
 	xorq	%rax,%rbx
 	xorq	%r14,%r14
-	movq	%r9,%r15
+	movq	%r9,%r15  // j=num
 
-.Lcopy:
+.Lcopy:  // conditional copy
 	movq	(%rdi,%r14,8),%rcx
 	movq	(%rsp,%r14,8),%rdx
 	andq	%rbx,%rcx
 	andq	%rax,%rdx
-	movq	%r14,(%rsp,%r14,8)
+	movq	%r14,(%rsp,%r14,8)  // zap temporary vector
 	orq	%rcx,%rdx
-	movq	%rdx,(%rdi,%r14,8)
+	movq	%rdx,(%rdi,%r14,8)  // rpi=tpi
 	leaq	1(%r14),%r14
 	subq	$1,%r15
 	jnz	.Lcopy
 
-	movq	8(%rsp,%r9,8),%rsi
+	movq	8(%rsp,%r9,8),%rsi  // restore %rsp
 .cfi_def_cfa	%rsi,8
 	movq	$1,%rax
 
@@ -469,36 +469,36 @@
 .Lmul4x_prologue:
 
 .byte	0x67
-
-
-
-	shll	$3,%r9d
-	leaq	(%r9,%r9,2),%r10
-	negq	%r9
-
-
-
-
-
-
-
-
-
-
+// num is declared as an int, a 32-bit parameter, so the upper half is
+// undefined. It is important that this write to %r9, which zeros the
+// upper half, predates the first access.
+	shll	$3,%r9d  // convert %r9 to bytes
+	leaq	(%r9,%r9,2),%r10  // 3*%r9 in bytes
+	negq	%r9  // -%r9
+
+// #############################################################
+// Ensure that stack frame doesn't alias with +3*%r9
+// modulo 4096, which covers retnum, amnum and nnum
+// (see bn_exp.c). This is done to allow memory disambiguation
+// logic do its magic. Extra num is allocated in order
+// to align with bn_power5's frame, which is cleansed after
+// completing exponentiation. Extra 256 bytes is for power mask
+// calculated from 7th argument, the index.
+// 
 	leaq	-320(%rsp,%r9,2),%r11
 	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	.Lmul4xsp_alt
-	subq	%r11,%rbp
-	leaq	-320(%rbp,%r9,2),%rbp
+	subq	%r11,%rbp  // align with %rdi
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*num*8+256)
 	jmp	.Lmul4xsp_done
 
 .align	32
 .Lmul4xsp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rbp,%r9,2),%rbp
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*num*8+256)
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
@@ -529,7 +529,7 @@
 
 	call	mul4x_internal
 
-	movq	40(%rsp),%rsi
+	movq	40(%rsp),%rsi  // restore %rsp
 .cfi_def_cfa	%rsi,8
 	movq	$1,%rax
 
@@ -556,36 +556,36 @@
 .align	32
 mul4x_internal:
 .cfi_startproc	
-	shlq	$5,%r9
-	movd	8(%rax),%xmm5
+	shlq	$5,%r9  // %r9 was in bytes
+	movd	8(%rax),%xmm5  // load 7th argument, index
 	leaq	.Linc(%rip),%rax
-	leaq	128(%rdx,%r9,1),%r13
-	shrq	$5,%r9
-	movdqa	0(%rax),%xmm0
-	movdqa	16(%rax),%xmm1
-	leaq	88-112(%rsp,%r9,1),%r10
-	leaq	128(%rdx),%r12
-
-	pshufd	$0,%xmm5,%xmm5
+	leaq	128(%rdx,%r9,1),%r13  // end of powers table (+size optimization)
+	shrq	$5,%r9  // restore %r9
+	movdqa	0(%rax),%xmm0  // 00000001000000010000000000000000
+	movdqa	16(%rax),%xmm1  // 00000002000000020000000200000002
+	leaq	88-112(%rsp,%r9,1),%r10  // place the mask after tpnum+1 (+ICache optimization)
+	leaq	128(%rdx),%r12  // size optimization
+
+	pshufd	$0,%xmm5,%xmm5  // broadcast index
 	movdqa	%xmm1,%xmm4
 .byte	0x67,0x67
 	movdqa	%xmm1,%xmm2
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 .byte	0x67
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,112(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,128(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,144(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -594,17 +594,17 @@
 	movdqa	%xmm3,160(%r10)
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,176(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,192(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,208(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -613,17 +613,17 @@
 	movdqa	%xmm3,224(%r10)
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,240(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,256(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,272(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -642,7 +642,7 @@
 
 	pcmpeqd	%xmm5,%xmm3
 	movdqa	%xmm2,336(%r10)
-	pand	64(%r12),%xmm0
+	pand	64(%r12),%xmm0  // while it's still in register
 
 	pand	80(%r12),%xmm1
 	pand	96(%r12),%xmm2
@@ -687,31 +687,31 @@
 	por	%xmm2,%xmm0
 	por	%xmm3,%xmm1
 	por	%xmm1,%xmm0
-
-	pshufd	$0x4e,%xmm0,%xmm1
+// Combine the upper and lower halves of %xmm0.
+	pshufd	$0x4e,%xmm0,%xmm1  // Swap upper and lower halves.
 	por	%xmm1,%xmm0
 	leaq	256(%r12),%r12
-	movq	%xmm0,%rbx
+	movq	%xmm0,%rbx  // m0=bp0
 
-	movq	%r13,16+8(%rsp)
-	movq	%rdi,56+8(%rsp)
+	movq	%r13,16+8(%rsp)  // save end of bnum
+	movq	%rdi,56+8(%rsp)  // save %rdi
 
-	movq	(%r8),%r8
+	movq	(%r8),%r8  // pull n00 value
 	movq	(%rsi),%rax
-	leaq	(%rsi,%r9,1),%rsi
+	leaq	(%rsi,%r9,1),%rsi  // end of anum
 	negq	%r9
 
 	movq	%r8,%rbp
-	mulq	%rbx
+	mulq	%rbx  // ap0*bp0
 	movq	%rax,%r10
 	movq	(%rcx),%rax
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // "tp0"*n0
 	leaq	64+8(%rsp),%r14
 	movq	%rdx,%r11
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // discarded
 	movq	8(%rsi,%r9,1),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rdi
@@ -727,7 +727,7 @@
 	movq	16(%rsi,%r9,1),%rax
 	adcq	$0,%rdx
 	addq	%r11,%rdi
-	leaq	32(%r9),%r15
+	leaq	32(%r9),%r15  // j=4
 	leaq	32(%rcx),%rcx
 	adcq	$0,%rdx
 	movq	%rdi,(%r14)
@@ -736,103 +736,103 @@
 
 .align	32
 .L1st4x:
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r10
 	movq	-16(%rcx),%rax
 	leaq	32(%r14),%r14
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-24(%r14)
+	movq	%r13,-24(%r14)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	-8(%rcx),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
-	addq	%r11,%rdi
+	addq	%r11,%rdi  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%rdi,-16(%r14)
+	movq	%rdi,-16(%r14)  // tpj-1
 	movq	%rdx,%r13
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r10
 	movq	0(%rcx),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	8(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-8(%r14)
+	movq	%r13,-8(%r14)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	8(%rcx),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	16(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
-	addq	%r11,%rdi
+	addq	%r11,%rdi  // npj*m1+apj*bp0
 	leaq	32(%rcx),%rcx
 	adcq	$0,%rdx
-	movq	%rdi,(%r14)
+	movq	%rdi,(%r14)  // tpj-1
 	movq	%rdx,%r13
 
-	addq	$32,%r15
+	addq	$32,%r15  // j+=4
 	jnz	.L1st4x
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r10
 	movq	-16(%rcx),%rax
 	leaq	32(%r14),%r14
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi),%rax
 	adcq	$0,%rdx
-	addq	%r10,%r13
+	addq	%r10,%r13  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%r13,-24(%r14)
+	movq	%r13,-24(%r14)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bp0
 	addq	%rax,%r11
 	movq	-8(%rcx),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
-	movq	(%rsi,%r9,1),%rax
+	movq	(%rsi,%r9,1),%rax  // ap0
 	adcq	$0,%rdx
-	addq	%r11,%rdi
+	addq	%r11,%rdi  // npj*m1+apj*bp0
 	adcq	$0,%rdx
-	movq	%rdi,-16(%r14)
+	movq	%rdi,-16(%r14)  // tpj-1
 	movq	%rdx,%r13
 
-	leaq	(%rcx,%r9,1),%rcx
+	leaq	(%rcx,%r9,1),%rcx  // rewind %rcx
 
 	xorq	%rdi,%rdi
 	addq	%r10,%r13
@@ -843,7 +843,7 @@
 
 .align	32
 .Louter4x:
-	leaq	16+128(%r14),%rdx
+	leaq	16+128(%r14),%rdx  // where 256-byte mask is (+size optimization)
 	pxor	%xmm4,%xmm4
 	pxor	%xmm5,%xmm5
 	movdqa	-128(%r12),%xmm0
@@ -895,45 +895,45 @@
 	por	%xmm2,%xmm4
 	por	%xmm3,%xmm5
 	por	%xmm5,%xmm4
-
-	pshufd	$0x4e,%xmm4,%xmm0
+// Combine the upper and lower halves of %xmm4 as %xmm0.
+	pshufd	$0x4e,%xmm4,%xmm0  // Swap upper and lower halves.
 	por	%xmm4,%xmm0
 	leaq	256(%r12),%r12
-	movq	%xmm0,%rbx
+	movq	%xmm0,%rbx  // m0=bpi
 
 	movq	(%r14,%r9,1),%r10
 	movq	%r8,%rbp
-	mulq	%rbx
-	addq	%rax,%r10
+	mulq	%rbx  // ap0*bpi
+	addq	%rax,%r10  // ap0*bpi+tp0
 	movq	(%rcx),%rax
 	adcq	$0,%rdx
 
-	imulq	%r10,%rbp
+	imulq	%r10,%rbp  // tp0*n0
 	movq	%rdx,%r11
-	movq	%rdi,(%r14)
+	movq	%rdi,(%r14)  // store upmost overflow bit
 
-	leaq	(%r14,%r9,1),%r14
+	leaq	(%r14,%r9,1),%r14  // rewind %r14
 
-	mulq	%rbp
-	addq	%rax,%r10
+	mulq	%rbp  // np0*m1
+	addq	%rax,%r10  // "%r13", discarded
 	movq	8(%rsi,%r9,1),%rax
 	adcq	$0,%rdx
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	8(%rcx),%rax
 	adcq	$0,%rdx
-	addq	8(%r14),%r11
+	addq	8(%r14),%r11  // +tp1
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	16(%rsi,%r9,1),%rax
 	adcq	$0,%rdx
-	addq	%r11,%rdi
-	leaq	32(%r9),%r15
+	addq	%r11,%rdi  // npj*m1+apj*bpi+tpj
+	leaq	32(%r9),%r15  // j=4
 	leaq	32(%rcx),%rcx
 	adcq	$0,%rdx
 	movq	%rdx,%r13
@@ -941,25 +941,25 @@
 
 .align	32
 .Linner4x:
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r10
 	movq	-16(%rcx),%rax
 	adcq	$0,%rdx
-	addq	16(%r14),%r10
+	addq	16(%r14),%r10  // apj*bpi+tpj
 	leaq	32(%r14),%r14
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r13
 	adcq	$0,%rdx
-	movq	%rdi,-32(%r14)
+	movq	%rdi,-32(%r14)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	-8(%rcx),%rax
 	adcq	$0,%rdx
@@ -967,33 +967,33 @@
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
 	addq	%r11,%rdi
 	adcq	$0,%rdx
-	movq	%r13,-24(%r14)
+	movq	%r13,-24(%r14)  // tpj-1
 	movq	%rdx,%r13
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r10
 	movq	0(%rcx),%rax
 	adcq	$0,%rdx
-	addq	(%r14),%r10
+	addq	(%r14),%r10  // apj*bpi+tpj
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	8(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r13
 	adcq	$0,%rdx
-	movq	%rdi,-16(%r14)
+	movq	%rdi,-16(%r14)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	8(%rcx),%rax
 	adcq	$0,%rdx
@@ -1001,38 +1001,38 @@
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
 	movq	16(%rsi,%r15,1),%rax
 	adcq	$0,%rdx
 	addq	%r11,%rdi
 	leaq	32(%rcx),%rcx
 	adcq	$0,%rdx
-	movq	%r13,-8(%r14)
+	movq	%r13,-8(%r14)  // tpj-1
 	movq	%rdx,%r13
 
-	addq	$32,%r15
+	addq	$32,%r15  // j+=4
 	jnz	.Linner4x
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r10
 	movq	-16(%rcx),%rax
 	adcq	$0,%rdx
-	addq	16(%r14),%r10
+	addq	16(%r14),%r10  // apj*bpi+tpj
 	leaq	32(%r14),%r14
 	adcq	$0,%rdx
 	movq	%rdx,%r11
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%r13
 	movq	-8(%rsi),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r13
 	adcq	$0,%rdx
-	movq	%rdi,-32(%r14)
+	movq	%rdi,-32(%r14)  // tpj-1
 	movq	%rdx,%rdi
 
-	mulq	%rbx
+	mulq	%rbx  // apj*bpi
 	addq	%rax,%r11
 	movq	%rbp,%rax
 	movq	-8(%rcx),%rbp
@@ -1041,39 +1041,39 @@
 	adcq	$0,%rdx
 	movq	%rdx,%r10
 
-	mulq	%rbp
+	mulq	%rbp  // npj*m1
 	addq	%rax,%rdi
-	movq	(%rsi,%r9,1),%rax
+	movq	(%rsi,%r9,1),%rax  // ap0
 	adcq	$0,%rdx
 	addq	%r11,%rdi
 	adcq	$0,%rdx
-	movq	%r13,-24(%r14)
+	movq	%r13,-24(%r14)  // tpj-1
 	movq	%rdx,%r13
 
-	movq	%rdi,-16(%r14)
-	leaq	(%rcx,%r9,1),%rcx
+	movq	%rdi,-16(%r14)  // tpj-1
+	leaq	(%rcx,%r9,1),%rcx  // rewind %rcx
 
 	xorq	%rdi,%rdi
 	addq	%r10,%r13
 	adcq	$0,%rdi
-	addq	(%r14),%r13
-	adcq	$0,%rdi
+	addq	(%r14),%r13  // pull upmost overflow bit
+	adcq	$0,%rdi  // upmost overflow bit
 	movq	%r13,-8(%r14)
 
 	cmpq	16+8(%rsp),%r12
 	jb	.Louter4x
 	xorq	%rax,%rax
-	subq	%r13,%rbp
-	adcq	%r15,%r15
+	subq	%r13,%rbp  // compare top-most words
+	adcq	%r15,%r15  // %r15 is zero
 	orq	%r15,%rdi
-	subq	%rdi,%rax
-	leaq	(%r14,%r9,1),%rbx
+	subq	%rdi,%rax  // %rax=-%rdi
+	leaq	(%r14,%r9,1),%rbx  // tptr in .sqr4x_sub
 	movq	(%rcx),%r12
-	leaq	(%rcx),%rbp
+	leaq	(%rcx),%rbp  // nptr in .sqr4x_sub
 	movq	%r9,%rcx
 	sarq	$3+2,%rcx
-	movq	56+8(%rsp),%rdi
-	decq	%r12
+	movq	56+8(%rsp),%rdi  // rptr in .sqr4x_sub
+	decq	%r12  // so that after 'not' we get -n0
 	xorq	%r10,%r10
 	movq	8(%rbp),%r13
 	movq	16(%rbp),%r14
@@ -1104,35 +1104,35 @@
 .cfi_offset	%r15,-56
 .Lpower5_prologue:
 
-
-
-
-	shll	$3,%r9d
-	leal	(%r9,%r9,2),%r10d
+// num is declared as an int, a 32-bit parameter, so the upper half is
+// undefined. It is important that this write to %r9, which zeros the
+// upper half, come before the first access.
+	shll	$3,%r9d  // convert %r9 to bytes
+	leal	(%r9,%r9,2),%r10d  // 3*%r9
 	negq	%r9
-	movq	(%r8),%r8
-
-
-
-
-
-
-
-
+	movq	(%r8),%r8  // *n0
+
+// #############################################################
+// Ensure that stack frame doesn't alias with %rdi+3*%r9
+// modulo 4096, which covers retnum, amnum and nnum
+// (see bn_exp.c). This is done to allow memory disambiguation
+// logic do its magic. Extra 256 bytes is for power mask
+// calculated from 7th argument, the index.
+// 
 	leaq	-320(%rsp,%r9,2),%r11
 	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	.Lpwr_sp_alt
-	subq	%r11,%rbp
-	leaq	-320(%rbp,%r9,2),%rbp
+	subq	%r11,%rbp  // align with %rsi
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*num*8+256)
 	jmp	.Lpwr_sp_done
 
 .align	32
 .Lpwr_sp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rbp,%r9,2),%rbp
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*num*8+256)
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
@@ -1158,22 +1158,22 @@
 	movq	%r9,%r10
 	negq	%r9
 
-
-
-
-
-
-
-
-
-
+// #############################################################
+// Stack layout
+// 
+// +0	saved %r9, used in reduction section
+// +8	&t2*%r9, used in reduction section
+// +32	saved *n0
+// +40	saved %rsp
+// +48	t2*%r9
+// 
 	movq	%r8,32(%rsp)
-	movq	%rax,40(%rsp)
+	movq	%rax,40(%rsp)  // save original %rsp
 .cfi_escape	0x0f,0x05,0x77,0x28,0x06,0x23,0x08
 .Lpower5_body:
-	movq	%rdi,%xmm1
-	movq	%rcx,%xmm2
-	movq	%r10,%xmm3
+	movq	%rdi,%xmm1  // save %rdi, used in sqr8x
+	movq	%rcx,%xmm2  // save %rcx
+	movq	%r10,%xmm3  // -%r9, used in sqr8x
 	movq	%rdx,%xmm4
 
 	call	__bn_sqr8x_internal
@@ -1195,7 +1195,7 @@
 
 	call	mul4x_internal
 
-	movq	40(%rsp),%rsi
+	movq	40(%rsp),%rsi  // restore %rsp
 .cfi_def_cfa	%rsi,8
 	movq	$1,%rax
 	movq	-48(%rsi),%r15
@@ -1226,261 +1226,261 @@
 __bn_sqr8x_internal:
 .cfi_startproc	
 _CET_ENDBR
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-	leaq	32(%r10),%rbp
-	leaq	(%rsi,%r9,1),%rsi
-
-	movq	%r9,%rcx
-
-
-	movq	-32(%rsi,%rbp,1),%r14
-	leaq	48+8(%rsp,%r9,2),%rdi
-	movq	-24(%rsi,%rbp,1),%rax
-	leaq	-32(%rdi,%rbp,1),%rdi
-	movq	-16(%rsi,%rbp,1),%rbx
+// #############################################################
+// Squaring part:
+// 
+// a) multiply-n-add everything but ai*ai;
+// b) shift result of a) by 1 to the left and accumulate
+// ai*ai products;
+// 
+// #############################################################
+// a1a0
+// a2a0
+// a3a0
+// a2a1
+// a4a0
+// a3a1
+// a5a0
+// a4a1
+// a3a2
+// a6a0
+// a5a1
+// a4a2
+// a7a0
+// a6a1
+// a5a2
+// a4a3
+// a7a1
+// a6a2
+// a5a3
+// a7a2
+// a6a3
+// a5a4
+// a7a3
+// a6a4
+// a7a4
+// a6a5
+// a7a5
+// a7a6
+// a1a0
+// a2a0
+// a3a0
+// a4a0
+// a5a0
+// a6a0
+// a7a0
+// a2a1
+// a3a1
+// a4a1
+// a5a1
+// a6a1
+// a7a1
+// a3a2
+// a4a2
+// a5a2
+// a6a2
+// a7a2
+// a4a3
+// a5a3
+// a6a3
+// a7a3
+// a5a4
+// a6a4
+// a7a4
+// a6a5
+// a7a5
+// a7a6
+// a0a0
+// a1a1
+// a2a2
+// a3a3
+// a4a4
+// a5a5
+// a6a6
+// a7a7
+
+	leaq	32(%r10),%rbp  // %rbp=-(%r9-32)
+	leaq	(%rsi,%r9,1),%rsi  // end of a buffer, (%rsi,%rbp)=&ap2
+
+	movq	%r9,%rcx  // %rcx=%r9
+
+// comments apply to %r9==8 case
+	movq	-32(%rsi,%rbp,1),%r14  // a0
+	leaq	48+8(%rsp,%r9,2),%rdi  // end of tp buffer, &tp2*%r9
+	movq	-24(%rsi,%rbp,1),%rax  // a1
+	leaq	-32(%rdi,%rbp,1),%rdi  // end of tp window, &tp2*%r9-"%rbp"
+	movq	-16(%rsi,%rbp,1),%rbx  // a2
 	movq	%rax,%r15
 
-	mulq	%r14
-	movq	%rax,%r10
-	movq	%rbx,%rax
+	mulq	%r14  // a1*a0
+	movq	%rax,%r10  // a1*a0
+	movq	%rbx,%rax  // a2
 	movq	%rdx,%r11
-	movq	%r10,-24(%rdi,%rbp,1)
+	movq	%r10,-24(%rdi,%rbp,1)  // t1
 
-	mulq	%r14
+	mulq	%r14  // a2*a0
 	addq	%rax,%r11
 	movq	%rbx,%rax
 	adcq	$0,%rdx
-	movq	%r11,-16(%rdi,%rbp,1)
+	movq	%r11,-16(%rdi,%rbp,1)  // t2
 	movq	%rdx,%r10
 
 
-	movq	-8(%rsi,%rbp,1),%rbx
-	mulq	%r15
-	movq	%rax,%r12
+	movq	-8(%rsi,%rbp,1),%rbx  // a3
+	mulq	%r15  // a2*a1
+	movq	%rax,%r12  // a2*a1+t3
 	movq	%rbx,%rax
 	movq	%rdx,%r13
 
 	leaq	(%rbp),%rcx
-	mulq	%r14
-	addq	%rax,%r10
+	mulq	%r14  // a3*a0
+	addq	%rax,%r10  // a3*a0+a2*a1+t3
 	movq	%rbx,%rax
 	movq	%rdx,%r11
 	adcq	$0,%r11
 	addq	%r12,%r10
 	adcq	$0,%r11
-	movq	%r10,-8(%rdi,%rcx,1)
+	movq	%r10,-8(%rdi,%rcx,1)  // t3
 	jmp	.Lsqr4x_1st
 
 .align	32
 .Lsqr4x_1st:
-	movq	(%rsi,%rcx,1),%rbx
-	mulq	%r15
-	addq	%rax,%r13
+	movq	(%rsi,%rcx,1),%rbx  // a4
+	mulq	%r15  // a3*a1
+	addq	%rax,%r13  // a3*a1+t4
 	movq	%rbx,%rax
 	movq	%rdx,%r12
 	adcq	$0,%r12
 
-	mulq	%r14
-	addq	%rax,%r11
-	movq	%rbx,%rax
-	movq	8(%rsi,%rcx,1),%rbx
+	mulq	%r14  // a4*a0
+	addq	%rax,%r11  // a4*a0+a3*a1+t4
+	movq	%rbx,%rax  // a3
+	movq	8(%rsi,%rcx,1),%rbx  // a5
 	movq	%rdx,%r10
 	adcq	$0,%r10
 	addq	%r13,%r11
 	adcq	$0,%r10
 
 
-	mulq	%r15
-	addq	%rax,%r12
+	mulq	%r15  // a4*a3
+	addq	%rax,%r12  // a4*a3+t5
 	movq	%rbx,%rax
-	movq	%r11,(%rdi,%rcx,1)
+	movq	%r11,(%rdi,%rcx,1)  // t4
 	movq	%rdx,%r13
 	adcq	$0,%r13
 
-	mulq	%r14
-	addq	%rax,%r10
+	mulq	%r14  // a5*a2
+	addq	%rax,%r10  // a5*a2+a4*a3+t5
 	movq	%rbx,%rax
-	movq	16(%rsi,%rcx,1),%rbx
+	movq	16(%rsi,%rcx,1),%rbx  // a6
 	movq	%rdx,%r11
 	adcq	$0,%r11
 	addq	%r12,%r10
 	adcq	$0,%r11
 
-	mulq	%r15
-	addq	%rax,%r13
+	mulq	%r15  // a5*a3
+	addq	%rax,%r13  // a5*a3+t6
 	movq	%rbx,%rax
-	movq	%r10,8(%rdi,%rcx,1)
+	movq	%r10,8(%rdi,%rcx,1)  // t5
 	movq	%rdx,%r12
 	adcq	$0,%r12
 
-	mulq	%r14
-	addq	%rax,%r11
-	movq	%rbx,%rax
-	movq	24(%rsi,%rcx,1),%rbx
+	mulq	%r14  // a6*a2
+	addq	%rax,%r11  // a6*a2+a5*a3+t6
+	movq	%rbx,%rax  // a3
+	movq	24(%rsi,%rcx,1),%rbx  // a7
 	movq	%rdx,%r10
 	adcq	$0,%r10
 	addq	%r13,%r11
 	adcq	$0,%r10
 
 
-	mulq	%r15
-	addq	%rax,%r12
+	mulq	%r15  // a6*a5
+	addq	%rax,%r12  // a6*a5+t7
 	movq	%rbx,%rax
-	movq	%r11,16(%rdi,%rcx,1)
+	movq	%r11,16(%rdi,%rcx,1)  // t6
 	movq	%rdx,%r13
 	adcq	$0,%r13
 	leaq	32(%rcx),%rcx
 
-	mulq	%r14
-	addq	%rax,%r10
+	mulq	%r14  // a7*a4
+	addq	%rax,%r10  // a7*a4+a6*a5+t6
 	movq	%rbx,%rax
 	movq	%rdx,%r11
 	adcq	$0,%r11
 	addq	%r12,%r10
 	adcq	$0,%r11
-	movq	%r10,-8(%rdi,%rcx,1)
+	movq	%r10,-8(%rdi,%rcx,1)  // t7
 
 	cmpq	$0,%rcx
 	jne	.Lsqr4x_1st
 
-	mulq	%r15
+	mulq	%r15  // a7*a5
 	addq	%rax,%r13
 	leaq	16(%rbp),%rbp
 	adcq	$0,%rdx
 	addq	%r11,%r13
 	adcq	$0,%rdx
 
-	movq	%r13,(%rdi)
+	movq	%r13,(%rdi)  // t8
 	movq	%rdx,%r12
-	movq	%rdx,8(%rdi)
+	movq	%rdx,8(%rdi)  // t9
 	jmp	.Lsqr4x_outer
 
 .align	32
-.Lsqr4x_outer:
-	movq	-32(%rsi,%rbp,1),%r14
-	leaq	48+8(%rsp,%r9,2),%rdi
-	movq	-24(%rsi,%rbp,1),%rax
-	leaq	-32(%rdi,%rbp,1),%rdi
-	movq	-16(%rsi,%rbp,1),%rbx
+.Lsqr4x_outer:  // comments apply to %r9==6 case
+	movq	-32(%rsi,%rbp,1),%r14  // a0
+	leaq	48+8(%rsp,%r9,2),%rdi  // end of tp buffer, &tp2*%r9
+	movq	-24(%rsi,%rbp,1),%rax  // a1
+	leaq	-32(%rdi,%rbp,1),%rdi  // end of tp window, &tp2*%r9-"%rbp"
+	movq	-16(%rsi,%rbp,1),%rbx  // a2
 	movq	%rax,%r15
 
-	mulq	%r14
-	movq	-24(%rdi,%rbp,1),%r10
-	addq	%rax,%r10
-	movq	%rbx,%rax
+	mulq	%r14  // a1*a0
+	movq	-24(%rdi,%rbp,1),%r10  // t1
+	addq	%rax,%r10  // a1*a0+t1
+	movq	%rbx,%rax  // a2
 	adcq	$0,%rdx
-	movq	%r10,-24(%rdi,%rbp,1)
+	movq	%r10,-24(%rdi,%rbp,1)  // t1
 	movq	%rdx,%r11
 
-	mulq	%r14
+	mulq	%r14  // a2*a0
 	addq	%rax,%r11
 	movq	%rbx,%rax
 	adcq	$0,%rdx
-	addq	-16(%rdi,%rbp,1),%r11
+	addq	-16(%rdi,%rbp,1),%r11  // a2*a0+t2
 	movq	%rdx,%r10
 	adcq	$0,%r10
-	movq	%r11,-16(%rdi,%rbp,1)
+	movq	%r11,-16(%rdi,%rbp,1)  // t2
 
 	xorq	%r12,%r12
 
-	movq	-8(%rsi,%rbp,1),%rbx
-	mulq	%r15
-	addq	%rax,%r12
+	movq	-8(%rsi,%rbp,1),%rbx  // a3
+	mulq	%r15  // a2*a1
+	addq	%rax,%r12  // a2*a1+t3
 	movq	%rbx,%rax
 	adcq	$0,%rdx
 	addq	-8(%rdi,%rbp,1),%r12
 	movq	%rdx,%r13
 	adcq	$0,%r13
 
-	mulq	%r14
-	addq	%rax,%r10
+	mulq	%r14  // a3*a0
+	addq	%rax,%r10  // a3*a0+a2*a1+t3
 	movq	%rbx,%rax
 	adcq	$0,%rdx
 	addq	%r12,%r10
 	movq	%rdx,%r11
 	adcq	$0,%r11
-	movq	%r10,-8(%rdi,%rbp,1)
+	movq	%r10,-8(%rdi,%rbp,1)  // t3
 
 	leaq	(%rbp),%rcx
 	jmp	.Lsqr4x_inner
 
 .align	32
 .Lsqr4x_inner:
-	movq	(%rsi,%rcx,1),%rbx
-	mulq	%r15
-	addq	%rax,%r13
+	movq	(%rsi,%rcx,1),%rbx  // a4
+	mulq	%r15  // a3*a1
+	addq	%rax,%r13  // a3*a1+t4
 	movq	%rbx,%rax
 	movq	%rdx,%r12
 	adcq	$0,%r12
@@ -1488,254 +1488,254 @@
 	adcq	$0,%r12
 
 .byte	0x67
-	mulq	%r14
-	addq	%rax,%r11
-	movq	%rbx,%rax
-	movq	8(%rsi,%rcx,1),%rbx
+	mulq	%r14  // a4*a0
+	addq	%rax,%r11  // a4*a0+a3*a1+t4
+	movq	%rbx,%rax  // a3
+	movq	8(%rsi,%rcx,1),%rbx  // a5
 	movq	%rdx,%r10
 	adcq	$0,%r10
 	addq	%r13,%r11
 	adcq	$0,%r10
 
-	mulq	%r15
-	addq	%rax,%r12
-	movq	%r11,(%rdi,%rcx,1)
+	mulq	%r15  // a4*a3
+	addq	%rax,%r12  // a4*a3+t5
+	movq	%r11,(%rdi,%rcx,1)  // t4
 	movq	%rbx,%rax
 	movq	%rdx,%r13
 	adcq	$0,%r13
 	addq	8(%rdi,%rcx,1),%r12
-	leaq	16(%rcx),%rcx
+	leaq	16(%rcx),%rcx  // j++
 	adcq	$0,%r13
 
-	mulq	%r14
-	addq	%rax,%r10
+	mulq	%r14  // a5*a2
+	addq	%rax,%r10  // a5*a2+a4*a3+t5
 	movq	%rbx,%rax
 	adcq	$0,%rdx
 	addq	%r12,%r10
 	movq	%rdx,%r11
 	adcq	$0,%r11
-	movq	%r10,-8(%rdi,%rcx,1)
+	movq	%r10,-8(%rdi,%rcx,1)  // t5, "preloaded t1" below
 
 	cmpq	$0,%rcx
 	jne	.Lsqr4x_inner
 
 .byte	0x67
-	mulq	%r15
+	mulq	%r15  // a5*a3
 	addq	%rax,%r13
 	adcq	$0,%rdx
 	addq	%r11,%r13
 	adcq	$0,%rdx
 
-	movq	%r13,(%rdi)
+	movq	%r13,(%rdi)  // t6, "preloaded t2" below
 	movq	%rdx,%r12
-	movq	%rdx,8(%rdi)
+	movq	%rdx,8(%rdi)  // t7, "preloaded t3" below
 
 	addq	$16,%rbp
 	jnz	.Lsqr4x_outer
 
-
-	movq	-32(%rsi),%r14
-	leaq	48+8(%rsp,%r9,2),%rdi
-	movq	-24(%rsi),%rax
-	leaq	-32(%rdi,%rbp,1),%rdi
-	movq	-16(%rsi),%rbx
+// comments apply to %r9==4 case
+	movq	-32(%rsi),%r14  // a0
+	leaq	48+8(%rsp,%r9,2),%rdi  // end of tp buffer, &tp2*%r9
+	movq	-24(%rsi),%rax  // a1
+	leaq	-32(%rdi,%rbp,1),%rdi  // end of tp window, &tp2*%r9-"%rbp"
+	movq	-16(%rsi),%rbx  // a2
 	movq	%rax,%r15
 
-	mulq	%r14
-	addq	%rax,%r10
-	movq	%rbx,%rax
+	mulq	%r14  // a1*a0
+	addq	%rax,%r10  // a1*a0+t1, preloaded t1
+	movq	%rbx,%rax  // a2
 	movq	%rdx,%r11
 	adcq	$0,%r11
 
-	mulq	%r14
+	mulq	%r14  // a2*a0
 	addq	%rax,%r11
 	movq	%rbx,%rax
-	movq	%r10,-24(%rdi)
+	movq	%r10,-24(%rdi)  // t1
 	movq	%rdx,%r10
 	adcq	$0,%r10
-	addq	%r13,%r11
-	movq	-8(%rsi),%rbx
+	addq	%r13,%r11  // a2*a0+t2, preloaded t2
+	movq	-8(%rsi),%rbx  // a3
 	adcq	$0,%r10
 
-	mulq	%r15
-	addq	%rax,%r12
+	mulq	%r15  // a2*a1
+	addq	%rax,%r12  // a2*a1+t3, preloaded t3
 	movq	%rbx,%rax
-	movq	%r11,-16(%rdi)
+	movq	%r11,-16(%rdi)  // t2
 	movq	%rdx,%r13
 	adcq	$0,%r13
 
-	mulq	%r14
-	addq	%rax,%r10
+	mulq	%r14  // a3*a0
+	addq	%rax,%r10  // a3*a0+a2*a1+t3
 	movq	%rbx,%rax
 	movq	%rdx,%r11
 	adcq	$0,%r11
 	addq	%r12,%r10
 	adcq	$0,%r11
-	movq	%r10,-8(%rdi)
+	movq	%r10,-8(%rdi)  // t3
 
-	mulq	%r15
+	mulq	%r15  // a3*a1
 	addq	%rax,%r13
-	movq	-16(%rsi),%rax
+	movq	-16(%rsi),%rax  // a2
 	adcq	$0,%rdx
 	addq	%r11,%r13
 	adcq	$0,%rdx
 
-	movq	%r13,(%rdi)
+	movq	%r13,(%rdi)  // t4
 	movq	%rdx,%r12
-	movq	%rdx,8(%rdi)
+	movq	%rdx,8(%rdi)  // t5
 
-	mulq	%rbx
+	mulq	%rbx  // a2*a3
 	addq	$16,%rbp
 	xorq	%r14,%r14
-	subq	%r9,%rbp
+	subq	%r9,%rbp  // %rbp=16-%r9
 	xorq	%r15,%r15
 
-	addq	%r12,%rax
+	addq	%r12,%rax  // t5
 	adcq	$0,%rdx
-	movq	%rax,8(%rdi)
-	movq	%rdx,16(%rdi)
-	movq	%r15,24(%rdi)
+	movq	%rax,8(%rdi)  // t5
+	movq	%rdx,16(%rdi)  // t6
+	movq	%r15,24(%rdi)  // t7
 
-	movq	-16(%rsi,%rbp,1),%rax
+	movq	-16(%rsi,%rbp,1),%rax  // a0
 	leaq	48+8(%rsp),%rdi
-	xorq	%r10,%r10
-	movq	8(%rdi),%r11
+	xorq	%r10,%r10  // t0
+	movq	8(%rdi),%r11  // t1
 
-	leaq	(%r14,%r10,2),%r12
+	leaq	(%r14,%r10,2),%r12  // t2*i<<1 | shift
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r13
+	leaq	(%rcx,%r11,2),%r13  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r13
-	movq	16(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	24(%rdi),%r11
+	orq	%r10,%r13  // | t2*i>>63
+	movq	16(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	24(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%r12
-	movq	-8(%rsi,%rbp,1),%rax
+	movq	-8(%rsi,%rbp,1),%rax  // ai+1	# prefetch
 	movq	%r12,(%rdi)
 	adcq	%rdx,%r13
 
-	leaq	(%r14,%r10,2),%rbx
+	leaq	(%r14,%r10,2),%rbx  // t2*i<<1 | shift
 	movq	%r13,8(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r8
+	leaq	(%rcx,%r11,2),%r8  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r8
-	movq	32(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	40(%rdi),%r11
+	orq	%r10,%r8  // | t2*i>>63
+	movq	32(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	40(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%rbx
-	movq	0(%rsi,%rbp,1),%rax
+	movq	0(%rsi,%rbp,1),%rax  // ai+1	# prefetch
 	movq	%rbx,16(%rdi)
 	adcq	%rdx,%r8
 	leaq	16(%rbp),%rbp
 	movq	%r8,24(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	leaq	64(%rdi),%rdi
 	jmp	.Lsqr4x_shift_n_add
 
 .align	32
 .Lsqr4x_shift_n_add:
-	leaq	(%r14,%r10,2),%r12
+	leaq	(%r14,%r10,2),%r12  // t2*i<<1 | shift
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r13
+	leaq	(%rcx,%r11,2),%r13  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r13
-	movq	-16(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	-8(%rdi),%r11
+	orq	%r10,%r13  // | t2*i>>63
+	movq	-16(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	-8(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%r12
-	movq	-8(%rsi,%rbp,1),%rax
+	movq	-8(%rsi,%rbp,1),%rax  // ai+1	# prefetch
 	movq	%r12,-32(%rdi)
 	adcq	%rdx,%r13
 
-	leaq	(%r14,%r10,2),%rbx
+	leaq	(%r14,%r10,2),%rbx  // t2*i<<1 | shift
 	movq	%r13,-24(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r8
+	leaq	(%rcx,%r11,2),%r8  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r8
-	movq	0(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	8(%rdi),%r11
+	orq	%r10,%r8  // | t2*i>>63
+	movq	0(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	8(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%rbx
-	movq	0(%rsi,%rbp,1),%rax
+	movq	0(%rsi,%rbp,1),%rax  // ai+1	# prefetch
 	movq	%rbx,-16(%rdi)
 	adcq	%rdx,%r8
 
-	leaq	(%r14,%r10,2),%r12
+	leaq	(%r14,%r10,2),%r12  // t2*i<<1 | shift
 	movq	%r8,-8(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r13
+	leaq	(%rcx,%r11,2),%r13  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r13
-	movq	16(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	24(%rdi),%r11
+	orq	%r10,%r13  // | t2*i>>63
+	movq	16(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	24(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%r12
-	movq	8(%rsi,%rbp,1),%rax
+	movq	8(%rsi,%rbp,1),%rax  // ai+1	# prefetch
 	movq	%r12,0(%rdi)
 	adcq	%rdx,%r13
 
-	leaq	(%r14,%r10,2),%rbx
+	leaq	(%r14,%r10,2),%rbx  // t2*i<<1 | shift
 	movq	%r13,8(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r8
+	leaq	(%rcx,%r11,2),%r8  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r8
-	movq	32(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	40(%rdi),%r11
+	orq	%r10,%r8  // | t2*i>>63
+	movq	32(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	40(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%rbx
-	movq	16(%rsi,%rbp,1),%rax
+	movq	16(%rsi,%rbp,1),%rax  // ai+1	# prefetch
 	movq	%rbx,16(%rdi)
 	adcq	%rdx,%r8
 	movq	%r8,24(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	leaq	64(%rdi),%rdi
 	addq	$32,%rbp
 	jnz	.Lsqr4x_shift_n_add
 
-	leaq	(%r14,%r10,2),%r12
+	leaq	(%r14,%r10,2),%r12  // t2*i<<1 | shift
 .byte	0x67
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r13
+	leaq	(%rcx,%r11,2),%r13  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r13
-	movq	-16(%rdi),%r10
-	movq	%r11,%r14
-	mulq	%rax
-	negq	%r15
-	movq	-8(%rdi),%r11
+	orq	%r10,%r13  // | t2*i>>63
+	movq	-16(%rdi),%r10  // t2*i+2	# prefetch
+	movq	%r11,%r14  // shift=t2*i+1>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
+	movq	-8(%rdi),%r11  // t2*i+2+1	# prefetch
 	adcq	%rax,%r12
-	movq	-8(%rsi),%rax
+	movq	-8(%rsi),%rax  // ai+1	# prefetch
 	movq	%r12,-32(%rdi)
 	adcq	%rdx,%r13
 
-	leaq	(%r14,%r10,2),%rbx
+	leaq	(%r14,%r10,2),%rbx  // t2*i<<1|shift
 	movq	%r13,-24(%rdi)
-	sbbq	%r15,%r15
+	sbbq	%r15,%r15  // mov cf,%r15
 	shrq	$63,%r10
-	leaq	(%rcx,%r11,2),%r8
+	leaq	(%rcx,%r11,2),%r8  // t2*i+1<<1 |
 	shrq	$63,%r11
-	orq	%r10,%r8
-	mulq	%rax
-	negq	%r15
+	orq	%r10,%r8  // | t2*i>>63
+	mulq	%rax  // ai*ai
+	negq	%r15  // mov %r15,cf
 	adcq	%rax,%rbx
 	adcq	%rdx,%r8
 	movq	%rbx,-16(%rdi)
@@ -1743,17 +1743,17 @@
 	movq	%xmm2,%rbp
 __bn_sqr8x_reduction:
 	xorq	%rax,%rax
-	leaq	(%r9,%rbp,1),%rcx
-	leaq	48+8(%rsp,%r9,2),%rdx
+	leaq	(%r9,%rbp,1),%rcx  // end of n
+	leaq	48+8(%rsp,%r9,2),%rdx  // end of t buffer
 	movq	%rcx,0+8(%rsp)
-	leaq	48+8(%rsp,%r9,1),%rdi
+	leaq	48+8(%rsp,%r9,1),%rdi  // end of initial t window
 	movq	%rdx,8+8(%rsp)
 	negq	%r9
 	jmp	.L8x_reduction_loop
 
 .align	32
 .L8x_reduction_loop:
-	leaq	(%rdi,%r9,1),%rdi
+	leaq	(%rdi,%r9,1),%rdi  // start of current t window
 .byte	0x66
 	movq	0(%rdi),%rbx
 	movq	8(%rdi),%r9
@@ -1763,20 +1763,20 @@
 	movq	40(%rdi),%r13
 	movq	48(%rdi),%r14
 	movq	56(%rdi),%r15
-	movq	%rax,(%rdx)
+	movq	%rax,(%rdx)  // store top-most carry bit
 	leaq	64(%rdi),%rdi
 
 .byte	0x67
 	movq	%rbx,%r8
-	imulq	32+8(%rsp),%rbx
-	movq	0(%rbp),%rax
+	imulq	32+8(%rsp),%rbx  // n0*a0
+	movq	0(%rbp),%rax  // n0
 	movl	$8,%ecx
 	jmp	.L8x_reduce
 
 .align	32
 .L8x_reduce:
 	mulq	%rbx
-	movq	8(%rbp),%rax
+	movq	8(%rbp),%rax  // n1
 	negq	%r8
 	movq	%rdx,%r8
 	adcq	$0,%r8
@@ -1786,7 +1786,7 @@
 	movq	16(%rbp),%rax
 	adcq	$0,%rdx
 	addq	%r9,%r8
-	movq	%rbx,48-8+8(%rsp,%rcx,8)
+	movq	%rbx,48-8+8(%rsp,%rcx,8)  // put aside n0*ai
 	movq	%rdx,%r9
 	adcq	$0,%r9
 
@@ -1795,7 +1795,7 @@
 	movq	24(%rbp),%rax
 	adcq	$0,%rdx
 	addq	%r10,%r9
-	movq	32+8(%rsp),%rsi
+	movq	32+8(%rsp),%rsi  // pull n0, borrow %rsi
 	movq	%rdx,%r10
 	adcq	$0,%r10
 
@@ -1803,7 +1803,7 @@
 	addq	%rax,%r11
 	movq	32(%rbp),%rax
 	adcq	$0,%rdx
-	imulq	%r8,%rsi
+	imulq	%r8,%rsi  // modulo-scheduled
 	addq	%r11,%r10
 	movq	%rdx,%r11
 	adcq	$0,%r11
@@ -1833,9 +1833,9 @@
 	adcq	$0,%r14
 
 	mulq	%rbx
-	movq	%rsi,%rbx
+	movq	%rsi,%rbx  // n0*ai
 	addq	%rax,%r15
-	movq	0(%rbp),%rax
+	movq	0(%rbp),%rax  // n0
 	adcq	$0,%rdx
 	addq	%r15,%r14
 	movq	%rdx,%r15
@@ -1846,8 +1846,8 @@
 
 	leaq	64(%rbp),%rbp
 	xorq	%rax,%rax
-	movq	8+8(%rsp),%rdx
-	cmpq	0+8(%rsp),%rbp
+	movq	8+8(%rsp),%rdx  // pull end of t
+	cmpq	0+8(%rsp),%rbp  // end of n?
 	jae	.L8x_no_tail
 
 .byte	0x66
@@ -1859,9 +1859,9 @@
 	adcq	40(%rdi),%r13
 	adcq	48(%rdi),%r14
 	adcq	56(%rdi),%r15
-	sbbq	%rsi,%rsi
+	sbbq	%rsi,%rsi  // top carry
 
-	movq	48+56+8(%rsp),%rbx
+	movq	48+56+8(%rsp),%rbx  // pull n0*a0
 	movl	$8,%ecx
 	movq	0(%rbp),%rax
 	jmp	.L8x_tail
@@ -1871,7 +1871,7 @@
 	mulq	%rbx
 	addq	%rax,%r8
 	movq	8(%rbp),%rax
-	movq	%r8,(%rdi)
+	movq	%r8,(%rdi)  // save result
 	movq	%rdx,%r8
 	adcq	$0,%r8
 
@@ -1880,7 +1880,7 @@
 	movq	16(%rbp),%rax
 	adcq	$0,%rdx
 	addq	%r9,%r8
-	leaq	8(%rdi),%rdi
+	leaq	8(%rdi),%rdi  // %rdi++
 	movq	%rdx,%r9
 	adcq	$0,%r9
 
@@ -1925,11 +1925,11 @@
 	adcq	$0,%r14
 
 	mulq	%rbx
-	movq	48-16+8(%rsp,%rcx,8),%rbx
+	movq	48-16+8(%rsp,%rcx,8),%rbx  // pull n0*ai
 	addq	%rax,%r15
 	adcq	$0,%rdx
 	addq	%r15,%r14
-	movq	0(%rbp),%rax
+	movq	0(%rbp),%rax  // pull n0
 	movq	%rdx,%r15
 	adcq	$0,%r15
 
@@ -1937,13 +1937,13 @@
 	jnz	.L8x_tail
 
 	leaq	64(%rbp),%rbp
-	movq	8+8(%rsp),%rdx
-	cmpq	0+8(%rsp),%rbp
-	jae	.L8x_tail_done
+	movq	8+8(%rsp),%rdx  // pull end of t
+	cmpq	0+8(%rsp),%rbp  // end of n?
+	jae	.L8x_tail_done  // break out of loop
 
-	movq	48+56+8(%rsp),%rbx
+	movq	48+56+8(%rsp),%rbx  // pull n0*a0
 	negq	%rsi
-	movq	0(%rbp),%rax
+	movq	0(%rbp),%rax  // pull n0
 	adcq	0(%rdi),%r8
 	adcq	8(%rdi),%r9
 	adcq	16(%rdi),%r10
@@ -1952,7 +1952,7 @@
 	adcq	40(%rdi),%r13
 	adcq	48(%rdi),%r14
 	adcq	56(%rdi),%r15
-	sbbq	%rsi,%rsi
+	sbbq	%rsi,%rsi  // top carry
 
 	movl	$8,%ecx
 	jmp	.L8x_tail
@@ -1960,7 +1960,7 @@
 .align	32
 .L8x_tail_done:
 	xorq	%rax,%rax
-	addq	(%rdx),%r8
+	addq	(%rdx),%r8  // can this overflow?
 	adcq	$0,%r9
 	adcq	$0,%r10
 	adcq	$0,%r11
@@ -1980,15 +1980,15 @@
 	adcq	40(%rdi),%r13
 	adcq	48(%rdi),%r14
 	adcq	56(%rdi),%r15
-	adcq	$0,%rax
-	movq	-8(%rbp),%rcx
+	adcq	$0,%rax  // top-most carry
+	movq	-8(%rbp),%rcx  // npnum-1
 	xorq	%rsi,%rsi
 
-	movq	%xmm2,%rbp
+	movq	%xmm2,%rbp  // restore %rbp
 
-	movq	%r8,0(%rdi)
+	movq	%r8,0(%rdi)  // store top 512 bits
 	movq	%r9,8(%rdi)
-	movq	%xmm3,%r9
+	movq	%xmm3,%r9  // %r9 is %r9, can't be moved upwards
 	movq	%r10,16(%rdi)
 	movq	%r11,24(%rdi)
 	movq	%r12,32(%rdi)
@@ -1997,7 +1997,7 @@
 	movq	%r15,56(%rdi)
 	leaq	64(%rdi),%rdi
 
-	cmpq	%rdx,%rdi
+	cmpq	%rdx,%rdi  // end of t?
 	jb	.L8x_reduction_loop
 	ret
 .cfi_endproc	
@@ -2007,13 +2007,13 @@
 __bn_post4x_internal:
 .cfi_startproc	
 	movq	0(%rbp),%r12
-	leaq	(%rdi,%r9,1),%rbx
+	leaq	(%rdi,%r9,1),%rbx  // %rdi was %rbx above
 	movq	%r9,%rcx
-	movq	%xmm1,%rdi
+	movq	%xmm1,%rdi  // restore %rdi
 	negq	%rax
-	movq	%xmm1,%rsi
+	movq	%xmm1,%rsi  // prepare for back-to-back call
 	sarq	$3+2,%rcx
-	decq	%r12
+	decq	%r12  // so that after 'not' we get -n0
 	xorq	%r10,%r10
 	movq	8(%rbp),%r13
 	movq	16(%rbp),%r14
@@ -2037,7 +2037,7 @@
 	andq	%rax,%r14
 	andq	%rax,%r15
 
-	negq	%r10
+	negq	%r10  // mov %r10,%cf
 	adcq	0(%rbx),%r12
 	adcq	8(%rbx),%r13
 	adcq	16(%rbx),%r14
@@ -2045,16 +2045,16 @@
 	movq	%r12,0(%rdi)
 	leaq	32(%rbx),%rbx
 	movq	%r13,8(%rdi)
-	sbbq	%r10,%r10
+	sbbq	%r10,%r10  // mov %cf,%r10
 	movq	%r14,16(%rdi)
 	movq	%r15,24(%rdi)
 	leaq	32(%rdi),%rdi
 
-	incq	%rcx
+	incq	%rcx  // pass %cf
 	jnz	.Lsqr4x_sub
 
-	movq	%r9,%r10
-	negq	%r9
+	movq	%r9,%r10  // prepare for back-to-back call
+	negq	%r9  // restore %r9
 	ret
 .cfi_endproc	
 .size	__bn_post4x_internal,.-__bn_post4x_internal
@@ -2081,42 +2081,42 @@
 .cfi_offset	%r15,-56
 .Lmulx4x_prologue:
 
-
-
-
-	shll	$3,%r9d
-	leaq	(%r9,%r9,2),%r10
-	negq	%r9
-	movq	(%r8),%r8
-
-
-
-
-
-
-
-
-
-
+// num is declared as an int, a 32-bit parameter, so the upper half is
+// undefined. It is important that this write to %r9, which zeros the
+// upper half, predates the first access.
+	shll	$3,%r9d  // convert %r9 to bytes
+	leaq	(%r9,%r9,2),%r10  // 3*%r9 in bytes
+	negq	%r9  // -%r9
+	movq	(%r8),%r8  // *n0
+
+// #############################################################
+// Ensure that stack frame doesn't alias with +3*%r9
+// modulo 4096, which covers retnum, amnum and nnum
+// (see bn_exp.c). This is done to allow memory disambiguation
+// logic do its magic. Extra num is allocated in order
+// to align with bn_power5's frame, which is cleansed after
+// completing exponentiation. Extra 256 bytes is for power mask
+// calculated from 7th argument, the index.
+// 
 	leaq	-320(%rsp,%r9,2),%r11
 	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	.Lmulx4xsp_alt
-	subq	%r11,%rbp
-	leaq	-320(%rbp,%r9,2),%rbp
+	subq	%r11,%rbp  // align with
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*%r9*8+256)
 	jmp	.Lmulx4xsp_done
 
 .Lmulx4xsp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rbp,%r9,2),%rbp
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*%r9*8+256)
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
 	subq	%r11,%rbp
 .Lmulx4xsp_done:
-	andq	$-64,%rbp
+	andq	$-64,%rbp  // ensure alignment
 	movq	%rsp,%r11
 	subq	%rbp,%r11
 	andq	$-4096,%r11
@@ -2133,25 +2133,25 @@
 	ja	.Lmulx4x_page_walk
 .Lmulx4x_page_walk_done:
 
-
-
-
-
-
-
-
-
-
-
-
-
-	movq	%r8,32(%rsp)
-	movq	%rax,40(%rsp)
+// #############################################################
+// Stack layout
+// +0	-num
+// +8	off-loaded &bi
+// +16	end of bnum
+// +24	inner counter
+// +32	saved n0
+// +40	saved %rsp
+// +48
+// +56	saved rp
+// +64	tmpnum+1
+// 
+	movq	%r8,32(%rsp)  // save *n0
+	movq	%rax,40(%rsp)  // save original %rsp
 .cfi_escape	0x0f,0x05,0x77,0x28,0x06,0x23,0x08
 .Lmulx4x_body:
 	call	mulx4x_internal
 
-	movq	40(%rsp),%rsi
+	movq	40(%rsp),%rsi  // restore %rsp
 .cfi_def_cfa	%rsi,8
 	movq	$1,%rax
 
@@ -2178,44 +2178,44 @@
 .align	32
 mulx4x_internal:
 .cfi_startproc	
-	movq	%r9,8(%rsp)
+	movq	%r9,8(%rsp)  // save -%r9 (it was in bytes)
 	movq	%r9,%r10
-	negq	%r9
+	negq	%r9  // restore %r9
 	shlq	$5,%r9
-	negq	%r10
-	leaq	128(%rdx,%r9,1),%r13
+	negq	%r10  // restore %r9
+	leaq	128(%rdx,%r9,1),%r13  // end of powers table (+size optimization)
 	shrq	$5+5,%r9
-	movd	8(%rax),%xmm5
+	movd	8(%rax),%xmm5  // load 7th argument
 	subq	$1,%r9
 	leaq	.Linc(%rip),%rax
-	movq	%r13,16+8(%rsp)
-	movq	%r9,24+8(%rsp)
-	movq	%rdi,56+8(%rsp)
-	movdqa	0(%rax),%xmm0
-	movdqa	16(%rax),%xmm1
-	leaq	88-112(%rsp,%r10,1),%r10
-	leaq	128(%rdx),%rdi
-
-	pshufd	$0,%xmm5,%xmm5
+	movq	%r13,16+8(%rsp)  // end of bnum
+	movq	%r9,24+8(%rsp)  // inner counter
+	movq	%rdi,56+8(%rsp)  // save %rdi
+	movdqa	0(%rax),%xmm0  // 00000001000000010000000000000000
+	movdqa	16(%rax),%xmm1  // 00000002000000020000000200000002
+	leaq	88-112(%rsp,%r10,1),%r10  // place the mask after tpnum+1 (+ICache optimization)
+	leaq	128(%rdx),%rdi  // size optimization
+
+	pshufd	$0,%xmm5,%xmm5  // broadcast index
 	movdqa	%xmm1,%xmm4
 .byte	0x67
 	movdqa	%xmm1,%xmm2
 .byte	0x67
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,112(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,128(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,144(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -2224,17 +2224,17 @@
 	movdqa	%xmm3,160(%r10)
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,176(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,192(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,208(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -2243,17 +2243,17 @@
 	movdqa	%xmm3,224(%r10)
 	movdqa	%xmm4,%xmm3
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,240(%r10)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,256(%r10)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,272(%r10)
 	movdqa	%xmm4,%xmm2
 
@@ -2273,7 +2273,7 @@
 	pcmpeqd	%xmm5,%xmm3
 	movdqa	%xmm2,336(%r10)
 
-	pand	64(%rdi),%xmm0
+	pand	64(%rdi),%xmm0  // while it's still in register
 	pand	80(%rdi),%xmm1
 	pand	96(%rdi),%xmm2
 	movdqa	%xmm3,352(%r10)
@@ -2317,41 +2317,41 @@
 	por	%xmm2,%xmm0
 	por	%xmm3,%xmm1
 	pxor	%xmm1,%xmm0
-
-	pshufd	$0x4e,%xmm0,%xmm1
+// Combine the upper and lower halves of %xmm0.
+	pshufd	$0x4e,%xmm0,%xmm1  // Swap upper and lower halves.
 	por	%xmm1,%xmm0
 	leaq	256(%rdi),%rdi
-	movq	%xmm0,%rdx
+	movq	%xmm0,%rdx  // bp0
 	leaq	64+32+8(%rsp),%rbx
 
 	movq	%rdx,%r9
-	mulxq	0(%rsi),%r8,%rax
-	mulxq	8(%rsi),%r11,%r12
+	mulxq	0(%rsi),%r8,%rax  // a0*b0
+	mulxq	8(%rsi),%r11,%r12  // a1*b0
 	addq	%rax,%r11
-	mulxq	16(%rsi),%rax,%r13
+	mulxq	16(%rsi),%rax,%r13  // ...
 	adcq	%rax,%r12
 	adcq	$0,%r13
 	mulxq	24(%rsi),%rax,%r14
 
 	movq	%r8,%r15
-	imulq	32+8(%rsp),%r8
-	xorq	%rbp,%rbp
+	imulq	32+8(%rsp),%r8  // "t0"*n0
+	xorq	%rbp,%rbp  // cf=0, of=0
 	movq	%r8,%rdx
 
-	movq	%rdi,8+8(%rsp)
+	movq	%rdi,8+8(%rsp)  // off-load &bi
 
 	leaq	32(%rsi),%rsi
 	adcxq	%rax,%r13
-	adcxq	%rbp,%r14
+	adcxq	%rbp,%r14  // cf=0
 
 	mulxq	0(%rcx),%rax,%r10
-	adcxq	%rax,%r15
+	adcxq	%rax,%r15  // discarded
 	adoxq	%r11,%r10
 	mulxq	8(%rcx),%rax,%r11
 	adcxq	%rax,%r10
 	adoxq	%r12,%r11
 	mulxq	16(%rcx),%rax,%r12
-	movq	24+8(%rsp),%rdi
+	movq	24+8(%rsp),%rdi  // counter value
 	movq	%r10,-32(%rbx)
 	adcxq	%rax,%r11
 	adoxq	%r13,%r12
@@ -2359,25 +2359,25 @@
 	movq	%r9,%rdx
 	movq	%r11,-24(%rbx)
 	adcxq	%rax,%r12
-	adoxq	%rbp,%r15
+	adoxq	%rbp,%r15  // of=0
 	leaq	32(%rcx),%rcx
 	movq	%r12,-16(%rbx)
 	jmp	.Lmulx4x_1st
 
 .align	32
 .Lmulx4x_1st:
-	adcxq	%rbp,%r15
-	mulxq	0(%rsi),%r10,%rax
+	adcxq	%rbp,%r15  // cf=0, modulo-scheduled
+	mulxq	0(%rsi),%r10,%rax  // a4*b0
 	adcxq	%r14,%r10
-	mulxq	8(%rsi),%r11,%r14
+	mulxq	8(%rsi),%r11,%r14  // a5*b0
 	adcxq	%rax,%r11
-	mulxq	16(%rsi),%r12,%rax
+	mulxq	16(%rsi),%r12,%rax  // ...
 	adcxq	%r14,%r12
 	mulxq	24(%rsi),%r13,%r14
 .byte	0x67,0x67
 	movq	%r8,%rdx
 	adcxq	%rax,%r13
-	adcxq	%rbp,%r14
+	adcxq	%rbp,%r14  // cf=0
 	leaq	32(%rsi),%rsi
 	leaq	32(%rbx),%rbx
 
@@ -2401,21 +2401,21 @@
 	leaq	32(%rcx),%rcx
 	movq	%r13,-16(%rbx)
 
-	decq	%rdi
+	decq	%rdi  // of=0, pass cf
 	jnz	.Lmulx4x_1st
 
-	movq	8(%rsp),%rax
-	adcq	%rbp,%r15
-	leaq	(%rsi,%rax,1),%rsi
+	movq	8(%rsp),%rax  // load -num
+	adcq	%rbp,%r15  // modulo-scheduled
+	leaq	(%rsi,%rax,1),%rsi  // rewind %rsi
 	addq	%r15,%r14
-	movq	8+8(%rsp),%rdi
-	adcq	%rbp,%rbp
+	movq	8+8(%rsp),%rdi  // re-load &bi
+	adcq	%rbp,%rbp  // top-most carry
 	movq	%r14,-8(%rbx)
 	jmp	.Lmulx4x_outer
 
 .align	32
 .Lmulx4x_outer:
-	leaq	16-256(%rbx),%r10
+	leaq	16-256(%rbx),%r10  // where 256-byte mask is (+density control)
 	pxor	%xmm4,%xmm4
 .byte	0x67,0x67
 	pxor	%xmm5,%xmm5
@@ -2468,41 +2468,41 @@
 	por	%xmm2,%xmm4
 	por	%xmm3,%xmm5
 	por	%xmm5,%xmm4
-
-	pshufd	$0x4e,%xmm4,%xmm0
+// Combine the upper and lower halves of %xmm4 as %xmm0.
+	pshufd	$0x4e,%xmm4,%xmm0  // Swap upper and lower halves.
 	por	%xmm4,%xmm0
 	leaq	256(%rdi),%rdi
-	movq	%xmm0,%rdx
+	movq	%xmm0,%rdx  // m0=bpi
 
-	movq	%rbp,(%rbx)
-	leaq	32(%rbx,%rax,1),%rbx
-	mulxq	0(%rsi),%r8,%r11
-	xorq	%rbp,%rbp
+	movq	%rbp,(%rbx)  // save top-most carry
+	leaq	32(%rbx,%rax,1),%rbx  // rewind %rbx
+	mulxq	0(%rsi),%r8,%r11  // a0*bi
+	xorq	%rbp,%rbp  // cf=0, of=0
 	movq	%rdx,%r9
-	mulxq	8(%rsi),%r14,%r12
-	adoxq	-32(%rbx),%r8
+	mulxq	8(%rsi),%r14,%r12  // a1*bi
+	adoxq	-32(%rbx),%r8  // +t0
 	adcxq	%r14,%r11
-	mulxq	16(%rsi),%r15,%r13
+	mulxq	16(%rsi),%r15,%r13  // ...
 	adoxq	-24(%rbx),%r11
 	adcxq	%r15,%r12
 	mulxq	24(%rsi),%rdx,%r14
 	adoxq	-16(%rbx),%r12
 	adcxq	%rdx,%r13
-	leaq	(%rcx,%rax,1),%rcx
+	leaq	(%rcx,%rax,1),%rcx  // rewind %rcx
 	leaq	32(%rsi),%rsi
 	adoxq	-8(%rbx),%r13
 	adcxq	%rbp,%r14
 	adoxq	%rbp,%r14
 
 	movq	%r8,%r15
-	imulq	32+8(%rsp),%r8
+	imulq	32+8(%rsp),%r8  // "t0"*n0
 
 	movq	%r8,%rdx
-	xorq	%rbp,%rbp
-	movq	%rdi,8+8(%rsp)
+	xorq	%rbp,%rbp  // cf=0, of=0
+	movq	%rdi,8+8(%rsp)  // off-load &bi
 
 	mulxq	0(%rcx),%rax,%r10
-	adcxq	%rax,%r15
+	adcxq	%rax,%r15  // discarded
 	adoxq	%r11,%r10
 	mulxq	8(%rcx),%rax,%r11
 	adcxq	%rax,%r10
@@ -2512,24 +2512,24 @@
 	adoxq	%r13,%r12
 	mulxq	24(%rcx),%rax,%r15
 	movq	%r9,%rdx
-	movq	24+8(%rsp),%rdi
+	movq	24+8(%rsp),%rdi  // counter value
 	movq	%r10,-32(%rbx)
 	adcxq	%rax,%r12
 	movq	%r11,-24(%rbx)
-	adoxq	%rbp,%r15
+	adoxq	%rbp,%r15  // of=0
 	movq	%r12,-16(%rbx)
 	leaq	32(%rcx),%rcx
 	jmp	.Lmulx4x_inner
 
 .align	32
 .Lmulx4x_inner:
-	mulxq	0(%rsi),%r10,%rax
-	adcxq	%rbp,%r15
+	mulxq	0(%rsi),%r10,%rax  // a4*bi
+	adcxq	%rbp,%r15  // cf=0, modulo-scheduled
 	adoxq	%r14,%r10
-	mulxq	8(%rsi),%r11,%r14
+	mulxq	8(%rsi),%r11,%r14  // a5*bi
 	adcxq	0(%rbx),%r10
 	adoxq	%rax,%r11
-	mulxq	16(%rsi),%r12,%rax
+	mulxq	16(%rsi),%r12,%rax  // ...
 	adcxq	8(%rbx),%r11
 	adoxq	%r14,%r12
 	mulxq	24(%rsi),%r13,%r14
@@ -2537,10 +2537,10 @@
 	adcxq	16(%rbx),%r12
 	adoxq	%rax,%r13
 	adcxq	24(%rbx),%r13
-	adoxq	%rbp,%r14
+	adoxq	%rbp,%r14  // of=0
 	leaq	32(%rsi),%rsi
 	leaq	32(%rbx),%rbx
-	adcxq	%rbp,%r14
+	adcxq	%rbp,%r14  // cf=0
 
 	adoxq	%r15,%r10
 	mulxq	0(%rcx),%rax,%r15
@@ -2562,17 +2562,17 @@
 	adoxq	%rbp,%r15
 	movq	%r13,-16(%rbx)
 
-	decq	%rdi
+	decq	%rdi  // of=0, pass cf
 	jnz	.Lmulx4x_inner
 
-	movq	0+8(%rsp),%rax
-	adcq	%rbp,%r15
-	subq	0(%rbx),%rdi
-	movq	8+8(%rsp),%rdi
+	movq	0+8(%rsp),%rax  // load -num
+	adcq	%rbp,%r15  // modulo-scheduled
+	subq	0(%rbx),%rdi  // pull top-most carry to %cf
+	movq	8+8(%rsp),%rdi  // re-load &bi
 	movq	16+8(%rsp),%r10
 	adcq	%r15,%r14
-	leaq	(%rsi,%rax,1),%rsi
-	adcq	%rbp,%rbp
+	leaq	(%rsi,%rax,1),%rsi  // rewind %rsi
+	adcq	%rbp,%rbp  // top-most carry
 	movq	%r14,-8(%rbx)
 
 	cmpq	%r10,%rdi
@@ -2581,23 +2581,23 @@
 	movq	-8(%rcx),%r10
 	movq	%rbp,%r8
 	movq	(%rcx,%rax,1),%r12
-	leaq	(%rcx,%rax,1),%rbp
+	leaq	(%rcx,%rax,1),%rbp  // rewind %rcx
 	movq	%rax,%rcx
-	leaq	(%rbx,%rax,1),%rdi
+	leaq	(%rbx,%rax,1),%rdi  // rewind %rbx
 	xorl	%eax,%eax
 	xorq	%r15,%r15
-	subq	%r14,%r10
+	subq	%r14,%r10  // compare top-most words
 	adcq	%r15,%r15
 	orq	%r15,%r8
 	sarq	$3+2,%rcx
-	subq	%r8,%rax
-	movq	56+8(%rsp),%rdx
-	decq	%r12
+	subq	%r8,%rax  // %rax=-%r8
+	movq	56+8(%rsp),%rdx  // restore rp
+	decq	%r12  // so that after 'not' we get -n0
 	movq	8(%rbp),%r13
 	xorq	%r8,%r8
 	movq	16(%rbp),%r14
 	movq	24(%rbp),%r15
-	jmp	.Lsqrx4x_sub_entry
+	jmp	.Lsqrx4x_sub_entry  // common post-condition
 .cfi_endproc	
 .size	mulx4x_internal,.-mulx4x_internal
 .globl	bn_powerx5
@@ -2623,35 +2623,35 @@
 .cfi_offset	%r15,-56
 .Lpowerx5_prologue:
 
-
-
-
-	shll	$3,%r9d
-	leaq	(%r9,%r9,2),%r10
+// num is declared as an int, a 32-bit parameter, so the upper half is
+// undefined. It is important that this write to %r9, which zeros the
+// upper half, predates the first access.
+	shll	$3,%r9d  // convert %r9 to bytes
+	leaq	(%r9,%r9,2),%r10  // 3*%r9 in bytes
 	negq	%r9
-	movq	(%r8),%r8
-
-
-
-
-
-
-
-
+	movq	(%r8),%r8  // *n0
+
+// #############################################################
+// Ensure that stack frame doesn't alias with %rdi+3*%r9
+// modulo 4096, which covers retnum, amnum and nnum
+// (see bn_exp.c). This is done to allow memory disambiguation
+// logic do its magic. Extra 256 bytes is for power mask
+// calculated from 7th argument, the index.
+// 
 	leaq	-320(%rsp,%r9,2),%r11
 	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	.Lpwrx_sp_alt
-	subq	%r11,%rbp
-	leaq	-320(%rbp,%r9,2),%rbp
+	subq	%r11,%rbp  // align with %rsi
+	leaq	-320(%rbp,%r9,2),%rbp  // future alloca(frame+2*%r9*8+256)
 	jmp	.Lpwrx_sp_done
 
 .align	32
 .Lpwrx_sp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rbp,%r9,2),%rbp
+	leaq	-320(%rbp,%r9,2),%rbp  // alloca(frame+2*%r9*8+256)
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
@@ -2677,24 +2677,24 @@
 	movq	%r9,%r10
 	negq	%r9
 
-
-
-
-
-
-
-
-
-
-
-
+// #############################################################
+// Stack layout
+// 
+// +0	saved %r9, used in reduction section
+// +8	&t2*%r9, used in reduction section
+// +16	intermediate carry bit
+// +24	top-most carry bit, used in reduction section
+// +32	saved *n0
+// +40	saved %rsp
+// +48	t2*%r9
+// 
 	pxor	%xmm0,%xmm0
-	movq	%rdi,%xmm1
-	movq	%rcx,%xmm2
-	movq	%r10,%xmm3
+	movq	%rdi,%xmm1  // save %rdi
+	movq	%rcx,%xmm2  // save %rcx
+	movq	%r10,%xmm3  // -%r9
 	movq	%rdx,%xmm4
 	movq	%r8,32(%rsp)
-	movq	%rax,40(%rsp)
+	movq	%rax,40(%rsp)  // save original %rsp
 .cfi_escape	0x0f,0x05,0x77,0x28,0x06,0x23,0x08
 .Lpowerx5_body:
 
@@ -2709,7 +2709,7 @@
 	call	__bn_sqrx8x_internal
 	call	__bn_postx4x_internal
 
-	movq	%r10,%r9
+	movq	%r10,%r9  // -num
 	movq	%rsi,%rdi
 	movq	%xmm2,%rcx
 	movq	%xmm4,%rdx
@@ -2717,7 +2717,7 @@
 
 	call	mulx4x_internal
 
-	movq	40(%rsp),%rsi
+	movq	40(%rsp),%rsi  // restore %rsp
 .cfi_def_cfa	%rsi,8
 	movq	$1,%rax
 
@@ -2749,50 +2749,50 @@
 __bn_sqrx8x_internal:
 .cfi_startproc	
 _CET_ENDBR
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+// #################################################################
+// Squaring part:
+// 
+// a) multiply-n-add everything but ai*ai;
+// b) shift result of a) by 1 to the left and accumulate
+// ai*ai products;
+// 
+// #################################################################
+// a7a7a6a6a5a5a4a4a3a3a2a2a1a1a0a0
+// a1a0
+// a2a0
+// a3a0
+// a2a1
+// a3a1
+// a3a2
+// 
+// a4a0
+// a5a0
+// a6a0
+// a7a0
+// a4a1
+// a5a1
+// a6a1
+// a7a1
+// a4a2
+// a5a2
+// a6a2
+// a7a2
+// a4a3
+// a5a3
+// a6a3
+// a7a3
+// 
+// a5a4
+// a6a4
+// a7a4
+// a6a5
+// a7a5
+// a7a6
+// a7a7a6a6a5a5a4a4a3a3a2a2a1a1a0a0
 	leaq	48+8(%rsp),%rdi
 	leaq	(%rsi,%r9,1),%rbp
-	movq	%r9,0+8(%rsp)
-	movq	%rbp,8+8(%rsp)
+	movq	%r9,0+8(%rsp)  // save %r9
+	movq	%rbp,8+8(%rsp)  // save end of %rsi
 	jmp	.Lsqr8x_zero_start
 
 .align	32
@@ -2803,7 +2803,7 @@
 	movdqa	%xmm0,16(%rdi)
 	movdqa	%xmm0,32(%rdi)
 	movdqa	%xmm0,48(%rdi)
-.Lsqr8x_zero_start:
+.Lsqr8x_zero_start:  // aligned at 32
 	movdqa	%xmm0,64(%rdi)
 	movdqa	%xmm0,80(%rdi)
 	movdqa	%xmm0,96(%rdi)
@@ -2812,8 +2812,8 @@
 	subq	$64,%r9
 	jnz	.Lsqrx8x_zero
 
-	movq	0(%rsi),%rdx
-
+	movq	0(%rsi),%rdx  // a0, modulo-scheduled
+// xor	%r9,%r9			# t1, ex-%r9, zero already
 	xorq	%r10,%r10
 	xorq	%r11,%r11
 	xorq	%r12,%r12
@@ -2821,21 +2821,21 @@
 	xorq	%r14,%r14
 	xorq	%r15,%r15
 	leaq	48+8(%rsp),%rdi
-	xorq	%rbp,%rbp
+	xorq	%rbp,%rbp  // cf=0, cf=0
 	jmp	.Lsqrx8x_outer_loop
 
 .align	32
 .Lsqrx8x_outer_loop:
-	mulxq	8(%rsi),%r8,%rax
-	adcxq	%r9,%r8
+	mulxq	8(%rsi),%r8,%rax  // a1*a0
+	adcxq	%r9,%r8  // a1*a0+=t1
 	adoxq	%rax,%r10
-	mulxq	16(%rsi),%r9,%rax
+	mulxq	16(%rsi),%r9,%rax  // a2*a0
 	adcxq	%r10,%r9
 	adoxq	%rax,%r11
-.byte	0xc4,0xe2,0xab,0xf6,0x86,0x18,0x00,0x00,0x00
+.byte	0xc4,0xe2,0xab,0xf6,0x86,0x18,0x00,0x00,0x00  // mulx	3*8(%rsi),%r10,%rax	# ...
 	adcxq	%r11,%r10
 	adoxq	%rax,%r12
-.byte	0xc4,0xe2,0xa3,0xf6,0x86,0x20,0x00,0x00,0x00
+.byte	0xc4,0xe2,0xa3,0xf6,0x86,0x20,0x00,0x00,0x00  // mulx	4*8(%rsi),%r11,%rax
 	adcxq	%r12,%r11
 	adoxq	%rax,%r13
 	mulxq	40(%rsi),%r12,%rax
@@ -2845,97 +2845,97 @@
 	adcxq	%r14,%r13
 	adoxq	%r15,%rax
 	mulxq	56(%rsi),%r14,%r15
-	movq	8(%rsi),%rdx
+	movq	8(%rsi),%rdx  // a1
 	adcxq	%rax,%r14
 	adoxq	%rbp,%r15
 	adcq	64(%rdi),%r15
-	movq	%r8,8(%rdi)
-	movq	%r9,16(%rdi)
-	sbbq	%rcx,%rcx
-	xorq	%rbp,%rbp
+	movq	%r8,8(%rdi)  // t1
+	movq	%r9,16(%rdi)  // t2
+	sbbq	%rcx,%rcx  // mov %cf,%rcx
+	xorq	%rbp,%rbp  // cf=0, of=0
 
 
-	mulxq	16(%rsi),%r8,%rbx
-	mulxq	24(%rsi),%r9,%rax
+	mulxq	16(%rsi),%r8,%rbx  // a2*a1
+	mulxq	24(%rsi),%r9,%rax  // a3*a1
 	adcxq	%r10,%r8
 	adoxq	%rbx,%r9
-	mulxq	32(%rsi),%r10,%rbx
+	mulxq	32(%rsi),%r10,%rbx  // ...
 	adcxq	%r11,%r9
 	adoxq	%rax,%r10
-.byte	0xc4,0xe2,0xa3,0xf6,0x86,0x28,0x00,0x00,0x00
+.byte	0xc4,0xe2,0xa3,0xf6,0x86,0x28,0x00,0x00,0x00  // mulx	5*8(%rsi),%r11,%rax
 	adcxq	%r12,%r10
 	adoxq	%rbx,%r11
-.byte	0xc4,0xe2,0x9b,0xf6,0x9e,0x30,0x00,0x00,0x00
+.byte	0xc4,0xe2,0x9b,0xf6,0x9e,0x30,0x00,0x00,0x00  // mulx	6*8(%rsi),%r12,%rbx
 	adcxq	%r13,%r11
 	adoxq	%r14,%r12
-.byte	0xc4,0x62,0x93,0xf6,0xb6,0x38,0x00,0x00,0x00
-	movq	16(%rsi),%rdx
+.byte	0xc4,0x62,0x93,0xf6,0xb6,0x38,0x00,0x00,0x00  // mulx	7*8(%rsi),%r13,%r14
+	movq	16(%rsi),%rdx  // a2
 	adcxq	%rax,%r12
 	adoxq	%rbx,%r13
 	adcxq	%r15,%r13
-	adoxq	%rbp,%r14
-	adcxq	%rbp,%r14
+	adoxq	%rbp,%r14  // of=0
+	adcxq	%rbp,%r14  // cf=0
 
-	movq	%r8,24(%rdi)
-	movq	%r9,32(%rdi)
+	movq	%r8,24(%rdi)  // t3
+	movq	%r9,32(%rdi)  // t4
 
-	mulxq	24(%rsi),%r8,%rbx
-	mulxq	32(%rsi),%r9,%rax
+	mulxq	24(%rsi),%r8,%rbx  // a3*a2
+	mulxq	32(%rsi),%r9,%rax  // a4*a2
 	adcxq	%r10,%r8
 	adoxq	%rbx,%r9
-	mulxq	40(%rsi),%r10,%rbx
+	mulxq	40(%rsi),%r10,%rbx  // ...
 	adcxq	%r11,%r9
 	adoxq	%rax,%r10
-.byte	0xc4,0xe2,0xa3,0xf6,0x86,0x30,0x00,0x00,0x00
+.byte	0xc4,0xe2,0xa3,0xf6,0x86,0x30,0x00,0x00,0x00  // mulx	6*8(%rsi),%r11,%rax
 	adcxq	%r12,%r10
 	adoxq	%r13,%r11
-.byte	0xc4,0x62,0x9b,0xf6,0xae,0x38,0x00,0x00,0x00
+.byte	0xc4,0x62,0x9b,0xf6,0xae,0x38,0x00,0x00,0x00  // mulx	7*8(%rsi),%r12,%r13
 .byte	0x3e
-	movq	24(%rsi),%rdx
+	movq	24(%rsi),%rdx  // a3
 	adcxq	%rbx,%r11
 	adoxq	%rax,%r12
 	adcxq	%r14,%r12
-	movq	%r8,40(%rdi)
-	movq	%r9,48(%rdi)
-	mulxq	32(%rsi),%r8,%rax
-	adoxq	%rbp,%r13
-	adcxq	%rbp,%r13
+	movq	%r8,40(%rdi)  // t5
+	movq	%r9,48(%rdi)  // t6
+	mulxq	32(%rsi),%r8,%rax  // a4*a3
+	adoxq	%rbp,%r13  // of=0
+	adcxq	%rbp,%r13  // cf=0
 
-	mulxq	40(%rsi),%r9,%rbx
+	mulxq	40(%rsi),%r9,%rbx  // a5*a3
 	adcxq	%r10,%r8
 	adoxq	%rax,%r9
-	mulxq	48(%rsi),%r10,%rax
+	mulxq	48(%rsi),%r10,%rax  // ...
 	adcxq	%r11,%r9
 	adoxq	%r12,%r10
 	mulxq	56(%rsi),%r11,%r12
-	movq	32(%rsi),%rdx
-	movq	40(%rsi),%r14
+	movq	32(%rsi),%rdx  // a4
+	movq	40(%rsi),%r14  // a5
 	adcxq	%rbx,%r10
 	adoxq	%rax,%r11
-	movq	48(%rsi),%r15
+	movq	48(%rsi),%r15  // a6
 	adcxq	%r13,%r11
-	adoxq	%rbp,%r12
-	adcxq	%rbp,%r12
+	adoxq	%rbp,%r12  // of=0
+	adcxq	%rbp,%r12  // cf=0
 
-	movq	%r8,56(%rdi)
-	movq	%r9,64(%rdi)
+	movq	%r8,56(%rdi)  // t7
+	movq	%r9,64(%rdi)  // t8
 
-	mulxq	%r14,%r9,%rax
-	movq	56(%rsi),%r8
+	mulxq	%r14,%r9,%rax  // a5*a4
+	movq	56(%rsi),%r8  // a7
 	adcxq	%r10,%r9
-	mulxq	%r15,%r10,%rbx
+	mulxq	%r15,%r10,%rbx  // a6*a4
 	adoxq	%rax,%r10
 	adcxq	%r11,%r10
-	mulxq	%r8,%r11,%rax
-	movq	%r14,%rdx
+	mulxq	%r8,%r11,%rax  // a7*a4
+	movq	%r14,%rdx  // a5
 	adoxq	%rbx,%r11
 	adcxq	%r12,%r11
+// adox	%rbp,%rax		# of=0
+	adcxq	%rbp,%rax  // cf=0
 
-	adcxq	%rbp,%rax
-
-	mulxq	%r15,%r14,%rbx
-	mulxq	%r8,%r12,%r13
-	movq	%r15,%rdx
+	mulxq	%r15,%r14,%rbx  // a6*a5
+	mulxq	%r8,%r12,%r13  // a7*a5
+	movq	%r15,%rdx  // a6
 	leaq	64(%rsi),%rsi
 	adcxq	%r14,%r11
 	adoxq	%rbx,%r12
@@ -2943,19 +2943,19 @@
 	adoxq	%rbp,%r13
 
 .byte	0x67,0x67
-	mulxq	%r8,%r8,%r14
+	mulxq	%r8,%r8,%r14  // a7*a6
 	adcxq	%r8,%r13
 	adcxq	%rbp,%r14
 
 	cmpq	8+8(%rsp),%rsi
 	je	.Lsqrx8x_outer_break
 
-	negq	%rcx
+	negq	%rcx  // mov %rcx,%cf
 	movq	$-8,%rcx
 	movq	%rbp,%r15
 	movq	64(%rdi),%r8
-	adcxq	72(%rdi),%r9
-	adcxq	80(%rdi),%r10
+	adcxq	72(%rdi),%r9  // +=t9
+	adcxq	80(%rdi),%r10  // ...
 	adcxq	88(%rdi),%r11
 	adcq	96(%rdi),%r12
 	adcq	104(%rdi),%r13
@@ -2963,24 +2963,24 @@
 	adcq	120(%rdi),%r15
 	leaq	(%rsi),%rbp
 	leaq	128(%rdi),%rdi
-	sbbq	%rax,%rax
+	sbbq	%rax,%rax  // mov %cf,%rcx
 
-	movq	-64(%rsi),%rdx
-	movq	%rax,16+8(%rsp)
+	movq	-64(%rsi),%rdx  // a0
+	movq	%rax,16+8(%rsp)  // offload %rcx
 	movq	%rdi,24+8(%rsp)
 
-
-	xorl	%eax,%eax
+// lea	8*8(%rdi),%rdi	# see 2*8*8(%rdi) above
+	xorl	%eax,%eax  // cf=0, of=0
 	jmp	.Lsqrx8x_loop
 
 .align	32
 .Lsqrx8x_loop:
 	movq	%r8,%rbx
-	mulxq	0(%rbp),%rax,%r8
-	adcxq	%rax,%rbx
+	mulxq	0(%rbp),%rax,%r8  // a8*ai
+	adcxq	%rax,%rbx  // +=t8
 	adoxq	%r9,%r8
 
-	mulxq	8(%rbp),%rax,%r9
+	mulxq	8(%rbp),%rax,%r9  // ...
 	adcxq	%rax,%r8
 	adoxq	%r10,%r9
 
@@ -2992,7 +2992,7 @@
 	adcxq	%rax,%r10
 	adoxq	%r12,%r11
 
-.byte	0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00
+.byte	0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00  // mulx	4*8(%rbp),%rax,%r12
 	adcxq	%rax,%r11
 	adoxq	%r13,%r12
 
@@ -3001,27 +3001,27 @@
 	adoxq	%r14,%r13
 
 	mulxq	48(%rbp),%rax,%r14
-	movq	%rbx,(%rdi,%rcx,8)
+	movq	%rbx,(%rdi,%rcx,8)  // store t8+i
 	movl	$0,%ebx
 	adcxq	%rax,%r13
 	adoxq	%r15,%r14
 
-.byte	0xc4,0x62,0xfb,0xf6,0xbd,0x38,0x00,0x00,0x00
-	movq	8(%rsi,%rcx,8),%rdx
+.byte	0xc4,0x62,0xfb,0xf6,0xbd,0x38,0x00,0x00,0x00  // mulx	7*8(%rbp),%rax,%r15
+	movq	8(%rsi,%rcx,8),%rdx  // ai
 	adcxq	%rax,%r14
-	adoxq	%rbx,%r15
-	adcxq	%rbx,%r15
+	adoxq	%rbx,%r15  // %rbx is 0, of=0
+	adcxq	%rbx,%r15  // cf=0
 
 .byte	0x67
-	incq	%rcx
+	incq	%rcx  // of=0
 	jnz	.Lsqrx8x_loop
 
 	leaq	64(%rbp),%rbp
 	movq	$-8,%rcx
-	cmpq	8+8(%rsp),%rbp
+	cmpq	8+8(%rsp),%rbp  // done?
 	je	.Lsqrx8x_break
 
-	subq	16+8(%rsp),%rbx
+	subq	16+8(%rsp),%rbx  // mov 16(%rsp),%cf
 .byte	0x66
 	movq	-64(%rsi),%rdx
 	adcxq	0(%rdi),%r8
@@ -3034,19 +3034,19 @@
 	adcq	56(%rdi),%r15
 	leaq	64(%rdi),%rdi
 .byte	0x67
-	sbbq	%rax,%rax
-	xorl	%ebx,%ebx
-	movq	%rax,16+8(%rsp)
+	sbbq	%rax,%rax  // mov %cf,%rax
+	xorl	%ebx,%ebx  // cf=0, of=0
+	movq	%rax,16+8(%rsp)  // offload carry
 	jmp	.Lsqrx8x_loop
 
 .align	32
 .Lsqrx8x_break:
 	xorq	%rbp,%rbp
-	subq	16+8(%rsp),%rbx
+	subq	16+8(%rsp),%rbx  // mov 16(%rsp),%cf
 	adcxq	%rbp,%r8
-	movq	24+8(%rsp),%rcx
+	movq	24+8(%rsp),%rcx  // initial %rdi, borrow %rcx
 	adcxq	%rbp,%r9
-	movq	0(%rsi),%rdx
+	movq	0(%rsi),%rdx  // a8, modulo-scheduled
 	adcq	$0,%r10
 	movq	%r8,0(%rdi)
 	adcq	$0,%r11
@@ -3054,7 +3054,7 @@
 	adcq	$0,%r13
 	adcq	$0,%r14
 	adcq	$0,%r15
-	cmpq	%rcx,%rdi
+	cmpq	%rcx,%rdi  // cf=0, of=0
 	je	.Lsqrx8x_outer_loop
 
 	movq	%r9,8(%rdi)
@@ -3076,57 +3076,57 @@
 
 .align	32
 .Lsqrx8x_outer_break:
-	movq	%r9,72(%rdi)
-	movq	%xmm3,%rcx
-	movq	%r10,80(%rdi)
+	movq	%r9,72(%rdi)  // t9
+	movq	%xmm3,%rcx  // -%r9
+	movq	%r10,80(%rdi)  // ...
 	movq	%r11,88(%rdi)
 	movq	%r12,96(%rdi)
 	movq	%r13,104(%rdi)
 	movq	%r14,112(%rdi)
 	leaq	48+8(%rsp),%rdi
-	movq	(%rsi,%rcx,1),%rdx
+	movq	(%rsi,%rcx,1),%rdx  // a0
 
-	movq	8(%rdi),%r11
-	xorq	%r10,%r10
-	movq	0+8(%rsp),%r9
+	movq	8(%rdi),%r11  // t1
+	xorq	%r10,%r10  // t0, of=0, cf=0
+	movq	0+8(%rsp),%r9  // restore %r9
 	adoxq	%r11,%r11
-	movq	16(%rdi),%r12
-	movq	24(%rdi),%r13
-
+	movq	16(%rdi),%r12  // t2	# prefetch
+	movq	24(%rdi),%r13  // t3	# prefetch
+// jmp	.Lsqrx4x_shift_n_add	# happens to be aligned
 
 .align	32
 .Lsqrx4x_shift_n_add:
 	mulxq	%rdx,%rax,%rbx
 	adoxq	%r12,%r12
 	adcxq	%r10,%rax
-.byte	0x48,0x8b,0x94,0x0e,0x08,0x00,0x00,0x00
-.byte	0x4c,0x8b,0x97,0x20,0x00,0x00,0x00
+.byte	0x48,0x8b,0x94,0x0e,0x08,0x00,0x00,0x00  // mov	8(%rsi,%rcx),%rdx	# ai+1	# prefetch
+.byte	0x4c,0x8b,0x97,0x20,0x00,0x00,0x00  // mov	32(%rdi),%r10	# t2*i+4	# prefetch
 	adoxq	%r13,%r13
 	adcxq	%r11,%rbx
-	movq	40(%rdi),%r11
+	movq	40(%rdi),%r11  // t2*i+4+1	# prefetch
 	movq	%rax,0(%rdi)
 	movq	%rbx,8(%rdi)
 
 	mulxq	%rdx,%rax,%rbx
 	adoxq	%r10,%r10
 	adcxq	%r12,%rax
-	movq	16(%rsi,%rcx,1),%rdx
-	movq	48(%rdi),%r12
+	movq	16(%rsi,%rcx,1),%rdx  // ai+2	# prefetch
+	movq	48(%rdi),%r12  // t2*i+6	# prefetch
 	adoxq	%r11,%r11
 	adcxq	%r13,%rbx
-	movq	56(%rdi),%r13
+	movq	56(%rdi),%r13  // t2*i+6+1	# prefetch
 	movq	%rax,16(%rdi)
 	movq	%rbx,24(%rdi)
 
 	mulxq	%rdx,%rax,%rbx
 	adoxq	%r12,%r12
 	adcxq	%r10,%rax
-	movq	24(%rsi,%rcx,1),%rdx
+	movq	24(%rsi,%rcx,1),%rdx  // ai+3	# prefetch
 	leaq	32(%rcx),%rcx
-	movq	64(%rdi),%r10
+	movq	64(%rdi),%r10  // t2*i+8	# prefetch
 	adoxq	%r13,%r13
 	adcxq	%r11,%rbx
-	movq	72(%rdi),%r11
+	movq	72(%rdi),%r11  // t2*i+8+1	# prefetch
 	movq	%rax,32(%rdi)
 	movq	%rbx,40(%rdi)
 
@@ -3134,11 +3134,11 @@
 	adoxq	%r10,%r10
 	adcxq	%r12,%rax
 	jrcxz	.Lsqrx4x_shift_n_add_break
-.byte	0x48,0x8b,0x94,0x0e,0x00,0x00,0x00,0x00
+.byte	0x48,0x8b,0x94,0x0e,0x00,0x00,0x00,0x00  // mov	0(%rsi,%rcx),%rdx	# ai+4	# prefetch
 	adoxq	%r11,%r11
 	adcxq	%r13,%rbx
-	movq	80(%rdi),%r12
-	movq	88(%rdi),%r13
+	movq	80(%rdi),%r12  // t2*i+10	# prefetch
+	movq	88(%rdi),%r13  // t2*i+10+1	# prefetch
 	movq	%rax,48(%rdi)
 	movq	%rbx,56(%rdi)
 	leaq	64(%rdi),%rdi
@@ -3150,18 +3150,18 @@
 	adcxq	%r13,%rbx
 	movq	%rax,48(%rdi)
 	movq	%rbx,56(%rdi)
-	leaq	64(%rdi),%rdi
+	leaq	64(%rdi),%rdi  // end of t buffer
 	movq	%xmm2,%rbp
 __bn_sqrx8x_reduction:
-	xorl	%eax,%eax
-	movq	32+8(%rsp),%rbx
-	movq	48+8(%rsp),%rdx
-	leaq	-64(%rbp,%r9,1),%rcx
-
-	movq	%rcx,0+8(%rsp)
-	movq	%rdi,8+8(%rsp)
-
-	leaq	48+8(%rsp),%rdi
+	xorl	%eax,%eax  // initial top-most carry bit
+	movq	32+8(%rsp),%rbx  // n0
+	movq	48+8(%rsp),%rdx  // "%r8", 8*0(%rdi)
+	leaq	-64(%rbp,%r9,1),%rcx  // end of n
+// lea	48+8(%rsp,%r9,2),%rdi	# end of t buffer
+	movq	%rcx,0+8(%rsp)  // save end of n
+	movq	%rdi,8+8(%rsp)  // save end of t
+
+	leaq	48+8(%rsp),%rdi  // initial t window
 	jmp	.Lsqrx8x_reduction_loop
 
 .align	32
@@ -3171,25 +3171,25 @@
 	movq	24(%rdi),%r11
 	movq	32(%rdi),%r12
 	movq	%rdx,%r8
-	imulq	%rbx,%rdx
+	imulq	%rbx,%rdx  // n0*ai
 	movq	40(%rdi),%r13
 	movq	48(%rdi),%r14
 	movq	56(%rdi),%r15
-	movq	%rax,24+8(%rsp)
+	movq	%rax,24+8(%rsp)  // store top-most carry bit
 
 	leaq	64(%rdi),%rdi
-	xorq	%rsi,%rsi
+	xorq	%rsi,%rsi  // cf=0,of=0
 	movq	$-8,%rcx
 	jmp	.Lsqrx8x_reduce
 
 .align	32
 .Lsqrx8x_reduce:
 	movq	%r8,%rbx
-	mulxq	0(%rbp),%rax,%r8
-	adcxq	%rbx,%rax
+	mulxq	0(%rbp),%rax,%r8  // n0
+	adcxq	%rbx,%rax  // discarded
 	adoxq	%r9,%r8
 
-	mulxq	8(%rbp),%rbx,%r9
+	mulxq	8(%rbp),%rbx,%r9  // n1
 	adcxq	%rbx,%r8
 	adoxq	%r10,%r9
 
@@ -3201,15 +3201,15 @@
 	adcxq	%rbx,%r10
 	adoxq	%r12,%r11
 
-.byte	0xc4,0x62,0xe3,0xf6,0xa5,0x20,0x00,0x00,0x00
+.byte	0xc4,0x62,0xe3,0xf6,0xa5,0x20,0x00,0x00,0x00  // mulx	8*4(%rbp),%rbx,%r12
 	movq	%rdx,%rax
 	movq	%r8,%rdx
 	adcxq	%rbx,%r11
 	adoxq	%r13,%r12
 
-	mulxq	32+8(%rsp),%rbx,%rdx
+	mulxq	32+8(%rsp),%rbx,%rdx  // %rdx discarded
 	movq	%rax,%rdx
-	movq	%rax,64+48+8(%rsp,%rcx,8)
+	movq	%rax,64+48+8(%rsp,%rcx,8)  // put aside n0*ai
 
 	mulxq	40(%rbp),%rax,%r13
 	adcxq	%rax,%r12
@@ -3222,18 +3222,18 @@
 	mulxq	56(%rbp),%rax,%r15
 	movq	%rbx,%rdx
 	adcxq	%rax,%r14
-	adoxq	%rsi,%r15
-	adcxq	%rsi,%r15
+	adoxq	%rsi,%r15  // %rsi is 0
+	adcxq	%rsi,%r15  // cf=0
 
 .byte	0x67,0x67,0x67
-	incq	%rcx
+	incq	%rcx  // of=0
 	jnz	.Lsqrx8x_reduce
 
-	movq	%rsi,%rax
-	cmpq	0+8(%rsp),%rbp
+	movq	%rsi,%rax  // xor	%rax,%rax
+	cmpq	0+8(%rsp),%rbp  // end of n?
 	jae	.Lsqrx8x_no_tail
 
-	movq	48+8(%rsp),%rdx
+	movq	48+8(%rsp),%rdx  // pull n0*a0
 	addq	0(%rdi),%r8
 	leaq	64(%rbp),%rbp
 	movq	$-8,%rcx
@@ -3245,9 +3245,9 @@
 	adcq	48(%rdi),%r14
 	adcq	56(%rdi),%r15
 	leaq	64(%rdi),%rdi
-	sbbq	%rax,%rax
+	sbbq	%rax,%rax  // top carry
 
-	xorq	%rsi,%rsi
+	xorq	%rsi,%rsi  // of=0, cf=0
 	movq	%rax,16+8(%rsp)
 	jmp	.Lsqrx8x_tail
 
@@ -3270,7 +3270,7 @@
 	adcxq	%rax,%r10
 	adoxq	%r12,%r11
 
-.byte	0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00
+.byte	0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00  // mulx	8*4(%rbp),%rax,%r12
 	adcxq	%rax,%r11
 	adoxq	%r13,%r12
 
@@ -3283,21 +3283,21 @@
 	adoxq	%r15,%r14
 
 	mulxq	56(%rbp),%rax,%r15
-	movq	72+48+8(%rsp,%rcx,8),%rdx
+	movq	72+48+8(%rsp,%rcx,8),%rdx  // pull n0*ai
 	adcxq	%rax,%r14
 	adoxq	%rsi,%r15
-	movq	%rbx,(%rdi,%rcx,8)
+	movq	%rbx,(%rdi,%rcx,8)  // save result
 	movq	%r8,%rbx
-	adcxq	%rsi,%r15
+	adcxq	%rsi,%r15  // cf=0
 
-	incq	%rcx
+	incq	%rcx  // of=0
 	jnz	.Lsqrx8x_tail
 
-	cmpq	0+8(%rsp),%rbp
-	jae	.Lsqrx8x_tail_done
+	cmpq	0+8(%rsp),%rbp  // end of n?
+	jae	.Lsqrx8x_tail_done  // break out of loop
 
-	subq	16+8(%rsp),%rsi
-	movq	48+8(%rsp),%rdx
+	subq	16+8(%rsp),%rsi  // mov 16(%rsp),%cf
+	movq	48+8(%rsp),%rdx  // pull n0*a0
 	leaq	64(%rbp),%rbp
 	adcq	0(%rdi),%r8
 	adcq	8(%rdi),%r9
@@ -3309,16 +3309,16 @@
 	adcq	56(%rdi),%r15
 	leaq	64(%rdi),%rdi
 	sbbq	%rax,%rax
-	subq	$8,%rcx
+	subq	$8,%rcx  // mov	$-8,%rcx
 
-	xorq	%rsi,%rsi
+	xorq	%rsi,%rsi  // of=0, cf=0
 	movq	%rax,16+8(%rsp)
 	jmp	.Lsqrx8x_tail
 
 .align	32
 .Lsqrx8x_tail_done:
 	xorq	%rax,%rax
-	addq	24+8(%rsp),%r8
+	addq	24+8(%rsp),%r8  // can this overflow?
 	adcq	$0,%r9
 	adcq	$0,%r10
 	adcq	$0,%r11
@@ -3328,26 +3328,26 @@
 	adcq	$0,%r15
 	adcq	$0,%rax
 
-	subq	16+8(%rsp),%rsi
-.Lsqrx8x_no_tail:
+	subq	16+8(%rsp),%rsi  // mov 16(%rsp),%cf
+.Lsqrx8x_no_tail:  // %cf is 0 if jumped here
 	adcq	0(%rdi),%r8
 	movq	%xmm3,%rcx
 	adcq	8(%rdi),%r9
 	movq	56(%rbp),%rsi
-	movq	%xmm2,%rbp
+	movq	%xmm2,%rbp  // restore %rbp
 	adcq	16(%rdi),%r10
 	adcq	24(%rdi),%r11
 	adcq	32(%rdi),%r12
 	adcq	40(%rdi),%r13
 	adcq	48(%rdi),%r14
 	adcq	56(%rdi),%r15
-	adcq	$0,%rax
+	adcq	$0,%rax  // top-most carry
 
-	movq	32+8(%rsp),%rbx
-	movq	64(%rdi,%rcx,1),%rdx
+	movq	32+8(%rsp),%rbx  // n0
+	movq	64(%rdi,%rcx,1),%rdx  // modulo-scheduled "%r8"
 
-	movq	%r8,0(%rdi)
-	leaq	64(%rdi),%r8
+	movq	%r8,0(%rdi)  // store top 512 bits
+	leaq	64(%rdi),%r8  // borrow %r8
 	movq	%r9,8(%rdi)
 	movq	%r10,16(%rdi)
 	movq	%r11,24(%rdi)
@@ -3356,8 +3356,8 @@
 	movq	%r14,48(%rdi)
 	movq	%r15,56(%rdi)
 
-	leaq	64(%rdi,%rcx,1),%rdi
-	cmpq	8+8(%rsp),%r8
+	leaq	64(%rdi,%rcx,1),%rdi  // start of current t window
+	cmpq	8+8(%rsp),%r8  // end of t?
 	jb	.Lsqrx8x_reduction_loop
 	ret
 .cfi_endproc	
@@ -3367,14 +3367,14 @@
 __bn_postx4x_internal:
 .cfi_startproc	
 	movq	0(%rbp),%r12
-	movq	%rcx,%r10
-	movq	%rcx,%r9
+	movq	%rcx,%r10  // -%r9
+	movq	%rcx,%r9  // -%r9
 	negq	%rax
 	sarq	$3+2,%rcx
-
-	movq	%xmm1,%rdx
-	movq	%xmm1,%rsi
-	decq	%r12
+// lea	48+8(%rsp,%r9),%rdi
+	movq	%xmm1,%rdx  // restore %rdx
+	movq	%xmm1,%rsi  // prepare for back-to-back call
+	decq	%r12  // so that after 'not' we get -n0
 	movq	8(%rbp),%r13
 	xorq	%r8,%r8
 	movq	16(%rbp),%r14
@@ -3394,7 +3394,7 @@
 	andnq	%rax,%r14,%r14
 	andnq	%rax,%r15,%r15
 
-	negq	%r8
+	negq	%r8  // mov %r8,%cf
 	adcq	0(%rdi),%r12
 	adcq	8(%rdi),%r13
 	adcq	16(%rdi),%r14
@@ -3402,7 +3402,7 @@
 	movq	%r12,0(%rdx)
 	leaq	32(%rdi),%rdi
 	movq	%r13,8(%rdx)
-	sbbq	%r8,%r8
+	sbbq	%r8,%r8  // mov %cf,%r8
 	movq	%r14,16(%rdx)
 	movq	%r15,24(%rdx)
 	leaq	32(%rdx),%rdx
@@ -3410,7 +3410,7 @@
 	incq	%rcx
 	jnz	.Lsqrx4x_sub
 
-	negq	%r9
+	negq	%r9  // restore %r9
 
 	ret
 .cfi_endproc	
@@ -3425,13 +3425,13 @@
 	cmpl	$0,%esi
 	jz	.Lscatter_epilogue
 
-
-
-
-
-
-
-
+// %rdx stores 32 entries, t0 through t31. Each entry has %esi words.
+// They are interleaved in memory as follows:
+// 
+// t00      t10      t20      ... t310
+// t01      t11      t21      ... t311
+// ...
+// t0%esi-1 t1%esi-1 t2%esi-1 ... t31%esi-1
 
 	leaq	(%rdx,%rcx,8),%rdx
 .Lscatter:
@@ -3452,97 +3452,97 @@
 .align	32
 bn_gather5:
 .cfi_startproc	
-.LSEH_begin_bn_gather5:
+.LSEH_begin_bn_gather5:  // Win64 thing, but harmless in other cases
 _CET_ENDBR
-
-.byte	0x4c,0x8d,0x14,0x24
+// I can't trust assembler to use specific encoding:-(
+.byte	0x4c,0x8d,0x14,0x24  // lea    (%rsp),%r10
 .cfi_def_cfa_register	%r10
-.byte	0x48,0x81,0xec,0x08,0x01,0x00,0x00
+.byte	0x48,0x81,0xec,0x08,0x01,0x00,0x00  // sub	$0x108,%rsp
 	leaq	.Linc(%rip),%rax
-	andq	$-16,%rsp
+	andq	$-16,%rsp  // shouldn't be formally required
 
 	movd	%ecx,%xmm5
-	movdqa	0(%rax),%xmm0
-	movdqa	16(%rax),%xmm1
-	leaq	128(%rdx),%r11
-	leaq	128(%rsp),%rax
+	movdqa	0(%rax),%xmm0  // 00000001000000010000000000000000
+	movdqa	16(%rax),%xmm1  // 00000002000000020000000200000002
+	leaq	128(%rdx),%r11  // size optimization
+	leaq	128(%rsp),%rax  // size optimization
 
-	pshufd	$0,%xmm5,%xmm5
+	pshufd	$0,%xmm5,%xmm5  // broadcast %ecx
 	movdqa	%xmm1,%xmm4
 	movdqa	%xmm1,%xmm2
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 	movdqa	%xmm4,%xmm3
 
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,-128(%rax)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,-112(%rax)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,-96(%rax)
 	movdqa	%xmm4,%xmm2
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 	movdqa	%xmm3,-80(%rax)
 	movdqa	%xmm4,%xmm3
 
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,-64(%rax)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,-48(%rax)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,-32(%rax)
 	movdqa	%xmm4,%xmm2
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 	movdqa	%xmm3,-16(%rax)
 	movdqa	%xmm4,%xmm3
 
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,0(%rax)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,16(%rax)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,32(%rax)
 	movdqa	%xmm4,%xmm2
 	paddd	%xmm0,%xmm1
-	pcmpeqd	%xmm5,%xmm0
+	pcmpeqd	%xmm5,%xmm0  // compare to 1,0
 	movdqa	%xmm3,48(%rax)
 	movdqa	%xmm4,%xmm3
 
 	paddd	%xmm1,%xmm2
-	pcmpeqd	%xmm5,%xmm1
+	pcmpeqd	%xmm5,%xmm1  // compare to 3,2
 	movdqa	%xmm0,64(%rax)
 	movdqa	%xmm4,%xmm0
 
 	paddd	%xmm2,%xmm3
-	pcmpeqd	%xmm5,%xmm2
+	pcmpeqd	%xmm5,%xmm2  // compare to 5,4
 	movdqa	%xmm1,80(%rax)
 	movdqa	%xmm4,%xmm1
 
 	paddd	%xmm3,%xmm0
-	pcmpeqd	%xmm5,%xmm3
+	pcmpeqd	%xmm5,%xmm3  // compare to 7,6
 	movdqa	%xmm2,96(%rax)
 	movdqa	%xmm4,%xmm2
 	movdqa	%xmm3,112(%rax)
@@ -3602,10 +3602,10 @@
 	por	%xmm3,%xmm5
 	por	%xmm5,%xmm4
 	leaq	256(%r11),%r11
-
-	pshufd	$0x4e,%xmm4,%xmm0
+// Combine the upper and lower halves of %xmm0.
+	pshufd	$0x4e,%xmm4,%xmm0  // Swap upper and lower halves.
 	por	%xmm4,%xmm0
-	movq	%xmm0,(%rdi)
+	movq	%xmm0,(%rdi)  // m0=bp0
 	leaq	8(%rdi),%rdi
 	subl	$1,%esi
 	jnz	.Lgather

boringssl-0.20260708.tar.xz/gen/bcm/x86_64-mont5-win.asm -> boringssl-0.20260813.tar.xz/gen/bcm/x86_64-mont5-win.asm Changed

@@ -32,12 +32,12 @@
 
 
 _CET_ENDBR
-
-
+; num is declared as an int, a 32-bit parameter, so the upper half is
+; undefined. Zero the upper half to normalize it.
 	mov	r9d,r9d
 	mov	rax,rsp
 
-	movd	xmm5,DWORD56+rsp
+	movd	xmm5,DWORD56+rsp  ; load 7th argument
 	push	rbx
 
 	push	rbp
@@ -53,18 +53,18 @@
 
 	neg	r9
 	mov	r11,rsp
-	lea	r10,((-280))+r9*8+rsp
-	neg	r9
-	and	r10,-1024
-
-
-
-
-
-
-
-
-
+	lea	r10,((-280))+r9*8+rsp  ; future alloca(8*(num+2)+256+8)
+	neg	r9  ; restore %r9
+	and	r10,-1024  ; minimize TLB usage
+
+; An OS-agnostic version of __chkstk.
+; 
+; Some OSes (Windows) insist on stack being "wired" to
+; physical memory in strictly sequential manner, i.e. if stack
+; allocation spans two pages, then reference to farmost one can
+; be punishable by SEGV. But page walking can do good even on
+; other OSes, because it guarantees that villain thread hits
+; the guard page before it can make damage to innocent one...
 	sub	r11,r10
 	and	r11,-4096
 	lea	rsp,r11*1+r10
@@ -81,35 +81,35 @@
 $L$mul_page_walk_done:
 
 	lea	r10,$L$inc
-	mov	QWORD8+r9*8+rsp,rax
+	mov	QWORD8+r9*8+rsp,rax  ; tpnum+1=%rsp
 
 $L$mul_body:
 
-	lea	r12,128+rdx
-	movdqa	xmm0,XMMWORDr10
-	movdqa	xmm1,XMMWORD16+r10
-	lea	r10,((24-112))+r9*8+rsp
+	lea	r12,128+rdx  ; reassign %rdx (+size optimization)
+	movdqa	xmm0,XMMWORDr10  ; 00000001000000010000000000000000
+	movdqa	xmm1,XMMWORD16+r10  ; 00000002000000020000000200000002
+	lea	r10,((24-112))+r9*8+rsp  ; place the mask after tpnum+3 (+ICache optimization)
 	and	r10,-16
 
-	pshufd	xmm5,xmm5,0
+	pshufd	xmm5,xmm5,0  ; broadcast index
 	movdqa	xmm4,xmm1
 	movdqa	xmm2,xmm1
 	paddd	xmm1,xmm0
-	pcmpeqd	xmm0,xmm5
+	pcmpeqd	xmm0,xmm5  ; compare to 1,0
 	DB	0x67
 	movdqa	xmm3,xmm4
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORD112+r10,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD128+r10,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD144+r10,xmm2
 	movdqa	xmm2,xmm4
 
@@ -118,17 +118,17 @@
 	movdqa	XMMWORD160+r10,xmm3
 	movdqa	xmm3,xmm4
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORD176+r10,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD192+r10,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD208+r10,xmm2
 	movdqa	xmm2,xmm4
 
@@ -137,17 +137,17 @@
 	movdqa	XMMWORD224+r10,xmm3
 	movdqa	xmm3,xmm4
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORD240+r10,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD256+r10,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD272+r10,xmm2
 	movdqa	xmm2,xmm4
 
@@ -166,7 +166,7 @@
 
 	pcmpeqd	xmm3,xmm5
 	movdqa	XMMWORD336+r10,xmm2
-	pand	xmm0,XMMWORD64+r12
+	pand	xmm0,XMMWORD64+r12  ; while it's still in register
 
 	pand	xmm1,XMMWORD80+r12
 	pand	xmm2,XMMWORD96+r12
@@ -211,33 +211,33 @@
 	por	xmm0,xmm2
 	por	xmm1,xmm3
 	por	xmm0,xmm1
-
-	pshufd	xmm1,xmm0,0x4e
+; Combine the upper and lower halves of %xmm0.
+	pshufd	xmm1,xmm0,0x4e  ; Swap upper and lower halves.
 	por	xmm0,xmm1
 	lea	r12,256+r12
-	movq	rbx,xmm0
+	movq	rbx,xmm0  ; m0=bp0
 
-	mov	r8,QWORDr8
+	mov	r8,QWORDr8  ; pull n00 value
 	mov	rax,QWORDrsi
 
-	xor	r14,r14
-	xor	r15,r15
+	xor	r14,r14  ; i=0
+	xor	r15,r15  ; j=0
 
 	mov	rbp,r8
-	mul	rbx
+	mul	rbx  ; ap0*bp0
 	mov	r10,rax
 	mov	rax,QWORDrcx
 
-	imul	rbp,r10
+	imul	rbp,r10  ; "tp0"*n0
 	mov	r11,rdx
 
-	mul	rbp
-	add	r10,rax
+	mul	rbp  ; np0*m1
+	add	r10,rax  ; discarded
 	mov	rax,QWORD8+rsi
 	adc	rdx,0
 	mov	r13,rdx
 
-	lea	r15,1+r15
+	lea	r15,1+r15  ; j++
 	jmp	NEAR $L$1st_enter
 
 ALIGN	16
@@ -245,30 +245,30 @@
 	add	r13,rax
 	mov	rax,QWORDr15*8+rsi
 	adc	rdx,0
-	add	r13,r11
+	add	r13,r11  ; npj*m1+apj*bp0
 	mov	r11,r10
 	adc	rdx,0
-	mov	QWORD((-16))+r15*8+rsp,r13
+	mov	QWORD((-16))+r15*8+rsp,r13  ; tpj-1
 	mov	r13,rdx
 
 $L$1st_enter:
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r11,rax
 	mov	rax,QWORDr15*8+rcx
 	adc	rdx,0
-	lea	r15,1+r15
+	lea	r15,1+r15  ; j++
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	cmp	r15,r9
-	jne	NEAR $L$1st
-
+	jne	NEAR $L$1st  ; note that upon exit %r15==%r9, so
+; they can be used interchangeably
 
 	add	r13,rax
 	adc	rdx,0
-	add	r13,r11
+	add	r13,r11  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-16))+r9*8+rsp,r13
+	mov	QWORD((-16))+r9*8+rsp,r13  ; tpnum-1
 	mov	r13,rdx
 	mov	r11,r10
 
@@ -276,13 +276,13 @@
 	add	r13,r11
 	adc	rdx,0
 	mov	QWORD((-8))+r9*8+rsp,r13
-	mov	QWORDr9*8+rsp,rdx
+	mov	QWORDr9*8+rsp,rdx  ; store upmost overflow bit
 
-	lea	r14,1+r14
+	lea	r14,1+r14  ; i++
 	jmp	NEAR $L$outer
 ALIGN	16
 $L$outer:
-	lea	rdx,((24+128))+r9*8+rsp
+	lea	rdx,((24+128))+r9*8+rsp  ; where 256-byte mask is (+size optimization)
 	and	rdx,-16
 	pxor	xmm4,xmm4
 	pxor	xmm5,xmm5
@@ -335,34 +335,34 @@
 	por	xmm4,xmm2
 	por	xmm5,xmm3
 	por	xmm4,xmm5
-
-	pshufd	xmm0,xmm4,0x4e
+; Combine the upper and lower halves of %xmm4 as %xmm0.
+	pshufd	xmm0,xmm4,0x4e  ; Swap upper and lower halves.
 	por	xmm0,xmm4
 	lea	r12,256+r12
 
-	mov	rax,QWORDrsi
-	movq	rbx,xmm0
+	mov	rax,QWORDrsi  ; ap0
+	movq	rbx,xmm0  ; m0=bpi
 
-	xor	r15,r15
+	xor	r15,r15  ; j=0
 	mov	rbp,r8
 	mov	r10,QWORDrsp
 
-	mul	rbx
-	add	r10,rax
+	mul	rbx  ; ap0*bpi
+	add	r10,rax  ; ap0*bpi+tp0
 	mov	rax,QWORDrcx
 	adc	rdx,0
 
-	imul	rbp,r10
+	imul	rbp,r10  ; tp0*n0
 	mov	r11,rdx
 
-	mul	rbp
-	add	r10,rax
+	mul	rbp  ; np0*m1
+	add	r10,rax  ; discarded
 	mov	rax,QWORD8+rsi
 	adc	rdx,0
-	mov	r10,QWORD8+rsp
+	mov	r10,QWORD8+rsp  ; tp1
 	mov	r13,rdx
 
-	lea	r15,1+r15
+	lea	r15,1+r15  ; j++
 	jmp	NEAR $L$inner_enter
 
 ALIGN	16
@@ -370,78 +370,78 @@
 	add	r13,rax
 	mov	rax,QWORDr15*8+rsi
 	adc	rdx,0
-	add	r13,r10
+	add	r13,r10  ; npj*m1+apj*bpi+tpj
 	mov	r10,QWORDr15*8+rsp
 	adc	rdx,0
-	mov	QWORD((-16))+r15*8+rsp,r13
+	mov	QWORD((-16))+r15*8+rsp,r13  ; tpj-1
 	mov	r13,rdx
 
 $L$inner_enter:
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r11,rax
 	mov	rax,QWORDr15*8+rcx
 	adc	rdx,0
-	add	r10,r11
+	add	r10,r11  ; apj*bpi+tpj
 	mov	r11,rdx
 	adc	r11,0
-	lea	r15,1+r15
+	lea	r15,1+r15  ; j++
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	cmp	r15,r9
-	jne	NEAR $L$inner
-
+	jne	NEAR $L$inner  ; note that upon exit %r15==%r9, so
+; they can be used interchangeably
 	add	r13,rax
 	adc	rdx,0
-	add	r13,r10
+	add	r13,r10  ; npj*m1+apj*bpi+tpj
 	mov	r10,QWORDr9*8+rsp
 	adc	rdx,0
-	mov	QWORD((-16))+r9*8+rsp,r13
+	mov	QWORD((-16))+r9*8+rsp,r13  ; tpnum-1
 	mov	r13,rdx
 
 	xor	rdx,rdx
 	add	r13,r11
 	adc	rdx,0
-	add	r13,r10
+	add	r13,r10  ; pull upmost overflow bit
 	adc	rdx,0
 	mov	QWORD((-8))+r9*8+rsp,r13
-	mov	QWORDr9*8+rsp,rdx
+	mov	QWORDr9*8+rsp,rdx  ; store upmost overflow bit
 
-	lea	r14,1+r14
+	lea	r14,1+r14  ; i++
 	cmp	r14,r9
 	jb	NEAR $L$outer
 
-	xor	r14,r14
-	mov	rax,QWORDrsp
-	lea	rsi,rsp
-	mov	r15,r9
+	xor	r14,r14  ; i=0 and clear CF!
+	mov	rax,QWORDrsp  ; tp0
+	lea	rsi,rsp  ; borrow ap for tp
+	mov	r15,r9  ; j=num
 	jmp	NEAR $L$sub
 ALIGN	16
 $L$sub:	sbb	rax,QWORDr14*8+rcx
-	mov	QWORDr14*8+rdi,rax
-	mov	rax,QWORD8+r14*8+rsi
-	lea	r14,1+r14
-	dec	r15
+	mov	QWORDr14*8+rdi,rax  ; rpi=tpi-npi
+	mov	rax,QWORD8+r14*8+rsi  ; tpi+1
+	lea	r14,1+r14  ; i++
+	dec	r15  ; doesn't affect CF!
 	jnz	NEAR $L$sub
 
-	sbb	rax,0
+	sbb	rax,0  ; handle upmost overflow bit
 	mov	rbx,-1
 	xor	rbx,rax
 	xor	r14,r14
-	mov	r15,r9
+	mov	r15,r9  ; j=num
 
-$L$copy:
+$L$copy:  ; conditional copy
 	mov	rcx,QWORDr14*8+rdi
 	mov	rdx,QWORDr14*8+rsp
 	and	rcx,rbx
 	and	rdx,rax
-	mov	QWORDr14*8+rsp,r14
+	mov	QWORDr14*8+rsp,r14  ; zap temporary vector
 	or	rdx,rcx
-	mov	QWORDr14*8+rdi,rdx
+	mov	QWORDr14*8+rdi,rdx  ; rpi=tpi
 	lea	r14,1+r14
 	sub	r15,1
 	jnz	NEAR $L$copy
 
-	mov	rsi,QWORD8+r9*8+rsp
+	mov	rsi,QWORD8+r9*8+rsp  ; restore %rsp
 
 	mov	rax,1
 
@@ -501,36 +501,36 @@
 $L$mul4x_prologue:
 
 	DB	0x67
-
-
-
-	shl	r9d,3
-	lea	r10,r9*2+r9
-	neg	r9
-
-
-
-
-
-
-
-
-
-
+; num is declared as an int, a 32-bit parameter, so the upper half is
+; undefined. It is important that this write to %r9, which zeros the
+; upper half, predates the first access.
+	shl	r9d,3  ; convert %r9 to bytes
+	lea	r10,r9*2+r9  ; 3*%r9 in bytes
+	neg	r9  ; -%r9
+
+; #############################################################
+; Ensure that stack frame doesn't alias with +3*%r9
+; modulo 4096, which covers retnum, amnum and nnum
+; (see bn_exp.c). This is done to allow memory disambiguation
+; logic do its magic. Extra num is allocated in order
+; to align with bn_power5's frame, which is cleansed after
+; completing exponentiation. Extra 256 bytes is for power mask
+; calculated from 7th argument, the index.
+; 
 	lea	r11,((-320))+r9*2+rsp
 	mov	rbp,rsp
 	sub	r11,rdi
 	and	r11,4095
 	cmp	r10,r11
 	jb	NEAR $L$mul4xsp_alt
-	sub	rbp,r11
-	lea	rbp,((-320))+r9*2+rbp
+	sub	rbp,r11  ; align with %rdi
+	lea	rbp,((-320))+r9*2+rbp  ; future alloca(frame+2*num*8+256)
 	jmp	NEAR $L$mul4xsp_done
 
 ALIGN	32
 $L$mul4xsp_alt:
 	lea	r10,((4096-320))+r9*2
-	lea	rbp,((-320))+r9*2+rbp
+	lea	rbp,((-320))+r9*2+rbp  ; future alloca(frame+2*num*8+256)
 	sub	r11,r10
 	mov	r10,0
 	cmovc	r11,r10
@@ -561,7 +561,7 @@
 
 	call	mul4x_internal
 
-	mov	rsi,QWORD40+rsp
+	mov	rsi,QWORD40+rsp  ; restore %rsp
 
 	mov	rax,1
 
@@ -590,36 +590,36 @@
 ALIGN	32
 mul4x_internal:
 
-	shl	r9,5
-	movd	xmm5,DWORD56+rax
+	shl	r9,5  ; %r9 was in bytes
+	movd	xmm5,DWORD56+rax  ; load 7th argument, index
 	lea	rax,$L$inc
-	lea	r13,128+r9*1+rdx
-	shr	r9,5
-	movdqa	xmm0,XMMWORDrax
-	movdqa	xmm1,XMMWORD16+rax
-	lea	r10,((88-112))+r9*1+rsp
-	lea	r12,128+rdx
-
-	pshufd	xmm5,xmm5,0
+	lea	r13,128+r9*1+rdx  ; end of powers table (+size optimization)
+	shr	r9,5  ; restore %r9
+	movdqa	xmm0,XMMWORDrax  ; 00000001000000010000000000000000
+	movdqa	xmm1,XMMWORD16+rax  ; 00000002000000020000000200000002
+	lea	r10,((88-112))+r9*1+rsp  ; place the mask after tpnum+1 (+ICache optimization)
+	lea	r12,128+rdx  ; size optimization
+
+	pshufd	xmm5,xmm5,0  ; broadcast index
 	movdqa	xmm4,xmm1
 	DB	0x67,0x67
 	movdqa	xmm2,xmm1
 	paddd	xmm1,xmm0
-	pcmpeqd	xmm0,xmm5
+	pcmpeqd	xmm0,xmm5  ; compare to 1,0
 	DB	0x67
 	movdqa	xmm3,xmm4
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORD112+r10,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD128+r10,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD144+r10,xmm2
 	movdqa	xmm2,xmm4
 
@@ -628,17 +628,17 @@
 	movdqa	XMMWORD160+r10,xmm3
 	movdqa	xmm3,xmm4
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORD176+r10,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD192+r10,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD208+r10,xmm2
 	movdqa	xmm2,xmm4
 
@@ -647,17 +647,17 @@
 	movdqa	XMMWORD224+r10,xmm3
 	movdqa	xmm3,xmm4
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORD240+r10,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD256+r10,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD272+r10,xmm2
 	movdqa	xmm2,xmm4
 
@@ -676,7 +676,7 @@
 
 	pcmpeqd	xmm3,xmm5
 	movdqa	XMMWORD336+r10,xmm2
-	pand	xmm0,XMMWORD64+r12
+	pand	xmm0,XMMWORD64+r12  ; while it's still in register
 
 	pand	xmm1,XMMWORD80+r12
 	pand	xmm2,XMMWORD96+r12
@@ -721,31 +721,31 @@
 	por	xmm0,xmm2
 	por	xmm1,xmm3
 	por	xmm0,xmm1
-
-	pshufd	xmm1,xmm0,0x4e
+; Combine the upper and lower halves of %xmm0.
+	pshufd	xmm1,xmm0,0x4e  ; Swap upper and lower halves.
 	por	xmm0,xmm1
 	lea	r12,256+r12
-	movq	rbx,xmm0
+	movq	rbx,xmm0  ; m0=bp0
 
-	mov	QWORD((16+8))+rsp,r13
-	mov	QWORD((56+8))+rsp,rdi
+	mov	QWORD((16+8))+rsp,r13  ; save end of bnum
+	mov	QWORD((56+8))+rsp,rdi  ; save %rdi
 
-	mov	r8,QWORDr8
+	mov	r8,QWORDr8  ; pull n00 value
 	mov	rax,QWORDrsi
-	lea	rsi,r9*1+rsi
+	lea	rsi,r9*1+rsi  ; end of anum
 	neg	r9
 
 	mov	rbp,r8
-	mul	rbx
+	mul	rbx  ; ap0*bp0
 	mov	r10,rax
 	mov	rax,QWORDrcx
 
-	imul	rbp,r10
+	imul	rbp,r10  ; "tp0"*n0
 	lea	r14,((64+8))+rsp
 	mov	r11,rdx
 
-	mul	rbp
-	add	r10,rax
+	mul	rbp  ; np0*m1
+	add	r10,rax  ; discarded
 	mov	rax,QWORD8+r9*1+rsi
 	adc	rdx,0
 	mov	rdi,rdx
@@ -761,7 +761,7 @@
 	mov	rax,QWORD16+r9*1+rsi
 	adc	rdx,0
 	add	rdi,r11
-	lea	r15,32+r9
+	lea	r15,32+r9  ; j=4
 	lea	rcx,32+rcx
 	adc	rdx,0
 	mov	QWORDr14,rdi
@@ -770,103 +770,103 @@
 
 ALIGN	32
 $L$1st4x:
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r10,rax
 	mov	rax,QWORD((-16))+rcx
 	lea	r14,32+r14
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	r13,rax
 	mov	rax,QWORD((-8))+r15*1+rsi
 	adc	rdx,0
-	add	r13,r10
+	add	r13,r10  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-24))+r14,r13
+	mov	QWORD((-24))+r14,r13  ; tpj-1
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r11,rax
 	mov	rax,QWORD((-8))+rcx
 	adc	rdx,0
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
 	mov	rax,QWORDr15*1+rsi
 	adc	rdx,0
-	add	rdi,r11
+	add	rdi,r11  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-16))+r14,rdi
+	mov	QWORD((-16))+r14,rdi  ; tpj-1
 	mov	r13,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r10,rax
 	mov	rax,QWORDrcx
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	r13,rax
 	mov	rax,QWORD8+r15*1+rsi
 	adc	rdx,0
-	add	r13,r10
+	add	r13,r10  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-8))+r14,r13
+	mov	QWORD((-8))+r14,r13  ; tpj-1
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r11,rax
 	mov	rax,QWORD8+rcx
 	adc	rdx,0
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
 	mov	rax,QWORD16+r15*1+rsi
 	adc	rdx,0
-	add	rdi,r11
+	add	rdi,r11  ; npj*m1+apj*bp0
 	lea	rcx,32+rcx
 	adc	rdx,0
-	mov	QWORDr14,rdi
+	mov	QWORDr14,rdi  ; tpj-1
 	mov	r13,rdx
 
-	add	r15,32
+	add	r15,32  ; j+=4
 	jnz	NEAR $L$1st4x
 
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r10,rax
 	mov	rax,QWORD((-16))+rcx
 	lea	r14,32+r14
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	r13,rax
 	mov	rax,QWORD((-8))+rsi
 	adc	rdx,0
-	add	r13,r10
+	add	r13,r10  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-24))+r14,r13
+	mov	QWORD((-24))+r14,r13  ; tpj-1
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bp0
 	add	r11,rax
 	mov	rax,QWORD((-8))+rcx
 	adc	rdx,0
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
-	mov	rax,QWORDr9*1+rsi
+	mov	rax,QWORDr9*1+rsi  ; ap0
 	adc	rdx,0
-	add	rdi,r11
+	add	rdi,r11  ; npj*m1+apj*bp0
 	adc	rdx,0
-	mov	QWORD((-16))+r14,rdi
+	mov	QWORD((-16))+r14,rdi  ; tpj-1
 	mov	r13,rdx
 
-	lea	rcx,r9*1+rcx
+	lea	rcx,r9*1+rcx  ; rewind %rcx
 
 	xor	rdi,rdi
 	add	r13,r10
@@ -877,7 +877,7 @@
 
 ALIGN	32
 $L$outer4x:
-	lea	rdx,((16+128))+r14
+	lea	rdx,((16+128))+r14  ; where 256-byte mask is (+size optimization)
 	pxor	xmm4,xmm4
 	pxor	xmm5,xmm5
 	movdqa	xmm0,XMMWORD((-128))+r12
@@ -929,45 +929,45 @@
 	por	xmm4,xmm2
 	por	xmm5,xmm3
 	por	xmm4,xmm5
-
-	pshufd	xmm0,xmm4,0x4e
+; Combine the upper and lower halves of %xmm4 as %xmm0.
+	pshufd	xmm0,xmm4,0x4e  ; Swap upper and lower halves.
 	por	xmm0,xmm4
 	lea	r12,256+r12
-	movq	rbx,xmm0
+	movq	rbx,xmm0  ; m0=bpi
 
 	mov	r10,QWORDr9*1+r14
 	mov	rbp,r8
-	mul	rbx
-	add	r10,rax
+	mul	rbx  ; ap0*bpi
+	add	r10,rax  ; ap0*bpi+tp0
 	mov	rax,QWORDrcx
 	adc	rdx,0
 
-	imul	rbp,r10
+	imul	rbp,r10  ; tp0*n0
 	mov	r11,rdx
-	mov	QWORDr14,rdi
+	mov	QWORDr14,rdi  ; store upmost overflow bit
 
-	lea	r14,r9*1+r14
+	lea	r14,r9*1+r14  ; rewind %r14
 
-	mul	rbp
-	add	r10,rax
+	mul	rbp  ; np0*m1
+	add	r10,rax  ; "%r13", discarded
 	mov	rax,QWORD8+r9*1+rsi
 	adc	rdx,0
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r11,rax
 	mov	rax,QWORD8+rcx
 	adc	rdx,0
-	add	r11,QWORD8+r14
+	add	r11,QWORD8+r14  ; +tp1
 	adc	rdx,0
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
 	mov	rax,QWORD16+r9*1+rsi
 	adc	rdx,0
-	add	rdi,r11
-	lea	r15,32+r9
+	add	rdi,r11  ; npj*m1+apj*bpi+tpj
+	lea	r15,32+r9  ; j=4
 	lea	rcx,32+rcx
 	adc	rdx,0
 	mov	r13,rdx
@@ -975,25 +975,25 @@
 
 ALIGN	32
 $L$inner4x:
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r10,rax
 	mov	rax,QWORD((-16))+rcx
 	adc	rdx,0
-	add	r10,QWORD16+r14
+	add	r10,QWORD16+r14  ; apj*bpi+tpj
 	lea	r14,32+r14
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	r13,rax
 	mov	rax,QWORD((-8))+r15*1+rsi
 	adc	rdx,0
 	add	r13,r10
 	adc	rdx,0
-	mov	QWORD((-32))+r14,rdi
+	mov	QWORD((-32))+r14,rdi  ; tpj-1
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r11,rax
 	mov	rax,QWORD((-8))+rcx
 	adc	rdx,0
@@ -1001,33 +1001,33 @@
 	adc	rdx,0
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
 	mov	rax,QWORDr15*1+rsi
 	adc	rdx,0
 	add	rdi,r11
 	adc	rdx,0
-	mov	QWORD((-24))+r14,r13
+	mov	QWORD((-24))+r14,r13  ; tpj-1
 	mov	r13,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r10,rax
 	mov	rax,QWORDrcx
 	adc	rdx,0
-	add	r10,QWORDr14
+	add	r10,QWORDr14  ; apj*bpi+tpj
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	r13,rax
 	mov	rax,QWORD8+r15*1+rsi
 	adc	rdx,0
 	add	r13,r10
 	adc	rdx,0
-	mov	QWORD((-16))+r14,rdi
+	mov	QWORD((-16))+r14,rdi  ; tpj-1
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r11,rax
 	mov	rax,QWORD8+rcx
 	adc	rdx,0
@@ -1035,38 +1035,38 @@
 	adc	rdx,0
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
 	mov	rax,QWORD16+r15*1+rsi
 	adc	rdx,0
 	add	rdi,r11
 	lea	rcx,32+rcx
 	adc	rdx,0
-	mov	QWORD((-8))+r14,r13
+	mov	QWORD((-8))+r14,r13  ; tpj-1
 	mov	r13,rdx
 
-	add	r15,32
+	add	r15,32  ; j+=4
 	jnz	NEAR $L$inner4x
 
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r10,rax
 	mov	rax,QWORD((-16))+rcx
 	adc	rdx,0
-	add	r10,QWORD16+r14
+	add	r10,QWORD16+r14  ; apj*bpi+tpj
 	lea	r14,32+r14
 	adc	rdx,0
 	mov	r11,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	r13,rax
 	mov	rax,QWORD((-8))+rsi
 	adc	rdx,0
 	add	r13,r10
 	adc	rdx,0
-	mov	QWORD((-32))+r14,rdi
+	mov	QWORD((-32))+r14,rdi  ; tpj-1
 	mov	rdi,rdx
 
-	mul	rbx
+	mul	rbx  ; apj*bpi
 	add	r11,rax
 	mov	rax,rbp
 	mov	rbp,QWORD((-8))+rcx
@@ -1075,39 +1075,39 @@
 	adc	rdx,0
 	mov	r10,rdx
 
-	mul	rbp
+	mul	rbp  ; npj*m1
 	add	rdi,rax
-	mov	rax,QWORDr9*1+rsi
+	mov	rax,QWORDr9*1+rsi  ; ap0
 	adc	rdx,0
 	add	rdi,r11
 	adc	rdx,0
-	mov	QWORD((-24))+r14,r13
+	mov	QWORD((-24))+r14,r13  ; tpj-1
 	mov	r13,rdx
 
-	mov	QWORD((-16))+r14,rdi
-	lea	rcx,r9*1+rcx
+	mov	QWORD((-16))+r14,rdi  ; tpj-1
+	lea	rcx,r9*1+rcx  ; rewind %rcx
 
 	xor	rdi,rdi
 	add	r13,r10
 	adc	rdi,0
-	add	r13,QWORDr14
-	adc	rdi,0
+	add	r13,QWORDr14  ; pull upmost overflow bit
+	adc	rdi,0  ; upmost overflow bit
 	mov	QWORD((-8))+r14,r13
 
 	cmp	r12,QWORD((16+8))+rsp
 	jb	NEAR $L$outer4x
 	xor	rax,rax
-	sub	rbp,r13
-	adc	r15,r15
+	sub	rbp,r13  ; compare top-most words
+	adc	r15,r15  ; %r15 is zero
 	or	rdi,r15
-	sub	rax,rdi
-	lea	rbx,r9*1+r14
+	sub	rax,rdi  ; %rax=-%rdi
+	lea	rbx,r9*1+r14  ; tptr in .sqr4x_sub
 	mov	r12,QWORDrcx
-	lea	rbp,rcx
+	lea	rbp,rcx  ; nptr in .sqr4x_sub
 	mov	rcx,r9
 	sar	rcx,3+2
-	mov	rdi,QWORD((56+8))+rsp
-	dec	r12
+	mov	rdi,QWORD((56+8))+rsp  ; rptr in .sqr4x_sub
+	dec	r12  ; so that after 'not' we get -n0
 	xor	r10,r10
 	mov	r13,QWORD8+rbp
 	mov	r14,QWORD16+rbp
@@ -1149,35 +1149,35 @@
 
 $L$power5_prologue:
 
-
-
-
-	shl	r9d,3
-	lea	r10d,r9*2+r9
+; num is declared as an int, a 32-bit parameter, so the upper half is
+; undefined. It is important that this write to %r9, which zeros the
+; upper half, come before the first access.
+	shl	r9d,3  ; convert %r9 to bytes
+	lea	r10d,r9*2+r9  ; 3*%r9
 	neg	r9
-	mov	r8,QWORDr8
-
-
-
-
-
-
-
-
+	mov	r8,QWORDr8  ; *n0
+
+; #############################################################
+; Ensure that stack frame doesn't alias with %rdi+3*%r9
+; modulo 4096, which covers retnum, amnum and nnum
+; (see bn_exp.c). This is done to allow memory disambiguation
+; logic do its magic. Extra 256 bytes is for power mask
+; calculated from 7th argument, the index.
+; 
 	lea	r11,((-320))+r9*2+rsp
 	mov	rbp,rsp
 	sub	r11,rdi
 	and	r11,4095
 	cmp	r10,r11
 	jb	NEAR $L$pwr_sp_alt
-	sub	rbp,r11
-	lea	rbp,((-320))+r9*2+rbp
+	sub	rbp,r11  ; align with %rsi
+	lea	rbp,((-320))+r9*2+rbp  ; future alloca(frame+2*num*8+256)
 	jmp	NEAR $L$pwr_sp_done
 
 ALIGN	32
 $L$pwr_sp_alt:
 	lea	r10,((4096-320))+r9*2
-	lea	rbp,((-320))+r9*2+rbp
+	lea	rbp,((-320))+r9*2+rbp  ; future alloca(frame+2*num*8+256)
 	sub	r11,r10
 	mov	r10,0
 	cmovc	r11,r10
@@ -1203,22 +1203,22 @@
 	mov	r10,r9
 	neg	r9
 
-
-
-
-
-
-
-
-
-
+; #############################################################
+; Stack layout
+; 
+; +0	saved %r9, used in reduction section
+; +8	&t2*%r9, used in reduction section
+; +32	saved *n0
+; +40	saved %rsp
+; +48	t2*%r9
+; 
 	mov	QWORD32+rsp,r8
-	mov	QWORD40+rsp,rax
+	mov	QWORD40+rsp,rax  ; save original %rsp
 
 $L$power5_body:
-	movq	xmm1,rdi
-	movq	xmm2,rcx
-	movq	xmm3,r10
+	movq	xmm1,rdi  ; save %rdi, used in sqr8x
+	movq	xmm2,rcx  ; save %rcx
+	movq	xmm3,r10  ; -%r9, used in sqr8x
 	movq	xmm4,rdx
 
 	call	__bn_sqr8x_internal
@@ -1240,7 +1240,7 @@
 
 	call	mul4x_internal
 
-	mov	rsi,QWORD40+rsp
+	mov	rsi,QWORD40+rsp  ; restore %rsp
 
 	mov	rax,1
 	mov	r15,QWORD((-48))+rsi
@@ -1272,261 +1272,261 @@
 __bn_sqr8x_internal:
 
 _CET_ENDBR
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-	lea	rbp,32+r10
-	lea	rsi,r9*1+rsi
-
-	mov	rcx,r9
-
-
-	mov	r14,QWORD((-32))+rbp*1+rsi
-	lea	rdi,((48+8))+r9*2+rsp
-	mov	rax,QWORD((-24))+rbp*1+rsi
-	lea	rdi,((-32))+rbp*1+rdi
-	mov	rbx,QWORD((-16))+rbp*1+rsi
+; #############################################################
+; Squaring part:
+; 
+; a) multiply-n-add everything but ai*ai;
+; b) shift result of a) by 1 to the left and accumulate
+; ai*ai products;
+; 
+; #############################################################
+; a1a0
+; a2a0
+; a3a0
+; a2a1
+; a4a0
+; a3a1
+; a5a0
+; a4a1
+; a3a2
+; a6a0
+; a5a1
+; a4a2
+; a7a0
+; a6a1
+; a5a2
+; a4a3
+; a7a1
+; a6a2
+; a5a3
+; a7a2
+; a6a3
+; a5a4
+; a7a3
+; a6a4
+; a7a4
+; a6a5
+; a7a5
+; a7a6
+; a1a0
+; a2a0
+; a3a0
+; a4a0
+; a5a0
+; a6a0
+; a7a0
+; a2a1
+; a3a1
+; a4a1
+; a5a1
+; a6a1
+; a7a1
+; a3a2
+; a4a2
+; a5a2
+; a6a2
+; a7a2
+; a4a3
+; a5a3
+; a6a3
+; a7a3
+; a5a4
+; a6a4
+; a7a4
+; a6a5
+; a7a5
+; a7a6
+; a0a0
+; a1a1
+; a2a2
+; a3a3
+; a4a4
+; a5a5
+; a6a6
+; a7a7
+
+	lea	rbp,32+r10  ; %rbp=-(%r9-32)
+	lea	rsi,r9*1+rsi  ; end of a buffer, (%rsi,%rbp)=&ap2
+
+	mov	rcx,r9  ; %rcx=%r9
+
+; comments apply to %r9==8 case
+	mov	r14,QWORD((-32))+rbp*1+rsi  ; a0
+	lea	rdi,((48+8))+r9*2+rsp  ; end of tp buffer, &tp2*%r9
+	mov	rax,QWORD((-24))+rbp*1+rsi  ; a1
+	lea	rdi,((-32))+rbp*1+rdi  ; end of tp window, &tp2*%r9-"%rbp"
+	mov	rbx,QWORD((-16))+rbp*1+rsi  ; a2
 	mov	r15,rax
 
-	mul	r14
-	mov	r10,rax
-	mov	rax,rbx
+	mul	r14  ; a1*a0
+	mov	r10,rax  ; a1*a0
+	mov	rax,rbx  ; a2
 	mov	r11,rdx
-	mov	QWORD((-24))+rbp*1+rdi,r10
+	mov	QWORD((-24))+rbp*1+rdi,r10  ; t1
 
-	mul	r14
+	mul	r14  ; a2*a0
 	add	r11,rax
 	mov	rax,rbx
 	adc	rdx,0
-	mov	QWORD((-16))+rbp*1+rdi,r11
+	mov	QWORD((-16))+rbp*1+rdi,r11  ; t2
 	mov	r10,rdx
 
 
-	mov	rbx,QWORD((-8))+rbp*1+rsi
-	mul	r15
-	mov	r12,rax
+	mov	rbx,QWORD((-8))+rbp*1+rsi  ; a3
+	mul	r15  ; a2*a1
+	mov	r12,rax  ; a2*a1+t3
 	mov	rax,rbx
 	mov	r13,rdx
 
 	lea	rcx,rbp
-	mul	r14
-	add	r10,rax
+	mul	r14  ; a3*a0
+	add	r10,rax  ; a3*a0+a2*a1+t3
 	mov	rax,rbx
 	mov	r11,rdx
 	adc	r11,0
 	add	r10,r12
 	adc	r11,0
-	mov	QWORD((-8))+rcx*1+rdi,r10
+	mov	QWORD((-8))+rcx*1+rdi,r10  ; t3
 	jmp	NEAR $L$sqr4x_1st
 
 ALIGN	32
 $L$sqr4x_1st:
-	mov	rbx,QWORDrcx*1+rsi
-	mul	r15
-	add	r13,rax
+	mov	rbx,QWORDrcx*1+rsi  ; a4
+	mul	r15  ; a3*a1
+	add	r13,rax  ; a3*a1+t4
 	mov	rax,rbx
 	mov	r12,rdx
 	adc	r12,0
 
-	mul	r14
-	add	r11,rax
-	mov	rax,rbx
-	mov	rbx,QWORD8+rcx*1+rsi
+	mul	r14  ; a4*a0
+	add	r11,rax  ; a4*a0+a3*a1+t4
+	mov	rax,rbx  ; a3
+	mov	rbx,QWORD8+rcx*1+rsi  ; a5
 	mov	r10,rdx
 	adc	r10,0
 	add	r11,r13
 	adc	r10,0
 
 
-	mul	r15
-	add	r12,rax
+	mul	r15  ; a4*a3
+	add	r12,rax  ; a4*a3+t5
 	mov	rax,rbx
-	mov	QWORDrcx*1+rdi,r11
+	mov	QWORDrcx*1+rdi,r11  ; t4
 	mov	r13,rdx
 	adc	r13,0
 
-	mul	r14
-	add	r10,rax
+	mul	r14  ; a5*a2
+	add	r10,rax  ; a5*a2+a4*a3+t5
 	mov	rax,rbx
-	mov	rbx,QWORD16+rcx*1+rsi
+	mov	rbx,QWORD16+rcx*1+rsi  ; a6
 	mov	r11,rdx
 	adc	r11,0
 	add	r10,r12
 	adc	r11,0
 
-	mul	r15
-	add	r13,rax
+	mul	r15  ; a5*a3
+	add	r13,rax  ; a5*a3+t6
 	mov	rax,rbx
-	mov	QWORD8+rcx*1+rdi,r10
+	mov	QWORD8+rcx*1+rdi,r10  ; t5
 	mov	r12,rdx
 	adc	r12,0
 
-	mul	r14
-	add	r11,rax
-	mov	rax,rbx
-	mov	rbx,QWORD24+rcx*1+rsi
+	mul	r14  ; a6*a2
+	add	r11,rax  ; a6*a2+a5*a3+t6
+	mov	rax,rbx  ; a3
+	mov	rbx,QWORD24+rcx*1+rsi  ; a7
 	mov	r10,rdx
 	adc	r10,0
 	add	r11,r13
 	adc	r10,0
 
 
-	mul	r15
-	add	r12,rax
+	mul	r15  ; a6*a5
+	add	r12,rax  ; a6*a5+t7
 	mov	rax,rbx
-	mov	QWORD16+rcx*1+rdi,r11
+	mov	QWORD16+rcx*1+rdi,r11  ; t6
 	mov	r13,rdx
 	adc	r13,0
 	lea	rcx,32+rcx
 
-	mul	r14
-	add	r10,rax
+	mul	r14  ; a7*a4
+	add	r10,rax  ; a7*a4+a6*a5+t6
 	mov	rax,rbx
 	mov	r11,rdx
 	adc	r11,0
 	add	r10,r12
 	adc	r11,0
-	mov	QWORD((-8))+rcx*1+rdi,r10
+	mov	QWORD((-8))+rcx*1+rdi,r10  ; t7
 
 	cmp	rcx,0
 	jne	NEAR $L$sqr4x_1st
 
-	mul	r15
+	mul	r15  ; a7*a5
 	add	r13,rax
 	lea	rbp,16+rbp
 	adc	rdx,0
 	add	r13,r11
 	adc	rdx,0
 
-	mov	QWORDrdi,r13
+	mov	QWORDrdi,r13  ; t8
 	mov	r12,rdx
-	mov	QWORD8+rdi,rdx
+	mov	QWORD8+rdi,rdx  ; t9
 	jmp	NEAR $L$sqr4x_outer
 
 ALIGN	32
-$L$sqr4x_outer:
-	mov	r14,QWORD((-32))+rbp*1+rsi
-	lea	rdi,((48+8))+r9*2+rsp
-	mov	rax,QWORD((-24))+rbp*1+rsi
-	lea	rdi,((-32))+rbp*1+rdi
-	mov	rbx,QWORD((-16))+rbp*1+rsi
+$L$sqr4x_outer:  ; comments apply to %r9==6 case
+	mov	r14,QWORD((-32))+rbp*1+rsi  ; a0
+	lea	rdi,((48+8))+r9*2+rsp  ; end of tp buffer, &tp2*%r9
+	mov	rax,QWORD((-24))+rbp*1+rsi  ; a1
+	lea	rdi,((-32))+rbp*1+rdi  ; end of tp window, &tp2*%r9-"%rbp"
+	mov	rbx,QWORD((-16))+rbp*1+rsi  ; a2
 	mov	r15,rax
 
-	mul	r14
-	mov	r10,QWORD((-24))+rbp*1+rdi
-	add	r10,rax
-	mov	rax,rbx
+	mul	r14  ; a1*a0
+	mov	r10,QWORD((-24))+rbp*1+rdi  ; t1
+	add	r10,rax  ; a1*a0+t1
+	mov	rax,rbx  ; a2
 	adc	rdx,0
-	mov	QWORD((-24))+rbp*1+rdi,r10
+	mov	QWORD((-24))+rbp*1+rdi,r10  ; t1
 	mov	r11,rdx
 
-	mul	r14
+	mul	r14  ; a2*a0
 	add	r11,rax
 	mov	rax,rbx
 	adc	rdx,0
-	add	r11,QWORD((-16))+rbp*1+rdi
+	add	r11,QWORD((-16))+rbp*1+rdi  ; a2*a0+t2
 	mov	r10,rdx
 	adc	r10,0
-	mov	QWORD((-16))+rbp*1+rdi,r11
+	mov	QWORD((-16))+rbp*1+rdi,r11  ; t2
 
 	xor	r12,r12
 
-	mov	rbx,QWORD((-8))+rbp*1+rsi
-	mul	r15
-	add	r12,rax
+	mov	rbx,QWORD((-8))+rbp*1+rsi  ; a3
+	mul	r15  ; a2*a1
+	add	r12,rax  ; a2*a1+t3
 	mov	rax,rbx
 	adc	rdx,0
 	add	r12,QWORD((-8))+rbp*1+rdi
 	mov	r13,rdx
 	adc	r13,0
 
-	mul	r14
-	add	r10,rax
+	mul	r14  ; a3*a0
+	add	r10,rax  ; a3*a0+a2*a1+t3
 	mov	rax,rbx
 	adc	rdx,0
 	add	r10,r12
 	mov	r11,rdx
 	adc	r11,0
-	mov	QWORD((-8))+rbp*1+rdi,r10
+	mov	QWORD((-8))+rbp*1+rdi,r10  ; t3
 
 	lea	rcx,rbp
 	jmp	NEAR $L$sqr4x_inner
 
 ALIGN	32
 $L$sqr4x_inner:
-	mov	rbx,QWORDrcx*1+rsi
-	mul	r15
-	add	r13,rax
+	mov	rbx,QWORDrcx*1+rsi  ; a4
+	mul	r15  ; a3*a1
+	add	r13,rax  ; a3*a1+t4
 	mov	rax,rbx
 	mov	r12,rdx
 	adc	r12,0
@@ -1534,254 +1534,254 @@
 	adc	r12,0
 
 	DB	0x67
-	mul	r14
-	add	r11,rax
-	mov	rax,rbx
-	mov	rbx,QWORD8+rcx*1+rsi
+	mul	r14  ; a4*a0
+	add	r11,rax  ; a4*a0+a3*a1+t4
+	mov	rax,rbx  ; a3
+	mov	rbx,QWORD8+rcx*1+rsi  ; a5
 	mov	r10,rdx
 	adc	r10,0
 	add	r11,r13
 	adc	r10,0
 
-	mul	r15
-	add	r12,rax
-	mov	QWORDrcx*1+rdi,r11
+	mul	r15  ; a4*a3
+	add	r12,rax  ; a4*a3+t5
+	mov	QWORDrcx*1+rdi,r11  ; t4
 	mov	rax,rbx
 	mov	r13,rdx
 	adc	r13,0
 	add	r12,QWORD8+rcx*1+rdi
-	lea	rcx,16+rcx
+	lea	rcx,16+rcx  ; j++
 	adc	r13,0
 
-	mul	r14
-	add	r10,rax
+	mul	r14  ; a5*a2
+	add	r10,rax  ; a5*a2+a4*a3+t5
 	mov	rax,rbx
 	adc	rdx,0
 	add	r10,r12
 	mov	r11,rdx
 	adc	r11,0
-	mov	QWORD((-8))+rcx*1+rdi,r10
+	mov	QWORD((-8))+rcx*1+rdi,r10  ; t5, "preloaded t1" below
 
 	cmp	rcx,0
 	jne	NEAR $L$sqr4x_inner
 
 	DB	0x67
-	mul	r15
+	mul	r15  ; a5*a3
 	add	r13,rax
 	adc	rdx,0
 	add	r13,r11
 	adc	rdx,0
 
-	mov	QWORDrdi,r13
+	mov	QWORDrdi,r13  ; t6, "preloaded t2" below
 	mov	r12,rdx
-	mov	QWORD8+rdi,rdx
+	mov	QWORD8+rdi,rdx  ; t7, "preloaded t3" below
 
 	add	rbp,16
 	jnz	NEAR $L$sqr4x_outer
 
-
-	mov	r14,QWORD((-32))+rsi
-	lea	rdi,((48+8))+r9*2+rsp
-	mov	rax,QWORD((-24))+rsi
-	lea	rdi,((-32))+rbp*1+rdi
-	mov	rbx,QWORD((-16))+rsi
+; comments apply to %r9==4 case
+	mov	r14,QWORD((-32))+rsi  ; a0
+	lea	rdi,((48+8))+r9*2+rsp  ; end of tp buffer, &tp2*%r9
+	mov	rax,QWORD((-24))+rsi  ; a1
+	lea	rdi,((-32))+rbp*1+rdi  ; end of tp window, &tp2*%r9-"%rbp"
+	mov	rbx,QWORD((-16))+rsi  ; a2
 	mov	r15,rax
 
-	mul	r14
-	add	r10,rax
-	mov	rax,rbx
+	mul	r14  ; a1*a0
+	add	r10,rax  ; a1*a0+t1, preloaded t1
+	mov	rax,rbx  ; a2
 	mov	r11,rdx
 	adc	r11,0
 
-	mul	r14
+	mul	r14  ; a2*a0
 	add	r11,rax
 	mov	rax,rbx
-	mov	QWORD((-24))+rdi,r10
+	mov	QWORD((-24))+rdi,r10  ; t1
 	mov	r10,rdx
 	adc	r10,0
-	add	r11,r13
-	mov	rbx,QWORD((-8))+rsi
+	add	r11,r13  ; a2*a0+t2, preloaded t2
+	mov	rbx,QWORD((-8))+rsi  ; a3
 	adc	r10,0
 
-	mul	r15
-	add	r12,rax
+	mul	r15  ; a2*a1
+	add	r12,rax  ; a2*a1+t3, preloaded t3
 	mov	rax,rbx
-	mov	QWORD((-16))+rdi,r11
+	mov	QWORD((-16))+rdi,r11  ; t2
 	mov	r13,rdx
 	adc	r13,0
 
-	mul	r14
-	add	r10,rax
+	mul	r14  ; a3*a0
+	add	r10,rax  ; a3*a0+a2*a1+t3
 	mov	rax,rbx
 	mov	r11,rdx
 	adc	r11,0
 	add	r10,r12
 	adc	r11,0
-	mov	QWORD((-8))+rdi,r10
+	mov	QWORD((-8))+rdi,r10  ; t3
 
-	mul	r15
+	mul	r15  ; a3*a1
 	add	r13,rax
-	mov	rax,QWORD((-16))+rsi
+	mov	rax,QWORD((-16))+rsi  ; a2
 	adc	rdx,0
 	add	r13,r11
 	adc	rdx,0
 
-	mov	QWORDrdi,r13
+	mov	QWORDrdi,r13  ; t4
 	mov	r12,rdx
-	mov	QWORD8+rdi,rdx
+	mov	QWORD8+rdi,rdx  ; t5
 
-	mul	rbx
+	mul	rbx  ; a2*a3
 	add	rbp,16
 	xor	r14,r14
-	sub	rbp,r9
+	sub	rbp,r9  ; %rbp=16-%r9
 	xor	r15,r15
 
-	add	rax,r12
+	add	rax,r12  ; t5
 	adc	rdx,0
-	mov	QWORD8+rdi,rax
-	mov	QWORD16+rdi,rdx
-	mov	QWORD24+rdi,r15
+	mov	QWORD8+rdi,rax  ; t5
+	mov	QWORD16+rdi,rdx  ; t6
+	mov	QWORD24+rdi,r15  ; t7
 
-	mov	rax,QWORD((-16))+rbp*1+rsi
+	mov	rax,QWORD((-16))+rbp*1+rsi  ; a0
 	lea	rdi,((48+8))+rsp
-	xor	r10,r10
-	mov	r11,QWORD8+rdi
+	xor	r10,r10  ; t0
+	mov	r11,QWORD8+rdi  ; t1
 
-	lea	r12,r10*2+r14
+	lea	r12,r10*2+r14  ; t2*i<<1 | shift
 	shr	r10,63
-	lea	r13,r11*2+rcx
+	lea	r13,r11*2+rcx  ; t2*i+1<<1 |
 	shr	r11,63
-	or	r13,r10
-	mov	r10,QWORD16+rdi
-	mov	r14,r11
-	mul	rax
-	neg	r15
-	mov	r11,QWORD24+rdi
+	or	r13,r10  ; | t2*i>>63
+	mov	r10,QWORD16+rdi  ; t2*i+2	# prefetch
+	mov	r14,r11  ; shift=t2*i+1>>63
+	mul	rax  ; ai*ai
+	neg	r15  ; mov %r15,cf
+	mov	r11,QWORD24+rdi  ; t2*i+2+1	# prefetch
 	adc	r12,rax
-	mov	rax,QWORD((-8))+rbp*1+rsi
+	mov	rax,QWORD((-8))+rbp*1+rsi  ; ai+1	# prefetch
 	mov	QWORDrdi,r12
 	adc	r13,rdx
 
-	lea	rbx,r10*2+r14
+	lea	rbx,r10*2+r14  ; t2*i<<1 | shift
 	mov	QWORD8+rdi,r13
-	sbb	r15,r15
+	sbb	r15,r15  ; mov cf,%r15
 	shr	r10,63
-	lea	r8,r11*2+rcx
+	lea	r8,r11*2+rcx  ; t2*i+1<<1 |
 	shr	r11,63
-	or	r8,r10
-	mov	r10,QWORD32+rdi
-	mov	r14,r11
-	mul	rax
-	neg	r15
-	mov	r11,QWORD40+rdi
+	or	r8,r10  ; | t2*i>>63
+	mov	r10,QWORD32+rdi  ; t2*i+2	# prefetch
+	mov	r14,r11  ; shift=t2*i+1>>63
+	mul	rax  ; ai*ai
+	neg	r15  ; mov %r15,cf
+	mov	r11,QWORD40+rdi  ; t2*i+2+1	# prefetch
 	adc	rbx,rax
-	mov	rax,QWORDrbp*1+rsi
+	mov	rax,QWORDrbp*1+rsi  ; ai+1	# prefetch
 	mov	QWORD16+rdi,rbx
 	adc	r8,rdx
 	lea	rbp,16+rbp
 	mov	QWORD24+rdi,r8
-	sbb	r15,r15
+	sbb	r15,r15  ; mov cf,%r15
 	lea	rdi,64+rdi
 	jmp	NEAR $L$sqr4x_shift_n_add
 
 ALIGN	32
 $L$sqr4x_shift_n_add:
-	lea	r12,r10*2+r14
+	lea	r12,r10*2+r14  ; t2*i<<1 | shift
 	shr	r10,63
-	lea	r13,r11*2+rcx
+	lea	r13,r11*2+rcx  ; t2*i+1<<1 |
 	shr	r11,63
-	or	r13,r10
-	mov	r10,QWORD((-16))+rdi
-	mov	r14,r11
-	mul	rax
-	neg	r15
-	mov	r11,QWORD((-8))+rdi
+	or	r13,r10  ; | t2*i>>63
+	mov	r10,QWORD((-16))+rdi  ; t2*i+2	# prefetch
+	mov	r14,r11  ; shift=t2*i+1>>63
+	mul	rax  ; ai*ai
+	neg	r15  ; mov %r15,cf
+	mov	r11,QWORD((-8))+rdi  ; t2*i+2+1	# prefetch
 	adc	r12,rax
-	mov	rax,QWORD((-8))+rbp*1+rsi
+	mov	rax,QWORD((-8))+rbp*1+rsi  ; ai+1	# prefetch
 	mov	QWORD((-32))+rdi,r12
 	adc	r13,rdx
 
-	lea	rbx,r10*2+r14
+	lea	rbx,r10*2+r14  ; t2*i<<1 | shift
 	mov	QWORD((-24))+rdi,r13
-	sbb	r15,r15
+	sbb	r15,r15  ; mov cf,%r15
 	shr	r10,63
-	lea	r8,r11*2+rcx
+	lea	r8,r11*2+rcx  ; t2*i+1<<1 |
 	shr	r11,63
-	or	r8,r10
-	mov	r10,QWORDrdi
-	mov	r14,r11
-	mul	rax
-	neg	r15
-	mov	r11,QWORD8+rdi
+	or	r8,r10  ; | t2*i>>63
+	mov	r10,QWORDrdi  ; t2*i+2	# prefetch
+	mov	r14,r11  ; shift=t2*i+1>>63
+	mul	rax  ; ai*ai
+	neg	r15  ; mov %r15,cf
+	mov	r11,QWORD8+rdi  ; t2*i+2+1	# prefetch
 	adc	rbx,rax
-	mov	rax,QWORDrbp*1+rsi
+	mov	rax,QWORDrbp*1+rsi  ; ai+1	# prefetch
 	mov	QWORD((-16))+rdi,rbx
 	adc	r8,rdx
 
-	lea	r12,r10*2+r14
+	lea	r12,r10*2+r14  ; t2*i<<1 | shift
 	mov	QWORD((-8))+rdi,r8
-	sbb	r15,r15
+	sbb	r15,r15  ; mov cf,%r15
 	shr	r10,63
-	lea	r13,r11*2+rcx
+	lea	r13,r11*2+rcx  ; t2*i+1<<1 |
 	shr	r11,63
-	or	r13,r10
-	mov	r10,QWORD16+rdi
-	mov	r14,r11
-	mul	rax
-	neg	r15
-	mov	r11,QWORD24+rdi
+	or	r13,r10  ; | t2*i>>63
+	mov	r10,QWORD16+rdi  ; t2*i+2	# prefetch
+	mov	r14,r11  ; shift=t2*i+1>>63
+	mul	rax  ; ai*ai
+	neg	r15  ; mov %r15,cf
+	mov	r11,QWORD24+rdi  ; t2*i+2+1	# prefetch
 	adc	r12,rax
-	mov	rax,QWORD8+rbp*1+rsi
+	mov	rax,QWORD8+rbp*1+rsi  ; ai+1	# prefetch
 	mov	QWORDrdi,r12
 	adc	r13,rdx
 
-	lea	rbx,r10*2+r14
+	lea	rbx,r10*2+r14  ; t2*i<<1 | shift
 	mov	QWORD8+rdi,r13
-	sbb	r15,r15
+	sbb	r15,r15  ; mov cf,%r15
 	shr	r10,63
-	lea	r8,r11*2+rcx
+	lea	r8,r11*2+rcx  ; t2*i+1<<1 |
 	shr	r11,63
-	or	r8,r10
-	mov	r10,QWORD32+rdi
-	mov	r14,r11
-	mul	rax
-	neg	r15
-	mov	r11,QWORD40+rdi
+	or	r8,r10  ; | t2*i>>63
+	mov	r10,QWORD32+rdi  ; t2*i+2	# prefetch
+	mov	r14,r11  ; shift=t2*i+1>>63
+	mul	rax  ; ai*ai
+	neg	r15  ; mov %r15,cf
+	mov	r11,QWORD40+rdi  ; t2*i+2+1	# prefetch
 	adc	rbx,rax
-	mov	rax,QWORD16+rbp*1+rsi
+	mov	rax,QWORD16+rbp*1+rsi  ; ai+1	# prefetch
 	mov	QWORD16+rdi,rbx
 	adc	r8,rdx
 	mov	QWORD24+rdi,r8
-	sbb	r15,r15
+	sbb	r15,r15  ; mov cf,%r15
 	lea	rdi,64+rdi
 	add	rbp,32
 	jnz	NEAR $L$sqr4x_shift_n_add
 
-	lea	r12,r10*2+r14
+	lea	r12,r10*2+r14  ; t2*i<<1 | shift
 	DB	0x67
 	shr	r10,63
-	lea	r13,r11*2+rcx
+	lea	r13,r11*2+rcx  ; t2*i+1<<1 |
 	shr	r11,63
-	or	r13,r10
-	mov	r10,QWORD((-16))+rdi
-	mov	r14,r11
-	mul	rax
-	neg	r15
-	mov	r11,QWORD((-8))+rdi
+	or	r13,r10  ; | t2*i>>63
+	mov	r10,QWORD((-16))+rdi  ; t2*i+2	# prefetch
+	mov	r14,r11  ; shift=t2*i+1>>63
+	mul	rax  ; ai*ai
+	neg	r15  ; mov %r15,cf
+	mov	r11,QWORD((-8))+rdi  ; t2*i+2+1	# prefetch
 	adc	r12,rax
-	mov	rax,QWORD((-8))+rsi
+	mov	rax,QWORD((-8))+rsi  ; ai+1	# prefetch
 	mov	QWORD((-32))+rdi,r12
 	adc	r13,rdx
 
-	lea	rbx,r10*2+r14
+	lea	rbx,r10*2+r14  ; t2*i<<1|shift
 	mov	QWORD((-24))+rdi,r13
-	sbb	r15,r15
+	sbb	r15,r15  ; mov cf,%r15
 	shr	r10,63
-	lea	r8,r11*2+rcx
+	lea	r8,r11*2+rcx  ; t2*i+1<<1 |
 	shr	r11,63
-	or	r8,r10
-	mul	rax
-	neg	r15
+	or	r8,r10  ; | t2*i>>63
+	mul	rax  ; ai*ai
+	neg	r15  ; mov %r15,cf
 	adc	rbx,rax
 	adc	r8,rdx
 	mov	QWORD((-16))+rdi,rbx
@@ -1789,17 +1789,17 @@
 	movq	rbp,xmm2
 __bn_sqr8x_reduction:
 	xor	rax,rax
-	lea	rcx,rbp*1+r9
-	lea	rdx,((48+8))+r9*2+rsp
+	lea	rcx,rbp*1+r9  ; end of n
+	lea	rdx,((48+8))+r9*2+rsp  ; end of t buffer
 	mov	QWORD((0+8))+rsp,rcx
-	lea	rdi,((48+8))+r9*1+rsp
+	lea	rdi,((48+8))+r9*1+rsp  ; end of initial t window
 	mov	QWORD((8+8))+rsp,rdx
 	neg	r9
 	jmp	NEAR $L$8x_reduction_loop
 
 ALIGN	32
 $L$8x_reduction_loop:
-	lea	rdi,r9*1+rdi
+	lea	rdi,r9*1+rdi  ; start of current t window
 	DB	0x66
 	mov	rbx,QWORDrdi
 	mov	r9,QWORD8+rdi
@@ -1809,20 +1809,20 @@
 	mov	r13,QWORD40+rdi
 	mov	r14,QWORD48+rdi
 	mov	r15,QWORD56+rdi
-	mov	QWORDrdx,rax
+	mov	QWORDrdx,rax  ; store top-most carry bit
 	lea	rdi,64+rdi
 
 	DB	0x67
 	mov	r8,rbx
-	imul	rbx,QWORD((32+8))+rsp
-	mov	rax,QWORDrbp
+	imul	rbx,QWORD((32+8))+rsp  ; n0*a0
+	mov	rax,QWORDrbp  ; n0
 	mov	ecx,8
 	jmp	NEAR $L$8x_reduce
 
 ALIGN	32
 $L$8x_reduce:
 	mul	rbx
-	mov	rax,QWORD8+rbp
+	mov	rax,QWORD8+rbp  ; n1
 	neg	r8
 	mov	r8,rdx
 	adc	r8,0
@@ -1832,7 +1832,7 @@
 	mov	rax,QWORD16+rbp
 	adc	rdx,0
 	add	r8,r9
-	mov	QWORD((48-8+8))+rcx*8+rsp,rbx
+	mov	QWORD((48-8+8))+rcx*8+rsp,rbx  ; put aside n0*ai
 	mov	r9,rdx
 	adc	r9,0
 
@@ -1841,7 +1841,7 @@
 	mov	rax,QWORD24+rbp
 	adc	rdx,0
 	add	r9,r10
-	mov	rsi,QWORD((32+8))+rsp
+	mov	rsi,QWORD((32+8))+rsp  ; pull n0, borrow %rsi
 	mov	r10,rdx
 	adc	r10,0
 
@@ -1849,7 +1849,7 @@
 	add	r11,rax
 	mov	rax,QWORD32+rbp
 	adc	rdx,0
-	imul	rsi,r8
+	imul	rsi,r8  ; modulo-scheduled
 	add	r10,r11
 	mov	r11,rdx
 	adc	r11,0
@@ -1879,9 +1879,9 @@
 	adc	r14,0
 
 	mul	rbx
-	mov	rbx,rsi
+	mov	rbx,rsi  ; n0*ai
 	add	r15,rax
-	mov	rax,QWORDrbp
+	mov	rax,QWORDrbp  ; n0
 	adc	rdx,0
 	add	r14,r15
 	mov	r15,rdx
@@ -1892,8 +1892,8 @@
 
 	lea	rbp,64+rbp
 	xor	rax,rax
-	mov	rdx,QWORD((8+8))+rsp
-	cmp	rbp,QWORD((0+8))+rsp
+	mov	rdx,QWORD((8+8))+rsp  ; pull end of t
+	cmp	rbp,QWORD((0+8))+rsp  ; end of n?
 	jae	NEAR $L$8x_no_tail
 
 	DB	0x66
@@ -1905,9 +1905,9 @@
 	adc	r13,QWORD40+rdi
 	adc	r14,QWORD48+rdi
 	adc	r15,QWORD56+rdi
-	sbb	rsi,rsi
+	sbb	rsi,rsi  ; top carry
 
-	mov	rbx,QWORD((48+56+8))+rsp
+	mov	rbx,QWORD((48+56+8))+rsp  ; pull n0*a0
 	mov	ecx,8
 	mov	rax,QWORDrbp
 	jmp	NEAR $L$8x_tail
@@ -1917,7 +1917,7 @@
 	mul	rbx
 	add	r8,rax
 	mov	rax,QWORD8+rbp
-	mov	QWORDrdi,r8
+	mov	QWORDrdi,r8  ; save result
 	mov	r8,rdx
 	adc	r8,0
 
@@ -1926,7 +1926,7 @@
 	mov	rax,QWORD16+rbp
 	adc	rdx,0
 	add	r8,r9
-	lea	rdi,8+rdi
+	lea	rdi,8+rdi  ; %rdi++
 	mov	r9,rdx
 	adc	r9,0
 
@@ -1971,11 +1971,11 @@
 	adc	r14,0
 
 	mul	rbx
-	mov	rbx,QWORD((48-16+8))+rcx*8+rsp
+	mov	rbx,QWORD((48-16+8))+rcx*8+rsp  ; pull n0*ai
 	add	r15,rax
 	adc	rdx,0
 	add	r14,r15
-	mov	rax,QWORDrbp
+	mov	rax,QWORDrbp  ; pull n0
 	mov	r15,rdx
 	adc	r15,0
 
@@ -1983,13 +1983,13 @@
 	jnz	NEAR $L$8x_tail
 
 	lea	rbp,64+rbp
-	mov	rdx,QWORD((8+8))+rsp
-	cmp	rbp,QWORD((0+8))+rsp
-	jae	NEAR $L$8x_tail_done
+	mov	rdx,QWORD((8+8))+rsp  ; pull end of t
+	cmp	rbp,QWORD((0+8))+rsp  ; end of n?
+	jae	NEAR $L$8x_tail_done  ; break out of loop
 
-	mov	rbx,QWORD((48+56+8))+rsp
+	mov	rbx,QWORD((48+56+8))+rsp  ; pull n0*a0
 	neg	rsi
-	mov	rax,QWORDrbp
+	mov	rax,QWORDrbp  ; pull n0
 	adc	r8,QWORDrdi
 	adc	r9,QWORD8+rdi
 	adc	r10,QWORD16+rdi
@@ -1998,7 +1998,7 @@
 	adc	r13,QWORD40+rdi
 	adc	r14,QWORD48+rdi
 	adc	r15,QWORD56+rdi
-	sbb	rsi,rsi
+	sbb	rsi,rsi  ; top carry
 
 	mov	ecx,8
 	jmp	NEAR $L$8x_tail
@@ -2006,7 +2006,7 @@
 ALIGN	32
 $L$8x_tail_done:
 	xor	rax,rax
-	add	r8,QWORDrdx
+	add	r8,QWORDrdx  ; can this overflow?
 	adc	r9,0
 	adc	r10,0
 	adc	r11,0
@@ -2026,15 +2026,15 @@
 	adc	r13,QWORD40+rdi
 	adc	r14,QWORD48+rdi
 	adc	r15,QWORD56+rdi
-	adc	rax,0
-	mov	rcx,QWORD((-8))+rbp
+	adc	rax,0  ; top-most carry
+	mov	rcx,QWORD((-8))+rbp  ; npnum-1
 	xor	rsi,rsi
 
-	movq	rbp,xmm2
+	movq	rbp,xmm2  ; restore %rbp
 
-	mov	QWORDrdi,r8
+	mov	QWORDrdi,r8  ; store top 512 bits
 	mov	QWORD8+rdi,r9
-	movq	r9,xmm3
+	movq	r9,xmm3  ; %r9 is %r9, can't be moved upwards
 	mov	QWORD16+rdi,r10
 	mov	QWORD24+rdi,r11
 	mov	QWORD32+rdi,r12
@@ -2043,7 +2043,7 @@
 	mov	QWORD56+rdi,r15
 	lea	rdi,64+rdi
 
-	cmp	rdi,rdx
+	cmp	rdi,rdx  ; end of t?
 	jb	NEAR $L$8x_reduction_loop
 	ret
 
@@ -2053,13 +2053,13 @@
 __bn_post4x_internal:
 
 	mov	r12,QWORDrbp
-	lea	rbx,r9*1+rdi
+	lea	rbx,r9*1+rdi  ; %rdi was %rbx above
 	mov	rcx,r9
-	movq	rdi,xmm1
+	movq	rdi,xmm1  ; restore %rdi
 	neg	rax
-	movq	rsi,xmm1
+	movq	rsi,xmm1  ; prepare for back-to-back call
 	sar	rcx,3+2
-	dec	r12
+	dec	r12  ; so that after 'not' we get -n0
 	xor	r10,r10
 	mov	r13,QWORD8+rbp
 	mov	r14,QWORD16+rbp
@@ -2083,7 +2083,7 @@
 	and	r14,rax
 	and	r15,rax
 
-	neg	r10
+	neg	r10  ; mov %r10,%cf
 	adc	r12,QWORDrbx
 	adc	r13,QWORD8+rbx
 	adc	r14,QWORD16+rbx
@@ -2091,16 +2091,16 @@
 	mov	QWORDrdi,r12
 	lea	rbx,32+rbx
 	mov	QWORD8+rdi,r13
-	sbb	r10,r10
+	sbb	r10,r10  ; mov %cf,%r10
 	mov	QWORD16+rdi,r14
 	mov	QWORD24+rdi,r15
 	lea	rdi,32+rdi
 
-	inc	rcx
+	inc	rcx  ; pass %cf
 	jnz	NEAR $L$sqr4x_sub
 
-	mov	r10,r9
-	neg	r9
+	mov	r10,r9  ; prepare for back-to-back call
+	neg	r9  ; restore %r9
 	ret
 
 
@@ -2138,42 +2138,42 @@
 
 $L$mulx4x_prologue:
 
-
-
-
-	shl	r9d,3
-	lea	r10,r9*2+r9
-	neg	r9
-	mov	r8,QWORDr8
-
-
-
-
-
-
-
-
-
-
+; num is declared as an int, a 32-bit parameter, so the upper half is
+; undefined. It is important that this write to %r9, which zeros the
+; upper half, predates the first access.
+	shl	r9d,3  ; convert %r9 to bytes
+	lea	r10,r9*2+r9  ; 3*%r9 in bytes
+	neg	r9  ; -%r9
+	mov	r8,QWORDr8  ; *n0
+
+; #############################################################
+; Ensure that stack frame doesn't alias with +3*%r9
+; modulo 4096, which covers retnum, amnum and nnum
+; (see bn_exp.c). This is done to allow memory disambiguation
+; logic do its magic. Extra num is allocated in order
+; to align with bn_power5's frame, which is cleansed after
+; completing exponentiation. Extra 256 bytes is for power mask
+; calculated from 7th argument, the index.
+; 
 	lea	r11,((-320))+r9*2+rsp
 	mov	rbp,rsp
 	sub	r11,rdi
 	and	r11,4095
 	cmp	r10,r11
 	jb	NEAR $L$mulx4xsp_alt
-	sub	rbp,r11
-	lea	rbp,((-320))+r9*2+rbp
+	sub	rbp,r11  ; align with
+	lea	rbp,((-320))+r9*2+rbp  ; future alloca(frame+2*%r9*8+256)
 	jmp	NEAR $L$mulx4xsp_done
 
 $L$mulx4xsp_alt:
 	lea	r10,((4096-320))+r9*2
-	lea	rbp,((-320))+r9*2+rbp
+	lea	rbp,((-320))+r9*2+rbp  ; future alloca(frame+2*%r9*8+256)
 	sub	r11,r10
 	mov	r10,0
 	cmovc	r11,r10
 	sub	rbp,r11
 $L$mulx4xsp_done:
-	and	rbp,-64
+	and	rbp,-64  ; ensure alignment
 	mov	r11,rsp
 	sub	r11,rbp
 	and	r11,-4096
@@ -2190,25 +2190,25 @@
 	ja	NEAR $L$mulx4x_page_walk
 $L$mulx4x_page_walk_done:
 
-
-
-
-
-
-
-
-
-
-
-
-
-	mov	QWORD32+rsp,r8
-	mov	QWORD40+rsp,rax
+; #############################################################
+; Stack layout
+; +0	-num
+; +8	off-loaded &bi
+; +16	end of bnum
+; +24	inner counter
+; +32	saved n0
+; +40	saved %rsp
+; +48
+; +56	saved rp
+; +64	tmpnum+1
+; 
+	mov	QWORD32+rsp,r8  ; save *n0
+	mov	QWORD40+rsp,rax  ; save original %rsp
 
 $L$mulx4x_body:
 	call	mulx4x_internal
 
-	mov	rsi,QWORD40+rsp
+	mov	rsi,QWORD40+rsp  ; restore %rsp
 
 	mov	rax,1
 
@@ -2237,44 +2237,44 @@
 ALIGN	32
 mulx4x_internal:
 
-	mov	QWORD8+rsp,r9
+	mov	QWORD8+rsp,r9  ; save -%r9 (it was in bytes)
 	mov	r10,r9
-	neg	r9
+	neg	r9  ; restore %r9
 	shl	r9,5
-	neg	r10
-	lea	r13,128+r9*1+rdx
+	neg	r10  ; restore %r9
+	lea	r13,128+r9*1+rdx  ; end of powers table (+size optimization)
 	shr	r9,5+5
-	movd	xmm5,DWORD56+rax
+	movd	xmm5,DWORD56+rax  ; load 7th argument
 	sub	r9,1
 	lea	rax,$L$inc
-	mov	QWORD((16+8))+rsp,r13
-	mov	QWORD((24+8))+rsp,r9
-	mov	QWORD((56+8))+rsp,rdi
-	movdqa	xmm0,XMMWORDrax
-	movdqa	xmm1,XMMWORD16+rax
-	lea	r10,((88-112))+r10*1+rsp
-	lea	rdi,128+rdx
-
-	pshufd	xmm5,xmm5,0
+	mov	QWORD((16+8))+rsp,r13  ; end of bnum
+	mov	QWORD((24+8))+rsp,r9  ; inner counter
+	mov	QWORD((56+8))+rsp,rdi  ; save %rdi
+	movdqa	xmm0,XMMWORDrax  ; 00000001000000010000000000000000
+	movdqa	xmm1,XMMWORD16+rax  ; 00000002000000020000000200000002
+	lea	r10,((88-112))+r10*1+rsp  ; place the mask after tpnum+1 (+ICache optimization)
+	lea	rdi,128+rdx  ; size optimization
+
+	pshufd	xmm5,xmm5,0  ; broadcast index
 	movdqa	xmm4,xmm1
 	DB	0x67
 	movdqa	xmm2,xmm1
 	DB	0x67
 	paddd	xmm1,xmm0
-	pcmpeqd	xmm0,xmm5
+	pcmpeqd	xmm0,xmm5  ; compare to 1,0
 	movdqa	xmm3,xmm4
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORD112+r10,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD128+r10,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD144+r10,xmm2
 	movdqa	xmm2,xmm4
 
@@ -2283,17 +2283,17 @@
 	movdqa	XMMWORD160+r10,xmm3
 	movdqa	xmm3,xmm4
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORD176+r10,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD192+r10,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD208+r10,xmm2
 	movdqa	xmm2,xmm4
 
@@ -2302,17 +2302,17 @@
 	movdqa	XMMWORD224+r10,xmm3
 	movdqa	xmm3,xmm4
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORD240+r10,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD256+r10,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD272+r10,xmm2
 	movdqa	xmm2,xmm4
 
@@ -2332,7 +2332,7 @@
 	pcmpeqd	xmm3,xmm5
 	movdqa	XMMWORD336+r10,xmm2
 
-	pand	xmm0,XMMWORD64+rdi
+	pand	xmm0,XMMWORD64+rdi  ; while it's still in register
 	pand	xmm1,XMMWORD80+rdi
 	pand	xmm2,XMMWORD96+rdi
 	movdqa	XMMWORD352+r10,xmm3
@@ -2376,41 +2376,41 @@
 	por	xmm0,xmm2
 	por	xmm1,xmm3
 	pxor	xmm0,xmm1
-
-	pshufd	xmm1,xmm0,0x4e
+; Combine the upper and lower halves of %xmm0.
+	pshufd	xmm1,xmm0,0x4e  ; Swap upper and lower halves.
 	por	xmm0,xmm1
 	lea	rdi,256+rdi
-	movq	rdx,xmm0
+	movq	rdx,xmm0  ; bp0
 	lea	rbx,((64+32+8))+rsp
 
 	mov	r9,rdx
-	mulx	rax,r8,QWORDrsi
-	mulx	r12,r11,QWORD8+rsi
+	mulx	rax,r8,QWORDrsi  ; a0*b0
+	mulx	r12,r11,QWORD8+rsi  ; a1*b0
 	add	r11,rax
-	mulx	r13,rax,QWORD16+rsi
+	mulx	r13,rax,QWORD16+rsi  ; ...
 	adc	r12,rax
 	adc	r13,0
 	mulx	r14,rax,QWORD24+rsi
 
 	mov	r15,r8
-	imul	r8,QWORD((32+8))+rsp
-	xor	rbp,rbp
+	imul	r8,QWORD((32+8))+rsp  ; "t0"*n0
+	xor	rbp,rbp  ; cf=0, of=0
 	mov	rdx,r8
 
-	mov	QWORD((8+8))+rsp,rdi
+	mov	QWORD((8+8))+rsp,rdi  ; off-load &bi
 
 	lea	rsi,32+rsi
 	adcx	r13,rax
-	adcx	r14,rbp
+	adcx	r14,rbp  ; cf=0
 
 	mulx	r10,rax,QWORDrcx
-	adcx	r15,rax
+	adcx	r15,rax  ; discarded
 	adox	r10,r11
 	mulx	r11,rax,QWORD8+rcx
 	adcx	r10,rax
 	adox	r11,r12
 	mulx	r12,rax,QWORD16+rcx
-	mov	rdi,QWORD((24+8))+rsp
+	mov	rdi,QWORD((24+8))+rsp  ; counter value
 	mov	QWORD((-32))+rbx,r10
 	adcx	r11,rax
 	adox	r12,r13
@@ -2418,25 +2418,25 @@
 	mov	rdx,r9
 	mov	QWORD((-24))+rbx,r11
 	adcx	r12,rax
-	adox	r15,rbp
+	adox	r15,rbp  ; of=0
 	lea	rcx,32+rcx
 	mov	QWORD((-16))+rbx,r12
 	jmp	NEAR $L$mulx4x_1st
 
 ALIGN	32
 $L$mulx4x_1st:
-	adcx	r15,rbp
-	mulx	rax,r10,QWORDrsi
+	adcx	r15,rbp  ; cf=0, modulo-scheduled
+	mulx	rax,r10,QWORDrsi  ; a4*b0
 	adcx	r10,r14
-	mulx	r14,r11,QWORD8+rsi
+	mulx	r14,r11,QWORD8+rsi  ; a5*b0
 	adcx	r11,rax
-	mulx	rax,r12,QWORD16+rsi
+	mulx	rax,r12,QWORD16+rsi  ; ...
 	adcx	r12,r14
 	mulx	r14,r13,QWORD24+rsi
 	DB	0x67,0x67
 	mov	rdx,r8
 	adcx	r13,rax
-	adcx	r14,rbp
+	adcx	r14,rbp  ; cf=0
 	lea	rsi,32+rsi
 	lea	rbx,32+rbx
 
@@ -2460,21 +2460,21 @@
 	lea	rcx,32+rcx
 	mov	QWORD((-16))+rbx,r13
 
-	dec	rdi
+	dec	rdi  ; of=0, pass cf
 	jnz	NEAR $L$mulx4x_1st
 
-	mov	rax,QWORD8+rsp
-	adc	r15,rbp
-	lea	rsi,rax*1+rsi
+	mov	rax,QWORD8+rsp  ; load -num
+	adc	r15,rbp  ; modulo-scheduled
+	lea	rsi,rax*1+rsi  ; rewind %rsi
 	add	r14,r15
-	mov	rdi,QWORD((8+8))+rsp
-	adc	rbp,rbp
+	mov	rdi,QWORD((8+8))+rsp  ; re-load &bi
+	adc	rbp,rbp  ; top-most carry
 	mov	QWORD((-8))+rbx,r14
 	jmp	NEAR $L$mulx4x_outer
 
 ALIGN	32
 $L$mulx4x_outer:
-	lea	r10,((16-256))+rbx
+	lea	r10,((16-256))+rbx  ; where 256-byte mask is (+density control)
 	pxor	xmm4,xmm4
 	DB	0x67,0x67
 	pxor	xmm5,xmm5
@@ -2527,41 +2527,41 @@
 	por	xmm4,xmm2
 	por	xmm5,xmm3
 	por	xmm4,xmm5
-
-	pshufd	xmm0,xmm4,0x4e
+; Combine the upper and lower halves of %xmm4 as %xmm0.
+	pshufd	xmm0,xmm4,0x4e  ; Swap upper and lower halves.
 	por	xmm0,xmm4
 	lea	rdi,256+rdi
-	movq	rdx,xmm0
+	movq	rdx,xmm0  ; m0=bpi
 
-	mov	QWORDrbx,rbp
-	lea	rbx,32+rax*1+rbx
-	mulx	r11,r8,QWORDrsi
-	xor	rbp,rbp
+	mov	QWORDrbx,rbp  ; save top-most carry
+	lea	rbx,32+rax*1+rbx  ; rewind %rbx
+	mulx	r11,r8,QWORDrsi  ; a0*bi
+	xor	rbp,rbp  ; cf=0, of=0
 	mov	r9,rdx
-	mulx	r12,r14,QWORD8+rsi
-	adox	r8,QWORD((-32))+rbx
+	mulx	r12,r14,QWORD8+rsi  ; a1*bi
+	adox	r8,QWORD((-32))+rbx  ; +t0
 	adcx	r11,r14
-	mulx	r13,r15,QWORD16+rsi
+	mulx	r13,r15,QWORD16+rsi  ; ...
 	adox	r11,QWORD((-24))+rbx
 	adcx	r12,r15
 	mulx	r14,rdx,QWORD24+rsi
 	adox	r12,QWORD((-16))+rbx
 	adcx	r13,rdx
-	lea	rcx,rax*1+rcx
+	lea	rcx,rax*1+rcx  ; rewind %rcx
 	lea	rsi,32+rsi
 	adox	r13,QWORD((-8))+rbx
 	adcx	r14,rbp
 	adox	r14,rbp
 
 	mov	r15,r8
-	imul	r8,QWORD((32+8))+rsp
+	imul	r8,QWORD((32+8))+rsp  ; "t0"*n0
 
 	mov	rdx,r8
-	xor	rbp,rbp
-	mov	QWORD((8+8))+rsp,rdi
+	xor	rbp,rbp  ; cf=0, of=0
+	mov	QWORD((8+8))+rsp,rdi  ; off-load &bi
 
 	mulx	r10,rax,QWORDrcx
-	adcx	r15,rax
+	adcx	r15,rax  ; discarded
 	adox	r10,r11
 	mulx	r11,rax,QWORD8+rcx
 	adcx	r10,rax
@@ -2571,24 +2571,24 @@
 	adox	r12,r13
 	mulx	r15,rax,QWORD24+rcx
 	mov	rdx,r9
-	mov	rdi,QWORD((24+8))+rsp
+	mov	rdi,QWORD((24+8))+rsp  ; counter value
 	mov	QWORD((-32))+rbx,r10
 	adcx	r12,rax
 	mov	QWORD((-24))+rbx,r11
-	adox	r15,rbp
+	adox	r15,rbp  ; of=0
 	mov	QWORD((-16))+rbx,r12
 	lea	rcx,32+rcx
 	jmp	NEAR $L$mulx4x_inner
 
 ALIGN	32
 $L$mulx4x_inner:
-	mulx	rax,r10,QWORDrsi
-	adcx	r15,rbp
+	mulx	rax,r10,QWORDrsi  ; a4*bi
+	adcx	r15,rbp  ; cf=0, modulo-scheduled
 	adox	r10,r14
-	mulx	r14,r11,QWORD8+rsi
+	mulx	r14,r11,QWORD8+rsi  ; a5*bi
 	adcx	r10,QWORDrbx
 	adox	r11,rax
-	mulx	rax,r12,QWORD16+rsi
+	mulx	rax,r12,QWORD16+rsi  ; ...
 	adcx	r11,QWORD8+rbx
 	adox	r12,r14
 	mulx	r14,r13,QWORD24+rsi
@@ -2596,10 +2596,10 @@
 	adcx	r12,QWORD16+rbx
 	adox	r13,rax
 	adcx	r13,QWORD24+rbx
-	adox	r14,rbp
+	adox	r14,rbp  ; of=0
 	lea	rsi,32+rsi
 	lea	rbx,32+rbx
-	adcx	r14,rbp
+	adcx	r14,rbp  ; cf=0
 
 	adox	r10,r15
 	mulx	r15,rax,QWORDrcx
@@ -2621,17 +2621,17 @@
 	adox	r15,rbp
 	mov	QWORD((-16))+rbx,r13
 
-	dec	rdi
+	dec	rdi  ; of=0, pass cf
 	jnz	NEAR $L$mulx4x_inner
 
-	mov	rax,QWORD((0+8))+rsp
-	adc	r15,rbp
-	sub	rdi,QWORDrbx
-	mov	rdi,QWORD((8+8))+rsp
+	mov	rax,QWORD((0+8))+rsp  ; load -num
+	adc	r15,rbp  ; modulo-scheduled
+	sub	rdi,QWORDrbx  ; pull top-most carry to %cf
+	mov	rdi,QWORD((8+8))+rsp  ; re-load &bi
 	mov	r10,QWORD((16+8))+rsp
 	adc	r14,r15
-	lea	rsi,rax*1+rsi
-	adc	rbp,rbp
+	lea	rsi,rax*1+rsi  ; rewind %rsi
+	adc	rbp,rbp  ; top-most carry
 	mov	QWORD((-8))+rbx,r14
 
 	cmp	rdi,r10
@@ -2640,23 +2640,23 @@
 	mov	r10,QWORD((-8))+rcx
 	mov	r8,rbp
 	mov	r12,QWORDrax*1+rcx
-	lea	rbp,rax*1+rcx
+	lea	rbp,rax*1+rcx  ; rewind %rcx
 	mov	rcx,rax
-	lea	rdi,rax*1+rbx
+	lea	rdi,rax*1+rbx  ; rewind %rbx
 	xor	eax,eax
 	xor	r15,r15
-	sub	r10,r14
+	sub	r10,r14  ; compare top-most words
 	adc	r15,r15
 	or	r8,r15
 	sar	rcx,3+2
-	sub	rax,r8
-	mov	rdx,QWORD((56+8))+rsp
-	dec	r12
+	sub	rax,r8  ; %rax=-%r8
+	mov	rdx,QWORD((56+8))+rsp  ; restore rp
+	dec	r12  ; so that after 'not' we get -n0
 	mov	r13,QWORD8+rbp
 	xor	r8,r8
 	mov	r14,QWORD16+rbp
 	mov	r15,QWORD24+rbp
-	jmp	NEAR $L$sqrx4x_sub_entry
+	jmp	NEAR $L$sqrx4x_sub_entry  ; common post-condition
 
 
 global	bn_powerx5
@@ -2693,35 +2693,35 @@
 
 $L$powerx5_prologue:
 
-
-
-
-	shl	r9d,3
-	lea	r10,r9*2+r9
+; num is declared as an int, a 32-bit parameter, so the upper half is
+; undefined. It is important that this write to %r9, which zeros the
+; upper half, predates the first access.
+	shl	r9d,3  ; convert %r9 to bytes
+	lea	r10,r9*2+r9  ; 3*%r9 in bytes
 	neg	r9
-	mov	r8,QWORDr8
-
-
-
-
-
-
-
-
+	mov	r8,QWORDr8  ; *n0
+
+; #############################################################
+; Ensure that stack frame doesn't alias with %rdi+3*%r9
+; modulo 4096, which covers retnum, amnum and nnum
+; (see bn_exp.c). This is done to allow memory disambiguation
+; logic do its magic. Extra 256 bytes is for power mask
+; calculated from 7th argument, the index.
+; 
 	lea	r11,((-320))+r9*2+rsp
 	mov	rbp,rsp
 	sub	r11,rdi
 	and	r11,4095
 	cmp	r10,r11
 	jb	NEAR $L$pwrx_sp_alt
-	sub	rbp,r11
-	lea	rbp,((-320))+r9*2+rbp
+	sub	rbp,r11  ; align with %rsi
+	lea	rbp,((-320))+r9*2+rbp  ; future alloca(frame+2*%r9*8+256)
 	jmp	NEAR $L$pwrx_sp_done
 
 ALIGN	32
 $L$pwrx_sp_alt:
 	lea	r10,((4096-320))+r9*2
-	lea	rbp,((-320))+r9*2+rbp
+	lea	rbp,((-320))+r9*2+rbp  ; alloca(frame+2*%r9*8+256)
 	sub	r11,r10
 	mov	r10,0
 	cmovc	r11,r10
@@ -2747,24 +2747,24 @@
 	mov	r10,r9
 	neg	r9
 
-
-
-
-
-
-
-
-
-
-
-
+; #############################################################
+; Stack layout
+; 
+; +0	saved %r9, used in reduction section
+; +8	&t2*%r9, used in reduction section
+; +16	intermediate carry bit
+; +24	top-most carry bit, used in reduction section
+; +32	saved *n0
+; +40	saved %rsp
+; +48	t2*%r9
+; 
 	pxor	xmm0,xmm0
-	movq	xmm1,rdi
-	movq	xmm2,rcx
-	movq	xmm3,r10
+	movq	xmm1,rdi  ; save %rdi
+	movq	xmm2,rcx  ; save %rcx
+	movq	xmm3,r10  ; -%r9
 	movq	xmm4,rdx
 	mov	QWORD32+rsp,r8
-	mov	QWORD40+rsp,rax
+	mov	QWORD40+rsp,rax  ; save original %rsp
 
 $L$powerx5_body:
 
@@ -2779,7 +2779,7 @@
 	call	__bn_sqrx8x_internal
 	call	__bn_postx4x_internal
 
-	mov	r9,r10
+	mov	r9,r10  ; -num
 	mov	rdi,rsi
 	movq	rcx,xmm2
 	movq	rdx,xmm4
@@ -2787,7 +2787,7 @@
 
 	call	mulx4x_internal
 
-	mov	rsi,QWORD40+rsp
+	mov	rsi,QWORD40+rsp  ; restore %rsp
 
 	mov	rax,1
 
@@ -2820,50 +2820,50 @@
 __bn_sqrx8x_internal:
 
 _CET_ENDBR
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+; #################################################################
+; Squaring part:
+; 
+; a) multiply-n-add everything but ai*ai;
+; b) shift result of a) by 1 to the left and accumulate
+; ai*ai products;
+; 
+; #################################################################
+; a7a7a6a6a5a5a4a4a3a3a2a2a1a1a0a0
+; a1a0
+; a2a0
+; a3a0
+; a2a1
+; a3a1
+; a3a2
+; 
+; a4a0
+; a5a0
+; a6a0
+; a7a0
+; a4a1
+; a5a1
+; a6a1
+; a7a1
+; a4a2
+; a5a2
+; a6a2
+; a7a2
+; a4a3
+; a5a3
+; a6a3
+; a7a3
+; 
+; a5a4
+; a6a4
+; a7a4
+; a6a5
+; a7a5
+; a7a6
+; a7a7a6a6a5a5a4a4a3a3a2a2a1a1a0a0
 	lea	rdi,((48+8))+rsp
 	lea	rbp,r9*1+rsi
-	mov	QWORD((0+8))+rsp,r9
-	mov	QWORD((8+8))+rsp,rbp
+	mov	QWORD((0+8))+rsp,r9  ; save %r9
+	mov	QWORD((8+8))+rsp,rbp  ; save end of %rsi
 	jmp	NEAR $L$sqr8x_zero_start
 
 ALIGN	32
@@ -2874,7 +2874,7 @@
 	movdqa	XMMWORD16+rdi,xmm0
 	movdqa	XMMWORD32+rdi,xmm0
 	movdqa	XMMWORD48+rdi,xmm0
-$L$sqr8x_zero_start:
+$L$sqr8x_zero_start:  ; aligned at 32
 	movdqa	XMMWORD64+rdi,xmm0
 	movdqa	XMMWORD80+rdi,xmm0
 	movdqa	XMMWORD96+rdi,xmm0
@@ -2883,8 +2883,8 @@
 	sub	r9,64
 	jnz	NEAR $L$sqrx8x_zero
 
-	mov	rdx,QWORDrsi
-
+	mov	rdx,QWORDrsi  ; a0, modulo-scheduled
+; xor	%r9,%r9			# t1, ex-%r9, zero already
 	xor	r10,r10
 	xor	r11,r11
 	xor	r12,r12
@@ -2892,21 +2892,21 @@
 	xor	r14,r14
 	xor	r15,r15
 	lea	rdi,((48+8))+rsp
-	xor	rbp,rbp
+	xor	rbp,rbp  ; cf=0, cf=0
 	jmp	NEAR $L$sqrx8x_outer_loop
 
 ALIGN	32
 $L$sqrx8x_outer_loop:
-	mulx	rax,r8,QWORD8+rsi
-	adcx	r8,r9
+	mulx	rax,r8,QWORD8+rsi  ; a1*a0
+	adcx	r8,r9  ; a1*a0+=t1
 	adox	r10,rax
-	mulx	rax,r9,QWORD16+rsi
+	mulx	rax,r9,QWORD16+rsi  ; a2*a0
 	adcx	r9,r10
 	adox	r11,rax
-	DB	0xc4,0xe2,0xab,0xf6,0x86,0x18,0x00,0x00,0x00
+	DB	0xc4,0xe2,0xab,0xf6,0x86,0x18,0x00,0x00,0x00  ; mulx	3*8(%rsi),%r10,%rax	# ...
 	adcx	r10,r11
 	adox	r12,rax
-	DB	0xc4,0xe2,0xa3,0xf6,0x86,0x20,0x00,0x00,0x00
+	DB	0xc4,0xe2,0xa3,0xf6,0x86,0x20,0x00,0x00,0x00  ; mulx	4*8(%rsi),%r11,%rax
 	adcx	r11,r12
 	adox	r13,rax
 	mulx	rax,r12,QWORD40+rsi
@@ -2916,97 +2916,97 @@
 	adcx	r13,r14
 	adox	rax,r15
 	mulx	r15,r14,QWORD56+rsi
-	mov	rdx,QWORD8+rsi
+	mov	rdx,QWORD8+rsi  ; a1
 	adcx	r14,rax
 	adox	r15,rbp
 	adc	r15,QWORD64+rdi
-	mov	QWORD8+rdi,r8
-	mov	QWORD16+rdi,r9
-	sbb	rcx,rcx
-	xor	rbp,rbp
+	mov	QWORD8+rdi,r8  ; t1
+	mov	QWORD16+rdi,r9  ; t2
+	sbb	rcx,rcx  ; mov %cf,%rcx
+	xor	rbp,rbp  ; cf=0, of=0
 
 
-	mulx	rbx,r8,QWORD16+rsi
-	mulx	rax,r9,QWORD24+rsi
+	mulx	rbx,r8,QWORD16+rsi  ; a2*a1
+	mulx	rax,r9,QWORD24+rsi  ; a3*a1
 	adcx	r8,r10
 	adox	r9,rbx
-	mulx	rbx,r10,QWORD32+rsi
+	mulx	rbx,r10,QWORD32+rsi  ; ...
 	adcx	r9,r11
 	adox	r10,rax
-	DB	0xc4,0xe2,0xa3,0xf6,0x86,0x28,0x00,0x00,0x00
+	DB	0xc4,0xe2,0xa3,0xf6,0x86,0x28,0x00,0x00,0x00  ; mulx	5*8(%rsi),%r11,%rax
 	adcx	r10,r12
 	adox	r11,rbx
-	DB	0xc4,0xe2,0x9b,0xf6,0x9e,0x30,0x00,0x00,0x00
+	DB	0xc4,0xe2,0x9b,0xf6,0x9e,0x30,0x00,0x00,0x00  ; mulx	6*8(%rsi),%r12,%rbx
 	adcx	r11,r13
 	adox	r12,r14
-	DB	0xc4,0x62,0x93,0xf6,0xb6,0x38,0x00,0x00,0x00
-	mov	rdx,QWORD16+rsi
+	DB	0xc4,0x62,0x93,0xf6,0xb6,0x38,0x00,0x00,0x00  ; mulx	7*8(%rsi),%r13,%r14
+	mov	rdx,QWORD16+rsi  ; a2
 	adcx	r12,rax
 	adox	r13,rbx
 	adcx	r13,r15
-	adox	r14,rbp
-	adcx	r14,rbp
+	adox	r14,rbp  ; of=0
+	adcx	r14,rbp  ; cf=0
 
-	mov	QWORD24+rdi,r8
-	mov	QWORD32+rdi,r9
+	mov	QWORD24+rdi,r8  ; t3
+	mov	QWORD32+rdi,r9  ; t4
 
-	mulx	rbx,r8,QWORD24+rsi
-	mulx	rax,r9,QWORD32+rsi
+	mulx	rbx,r8,QWORD24+rsi  ; a3*a2
+	mulx	rax,r9,QWORD32+rsi  ; a4*a2
 	adcx	r8,r10
 	adox	r9,rbx
-	mulx	rbx,r10,QWORD40+rsi
+	mulx	rbx,r10,QWORD40+rsi  ; ...
 	adcx	r9,r11
 	adox	r10,rax
-	DB	0xc4,0xe2,0xa3,0xf6,0x86,0x30,0x00,0x00,0x00
+	DB	0xc4,0xe2,0xa3,0xf6,0x86,0x30,0x00,0x00,0x00  ; mulx	6*8(%rsi),%r11,%rax
 	adcx	r10,r12
 	adox	r11,r13
-	DB	0xc4,0x62,0x9b,0xf6,0xae,0x38,0x00,0x00,0x00
+	DB	0xc4,0x62,0x9b,0xf6,0xae,0x38,0x00,0x00,0x00  ; mulx	7*8(%rsi),%r12,%r13
 	DB	0x3e
-	mov	rdx,QWORD24+rsi
+	mov	rdx,QWORD24+rsi  ; a3
 	adcx	r11,rbx
 	adox	r12,rax
 	adcx	r12,r14
-	mov	QWORD40+rdi,r8
-	mov	QWORD48+rdi,r9
-	mulx	rax,r8,QWORD32+rsi
-	adox	r13,rbp
-	adcx	r13,rbp
+	mov	QWORD40+rdi,r8  ; t5
+	mov	QWORD48+rdi,r9  ; t6
+	mulx	rax,r8,QWORD32+rsi  ; a4*a3
+	adox	r13,rbp  ; of=0
+	adcx	r13,rbp  ; cf=0
 
-	mulx	rbx,r9,QWORD40+rsi
+	mulx	rbx,r9,QWORD40+rsi  ; a5*a3
 	adcx	r8,r10
 	adox	r9,rax
-	mulx	rax,r10,QWORD48+rsi
+	mulx	rax,r10,QWORD48+rsi  ; ...
 	adcx	r9,r11
 	adox	r10,r12
 	mulx	r12,r11,QWORD56+rsi
-	mov	rdx,QWORD32+rsi
-	mov	r14,QWORD40+rsi
+	mov	rdx,QWORD32+rsi  ; a4
+	mov	r14,QWORD40+rsi  ; a5
 	adcx	r10,rbx
 	adox	r11,rax
-	mov	r15,QWORD48+rsi
+	mov	r15,QWORD48+rsi  ; a6
 	adcx	r11,r13
-	adox	r12,rbp
-	adcx	r12,rbp
+	adox	r12,rbp  ; of=0
+	adcx	r12,rbp  ; cf=0
 
-	mov	QWORD56+rdi,r8
-	mov	QWORD64+rdi,r9
+	mov	QWORD56+rdi,r8  ; t7
+	mov	QWORD64+rdi,r9  ; t8
 
-	mulx	rax,r9,r14
-	mov	r8,QWORD56+rsi
+	mulx	rax,r9,r14  ; a5*a4
+	mov	r8,QWORD56+rsi  ; a7
 	adcx	r9,r10
-	mulx	rbx,r10,r15
+	mulx	rbx,r10,r15  ; a6*a4
 	adox	r10,rax
 	adcx	r10,r11
-	mulx	rax,r11,r8
-	mov	rdx,r14
+	mulx	rax,r11,r8  ; a7*a4
+	mov	rdx,r14  ; a5
 	adox	r11,rbx
 	adcx	r11,r12
+; adox	%rbp,%rax		# of=0
+	adcx	rax,rbp  ; cf=0
 
-	adcx	rax,rbp
-
-	mulx	rbx,r14,r15
-	mulx	r13,r12,r8
-	mov	rdx,r15
+	mulx	rbx,r14,r15  ; a6*a5
+	mulx	r13,r12,r8  ; a7*a5
+	mov	rdx,r15  ; a6
 	lea	rsi,64+rsi
 	adcx	r11,r14
 	adox	r12,rbx
@@ -3014,19 +3014,19 @@
 	adox	r13,rbp
 
 	DB	0x67,0x67
-	mulx	r14,r8,r8
+	mulx	r14,r8,r8  ; a7*a6
 	adcx	r13,r8
 	adcx	r14,rbp
 
 	cmp	rsi,QWORD((8+8))+rsp
 	je	NEAR $L$sqrx8x_outer_break
 
-	neg	rcx
+	neg	rcx  ; mov %rcx,%cf
 	mov	rcx,-8
 	mov	r15,rbp
 	mov	r8,QWORD64+rdi
-	adcx	r9,QWORD72+rdi
-	adcx	r10,QWORD80+rdi
+	adcx	r9,QWORD72+rdi  ; +=t9
+	adcx	r10,QWORD80+rdi  ; ...
 	adcx	r11,QWORD88+rdi
 	adc	r12,QWORD96+rdi
 	adc	r13,QWORD104+rdi
@@ -3034,24 +3034,24 @@
 	adc	r15,QWORD120+rdi
 	lea	rbp,rsi
 	lea	rdi,128+rdi
-	sbb	rax,rax
+	sbb	rax,rax  ; mov %cf,%rcx
 
-	mov	rdx,QWORD((-64))+rsi
-	mov	QWORD((16+8))+rsp,rax
+	mov	rdx,QWORD((-64))+rsi  ; a0
+	mov	QWORD((16+8))+rsp,rax  ; offload %rcx
 	mov	QWORD((24+8))+rsp,rdi
 
-
-	xor	eax,eax
+; lea	8*8(%rdi),%rdi	# see 2*8*8(%rdi) above
+	xor	eax,eax  ; cf=0, of=0
 	jmp	NEAR $L$sqrx8x_loop
 
 ALIGN	32
 $L$sqrx8x_loop:
 	mov	rbx,r8
-	mulx	r8,rax,QWORDrbp
-	adcx	rbx,rax
+	mulx	r8,rax,QWORDrbp  ; a8*ai
+	adcx	rbx,rax  ; +=t8
 	adox	r8,r9
 
-	mulx	r9,rax,QWORD8+rbp
+	mulx	r9,rax,QWORD8+rbp  ; ...
 	adcx	r8,rax
 	adox	r9,r10
 
@@ -3063,7 +3063,7 @@
 	adcx	r10,rax
 	adox	r11,r12
 
-	DB	0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00
+	DB	0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00  ; mulx	4*8(%rbp),%rax,%r12
 	adcx	r11,rax
 	adox	r12,r13
 
@@ -3072,27 +3072,27 @@
 	adox	r13,r14
 
 	mulx	r14,rax,QWORD48+rbp
-	mov	QWORDrcx*8+rdi,rbx
+	mov	QWORDrcx*8+rdi,rbx  ; store t8+i
 	mov	ebx,0
 	adcx	r13,rax
 	adox	r14,r15
 
-	DB	0xc4,0x62,0xfb,0xf6,0xbd,0x38,0x00,0x00,0x00
-	mov	rdx,QWORD8+rcx*8+rsi
+	DB	0xc4,0x62,0xfb,0xf6,0xbd,0x38,0x00,0x00,0x00  ; mulx	7*8(%rbp),%rax,%r15
+	mov	rdx,QWORD8+rcx*8+rsi  ; ai
 	adcx	r14,rax
-	adox	r15,rbx
-	adcx	r15,rbx
+	adox	r15,rbx  ; %rbx is 0, of=0
+	adcx	r15,rbx  ; cf=0
 
 	DB	0x67
-	inc	rcx
+	inc	rcx  ; of=0
 	jnz	NEAR $L$sqrx8x_loop
 
 	lea	rbp,64+rbp
 	mov	rcx,-8
-	cmp	rbp,QWORD((8+8))+rsp
+	cmp	rbp,QWORD((8+8))+rsp  ; done?
 	je	NEAR $L$sqrx8x_break
 
-	sub	rbx,QWORD((16+8))+rsp
+	sub	rbx,QWORD((16+8))+rsp  ; mov 16(%rsp),%cf
 	DB	0x66
 	mov	rdx,QWORD((-64))+rsi
 	adcx	r8,QWORDrdi
@@ -3105,19 +3105,19 @@
 	adc	r15,QWORD56+rdi
 	lea	rdi,64+rdi
 	DB	0x67
-	sbb	rax,rax
-	xor	ebx,ebx
-	mov	QWORD((16+8))+rsp,rax
+	sbb	rax,rax  ; mov %cf,%rax
+	xor	ebx,ebx  ; cf=0, of=0
+	mov	QWORD((16+8))+rsp,rax  ; offload carry
 	jmp	NEAR $L$sqrx8x_loop
 
 ALIGN	32
 $L$sqrx8x_break:
 	xor	rbp,rbp
-	sub	rbx,QWORD((16+8))+rsp
+	sub	rbx,QWORD((16+8))+rsp  ; mov 16(%rsp),%cf
 	adcx	r8,rbp
-	mov	rcx,QWORD((24+8))+rsp
+	mov	rcx,QWORD((24+8))+rsp  ; initial %rdi, borrow %rcx
 	adcx	r9,rbp
-	mov	rdx,QWORDrsi
+	mov	rdx,QWORDrsi  ; a8, modulo-scheduled
 	adc	r10,0
 	mov	QWORDrdi,r8
 	adc	r11,0
@@ -3125,7 +3125,7 @@
 	adc	r13,0
 	adc	r14,0
 	adc	r15,0
-	cmp	rdi,rcx
+	cmp	rdi,rcx  ; cf=0, of=0
 	je	NEAR $L$sqrx8x_outer_loop
 
 	mov	QWORD8+rdi,r9
@@ -3147,57 +3147,57 @@
 
 ALIGN	32
 $L$sqrx8x_outer_break:
-	mov	QWORD72+rdi,r9
-	movq	rcx,xmm3
-	mov	QWORD80+rdi,r10
+	mov	QWORD72+rdi,r9  ; t9
+	movq	rcx,xmm3  ; -%r9
+	mov	QWORD80+rdi,r10  ; ...
 	mov	QWORD88+rdi,r11
 	mov	QWORD96+rdi,r12
 	mov	QWORD104+rdi,r13
 	mov	QWORD112+rdi,r14
 	lea	rdi,((48+8))+rsp
-	mov	rdx,QWORDrcx*1+rsi
+	mov	rdx,QWORDrcx*1+rsi  ; a0
 
-	mov	r11,QWORD8+rdi
-	xor	r10,r10
-	mov	r9,QWORD((0+8))+rsp
+	mov	r11,QWORD8+rdi  ; t1
+	xor	r10,r10  ; t0, of=0, cf=0
+	mov	r9,QWORD((0+8))+rsp  ; restore %r9
 	adox	r11,r11
-	mov	r12,QWORD16+rdi
-	mov	r13,QWORD24+rdi
-
+	mov	r12,QWORD16+rdi  ; t2	# prefetch
+	mov	r13,QWORD24+rdi  ; t3	# prefetch
+; jmp	.Lsqrx4x_shift_n_add	# happens to be aligned
 
 ALIGN	32
 $L$sqrx4x_shift_n_add:
 	mulx	rbx,rax,rdx
 	adox	r12,r12
 	adcx	rax,r10
-	DB	0x48,0x8b,0x94,0x0e,0x08,0x00,0x00,0x00
-	DB	0x4c,0x8b,0x97,0x20,0x00,0x00,0x00
+	DB	0x48,0x8b,0x94,0x0e,0x08,0x00,0x00,0x00  ; mov	8(%rsi,%rcx),%rdx	# ai+1	# prefetch
+	DB	0x4c,0x8b,0x97,0x20,0x00,0x00,0x00  ; mov	32(%rdi),%r10	# t2*i+4	# prefetch
 	adox	r13,r13
 	adcx	rbx,r11
-	mov	r11,QWORD40+rdi
+	mov	r11,QWORD40+rdi  ; t2*i+4+1	# prefetch
 	mov	QWORDrdi,rax
 	mov	QWORD8+rdi,rbx
 
 	mulx	rbx,rax,rdx
 	adox	r10,r10
 	adcx	rax,r12
-	mov	rdx,QWORD16+rcx*1+rsi
-	mov	r12,QWORD48+rdi
+	mov	rdx,QWORD16+rcx*1+rsi  ; ai+2	# prefetch
+	mov	r12,QWORD48+rdi  ; t2*i+6	# prefetch
 	adox	r11,r11
 	adcx	rbx,r13
-	mov	r13,QWORD56+rdi
+	mov	r13,QWORD56+rdi  ; t2*i+6+1	# prefetch
 	mov	QWORD16+rdi,rax
 	mov	QWORD24+rdi,rbx
 
 	mulx	rbx,rax,rdx
 	adox	r12,r12
 	adcx	rax,r10
-	mov	rdx,QWORD24+rcx*1+rsi
+	mov	rdx,QWORD24+rcx*1+rsi  ; ai+3	# prefetch
 	lea	rcx,32+rcx
-	mov	r10,QWORD64+rdi
+	mov	r10,QWORD64+rdi  ; t2*i+8	# prefetch
 	adox	r13,r13
 	adcx	rbx,r11
-	mov	r11,QWORD72+rdi
+	mov	r11,QWORD72+rdi  ; t2*i+8+1	# prefetch
 	mov	QWORD32+rdi,rax
 	mov	QWORD40+rdi,rbx
 
@@ -3205,11 +3205,11 @@
 	adox	r10,r10
 	adcx	rax,r12
 	jrcxz	$L$sqrx4x_shift_n_add_break
-	DB	0x48,0x8b,0x94,0x0e,0x00,0x00,0x00,0x00
+	DB	0x48,0x8b,0x94,0x0e,0x00,0x00,0x00,0x00  ; mov	0(%rsi,%rcx),%rdx	# ai+4	# prefetch
 	adox	r11,r11
 	adcx	rbx,r13
-	mov	r12,QWORD80+rdi
-	mov	r13,QWORD88+rdi
+	mov	r12,QWORD80+rdi  ; t2*i+10	# prefetch
+	mov	r13,QWORD88+rdi  ; t2*i+10+1	# prefetch
 	mov	QWORD48+rdi,rax
 	mov	QWORD56+rdi,rbx
 	lea	rdi,64+rdi
@@ -3221,18 +3221,18 @@
 	adcx	rbx,r13
 	mov	QWORD48+rdi,rax
 	mov	QWORD56+rdi,rbx
-	lea	rdi,64+rdi
+	lea	rdi,64+rdi  ; end of t buffer
 	movq	rbp,xmm2
 __bn_sqrx8x_reduction:
-	xor	eax,eax
-	mov	rbx,QWORD((32+8))+rsp
-	mov	rdx,QWORD((48+8))+rsp
-	lea	rcx,((-64))+r9*1+rbp
-
-	mov	QWORD((0+8))+rsp,rcx
-	mov	QWORD((8+8))+rsp,rdi
-
-	lea	rdi,((48+8))+rsp
+	xor	eax,eax  ; initial top-most carry bit
+	mov	rbx,QWORD((32+8))+rsp  ; n0
+	mov	rdx,QWORD((48+8))+rsp  ; "%r8", 8*0(%rdi)
+	lea	rcx,((-64))+r9*1+rbp  ; end of n
+; lea	48+8(%rsp,%r9,2),%rdi	# end of t buffer
+	mov	QWORD((0+8))+rsp,rcx  ; save end of n
+	mov	QWORD((8+8))+rsp,rdi  ; save end of t
+
+	lea	rdi,((48+8))+rsp  ; initial t window
 	jmp	NEAR $L$sqrx8x_reduction_loop
 
 ALIGN	32
@@ -3242,25 +3242,25 @@
 	mov	r11,QWORD24+rdi
 	mov	r12,QWORD32+rdi
 	mov	r8,rdx
-	imul	rdx,rbx
+	imul	rdx,rbx  ; n0*ai
 	mov	r13,QWORD40+rdi
 	mov	r14,QWORD48+rdi
 	mov	r15,QWORD56+rdi
-	mov	QWORD((24+8))+rsp,rax
+	mov	QWORD((24+8))+rsp,rax  ; store top-most carry bit
 
 	lea	rdi,64+rdi
-	xor	rsi,rsi
+	xor	rsi,rsi  ; cf=0,of=0
 	mov	rcx,-8
 	jmp	NEAR $L$sqrx8x_reduce
 
 ALIGN	32
 $L$sqrx8x_reduce:
 	mov	rbx,r8
-	mulx	r8,rax,QWORDrbp
-	adcx	rax,rbx
+	mulx	r8,rax,QWORDrbp  ; n0
+	adcx	rax,rbx  ; discarded
 	adox	r8,r9
 
-	mulx	r9,rbx,QWORD8+rbp
+	mulx	r9,rbx,QWORD8+rbp  ; n1
 	adcx	r8,rbx
 	adox	r9,r10
 
@@ -3272,15 +3272,15 @@
 	adcx	r10,rbx
 	adox	r11,r12
 
-	DB	0xc4,0x62,0xe3,0xf6,0xa5,0x20,0x00,0x00,0x00
+	DB	0xc4,0x62,0xe3,0xf6,0xa5,0x20,0x00,0x00,0x00  ; mulx	8*4(%rbp),%rbx,%r12
 	mov	rax,rdx
 	mov	rdx,r8
 	adcx	r11,rbx
 	adox	r12,r13
 
-	mulx	rdx,rbx,QWORD((32+8))+rsp
+	mulx	rdx,rbx,QWORD((32+8))+rsp  ; %rdx discarded
 	mov	rdx,rax
-	mov	QWORD((64+48+8))+rcx*8+rsp,rax
+	mov	QWORD((64+48+8))+rcx*8+rsp,rax  ; put aside n0*ai
 
 	mulx	r13,rax,QWORD40+rbp
 	adcx	r12,rax
@@ -3293,18 +3293,18 @@
 	mulx	r15,rax,QWORD56+rbp
 	mov	rdx,rbx
 	adcx	r14,rax
-	adox	r15,rsi
-	adcx	r15,rsi
+	adox	r15,rsi  ; %rsi is 0
+	adcx	r15,rsi  ; cf=0
 
 	DB	0x67,0x67,0x67
-	inc	rcx
+	inc	rcx  ; of=0
 	jnz	NEAR $L$sqrx8x_reduce
 
-	mov	rax,rsi
-	cmp	rbp,QWORD((0+8))+rsp
+	mov	rax,rsi  ; xor	%rax,%rax
+	cmp	rbp,QWORD((0+8))+rsp  ; end of n?
 	jae	NEAR $L$sqrx8x_no_tail
 
-	mov	rdx,QWORD((48+8))+rsp
+	mov	rdx,QWORD((48+8))+rsp  ; pull n0*a0
 	add	r8,QWORDrdi
 	lea	rbp,64+rbp
 	mov	rcx,-8
@@ -3316,9 +3316,9 @@
 	adc	r14,QWORD48+rdi
 	adc	r15,QWORD56+rdi
 	lea	rdi,64+rdi
-	sbb	rax,rax
+	sbb	rax,rax  ; top carry
 
-	xor	rsi,rsi
+	xor	rsi,rsi  ; of=0, cf=0
 	mov	QWORD((16+8))+rsp,rax
 	jmp	NEAR $L$sqrx8x_tail
 
@@ -3341,7 +3341,7 @@
 	adcx	r10,rax
 	adox	r11,r12
 
-	DB	0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00
+	DB	0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00  ; mulx	8*4(%rbp),%rax,%r12
 	adcx	r11,rax
 	adox	r12,r13
 
@@ -3354,21 +3354,21 @@
 	adox	r14,r15
 
 	mulx	r15,rax,QWORD56+rbp
-	mov	rdx,QWORD((72+48+8))+rcx*8+rsp
+	mov	rdx,QWORD((72+48+8))+rcx*8+rsp  ; pull n0*ai
 	adcx	r14,rax
 	adox	r15,rsi
-	mov	QWORDrcx*8+rdi,rbx
+	mov	QWORDrcx*8+rdi,rbx  ; save result
 	mov	rbx,r8
-	adcx	r15,rsi
+	adcx	r15,rsi  ; cf=0
 
-	inc	rcx
+	inc	rcx  ; of=0
 	jnz	NEAR $L$sqrx8x_tail
 
-	cmp	rbp,QWORD((0+8))+rsp
-	jae	NEAR $L$sqrx8x_tail_done
+	cmp	rbp,QWORD((0+8))+rsp  ; end of n?
+	jae	NEAR $L$sqrx8x_tail_done  ; break out of loop
 
-	sub	rsi,QWORD((16+8))+rsp
-	mov	rdx,QWORD((48+8))+rsp
+	sub	rsi,QWORD((16+8))+rsp  ; mov 16(%rsp),%cf
+	mov	rdx,QWORD((48+8))+rsp  ; pull n0*a0
 	lea	rbp,64+rbp
 	adc	r8,QWORDrdi
 	adc	r9,QWORD8+rdi
@@ -3380,16 +3380,16 @@
 	adc	r15,QWORD56+rdi
 	lea	rdi,64+rdi
 	sbb	rax,rax
-	sub	rcx,8
+	sub	rcx,8  ; mov	$-8,%rcx
 
-	xor	rsi,rsi
+	xor	rsi,rsi  ; of=0, cf=0
 	mov	QWORD((16+8))+rsp,rax
 	jmp	NEAR $L$sqrx8x_tail
 
 ALIGN	32
 $L$sqrx8x_tail_done:
 	xor	rax,rax
-	add	r8,QWORD((24+8))+rsp
+	add	r8,QWORD((24+8))+rsp  ; can this overflow?
 	adc	r9,0
 	adc	r10,0
 	adc	r11,0
@@ -3399,26 +3399,26 @@
 	adc	r15,0
 	adc	rax,0
 
-	sub	rsi,QWORD((16+8))+rsp
-$L$sqrx8x_no_tail:
+	sub	rsi,QWORD((16+8))+rsp  ; mov 16(%rsp),%cf
+$L$sqrx8x_no_tail:  ; %cf is 0 if jumped here
 	adc	r8,QWORDrdi
 	movq	rcx,xmm3
 	adc	r9,QWORD8+rdi
 	mov	rsi,QWORD56+rbp
-	movq	rbp,xmm2
+	movq	rbp,xmm2  ; restore %rbp
 	adc	r10,QWORD16+rdi
 	adc	r11,QWORD24+rdi
 	adc	r12,QWORD32+rdi
 	adc	r13,QWORD40+rdi
 	adc	r14,QWORD48+rdi
 	adc	r15,QWORD56+rdi
-	adc	rax,0
+	adc	rax,0  ; top-most carry
 
-	mov	rbx,QWORD((32+8))+rsp
-	mov	rdx,QWORD64+rcx*1+rdi
+	mov	rbx,QWORD((32+8))+rsp  ; n0
+	mov	rdx,QWORD64+rcx*1+rdi  ; modulo-scheduled "%r8"
 
-	mov	QWORDrdi,r8
-	lea	r8,64+rdi
+	mov	QWORDrdi,r8  ; store top 512 bits
+	lea	r8,64+rdi  ; borrow %r8
 	mov	QWORD8+rdi,r9
 	mov	QWORD16+rdi,r10
 	mov	QWORD24+rdi,r11
@@ -3427,8 +3427,8 @@
 	mov	QWORD48+rdi,r14
 	mov	QWORD56+rdi,r15
 
-	lea	rdi,64+rcx*1+rdi
-	cmp	r8,QWORD((8+8))+rsp
+	lea	rdi,64+rcx*1+rdi  ; start of current t window
+	cmp	r8,QWORD((8+8))+rsp  ; end of t?
 	jb	NEAR $L$sqrx8x_reduction_loop
 	ret
 
@@ -3438,14 +3438,14 @@
 __bn_postx4x_internal:
 
 	mov	r12,QWORDrbp
-	mov	r10,rcx
-	mov	r9,rcx
+	mov	r10,rcx  ; -%r9
+	mov	r9,rcx  ; -%r9
 	neg	rax
 	sar	rcx,3+2
-
-	movq	rdx,xmm1
-	movq	rsi,xmm1
-	dec	r12
+; lea	48+8(%rsp,%r9),%rdi
+	movq	rdx,xmm1  ; restore %rdx
+	movq	rsi,xmm1  ; prepare for back-to-back call
+	dec	r12  ; so that after 'not' we get -n0
 	mov	r13,QWORD8+rbp
 	xor	r8,r8
 	mov	r14,QWORD16+rbp
@@ -3465,7 +3465,7 @@
 	andn	r14,r14,rax
 	andn	r15,r15,rax
 
-	neg	r8
+	neg	r8  ; mov %r8,%cf
 	adc	r12,QWORDrdi
 	adc	r13,QWORD8+rdi
 	adc	r14,QWORD16+rdi
@@ -3473,7 +3473,7 @@
 	mov	QWORDrdx,r12
 	lea	rdi,32+rdi
 	mov	QWORD8+rdx,r13
-	sbb	r8,r8
+	sbb	r8,r8  ; mov %cf,%r8
 	mov	QWORD16+rdx,r14
 	mov	QWORD24+rdx,r15
 	lea	rdx,32+rdx
@@ -3481,7 +3481,7 @@
 	inc	rcx
 	jnz	NEAR $L$sqrx4x_sub
 
-	neg	r9
+	neg	r9  ; restore %r9
 
 	ret
 
@@ -3495,13 +3495,13 @@
 	cmp	edx,0
 	jz	NEAR $L$scatter_epilogue
 
-
-
-
-
-
-
-
+; %r8 stores 32 entries, t0 through t31. Each entry has %edx words.
+; They are interleaved in memory as follows:
+; 
+; t00      t10      t20      ... t310
+; t01      t11      t21      ... t311
+; ...
+; t0%edx-1 t1%edx-1 t2%edx-1 ... t31%edx-1
 
 	lea	r8,r9*8+r8
 $L$scatter:
@@ -3521,97 +3521,97 @@
 ALIGN	32
 bn_gather5:
 
-$L$SEH_begin_bn_gather5:
+$L$SEH_begin_bn_gather5:  ; Win64 thing, but harmless in other cases
 _CET_ENDBR
+; I can't trust assembler to use specific encoding:-(
+	DB	0x4c,0x8d,0x14,0x24  ; lea    (%rsp),%r10
 
-	DB	0x4c,0x8d,0x14,0x24
-
-	DB	0x48,0x81,0xec,0x08,0x01,0x00,0x00
+	DB	0x48,0x81,0xec,0x08,0x01,0x00,0x00  ; sub	$0x108,%rsp
 	lea	rax,$L$inc
-	and	rsp,-16
+	and	rsp,-16  ; shouldn't be formally required
 
 	movd	xmm5,r9d
-	movdqa	xmm0,XMMWORDrax
-	movdqa	xmm1,XMMWORD16+rax
-	lea	r11,128+r8
-	lea	rax,128+rsp
+	movdqa	xmm0,XMMWORDrax  ; 00000001000000010000000000000000
+	movdqa	xmm1,XMMWORD16+rax  ; 00000002000000020000000200000002
+	lea	r11,128+r8  ; size optimization
+	lea	rax,128+rsp  ; size optimization
 
-	pshufd	xmm5,xmm5,0
+	pshufd	xmm5,xmm5,0  ; broadcast %r9d
 	movdqa	xmm4,xmm1
 	movdqa	xmm2,xmm1
 	paddd	xmm1,xmm0
-	pcmpeqd	xmm0,xmm5
+	pcmpeqd	xmm0,xmm5  ; compare to 1,0
 	movdqa	xmm3,xmm4
 
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORD(-128)+rax,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD(-112)+rax,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD(-96)+rax,xmm2
 	movdqa	xmm2,xmm4
 	paddd	xmm1,xmm0
-	pcmpeqd	xmm0,xmm5
+	pcmpeqd	xmm0,xmm5  ; compare to 1,0
 	movdqa	XMMWORD(-80)+rax,xmm3
 	movdqa	xmm3,xmm4
 
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORD(-64)+rax,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD(-48)+rax,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD(-32)+rax,xmm2
 	movdqa	xmm2,xmm4
 	paddd	xmm1,xmm0
-	pcmpeqd	xmm0,xmm5
+	pcmpeqd	xmm0,xmm5  ; compare to 1,0
 	movdqa	XMMWORD(-16)+rax,xmm3
 	movdqa	xmm3,xmm4
 
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORDrax,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD16+rax,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD32+rax,xmm2
 	movdqa	xmm2,xmm4
 	paddd	xmm1,xmm0
-	pcmpeqd	xmm0,xmm5
+	pcmpeqd	xmm0,xmm5  ; compare to 1,0
 	movdqa	XMMWORD48+rax,xmm3
 	movdqa	xmm3,xmm4
 
 	paddd	xmm2,xmm1
-	pcmpeqd	xmm1,xmm5
+	pcmpeqd	xmm1,xmm5  ; compare to 3,2
 	movdqa	XMMWORD64+rax,xmm0
 	movdqa	xmm0,xmm4
 
 	paddd	xmm3,xmm2
-	pcmpeqd	xmm2,xmm5
+	pcmpeqd	xmm2,xmm5  ; compare to 5,4
 	movdqa	XMMWORD80+rax,xmm1
 	movdqa	xmm1,xmm4
 
 	paddd	xmm0,xmm3
-	pcmpeqd	xmm3,xmm5
+	pcmpeqd	xmm3,xmm5  ; compare to 7,6
 	movdqa	XMMWORD96+rax,xmm2
 	movdqa	xmm2,xmm4
 	movdqa	XMMWORD112+rax,xmm3
@@ -3671,10 +3671,10 @@
 	por	xmm5,xmm3
 	por	xmm4,xmm5
 	lea	r11,256+r11
-
-	pshufd	xmm0,xmm4,0x4e
+; Combine the upper and lower halves of %xmm0.
+	pshufd	xmm0,xmm4,0x4e  ; Swap upper and lower halves.
 	por	xmm0,xmm4
-	movq	QWORDrcx,xmm0
+	movq	QWORDrcx,xmm0  ; m0=bp0
 	lea	rcx,8+rcx
 	sub	edx,1
 	jnz	NEAR $L$gather
@@ -3698,7 +3698,7 @@
 	DB	114,32,120,56,54,95,54,52,44,32,67,82,89,80,84,79
 	DB	71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111
 	DB	112,101,110,115,115,108,46,111,114,103,62,0
-section	.text
+section	.text code align=64
 
 EXTERN	__imp_RtlVirtualUnwind
 
@@ -3715,40 +3715,40 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; end of prologue label
+	cmp	rbx,r10  ; context->Rip<end of prologue label
 	jb	NEAR $L$common_seh_tail
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; beginning of body label
+	cmp	rbx,r10  ; context->Rip<body label
 	jb	NEAR $L$common_pop_regs
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
-	mov	r10d,DWORD8+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD8+r11  ; HandlerData2
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$common_seh_tail
 
 	lea	r10,$L$mul_epilogue
 	cmp	rbx,r10
 	ja	NEAR $L$body_40
 
-	mov	r10,QWORD192+r8
-	mov	rax,QWORD8+r10*8+rax
+	mov	r10,QWORD192+r8  ; pull %r9
+	mov	rax,QWORD8+r10*8+rax  ; pull saved stack pointer
 
 	jmp	NEAR $L$common_pop_regs
 
 $L$body_40:
-	mov	rax,QWORD40+rax
+	mov	rax,QWORD40+rax  ; pull saved stack pointer
 $L$common_pop_regs:
 	mov	rbx,QWORD((-8))+rax
 	mov	rbp,QWORD((-16))+rax
@@ -3756,40 +3756,40 @@
 	mov	r13,QWORD((-32))+rax
 	mov	r14,QWORD((-40))+rax
 	mov	r15,QWORD((-48))+rax
-	mov	QWORD144+r8,rbx
-	mov	QWORD160+r8,rbp
-	mov	QWORD216+r8,r12
-	mov	QWORD224+r8,r13
-	mov	QWORD232+r8,r14
-	mov	QWORD240+r8,r15
+	mov	QWORD144+r8,rbx  ; restore context->Rbx
+	mov	QWORD160+r8,rbp  ; restore context->Rbp
+	mov	QWORD216+r8,r12  ; restore context->R12
+	mov	QWORD224+r8,r13  ; restore context->R13
+	mov	QWORD232+r8,r14  ; restore context->R14
+	mov	QWORD240+r8,r15  ; restore context->R15
 
 $L$common_seh_tail:
 	mov	rdi,QWORD8+rax
 	mov	rsi,QWORD16+rax
-	mov	QWORD152+r8,rax
-	mov	QWORD168+r8,rsi
-	mov	QWORD176+r8,rdi
+	mov	QWORD152+r8,rax  ; restore context->Rsp
+	mov	QWORD168+r8,rsi  ; restore context->Rsi
+	mov	QWORD176+r8,rdi  ; restore context->Rdi
 
-	mov	rdi,QWORD40+r9
-	mov	rsi,r8
-	mov	ecx,154
-	DD	0xa548f3fc
+	mov	rdi,QWORD40+r9  ; disp->ContextRecord
+	mov	rsi,r8  ; context
+	mov	ecx,154  ; sizeof(CONTEXT)
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	mov	rsi,r9
-	xor	rcx,rcx
-	mov	rdx,QWORD8+rsi
-	mov	r8,QWORDrsi
-	mov	r9,QWORD16+rsi
-	mov	r10,QWORD40+rsi
-	lea	r11,56+rsi
-	lea	r12,24+rsi
-	mov	QWORD32+rsp,r10
-	mov	QWORD40+rsp,r11
-	mov	QWORD48+rsp,r12
-	mov	QWORD56+rsp,rcx
+	xor	rcx,rcx  ; arg1, UNW_FLAG_NHANDLER
+	mov	rdx,QWORD8+rsi  ; arg2, disp->ImageBase
+	mov	r8,QWORDrsi  ; arg3, disp->ControlPc
+	mov	r9,QWORD16+rsi  ; arg4, disp->FunctionEntry
+	mov	r10,QWORD40+rsi  ; disp->ContextRecord
+	lea	r11,56+rsi  ; &disp->HandlerData
+	lea	r12,24+rsi  ; &disp->EstablisherFrame
+	mov	QWORD32+rsp,r10  ; arg5
+	mov	QWORD40+rsp,r11  ; arg6
+	mov	QWORD48+rsp,r12  ; arg7
+	mov	QWORD56+rsp,rcx  ; arg8, (NULL)
 	call	QWORD__imp_RtlVirtualUnwind
 
-	mov	eax,1
+	mov	eax,1  ; ExceptionContinueSearch
 	add	rsp,64
 	popfq
 	pop	r15
@@ -3832,32 +3832,32 @@
 $L$SEH_info_bn_mul_mont_gather5_nohw:
 	DB	9,0,0,0
 	DD	mul_handler wrt ..imagebase
-	DD	$L$mul_body wrt ..imagebase,$L$mul_body wrt ..imagebase,$L$mul_epilogue wrt ..imagebase
+	DD	$L$mul_body wrt ..imagebase,$L$mul_body wrt ..imagebase,$L$mul_epilogue wrt ..imagebase  ; HandlerData
 ALIGN	8
 $L$SEH_info_bn_mul4x_mont_gather5:
 	DB	9,0,0,0
 	DD	mul_handler wrt ..imagebase
-	DD	$L$mul4x_prologue wrt ..imagebase,$L$mul4x_body wrt ..imagebase,$L$mul4x_epilogue wrt ..imagebase
+	DD	$L$mul4x_prologue wrt ..imagebase,$L$mul4x_body wrt ..imagebase,$L$mul4x_epilogue wrt ..imagebase  ; HandlerData
 ALIGN	8
 $L$SEH_info_bn_power5_nohw:
 	DB	9,0,0,0
 	DD	mul_handler wrt ..imagebase
-	DD	$L$power5_prologue wrt ..imagebase,$L$power5_body wrt ..imagebase,$L$power5_epilogue wrt ..imagebase
+	DD	$L$power5_prologue wrt ..imagebase,$L$power5_body wrt ..imagebase,$L$power5_epilogue wrt ..imagebase  ; HandlerData
 ALIGN	8
 $L$SEH_info_bn_mulx4x_mont_gather5:
 	DB	9,0,0,0
 	DD	mul_handler wrt ..imagebase
-	DD	$L$mulx4x_prologue wrt ..imagebase,$L$mulx4x_body wrt ..imagebase,$L$mulx4x_epilogue wrt ..imagebase
+	DD	$L$mulx4x_prologue wrt ..imagebase,$L$mulx4x_body wrt ..imagebase,$L$mulx4x_epilogue wrt ..imagebase  ; HandlerData
 ALIGN	8
 $L$SEH_info_bn_powerx5:
 	DB	9,0,0,0
 	DD	mul_handler wrt ..imagebase
-	DD	$L$powerx5_prologue wrt ..imagebase,$L$powerx5_body wrt ..imagebase,$L$powerx5_epilogue wrt ..imagebase
+	DD	$L$powerx5_prologue wrt ..imagebase,$L$powerx5_body wrt ..imagebase,$L$powerx5_epilogue wrt ..imagebase  ; HandlerData
 ALIGN	8
 $L$SEH_info_bn_gather5:
 	DB	0x01,0x0b,0x03,0x0a
-	DB	0x0b,0x01,0x21,0x00
-	DB	0x04,0xa3,0x00,0x00
+	DB	0x0b,0x01,0x21,0x00  ; sub	rsp,0x108
+	DB	0x04,0xa3,0x00,0x00  ; lea	r10,(rsp)
 ALIGN	8
 %else
 ; Work around https://bugzilla.nasm.us/show_bug.cgi?id=3392738

boringssl-0.20260708.tar.xz/gen/crypto/aes128gcmsiv-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/crypto/aes128gcmsiv-x86_64-apple.S Changed

@@ -89,21 +89,21 @@
 _CET_ENDBR
 	vmovdqa	(%rsi),%xmm0
 	vmovdqa	%xmm0,%xmm1
-	vmovdqa	%xmm0,(%rdi)
+	vmovdqa	%xmm0,(%rdi)  // H
 	call	GFMUL
-	vmovdqa	%xmm0,16(%rdi)
+	vmovdqa	%xmm0,16(%rdi)  // H^2
 	call	GFMUL
-	vmovdqa	%xmm0,32(%rdi)
+	vmovdqa	%xmm0,32(%rdi)  // H^3
 	call	GFMUL
-	vmovdqa	%xmm0,48(%rdi)
+	vmovdqa	%xmm0,48(%rdi)  // H^4
 	call	GFMUL
-	vmovdqa	%xmm0,64(%rdi)
+	vmovdqa	%xmm0,64(%rdi)  // H^5
 	call	GFMUL
-	vmovdqa	%xmm0,80(%rdi)
+	vmovdqa	%xmm0,80(%rdi)  // H^6
 	call	GFMUL
-	vmovdqa	%xmm0,96(%rdi)
+	vmovdqa	%xmm0,96(%rdi)  // H^7
 	call	GFMUL
-	vmovdqa	%xmm0,112(%rdi)
+	vmovdqa	%xmm0,112(%rdi)  // H^8
 	ret
 
 
@@ -117,17 +117,17 @@
 _CET_ENDBR
 	vmovdqa	(%rsi),%xmm0
 	vmovdqa	%xmm0,%xmm1
-	vmovdqa	%xmm0,(%rdi)
+	vmovdqa	%xmm0,(%rdi)  // H
 	call	GFMUL
-	vmovdqa	%xmm0,16(%rdi)
+	vmovdqa	%xmm0,16(%rdi)  // H^2
 	call	GFMUL
-	vmovdqa	%xmm0,32(%rdi)
+	vmovdqa	%xmm0,32(%rdi)  // H^3
 	call	GFMUL
-	vmovdqa	%xmm0,48(%rdi)
+	vmovdqa	%xmm0,48(%rdi)  // H^4
 	call	GFMUL
-	vmovdqa	%xmm0,64(%rdi)
+	vmovdqa	%xmm0,64(%rdi)  // H^5
 	call	GFMUL
-	vmovdqa	%xmm0,80(%rdi)
+	vmovdqa	%xmm0,80(%rdi)  // H^6
 	ret
 
 
@@ -146,8 +146,8 @@
 L$htable_polyval_start:
 	vzeroall
 
-
-
+// We hash 8 blocks each iteration. If the total number of blocks is not a
+// multiple of 8, we first hash the leading n%8 blocks.
 	movq	%rdx,%r11
 	andq	$127,%r11
 
@@ -159,7 +159,7 @@
 
 	subq	$16,%r11
 
-
+// hash first prefix block
 	vmovdqu	(%rsi),%xmm0
 	vpxor	%xmm1,%xmm0,%xmm0
 
@@ -174,12 +174,12 @@
 	jnz	L$htable_polyval_prefix_loop
 	jmp	L$htable_polyval_prefix_complete
 
-
+// hash remaining prefix blocks (up to 7 total prefix blocks)
 .p2align	6
 L$htable_polyval_prefix_loop:
 	subq	$16,%r11
 
-	vmovdqu	(%rsi),%xmm0
+	vmovdqu	(%rsi),%xmm0  // next data block
 
 	vpclmulqdq	$0x00,(%rdi,%r11,1),%xmm0,%xmm6
 	vpxor	%xmm6,%xmm3,%xmm3
@@ -206,10 +206,10 @@
 	jmp	L$htable_polyval_main_loop
 
 L$htable_polyval_no_prefix:
-
-
-
-
+// At this point we know the number of blocks is a multiple of 8. However,
+// the reduction in the main loop includes a multiplication by x^(-128). In
+// order to counter this, the existing tag needs to be multiplied by x^128.
+// In practice, this just means that it is loaded into %xmm9, not %xmm1.
 	vpxor	%xmm1,%xmm1,%xmm1
 	vmovdqa	(%rcx),%xmm9
 
@@ -218,7 +218,7 @@
 	subq	$0x80,%rdx
 	jb	L$htable_polyval_out
 
-	vmovdqu	112(%rsi),%xmm0
+	vmovdqu	112(%rsi),%xmm0  // Ii
 
 	vpclmulqdq	$0x01,(%rdi),%xmm0,%xmm5
 	vpclmulqdq	$0x00,(%rdi),%xmm0,%xmm3
@@ -226,7 +226,7 @@
 	vpclmulqdq	$0x10,(%rdi),%xmm0,%xmm6
 	vpxor	%xmm6,%xmm5,%xmm5
 
-
+// ########################################################
 	vmovdqu	96(%rsi),%xmm0
 	vpclmulqdq	$0x01,16(%rdi),%xmm0,%xmm6
 	vpxor	%xmm6,%xmm5,%xmm5
@@ -238,10 +238,10 @@
 	vpxor	%xmm6,%xmm5,%xmm5
 
 
-
+// ########################################################
 	vmovdqu	80(%rsi),%xmm0
 
-	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm7
+	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm7  // reduction stage 1a
 	vpalignr	$8,%xmm1,%xmm1,%xmm1
 
 	vpclmulqdq	$0x01,32(%rdi),%xmm0,%xmm6
@@ -254,8 +254,8 @@
 	vpxor	%xmm6,%xmm5,%xmm5
 
 
-	vpxor	%xmm7,%xmm1,%xmm1
-
+	vpxor	%xmm7,%xmm1,%xmm1  // reduction stage 1b
+// ########################################################
 	vmovdqu	64(%rsi),%xmm0
 
 	vpclmulqdq	$0x01,48(%rdi),%xmm0,%xmm6
@@ -267,10 +267,10 @@
 	vpclmulqdq	$0x10,48(%rdi),%xmm0,%xmm6
 	vpxor	%xmm6,%xmm5,%xmm5
 
-
+// ########################################################
 	vmovdqu	48(%rsi),%xmm0
 
-	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm7
+	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm7  // reduction stage 2a
 	vpalignr	$8,%xmm1,%xmm1,%xmm1
 
 	vpclmulqdq	$0x01,64(%rdi),%xmm0,%xmm6
@@ -283,8 +283,8 @@
 	vpxor	%xmm6,%xmm5,%xmm5
 
 
-	vpxor	%xmm7,%xmm1,%xmm1
-
+	vpxor	%xmm7,%xmm1,%xmm1  // reduction stage 2b
+// ########################################################
 	vmovdqu	32(%rsi),%xmm0
 
 	vpclmulqdq	$0x01,80(%rdi),%xmm0,%xmm6
@@ -297,8 +297,8 @@
 	vpxor	%xmm6,%xmm5,%xmm5
 
 
-	vpxor	%xmm9,%xmm1,%xmm1
-
+	vpxor	%xmm9,%xmm1,%xmm1  // reduction finalize
+// ########################################################
 	vmovdqu	16(%rsi),%xmm0
 
 	vpclmulqdq	$0x01,96(%rdi),%xmm0,%xmm6
@@ -310,7 +310,7 @@
 	vpclmulqdq	$0x10,96(%rdi),%xmm0,%xmm6
 	vpxor	%xmm6,%xmm5,%xmm5
 
-
+// ########################################################
 	vmovdqu	0(%rsi),%xmm0
 	vpxor	%xmm1,%xmm0,%xmm0
 
@@ -323,7 +323,7 @@
 	vpclmulqdq	$0x10,112(%rdi),%xmm0,%xmm6
 	vpxor	%xmm6,%xmm5,%xmm5
 
-
+// ########################################################
 	vpsrldq	$8,%xmm5,%xmm6
 	vpslldq	$8,%xmm5,%xmm5
 
@@ -333,7 +333,7 @@
 	leaq	128(%rsi),%rsi
 	jmp	L$htable_polyval_main_loop
 
-
+// ########################################################
 
 L$htable_polyval_out:
 	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm6
@@ -363,24 +363,24 @@
 	ret
 
 L$polyval_horner_start:
-
-
+// We will start with L GFMULS for POLYVAL(BIG_BUFFER)
+// RES = GFMUL(RES, H)
 
 	xorq	%r10,%r10
-	shlq	$4,%rcx
+	shlq	$4,%rcx  // L contains number of bytes to process
 
 	vmovdqa	(%rsi),%xmm1
 	vmovdqa	(%rdi),%xmm0
 
 L$polyval_horner_loop:
-	vpxor	(%rdx,%r10,1),%xmm0,%xmm0
-	call	GFMUL
+	vpxor	(%rdx,%r10,1),%xmm0,%xmm0  // RES = RES + Xi
+	call	GFMUL  // RES = RES * H
 
 	addq	$16,%r10
 	cmpq	%r10,%rcx
 	jne	L$polyval_horner_loop
 
-
+// calculation of T is complete. RES=T
 	vmovdqa	%xmm0,(%rdi)
 	ret
 
@@ -393,8 +393,8 @@
 _aes128gcmsiv_aes_ks:
 
 _CET_ENDBR
-	vmovdqu	(%rdi),%xmm1
-	vmovdqa	%xmm1,(%rsi)
+	vmovdqu	(%rdi),%xmm1  // xmm1 = user key
+	vmovdqa	%xmm1,(%rsi)  // rsi points to output
 
 	vmovdqa	con1(%rip),%xmm0
 	vmovdqa	mask(%rip),%xmm15
@@ -402,9 +402,9 @@
 	movq	$8,%rax
 
 L$ks128_loop:
-	addq	$16,%rsi
+	addq	$16,%rsi  // rsi points for next key
 	subq	$1,%rax
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // xmm2 = shuffled user key
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
 	vpslldq	$4,%xmm1,%xmm3
@@ -500,19 +500,19 @@
 _aes128gcmsiv_aes_ks_enc_x1:
 
 _CET_ENDBR
-	vmovdqa	(%rcx),%xmm1
+	vmovdqa	(%rcx),%xmm1  // xmm1 = first 16 bytes of random key
 	vmovdqa	0(%rdi),%xmm4
 
-	vmovdqa	%xmm1,(%rdx)
+	vmovdqa	%xmm1,(%rdx)  // KEY0 = first 16 bytes of random key
 	vpxor	%xmm1,%xmm4,%xmm4
 
-	vmovdqa	con1(%rip),%xmm0
-	vmovdqa	mask(%rip),%xmm15
+	vmovdqa	con1(%rip),%xmm0  // xmm0  = 1,1,1,1
+	vmovdqa	mask(%rip),%xmm15  // xmm15 = mask
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -521,10 +521,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,16(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -533,10 +533,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,32(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -545,10 +545,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,48(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -557,10 +557,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,64(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -569,10 +569,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,80(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -581,10 +581,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,96(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -593,10 +593,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,112(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -608,10 +608,10 @@
 
 	vmovdqa	con2(%rip),%xmm0
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -620,9 +620,9 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,144(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -644,11 +644,11 @@
 _aes128gcmsiv_kdf:
 
 _CET_ENDBR
+// parameter 1: %rdi                         Pointer to NONCE
+// parameter 2: %rsi                         Pointer to CT
+// parameter 4: %rdx                         Pointer to keys
 
-
-
-
-	vmovdqa	(%rdx),%xmm1
+	vmovdqa	(%rdx),%xmm1  // xmm1 = first 16 bytes of random key
 	vmovdqa	0(%rdi),%xmm9
 	vmovdqa	and_mask(%rip),%xmm12
 	vmovdqa	one(%rip),%xmm13
@@ -749,20 +749,20 @@
 	pushq	%r13
 
 
-	shrq	$4,%r8
+	shrq	$4,%r8  // LEN = num of blocks
 	movq	%r8,%r10
 	shlq	$62,%r10
 	shrq	$62,%r10
 
-
+// make IV from TAG
 	vmovdqa	(%rdx),%xmm15
-	vpor	OR_MASK(%rip),%xmm15,%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15  // IV = 1TAG126...3200..00
 
-	vmovdqu	four(%rip),%xmm4
-	vmovdqa	%xmm15,%xmm0
-	vpaddd	one(%rip),%xmm15,%xmm1
-	vpaddd	two(%rip),%xmm15,%xmm2
-	vpaddd	three(%rip),%xmm15,%xmm3
+	vmovdqu	four(%rip),%xmm4  // Register to increment counters
+	vmovdqa	%xmm15,%xmm0  // CTR1 = TAG1127...3200..00
+	vpaddd	one(%rip),%xmm15,%xmm1  // CTR2 = TAG1127...3200..01
+	vpaddd	two(%rip),%xmm15,%xmm2  // CTR3 = TAG1127...3200..02
+	vpaddd	three(%rip),%xmm15,%xmm3  // CTR4 = TAG1127...3200..03
 
 	shrq	$2,%r8
 	je	L$128_enc_msg_x4_check_remainder
@@ -850,7 +850,7 @@
 	vaesenclast	%xmm12,%xmm8,%xmm8
 
 
-
+// XOR with Plaintext
 	vpxor	0(%rdi),%xmm5,%xmm5
 	vpxor	16(%rdi),%xmm6,%xmm6
 	vpxor	32(%rdi),%xmm7,%xmm7
@@ -873,10 +873,10 @@
 	je	L$128_enc_msg_x4_out
 
 L$128_enc_msg_x4_loop2:
-
-
+// enc each block separately
+// CTR1 is the highest counter (even if no LOOP done)
 	vmovdqa	%xmm0,%xmm5
-	vpaddd	one(%rip),%xmm0,%xmm0
+	vpaddd	one(%rip),%xmm0,%xmm0  // inc counter
 
 	vpxor	(%rcx),%xmm5,%xmm5
 	vaesenc	16(%rcx),%xmm5,%xmm5
@@ -890,7 +890,7 @@
 	vaesenc	144(%rcx),%xmm5,%xmm5
 	vaesenclast	160(%rcx),%xmm5,%xmm5
 
-
+// XOR with plaintext
 	vpxor	(%rdi),%xmm5,%xmm5
 	vmovdqu	%xmm5,(%rsi)
 
@@ -930,29 +930,29 @@
 	movq	%rsp,%rbp
 
 
-
+// Place in stack
 	subq	$128,%rsp
 	andq	$-64,%rsp
 
-	shrq	$4,%r8
+	shrq	$4,%r8  // LEN = num of blocks
 	movq	%r8,%r10
 	shlq	$61,%r10
 	shrq	$61,%r10
 
-
+// make IV from TAG
 	vmovdqu	(%rdx),%xmm1
-	vpor	OR_MASK(%rip),%xmm1,%xmm1
-
+	vpor	OR_MASK(%rip),%xmm1,%xmm1  // TMP1= IV = 1TAG126...3200..00
 
+// store counter8 in the stack
 	vpaddd	seven(%rip),%xmm1,%xmm0
-	vmovdqu	%xmm0,(%rsp)
-	vpaddd	one(%rip),%xmm1,%xmm9
-	vpaddd	two(%rip),%xmm1,%xmm10
-	vpaddd	three(%rip),%xmm1,%xmm11
-	vpaddd	four(%rip),%xmm1,%xmm12
-	vpaddd	five(%rip),%xmm1,%xmm13
-	vpaddd	six(%rip),%xmm1,%xmm14
-	vmovdqa	%xmm1,%xmm0
+	vmovdqu	%xmm0,(%rsp)  // CTR8 = TAG127...3200..07
+	vpaddd	one(%rip),%xmm1,%xmm9  // CTR2 = TAG127...3200..01
+	vpaddd	two(%rip),%xmm1,%xmm10  // CTR3 = TAG127...3200..02
+	vpaddd	three(%rip),%xmm1,%xmm11  // CTR4 = TAG127...3200..03
+	vpaddd	four(%rip),%xmm1,%xmm12  // CTR5 = TAG127...3200..04
+	vpaddd	five(%rip),%xmm1,%xmm13  // CTR6 = TAG127...3200..05
+	vpaddd	six(%rip),%xmm1,%xmm14  // CTR7 = TAG127...3200..06
+	vmovdqa	%xmm1,%xmm0  // CTR1 = TAG127...3200..00
 
 	shrq	$3,%r8
 	je	L$128_enc_msg_x8_check_remainder
@@ -971,7 +971,7 @@
 	vmovdqa	%xmm12,%xmm5
 	vmovdqa	%xmm13,%xmm6
 	vmovdqa	%xmm14,%xmm7
-
+// move from stack
 	vmovdqu	(%rsp),%xmm8
 
 	vpxor	(%rcx),%xmm1,%xmm1
@@ -993,7 +993,7 @@
 	vaesenc	%xmm15,%xmm7,%xmm7
 	vaesenc	%xmm15,%xmm8,%xmm8
 
-	vmovdqu	(%rsp),%xmm14
+	vmovdqu	(%rsp),%xmm14  // deal with CTR8
 	vpaddd	eight(%rip),%xmm14,%xmm14
 	vmovdqu	%xmm14,(%rsp)
 	vmovdqu	32(%rcx),%xmm15
@@ -1094,7 +1094,7 @@
 	vaesenclast	%xmm15,%xmm8,%xmm8
 
 
-
+// XOR with Plaintext
 	vpxor	0(%rdi),%xmm1,%xmm1
 	vpxor	16(%rdi),%xmm2,%xmm2
 	vpxor	32(%rdi),%xmm3,%xmm3
@@ -1125,10 +1125,10 @@
 	je	L$128_enc_msg_x8_out
 
 L$128_enc_msg_x8_loop2:
-
-
+// enc each block separately
+// CTR1 is the highest counter (even if no LOOP done)
 	vmovdqa	%xmm0,%xmm1
-	vpaddd	one(%rip),%xmm0,%xmm0
+	vpaddd	one(%rip),%xmm0,%xmm0  // inc counter
 
 	vpxor	(%rcx),%xmm1,%xmm1
 	vaesenc	16(%rcx),%xmm1,%xmm1
@@ -1142,7 +1142,7 @@
 	vaesenc	144(%rcx),%xmm1,%xmm1
 	vaesenclast	160(%rcx),%xmm1,%xmm1
 
-
+// XOR with Plaintext
 	vpxor	(%rdi),%xmm1,%xmm1
 
 	vmovdqu	%xmm1,(%rsi)
@@ -1180,10 +1180,10 @@
 L$128_dec_start:
 	vzeroupper
 	vmovdqa	(%rdx),%xmm0
-
-
+// The claimed tag is provided after the current calculated tag value.
+// CTRBLKs is made from it.
 	vmovdqu	16(%rdx),%xmm15
-	vpor	OR_MASK(%rip),%xmm15,%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15  // CTR = 1TAG126...3200..00
 	movq	%rdx,%rax
 
 	leaq	32(%rax),%rax
@@ -1191,11 +1191,11 @@
 
 	andq	$~15,%r9
 
-
+// If less then 6 blocks, make singles
 	cmpq	$96,%r9
 	jb	L$128_dec_loop2
 
-
+// Decrypt the first six blocks
 	subq	$96,%r9
 	vmovdqa	%xmm15,%xmm7
 	vpaddd	one(%rip),%xmm7,%xmm8
@@ -1292,7 +1292,7 @@
 	vaesenclast	%xmm4,%xmm11,%xmm11
 	vaesenclast	%xmm4,%xmm12,%xmm12
 
-
+// XOR with CT
 	vpxor	0(%rdi),%xmm7,%xmm7
 	vpxor	16(%rdi),%xmm8,%xmm8
 	vpxor	32(%rdi),%xmm9,%xmm9
@@ -1311,7 +1311,7 @@
 	addq	$96,%rsi
 	jmp	L$128_dec_loop1
 
-
+// Decrypt 6 blocks each time while hashing previous 6 blocks
 .p2align	6
 L$128_dec_loop1:
 	cmpq	$96,%r9
@@ -1623,9 +1623,9 @@
 	vpxor	%xmm5,%xmm0,%xmm0
 
 L$128_dec_loop2:
+// Here we encrypt any remaining whole block
 
-
-
+// if there are no whole blocks
 	cmpq	$16,%r9
 	jb	L$128_dec_out
 	subq	$16,%r9
@@ -1680,7 +1680,7 @@
 	vaesenc	112(%rdx),%xmm1,%xmm1
 	vaesenc	128(%rdx),%xmm1,%xmm1
 	vaesenc	144(%rdx),%xmm1,%xmm1
-	vaesenclast	160(%rdx),%xmm1,%xmm1
+	vaesenclast	160(%rdx),%xmm1,%xmm1  // STATE_1 == IV
 
 	vmovdqa	%xmm1,(%rsi)
 
@@ -1695,14 +1695,14 @@
 _aes256gcmsiv_aes_ks_enc_x1:
 
 _CET_ENDBR
-	vmovdqa	con1(%rip),%xmm0
-	vmovdqa	mask(%rip),%xmm15
+	vmovdqa	con1(%rip),%xmm0  // CON_MASK  = 1,1,1,1
+	vmovdqa	mask(%rip),%xmm15  // MASK_256
 	vmovdqa	(%rdi),%xmm8
-	vmovdqa	(%rcx),%xmm1
+	vmovdqa	(%rcx),%xmm1  // KEY_1 || KEY_2 0..7 = user key
 	vmovdqa	16(%rcx),%xmm3
 	vpxor	%xmm1,%xmm8,%xmm8
 	vaesenc	%xmm3,%xmm8,%xmm8
-	vmovdqu	%xmm1,(%rdx)
+	vmovdqu	%xmm1,(%rdx)  // First round key
 	vmovdqu	%xmm3,16(%rdx)
 	vpxor	%xmm14,%xmm14,%xmm14
 
@@ -1895,7 +1895,7 @@
 	vaesenc	176(%rdx),%xmm1,%xmm1
 	vaesenc	192(%rdx),%xmm1,%xmm1
 	vaesenc	208(%rdx),%xmm1,%xmm1
-	vaesenclast	224(%rdx),%xmm1,%xmm1
+	vaesenclast	224(%rdx),%xmm1,%xmm1  // %xmm1 == IV
 	vmovdqa	%xmm1,(%rsi)
 	ret
 
@@ -1914,7 +1914,7 @@
 
 L$256_enc_msg_x4_start:
 	movq	%r8,%r10
-	shrq	$4,%r8
+	shrq	$4,%r8  // LEN = num of blocks
 	shlq	$60,%r10
 	jz	L$256_enc_msg_x4_start2
 	addq	$1,%r8
@@ -1924,15 +1924,15 @@
 	shlq	$62,%r10
 	shrq	$62,%r10
 
-
+// make IV from TAG
 	vmovdqa	(%rdx),%xmm15
-	vpor	OR_MASK(%rip),%xmm15,%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15  // IV = 1TAG126...3200..00
 
-	vmovdqa	four(%rip),%xmm4
-	vmovdqa	%xmm15,%xmm0
-	vpaddd	one(%rip),%xmm15,%xmm1
-	vpaddd	two(%rip),%xmm15,%xmm2
-	vpaddd	three(%rip),%xmm15,%xmm3
+	vmovdqa	four(%rip),%xmm4  // Register to increment counters
+	vmovdqa	%xmm15,%xmm0  // CTR1 = TAG1127...3200..00
+	vpaddd	one(%rip),%xmm15,%xmm1  // CTR2 = TAG1127...3200..01
+	vpaddd	two(%rip),%xmm15,%xmm2  // CTR3 = TAG1127...3200..02
+	vpaddd	three(%rip),%xmm15,%xmm3  // CTR4 = TAG1127...3200..03
 
 	shrq	$2,%r8
 	je	L$256_enc_msg_x4_check_remainder
@@ -2044,7 +2044,7 @@
 	vaesenclast	%xmm12,%xmm8,%xmm8
 
 
-
+// XOR with Plaintext
 	vpxor	0(%rdi),%xmm5,%xmm5
 	vpxor	16(%rdi),%xmm6,%xmm6
 	vpxor	32(%rdi),%xmm7,%xmm7
@@ -2067,11 +2067,11 @@
 	je	L$256_enc_msg_x4_out
 
 L$256_enc_msg_x4_loop2:
-
-
+// encrypt each block separately
+// CTR1 is the highest counter (even if no LOOP done)
 
 	vmovdqa	%xmm0,%xmm5
-	vpaddd	one(%rip),%xmm0,%xmm0
+	vpaddd	one(%rip),%xmm0,%xmm0  // inc counter
 	vpxor	(%rcx),%xmm5,%xmm5
 	vaesenc	16(%rcx),%xmm5,%xmm5
 	vaesenc	32(%rcx),%xmm5,%xmm5
@@ -2088,7 +2088,7 @@
 	vaesenc	208(%rcx),%xmm5,%xmm5
 	vaesenclast	224(%rcx),%xmm5,%xmm5
 
-
+// XOR with Plaintext
 	vpxor	(%rdi),%xmm5,%xmm5
 
 	vmovdqu	%xmm5,(%rsi)
@@ -2116,13 +2116,13 @@
 	ret
 
 L$256_enc_msg_x8_start:
-
+// Place in stack
 	movq	%rsp,%r11
 	subq	$16,%r11
 	andq	$-64,%r11
 
 	movq	%r8,%r10
-	shrq	$4,%r8
+	shrq	$4,%r8  // LEN = num of blocks
 	shlq	$60,%r10
 	jz	L$256_enc_msg_x8_start2
 	addq	$1,%r8
@@ -2132,20 +2132,20 @@
 	shlq	$61,%r10
 	shrq	$61,%r10
 
-
+// Make IV from TAG
 	vmovdqa	(%rdx),%xmm1
-	vpor	OR_MASK(%rip),%xmm1,%xmm1
-
+	vpor	OR_MASK(%rip),%xmm1,%xmm1  // TMP1= IV = 1TAG126...3200..00
 
+// store counter8 on the stack
 	vpaddd	seven(%rip),%xmm1,%xmm0
-	vmovdqa	%xmm0,(%r11)
-	vpaddd	one(%rip),%xmm1,%xmm9
-	vpaddd	two(%rip),%xmm1,%xmm10
-	vpaddd	three(%rip),%xmm1,%xmm11
-	vpaddd	four(%rip),%xmm1,%xmm12
-	vpaddd	five(%rip),%xmm1,%xmm13
-	vpaddd	six(%rip),%xmm1,%xmm14
-	vmovdqa	%xmm1,%xmm0
+	vmovdqa	%xmm0,(%r11)  // CTR8 = TAG127...3200..07
+	vpaddd	one(%rip),%xmm1,%xmm9  // CTR2 = TAG127...3200..01
+	vpaddd	two(%rip),%xmm1,%xmm10  // CTR3 = TAG127...3200..02
+	vpaddd	three(%rip),%xmm1,%xmm11  // CTR4 = TAG127...3200..03
+	vpaddd	four(%rip),%xmm1,%xmm12  // CTR5 = TAG127...3200..04
+	vpaddd	five(%rip),%xmm1,%xmm13  // CTR6 = TAG127...3200..05
+	vpaddd	six(%rip),%xmm1,%xmm14  // CTR7 = TAG127...3200..06
+	vmovdqa	%xmm1,%xmm0  // CTR1 = TAG127...3200..00
 
 	shrq	$3,%r8
 	jz	L$256_enc_msg_x8_check_remainder
@@ -2164,7 +2164,7 @@
 	vmovdqa	%xmm12,%xmm5
 	vmovdqa	%xmm13,%xmm6
 	vmovdqa	%xmm14,%xmm7
-
+// move from stack
 	vmovdqa	(%r11),%xmm8
 
 	vpxor	(%rcx),%xmm1,%xmm1
@@ -2186,7 +2186,7 @@
 	vaesenc	%xmm15,%xmm7,%xmm7
 	vaesenc	%xmm15,%xmm8,%xmm8
 
-	vmovdqa	(%r11),%xmm14
+	vmovdqa	(%r11),%xmm14  // deal with CTR8
 	vpaddd	eight(%rip),%xmm14,%xmm14
 	vmovdqa	%xmm14,(%r11)
 	vmovdqu	32(%rcx),%xmm15
@@ -2327,7 +2327,7 @@
 	vaesenclast	%xmm15,%xmm8,%xmm8
 
 
-
+// XOR with Plaintext
 	vpxor	0(%rdi),%xmm1,%xmm1
 	vpxor	16(%rdi),%xmm2,%xmm2
 	vpxor	32(%rdi),%xmm3,%xmm3
@@ -2358,8 +2358,8 @@
 	je	L$256_enc_msg_x8_out
 
 L$256_enc_msg_x8_loop2:
-
-
+// encrypt each block separately
+// CTR1 is the highest counter (even if no LOOP done)
 	vmovdqa	%xmm0,%xmm1
 	vpaddd	one(%rip),%xmm0,%xmm0
 
@@ -2379,7 +2379,7 @@
 	vaesenc	208(%rcx),%xmm1,%xmm1
 	vaesenclast	224(%rcx),%xmm1,%xmm1
 
-
+// XOR with Plaintext
 	vpxor	(%rdi),%xmm1,%xmm1
 
 	vmovdqu	%xmm1,(%rsi)
@@ -2409,10 +2409,10 @@
 L$256_dec_start:
 	vzeroupper
 	vmovdqa	(%rdx),%xmm0
-
-
+// The claimed tag is provided after the current calculated tag value.
+// CTRBLKs is made from it.
 	vmovdqu	16(%rdx),%xmm15
-	vpor	OR_MASK(%rip),%xmm15,%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15  // CTR = 1TAG126...3200..00
 	movq	%rdx,%rax
 
 	leaq	32(%rax),%rax
@@ -2420,11 +2420,11 @@
 
 	andq	$~15,%r9
 
-
+// If less then 6 blocks, make singles
 	cmpq	$96,%r9
 	jb	L$256_dec_loop2
 
-
+// Decrypt the first six blocks
 	subq	$96,%r9
 	vmovdqa	%xmm15,%xmm7
 	vpaddd	one(%rip),%xmm7,%xmm8
@@ -2553,7 +2553,7 @@
 	vaesenclast	%xmm4,%xmm11,%xmm11
 	vaesenclast	%xmm4,%xmm12,%xmm12
 
-
+// XOR with CT
 	vpxor	0(%rdi),%xmm7,%xmm7
 	vpxor	16(%rdi),%xmm8,%xmm8
 	vpxor	32(%rdi),%xmm9,%xmm9
@@ -2572,7 +2572,7 @@
 	addq	$96,%rsi
 	jmp	L$256_dec_loop1
 
-
+// Decrypt 6 blocks each time while hashing previous 6 blocks
 .p2align	6
 L$256_dec_loop1:
 	cmpq	$96,%r9
@@ -2916,9 +2916,9 @@
 	vpxor	%xmm5,%xmm0,%xmm0
 
 L$256_dec_loop2:
+// Here we encrypt any remaining whole block
 
-
-
+// if there are no whole blocks
 	cmpq	$16,%r9
 	jb	L$256_dec_out
 	subq	$16,%r9
@@ -2965,11 +2965,11 @@
 _aes256gcmsiv_kdf:
 
 _CET_ENDBR
+// parameter 1: %rdi                         Pointer to NONCE
+// parameter 2: %rsi                         Pointer to CT
+// parameter 4: %rdx                         Pointer to keys
 
-
-
-
-	vmovdqa	(%rdx),%xmm1
+	vmovdqa	(%rdx),%xmm1  // xmm1 = first 16 bytes of random key
 	vmovdqa	0(%rdi),%xmm4
 	vmovdqa	and_mask(%rip),%xmm11
 	vmovdqa	one(%rip),%xmm8

boringssl-0.20260708.tar.xz/gen/crypto/aes128gcmsiv-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/crypto/aes128gcmsiv-x86_64-linux.S Changed

@@ -74,21 +74,21 @@
 _CET_ENDBR
 	vmovdqa	(%rsi),%xmm0
 	vmovdqa	%xmm0,%xmm1
-	vmovdqa	%xmm0,(%rdi)
+	vmovdqa	%xmm0,(%rdi)  // H
 	call	GFMUL
-	vmovdqa	%xmm0,16(%rdi)
+	vmovdqa	%xmm0,16(%rdi)  // H^2
 	call	GFMUL
-	vmovdqa	%xmm0,32(%rdi)
+	vmovdqa	%xmm0,32(%rdi)  // H^3
 	call	GFMUL
-	vmovdqa	%xmm0,48(%rdi)
+	vmovdqa	%xmm0,48(%rdi)  // H^4
 	call	GFMUL
-	vmovdqa	%xmm0,64(%rdi)
+	vmovdqa	%xmm0,64(%rdi)  // H^5
 	call	GFMUL
-	vmovdqa	%xmm0,80(%rdi)
+	vmovdqa	%xmm0,80(%rdi)  // H^6
 	call	GFMUL
-	vmovdqa	%xmm0,96(%rdi)
+	vmovdqa	%xmm0,96(%rdi)  // H^7
 	call	GFMUL
-	vmovdqa	%xmm0,112(%rdi)
+	vmovdqa	%xmm0,112(%rdi)  // H^8
 	ret
 .cfi_endproc	
 .size	aesgcmsiv_htable_init, .-aesgcmsiv_htable_init
@@ -101,17 +101,17 @@
 _CET_ENDBR
 	vmovdqa	(%rsi),%xmm0
 	vmovdqa	%xmm0,%xmm1
-	vmovdqa	%xmm0,(%rdi)
+	vmovdqa	%xmm0,(%rdi)  // H
 	call	GFMUL
-	vmovdqa	%xmm0,16(%rdi)
+	vmovdqa	%xmm0,16(%rdi)  // H^2
 	call	GFMUL
-	vmovdqa	%xmm0,32(%rdi)
+	vmovdqa	%xmm0,32(%rdi)  // H^3
 	call	GFMUL
-	vmovdqa	%xmm0,48(%rdi)
+	vmovdqa	%xmm0,48(%rdi)  // H^4
 	call	GFMUL
-	vmovdqa	%xmm0,64(%rdi)
+	vmovdqa	%xmm0,64(%rdi)  // H^5
 	call	GFMUL
-	vmovdqa	%xmm0,80(%rdi)
+	vmovdqa	%xmm0,80(%rdi)  // H^6
 	ret
 .cfi_endproc	
 .size	aesgcmsiv_htable6_init, .-aesgcmsiv_htable6_init
@@ -129,8 +129,8 @@
 .Lhtable_polyval_start:
 	vzeroall
 
-
-
+// We hash 8 blocks each iteration. If the total number of blocks is not a
+// multiple of 8, we first hash the leading n%8 blocks.
 	movq	%rdx,%r11
 	andq	$127,%r11
 
@@ -142,7 +142,7 @@
 
 	subq	$16,%r11
 
-
+// hash first prefix block
 	vmovdqu	(%rsi),%xmm0
 	vpxor	%xmm1,%xmm0,%xmm0
 
@@ -157,12 +157,12 @@
 	jnz	.Lhtable_polyval_prefix_loop
 	jmp	.Lhtable_polyval_prefix_complete
 
-
+// hash remaining prefix blocks (up to 7 total prefix blocks)
 .align	64
 .Lhtable_polyval_prefix_loop:
 	subq	$16,%r11
 
-	vmovdqu	(%rsi),%xmm0
+	vmovdqu	(%rsi),%xmm0  // next data block
 
 	vpclmulqdq	$0x00,(%rdi,%r11,1),%xmm0,%xmm6
 	vpxor	%xmm6,%xmm3,%xmm3
@@ -189,10 +189,10 @@
 	jmp	.Lhtable_polyval_main_loop
 
 .Lhtable_polyval_no_prefix:
-
-
-
-
+// At this point we know the number of blocks is a multiple of 8. However,
+// the reduction in the main loop includes a multiplication by x^(-128). In
+// order to counter this, the existing tag needs to be multiplied by x^128.
+// In practice, this just means that it is loaded into %xmm9, not %xmm1.
 	vpxor	%xmm1,%xmm1,%xmm1
 	vmovdqa	(%rcx),%xmm9
 
@@ -201,7 +201,7 @@
 	subq	$0x80,%rdx
 	jb	.Lhtable_polyval_out
 
-	vmovdqu	112(%rsi),%xmm0
+	vmovdqu	112(%rsi),%xmm0  // Ii
 
 	vpclmulqdq	$0x01,(%rdi),%xmm0,%xmm5
 	vpclmulqdq	$0x00,(%rdi),%xmm0,%xmm3
@@ -209,7 +209,7 @@
 	vpclmulqdq	$0x10,(%rdi),%xmm0,%xmm6
 	vpxor	%xmm6,%xmm5,%xmm5
 
-
+// ########################################################
 	vmovdqu	96(%rsi),%xmm0
 	vpclmulqdq	$0x01,16(%rdi),%xmm0,%xmm6
 	vpxor	%xmm6,%xmm5,%xmm5
@@ -221,10 +221,10 @@
 	vpxor	%xmm6,%xmm5,%xmm5
 
 
-
+// ########################################################
 	vmovdqu	80(%rsi),%xmm0
 
-	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm7
+	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm7  // reduction stage 1a
 	vpalignr	$8,%xmm1,%xmm1,%xmm1
 
 	vpclmulqdq	$0x01,32(%rdi),%xmm0,%xmm6
@@ -237,8 +237,8 @@
 	vpxor	%xmm6,%xmm5,%xmm5
 
 
-	vpxor	%xmm7,%xmm1,%xmm1
-
+	vpxor	%xmm7,%xmm1,%xmm1  // reduction stage 1b
+// ########################################################
 	vmovdqu	64(%rsi),%xmm0
 
 	vpclmulqdq	$0x01,48(%rdi),%xmm0,%xmm6
@@ -250,10 +250,10 @@
 	vpclmulqdq	$0x10,48(%rdi),%xmm0,%xmm6
 	vpxor	%xmm6,%xmm5,%xmm5
 
-
+// ########################################################
 	vmovdqu	48(%rsi),%xmm0
 
-	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm7
+	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm7  // reduction stage 2a
 	vpalignr	$8,%xmm1,%xmm1,%xmm1
 
 	vpclmulqdq	$0x01,64(%rdi),%xmm0,%xmm6
@@ -266,8 +266,8 @@
 	vpxor	%xmm6,%xmm5,%xmm5
 
 
-	vpxor	%xmm7,%xmm1,%xmm1
-
+	vpxor	%xmm7,%xmm1,%xmm1  // reduction stage 2b
+// ########################################################
 	vmovdqu	32(%rsi),%xmm0
 
 	vpclmulqdq	$0x01,80(%rdi),%xmm0,%xmm6
@@ -280,8 +280,8 @@
 	vpxor	%xmm6,%xmm5,%xmm5
 
 
-	vpxor	%xmm9,%xmm1,%xmm1
-
+	vpxor	%xmm9,%xmm1,%xmm1  // reduction finalize
+// ########################################################
 	vmovdqu	16(%rsi),%xmm0
 
 	vpclmulqdq	$0x01,96(%rdi),%xmm0,%xmm6
@@ -293,7 +293,7 @@
 	vpclmulqdq	$0x10,96(%rdi),%xmm0,%xmm6
 	vpxor	%xmm6,%xmm5,%xmm5
 
-
+// ########################################################
 	vmovdqu	0(%rsi),%xmm0
 	vpxor	%xmm1,%xmm0,%xmm0
 
@@ -306,7 +306,7 @@
 	vpclmulqdq	$0x10,112(%rdi),%xmm0,%xmm6
 	vpxor	%xmm6,%xmm5,%xmm5
 
-
+// ########################################################
 	vpsrldq	$8,%xmm5,%xmm6
 	vpslldq	$8,%xmm5,%xmm5
 
@@ -316,7 +316,7 @@
 	leaq	128(%rsi),%rsi
 	jmp	.Lhtable_polyval_main_loop
 
-
+// ########################################################
 
 .Lhtable_polyval_out:
 	vpclmulqdq	$0x10,poly(%rip),%xmm1,%xmm6
@@ -345,24 +345,24 @@
 	ret
 
 .Lpolyval_horner_start:
-
-
+// We will start with L GFMULS for POLYVAL(BIG_BUFFER)
+// RES = GFMUL(RES, H)
 
 	xorq	%r10,%r10
-	shlq	$4,%rcx
+	shlq	$4,%rcx  // L contains number of bytes to process
 
 	vmovdqa	(%rsi),%xmm1
 	vmovdqa	(%rdi),%xmm0
 
 .Lpolyval_horner_loop:
-	vpxor	(%rdx,%r10,1),%xmm0,%xmm0
-	call	GFMUL
+	vpxor	(%rdx,%r10,1),%xmm0,%xmm0  // RES = RES + Xi
+	call	GFMUL  // RES = RES * H
 
 	addq	$16,%r10
 	cmpq	%r10,%rcx
 	jne	.Lpolyval_horner_loop
 
-
+// calculation of T is complete. RES=T
 	vmovdqa	%xmm0,(%rdi)
 	ret
 .cfi_endproc	
@@ -374,8 +374,8 @@
 aes128gcmsiv_aes_ks:
 .cfi_startproc	
 _CET_ENDBR
-	vmovdqu	(%rdi),%xmm1
-	vmovdqa	%xmm1,(%rsi)
+	vmovdqu	(%rdi),%xmm1  // xmm1 = user key
+	vmovdqa	%xmm1,(%rsi)  // rsi points to output
 
 	vmovdqa	con1(%rip),%xmm0
 	vmovdqa	mask(%rip),%xmm15
@@ -383,9 +383,9 @@
 	movq	$8,%rax
 
 .Lks128_loop:
-	addq	$16,%rsi
+	addq	$16,%rsi  // rsi points for next key
 	subq	$1,%rax
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // xmm2 = shuffled user key
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
 	vpslldq	$4,%xmm1,%xmm3
@@ -479,19 +479,19 @@
 aes128gcmsiv_aes_ks_enc_x1:
 .cfi_startproc	
 _CET_ENDBR
-	vmovdqa	(%rcx),%xmm1
+	vmovdqa	(%rcx),%xmm1  // xmm1 = first 16 bytes of random key
 	vmovdqa	0(%rdi),%xmm4
 
-	vmovdqa	%xmm1,(%rdx)
+	vmovdqa	%xmm1,(%rdx)  // KEY0 = first 16 bytes of random key
 	vpxor	%xmm1,%xmm4,%xmm4
 
-	vmovdqa	con1(%rip),%xmm0
-	vmovdqa	mask(%rip),%xmm15
+	vmovdqa	con1(%rip),%xmm0  // xmm0  = 1,1,1,1
+	vmovdqa	mask(%rip),%xmm15  // xmm15 = mask
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -500,10 +500,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,16(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -512,10 +512,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,32(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -524,10 +524,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,48(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -536,10 +536,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,64(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -548,10 +548,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,80(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -560,10 +560,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,96(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -572,10 +572,10 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,112(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -587,10 +587,10 @@
 
 	vmovdqa	con2(%rip),%xmm0
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
 	vpslld	$1,%xmm0,%xmm0
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -599,9 +599,9 @@
 	vaesenc	%xmm1,%xmm4,%xmm4
 	vmovdqa	%xmm1,144(%rdx)
 
-	vpshufb	%xmm15,%xmm1,%xmm2
+	vpshufb	%xmm15,%xmm1,%xmm2  // 
 	vaesenclast	%xmm0,%xmm2,%xmm2
-	vpsllq	$32,%xmm1,%xmm3
+	vpsllq	$32,%xmm1,%xmm3  // 
 	vpxor	%xmm3,%xmm1,%xmm1
 	vpshufb	con3(%rip),%xmm1,%xmm3
 	vpxor	%xmm3,%xmm1,%xmm1
@@ -622,11 +622,11 @@
 aes128gcmsiv_kdf:
 .cfi_startproc	
 _CET_ENDBR
+// parameter 1: %rdi                         Pointer to NONCE
+// parameter 2: %rsi                         Pointer to CT
+// parameter 4: %rdx                         Pointer to keys
 
-
-
-
-	vmovdqa	(%rdx),%xmm1
+	vmovdqa	(%rdx),%xmm1  // xmm1 = first 16 bytes of random key
 	vmovdqa	0(%rdi),%xmm9
 	vmovdqa	and_mask(%rip),%xmm12
 	vmovdqa	one(%rip),%xmm13
@@ -728,20 +728,20 @@
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r13,-24
 
-	shrq	$4,%r8
+	shrq	$4,%r8  // LEN = num of blocks
 	movq	%r8,%r10
 	shlq	$62,%r10
 	shrq	$62,%r10
 
-
+// make IV from TAG
 	vmovdqa	(%rdx),%xmm15
-	vpor	OR_MASK(%rip),%xmm15,%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15  // IV = 1TAG126...3200..00
 
-	vmovdqu	four(%rip),%xmm4
-	vmovdqa	%xmm15,%xmm0
-	vpaddd	one(%rip),%xmm15,%xmm1
-	vpaddd	two(%rip),%xmm15,%xmm2
-	vpaddd	three(%rip),%xmm15,%xmm3
+	vmovdqu	four(%rip),%xmm4  // Register to increment counters
+	vmovdqa	%xmm15,%xmm0  // CTR1 = TAG1127...3200..00
+	vpaddd	one(%rip),%xmm15,%xmm1  // CTR2 = TAG1127...3200..01
+	vpaddd	two(%rip),%xmm15,%xmm2  // CTR3 = TAG1127...3200..02
+	vpaddd	three(%rip),%xmm15,%xmm3  // CTR4 = TAG1127...3200..03
 
 	shrq	$2,%r8
 	je	.L128_enc_msg_x4_check_remainder
@@ -829,7 +829,7 @@
 	vaesenclast	%xmm12,%xmm8,%xmm8
 
 
-
+// XOR with Plaintext
 	vpxor	0(%rdi),%xmm5,%xmm5
 	vpxor	16(%rdi),%xmm6,%xmm6
 	vpxor	32(%rdi),%xmm7,%xmm7
@@ -852,10 +852,10 @@
 	je	.L128_enc_msg_x4_out
 
 .L128_enc_msg_x4_loop2:
-
-
+// enc each block separately
+// CTR1 is the highest counter (even if no LOOP done)
 	vmovdqa	%xmm0,%xmm5
-	vpaddd	one(%rip),%xmm0,%xmm0
+	vpaddd	one(%rip),%xmm0,%xmm0  // inc counter
 
 	vpxor	(%rcx),%xmm5,%xmm5
 	vaesenc	16(%rcx),%xmm5,%xmm5
@@ -869,7 +869,7 @@
 	vaesenc	144(%rcx),%xmm5,%xmm5
 	vaesenclast	160(%rcx),%xmm5,%xmm5
 
-
+// XOR with plaintext
 	vpxor	(%rdi),%xmm5,%xmm5
 	vmovdqu	%xmm5,(%rsi)
 
@@ -913,29 +913,29 @@
 	movq	%rsp,%rbp
 .cfi_def_cfa_register	rbp
 
-
+// Place in stack
 	subq	$128,%rsp
 	andq	$-64,%rsp
 
-	shrq	$4,%r8
+	shrq	$4,%r8  // LEN = num of blocks
 	movq	%r8,%r10
 	shlq	$61,%r10
 	shrq	$61,%r10
 
-
+// make IV from TAG
 	vmovdqu	(%rdx),%xmm1
-	vpor	OR_MASK(%rip),%xmm1,%xmm1
-
+	vpor	OR_MASK(%rip),%xmm1,%xmm1  // TMP1= IV = 1TAG126...3200..00
 
+// store counter8 in the stack
 	vpaddd	seven(%rip),%xmm1,%xmm0
-	vmovdqu	%xmm0,(%rsp)
-	vpaddd	one(%rip),%xmm1,%xmm9
-	vpaddd	two(%rip),%xmm1,%xmm10
-	vpaddd	three(%rip),%xmm1,%xmm11
-	vpaddd	four(%rip),%xmm1,%xmm12
-	vpaddd	five(%rip),%xmm1,%xmm13
-	vpaddd	six(%rip),%xmm1,%xmm14
-	vmovdqa	%xmm1,%xmm0
+	vmovdqu	%xmm0,(%rsp)  // CTR8 = TAG127...3200..07
+	vpaddd	one(%rip),%xmm1,%xmm9  // CTR2 = TAG127...3200..01
+	vpaddd	two(%rip),%xmm1,%xmm10  // CTR3 = TAG127...3200..02
+	vpaddd	three(%rip),%xmm1,%xmm11  // CTR4 = TAG127...3200..03
+	vpaddd	four(%rip),%xmm1,%xmm12  // CTR5 = TAG127...3200..04
+	vpaddd	five(%rip),%xmm1,%xmm13  // CTR6 = TAG127...3200..05
+	vpaddd	six(%rip),%xmm1,%xmm14  // CTR7 = TAG127...3200..06
+	vmovdqa	%xmm1,%xmm0  // CTR1 = TAG127...3200..00
 
 	shrq	$3,%r8
 	je	.L128_enc_msg_x8_check_remainder
@@ -954,7 +954,7 @@
 	vmovdqa	%xmm12,%xmm5
 	vmovdqa	%xmm13,%xmm6
 	vmovdqa	%xmm14,%xmm7
-
+// move from stack
 	vmovdqu	(%rsp),%xmm8
 
 	vpxor	(%rcx),%xmm1,%xmm1
@@ -976,7 +976,7 @@
 	vaesenc	%xmm15,%xmm7,%xmm7
 	vaesenc	%xmm15,%xmm8,%xmm8
 
-	vmovdqu	(%rsp),%xmm14
+	vmovdqu	(%rsp),%xmm14  // deal with CTR8
 	vpaddd	eight(%rip),%xmm14,%xmm14
 	vmovdqu	%xmm14,(%rsp)
 	vmovdqu	32(%rcx),%xmm15
@@ -1077,7 +1077,7 @@
 	vaesenclast	%xmm15,%xmm8,%xmm8
 
 
-
+// XOR with Plaintext
 	vpxor	0(%rdi),%xmm1,%xmm1
 	vpxor	16(%rdi),%xmm2,%xmm2
 	vpxor	32(%rdi),%xmm3,%xmm3
@@ -1108,10 +1108,10 @@
 	je	.L128_enc_msg_x8_out
 
 .L128_enc_msg_x8_loop2:
-
-
+// enc each block separately
+// CTR1 is the highest counter (even if no LOOP done)
 	vmovdqa	%xmm0,%xmm1
-	vpaddd	one(%rip),%xmm0,%xmm0
+	vpaddd	one(%rip),%xmm0,%xmm0  // inc counter
 
 	vpxor	(%rcx),%xmm1,%xmm1
 	vaesenc	16(%rcx),%xmm1,%xmm1
@@ -1125,7 +1125,7 @@
 	vaesenc	144(%rcx),%xmm1,%xmm1
 	vaesenclast	160(%rcx),%xmm1,%xmm1
 
-
+// XOR with Plaintext
 	vpxor	(%rdi),%xmm1,%xmm1
 
 	vmovdqu	%xmm1,(%rsi)
@@ -1165,10 +1165,10 @@
 .L128_dec_start:
 	vzeroupper
 	vmovdqa	(%rdx),%xmm0
-
-
+// The claimed tag is provided after the current calculated tag value.
+// CTRBLKs is made from it.
 	vmovdqu	16(%rdx),%xmm15
-	vpor	OR_MASK(%rip),%xmm15,%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15  // CTR = 1TAG126...3200..00
 	movq	%rdx,%rax
 
 	leaq	32(%rax),%rax
@@ -1176,11 +1176,11 @@
 
 	andq	$~15,%r9
 
-
+// If less then 6 blocks, make singles
 	cmpq	$96,%r9
 	jb	.L128_dec_loop2
 
-
+// Decrypt the first six blocks
 	subq	$96,%r9
 	vmovdqa	%xmm15,%xmm7
 	vpaddd	one(%rip),%xmm7,%xmm8
@@ -1277,7 +1277,7 @@
 	vaesenclast	%xmm4,%xmm11,%xmm11
 	vaesenclast	%xmm4,%xmm12,%xmm12
 
-
+// XOR with CT
 	vpxor	0(%rdi),%xmm7,%xmm7
 	vpxor	16(%rdi),%xmm8,%xmm8
 	vpxor	32(%rdi),%xmm9,%xmm9
@@ -1296,7 +1296,7 @@
 	addq	$96,%rsi
 	jmp	.L128_dec_loop1
 
-
+// Decrypt 6 blocks each time while hashing previous 6 blocks
 .align	64
 .L128_dec_loop1:
 	cmpq	$96,%r9
@@ -1608,9 +1608,9 @@
 	vpxor	%xmm5,%xmm0,%xmm0
 
 .L128_dec_loop2:
+// Here we encrypt any remaining whole block
 
-
-
+// if there are no whole blocks
 	cmpq	$16,%r9
 	jb	.L128_dec_out
 	subq	$16,%r9
@@ -1664,7 +1664,7 @@
 	vaesenc	112(%rdx),%xmm1,%xmm1
 	vaesenc	128(%rdx),%xmm1,%xmm1
 	vaesenc	144(%rdx),%xmm1,%xmm1
-	vaesenclast	160(%rdx),%xmm1,%xmm1
+	vaesenclast	160(%rdx),%xmm1,%xmm1  // STATE_1 == IV
 
 	vmovdqa	%xmm1,(%rsi)
 
@@ -1678,14 +1678,14 @@
 aes256gcmsiv_aes_ks_enc_x1:
 .cfi_startproc	
 _CET_ENDBR
-	vmovdqa	con1(%rip),%xmm0
-	vmovdqa	mask(%rip),%xmm15
+	vmovdqa	con1(%rip),%xmm0  // CON_MASK  = 1,1,1,1
+	vmovdqa	mask(%rip),%xmm15  // MASK_256
 	vmovdqa	(%rdi),%xmm8
-	vmovdqa	(%rcx),%xmm1
+	vmovdqa	(%rcx),%xmm1  // KEY_1 || KEY_2 0..7 = user key
 	vmovdqa	16(%rcx),%xmm3
 	vpxor	%xmm1,%xmm8,%xmm8
 	vaesenc	%xmm3,%xmm8,%xmm8
-	vmovdqu	%xmm1,(%rdx)
+	vmovdqu	%xmm1,(%rdx)  // First round key
 	vmovdqu	%xmm3,16(%rdx)
 	vpxor	%xmm14,%xmm14,%xmm14
 
@@ -1877,7 +1877,7 @@
 	vaesenc	176(%rdx),%xmm1,%xmm1
 	vaesenc	192(%rdx),%xmm1,%xmm1
 	vaesenc	208(%rdx),%xmm1,%xmm1
-	vaesenclast	224(%rdx),%xmm1,%xmm1
+	vaesenclast	224(%rdx),%xmm1,%xmm1  // %xmm1 == IV
 	vmovdqa	%xmm1,(%rsi)
 	ret
 .cfi_endproc	
@@ -1895,7 +1895,7 @@
 
 .L256_enc_msg_x4_start:
 	movq	%r8,%r10
-	shrq	$4,%r8
+	shrq	$4,%r8  // LEN = num of blocks
 	shlq	$60,%r10
 	jz	.L256_enc_msg_x4_start2
 	addq	$1,%r8
@@ -1905,15 +1905,15 @@
 	shlq	$62,%r10
 	shrq	$62,%r10
 
-
+// make IV from TAG
 	vmovdqa	(%rdx),%xmm15
-	vpor	OR_MASK(%rip),%xmm15,%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15  // IV = 1TAG126...3200..00
 
-	vmovdqa	four(%rip),%xmm4
-	vmovdqa	%xmm15,%xmm0
-	vpaddd	one(%rip),%xmm15,%xmm1
-	vpaddd	two(%rip),%xmm15,%xmm2
-	vpaddd	three(%rip),%xmm15,%xmm3
+	vmovdqa	four(%rip),%xmm4  // Register to increment counters
+	vmovdqa	%xmm15,%xmm0  // CTR1 = TAG1127...3200..00
+	vpaddd	one(%rip),%xmm15,%xmm1  // CTR2 = TAG1127...3200..01
+	vpaddd	two(%rip),%xmm15,%xmm2  // CTR3 = TAG1127...3200..02
+	vpaddd	three(%rip),%xmm15,%xmm3  // CTR4 = TAG1127...3200..03
 
 	shrq	$2,%r8
 	je	.L256_enc_msg_x4_check_remainder
@@ -2025,7 +2025,7 @@
 	vaesenclast	%xmm12,%xmm8,%xmm8
 
 
-
+// XOR with Plaintext
 	vpxor	0(%rdi),%xmm5,%xmm5
 	vpxor	16(%rdi),%xmm6,%xmm6
 	vpxor	32(%rdi),%xmm7,%xmm7
@@ -2048,11 +2048,11 @@
 	je	.L256_enc_msg_x4_out
 
 .L256_enc_msg_x4_loop2:
-
-
+// encrypt each block separately
+// CTR1 is the highest counter (even if no LOOP done)
 
 	vmovdqa	%xmm0,%xmm5
-	vpaddd	one(%rip),%xmm0,%xmm0
+	vpaddd	one(%rip),%xmm0,%xmm0  // inc counter
 	vpxor	(%rcx),%xmm5,%xmm5
 	vaesenc	16(%rcx),%xmm5,%xmm5
 	vaesenc	32(%rcx),%xmm5,%xmm5
@@ -2069,7 +2069,7 @@
 	vaesenc	208(%rcx),%xmm5,%xmm5
 	vaesenclast	224(%rcx),%xmm5,%xmm5
 
-
+// XOR with Plaintext
 	vpxor	(%rdi),%xmm5,%xmm5
 
 	vmovdqu	%xmm5,(%rsi)
@@ -2096,13 +2096,13 @@
 	ret
 
 .L256_enc_msg_x8_start:
-
+// Place in stack
 	movq	%rsp,%r11
 	subq	$16,%r11
 	andq	$-64,%r11
 
 	movq	%r8,%r10
-	shrq	$4,%r8
+	shrq	$4,%r8  // LEN = num of blocks
 	shlq	$60,%r10
 	jz	.L256_enc_msg_x8_start2
 	addq	$1,%r8
@@ -2112,20 +2112,20 @@
 	shlq	$61,%r10
 	shrq	$61,%r10
 
-
+// Make IV from TAG
 	vmovdqa	(%rdx),%xmm1
-	vpor	OR_MASK(%rip),%xmm1,%xmm1
-
+	vpor	OR_MASK(%rip),%xmm1,%xmm1  // TMP1= IV = 1TAG126...3200..00
 
+// store counter8 on the stack
 	vpaddd	seven(%rip),%xmm1,%xmm0
-	vmovdqa	%xmm0,(%r11)
-	vpaddd	one(%rip),%xmm1,%xmm9
-	vpaddd	two(%rip),%xmm1,%xmm10
-	vpaddd	three(%rip),%xmm1,%xmm11
-	vpaddd	four(%rip),%xmm1,%xmm12
-	vpaddd	five(%rip),%xmm1,%xmm13
-	vpaddd	six(%rip),%xmm1,%xmm14
-	vmovdqa	%xmm1,%xmm0
+	vmovdqa	%xmm0,(%r11)  // CTR8 = TAG127...3200..07
+	vpaddd	one(%rip),%xmm1,%xmm9  // CTR2 = TAG127...3200..01
+	vpaddd	two(%rip),%xmm1,%xmm10  // CTR3 = TAG127...3200..02
+	vpaddd	three(%rip),%xmm1,%xmm11  // CTR4 = TAG127...3200..03
+	vpaddd	four(%rip),%xmm1,%xmm12  // CTR5 = TAG127...3200..04
+	vpaddd	five(%rip),%xmm1,%xmm13  // CTR6 = TAG127...3200..05
+	vpaddd	six(%rip),%xmm1,%xmm14  // CTR7 = TAG127...3200..06
+	vmovdqa	%xmm1,%xmm0  // CTR1 = TAG127...3200..00
 
 	shrq	$3,%r8
 	jz	.L256_enc_msg_x8_check_remainder
@@ -2144,7 +2144,7 @@
 	vmovdqa	%xmm12,%xmm5
 	vmovdqa	%xmm13,%xmm6
 	vmovdqa	%xmm14,%xmm7
-
+// move from stack
 	vmovdqa	(%r11),%xmm8
 
 	vpxor	(%rcx),%xmm1,%xmm1
@@ -2166,7 +2166,7 @@
 	vaesenc	%xmm15,%xmm7,%xmm7
 	vaesenc	%xmm15,%xmm8,%xmm8
 
-	vmovdqa	(%r11),%xmm14
+	vmovdqa	(%r11),%xmm14  // deal with CTR8
 	vpaddd	eight(%rip),%xmm14,%xmm14
 	vmovdqa	%xmm14,(%r11)
 	vmovdqu	32(%rcx),%xmm15
@@ -2307,7 +2307,7 @@
 	vaesenclast	%xmm15,%xmm8,%xmm8
 
 
-
+// XOR with Plaintext
 	vpxor	0(%rdi),%xmm1,%xmm1
 	vpxor	16(%rdi),%xmm2,%xmm2
 	vpxor	32(%rdi),%xmm3,%xmm3
@@ -2338,8 +2338,8 @@
 	je	.L256_enc_msg_x8_out
 
 .L256_enc_msg_x8_loop2:
-
-
+// encrypt each block separately
+// CTR1 is the highest counter (even if no LOOP done)
 	vmovdqa	%xmm0,%xmm1
 	vpaddd	one(%rip),%xmm0,%xmm0
 
@@ -2359,7 +2359,7 @@
 	vaesenc	208(%rcx),%xmm1,%xmm1
 	vaesenclast	224(%rcx),%xmm1,%xmm1
 
-
+// XOR with Plaintext
 	vpxor	(%rdi),%xmm1,%xmm1
 
 	vmovdqu	%xmm1,(%rsi)
@@ -2388,10 +2388,10 @@
 .L256_dec_start:
 	vzeroupper
 	vmovdqa	(%rdx),%xmm0
-
-
+// The claimed tag is provided after the current calculated tag value.
+// CTRBLKs is made from it.
 	vmovdqu	16(%rdx),%xmm15
-	vpor	OR_MASK(%rip),%xmm15,%xmm15
+	vpor	OR_MASK(%rip),%xmm15,%xmm15  // CTR = 1TAG126...3200..00
 	movq	%rdx,%rax
 
 	leaq	32(%rax),%rax
@@ -2399,11 +2399,11 @@
 
 	andq	$~15,%r9
 
-
+// If less then 6 blocks, make singles
 	cmpq	$96,%r9
 	jb	.L256_dec_loop2
 
-
+// Decrypt the first six blocks
 	subq	$96,%r9
 	vmovdqa	%xmm15,%xmm7
 	vpaddd	one(%rip),%xmm7,%xmm8
@@ -2532,7 +2532,7 @@
 	vaesenclast	%xmm4,%xmm11,%xmm11
 	vaesenclast	%xmm4,%xmm12,%xmm12
 
-
+// XOR with CT
 	vpxor	0(%rdi),%xmm7,%xmm7
 	vpxor	16(%rdi),%xmm8,%xmm8
 	vpxor	32(%rdi),%xmm9,%xmm9
@@ -2551,7 +2551,7 @@
 	addq	$96,%rsi
 	jmp	.L256_dec_loop1
 
-
+// Decrypt 6 blocks each time while hashing previous 6 blocks
 .align	64
 .L256_dec_loop1:
 	cmpq	$96,%r9
@@ -2895,9 +2895,9 @@
 	vpxor	%xmm5,%xmm0,%xmm0
 
 .L256_dec_loop2:
+// Here we encrypt any remaining whole block
 
-
-
+// if there are no whole blocks
 	cmpq	$16,%r9
 	jb	.L256_dec_out
 	subq	$16,%r9
@@ -2943,11 +2943,11 @@
 aes256gcmsiv_kdf:
 .cfi_startproc	
 _CET_ENDBR
+// parameter 1: %rdi                         Pointer to NONCE
+// parameter 2: %rsi                         Pointer to CT
+// parameter 4: %rdx                         Pointer to keys
 
-
-
-
-	vmovdqa	(%rdx),%xmm1
+	vmovdqa	(%rdx),%xmm1  // xmm1 = first 16 bytes of random key
 	vmovdqa	0(%rdi),%xmm4
 	vmovdqa	and_mask(%rip),%xmm11
 	vmovdqa	one(%rip),%xmm8

boringssl-0.20260708.tar.xz/gen/crypto/aes128gcmsiv-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/crypto/aes128gcmsiv-x86_64-win.asm Changed

@@ -89,21 +89,21 @@
 _CET_ENDBR
 	vmovdqa	xmm0,XMMWORDrsi
 	vmovdqa	xmm1,xmm0
-	vmovdqa	XMMWORDrdi,xmm0
+	vmovdqa	XMMWORDrdi,xmm0  ; H
 	call	GFMUL
-	vmovdqa	XMMWORD16+rdi,xmm0
+	vmovdqa	XMMWORD16+rdi,xmm0  ; H^2
 	call	GFMUL
-	vmovdqa	XMMWORD32+rdi,xmm0
+	vmovdqa	XMMWORD32+rdi,xmm0  ; H^3
 	call	GFMUL
-	vmovdqa	XMMWORD48+rdi,xmm0
+	vmovdqa	XMMWORD48+rdi,xmm0  ; H^4
 	call	GFMUL
-	vmovdqa	XMMWORD64+rdi,xmm0
+	vmovdqa	XMMWORD64+rdi,xmm0  ; H^5
 	call	GFMUL
-	vmovdqa	XMMWORD80+rdi,xmm0
+	vmovdqa	XMMWORD80+rdi,xmm0  ; H^6
 	call	GFMUL
-	vmovdqa	XMMWORD96+rdi,xmm0
+	vmovdqa	XMMWORD96+rdi,xmm0  ; H^7
 	call	GFMUL
-	vmovdqa	XMMWORD112+rdi,xmm0
+	vmovdqa	XMMWORD112+rdi,xmm0  ; H^8
 	mov	rdi,QWORD8+rsp	;WIN64 epilogue
 	mov	rsi,QWORD16+rsp
 	ret
@@ -125,17 +125,17 @@
 _CET_ENDBR
 	vmovdqa	xmm0,XMMWORDrsi
 	vmovdqa	xmm1,xmm0
-	vmovdqa	XMMWORDrdi,xmm0
+	vmovdqa	XMMWORDrdi,xmm0  ; H
 	call	GFMUL
-	vmovdqa	XMMWORD16+rdi,xmm0
+	vmovdqa	XMMWORD16+rdi,xmm0  ; H^2
 	call	GFMUL
-	vmovdqa	XMMWORD32+rdi,xmm0
+	vmovdqa	XMMWORD32+rdi,xmm0  ; H^3
 	call	GFMUL
-	vmovdqa	XMMWORD48+rdi,xmm0
+	vmovdqa	XMMWORD48+rdi,xmm0  ; H^4
 	call	GFMUL
-	vmovdqa	XMMWORD64+rdi,xmm0
+	vmovdqa	XMMWORD64+rdi,xmm0  ; H^5
 	call	GFMUL
-	vmovdqa	XMMWORD80+rdi,xmm0
+	vmovdqa	XMMWORD80+rdi,xmm0  ; H^6
 	mov	rdi,QWORD8+rsp	;WIN64 epilogue
 	mov	rsi,QWORD16+rsp
 	ret
@@ -166,8 +166,8 @@
 $L$htable_polyval_start:
 	vzeroall
 
-
-
+; We hash 8 blocks each iteration. If the total number of blocks is not a
+; multiple of 8, we first hash the leading n%8 blocks.
 	mov	r11,rdx
 	and	r11,127
 
@@ -179,7 +179,7 @@
 
 	sub	r11,16
 
-
+; hash first prefix block
 	vmovdqu	xmm0,XMMWORDrsi
 	vpxor	xmm0,xmm0,xmm1
 
@@ -194,12 +194,12 @@
 	jnz	NEAR $L$htable_polyval_prefix_loop
 	jmp	NEAR $L$htable_polyval_prefix_complete
 
-
+; hash remaining prefix blocks (up to 7 total prefix blocks)
 ALIGN	64
 $L$htable_polyval_prefix_loop:
 	sub	r11,16
 
-	vmovdqu	xmm0,XMMWORDrsi
+	vmovdqu	xmm0,XMMWORDrsi  ; next data block
 
 	vpclmulqdq	xmm6,xmm0,XMMWORDr11*1+rdi,0x00
 	vpxor	xmm3,xmm3,xmm6
@@ -226,10 +226,10 @@
 	jmp	NEAR $L$htable_polyval_main_loop
 
 $L$htable_polyval_no_prefix:
-
-
-
-
+; At this point we know the number of blocks is a multiple of 8. However,
+; the reduction in the main loop includes a multiplication by x^(-128). In
+; order to counter this, the existing tag needs to be multiplied by x^128.
+; In practice, this just means that it is loaded into %xmm9, not %xmm1.
 	vpxor	xmm1,xmm1,xmm1
 	vmovdqa	xmm9,XMMWORDrcx
 
@@ -238,7 +238,7 @@
 	sub	rdx,0x80
 	jb	NEAR $L$htable_polyval_out
 
-	vmovdqu	xmm0,XMMWORD112+rsi
+	vmovdqu	xmm0,XMMWORD112+rsi  ; Ii
 
 	vpclmulqdq	xmm5,xmm0,XMMWORDrdi,0x01
 	vpclmulqdq	xmm3,xmm0,XMMWORDrdi,0x00
@@ -246,7 +246,7 @@
 	vpclmulqdq	xmm6,xmm0,XMMWORDrdi,0x10
 	vpxor	xmm5,xmm5,xmm6
 
-
+; ########################################################
 	vmovdqu	xmm0,XMMWORD96+rsi
 	vpclmulqdq	xmm6,xmm0,XMMWORD16+rdi,0x01
 	vpxor	xmm5,xmm5,xmm6
@@ -258,10 +258,10 @@
 	vpxor	xmm5,xmm5,xmm6
 
 
-
+; ########################################################
 	vmovdqu	xmm0,XMMWORD80+rsi
 
-	vpclmulqdq	xmm7,xmm1,XMMWORDpoly,0x10
+	vpclmulqdq	xmm7,xmm1,XMMWORDpoly,0x10  ; reduction stage 1a
 	vpalignr	xmm1,xmm1,xmm1,8
 
 	vpclmulqdq	xmm6,xmm0,XMMWORD32+rdi,0x01
@@ -274,8 +274,8 @@
 	vpxor	xmm5,xmm5,xmm6
 
 
-	vpxor	xmm1,xmm1,xmm7
-
+	vpxor	xmm1,xmm1,xmm7  ; reduction stage 1b
+; ########################################################
 	vmovdqu	xmm0,XMMWORD64+rsi
 
 	vpclmulqdq	xmm6,xmm0,XMMWORD48+rdi,0x01
@@ -287,10 +287,10 @@
 	vpclmulqdq	xmm6,xmm0,XMMWORD48+rdi,0x10
 	vpxor	xmm5,xmm5,xmm6
 
-
+; ########################################################
 	vmovdqu	xmm0,XMMWORD48+rsi
 
-	vpclmulqdq	xmm7,xmm1,XMMWORDpoly,0x10
+	vpclmulqdq	xmm7,xmm1,XMMWORDpoly,0x10  ; reduction stage 2a
 	vpalignr	xmm1,xmm1,xmm1,8
 
 	vpclmulqdq	xmm6,xmm0,XMMWORD64+rdi,0x01
@@ -303,8 +303,8 @@
 	vpxor	xmm5,xmm5,xmm6
 
 
-	vpxor	xmm1,xmm1,xmm7
-
+	vpxor	xmm1,xmm1,xmm7  ; reduction stage 2b
+; ########################################################
 	vmovdqu	xmm0,XMMWORD32+rsi
 
 	vpclmulqdq	xmm6,xmm0,XMMWORD80+rdi,0x01
@@ -317,8 +317,8 @@
 	vpxor	xmm5,xmm5,xmm6
 
 
-	vpxor	xmm1,xmm1,xmm9
-
+	vpxor	xmm1,xmm1,xmm9  ; reduction finalize
+; ########################################################
 	vmovdqu	xmm0,XMMWORD16+rsi
 
 	vpclmulqdq	xmm6,xmm0,XMMWORD96+rdi,0x01
@@ -330,7 +330,7 @@
 	vpclmulqdq	xmm6,xmm0,XMMWORD96+rdi,0x10
 	vpxor	xmm5,xmm5,xmm6
 
-
+; ########################################################
 	vmovdqu	xmm0,XMMWORDrsi
 	vpxor	xmm0,xmm0,xmm1
 
@@ -343,7 +343,7 @@
 	vpclmulqdq	xmm6,xmm0,XMMWORD112+rdi,0x10
 	vpxor	xmm5,xmm5,xmm6
 
-
+; ########################################################
 	vpsrldq	xmm6,xmm5,8
 	vpslldq	xmm5,xmm5,8
 
@@ -353,7 +353,7 @@
 	lea	rsi,128+rsi
 	jmp	NEAR $L$htable_polyval_main_loop
 
-
+; ########################################################
 
 $L$htable_polyval_out:
 	vpclmulqdq	xmm6,xmm1,XMMWORDpoly,0x10
@@ -395,24 +395,24 @@
 	ret
 
 $L$polyval_horner_start:
-
-
+; We will start with L GFMULS for POLYVAL(BIG_BUFFER)
+; RES = GFMUL(RES, H)
 
 	xor	r10,r10
-	shl	rcx,4
+	shl	rcx,4  ; L contains number of bytes to process
 
 	vmovdqa	xmm1,XMMWORDrsi
 	vmovdqa	xmm0,XMMWORDrdi
 
 $L$polyval_horner_loop:
-	vpxor	xmm0,xmm0,XMMWORDr10*1+rdx
-	call	GFMUL
+	vpxor	xmm0,xmm0,XMMWORDr10*1+rdx  ; RES = RES + Xi
+	call	GFMUL  ; RES = RES * H
 
 	add	r10,16
 	cmp	rcx,r10
 	jne	NEAR $L$polyval_horner_loop
 
-
+; calculation of T is complete. RES=T
 	vmovdqa	XMMWORDrdi,xmm0
 	mov	rdi,QWORD8+rsp	;WIN64 epilogue
 	mov	rsi,QWORD16+rsp
@@ -433,8 +433,8 @@
 
 
 _CET_ENDBR
-	vmovdqu	xmm1,XMMWORDrdi
-	vmovdqa	XMMWORDrsi,xmm1
+	vmovdqu	xmm1,XMMWORDrdi  ; xmm1 = user key
+	vmovdqa	XMMWORDrsi,xmm1  ; rsi points to output
 
 	vmovdqa	xmm0,XMMWORDcon1
 	vmovdqa	xmm15,XMMWORDmask
@@ -442,9 +442,9 @@
 	mov	rax,8
 
 $L$ks128_loop:
-	add	rsi,16
+	add	rsi,16  ; rsi points for next key
 	sub	rax,1
-	vpshufb	xmm2,xmm1,xmm15
+	vpshufb	xmm2,xmm1,xmm15  ; xmm2 = shuffled user key
 	vaesenclast	xmm2,xmm2,xmm0
 	vpslld	xmm0,xmm0,1
 	vpslldq	xmm3,xmm1,4
@@ -558,19 +558,19 @@
 
 
 _CET_ENDBR
-	vmovdqa	xmm1,XMMWORDrcx
+	vmovdqa	xmm1,XMMWORDrcx  ; xmm1 = first 16 bytes of random key
 	vmovdqa	xmm4,XMMWORDrdi
 
-	vmovdqa	XMMWORDrdx,xmm1
+	vmovdqa	XMMWORDrdx,xmm1  ; KEY0 = first 16 bytes of random key
 	vpxor	xmm4,xmm4,xmm1
 
-	vmovdqa	xmm0,XMMWORDcon1
-	vmovdqa	xmm15,XMMWORDmask
+	vmovdqa	xmm0,XMMWORDcon1  ; xmm0  = 1,1,1,1
+	vmovdqa	xmm15,XMMWORDmask  ; xmm15 = mask
 
-	vpshufb	xmm2,xmm1,xmm15
+	vpshufb	xmm2,xmm1,xmm15  ; !!saving mov instruction to xmm2
 	vaesenclast	xmm2,xmm2,xmm0
 	vpslld	xmm0,xmm0,1
-	vpsllq	xmm3,xmm1,32
+	vpsllq	xmm3,xmm1,32  ; !!saving mov instruction to xmm3
 	vpxor	xmm1,xmm1,xmm3
 	vpshufb	xmm3,xmm1,XMMWORDcon3
 	vpxor	xmm1,xmm1,xmm3
@@ -579,10 +579,10 @@
 	vaesenc	xmm4,xmm4,xmm1
 	vmovdqa	XMMWORD16+rdx,xmm1
 
-	vpshufb	xmm2,xmm1,xmm15
+	vpshufb	xmm2,xmm1,xmm15  ; !!saving mov instruction to xmm2
 	vaesenclast	xmm2,xmm2,xmm0
 	vpslld	xmm0,xmm0,1
-	vpsllq	xmm3,xmm1,32
+	vpsllq	xmm3,xmm1,32  ; !!saving mov instruction to xmm3
 	vpxor	xmm1,xmm1,xmm3
 	vpshufb	xmm3,xmm1,XMMWORDcon3
 	vpxor	xmm1,xmm1,xmm3
@@ -591,10 +591,10 @@
 	vaesenc	xmm4,xmm4,xmm1
 	vmovdqa	XMMWORD32+rdx,xmm1
 
-	vpshufb	xmm2,xmm1,xmm15
+	vpshufb	xmm2,xmm1,xmm15  ; !!saving mov instruction to xmm2
 	vaesenclast	xmm2,xmm2,xmm0
 	vpslld	xmm0,xmm0,1
-	vpsllq	xmm3,xmm1,32
+	vpsllq	xmm3,xmm1,32  ; !!saving mov instruction to xmm3
 	vpxor	xmm1,xmm1,xmm3
 	vpshufb	xmm3,xmm1,XMMWORDcon3
 	vpxor	xmm1,xmm1,xmm3
@@ -603,10 +603,10 @@
 	vaesenc	xmm4,xmm4,xmm1
 	vmovdqa	XMMWORD48+rdx,xmm1
 
-	vpshufb	xmm2,xmm1,xmm15
+	vpshufb	xmm2,xmm1,xmm15  ; !!saving mov instruction to xmm2
 	vaesenclast	xmm2,xmm2,xmm0
 	vpslld	xmm0,xmm0,1
-	vpsllq	xmm3,xmm1,32
+	vpsllq	xmm3,xmm1,32  ; !!saving mov instruction to xmm3
 	vpxor	xmm1,xmm1,xmm3
 	vpshufb	xmm3,xmm1,XMMWORDcon3
 	vpxor	xmm1,xmm1,xmm3
@@ -615,10 +615,10 @@
 	vaesenc	xmm4,xmm4,xmm1
 	vmovdqa	XMMWORD64+rdx,xmm1
 
-	vpshufb	xmm2,xmm1,xmm15
+	vpshufb	xmm2,xmm1,xmm15  ; !!saving mov instruction to xmm2
 	vaesenclast	xmm2,xmm2,xmm0
 	vpslld	xmm0,xmm0,1
-	vpsllq	xmm3,xmm1,32
+	vpsllq	xmm3,xmm1,32  ; !!saving mov instruction to xmm3
 	vpxor	xmm1,xmm1,xmm3
 	vpshufb	xmm3,xmm1,XMMWORDcon3
 	vpxor	xmm1,xmm1,xmm3
@@ -627,10 +627,10 @@
 	vaesenc	xmm4,xmm4,xmm1
 	vmovdqa	XMMWORD80+rdx,xmm1
 
-	vpshufb	xmm2,xmm1,xmm15
+	vpshufb	xmm2,xmm1,xmm15  ; !!saving mov instruction to xmm2
 	vaesenclast	xmm2,xmm2,xmm0
 	vpslld	xmm0,xmm0,1
-	vpsllq	xmm3,xmm1,32
+	vpsllq	xmm3,xmm1,32  ; !!saving mov instruction to xmm3
 	vpxor	xmm1,xmm1,xmm3
 	vpshufb	xmm3,xmm1,XMMWORDcon3
 	vpxor	xmm1,xmm1,xmm3
@@ -639,10 +639,10 @@
 	vaesenc	xmm4,xmm4,xmm1
 	vmovdqa	XMMWORD96+rdx,xmm1
 
-	vpshufb	xmm2,xmm1,xmm15
+	vpshufb	xmm2,xmm1,xmm15  ; !!saving mov instruction to xmm2
 	vaesenclast	xmm2,xmm2,xmm0
 	vpslld	xmm0,xmm0,1
-	vpsllq	xmm3,xmm1,32
+	vpsllq	xmm3,xmm1,32  ; !!saving mov instruction to xmm3
 	vpxor	xmm1,xmm1,xmm3
 	vpshufb	xmm3,xmm1,XMMWORDcon3
 	vpxor	xmm1,xmm1,xmm3
@@ -651,10 +651,10 @@
 	vaesenc	xmm4,xmm4,xmm1
 	vmovdqa	XMMWORD112+rdx,xmm1
 
-	vpshufb	xmm2,xmm1,xmm15
+	vpshufb	xmm2,xmm1,xmm15  ; !!saving mov instruction to xmm2
 	vaesenclast	xmm2,xmm2,xmm0
 	vpslld	xmm0,xmm0,1
-	vpsllq	xmm3,xmm1,32
+	vpsllq	xmm3,xmm1,32  ; !!saving mov instruction to xmm3
 	vpxor	xmm1,xmm1,xmm3
 	vpshufb	xmm3,xmm1,XMMWORDcon3
 	vpxor	xmm1,xmm1,xmm3
@@ -666,10 +666,10 @@
 
 	vmovdqa	xmm0,XMMWORDcon2
 
-	vpshufb	xmm2,xmm1,xmm15
+	vpshufb	xmm2,xmm1,xmm15  ; !!saving mov instruction to xmm2
 	vaesenclast	xmm2,xmm2,xmm0
 	vpslld	xmm0,xmm0,1
-	vpsllq	xmm3,xmm1,32
+	vpsllq	xmm3,xmm1,32  ; !!saving mov instruction to xmm3
 	vpxor	xmm1,xmm1,xmm3
 	vpshufb	xmm3,xmm1,XMMWORDcon3
 	vpxor	xmm1,xmm1,xmm3
@@ -678,9 +678,9 @@
 	vaesenc	xmm4,xmm4,xmm1
 	vmovdqa	XMMWORD144+rdx,xmm1
 
-	vpshufb	xmm2,xmm1,xmm15
+	vpshufb	xmm2,xmm1,xmm15  ; !!saving mov instruction to xmm2
 	vaesenclast	xmm2,xmm2,xmm0
-	vpsllq	xmm3,xmm1,32
+	vpsllq	xmm3,xmm1,32  ; !!saving mov instruction to xmm3
 	vpxor	xmm1,xmm1,xmm3
 	vpshufb	xmm3,xmm1,XMMWORDcon3
 	vpxor	xmm1,xmm1,xmm3
@@ -711,11 +711,11 @@
 
 
 _CET_ENDBR
+; parameter 1: %rdi                         Pointer to NONCE
+; parameter 2: %rsi                         Pointer to CT
+; parameter 4: %rdx                         Pointer to keys
 
-
-
-
-	vmovdqa	xmm1,XMMWORDrdx
+	vmovdqa	xmm1,XMMWORDrdx  ; xmm1 = first 16 bytes of random key
 	vmovdqa	xmm9,XMMWORDrdi
 	vmovdqa	xmm12,XMMWORDand_mask
 	vmovdqa	xmm13,XMMWORDone
@@ -829,20 +829,20 @@
 	push	r13
 
 
-	shr	r8,4
+	shr	r8,4  ; LEN = num of blocks
 	mov	r10,r8
 	shl	r10,62
 	shr	r10,62
 
-
+; make IV from TAG
 	vmovdqa	xmm15,XMMWORDrdx
-	vpor	xmm15,xmm15,XMMWORDOR_MASK
+	vpor	xmm15,xmm15,XMMWORDOR_MASK  ; IV = 1TAG126...3200..00
 
-	vmovdqu	xmm4,XMMWORDfour
-	vmovdqa	xmm0,xmm15
-	vpaddd	xmm1,xmm15,XMMWORDone
-	vpaddd	xmm2,xmm15,XMMWORDtwo
-	vpaddd	xmm3,xmm15,XMMWORDthree
+	vmovdqu	xmm4,XMMWORDfour  ; Register to increment counters
+	vmovdqa	xmm0,xmm15  ; CTR1 = TAG1127...3200..00
+	vpaddd	xmm1,xmm15,XMMWORDone  ; CTR2 = TAG1127...3200..01
+	vpaddd	xmm2,xmm15,XMMWORDtwo  ; CTR3 = TAG1127...3200..02
+	vpaddd	xmm3,xmm15,XMMWORDthree  ; CTR4 = TAG1127...3200..03
 
 	shr	r8,2
 	je	NEAR $L$128_enc_msg_x4_check_remainder
@@ -930,7 +930,7 @@
 	vaesenclast	xmm8,xmm8,xmm12
 
 
-
+; XOR with Plaintext
 	vpxor	xmm5,xmm5,XMMWORDrdi
 	vpxor	xmm6,xmm6,XMMWORD16+rdi
 	vpxor	xmm7,xmm7,XMMWORD32+rdi
@@ -953,10 +953,10 @@
 	je	NEAR $L$128_enc_msg_x4_out
 
 $L$128_enc_msg_x4_loop2:
-
-
+; enc each block separately
+; CTR1 is the highest counter (even if no LOOP done)
 	vmovdqa	xmm5,xmm0
-	vpaddd	xmm0,xmm0,XMMWORDone
+	vpaddd	xmm0,xmm0,XMMWORDone  ; inc counter
 
 	vpxor	xmm5,xmm5,XMMWORDrcx
 	vaesenc	xmm5,xmm5,XMMWORD16+rcx
@@ -970,7 +970,7 @@
 	vaesenc	xmm5,xmm5,XMMWORD144+rcx
 	vaesenclast	xmm5,xmm5,XMMWORD160+rcx
 
-
+; XOR with plaintext
 	vpxor	xmm5,xmm5,XMMWORDrdi
 	vmovdqu	XMMWORDrsi,xmm5
 
@@ -1023,29 +1023,29 @@
 	mov	rbp,rsp
 
 
-
+; Place in stack
 	sub	rsp,128
 	and	rsp,-64
 
-	shr	r8,4
+	shr	r8,4  ; LEN = num of blocks
 	mov	r10,r8
 	shl	r10,61
 	shr	r10,61
 
-
+; make IV from TAG
 	vmovdqu	xmm1,XMMWORDrdx
-	vpor	xmm1,xmm1,XMMWORDOR_MASK
-
+	vpor	xmm1,xmm1,XMMWORDOR_MASK  ; TMP1= IV = 1TAG126...3200..00
 
+; store counter8 in the stack
 	vpaddd	xmm0,xmm1,XMMWORDseven
-	vmovdqu	XMMWORDrsp,xmm0
-	vpaddd	xmm9,xmm1,XMMWORDone
-	vpaddd	xmm10,xmm1,XMMWORDtwo
-	vpaddd	xmm11,xmm1,XMMWORDthree
-	vpaddd	xmm12,xmm1,XMMWORDfour
-	vpaddd	xmm13,xmm1,XMMWORDfive
-	vpaddd	xmm14,xmm1,XMMWORDsix
-	vmovdqa	xmm0,xmm1
+	vmovdqu	XMMWORDrsp,xmm0  ; CTR8 = TAG127...3200..07
+	vpaddd	xmm9,xmm1,XMMWORDone  ; CTR2 = TAG127...3200..01
+	vpaddd	xmm10,xmm1,XMMWORDtwo  ; CTR3 = TAG127...3200..02
+	vpaddd	xmm11,xmm1,XMMWORDthree  ; CTR4 = TAG127...3200..03
+	vpaddd	xmm12,xmm1,XMMWORDfour  ; CTR5 = TAG127...3200..04
+	vpaddd	xmm13,xmm1,XMMWORDfive  ; CTR6 = TAG127...3200..05
+	vpaddd	xmm14,xmm1,XMMWORDsix  ; CTR7 = TAG127...3200..06
+	vmovdqa	xmm0,xmm1  ; CTR1 = TAG127...3200..00
 
 	shr	r8,3
 	je	NEAR $L$128_enc_msg_x8_check_remainder
@@ -1064,7 +1064,7 @@
 	vmovdqa	xmm5,xmm12
 	vmovdqa	xmm6,xmm13
 	vmovdqa	xmm7,xmm14
-
+; move from stack
 	vmovdqu	xmm8,XMMWORDrsp
 
 	vpxor	xmm1,xmm1,XMMWORDrcx
@@ -1086,7 +1086,7 @@
 	vaesenc	xmm7,xmm7,xmm15
 	vaesenc	xmm8,xmm8,xmm15
 
-	vmovdqu	xmm14,XMMWORDrsp
+	vmovdqu	xmm14,XMMWORDrsp  ; deal with CTR8
 	vpaddd	xmm14,xmm14,XMMWORDeight
 	vmovdqu	XMMWORDrsp,xmm14
 	vmovdqu	xmm15,XMMWORD32+rcx
@@ -1187,7 +1187,7 @@
 	vaesenclast	xmm8,xmm8,xmm15
 
 
-
+; XOR with Plaintext
 	vpxor	xmm1,xmm1,XMMWORDrdi
 	vpxor	xmm2,xmm2,XMMWORD16+rdi
 	vpxor	xmm3,xmm3,XMMWORD32+rdi
@@ -1218,10 +1218,10 @@
 	je	NEAR $L$128_enc_msg_x8_out
 
 $L$128_enc_msg_x8_loop2:
-
-
+; enc each block separately
+; CTR1 is the highest counter (even if no LOOP done)
 	vmovdqa	xmm1,xmm0
-	vpaddd	xmm0,xmm0,XMMWORDone
+	vpaddd	xmm0,xmm0,XMMWORDone  ; inc counter
 
 	vpxor	xmm1,xmm1,XMMWORDrcx
 	vaesenc	xmm1,xmm1,XMMWORD16+rcx
@@ -1235,7 +1235,7 @@
 	vaesenc	xmm1,xmm1,XMMWORD144+rcx
 	vaesenclast	xmm1,xmm1,XMMWORD160+rcx
 
-
+; XOR with Plaintext
 	vpxor	xmm1,xmm1,XMMWORDrdi
 
 	vmovdqu	XMMWORDrsi,xmm1
@@ -1287,10 +1287,10 @@
 $L$128_dec_start:
 	vzeroupper
 	vmovdqa	xmm0,XMMWORDrdx
-
-
+; The claimed tag is provided after the current calculated tag value.
+; CTRBLKs is made from it.
 	vmovdqu	xmm15,XMMWORD16+rdx
-	vpor	xmm15,xmm15,XMMWORDOR_MASK
+	vpor	xmm15,xmm15,XMMWORDOR_MASK  ; CTR = 1TAG126...3200..00
 	mov	rax,rdx
 
 	lea	rax,32+rax
@@ -1298,11 +1298,11 @@
 
 	and	r9,~15
 
-
+; If less then 6 blocks, make singles
 	cmp	r9,96
 	jb	NEAR $L$128_dec_loop2
 
-
+; Decrypt the first six blocks
 	sub	r9,96
 	vmovdqa	xmm7,xmm15
 	vpaddd	xmm8,xmm7,XMMWORDone
@@ -1399,7 +1399,7 @@
 	vaesenclast	xmm11,xmm11,xmm4
 	vaesenclast	xmm12,xmm12,xmm4
 
-
+; XOR with CT
 	vpxor	xmm7,xmm7,XMMWORDrdi
 	vpxor	xmm8,xmm8,XMMWORD16+rdi
 	vpxor	xmm9,xmm9,XMMWORD32+rdi
@@ -1418,7 +1418,7 @@
 	add	rsi,96
 	jmp	NEAR $L$128_dec_loop1
 
-
+; Decrypt 6 blocks each time while hashing previous 6 blocks
 ALIGN	64
 $L$128_dec_loop1:
 	cmp	r9,96
@@ -1730,9 +1730,9 @@
 	vpxor	xmm0,xmm0,xmm5
 
 $L$128_dec_loop2:
+; Here we encrypt any remaining whole block
 
-
-
+; if there are no whole blocks
 	cmp	r9,16
 	jb	NEAR $L$128_dec_out
 	sub	r9,16
@@ -1796,7 +1796,7 @@
 	vaesenc	xmm1,xmm1,XMMWORD112+rdx
 	vaesenc	xmm1,xmm1,XMMWORD128+rdx
 	vaesenc	xmm1,xmm1,XMMWORD144+rdx
-	vaesenclast	xmm1,xmm1,XMMWORD160+rdx
+	vaesenclast	xmm1,xmm1,XMMWORD160+rdx  ; STATE_1 == IV
 
 	vmovdqa	XMMWORDrsi,xmm1
 
@@ -1821,14 +1821,14 @@
 
 
 _CET_ENDBR
-	vmovdqa	xmm0,XMMWORDcon1
-	vmovdqa	xmm15,XMMWORDmask
+	vmovdqa	xmm0,XMMWORDcon1  ; CON_MASK  = 1,1,1,1
+	vmovdqa	xmm15,XMMWORDmask  ; MASK_256
 	vmovdqa	xmm8,XMMWORDrdi
-	vmovdqa	xmm1,XMMWORDrcx
+	vmovdqa	xmm1,XMMWORDrcx  ; KEY_1 || KEY_2 0..7 = user key
 	vmovdqa	xmm3,XMMWORD16+rcx
 	vpxor	xmm8,xmm8,xmm1
 	vaesenc	xmm8,xmm8,xmm3
-	vmovdqu	XMMWORDrdx,xmm1
+	vmovdqu	XMMWORDrdx,xmm1  ; First round key
 	vmovdqu	XMMWORD16+rdx,xmm3
 	vpxor	xmm14,xmm14,xmm14
 
@@ -2030,7 +2030,7 @@
 	vaesenc	xmm1,xmm1,XMMWORD176+rdx
 	vaesenc	xmm1,xmm1,XMMWORD192+rdx
 	vaesenc	xmm1,xmm1,XMMWORD208+rdx
-	vaesenclast	xmm1,xmm1,XMMWORD224+rdx
+	vaesenclast	xmm1,xmm1,XMMWORD224+rdx  ; %xmm1 == IV
 	vmovdqa	XMMWORDrsi,xmm1
 	mov	rdi,QWORD8+rsp	;WIN64 epilogue
 	mov	rsi,QWORD16+rsp
@@ -2062,7 +2062,7 @@
 
 $L$256_enc_msg_x4_start:
 	mov	r10,r8
-	shr	r8,4
+	shr	r8,4  ; LEN = num of blocks
 	shl	r10,60
 	jz	NEAR $L$256_enc_msg_x4_start2
 	add	r8,1
@@ -2072,15 +2072,15 @@
 	shl	r10,62
 	shr	r10,62
 
-
+; make IV from TAG
 	vmovdqa	xmm15,XMMWORDrdx
-	vpor	xmm15,xmm15,XMMWORDOR_MASK
+	vpor	xmm15,xmm15,XMMWORDOR_MASK  ; IV = 1TAG126...3200..00
 
-	vmovdqa	xmm4,XMMWORDfour
-	vmovdqa	xmm0,xmm15
-	vpaddd	xmm1,xmm15,XMMWORDone
-	vpaddd	xmm2,xmm15,XMMWORDtwo
-	vpaddd	xmm3,xmm15,XMMWORDthree
+	vmovdqa	xmm4,XMMWORDfour  ; Register to increment counters
+	vmovdqa	xmm0,xmm15  ; CTR1 = TAG1127...3200..00
+	vpaddd	xmm1,xmm15,XMMWORDone  ; CTR2 = TAG1127...3200..01
+	vpaddd	xmm2,xmm15,XMMWORDtwo  ; CTR3 = TAG1127...3200..02
+	vpaddd	xmm3,xmm15,XMMWORDthree  ; CTR4 = TAG1127...3200..03
 
 	shr	r8,2
 	je	NEAR $L$256_enc_msg_x4_check_remainder
@@ -2192,7 +2192,7 @@
 	vaesenclast	xmm8,xmm8,xmm12
 
 
-
+; XOR with Plaintext
 	vpxor	xmm5,xmm5,XMMWORDrdi
 	vpxor	xmm6,xmm6,XMMWORD16+rdi
 	vpxor	xmm7,xmm7,XMMWORD32+rdi
@@ -2215,11 +2215,11 @@
 	je	NEAR $L$256_enc_msg_x4_out
 
 $L$256_enc_msg_x4_loop2:
-
-
+; encrypt each block separately
+; CTR1 is the highest counter (even if no LOOP done)
 
 	vmovdqa	xmm5,xmm0
-	vpaddd	xmm0,xmm0,XMMWORDone
+	vpaddd	xmm0,xmm0,XMMWORDone  ; inc counter
 	vpxor	xmm5,xmm5,XMMWORDrcx
 	vaesenc	xmm5,xmm5,XMMWORD16+rcx
 	vaesenc	xmm5,xmm5,XMMWORD32+rcx
@@ -2236,7 +2236,7 @@
 	vaesenc	xmm5,xmm5,XMMWORD208+rcx
 	vaesenclast	xmm5,xmm5,XMMWORD224+rcx
 
-
+; XOR with Plaintext
 	vpxor	xmm5,xmm5,XMMWORDrdi
 
 	vmovdqu	XMMWORDrsi,xmm5
@@ -2277,13 +2277,13 @@
 	ret
 
 $L$256_enc_msg_x8_start:
-
+; Place in stack
 	mov	r11,rsp
 	sub	r11,16
 	and	r11,-64
 
 	mov	r10,r8
-	shr	r8,4
+	shr	r8,4  ; LEN = num of blocks
 	shl	r10,60
 	jz	NEAR $L$256_enc_msg_x8_start2
 	add	r8,1
@@ -2293,20 +2293,20 @@
 	shl	r10,61
 	shr	r10,61
 
-
+; Make IV from TAG
 	vmovdqa	xmm1,XMMWORDrdx
-	vpor	xmm1,xmm1,XMMWORDOR_MASK
-
+	vpor	xmm1,xmm1,XMMWORDOR_MASK  ; TMP1= IV = 1TAG126...3200..00
 
+; store counter8 on the stack
 	vpaddd	xmm0,xmm1,XMMWORDseven
-	vmovdqa	XMMWORDr11,xmm0
-	vpaddd	xmm9,xmm1,XMMWORDone
-	vpaddd	xmm10,xmm1,XMMWORDtwo
-	vpaddd	xmm11,xmm1,XMMWORDthree
-	vpaddd	xmm12,xmm1,XMMWORDfour
-	vpaddd	xmm13,xmm1,XMMWORDfive
-	vpaddd	xmm14,xmm1,XMMWORDsix
-	vmovdqa	xmm0,xmm1
+	vmovdqa	XMMWORDr11,xmm0  ; CTR8 = TAG127...3200..07
+	vpaddd	xmm9,xmm1,XMMWORDone  ; CTR2 = TAG127...3200..01
+	vpaddd	xmm10,xmm1,XMMWORDtwo  ; CTR3 = TAG127...3200..02
+	vpaddd	xmm11,xmm1,XMMWORDthree  ; CTR4 = TAG127...3200..03
+	vpaddd	xmm12,xmm1,XMMWORDfour  ; CTR5 = TAG127...3200..04
+	vpaddd	xmm13,xmm1,XMMWORDfive  ; CTR6 = TAG127...3200..05
+	vpaddd	xmm14,xmm1,XMMWORDsix  ; CTR7 = TAG127...3200..06
+	vmovdqa	xmm0,xmm1  ; CTR1 = TAG127...3200..00
 
 	shr	r8,3
 	jz	NEAR $L$256_enc_msg_x8_check_remainder
@@ -2325,7 +2325,7 @@
 	vmovdqa	xmm5,xmm12
 	vmovdqa	xmm6,xmm13
 	vmovdqa	xmm7,xmm14
-
+; move from stack
 	vmovdqa	xmm8,XMMWORDr11
 
 	vpxor	xmm1,xmm1,XMMWORDrcx
@@ -2347,7 +2347,7 @@
 	vaesenc	xmm7,xmm7,xmm15
 	vaesenc	xmm8,xmm8,xmm15
 
-	vmovdqa	xmm14,XMMWORDr11
+	vmovdqa	xmm14,XMMWORDr11  ; deal with CTR8
 	vpaddd	xmm14,xmm14,XMMWORDeight
 	vmovdqa	XMMWORDr11,xmm14
 	vmovdqu	xmm15,XMMWORD32+rcx
@@ -2488,7 +2488,7 @@
 	vaesenclast	xmm8,xmm8,xmm15
 
 
-
+; XOR with Plaintext
 	vpxor	xmm1,xmm1,XMMWORDrdi
 	vpxor	xmm2,xmm2,XMMWORD16+rdi
 	vpxor	xmm3,xmm3,XMMWORD32+rdi
@@ -2519,8 +2519,8 @@
 	je	NEAR $L$256_enc_msg_x8_out
 
 $L$256_enc_msg_x8_loop2:
-
-
+; encrypt each block separately
+; CTR1 is the highest counter (even if no LOOP done)
 	vmovdqa	xmm1,xmm0
 	vpaddd	xmm0,xmm0,XMMWORDone
 
@@ -2540,7 +2540,7 @@
 	vaesenc	xmm1,xmm1,XMMWORD208+rcx
 	vaesenclast	xmm1,xmm1,XMMWORD224+rcx
 
-
+; XOR with Plaintext
 	vpxor	xmm1,xmm1,XMMWORDrdi
 
 	vmovdqu	XMMWORDrsi,xmm1
@@ -2584,10 +2584,10 @@
 $L$256_dec_start:
 	vzeroupper
 	vmovdqa	xmm0,XMMWORDrdx
-
-
+; The claimed tag is provided after the current calculated tag value.
+; CTRBLKs is made from it.
 	vmovdqu	xmm15,XMMWORD16+rdx
-	vpor	xmm15,xmm15,XMMWORDOR_MASK
+	vpor	xmm15,xmm15,XMMWORDOR_MASK  ; CTR = 1TAG126...3200..00
 	mov	rax,rdx
 
 	lea	rax,32+rax
@@ -2595,11 +2595,11 @@
 
 	and	r9,~15
 
-
+; If less then 6 blocks, make singles
 	cmp	r9,96
 	jb	NEAR $L$256_dec_loop2
 
-
+; Decrypt the first six blocks
 	sub	r9,96
 	vmovdqa	xmm7,xmm15
 	vpaddd	xmm8,xmm7,XMMWORDone
@@ -2728,7 +2728,7 @@
 	vaesenclast	xmm11,xmm11,xmm4
 	vaesenclast	xmm12,xmm12,xmm4
 
-
+; XOR with CT
 	vpxor	xmm7,xmm7,XMMWORDrdi
 	vpxor	xmm8,xmm8,XMMWORD16+rdi
 	vpxor	xmm9,xmm9,XMMWORD32+rdi
@@ -2747,7 +2747,7 @@
 	add	rsi,96
 	jmp	NEAR $L$256_dec_loop1
 
-
+; Decrypt 6 blocks each time while hashing previous 6 blocks
 ALIGN	64
 $L$256_dec_loop1:
 	cmp	r9,96
@@ -3091,9 +3091,9 @@
 	vpxor	xmm0,xmm0,xmm5
 
 $L$256_dec_loop2:
+; Here we encrypt any remaining whole block
 
-
-
+; if there are no whole blocks
 	cmp	r9,16
 	jb	NEAR $L$256_dec_out
 	sub	r9,16
@@ -3149,11 +3149,11 @@
 
 
 _CET_ENDBR
+; parameter 1: %rdi                         Pointer to NONCE
+; parameter 2: %rsi                         Pointer to CT
+; parameter 4: %rdx                         Pointer to keys
 
-
-
-
-	vmovdqa	xmm1,XMMWORDrdx
+	vmovdqa	xmm1,XMMWORDrdx  ; xmm1 = first 16 bytes of random key
 	vmovdqa	xmm4,XMMWORDrdi
 	vmovdqa	xmm11,XMMWORDand_mask
 	vmovdqa	xmm8,XMMWORDone

boringssl-0.20260708.tar.xz/gen/crypto/chacha-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/crypto/chacha-x86_64-apple.S Changed

@@ -62,25 +62,25 @@
 
 L$ctr32_body:
 
-
+// movdqa	.Lsigma(%rip),%xmm0
 	movdqu	(%rcx),%xmm1
 	movdqu	16(%rcx),%xmm2
 	movdqu	(%r8),%xmm3
 	movdqa	L$one(%rip),%xmm4
 
-
-	movdqa	%xmm1,16(%rsp)
-	movdqa	%xmm2,32(%rsp)
-	movdqa	%xmm3,48(%rsp)
-	movq	%rdx,%rbp
+// movdqa	%xmm0,4*0(%rsp)		# key0
+	movdqa	%xmm1,16(%rsp)  // key1
+	movdqa	%xmm2,32(%rsp)  // key2
+	movdqa	%xmm3,48(%rsp)  // key3
+	movq	%rdx,%rbp  // reassign %rdx
 	jmp	L$oop_outer
 
 .p2align	5
 L$oop_outer:
-	movl	$0x61707865,%eax
-	movl	$0x3320646e,%ebx
-	movl	$0x79622d32,%ecx
-	movl	$0x6b206574,%edx
+	movl	$0x61707865,%eax  // 'expa'
+	movl	$0x3320646e,%ebx  // 'nd 3'
+	movl	$0x79622d32,%ecx  // '2-by'
+	movl	$0x6b206574,%edx  // 'te k'
 	movl	16(%rsp),%r8d
 	movl	20(%rsp),%r9d
 	movl	24(%rsp),%r10d
@@ -90,13 +90,13 @@
 	movl	56(%rsp),%r14d
 	movl	60(%rsp),%r15d
 
-	movq	%rbp,64+0(%rsp)
+	movq	%rbp,64+0(%rsp)  // save len
 	movl	$10,%ebp
-	movq	%rsi,64+8(%rsp)
-	movq	%xmm2,%rsi
-	movq	%rdi,64+16(%rsp)
+	movq	%rsi,64+8(%rsp)  // save inp
+	movq	%xmm2,%rsi  // "%nox"
+	movq	%rdi,64+16(%rsp)  // save out
 	movq	%rsi,%rdi
-	shrq	$32,%rdi
+	shrq	$32,%rdi  // "%nox"
 	jmp	L$oop
 
 .p2align	5
@@ -207,18 +207,18 @@
 	roll	$7,%r8d
 	decl	%ebp
 	jnz	L$oop
-	movl	%edi,36(%rsp)
+	movl	%edi,36(%rsp)  // modulo-scheduled
 	movl	%esi,32(%rsp)
-	movq	64(%rsp),%rbp
+	movq	64(%rsp),%rbp  // load len
 	movdqa	%xmm2,%xmm1
-	movq	64+8(%rsp),%rsi
-	paddd	%xmm4,%xmm3
-	movq	64+16(%rsp),%rdi
-
-	addl	$0x61707865,%eax
-	addl	$0x3320646e,%ebx
-	addl	$0x79622d32,%ecx
-	addl	$0x6b206574,%edx
+	movq	64+8(%rsp),%rsi  // load inp
+	paddd	%xmm4,%xmm3  // increment counter
+	movq	64+16(%rsp),%rdi  // load out
+
+	addl	$0x61707865,%eax  // 'expa'
+	addl	$0x3320646e,%ebx  // 'nd 3'
+	addl	$0x79622d32,%ecx  // '2-by'
+	addl	$0x6b206574,%edx  // 'te k'
 	addl	16(%rsp),%r8d
 	addl	20(%rsp),%r9d
 	addl	24(%rsp),%r10d
@@ -232,7 +232,7 @@
 	cmpq	$64,%rbp
 	jb	L$tail
 
-	xorl	0(%rsi),%eax
+	xorl	0(%rsi),%eax  // xor with input
 	xorl	4(%rsi),%ebx
 	xorl	8(%rsi),%ecx
 	xorl	12(%rsi),%edx
@@ -245,13 +245,13 @@
 	xorl	52(%rsi),%r13d
 	xorl	56(%rsi),%r14d
 	xorl	60(%rsi),%r15d
-	leaq	64(%rsi),%rsi
+	leaq	64(%rsi),%rsi  // inp+=64
 	pxor	%xmm1,%xmm0
 
 	movdqa	%xmm2,32(%rsp)
 	movd	%xmm3,48(%rsp)
 
-	movl	%eax,0(%rdi)
+	movl	%eax,0(%rdi)  // write output
 	movl	%ebx,4(%rdi)
 	movl	%ecx,8(%rdi)
 	movl	%edx,12(%rdi)
@@ -264,7 +264,7 @@
 	movl	%r13d,52(%rdi)
 	movl	%r14d,56(%rdi)
 	movl	%r15d,60(%rdi)
-	leaq	64(%rdi),%rdi
+	leaq	64(%rdi),%rdi  // out+=64
 
 	subq	$64,%rbp
 	jnz	L$oop_outer
@@ -325,7 +325,7 @@
 _ChaCha20_ctr32_ssse3:
 
 _CET_ENDBR
-	movq	%rsp,%r9
+	movq	%rsp,%r9  // frame pointer
 
 	subq	$64+8,%rsp
 	movdqa	L$sigma(%rip),%xmm0
@@ -339,7 +339,7 @@
 	movdqa	%xmm1,16(%rsp)
 	movdqa	%xmm2,32(%rsp)
 	movdqa	%xmm3,48(%rsp)
-	movq	$10,%r8
+	movq	$10,%r8  // reuse %r8
 	jmp	L$oop_ssse3
 
 .p2align	5
@@ -410,19 +410,19 @@
 
 	movdqu	0(%rsi),%xmm4
 	movdqu	16(%rsi),%xmm5
-	pxor	%xmm4,%xmm0
+	pxor	%xmm4,%xmm0  // xor with input
 	movdqu	32(%rsi),%xmm4
 	pxor	%xmm5,%xmm1
 	movdqu	48(%rsi),%xmm5
-	leaq	64(%rsi),%rsi
+	leaq	64(%rsi),%rsi  // inp+=64
 	pxor	%xmm4,%xmm2
 	pxor	%xmm5,%xmm3
 
-	movdqu	%xmm0,0(%rdi)
+	movdqu	%xmm0,0(%rdi)  // write output
 	movdqu	%xmm1,16(%rdi)
 	movdqu	%xmm2,32(%rdi)
 	movdqu	%xmm3,48(%rdi)
-	leaq	64(%rdi),%rdi
+	leaq	64(%rdi),%rdi  // out+=64
 
 	subq	$64,%rdx
 	jnz	L$oop_outer_ssse3
@@ -461,20 +461,20 @@
 _ChaCha20_ctr32_ssse3_4x:
 
 _CET_ENDBR
-	movq	%rsp,%r9
+	movq	%rsp,%r9  // frame pointer
 
 	subq	$0x140+8,%rsp
-	movdqa	L$sigma(%rip),%xmm11
-	movdqu	(%rcx),%xmm15
-	movdqu	16(%rcx),%xmm7
-	movdqu	(%r8),%xmm3
-	leaq	256(%rsp),%rcx
+	movdqa	L$sigma(%rip),%xmm11  // key0
+	movdqu	(%rcx),%xmm15  // key1
+	movdqu	16(%rcx),%xmm7  // key2
+	movdqu	(%r8),%xmm3  // key3
+	leaq	256(%rsp),%rcx  // size optimization
 	leaq	L$rot16(%rip),%r10
 	leaq	L$rot24(%rip),%r11
 
-	pshufd	$0x00,%xmm11,%xmm8
+	pshufd	$0x00,%xmm11,%xmm8  // smash key by lanes...
 	pshufd	$0x55,%xmm11,%xmm9
-	movdqa	%xmm8,64(%rsp)
+	movdqa	%xmm8,64(%rsp)  // ... and offload
 	pshufd	$0xaa,%xmm11,%xmm10
 	movdqa	%xmm9,80(%rsp)
 	pshufd	$0xff,%xmm11,%xmm11
@@ -490,18 +490,18 @@
 	movdqa	%xmm14,160-256(%rcx)
 	movdqa	%xmm15,176-256(%rcx)
 
-	pshufd	$0x00,%xmm7,%xmm4
-	pshufd	$0x55,%xmm7,%xmm5
+	pshufd	$0x00,%xmm7,%xmm4  // ""
+	pshufd	$0x55,%xmm7,%xmm5  // ""
 	movdqa	%xmm4,192-256(%rcx)
-	pshufd	$0xaa,%xmm7,%xmm6
+	pshufd	$0xaa,%xmm7,%xmm6  // ""
 	movdqa	%xmm5,208-256(%rcx)
-	pshufd	$0xff,%xmm7,%xmm7
+	pshufd	$0xff,%xmm7,%xmm7  // ""
 	movdqa	%xmm6,224-256(%rcx)
 	movdqa	%xmm7,240-256(%rcx)
 
 	pshufd	$0x00,%xmm3,%xmm0
 	pshufd	$0x55,%xmm3,%xmm1
-	paddd	L$inc(%rip),%xmm0
+	paddd	L$inc(%rip),%xmm0  // don't save counters yet
 	pshufd	$0xaa,%xmm3,%xmm2
 	movdqa	%xmm1,272-256(%rcx)
 	pshufd	$0xff,%xmm3,%xmm3
@@ -512,7 +512,7 @@
 
 .p2align	5
 L$oop_outer4x:
-	movdqa	64(%rsp),%xmm8
+	movdqa	64(%rsp),%xmm8  // re-load smashed key
 	movdqa	80(%rsp),%xmm9
 	movdqa	96(%rsp),%xmm10
 	movdqa	112(%rsp),%xmm11
@@ -520,22 +520,22 @@
 	movdqa	144-256(%rcx),%xmm13
 	movdqa	160-256(%rcx),%xmm14
 	movdqa	176-256(%rcx),%xmm15
-	movdqa	192-256(%rcx),%xmm4
-	movdqa	208-256(%rcx),%xmm5
-	movdqa	224-256(%rcx),%xmm6
-	movdqa	240-256(%rcx),%xmm7
+	movdqa	192-256(%rcx),%xmm4  // ""
+	movdqa	208-256(%rcx),%xmm5  // ""
+	movdqa	224-256(%rcx),%xmm6  // ""
+	movdqa	240-256(%rcx),%xmm7  // ""
 	movdqa	256-256(%rcx),%xmm0
 	movdqa	272-256(%rcx),%xmm1
 	movdqa	288-256(%rcx),%xmm2
 	movdqa	304-256(%rcx),%xmm3
-	paddd	L$four(%rip),%xmm0
+	paddd	L$four(%rip),%xmm0  // next SIMD counters
 
 L$oop_enter4x:
-	movdqa	%xmm6,32(%rsp)
-	movdqa	%xmm7,48(%rsp)
-	movdqa	(%r10),%xmm7
+	movdqa	%xmm6,32(%rsp)  // SIMD equivalent of "%nox"
+	movdqa	%xmm7,48(%rsp)  // SIMD equivalent of "%nox"
+	movdqa	(%r10),%xmm7  // .Lrot16(%rip)
 	movl	$10,%eax
-	movdqa	%xmm0,256-256(%rcx)
+	movdqa	%xmm0,256-256(%rcx)  // save SIMD counters
 	jmp	L$oop4x
 
 .p2align	5
@@ -703,32 +703,32 @@
 	decl	%eax
 	jnz	L$oop4x
 
-	paddd	64(%rsp),%xmm8
+	paddd	64(%rsp),%xmm8  // accumulate key material
 	paddd	80(%rsp),%xmm9
 	paddd	96(%rsp),%xmm10
 	paddd	112(%rsp),%xmm11
 
-	movdqa	%xmm8,%xmm6
+	movdqa	%xmm8,%xmm6  // "de-interlace" data
 	punpckldq	%xmm9,%xmm8
 	movdqa	%xmm10,%xmm7
 	punpckldq	%xmm11,%xmm10
 	punpckhdq	%xmm9,%xmm6
 	punpckhdq	%xmm11,%xmm7
 	movdqa	%xmm8,%xmm9
-	punpcklqdq	%xmm10,%xmm8
+	punpcklqdq	%xmm10,%xmm8  // "a0"
 	movdqa	%xmm6,%xmm11
-	punpcklqdq	%xmm7,%xmm6
-	punpckhqdq	%xmm10,%xmm9
-	punpckhqdq	%xmm7,%xmm11
+	punpcklqdq	%xmm7,%xmm6  // "a2"
+	punpckhqdq	%xmm10,%xmm9  // "a1"
+	punpckhqdq	%xmm7,%xmm11  // "a3"
 	paddd	128-256(%rcx),%xmm12
 	paddd	144-256(%rcx),%xmm13
 	paddd	160-256(%rcx),%xmm14
 	paddd	176-256(%rcx),%xmm15
 
-	movdqa	%xmm8,0(%rsp)
+	movdqa	%xmm8,0(%rsp)  // offload
 	movdqa	%xmm9,16(%rsp)
-	movdqa	32(%rsp),%xmm8
-	movdqa	48(%rsp),%xmm9
+	movdqa	32(%rsp),%xmm8  // "xc2"
+	movdqa	48(%rsp),%xmm9  // "xc3"
 
 	movdqa	%xmm12,%xmm10
 	punpckldq	%xmm13,%xmm12
@@ -737,17 +737,17 @@
 	punpckhdq	%xmm13,%xmm10
 	punpckhdq	%xmm15,%xmm7
 	movdqa	%xmm12,%xmm13
-	punpcklqdq	%xmm14,%xmm12
+	punpcklqdq	%xmm14,%xmm12  // "b0"
 	movdqa	%xmm10,%xmm15
-	punpcklqdq	%xmm7,%xmm10
-	punpckhqdq	%xmm14,%xmm13
-	punpckhqdq	%xmm7,%xmm15
+	punpcklqdq	%xmm7,%xmm10  // "b2"
+	punpckhqdq	%xmm14,%xmm13  // "b1"
+	punpckhqdq	%xmm7,%xmm15  // "b3"
 	paddd	192-256(%rcx),%xmm4
 	paddd	208-256(%rcx),%xmm5
 	paddd	224-256(%rcx),%xmm8
 	paddd	240-256(%rcx),%xmm9
 
-	movdqa	%xmm6,32(%rsp)
+	movdqa	%xmm6,32(%rsp)  // keep offloading
 	movdqa	%xmm11,48(%rsp)
 
 	movdqa	%xmm4,%xmm14
@@ -757,11 +757,11 @@
 	punpckhdq	%xmm5,%xmm14
 	punpckhdq	%xmm9,%xmm7
 	movdqa	%xmm4,%xmm5
-	punpcklqdq	%xmm8,%xmm4
+	punpcklqdq	%xmm8,%xmm4  // "c0"
 	movdqa	%xmm14,%xmm9
-	punpcklqdq	%xmm7,%xmm14
-	punpckhqdq	%xmm8,%xmm5
-	punpckhqdq	%xmm7,%xmm9
+	punpcklqdq	%xmm7,%xmm14  // "c2"
+	punpckhqdq	%xmm8,%xmm5  // "c1"
+	punpckhqdq	%xmm7,%xmm9  // "c3"
 	paddd	256-256(%rcx),%xmm0
 	paddd	272-256(%rcx),%xmm1
 	paddd	288-256(%rcx),%xmm2
@@ -774,19 +774,19 @@
 	punpckhdq	%xmm1,%xmm8
 	punpckhdq	%xmm3,%xmm7
 	movdqa	%xmm0,%xmm1
-	punpcklqdq	%xmm2,%xmm0
+	punpcklqdq	%xmm2,%xmm0  // "d0"
 	movdqa	%xmm8,%xmm3
-	punpcklqdq	%xmm7,%xmm8
-	punpckhqdq	%xmm2,%xmm1
-	punpckhqdq	%xmm7,%xmm3
+	punpcklqdq	%xmm7,%xmm8  // "d2"
+	punpckhqdq	%xmm2,%xmm1  // "d1"
+	punpckhqdq	%xmm7,%xmm3  // "d3"
 	cmpq	$256,%rdx
 	jb	L$tail4x
 
-	movdqu	0(%rsi),%xmm6
+	movdqu	0(%rsi),%xmm6  // xor with input
 	movdqu	16(%rsi),%xmm11
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm7
-	pxor	0(%rsp),%xmm6
+	pxor	0(%rsp),%xmm6  // is offloaded, remember?
 	pxor	%xmm12,%xmm11
 	pxor	%xmm4,%xmm2
 	pxor	%xmm0,%xmm7
@@ -799,7 +799,7 @@
 	movdqu	96(%rsi),%xmm2
 	movdqu	%xmm7,48(%rdi)
 	movdqu	112(%rsi),%xmm7
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // size optimization
 	pxor	16(%rsp),%xmm6
 	pxor	%xmm13,%xmm11
 	pxor	%xmm5,%xmm2
@@ -812,7 +812,7 @@
 	movdqu	%xmm2,96(%rdi)
 	movdqu	32(%rsi),%xmm2
 	movdqu	%xmm7,112(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // size optimization
 	movdqu	48(%rsi),%xmm7
 	pxor	32(%rsp),%xmm6
 	pxor	%xmm10,%xmm11
@@ -827,7 +827,7 @@
 	movdqu	96(%rsi),%xmm2
 	movdqu	%xmm7,48(%rdi)
 	movdqu	112(%rsi),%xmm7
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // inp+=64*4
 	pxor	48(%rsp),%xmm6
 	pxor	%xmm15,%xmm11
 	pxor	%xmm9,%xmm2
@@ -836,7 +836,7 @@
 	movdqu	%xmm11,80(%rdi)
 	movdqu	%xmm2,96(%rdi)
 	movdqu	%xmm7,112(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // out+=64*4
 
 	subq	$256,%rdx
 	jnz	L$oop_outer4x
@@ -851,9 +851,9 @@
 	cmpq	$64,%rdx
 	jae	L$64_or_more4x
 
-
+// movdqa		0x00(%rsp),%xmm6		#  is offloaded, remember?
 	xorq	%r10,%r10
-
+// movdqa		%xmm6,0x00(%rsp)
 	movdqa	%xmm12,16(%rsp)
 	movdqa	%xmm4,32(%rsp)
 	movdqa	%xmm0,48(%rsp)
@@ -861,11 +861,11 @@
 
 .p2align	5
 L$64_or_more4x:
-	movdqu	0(%rsi),%xmm6
+	movdqu	0(%rsi),%xmm6  // xor with input
 	movdqu	16(%rsi),%xmm11
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm7
-	pxor	0(%rsp),%xmm6
+	pxor	0(%rsp),%xmm6  // is offloaded, remember?
 	pxor	%xmm12,%xmm11
 	pxor	%xmm4,%xmm2
 	pxor	%xmm0,%xmm7
@@ -875,24 +875,24 @@
 	movdqu	%xmm7,48(%rdi)
 	je	L$done4x
 
-	movdqa	16(%rsp),%xmm6
-	leaq	64(%rsi),%rsi
+	movdqa	16(%rsp),%xmm6  // is offloaded, remember?
+	leaq	64(%rsi),%rsi  // inp+=64*1
 	xorq	%r10,%r10
 	movdqa	%xmm6,0(%rsp)
 	movdqa	%xmm13,16(%rsp)
-	leaq	64(%rdi),%rdi
+	leaq	64(%rdi),%rdi  // out+=64*1
 	movdqa	%xmm5,32(%rsp)
-	subq	$64,%rdx
+	subq	$64,%rdx  // len-=64*1
 	movdqa	%xmm1,48(%rsp)
 	jmp	L$oop_tail4x
 
 .p2align	5
 L$128_or_more4x:
-	movdqu	0(%rsi),%xmm6
+	movdqu	0(%rsi),%xmm6  // xor with input
 	movdqu	16(%rsi),%xmm11
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm7
-	pxor	0(%rsp),%xmm6
+	pxor	0(%rsp),%xmm6  // is offloaded, remember?
 	pxor	%xmm12,%xmm11
 	pxor	%xmm4,%xmm2
 	pxor	%xmm0,%xmm7
@@ -915,24 +915,24 @@
 	movdqu	%xmm7,112(%rdi)
 	je	L$done4x
 
-	movdqa	32(%rsp),%xmm6
-	leaq	128(%rsi),%rsi
+	movdqa	32(%rsp),%xmm6  // is offloaded, remember?
+	leaq	128(%rsi),%rsi  // inp+=64*2
 	xorq	%r10,%r10
 	movdqa	%xmm6,0(%rsp)
 	movdqa	%xmm10,16(%rsp)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // out+=64*2
 	movdqa	%xmm14,32(%rsp)
-	subq	$128,%rdx
+	subq	$128,%rdx  // len-=64*2
 	movdqa	%xmm8,48(%rsp)
 	jmp	L$oop_tail4x
 
 .p2align	5
 L$192_or_more4x:
-	movdqu	0(%rsi),%xmm6
+	movdqu	0(%rsi),%xmm6  // xor with input
 	movdqu	16(%rsi),%xmm11
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm7
-	pxor	0(%rsp),%xmm6
+	pxor	0(%rsp),%xmm6  // is offloaded, remember?
 	pxor	%xmm12,%xmm11
 	pxor	%xmm4,%xmm2
 	pxor	%xmm0,%xmm7
@@ -945,7 +945,7 @@
 	movdqu	96(%rsi),%xmm2
 	movdqu	%xmm7,48(%rdi)
 	movdqu	112(%rsi),%xmm7
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // size optimization
 	pxor	16(%rsp),%xmm6
 	pxor	%xmm13,%xmm11
 	pxor	%xmm5,%xmm2
@@ -958,7 +958,7 @@
 	movdqu	%xmm2,96(%rdi)
 	movdqu	32(%rsi),%xmm2
 	movdqu	%xmm7,112(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // size optimization
 	movdqu	48(%rsi),%xmm7
 	pxor	32(%rsp),%xmm6
 	pxor	%xmm10,%xmm11
@@ -970,14 +970,14 @@
 	movdqu	%xmm7,48(%rdi)
 	je	L$done4x
 
-	movdqa	48(%rsp),%xmm6
-	leaq	64(%rsi),%rsi
+	movdqa	48(%rsp),%xmm6  // is offloaded, remember?
+	leaq	64(%rsi),%rsi  // inp+=64*3
 	xorq	%r10,%r10
 	movdqa	%xmm6,0(%rsp)
 	movdqa	%xmm15,16(%rsp)
-	leaq	64(%rdi),%rdi
+	leaq	64(%rdi),%rdi  // out+=64*3
 	movdqa	%xmm9,32(%rsp)
-	subq	$192,%rdx
+	subq	$192,%rdx  // len-=64*3
 	movdqa	%xmm3,48(%rsp)
 
 L$oop_tail4x:
@@ -1004,33 +1004,33 @@
 _ChaCha20_ctr32_avx2:
 
 _CET_ENDBR
-	movq	%rsp,%r9
+	movq	%rsp,%r9  // frame register
 
 	subq	$0x280+8,%rsp
 	andq	$-32,%rsp
 	vzeroupper
 
-
-
-
-
-
-
-
-
-
-	vbroadcasti128	L$sigma(%rip),%ymm11
-	vbroadcasti128	(%rcx),%ymm3
-	vbroadcasti128	16(%rcx),%ymm15
-	vbroadcasti128	(%r8),%ymm7
-	leaq	256(%rsp),%rcx
-	leaq	512(%rsp),%rax
+// ############### stack layout
+// +0x00		SIMD equivalent of %r12d
+// ...
+// +0x80		constant copy of key0-2 smashed by lanes
+// ...
+// +0x200	SIMD counters (with nonce smashed by lanes)
+// ...
+// +0x280
+
+	vbroadcasti128	L$sigma(%rip),%ymm11  // key0
+	vbroadcasti128	(%rcx),%ymm3  // key1
+	vbroadcasti128	16(%rcx),%ymm15  // key2
+	vbroadcasti128	(%r8),%ymm7  // key3
+	leaq	256(%rsp),%rcx  // size optimization
+	leaq	512(%rsp),%rax  // size optimization
 	leaq	L$rot16(%rip),%r10
 	leaq	L$rot24(%rip),%r11
 
-	vpshufd	$0x00,%ymm11,%ymm8
+	vpshufd	$0x00,%ymm11,%ymm8  // smash key by lanes...
 	vpshufd	$0x55,%ymm11,%ymm9
-	vmovdqa	%ymm8,128-256(%rcx)
+	vmovdqa	%ymm8,128-256(%rcx)  // ... and offload
 	vpshufd	$0xaa,%ymm11,%ymm10
 	vmovdqa	%ymm9,160-256(%rcx)
 	vpshufd	$0xff,%ymm11,%ymm11
@@ -1046,18 +1046,18 @@
 	vmovdqa	%ymm2,320-256(%rcx)
 	vmovdqa	%ymm3,352-256(%rcx)
 
-	vpshufd	$0x00,%ymm15,%ymm12
-	vpshufd	$0x55,%ymm15,%ymm13
+	vpshufd	$0x00,%ymm15,%ymm12  // "xc0"
+	vpshufd	$0x55,%ymm15,%ymm13  // "xc1"
 	vmovdqa	%ymm12,384-512(%rax)
-	vpshufd	$0xaa,%ymm15,%ymm14
+	vpshufd	$0xaa,%ymm15,%ymm14  // "xc2"
 	vmovdqa	%ymm13,416-512(%rax)
-	vpshufd	$0xff,%ymm15,%ymm15
+	vpshufd	$0xff,%ymm15,%ymm15  // "xc3"
 	vmovdqa	%ymm14,448-512(%rax)
 	vmovdqa	%ymm15,480-512(%rax)
 
 	vpshufd	$0x00,%ymm7,%ymm4
 	vpshufd	$0x55,%ymm7,%ymm5
-	vpaddd	L$incy(%rip),%ymm4,%ymm4
+	vpaddd	L$incy(%rip),%ymm4,%ymm4  // don't save counters yet
 	vpshufd	$0xaa,%ymm7,%ymm6
 	vmovdqa	%ymm5,544-512(%rax)
 	vpshufd	$0xff,%ymm7,%ymm7
@@ -1068,7 +1068,7 @@
 
 .p2align	5
 L$oop_outer8x:
-	vmovdqa	128-256(%rcx),%ymm8
+	vmovdqa	128-256(%rcx),%ymm8  // re-load smashed key
 	vmovdqa	160-256(%rcx),%ymm9
 	vmovdqa	192-256(%rcx),%ymm10
 	vmovdqa	224-256(%rcx),%ymm11
@@ -1076,21 +1076,21 @@
 	vmovdqa	288-256(%rcx),%ymm1
 	vmovdqa	320-256(%rcx),%ymm2
 	vmovdqa	352-256(%rcx),%ymm3
-	vmovdqa	384-512(%rax),%ymm12
-	vmovdqa	416-512(%rax),%ymm13
-	vmovdqa	448-512(%rax),%ymm14
-	vmovdqa	480-512(%rax),%ymm15
+	vmovdqa	384-512(%rax),%ymm12  // "xc0"
+	vmovdqa	416-512(%rax),%ymm13  // "xc1"
+	vmovdqa	448-512(%rax),%ymm14  // "xc2"
+	vmovdqa	480-512(%rax),%ymm15  // "xc3"
 	vmovdqa	512-512(%rax),%ymm4
 	vmovdqa	544-512(%rax),%ymm5
 	vmovdqa	576-512(%rax),%ymm6
 	vmovdqa	608-512(%rax),%ymm7
-	vpaddd	L$eight(%rip),%ymm4,%ymm4
+	vpaddd	L$eight(%rip),%ymm4,%ymm4  // next SIMD counters
 
 L$oop_enter8x:
-	vmovdqa	%ymm14,64(%rsp)
-	vmovdqa	%ymm15,96(%rsp)
+	vmovdqa	%ymm14,64(%rsp)  // SIMD equivalent of "%nox"
+	vmovdqa	%ymm15,96(%rsp)  // SIMD equivalent of "%nox"
 	vbroadcasti128	(%r10),%ymm15
-	vmovdqa	%ymm4,512-512(%rax)
+	vmovdqa	%ymm4,512-512(%rax)  // save SIMD counters
 	movl	$10,%eax
 	jmp	L$oop8x
 
@@ -1243,20 +1243,20 @@
 	decl	%eax
 	jnz	L$oop8x
 
-	leaq	512(%rsp),%rax
-	vpaddd	128-256(%rcx),%ymm8,%ymm8
+	leaq	512(%rsp),%rax  // size optimization
+	vpaddd	128-256(%rcx),%ymm8,%ymm8  // accumulate key
 	vpaddd	160-256(%rcx),%ymm9,%ymm9
 	vpaddd	192-256(%rcx),%ymm10,%ymm10
 	vpaddd	224-256(%rcx),%ymm11,%ymm11
 
-	vpunpckldq	%ymm9,%ymm8,%ymm14
+	vpunpckldq	%ymm9,%ymm8,%ymm14  // "de-interlace" data
 	vpunpckldq	%ymm11,%ymm10,%ymm15
 	vpunpckhdq	%ymm9,%ymm8,%ymm8
 	vpunpckhdq	%ymm11,%ymm10,%ymm10
-	vpunpcklqdq	%ymm15,%ymm14,%ymm9
-	vpunpckhqdq	%ymm15,%ymm14,%ymm14
-	vpunpcklqdq	%ymm10,%ymm8,%ymm11
-	vpunpckhqdq	%ymm10,%ymm8,%ymm8
+	vpunpcklqdq	%ymm15,%ymm14,%ymm9  // "a0"
+	vpunpckhqdq	%ymm15,%ymm14,%ymm14  // "a1"
+	vpunpcklqdq	%ymm10,%ymm8,%ymm11  // "a2"
+	vpunpckhqdq	%ymm10,%ymm8,%ymm8  // "a3"
 	vpaddd	256-256(%rcx),%ymm0,%ymm0
 	vpaddd	288-256(%rcx),%ymm1,%ymm1
 	vpaddd	320-256(%rcx),%ymm2,%ymm2
@@ -1266,11 +1266,11 @@
 	vpunpckldq	%ymm3,%ymm2,%ymm15
 	vpunpckhdq	%ymm1,%ymm0,%ymm0
 	vpunpckhdq	%ymm3,%ymm2,%ymm2
-	vpunpcklqdq	%ymm15,%ymm10,%ymm1
-	vpunpckhqdq	%ymm15,%ymm10,%ymm10
-	vpunpcklqdq	%ymm2,%ymm0,%ymm3
-	vpunpckhqdq	%ymm2,%ymm0,%ymm0
-	vperm2i128	$0x20,%ymm1,%ymm9,%ymm15
+	vpunpcklqdq	%ymm15,%ymm10,%ymm1  // "b0"
+	vpunpckhqdq	%ymm15,%ymm10,%ymm10  // "b1"
+	vpunpcklqdq	%ymm2,%ymm0,%ymm3  // "b2"
+	vpunpckhqdq	%ymm2,%ymm0,%ymm0  // "b3"
+	vperm2i128	$0x20,%ymm1,%ymm9,%ymm15  // "de-interlace" further
 	vperm2i128	$0x31,%ymm1,%ymm9,%ymm1
 	vperm2i128	$0x20,%ymm10,%ymm14,%ymm9
 	vperm2i128	$0x31,%ymm10,%ymm14,%ymm10
@@ -1278,10 +1278,10 @@
 	vperm2i128	$0x31,%ymm3,%ymm11,%ymm3
 	vperm2i128	$0x20,%ymm0,%ymm8,%ymm11
 	vperm2i128	$0x31,%ymm0,%ymm8,%ymm0
-	vmovdqa	%ymm15,0(%rsp)
+	vmovdqa	%ymm15,0(%rsp)  // offload
 	vmovdqa	%ymm9,32(%rsp)
-	vmovdqa	64(%rsp),%ymm15
-	vmovdqa	96(%rsp),%ymm9
+	vmovdqa	64(%rsp),%ymm15  // %ymm15
+	vmovdqa	96(%rsp),%ymm9  // %ymm9
 
 	vpaddd	384-512(%rax),%ymm12,%ymm12
 	vpaddd	416-512(%rax),%ymm13,%ymm13
@@ -1292,10 +1292,10 @@
 	vpunpckldq	%ymm9,%ymm15,%ymm8
 	vpunpckhdq	%ymm13,%ymm12,%ymm12
 	vpunpckhdq	%ymm9,%ymm15,%ymm15
-	vpunpcklqdq	%ymm8,%ymm2,%ymm13
-	vpunpckhqdq	%ymm8,%ymm2,%ymm2
-	vpunpcklqdq	%ymm15,%ymm12,%ymm9
-	vpunpckhqdq	%ymm15,%ymm12,%ymm12
+	vpunpcklqdq	%ymm8,%ymm2,%ymm13  // "c0"
+	vpunpckhqdq	%ymm8,%ymm2,%ymm2  // "c1"
+	vpunpcklqdq	%ymm15,%ymm12,%ymm9  // "c2"
+	vpunpckhqdq	%ymm15,%ymm12,%ymm12  // "c3"
 	vpaddd	512-512(%rax),%ymm4,%ymm4
 	vpaddd	544-512(%rax),%ymm5,%ymm5
 	vpaddd	576-512(%rax),%ymm6,%ymm6
@@ -1305,11 +1305,11 @@
 	vpunpckldq	%ymm7,%ymm6,%ymm8
 	vpunpckhdq	%ymm5,%ymm4,%ymm4
 	vpunpckhdq	%ymm7,%ymm6,%ymm6
-	vpunpcklqdq	%ymm8,%ymm15,%ymm5
-	vpunpckhqdq	%ymm8,%ymm15,%ymm15
-	vpunpcklqdq	%ymm6,%ymm4,%ymm7
-	vpunpckhqdq	%ymm6,%ymm4,%ymm4
-	vperm2i128	$0x20,%ymm5,%ymm13,%ymm8
+	vpunpcklqdq	%ymm8,%ymm15,%ymm5  // "d0"
+	vpunpckhqdq	%ymm8,%ymm15,%ymm15  // "d1"
+	vpunpcklqdq	%ymm6,%ymm4,%ymm7  // "d2"
+	vpunpckhqdq	%ymm6,%ymm4,%ymm4  // "d3"
+	vperm2i128	$0x20,%ymm5,%ymm13,%ymm8  // "de-interlace" further
 	vperm2i128	$0x31,%ymm5,%ymm13,%ymm5
 	vperm2i128	$0x20,%ymm15,%ymm2,%ymm13
 	vperm2i128	$0x31,%ymm15,%ymm2,%ymm15
@@ -1317,55 +1317,55 @@
 	vperm2i128	$0x31,%ymm7,%ymm9,%ymm7
 	vperm2i128	$0x20,%ymm4,%ymm12,%ymm9
 	vperm2i128	$0x31,%ymm4,%ymm12,%ymm4
-	vmovdqa	0(%rsp),%ymm6
+	vmovdqa	0(%rsp),%ymm6  // was offloaded, remember?
 	vmovdqa	32(%rsp),%ymm12
 
 	cmpq	$512,%rdx
 	jb	L$tail8x
 
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // size optimization
 	vmovdqu	%ymm6,0(%rdi)
 	vmovdqu	%ymm8,32(%rdi)
 	vmovdqu	%ymm1,64(%rdi)
 	vmovdqu	%ymm5,96(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // size optimization
 
 	vpxor	0(%rsi),%ymm12,%ymm12
 	vpxor	32(%rsi),%ymm13,%ymm13
 	vpxor	64(%rsi),%ymm10,%ymm10
 	vpxor	96(%rsi),%ymm15,%ymm15
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // size optimization
 	vmovdqu	%ymm12,0(%rdi)
 	vmovdqu	%ymm13,32(%rdi)
 	vmovdqu	%ymm10,64(%rdi)
 	vmovdqu	%ymm15,96(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // size optimization
 
 	vpxor	0(%rsi),%ymm14,%ymm14
 	vpxor	32(%rsi),%ymm2,%ymm2
 	vpxor	64(%rsi),%ymm3,%ymm3
 	vpxor	96(%rsi),%ymm7,%ymm7
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // size optimization
 	vmovdqu	%ymm14,0(%rdi)
 	vmovdqu	%ymm2,32(%rdi)
 	vmovdqu	%ymm3,64(%rdi)
 	vmovdqu	%ymm7,96(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // size optimization
 
 	vpxor	0(%rsi),%ymm11,%ymm11
 	vpxor	32(%rsi),%ymm9,%ymm9
 	vpxor	64(%rsi),%ymm0,%ymm0
 	vpxor	96(%rsi),%ymm4,%ymm4
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // size optimization
 	vmovdqu	%ymm11,0(%rdi)
 	vmovdqu	%ymm9,32(%rdi)
 	vmovdqu	%ymm0,64(%rdi)
 	vmovdqu	%ymm4,96(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // size optimization
 
 	subq	$512,%rdx
 	jnz	L$oop_outer8x
@@ -1395,23 +1395,23 @@
 
 .p2align	5
 L$64_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vmovdqu	%ymm6,0(%rdi)
 	vmovdqu	%ymm8,32(%rdi)
 	je	L$done8x
 
-	leaq	64(%rsi),%rsi
+	leaq	64(%rsi),%rsi  // inp+=64*1
 	xorq	%r10,%r10
 	vmovdqa	%ymm1,0(%rsp)
-	leaq	64(%rdi),%rdi
-	subq	$64,%rdx
+	leaq	64(%rdi),%rdi  // out+=64*1
+	subq	$64,%rdx  // len-=64*1
 	vmovdqa	%ymm5,32(%rsp)
 	jmp	L$oop_tail8x
 
 .p2align	5
 L$128_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
@@ -1421,17 +1421,17 @@
 	vmovdqu	%ymm5,96(%rdi)
 	je	L$done8x
 
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // inp+=64*2
 	xorq	%r10,%r10
 	vmovdqa	%ymm12,0(%rsp)
-	leaq	128(%rdi),%rdi
-	subq	$128,%rdx
+	leaq	128(%rdi),%rdi  // out+=64*2
+	subq	$128,%rdx  // len-=64*2
 	vmovdqa	%ymm13,32(%rsp)
 	jmp	L$oop_tail8x
 
 .p2align	5
 L$192_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
@@ -1445,17 +1445,17 @@
 	vmovdqu	%ymm13,160(%rdi)
 	je	L$done8x
 
-	leaq	192(%rsi),%rsi
+	leaq	192(%rsi),%rsi  // inp+=64*3
 	xorq	%r10,%r10
 	vmovdqa	%ymm10,0(%rsp)
-	leaq	192(%rdi),%rdi
-	subq	$192,%rdx
+	leaq	192(%rdi),%rdi  // out+=64*3
+	subq	$192,%rdx  // len-=64*3
 	vmovdqa	%ymm15,32(%rsp)
 	jmp	L$oop_tail8x
 
 .p2align	5
 L$256_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
@@ -1473,17 +1473,17 @@
 	vmovdqu	%ymm15,224(%rdi)
 	je	L$done8x
 
-	leaq	256(%rsi),%rsi
+	leaq	256(%rsi),%rsi  // inp+=64*4
 	xorq	%r10,%r10
 	vmovdqa	%ymm14,0(%rsp)
-	leaq	256(%rdi),%rdi
-	subq	$256,%rdx
+	leaq	256(%rdi),%rdi  // out+=64*4
+	subq	$256,%rdx  // len-=64*4
 	vmovdqa	%ymm2,32(%rsp)
 	jmp	L$oop_tail8x
 
 .p2align	5
 L$320_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
@@ -1505,17 +1505,17 @@
 	vmovdqu	%ymm2,288(%rdi)
 	je	L$done8x
 
-	leaq	320(%rsi),%rsi
+	leaq	320(%rsi),%rsi  // inp+=64*5
 	xorq	%r10,%r10
 	vmovdqa	%ymm3,0(%rsp)
-	leaq	320(%rdi),%rdi
-	subq	$320,%rdx
+	leaq	320(%rdi),%rdi  // out+=64*5
+	subq	$320,%rdx  // len-=64*5
 	vmovdqa	%ymm7,32(%rsp)
 	jmp	L$oop_tail8x
 
 .p2align	5
 L$384_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
@@ -1541,17 +1541,17 @@
 	vmovdqu	%ymm7,352(%rdi)
 	je	L$done8x
 
-	leaq	384(%rsi),%rsi
+	leaq	384(%rsi),%rsi  // inp+=64*6
 	xorq	%r10,%r10
 	vmovdqa	%ymm11,0(%rsp)
-	leaq	384(%rdi),%rdi
-	subq	$384,%rdx
+	leaq	384(%rdi),%rdi  // out+=64*6
+	subq	$384,%rdx  // len-=64*6
 	vmovdqa	%ymm9,32(%rsp)
 	jmp	L$oop_tail8x
 
 .p2align	5
 L$448_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
@@ -1581,11 +1581,11 @@
 	vmovdqu	%ymm9,416(%rdi)
 	je	L$done8x
 
-	leaq	448(%rsi),%rsi
+	leaq	448(%rsi),%rsi  // inp+=64*7
 	xorq	%r10,%r10
 	vmovdqa	%ymm0,0(%rsp)
-	leaq	448(%rdi),%rdi
-	subq	$448,%rdx
+	leaq	448(%rdi),%rdi  // out+=64*7
+	subq	$448,%rdx  // len-=64*7
 	vmovdqa	%ymm4,32(%rsp)
 
 L$oop_tail8x:

boringssl-0.20260708.tar.xz/gen/crypto/chacha-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/crypto/chacha-x86_64-linux.S Changed

@@ -68,25 +68,25 @@
 .cfi_adjust_cfa_offset	88
 .Lctr32_body:
 
-
+// movdqa	.Lsigma(%rip),%xmm0
 	movdqu	(%rcx),%xmm1
 	movdqu	16(%rcx),%xmm2
 	movdqu	(%r8),%xmm3
 	movdqa	.Lone(%rip),%xmm4
 
-
-	movdqa	%xmm1,16(%rsp)
-	movdqa	%xmm2,32(%rsp)
-	movdqa	%xmm3,48(%rsp)
-	movq	%rdx,%rbp
+// movdqa	%xmm0,4*0(%rsp)		# key0
+	movdqa	%xmm1,16(%rsp)  // key1
+	movdqa	%xmm2,32(%rsp)  // key2
+	movdqa	%xmm3,48(%rsp)  // key3
+	movq	%rdx,%rbp  // reassign %rdx
 	jmp	.Loop_outer
 
 .align	32
 .Loop_outer:
-	movl	$0x61707865,%eax
-	movl	$0x3320646e,%ebx
-	movl	$0x79622d32,%ecx
-	movl	$0x6b206574,%edx
+	movl	$0x61707865,%eax  // 'expa'
+	movl	$0x3320646e,%ebx  // 'nd 3'
+	movl	$0x79622d32,%ecx  // '2-by'
+	movl	$0x6b206574,%edx  // 'te k'
 	movl	16(%rsp),%r8d
 	movl	20(%rsp),%r9d
 	movl	24(%rsp),%r10d
@@ -96,13 +96,13 @@
 	movl	56(%rsp),%r14d
 	movl	60(%rsp),%r15d
 
-	movq	%rbp,64+0(%rsp)
+	movq	%rbp,64+0(%rsp)  // save len
 	movl	$10,%ebp
-	movq	%rsi,64+8(%rsp)
-	movq	%xmm2,%rsi
-	movq	%rdi,64+16(%rsp)
+	movq	%rsi,64+8(%rsp)  // save inp
+	movq	%xmm2,%rsi  // "%nox"
+	movq	%rdi,64+16(%rsp)  // save out
 	movq	%rsi,%rdi
-	shrq	$32,%rdi
+	shrq	$32,%rdi  // "%nox"
 	jmp	.Loop
 
 .align	32
@@ -213,18 +213,18 @@
 	roll	$7,%r8d
 	decl	%ebp
 	jnz	.Loop
-	movl	%edi,36(%rsp)
+	movl	%edi,36(%rsp)  // modulo-scheduled
 	movl	%esi,32(%rsp)
-	movq	64(%rsp),%rbp
+	movq	64(%rsp),%rbp  // load len
 	movdqa	%xmm2,%xmm1
-	movq	64+8(%rsp),%rsi
-	paddd	%xmm4,%xmm3
-	movq	64+16(%rsp),%rdi
-
-	addl	$0x61707865,%eax
-	addl	$0x3320646e,%ebx
-	addl	$0x79622d32,%ecx
-	addl	$0x6b206574,%edx
+	movq	64+8(%rsp),%rsi  // load inp
+	paddd	%xmm4,%xmm3  // increment counter
+	movq	64+16(%rsp),%rdi  // load out
+
+	addl	$0x61707865,%eax  // 'expa'
+	addl	$0x3320646e,%ebx  // 'nd 3'
+	addl	$0x79622d32,%ecx  // '2-by'
+	addl	$0x6b206574,%edx  // 'te k'
 	addl	16(%rsp),%r8d
 	addl	20(%rsp),%r9d
 	addl	24(%rsp),%r10d
@@ -238,7 +238,7 @@
 	cmpq	$64,%rbp
 	jb	.Ltail
 
-	xorl	0(%rsi),%eax
+	xorl	0(%rsi),%eax  // xor with input
 	xorl	4(%rsi),%ebx
 	xorl	8(%rsi),%ecx
 	xorl	12(%rsi),%edx
@@ -251,13 +251,13 @@
 	xorl	52(%rsi),%r13d
 	xorl	56(%rsi),%r14d
 	xorl	60(%rsi),%r15d
-	leaq	64(%rsi),%rsi
+	leaq	64(%rsi),%rsi  // inp+=64
 	pxor	%xmm1,%xmm0
 
 	movdqa	%xmm2,32(%rsp)
 	movd	%xmm3,48(%rsp)
 
-	movl	%eax,0(%rdi)
+	movl	%eax,0(%rdi)  // write output
 	movl	%ebx,4(%rdi)
 	movl	%ecx,8(%rdi)
 	movl	%edx,12(%rdi)
@@ -270,7 +270,7 @@
 	movl	%r13d,52(%rdi)
 	movl	%r14d,56(%rdi)
 	movl	%r15d,60(%rdi)
-	leaq	64(%rdi),%rdi
+	leaq	64(%rdi),%rdi  // out+=64
 
 	subq	$64,%rbp
 	jnz	.Loop_outer
@@ -330,7 +330,7 @@
 ChaCha20_ctr32_ssse3:
 .cfi_startproc	
 _CET_ENDBR
-	movq	%rsp,%r9
+	movq	%rsp,%r9  // frame pointer
 .cfi_def_cfa_register	r9
 	subq	$64+8,%rsp
 	movdqa	.Lsigma(%rip),%xmm0
@@ -344,7 +344,7 @@
 	movdqa	%xmm1,16(%rsp)
 	movdqa	%xmm2,32(%rsp)
 	movdqa	%xmm3,48(%rsp)
-	movq	$10,%r8
+	movq	$10,%r8  // reuse %r8
 	jmp	.Loop_ssse3
 
 .align	32
@@ -415,19 +415,19 @@
 
 	movdqu	0(%rsi),%xmm4
 	movdqu	16(%rsi),%xmm5
-	pxor	%xmm4,%xmm0
+	pxor	%xmm4,%xmm0  // xor with input
 	movdqu	32(%rsi),%xmm4
 	pxor	%xmm5,%xmm1
 	movdqu	48(%rsi),%xmm5
-	leaq	64(%rsi),%rsi
+	leaq	64(%rsi),%rsi  // inp+=64
 	pxor	%xmm4,%xmm2
 	pxor	%xmm5,%xmm3
 
-	movdqu	%xmm0,0(%rdi)
+	movdqu	%xmm0,0(%rdi)  // write output
 	movdqu	%xmm1,16(%rdi)
 	movdqu	%xmm2,32(%rdi)
 	movdqu	%xmm3,48(%rdi)
-	leaq	64(%rdi),%rdi
+	leaq	64(%rdi),%rdi  // out+=64
 
 	subq	$64,%rdx
 	jnz	.Loop_outer_ssse3
@@ -465,20 +465,20 @@
 ChaCha20_ctr32_ssse3_4x:
 .cfi_startproc	
 _CET_ENDBR
-	movq	%rsp,%r9
+	movq	%rsp,%r9  // frame pointer
 .cfi_def_cfa_register	r9
 	subq	$0x140+8,%rsp
-	movdqa	.Lsigma(%rip),%xmm11
-	movdqu	(%rcx),%xmm15
-	movdqu	16(%rcx),%xmm7
-	movdqu	(%r8),%xmm3
-	leaq	256(%rsp),%rcx
+	movdqa	.Lsigma(%rip),%xmm11  // key0
+	movdqu	(%rcx),%xmm15  // key1
+	movdqu	16(%rcx),%xmm7  // key2
+	movdqu	(%r8),%xmm3  // key3
+	leaq	256(%rsp),%rcx  // size optimization
 	leaq	.Lrot16(%rip),%r10
 	leaq	.Lrot24(%rip),%r11
 
-	pshufd	$0x00,%xmm11,%xmm8
+	pshufd	$0x00,%xmm11,%xmm8  // smash key by lanes...
 	pshufd	$0x55,%xmm11,%xmm9
-	movdqa	%xmm8,64(%rsp)
+	movdqa	%xmm8,64(%rsp)  // ... and offload
 	pshufd	$0xaa,%xmm11,%xmm10
 	movdqa	%xmm9,80(%rsp)
 	pshufd	$0xff,%xmm11,%xmm11
@@ -494,18 +494,18 @@
 	movdqa	%xmm14,160-256(%rcx)
 	movdqa	%xmm15,176-256(%rcx)
 
-	pshufd	$0x00,%xmm7,%xmm4
-	pshufd	$0x55,%xmm7,%xmm5
+	pshufd	$0x00,%xmm7,%xmm4  // ""
+	pshufd	$0x55,%xmm7,%xmm5  // ""
 	movdqa	%xmm4,192-256(%rcx)
-	pshufd	$0xaa,%xmm7,%xmm6
+	pshufd	$0xaa,%xmm7,%xmm6  // ""
 	movdqa	%xmm5,208-256(%rcx)
-	pshufd	$0xff,%xmm7,%xmm7
+	pshufd	$0xff,%xmm7,%xmm7  // ""
 	movdqa	%xmm6,224-256(%rcx)
 	movdqa	%xmm7,240-256(%rcx)
 
 	pshufd	$0x00,%xmm3,%xmm0
 	pshufd	$0x55,%xmm3,%xmm1
-	paddd	.Linc(%rip),%xmm0
+	paddd	.Linc(%rip),%xmm0  // don't save counters yet
 	pshufd	$0xaa,%xmm3,%xmm2
 	movdqa	%xmm1,272-256(%rcx)
 	pshufd	$0xff,%xmm3,%xmm3
@@ -516,7 +516,7 @@
 
 .align	32
 .Loop_outer4x:
-	movdqa	64(%rsp),%xmm8
+	movdqa	64(%rsp),%xmm8  // re-load smashed key
 	movdqa	80(%rsp),%xmm9
 	movdqa	96(%rsp),%xmm10
 	movdqa	112(%rsp),%xmm11
@@ -524,22 +524,22 @@
 	movdqa	144-256(%rcx),%xmm13
 	movdqa	160-256(%rcx),%xmm14
 	movdqa	176-256(%rcx),%xmm15
-	movdqa	192-256(%rcx),%xmm4
-	movdqa	208-256(%rcx),%xmm5
-	movdqa	224-256(%rcx),%xmm6
-	movdqa	240-256(%rcx),%xmm7
+	movdqa	192-256(%rcx),%xmm4  // ""
+	movdqa	208-256(%rcx),%xmm5  // ""
+	movdqa	224-256(%rcx),%xmm6  // ""
+	movdqa	240-256(%rcx),%xmm7  // ""
 	movdqa	256-256(%rcx),%xmm0
 	movdqa	272-256(%rcx),%xmm1
 	movdqa	288-256(%rcx),%xmm2
 	movdqa	304-256(%rcx),%xmm3
-	paddd	.Lfour(%rip),%xmm0
+	paddd	.Lfour(%rip),%xmm0  // next SIMD counters
 
 .Loop_enter4x:
-	movdqa	%xmm6,32(%rsp)
-	movdqa	%xmm7,48(%rsp)
-	movdqa	(%r10),%xmm7
+	movdqa	%xmm6,32(%rsp)  // SIMD equivalent of "%nox"
+	movdqa	%xmm7,48(%rsp)  // SIMD equivalent of "%nox"
+	movdqa	(%r10),%xmm7  // .Lrot16(%rip)
 	movl	$10,%eax
-	movdqa	%xmm0,256-256(%rcx)
+	movdqa	%xmm0,256-256(%rcx)  // save SIMD counters
 	jmp	.Loop4x
 
 .align	32
@@ -707,32 +707,32 @@
 	decl	%eax
 	jnz	.Loop4x
 
-	paddd	64(%rsp),%xmm8
+	paddd	64(%rsp),%xmm8  // accumulate key material
 	paddd	80(%rsp),%xmm9
 	paddd	96(%rsp),%xmm10
 	paddd	112(%rsp),%xmm11
 
-	movdqa	%xmm8,%xmm6
+	movdqa	%xmm8,%xmm6  // "de-interlace" data
 	punpckldq	%xmm9,%xmm8
 	movdqa	%xmm10,%xmm7
 	punpckldq	%xmm11,%xmm10
 	punpckhdq	%xmm9,%xmm6
 	punpckhdq	%xmm11,%xmm7
 	movdqa	%xmm8,%xmm9
-	punpcklqdq	%xmm10,%xmm8
+	punpcklqdq	%xmm10,%xmm8  // "a0"
 	movdqa	%xmm6,%xmm11
-	punpcklqdq	%xmm7,%xmm6
-	punpckhqdq	%xmm10,%xmm9
-	punpckhqdq	%xmm7,%xmm11
+	punpcklqdq	%xmm7,%xmm6  // "a2"
+	punpckhqdq	%xmm10,%xmm9  // "a1"
+	punpckhqdq	%xmm7,%xmm11  // "a3"
 	paddd	128-256(%rcx),%xmm12
 	paddd	144-256(%rcx),%xmm13
 	paddd	160-256(%rcx),%xmm14
 	paddd	176-256(%rcx),%xmm15
 
-	movdqa	%xmm8,0(%rsp)
+	movdqa	%xmm8,0(%rsp)  // offload
 	movdqa	%xmm9,16(%rsp)
-	movdqa	32(%rsp),%xmm8
-	movdqa	48(%rsp),%xmm9
+	movdqa	32(%rsp),%xmm8  // "xc2"
+	movdqa	48(%rsp),%xmm9  // "xc3"
 
 	movdqa	%xmm12,%xmm10
 	punpckldq	%xmm13,%xmm12
@@ -741,17 +741,17 @@
 	punpckhdq	%xmm13,%xmm10
 	punpckhdq	%xmm15,%xmm7
 	movdqa	%xmm12,%xmm13
-	punpcklqdq	%xmm14,%xmm12
+	punpcklqdq	%xmm14,%xmm12  // "b0"
 	movdqa	%xmm10,%xmm15
-	punpcklqdq	%xmm7,%xmm10
-	punpckhqdq	%xmm14,%xmm13
-	punpckhqdq	%xmm7,%xmm15
+	punpcklqdq	%xmm7,%xmm10  // "b2"
+	punpckhqdq	%xmm14,%xmm13  // "b1"
+	punpckhqdq	%xmm7,%xmm15  // "b3"
 	paddd	192-256(%rcx),%xmm4
 	paddd	208-256(%rcx),%xmm5
 	paddd	224-256(%rcx),%xmm8
 	paddd	240-256(%rcx),%xmm9
 
-	movdqa	%xmm6,32(%rsp)
+	movdqa	%xmm6,32(%rsp)  // keep offloading
 	movdqa	%xmm11,48(%rsp)
 
 	movdqa	%xmm4,%xmm14
@@ -761,11 +761,11 @@
 	punpckhdq	%xmm5,%xmm14
 	punpckhdq	%xmm9,%xmm7
 	movdqa	%xmm4,%xmm5
-	punpcklqdq	%xmm8,%xmm4
+	punpcklqdq	%xmm8,%xmm4  // "c0"
 	movdqa	%xmm14,%xmm9
-	punpcklqdq	%xmm7,%xmm14
-	punpckhqdq	%xmm8,%xmm5
-	punpckhqdq	%xmm7,%xmm9
+	punpcklqdq	%xmm7,%xmm14  // "c2"
+	punpckhqdq	%xmm8,%xmm5  // "c1"
+	punpckhqdq	%xmm7,%xmm9  // "c3"
 	paddd	256-256(%rcx),%xmm0
 	paddd	272-256(%rcx),%xmm1
 	paddd	288-256(%rcx),%xmm2
@@ -778,19 +778,19 @@
 	punpckhdq	%xmm1,%xmm8
 	punpckhdq	%xmm3,%xmm7
 	movdqa	%xmm0,%xmm1
-	punpcklqdq	%xmm2,%xmm0
+	punpcklqdq	%xmm2,%xmm0  // "d0"
 	movdqa	%xmm8,%xmm3
-	punpcklqdq	%xmm7,%xmm8
-	punpckhqdq	%xmm2,%xmm1
-	punpckhqdq	%xmm7,%xmm3
+	punpcklqdq	%xmm7,%xmm8  // "d2"
+	punpckhqdq	%xmm2,%xmm1  // "d1"
+	punpckhqdq	%xmm7,%xmm3  // "d3"
 	cmpq	$256,%rdx
 	jb	.Ltail4x
 
-	movdqu	0(%rsi),%xmm6
+	movdqu	0(%rsi),%xmm6  // xor with input
 	movdqu	16(%rsi),%xmm11
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm7
-	pxor	0(%rsp),%xmm6
+	pxor	0(%rsp),%xmm6  // is offloaded, remember?
 	pxor	%xmm12,%xmm11
 	pxor	%xmm4,%xmm2
 	pxor	%xmm0,%xmm7
@@ -803,7 +803,7 @@
 	movdqu	96(%rsi),%xmm2
 	movdqu	%xmm7,48(%rdi)
 	movdqu	112(%rsi),%xmm7
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // size optimization
 	pxor	16(%rsp),%xmm6
 	pxor	%xmm13,%xmm11
 	pxor	%xmm5,%xmm2
@@ -816,7 +816,7 @@
 	movdqu	%xmm2,96(%rdi)
 	movdqu	32(%rsi),%xmm2
 	movdqu	%xmm7,112(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // size optimization
 	movdqu	48(%rsi),%xmm7
 	pxor	32(%rsp),%xmm6
 	pxor	%xmm10,%xmm11
@@ -831,7 +831,7 @@
 	movdqu	96(%rsi),%xmm2
 	movdqu	%xmm7,48(%rdi)
 	movdqu	112(%rsi),%xmm7
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // inp+=64*4
 	pxor	48(%rsp),%xmm6
 	pxor	%xmm15,%xmm11
 	pxor	%xmm9,%xmm2
@@ -840,7 +840,7 @@
 	movdqu	%xmm11,80(%rdi)
 	movdqu	%xmm2,96(%rdi)
 	movdqu	%xmm7,112(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // out+=64*4
 
 	subq	$256,%rdx
 	jnz	.Loop_outer4x
@@ -855,9 +855,9 @@
 	cmpq	$64,%rdx
 	jae	.L64_or_more4x
 
-
+// movdqa		0x00(%rsp),%xmm6		#  is offloaded, remember?
 	xorq	%r10,%r10
-
+// movdqa		%xmm6,0x00(%rsp)
 	movdqa	%xmm12,16(%rsp)
 	movdqa	%xmm4,32(%rsp)
 	movdqa	%xmm0,48(%rsp)
@@ -865,11 +865,11 @@
 
 .align	32
 .L64_or_more4x:
-	movdqu	0(%rsi),%xmm6
+	movdqu	0(%rsi),%xmm6  // xor with input
 	movdqu	16(%rsi),%xmm11
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm7
-	pxor	0(%rsp),%xmm6
+	pxor	0(%rsp),%xmm6  // is offloaded, remember?
 	pxor	%xmm12,%xmm11
 	pxor	%xmm4,%xmm2
 	pxor	%xmm0,%xmm7
@@ -879,24 +879,24 @@
 	movdqu	%xmm7,48(%rdi)
 	je	.Ldone4x
 
-	movdqa	16(%rsp),%xmm6
-	leaq	64(%rsi),%rsi
+	movdqa	16(%rsp),%xmm6  // is offloaded, remember?
+	leaq	64(%rsi),%rsi  // inp+=64*1
 	xorq	%r10,%r10
 	movdqa	%xmm6,0(%rsp)
 	movdqa	%xmm13,16(%rsp)
-	leaq	64(%rdi),%rdi
+	leaq	64(%rdi),%rdi  // out+=64*1
 	movdqa	%xmm5,32(%rsp)
-	subq	$64,%rdx
+	subq	$64,%rdx  // len-=64*1
 	movdqa	%xmm1,48(%rsp)
 	jmp	.Loop_tail4x
 
 .align	32
 .L128_or_more4x:
-	movdqu	0(%rsi),%xmm6
+	movdqu	0(%rsi),%xmm6  // xor with input
 	movdqu	16(%rsi),%xmm11
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm7
-	pxor	0(%rsp),%xmm6
+	pxor	0(%rsp),%xmm6  // is offloaded, remember?
 	pxor	%xmm12,%xmm11
 	pxor	%xmm4,%xmm2
 	pxor	%xmm0,%xmm7
@@ -919,24 +919,24 @@
 	movdqu	%xmm7,112(%rdi)
 	je	.Ldone4x
 
-	movdqa	32(%rsp),%xmm6
-	leaq	128(%rsi),%rsi
+	movdqa	32(%rsp),%xmm6  // is offloaded, remember?
+	leaq	128(%rsi),%rsi  // inp+=64*2
 	xorq	%r10,%r10
 	movdqa	%xmm6,0(%rsp)
 	movdqa	%xmm10,16(%rsp)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // out+=64*2
 	movdqa	%xmm14,32(%rsp)
-	subq	$128,%rdx
+	subq	$128,%rdx  // len-=64*2
 	movdqa	%xmm8,48(%rsp)
 	jmp	.Loop_tail4x
 
 .align	32
 .L192_or_more4x:
-	movdqu	0(%rsi),%xmm6
+	movdqu	0(%rsi),%xmm6  // xor with input
 	movdqu	16(%rsi),%xmm11
 	movdqu	32(%rsi),%xmm2
 	movdqu	48(%rsi),%xmm7
-	pxor	0(%rsp),%xmm6
+	pxor	0(%rsp),%xmm6  // is offloaded, remember?
 	pxor	%xmm12,%xmm11
 	pxor	%xmm4,%xmm2
 	pxor	%xmm0,%xmm7
@@ -949,7 +949,7 @@
 	movdqu	96(%rsi),%xmm2
 	movdqu	%xmm7,48(%rdi)
 	movdqu	112(%rsi),%xmm7
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // size optimization
 	pxor	16(%rsp),%xmm6
 	pxor	%xmm13,%xmm11
 	pxor	%xmm5,%xmm2
@@ -962,7 +962,7 @@
 	movdqu	%xmm2,96(%rdi)
 	movdqu	32(%rsi),%xmm2
 	movdqu	%xmm7,112(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // size optimization
 	movdqu	48(%rsi),%xmm7
 	pxor	32(%rsp),%xmm6
 	pxor	%xmm10,%xmm11
@@ -974,14 +974,14 @@
 	movdqu	%xmm7,48(%rdi)
 	je	.Ldone4x
 
-	movdqa	48(%rsp),%xmm6
-	leaq	64(%rsi),%rsi
+	movdqa	48(%rsp),%xmm6  // is offloaded, remember?
+	leaq	64(%rsi),%rsi  // inp+=64*3
 	xorq	%r10,%r10
 	movdqa	%xmm6,0(%rsp)
 	movdqa	%xmm15,16(%rsp)
-	leaq	64(%rdi),%rdi
+	leaq	64(%rdi),%rdi  // out+=64*3
 	movdqa	%xmm9,32(%rsp)
-	subq	$192,%rdx
+	subq	$192,%rdx  // len-=64*3
 	movdqa	%xmm3,48(%rsp)
 
 .Loop_tail4x:
@@ -1007,33 +1007,33 @@
 ChaCha20_ctr32_avx2:
 .cfi_startproc	
 _CET_ENDBR
-	movq	%rsp,%r9
+	movq	%rsp,%r9  // frame register
 .cfi_def_cfa_register	r9
 	subq	$0x280+8,%rsp
 	andq	$-32,%rsp
 	vzeroupper
 
-
-
-
-
-
-
-
-
-
-	vbroadcasti128	.Lsigma(%rip),%ymm11
-	vbroadcasti128	(%rcx),%ymm3
-	vbroadcasti128	16(%rcx),%ymm15
-	vbroadcasti128	(%r8),%ymm7
-	leaq	256(%rsp),%rcx
-	leaq	512(%rsp),%rax
+// ############### stack layout
+// +0x00		SIMD equivalent of %r12d
+// ...
+// +0x80		constant copy of key0-2 smashed by lanes
+// ...
+// +0x200	SIMD counters (with nonce smashed by lanes)
+// ...
+// +0x280
+
+	vbroadcasti128	.Lsigma(%rip),%ymm11  // key0
+	vbroadcasti128	(%rcx),%ymm3  // key1
+	vbroadcasti128	16(%rcx),%ymm15  // key2
+	vbroadcasti128	(%r8),%ymm7  // key3
+	leaq	256(%rsp),%rcx  // size optimization
+	leaq	512(%rsp),%rax  // size optimization
 	leaq	.Lrot16(%rip),%r10
 	leaq	.Lrot24(%rip),%r11
 
-	vpshufd	$0x00,%ymm11,%ymm8
+	vpshufd	$0x00,%ymm11,%ymm8  // smash key by lanes...
 	vpshufd	$0x55,%ymm11,%ymm9
-	vmovdqa	%ymm8,128-256(%rcx)
+	vmovdqa	%ymm8,128-256(%rcx)  // ... and offload
 	vpshufd	$0xaa,%ymm11,%ymm10
 	vmovdqa	%ymm9,160-256(%rcx)
 	vpshufd	$0xff,%ymm11,%ymm11
@@ -1049,18 +1049,18 @@
 	vmovdqa	%ymm2,320-256(%rcx)
 	vmovdqa	%ymm3,352-256(%rcx)
 
-	vpshufd	$0x00,%ymm15,%ymm12
-	vpshufd	$0x55,%ymm15,%ymm13
+	vpshufd	$0x00,%ymm15,%ymm12  // "xc0"
+	vpshufd	$0x55,%ymm15,%ymm13  // "xc1"
 	vmovdqa	%ymm12,384-512(%rax)
-	vpshufd	$0xaa,%ymm15,%ymm14
+	vpshufd	$0xaa,%ymm15,%ymm14  // "xc2"
 	vmovdqa	%ymm13,416-512(%rax)
-	vpshufd	$0xff,%ymm15,%ymm15
+	vpshufd	$0xff,%ymm15,%ymm15  // "xc3"
 	vmovdqa	%ymm14,448-512(%rax)
 	vmovdqa	%ymm15,480-512(%rax)
 
 	vpshufd	$0x00,%ymm7,%ymm4
 	vpshufd	$0x55,%ymm7,%ymm5
-	vpaddd	.Lincy(%rip),%ymm4,%ymm4
+	vpaddd	.Lincy(%rip),%ymm4,%ymm4  // don't save counters yet
 	vpshufd	$0xaa,%ymm7,%ymm6
 	vmovdqa	%ymm5,544-512(%rax)
 	vpshufd	$0xff,%ymm7,%ymm7
@@ -1071,7 +1071,7 @@
 
 .align	32
 .Loop_outer8x:
-	vmovdqa	128-256(%rcx),%ymm8
+	vmovdqa	128-256(%rcx),%ymm8  // re-load smashed key
 	vmovdqa	160-256(%rcx),%ymm9
 	vmovdqa	192-256(%rcx),%ymm10
 	vmovdqa	224-256(%rcx),%ymm11
@@ -1079,21 +1079,21 @@
 	vmovdqa	288-256(%rcx),%ymm1
 	vmovdqa	320-256(%rcx),%ymm2
 	vmovdqa	352-256(%rcx),%ymm3
-	vmovdqa	384-512(%rax),%ymm12
-	vmovdqa	416-512(%rax),%ymm13
-	vmovdqa	448-512(%rax),%ymm14
-	vmovdqa	480-512(%rax),%ymm15
+	vmovdqa	384-512(%rax),%ymm12  // "xc0"
+	vmovdqa	416-512(%rax),%ymm13  // "xc1"
+	vmovdqa	448-512(%rax),%ymm14  // "xc2"
+	vmovdqa	480-512(%rax),%ymm15  // "xc3"
 	vmovdqa	512-512(%rax),%ymm4
 	vmovdqa	544-512(%rax),%ymm5
 	vmovdqa	576-512(%rax),%ymm6
 	vmovdqa	608-512(%rax),%ymm7
-	vpaddd	.Leight(%rip),%ymm4,%ymm4
+	vpaddd	.Leight(%rip),%ymm4,%ymm4  // next SIMD counters
 
 .Loop_enter8x:
-	vmovdqa	%ymm14,64(%rsp)
-	vmovdqa	%ymm15,96(%rsp)
+	vmovdqa	%ymm14,64(%rsp)  // SIMD equivalent of "%nox"
+	vmovdqa	%ymm15,96(%rsp)  // SIMD equivalent of "%nox"
 	vbroadcasti128	(%r10),%ymm15
-	vmovdqa	%ymm4,512-512(%rax)
+	vmovdqa	%ymm4,512-512(%rax)  // save SIMD counters
 	movl	$10,%eax
 	jmp	.Loop8x
 
@@ -1246,20 +1246,20 @@
 	decl	%eax
 	jnz	.Loop8x
 
-	leaq	512(%rsp),%rax
-	vpaddd	128-256(%rcx),%ymm8,%ymm8
+	leaq	512(%rsp),%rax  // size optimization
+	vpaddd	128-256(%rcx),%ymm8,%ymm8  // accumulate key
 	vpaddd	160-256(%rcx),%ymm9,%ymm9
 	vpaddd	192-256(%rcx),%ymm10,%ymm10
 	vpaddd	224-256(%rcx),%ymm11,%ymm11
 
-	vpunpckldq	%ymm9,%ymm8,%ymm14
+	vpunpckldq	%ymm9,%ymm8,%ymm14  // "de-interlace" data
 	vpunpckldq	%ymm11,%ymm10,%ymm15
 	vpunpckhdq	%ymm9,%ymm8,%ymm8
 	vpunpckhdq	%ymm11,%ymm10,%ymm10
-	vpunpcklqdq	%ymm15,%ymm14,%ymm9
-	vpunpckhqdq	%ymm15,%ymm14,%ymm14
-	vpunpcklqdq	%ymm10,%ymm8,%ymm11
-	vpunpckhqdq	%ymm10,%ymm8,%ymm8
+	vpunpcklqdq	%ymm15,%ymm14,%ymm9  // "a0"
+	vpunpckhqdq	%ymm15,%ymm14,%ymm14  // "a1"
+	vpunpcklqdq	%ymm10,%ymm8,%ymm11  // "a2"
+	vpunpckhqdq	%ymm10,%ymm8,%ymm8  // "a3"
 	vpaddd	256-256(%rcx),%ymm0,%ymm0
 	vpaddd	288-256(%rcx),%ymm1,%ymm1
 	vpaddd	320-256(%rcx),%ymm2,%ymm2
@@ -1269,11 +1269,11 @@
 	vpunpckldq	%ymm3,%ymm2,%ymm15
 	vpunpckhdq	%ymm1,%ymm0,%ymm0
 	vpunpckhdq	%ymm3,%ymm2,%ymm2
-	vpunpcklqdq	%ymm15,%ymm10,%ymm1
-	vpunpckhqdq	%ymm15,%ymm10,%ymm10
-	vpunpcklqdq	%ymm2,%ymm0,%ymm3
-	vpunpckhqdq	%ymm2,%ymm0,%ymm0
-	vperm2i128	$0x20,%ymm1,%ymm9,%ymm15
+	vpunpcklqdq	%ymm15,%ymm10,%ymm1  // "b0"
+	vpunpckhqdq	%ymm15,%ymm10,%ymm10  // "b1"
+	vpunpcklqdq	%ymm2,%ymm0,%ymm3  // "b2"
+	vpunpckhqdq	%ymm2,%ymm0,%ymm0  // "b3"
+	vperm2i128	$0x20,%ymm1,%ymm9,%ymm15  // "de-interlace" further
 	vperm2i128	$0x31,%ymm1,%ymm9,%ymm1
 	vperm2i128	$0x20,%ymm10,%ymm14,%ymm9
 	vperm2i128	$0x31,%ymm10,%ymm14,%ymm10
@@ -1281,10 +1281,10 @@
 	vperm2i128	$0x31,%ymm3,%ymm11,%ymm3
 	vperm2i128	$0x20,%ymm0,%ymm8,%ymm11
 	vperm2i128	$0x31,%ymm0,%ymm8,%ymm0
-	vmovdqa	%ymm15,0(%rsp)
+	vmovdqa	%ymm15,0(%rsp)  // offload
 	vmovdqa	%ymm9,32(%rsp)
-	vmovdqa	64(%rsp),%ymm15
-	vmovdqa	96(%rsp),%ymm9
+	vmovdqa	64(%rsp),%ymm15  // %ymm15
+	vmovdqa	96(%rsp),%ymm9  // %ymm9
 
 	vpaddd	384-512(%rax),%ymm12,%ymm12
 	vpaddd	416-512(%rax),%ymm13,%ymm13
@@ -1295,10 +1295,10 @@
 	vpunpckldq	%ymm9,%ymm15,%ymm8
 	vpunpckhdq	%ymm13,%ymm12,%ymm12
 	vpunpckhdq	%ymm9,%ymm15,%ymm15
-	vpunpcklqdq	%ymm8,%ymm2,%ymm13
-	vpunpckhqdq	%ymm8,%ymm2,%ymm2
-	vpunpcklqdq	%ymm15,%ymm12,%ymm9
-	vpunpckhqdq	%ymm15,%ymm12,%ymm12
+	vpunpcklqdq	%ymm8,%ymm2,%ymm13  // "c0"
+	vpunpckhqdq	%ymm8,%ymm2,%ymm2  // "c1"
+	vpunpcklqdq	%ymm15,%ymm12,%ymm9  // "c2"
+	vpunpckhqdq	%ymm15,%ymm12,%ymm12  // "c3"
 	vpaddd	512-512(%rax),%ymm4,%ymm4
 	vpaddd	544-512(%rax),%ymm5,%ymm5
 	vpaddd	576-512(%rax),%ymm6,%ymm6
@@ -1308,11 +1308,11 @@
 	vpunpckldq	%ymm7,%ymm6,%ymm8
 	vpunpckhdq	%ymm5,%ymm4,%ymm4
 	vpunpckhdq	%ymm7,%ymm6,%ymm6
-	vpunpcklqdq	%ymm8,%ymm15,%ymm5
-	vpunpckhqdq	%ymm8,%ymm15,%ymm15
-	vpunpcklqdq	%ymm6,%ymm4,%ymm7
-	vpunpckhqdq	%ymm6,%ymm4,%ymm4
-	vperm2i128	$0x20,%ymm5,%ymm13,%ymm8
+	vpunpcklqdq	%ymm8,%ymm15,%ymm5  // "d0"
+	vpunpckhqdq	%ymm8,%ymm15,%ymm15  // "d1"
+	vpunpcklqdq	%ymm6,%ymm4,%ymm7  // "d2"
+	vpunpckhqdq	%ymm6,%ymm4,%ymm4  // "d3"
+	vperm2i128	$0x20,%ymm5,%ymm13,%ymm8  // "de-interlace" further
 	vperm2i128	$0x31,%ymm5,%ymm13,%ymm5
 	vperm2i128	$0x20,%ymm15,%ymm2,%ymm13
 	vperm2i128	$0x31,%ymm15,%ymm2,%ymm15
@@ -1320,55 +1320,55 @@
 	vperm2i128	$0x31,%ymm7,%ymm9,%ymm7
 	vperm2i128	$0x20,%ymm4,%ymm12,%ymm9
 	vperm2i128	$0x31,%ymm4,%ymm12,%ymm4
-	vmovdqa	0(%rsp),%ymm6
+	vmovdqa	0(%rsp),%ymm6  // was offloaded, remember?
 	vmovdqa	32(%rsp),%ymm12
 
 	cmpq	$512,%rdx
 	jb	.Ltail8x
 
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // size optimization
 	vmovdqu	%ymm6,0(%rdi)
 	vmovdqu	%ymm8,32(%rdi)
 	vmovdqu	%ymm1,64(%rdi)
 	vmovdqu	%ymm5,96(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // size optimization
 
 	vpxor	0(%rsi),%ymm12,%ymm12
 	vpxor	32(%rsi),%ymm13,%ymm13
 	vpxor	64(%rsi),%ymm10,%ymm10
 	vpxor	96(%rsi),%ymm15,%ymm15
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // size optimization
 	vmovdqu	%ymm12,0(%rdi)
 	vmovdqu	%ymm13,32(%rdi)
 	vmovdqu	%ymm10,64(%rdi)
 	vmovdqu	%ymm15,96(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // size optimization
 
 	vpxor	0(%rsi),%ymm14,%ymm14
 	vpxor	32(%rsi),%ymm2,%ymm2
 	vpxor	64(%rsi),%ymm3,%ymm3
 	vpxor	96(%rsi),%ymm7,%ymm7
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // size optimization
 	vmovdqu	%ymm14,0(%rdi)
 	vmovdqu	%ymm2,32(%rdi)
 	vmovdqu	%ymm3,64(%rdi)
 	vmovdqu	%ymm7,96(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // size optimization
 
 	vpxor	0(%rsi),%ymm11,%ymm11
 	vpxor	32(%rsi),%ymm9,%ymm9
 	vpxor	64(%rsi),%ymm0,%ymm0
 	vpxor	96(%rsi),%ymm4,%ymm4
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // size optimization
 	vmovdqu	%ymm11,0(%rdi)
 	vmovdqu	%ymm9,32(%rdi)
 	vmovdqu	%ymm0,64(%rdi)
 	vmovdqu	%ymm4,96(%rdi)
-	leaq	128(%rdi),%rdi
+	leaq	128(%rdi),%rdi  // size optimization
 
 	subq	$512,%rdx
 	jnz	.Loop_outer8x
@@ -1398,23 +1398,23 @@
 
 .align	32
 .L64_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vmovdqu	%ymm6,0(%rdi)
 	vmovdqu	%ymm8,32(%rdi)
 	je	.Ldone8x
 
-	leaq	64(%rsi),%rsi
+	leaq	64(%rsi),%rsi  // inp+=64*1
 	xorq	%r10,%r10
 	vmovdqa	%ymm1,0(%rsp)
-	leaq	64(%rdi),%rdi
-	subq	$64,%rdx
+	leaq	64(%rdi),%rdi  // out+=64*1
+	subq	$64,%rdx  // len-=64*1
 	vmovdqa	%ymm5,32(%rsp)
 	jmp	.Loop_tail8x
 
 .align	32
 .L128_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
@@ -1424,17 +1424,17 @@
 	vmovdqu	%ymm5,96(%rdi)
 	je	.Ldone8x
 
-	leaq	128(%rsi),%rsi
+	leaq	128(%rsi),%rsi  // inp+=64*2
 	xorq	%r10,%r10
 	vmovdqa	%ymm12,0(%rsp)
-	leaq	128(%rdi),%rdi
-	subq	$128,%rdx
+	leaq	128(%rdi),%rdi  // out+=64*2
+	subq	$128,%rdx  // len-=64*2
 	vmovdqa	%ymm13,32(%rsp)
 	jmp	.Loop_tail8x
 
 .align	32
 .L192_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
@@ -1448,17 +1448,17 @@
 	vmovdqu	%ymm13,160(%rdi)
 	je	.Ldone8x
 
-	leaq	192(%rsi),%rsi
+	leaq	192(%rsi),%rsi  // inp+=64*3
 	xorq	%r10,%r10
 	vmovdqa	%ymm10,0(%rsp)
-	leaq	192(%rdi),%rdi
-	subq	$192,%rdx
+	leaq	192(%rdi),%rdi  // out+=64*3
+	subq	$192,%rdx  // len-=64*3
 	vmovdqa	%ymm15,32(%rsp)
 	jmp	.Loop_tail8x
 
 .align	32
 .L256_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
@@ -1476,17 +1476,17 @@
 	vmovdqu	%ymm15,224(%rdi)
 	je	.Ldone8x
 
-	leaq	256(%rsi),%rsi
+	leaq	256(%rsi),%rsi  // inp+=64*4
 	xorq	%r10,%r10
 	vmovdqa	%ymm14,0(%rsp)
-	leaq	256(%rdi),%rdi
-	subq	$256,%rdx
+	leaq	256(%rdi),%rdi  // out+=64*4
+	subq	$256,%rdx  // len-=64*4
 	vmovdqa	%ymm2,32(%rsp)
 	jmp	.Loop_tail8x
 
 .align	32
 .L320_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
@@ -1508,17 +1508,17 @@
 	vmovdqu	%ymm2,288(%rdi)
 	je	.Ldone8x
 
-	leaq	320(%rsi),%rsi
+	leaq	320(%rsi),%rsi  // inp+=64*5
 	xorq	%r10,%r10
 	vmovdqa	%ymm3,0(%rsp)
-	leaq	320(%rdi),%rdi
-	subq	$320,%rdx
+	leaq	320(%rdi),%rdi  // out+=64*5
+	subq	$320,%rdx  // len-=64*5
 	vmovdqa	%ymm7,32(%rsp)
 	jmp	.Loop_tail8x
 
 .align	32
 .L384_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
@@ -1544,17 +1544,17 @@
 	vmovdqu	%ymm7,352(%rdi)
 	je	.Ldone8x
 
-	leaq	384(%rsi),%rsi
+	leaq	384(%rsi),%rsi  // inp+=64*6
 	xorq	%r10,%r10
 	vmovdqa	%ymm11,0(%rsp)
-	leaq	384(%rdi),%rdi
-	subq	$384,%rdx
+	leaq	384(%rdi),%rdi  // out+=64*6
+	subq	$384,%rdx  // len-=64*6
 	vmovdqa	%ymm9,32(%rsp)
 	jmp	.Loop_tail8x
 
 .align	32
 .L448_or_more8x:
-	vpxor	0(%rsi),%ymm6,%ymm6
+	vpxor	0(%rsi),%ymm6,%ymm6  // xor with input
 	vpxor	32(%rsi),%ymm8,%ymm8
 	vpxor	64(%rsi),%ymm1,%ymm1
 	vpxor	96(%rsi),%ymm5,%ymm5
@@ -1584,11 +1584,11 @@
 	vmovdqu	%ymm9,416(%rdi)
 	je	.Ldone8x
 
-	leaq	448(%rsi),%rsi
+	leaq	448(%rsi),%rsi  // inp+=64*7
 	xorq	%r10,%r10
 	vmovdqa	%ymm0,0(%rsp)
-	leaq	448(%rdi),%rdi
-	subq	$448,%rdx
+	leaq	448(%rdi),%rdi  // out+=64*7
+	subq	$448,%rdx  // len-=64*7
 	vmovdqa	%ymm4,32(%rsp)
 
 .Loop_tail8x:

boringssl-0.20260708.tar.xz/gen/crypto/chacha-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/crypto/chacha-x86_64-win.asm Changed

@@ -50,7 +50,7 @@
 	DB	95,54,52,44,32,67,82,89,80,84,79,71,65,77,83,32
 	DB	98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115
 	DB	108,46,111,114,103,62,0
-section	.text
+section	.text code align=64
 
 global	ChaCha20_ctr32_nohw
 
@@ -85,25 +85,25 @@
 
 $L$ctr32_body:
 
-
+; movdqa	.Lsigma(%rip),%xmm0
 	movdqu	xmm1,XMMWORDrcx
 	movdqu	xmm2,XMMWORD16+rcx
 	movdqu	xmm3,XMMWORDr8
 	movdqa	xmm4,XMMWORD$L$one
 
-
-	movdqa	XMMWORD16+rsp,xmm1
-	movdqa	XMMWORD32+rsp,xmm2
-	movdqa	XMMWORD48+rsp,xmm3
-	mov	rbp,rdx
+; movdqa	%xmm0,4*0(%rsp)		# key0
+	movdqa	XMMWORD16+rsp,xmm1  ; key1
+	movdqa	XMMWORD32+rsp,xmm2  ; key2
+	movdqa	XMMWORD48+rsp,xmm3  ; key3
+	mov	rbp,rdx  ; reassign %rdx
 	jmp	NEAR $L$oop_outer
 
 ALIGN	32
 $L$oop_outer:
-	mov	eax,0x61707865
-	mov	ebx,0x3320646e
-	mov	ecx,0x79622d32
-	mov	edx,0x6b206574
+	mov	eax,0x61707865  ; 'expa'
+	mov	ebx,0x3320646e  ; 'nd 3'
+	mov	ecx,0x79622d32  ; '2-by'
+	mov	edx,0x6b206574  ; 'te k'
 	mov	r8d,DWORD16+rsp
 	mov	r9d,DWORD20+rsp
 	mov	r10d,DWORD24+rsp
@@ -113,13 +113,13 @@
 	mov	r14d,DWORD56+rsp
 	mov	r15d,DWORD60+rsp
 
-	mov	QWORD((64+0))+rsp,rbp
+	mov	QWORD((64+0))+rsp,rbp  ; save len
 	mov	ebp,10
-	mov	QWORD((64+8))+rsp,rsi
-	movq	rsi,xmm2
-	mov	QWORD((64+16))+rsp,rdi
+	mov	QWORD((64+8))+rsp,rsi  ; save inp
+	movq	rsi,xmm2  ; "%nox"
+	mov	QWORD((64+16))+rsp,rdi  ; save out
 	mov	rdi,rsi
-	shr	rdi,32
+	shr	rdi,32  ; "%nox"
 	jmp	NEAR $L$oop
 
 ALIGN	32
@@ -230,18 +230,18 @@
 	rol	r8d,7
 	dec	ebp
 	jnz	NEAR $L$oop
-	mov	DWORD36+rsp,edi
+	mov	DWORD36+rsp,edi  ; modulo-scheduled
 	mov	DWORD32+rsp,esi
-	mov	rbp,QWORD64+rsp
+	mov	rbp,QWORD64+rsp  ; load len
 	movdqa	xmm1,xmm2
-	mov	rsi,QWORD((64+8))+rsp
-	paddd	xmm3,xmm4
-	mov	rdi,QWORD((64+16))+rsp
-
-	add	eax,0x61707865
-	add	ebx,0x3320646e
-	add	ecx,0x79622d32
-	add	edx,0x6b206574
+	mov	rsi,QWORD((64+8))+rsp  ; load inp
+	paddd	xmm3,xmm4  ; increment counter
+	mov	rdi,QWORD((64+16))+rsp  ; load out
+
+	add	eax,0x61707865  ; 'expa'
+	add	ebx,0x3320646e  ; 'nd 3'
+	add	ecx,0x79622d32  ; '2-by'
+	add	edx,0x6b206574  ; 'te k'
 	add	r8d,DWORD16+rsp
 	add	r9d,DWORD20+rsp
 	add	r10d,DWORD24+rsp
@@ -255,7 +255,7 @@
 	cmp	rbp,64
 	jb	NEAR $L$tail
 
-	xor	eax,DWORDrsi
+	xor	eax,DWORDrsi  ; xor with input
 	xor	ebx,DWORD4+rsi
 	xor	ecx,DWORD8+rsi
 	xor	edx,DWORD12+rsi
@@ -268,13 +268,13 @@
 	xor	r13d,DWORD52+rsi
 	xor	r14d,DWORD56+rsi
 	xor	r15d,DWORD60+rsi
-	lea	rsi,64+rsi
+	lea	rsi,64+rsi  ; inp+=64
 	pxor	xmm0,xmm1
 
 	movdqa	XMMWORD32+rsp,xmm2
 	movd	DWORD48+rsp,xmm3
 
-	mov	DWORDrdi,eax
+	mov	DWORDrdi,eax  ; write output
 	mov	DWORD4+rdi,ebx
 	mov	DWORD8+rdi,ecx
 	mov	DWORD12+rdi,edx
@@ -287,7 +287,7 @@
 	mov	DWORD52+rdi,r13d
 	mov	DWORD56+rdi,r14d
 	mov	DWORD60+rdi,r15d
-	lea	rdi,64+rdi
+	lea	rdi,64+rdi  ; out+=64
 
 	sub	rbp,64
 	jnz	NEAR $L$oop_outer
@@ -359,7 +359,7 @@
 
 
 _CET_ENDBR
-	mov	r9,rsp
+	mov	r9,rsp  ; frame pointer
 
 	sub	rsp,64+40
 	movaps	XMMWORD(-40)+r9,xmm6
@@ -376,7 +376,7 @@
 	movdqa	XMMWORD16+rsp,xmm1
 	movdqa	XMMWORD32+rsp,xmm2
 	movdqa	XMMWORD48+rsp,xmm3
-	mov	r8,10
+	mov	r8,10  ; reuse %r8
 	jmp	NEAR $L$oop_ssse3
 
 ALIGN	32
@@ -447,19 +447,19 @@
 
 	movdqu	xmm4,XMMWORDrsi
 	movdqu	xmm5,XMMWORD16+rsi
-	pxor	xmm0,xmm4
+	pxor	xmm0,xmm4  ; xor with input
 	movdqu	xmm4,XMMWORD32+rsi
 	pxor	xmm1,xmm5
 	movdqu	xmm5,XMMWORD48+rsi
-	lea	rsi,64+rsi
+	lea	rsi,64+rsi  ; inp+=64
 	pxor	xmm2,xmm4
 	pxor	xmm3,xmm5
 
-	movdqu	XMMWORDrdi,xmm0
+	movdqu	XMMWORDrdi,xmm0  ; write output
 	movdqu	XMMWORD16+rdi,xmm1
 	movdqu	XMMWORD32+rdi,xmm2
 	movdqu	XMMWORD48+rdi,xmm3
-	lea	rdi,64+rdi
+	lea	rdi,64+rdi  ; out+=64
 
 	sub	rdx,64
 	jnz	NEAR $L$oop_outer_ssse3
@@ -511,7 +511,7 @@
 
 
 _CET_ENDBR
-	mov	r9,rsp
+	mov	r9,rsp  ; frame pointer
 
 	sub	rsp,0x140+168
 	movaps	XMMWORD(-168)+r9,xmm6
@@ -525,17 +525,17 @@
 	movaps	XMMWORD(-40)+r9,xmm14
 	movaps	XMMWORD(-24)+r9,xmm15
 $L$4x_body:
-	movdqa	xmm11,XMMWORD$L$sigma
-	movdqu	xmm15,XMMWORDrcx
-	movdqu	xmm7,XMMWORD16+rcx
-	movdqu	xmm3,XMMWORDr8
-	lea	rcx,256+rsp
+	movdqa	xmm11,XMMWORD$L$sigma  ; key0
+	movdqu	xmm15,XMMWORDrcx  ; key1
+	movdqu	xmm7,XMMWORD16+rcx  ; key2
+	movdqu	xmm3,XMMWORDr8  ; key3
+	lea	rcx,256+rsp  ; size optimization
 	lea	r10,$L$rot16
 	lea	r11,$L$rot24
 
-	pshufd	xmm8,xmm11,0x00
+	pshufd	xmm8,xmm11,0x00  ; smash key by lanes...
 	pshufd	xmm9,xmm11,0x55
-	movdqa	XMMWORD64+rsp,xmm8
+	movdqa	XMMWORD64+rsp,xmm8  ; ... and offload
 	pshufd	xmm10,xmm11,0xaa
 	movdqa	XMMWORD80+rsp,xmm9
 	pshufd	xmm11,xmm11,0xff
@@ -551,18 +551,18 @@
 	movdqa	XMMWORD(160-256)+rcx,xmm14
 	movdqa	XMMWORD(176-256)+rcx,xmm15
 
-	pshufd	xmm4,xmm7,0x00
-	pshufd	xmm5,xmm7,0x55
+	pshufd	xmm4,xmm7,0x00  ; ""
+	pshufd	xmm5,xmm7,0x55  ; ""
 	movdqa	XMMWORD(192-256)+rcx,xmm4
-	pshufd	xmm6,xmm7,0xaa
+	pshufd	xmm6,xmm7,0xaa  ; ""
 	movdqa	XMMWORD(208-256)+rcx,xmm5
-	pshufd	xmm7,xmm7,0xff
+	pshufd	xmm7,xmm7,0xff  ; ""
 	movdqa	XMMWORD(224-256)+rcx,xmm6
 	movdqa	XMMWORD(240-256)+rcx,xmm7
 
 	pshufd	xmm0,xmm3,0x00
 	pshufd	xmm1,xmm3,0x55
-	paddd	xmm0,XMMWORD$L$inc
+	paddd	xmm0,XMMWORD$L$inc  ; don't save counters yet
 	pshufd	xmm2,xmm3,0xaa
 	movdqa	XMMWORD(272-256)+rcx,xmm1
 	pshufd	xmm3,xmm3,0xff
@@ -573,7 +573,7 @@
 
 ALIGN	32
 $L$oop_outer4x:
-	movdqa	xmm8,XMMWORD64+rsp
+	movdqa	xmm8,XMMWORD64+rsp  ; re-load smashed key
 	movdqa	xmm9,XMMWORD80+rsp
 	movdqa	xmm10,XMMWORD96+rsp
 	movdqa	xmm11,XMMWORD112+rsp
@@ -581,22 +581,22 @@
 	movdqa	xmm13,XMMWORD((144-256))+rcx
 	movdqa	xmm14,XMMWORD((160-256))+rcx
 	movdqa	xmm15,XMMWORD((176-256))+rcx
-	movdqa	xmm4,XMMWORD((192-256))+rcx
-	movdqa	xmm5,XMMWORD((208-256))+rcx
-	movdqa	xmm6,XMMWORD((224-256))+rcx
-	movdqa	xmm7,XMMWORD((240-256))+rcx
+	movdqa	xmm4,XMMWORD((192-256))+rcx  ; ""
+	movdqa	xmm5,XMMWORD((208-256))+rcx  ; ""
+	movdqa	xmm6,XMMWORD((224-256))+rcx  ; ""
+	movdqa	xmm7,XMMWORD((240-256))+rcx  ; ""
 	movdqa	xmm0,XMMWORD((256-256))+rcx
 	movdqa	xmm1,XMMWORD((272-256))+rcx
 	movdqa	xmm2,XMMWORD((288-256))+rcx
 	movdqa	xmm3,XMMWORD((304-256))+rcx
-	paddd	xmm0,XMMWORD$L$four
+	paddd	xmm0,XMMWORD$L$four  ; next SIMD counters
 
 $L$oop_enter4x:
-	movdqa	XMMWORD32+rsp,xmm6
-	movdqa	XMMWORD48+rsp,xmm7
-	movdqa	xmm7,XMMWORDr10
+	movdqa	XMMWORD32+rsp,xmm6  ; SIMD equivalent of "%nox"
+	movdqa	XMMWORD48+rsp,xmm7  ; SIMD equivalent of "%nox"
+	movdqa	xmm7,XMMWORDr10  ; .Lrot16(%rip)
 	mov	eax,10
-	movdqa	XMMWORD(256-256)+rcx,xmm0
+	movdqa	XMMWORD(256-256)+rcx,xmm0  ; save SIMD counters
 	jmp	NEAR $L$oop4x
 
 ALIGN	32
@@ -764,32 +764,32 @@
 	dec	eax
 	jnz	NEAR $L$oop4x
 
-	paddd	xmm8,XMMWORD64+rsp
+	paddd	xmm8,XMMWORD64+rsp  ; accumulate key material
 	paddd	xmm9,XMMWORD80+rsp
 	paddd	xmm10,XMMWORD96+rsp
 	paddd	xmm11,XMMWORD112+rsp
 
-	movdqa	xmm6,xmm8
+	movdqa	xmm6,xmm8  ; "de-interlace" data
 	punpckldq	xmm8,xmm9
 	movdqa	xmm7,xmm10
 	punpckldq	xmm10,xmm11
 	punpckhdq	xmm6,xmm9
 	punpckhdq	xmm7,xmm11
 	movdqa	xmm9,xmm8
-	punpcklqdq	xmm8,xmm10
+	punpcklqdq	xmm8,xmm10  ; "a0"
 	movdqa	xmm11,xmm6
-	punpcklqdq	xmm6,xmm7
-	punpckhqdq	xmm9,xmm10
-	punpckhqdq	xmm11,xmm7
+	punpcklqdq	xmm6,xmm7  ; "a2"
+	punpckhqdq	xmm9,xmm10  ; "a1"
+	punpckhqdq	xmm11,xmm7  ; "a3"
 	paddd	xmm12,XMMWORD((128-256))+rcx
 	paddd	xmm13,XMMWORD((144-256))+rcx
 	paddd	xmm14,XMMWORD((160-256))+rcx
 	paddd	xmm15,XMMWORD((176-256))+rcx
 
-	movdqa	XMMWORDrsp,xmm8
+	movdqa	XMMWORDrsp,xmm8  ; offload
 	movdqa	XMMWORD16+rsp,xmm9
-	movdqa	xmm8,XMMWORD32+rsp
-	movdqa	xmm9,XMMWORD48+rsp
+	movdqa	xmm8,XMMWORD32+rsp  ; "xc2"
+	movdqa	xmm9,XMMWORD48+rsp  ; "xc3"
 
 	movdqa	xmm10,xmm12
 	punpckldq	xmm12,xmm13
@@ -798,17 +798,17 @@
 	punpckhdq	xmm10,xmm13
 	punpckhdq	xmm7,xmm15
 	movdqa	xmm13,xmm12
-	punpcklqdq	xmm12,xmm14
+	punpcklqdq	xmm12,xmm14  ; "b0"
 	movdqa	xmm15,xmm10
-	punpcklqdq	xmm10,xmm7
-	punpckhqdq	xmm13,xmm14
-	punpckhqdq	xmm15,xmm7
+	punpcklqdq	xmm10,xmm7  ; "b2"
+	punpckhqdq	xmm13,xmm14  ; "b1"
+	punpckhqdq	xmm15,xmm7  ; "b3"
 	paddd	xmm4,XMMWORD((192-256))+rcx
 	paddd	xmm5,XMMWORD((208-256))+rcx
 	paddd	xmm8,XMMWORD((224-256))+rcx
 	paddd	xmm9,XMMWORD((240-256))+rcx
 
-	movdqa	XMMWORD32+rsp,xmm6
+	movdqa	XMMWORD32+rsp,xmm6  ; keep offloading
 	movdqa	XMMWORD48+rsp,xmm11
 
 	movdqa	xmm14,xmm4
@@ -818,11 +818,11 @@
 	punpckhdq	xmm14,xmm5
 	punpckhdq	xmm7,xmm9
 	movdqa	xmm5,xmm4
-	punpcklqdq	xmm4,xmm8
+	punpcklqdq	xmm4,xmm8  ; "c0"
 	movdqa	xmm9,xmm14
-	punpcklqdq	xmm14,xmm7
-	punpckhqdq	xmm5,xmm8
-	punpckhqdq	xmm9,xmm7
+	punpcklqdq	xmm14,xmm7  ; "c2"
+	punpckhqdq	xmm5,xmm8  ; "c1"
+	punpckhqdq	xmm9,xmm7  ; "c3"
 	paddd	xmm0,XMMWORD((256-256))+rcx
 	paddd	xmm1,XMMWORD((272-256))+rcx
 	paddd	xmm2,XMMWORD((288-256))+rcx
@@ -835,19 +835,19 @@
 	punpckhdq	xmm8,xmm1
 	punpckhdq	xmm7,xmm3
 	movdqa	xmm1,xmm0
-	punpcklqdq	xmm0,xmm2
+	punpcklqdq	xmm0,xmm2  ; "d0"
 	movdqa	xmm3,xmm8
-	punpcklqdq	xmm8,xmm7
-	punpckhqdq	xmm1,xmm2
-	punpckhqdq	xmm3,xmm7
+	punpcklqdq	xmm8,xmm7  ; "d2"
+	punpckhqdq	xmm1,xmm2  ; "d1"
+	punpckhqdq	xmm3,xmm7  ; "d3"
 	cmp	rdx,64*4
 	jb	NEAR $L$tail4x
 
-	movdqu	xmm6,XMMWORDrsi
+	movdqu	xmm6,XMMWORDrsi  ; xor with input
 	movdqu	xmm11,XMMWORD16+rsi
 	movdqu	xmm2,XMMWORD32+rsi
 	movdqu	xmm7,XMMWORD48+rsi
-	pxor	xmm6,XMMWORDrsp
+	pxor	xmm6,XMMWORDrsp  ; is offloaded, remember?
 	pxor	xmm11,xmm12
 	pxor	xmm2,xmm4
 	pxor	xmm7,xmm0
@@ -860,7 +860,7 @@
 	movdqu	xmm2,XMMWORD96+rsi
 	movdqu	XMMWORD48+rdi,xmm7
 	movdqu	xmm7,XMMWORD112+rsi
-	lea	rsi,128+rsi
+	lea	rsi,128+rsi  ; size optimization
 	pxor	xmm6,XMMWORD16+rsp
 	pxor	xmm11,xmm13
 	pxor	xmm2,xmm5
@@ -873,7 +873,7 @@
 	movdqu	XMMWORD96+rdi,xmm2
 	movdqu	xmm2,XMMWORD32+rsi
 	movdqu	XMMWORD112+rdi,xmm7
-	lea	rdi,128+rdi
+	lea	rdi,128+rdi  ; size optimization
 	movdqu	xmm7,XMMWORD48+rsi
 	pxor	xmm6,XMMWORD32+rsp
 	pxor	xmm11,xmm10
@@ -888,7 +888,7 @@
 	movdqu	xmm2,XMMWORD96+rsi
 	movdqu	XMMWORD48+rdi,xmm7
 	movdqu	xmm7,XMMWORD112+rsi
-	lea	rsi,128+rsi
+	lea	rsi,128+rsi  ; inp+=64*4
 	pxor	xmm6,XMMWORD48+rsp
 	pxor	xmm11,xmm15
 	pxor	xmm2,xmm9
@@ -897,7 +897,7 @@
 	movdqu	XMMWORD80+rdi,xmm11
 	movdqu	XMMWORD96+rdi,xmm2
 	movdqu	XMMWORD112+rdi,xmm7
-	lea	rdi,128+rdi
+	lea	rdi,128+rdi  ; out+=64*4
 
 	sub	rdx,64*4
 	jnz	NEAR $L$oop_outer4x
@@ -912,9 +912,9 @@
 	cmp	rdx,64
 	jae	NEAR $L$64_or_more4x
 
-
+; movdqa		0x00(%rsp),%xmm6		#  is offloaded, remember?
 	xor	r10,r10
-
+; movdqa		%xmm6,0x00(%rsp)
 	movdqa	XMMWORD16+rsp,xmm12
 	movdqa	XMMWORD32+rsp,xmm4
 	movdqa	XMMWORD48+rsp,xmm0
@@ -922,11 +922,11 @@
 
 ALIGN	32
 $L$64_or_more4x:
-	movdqu	xmm6,XMMWORDrsi
+	movdqu	xmm6,XMMWORDrsi  ; xor with input
 	movdqu	xmm11,XMMWORD16+rsi
 	movdqu	xmm2,XMMWORD32+rsi
 	movdqu	xmm7,XMMWORD48+rsi
-	pxor	xmm6,XMMWORDrsp
+	pxor	xmm6,XMMWORDrsp  ; is offloaded, remember?
 	pxor	xmm11,xmm12
 	pxor	xmm2,xmm4
 	pxor	xmm7,xmm0
@@ -936,24 +936,24 @@
 	movdqu	XMMWORD48+rdi,xmm7
 	je	NEAR $L$done4x
 
-	movdqa	xmm6,XMMWORD16+rsp
-	lea	rsi,64+rsi
+	movdqa	xmm6,XMMWORD16+rsp  ; is offloaded, remember?
+	lea	rsi,64+rsi  ; inp+=64*1
 	xor	r10,r10
 	movdqa	XMMWORDrsp,xmm6
 	movdqa	XMMWORD16+rsp,xmm13
-	lea	rdi,64+rdi
+	lea	rdi,64+rdi  ; out+=64*1
 	movdqa	XMMWORD32+rsp,xmm5
-	sub	rdx,64
+	sub	rdx,64  ; len-=64*1
 	movdqa	XMMWORD48+rsp,xmm1
 	jmp	NEAR $L$oop_tail4x
 
 ALIGN	32
 $L$128_or_more4x:
-	movdqu	xmm6,XMMWORDrsi
+	movdqu	xmm6,XMMWORDrsi  ; xor with input
 	movdqu	xmm11,XMMWORD16+rsi
 	movdqu	xmm2,XMMWORD32+rsi
 	movdqu	xmm7,XMMWORD48+rsi
-	pxor	xmm6,XMMWORDrsp
+	pxor	xmm6,XMMWORDrsp  ; is offloaded, remember?
 	pxor	xmm11,xmm12
 	pxor	xmm2,xmm4
 	pxor	xmm7,xmm0
@@ -976,24 +976,24 @@
 	movdqu	XMMWORD112+rdi,xmm7
 	je	NEAR $L$done4x
 
-	movdqa	xmm6,XMMWORD32+rsp
-	lea	rsi,128+rsi
+	movdqa	xmm6,XMMWORD32+rsp  ; is offloaded, remember?
+	lea	rsi,128+rsi  ; inp+=64*2
 	xor	r10,r10
 	movdqa	XMMWORDrsp,xmm6
 	movdqa	XMMWORD16+rsp,xmm10
-	lea	rdi,128+rdi
+	lea	rdi,128+rdi  ; out+=64*2
 	movdqa	XMMWORD32+rsp,xmm14
-	sub	rdx,128
+	sub	rdx,128  ; len-=64*2
 	movdqa	XMMWORD48+rsp,xmm8
 	jmp	NEAR $L$oop_tail4x
 
 ALIGN	32
 $L$192_or_more4x:
-	movdqu	xmm6,XMMWORDrsi
+	movdqu	xmm6,XMMWORDrsi  ; xor with input
 	movdqu	xmm11,XMMWORD16+rsi
 	movdqu	xmm2,XMMWORD32+rsi
 	movdqu	xmm7,XMMWORD48+rsi
-	pxor	xmm6,XMMWORDrsp
+	pxor	xmm6,XMMWORDrsp  ; is offloaded, remember?
 	pxor	xmm11,xmm12
 	pxor	xmm2,xmm4
 	pxor	xmm7,xmm0
@@ -1006,7 +1006,7 @@
 	movdqu	xmm2,XMMWORD96+rsi
 	movdqu	XMMWORD48+rdi,xmm7
 	movdqu	xmm7,XMMWORD112+rsi
-	lea	rsi,128+rsi
+	lea	rsi,128+rsi  ; size optimization
 	pxor	xmm6,XMMWORD16+rsp
 	pxor	xmm11,xmm13
 	pxor	xmm2,xmm5
@@ -1019,7 +1019,7 @@
 	movdqu	XMMWORD96+rdi,xmm2
 	movdqu	xmm2,XMMWORD32+rsi
 	movdqu	XMMWORD112+rdi,xmm7
-	lea	rdi,128+rdi
+	lea	rdi,128+rdi  ; size optimization
 	movdqu	xmm7,XMMWORD48+rsi
 	pxor	xmm6,XMMWORD32+rsp
 	pxor	xmm11,xmm10
@@ -1031,14 +1031,14 @@
 	movdqu	XMMWORD48+rdi,xmm7
 	je	NEAR $L$done4x
 
-	movdqa	xmm6,XMMWORD48+rsp
-	lea	rsi,64+rsi
+	movdqa	xmm6,XMMWORD48+rsp  ; is offloaded, remember?
+	lea	rsi,64+rsi  ; inp+=64*3
 	xor	r10,r10
 	movdqa	XMMWORDrsp,xmm6
 	movdqa	XMMWORD16+rsp,xmm15
-	lea	rdi,64+rdi
+	lea	rdi,64+rdi  ; out+=64*3
 	movdqa	XMMWORD32+rsp,xmm9
-	sub	rdx,192
+	sub	rdx,192  ; len-=64*3
 	movdqa	XMMWORD48+rsp,xmm3
 
 $L$oop_tail4x:
@@ -1086,7 +1086,7 @@
 
 
 _CET_ENDBR
-	mov	r9,rsp
+	mov	r9,rsp  ; frame register
 
 	sub	rsp,0x280+168
 	and	rsp,-32
@@ -1103,27 +1103,27 @@
 $L$8x_body:
 	vzeroupper
 
-
-
-
-
-
-
-
-
-
-	vbroadcasti128	ymm11,XMMWORD$L$sigma
-	vbroadcasti128	ymm3,XMMWORDrcx
-	vbroadcasti128	ymm15,XMMWORD16+rcx
-	vbroadcasti128	ymm7,XMMWORDr8
-	lea	rcx,256+rsp
-	lea	rax,512+rsp
+; ############### stack layout
+; +0x00		SIMD equivalent of %r12d
+; ...
+; +0x80		constant copy of key0-2 smashed by lanes
+; ...
+; +0x200	SIMD counters (with nonce smashed by lanes)
+; ...
+; +0x280
+
+	vbroadcasti128	ymm11,XMMWORD$L$sigma  ; key0
+	vbroadcasti128	ymm3,XMMWORDrcx  ; key1
+	vbroadcasti128	ymm15,XMMWORD16+rcx  ; key2
+	vbroadcasti128	ymm7,XMMWORDr8  ; key3
+	lea	rcx,256+rsp  ; size optimization
+	lea	rax,512+rsp  ; size optimization
 	lea	r10,$L$rot16
 	lea	r11,$L$rot24
 
-	vpshufd	ymm8,ymm11,0x00
+	vpshufd	ymm8,ymm11,0x00  ; smash key by lanes...
 	vpshufd	ymm9,ymm11,0x55
-	vmovdqa	YMMWORD(128-256)+rcx,ymm8
+	vmovdqa	YMMWORD(128-256)+rcx,ymm8  ; ... and offload
 	vpshufd	ymm10,ymm11,0xaa
 	vmovdqa	YMMWORD(160-256)+rcx,ymm9
 	vpshufd	ymm11,ymm11,0xff
@@ -1139,18 +1139,18 @@
 	vmovdqa	YMMWORD(320-256)+rcx,ymm2
 	vmovdqa	YMMWORD(352-256)+rcx,ymm3
 
-	vpshufd	ymm12,ymm15,0x00
-	vpshufd	ymm13,ymm15,0x55
+	vpshufd	ymm12,ymm15,0x00  ; "xc0"
+	vpshufd	ymm13,ymm15,0x55  ; "xc1"
 	vmovdqa	YMMWORD(384-512)+rax,ymm12
-	vpshufd	ymm14,ymm15,0xaa
+	vpshufd	ymm14,ymm15,0xaa  ; "xc2"
 	vmovdqa	YMMWORD(416-512)+rax,ymm13
-	vpshufd	ymm15,ymm15,0xff
+	vpshufd	ymm15,ymm15,0xff  ; "xc3"
 	vmovdqa	YMMWORD(448-512)+rax,ymm14
 	vmovdqa	YMMWORD(480-512)+rax,ymm15
 
 	vpshufd	ymm4,ymm7,0x00
 	vpshufd	ymm5,ymm7,0x55
-	vpaddd	ymm4,ymm4,YMMWORD$L$incy
+	vpaddd	ymm4,ymm4,YMMWORD$L$incy  ; don't save counters yet
 	vpshufd	ymm6,ymm7,0xaa
 	vmovdqa	YMMWORD(544-512)+rax,ymm5
 	vpshufd	ymm7,ymm7,0xff
@@ -1161,7 +1161,7 @@
 
 ALIGN	32
 $L$oop_outer8x:
-	vmovdqa	ymm8,YMMWORD((128-256))+rcx
+	vmovdqa	ymm8,YMMWORD((128-256))+rcx  ; re-load smashed key
 	vmovdqa	ymm9,YMMWORD((160-256))+rcx
 	vmovdqa	ymm10,YMMWORD((192-256))+rcx
 	vmovdqa	ymm11,YMMWORD((224-256))+rcx
@@ -1169,21 +1169,21 @@
 	vmovdqa	ymm1,YMMWORD((288-256))+rcx
 	vmovdqa	ymm2,YMMWORD((320-256))+rcx
 	vmovdqa	ymm3,YMMWORD((352-256))+rcx
-	vmovdqa	ymm12,YMMWORD((384-512))+rax
-	vmovdqa	ymm13,YMMWORD((416-512))+rax
-	vmovdqa	ymm14,YMMWORD((448-512))+rax
-	vmovdqa	ymm15,YMMWORD((480-512))+rax
+	vmovdqa	ymm12,YMMWORD((384-512))+rax  ; "xc0"
+	vmovdqa	ymm13,YMMWORD((416-512))+rax  ; "xc1"
+	vmovdqa	ymm14,YMMWORD((448-512))+rax  ; "xc2"
+	vmovdqa	ymm15,YMMWORD((480-512))+rax  ; "xc3"
 	vmovdqa	ymm4,YMMWORD((512-512))+rax
 	vmovdqa	ymm5,YMMWORD((544-512))+rax
 	vmovdqa	ymm6,YMMWORD((576-512))+rax
 	vmovdqa	ymm7,YMMWORD((608-512))+rax
-	vpaddd	ymm4,ymm4,YMMWORD$L$eight
+	vpaddd	ymm4,ymm4,YMMWORD$L$eight  ; next SIMD counters
 
 $L$oop_enter8x:
-	vmovdqa	YMMWORD64+rsp,ymm14
-	vmovdqa	YMMWORD96+rsp,ymm15
+	vmovdqa	YMMWORD64+rsp,ymm14  ; SIMD equivalent of "%nox"
+	vmovdqa	YMMWORD96+rsp,ymm15  ; SIMD equivalent of "%nox"
 	vbroadcasti128	ymm15,XMMWORDr10
-	vmovdqa	YMMWORD(512-512)+rax,ymm4
+	vmovdqa	YMMWORD(512-512)+rax,ymm4  ; save SIMD counters
 	mov	eax,10
 	jmp	NEAR $L$oop8x
 
@@ -1336,20 +1336,20 @@
 	dec	eax
 	jnz	NEAR $L$oop8x
 
-	lea	rax,512+rsp
-	vpaddd	ymm8,ymm8,YMMWORD((128-256))+rcx
+	lea	rax,512+rsp  ; size optimization
+	vpaddd	ymm8,ymm8,YMMWORD((128-256))+rcx  ; accumulate key
 	vpaddd	ymm9,ymm9,YMMWORD((160-256))+rcx
 	vpaddd	ymm10,ymm10,YMMWORD((192-256))+rcx
 	vpaddd	ymm11,ymm11,YMMWORD((224-256))+rcx
 
-	vpunpckldq	ymm14,ymm8,ymm9
+	vpunpckldq	ymm14,ymm8,ymm9  ; "de-interlace" data
 	vpunpckldq	ymm15,ymm10,ymm11
 	vpunpckhdq	ymm8,ymm8,ymm9
 	vpunpckhdq	ymm10,ymm10,ymm11
-	vpunpcklqdq	ymm9,ymm14,ymm15
-	vpunpckhqdq	ymm14,ymm14,ymm15
-	vpunpcklqdq	ymm11,ymm8,ymm10
-	vpunpckhqdq	ymm8,ymm8,ymm10
+	vpunpcklqdq	ymm9,ymm14,ymm15  ; "a0"
+	vpunpckhqdq	ymm14,ymm14,ymm15  ; "a1"
+	vpunpcklqdq	ymm11,ymm8,ymm10  ; "a2"
+	vpunpckhqdq	ymm8,ymm8,ymm10  ; "a3"
 	vpaddd	ymm0,ymm0,YMMWORD((256-256))+rcx
 	vpaddd	ymm1,ymm1,YMMWORD((288-256))+rcx
 	vpaddd	ymm2,ymm2,YMMWORD((320-256))+rcx
@@ -1359,11 +1359,11 @@
 	vpunpckldq	ymm15,ymm2,ymm3
 	vpunpckhdq	ymm0,ymm0,ymm1
 	vpunpckhdq	ymm2,ymm2,ymm3
-	vpunpcklqdq	ymm1,ymm10,ymm15
-	vpunpckhqdq	ymm10,ymm10,ymm15
-	vpunpcklqdq	ymm3,ymm0,ymm2
-	vpunpckhqdq	ymm0,ymm0,ymm2
-	vperm2i128	ymm15,ymm9,ymm1,0x20
+	vpunpcklqdq	ymm1,ymm10,ymm15  ; "b0"
+	vpunpckhqdq	ymm10,ymm10,ymm15  ; "b1"
+	vpunpcklqdq	ymm3,ymm0,ymm2  ; "b2"
+	vpunpckhqdq	ymm0,ymm0,ymm2  ; "b3"
+	vperm2i128	ymm15,ymm9,ymm1,0x20  ; "de-interlace" further
 	vperm2i128	ymm1,ymm9,ymm1,0x31
 	vperm2i128	ymm9,ymm14,ymm10,0x20
 	vperm2i128	ymm10,ymm14,ymm10,0x31
@@ -1371,10 +1371,10 @@
 	vperm2i128	ymm3,ymm11,ymm3,0x31
 	vperm2i128	ymm11,ymm8,ymm0,0x20
 	vperm2i128	ymm0,ymm8,ymm0,0x31
-	vmovdqa	YMMWORDrsp,ymm15
+	vmovdqa	YMMWORDrsp,ymm15  ; offload
 	vmovdqa	YMMWORD32+rsp,ymm9
-	vmovdqa	ymm15,YMMWORD64+rsp
-	vmovdqa	ymm9,YMMWORD96+rsp
+	vmovdqa	ymm15,YMMWORD64+rsp  ; %ymm15
+	vmovdqa	ymm9,YMMWORD96+rsp  ; %ymm9
 
 	vpaddd	ymm12,ymm12,YMMWORD((384-512))+rax
 	vpaddd	ymm13,ymm13,YMMWORD((416-512))+rax
@@ -1385,10 +1385,10 @@
 	vpunpckldq	ymm8,ymm15,ymm9
 	vpunpckhdq	ymm12,ymm12,ymm13
 	vpunpckhdq	ymm15,ymm15,ymm9
-	vpunpcklqdq	ymm13,ymm2,ymm8
-	vpunpckhqdq	ymm2,ymm2,ymm8
-	vpunpcklqdq	ymm9,ymm12,ymm15
-	vpunpckhqdq	ymm12,ymm12,ymm15
+	vpunpcklqdq	ymm13,ymm2,ymm8  ; "c0"
+	vpunpckhqdq	ymm2,ymm2,ymm8  ; "c1"
+	vpunpcklqdq	ymm9,ymm12,ymm15  ; "c2"
+	vpunpckhqdq	ymm12,ymm12,ymm15  ; "c3"
 	vpaddd	ymm4,ymm4,YMMWORD((512-512))+rax
 	vpaddd	ymm5,ymm5,YMMWORD((544-512))+rax
 	vpaddd	ymm6,ymm6,YMMWORD((576-512))+rax
@@ -1398,11 +1398,11 @@
 	vpunpckldq	ymm8,ymm6,ymm7
 	vpunpckhdq	ymm4,ymm4,ymm5
 	vpunpckhdq	ymm6,ymm6,ymm7
-	vpunpcklqdq	ymm5,ymm15,ymm8
-	vpunpckhqdq	ymm15,ymm15,ymm8
-	vpunpcklqdq	ymm7,ymm4,ymm6
-	vpunpckhqdq	ymm4,ymm4,ymm6
-	vperm2i128	ymm8,ymm13,ymm5,0x20
+	vpunpcklqdq	ymm5,ymm15,ymm8  ; "d0"
+	vpunpckhqdq	ymm15,ymm15,ymm8  ; "d1"
+	vpunpcklqdq	ymm7,ymm4,ymm6  ; "d2"
+	vpunpckhqdq	ymm4,ymm4,ymm6  ; "d3"
+	vperm2i128	ymm8,ymm13,ymm5,0x20  ; "de-interlace" further
 	vperm2i128	ymm5,ymm13,ymm5,0x31
 	vperm2i128	ymm13,ymm2,ymm15,0x20
 	vperm2i128	ymm15,ymm2,ymm15,0x31
@@ -1410,55 +1410,55 @@
 	vperm2i128	ymm7,ymm9,ymm7,0x31
 	vperm2i128	ymm9,ymm12,ymm4,0x20
 	vperm2i128	ymm4,ymm12,ymm4,0x31
-	vmovdqa	ymm6,YMMWORDrsp
+	vmovdqa	ymm6,YMMWORDrsp  ; was offloaded, remember?
 	vmovdqa	ymm12,YMMWORD32+rsp
 
 	cmp	rdx,64*8
 	jb	NEAR $L$tail8x
 
-	vpxor	ymm6,ymm6,YMMWORDrsi
+	vpxor	ymm6,ymm6,YMMWORDrsi  ; xor with input
 	vpxor	ymm8,ymm8,YMMWORD32+rsi
 	vpxor	ymm1,ymm1,YMMWORD64+rsi
 	vpxor	ymm5,ymm5,YMMWORD96+rsi
-	lea	rsi,128+rsi
+	lea	rsi,128+rsi  ; size optimization
 	vmovdqu	YMMWORDrdi,ymm6
 	vmovdqu	YMMWORD32+rdi,ymm8
 	vmovdqu	YMMWORD64+rdi,ymm1
 	vmovdqu	YMMWORD96+rdi,ymm5
-	lea	rdi,128+rdi
+	lea	rdi,128+rdi  ; size optimization
 
 	vpxor	ymm12,ymm12,YMMWORDrsi
 	vpxor	ymm13,ymm13,YMMWORD32+rsi
 	vpxor	ymm10,ymm10,YMMWORD64+rsi
 	vpxor	ymm15,ymm15,YMMWORD96+rsi
-	lea	rsi,128+rsi
+	lea	rsi,128+rsi  ; size optimization
 	vmovdqu	YMMWORDrdi,ymm12
 	vmovdqu	YMMWORD32+rdi,ymm13
 	vmovdqu	YMMWORD64+rdi,ymm10
 	vmovdqu	YMMWORD96+rdi,ymm15
-	lea	rdi,128+rdi
+	lea	rdi,128+rdi  ; size optimization
 
 	vpxor	ymm14,ymm14,YMMWORDrsi
 	vpxor	ymm2,ymm2,YMMWORD32+rsi
 	vpxor	ymm3,ymm3,YMMWORD64+rsi
 	vpxor	ymm7,ymm7,YMMWORD96+rsi
-	lea	rsi,128+rsi
+	lea	rsi,128+rsi  ; size optimization
 	vmovdqu	YMMWORDrdi,ymm14
 	vmovdqu	YMMWORD32+rdi,ymm2
 	vmovdqu	YMMWORD64+rdi,ymm3
 	vmovdqu	YMMWORD96+rdi,ymm7
-	lea	rdi,128+rdi
+	lea	rdi,128+rdi  ; size optimization
 
 	vpxor	ymm11,ymm11,YMMWORDrsi
 	vpxor	ymm9,ymm9,YMMWORD32+rsi
 	vpxor	ymm0,ymm0,YMMWORD64+rsi
 	vpxor	ymm4,ymm4,YMMWORD96+rsi
-	lea	rsi,128+rsi
+	lea	rsi,128+rsi  ; size optimization
 	vmovdqu	YMMWORDrdi,ymm11
 	vmovdqu	YMMWORD32+rdi,ymm9
 	vmovdqu	YMMWORD64+rdi,ymm0
 	vmovdqu	YMMWORD96+rdi,ymm4
-	lea	rdi,128+rdi
+	lea	rdi,128+rdi  ; size optimization
 
 	sub	rdx,64*8
 	jnz	NEAR $L$oop_outer8x
@@ -1488,23 +1488,23 @@
 
 ALIGN	32
 $L$64_or_more8x:
-	vpxor	ymm6,ymm6,YMMWORDrsi
+	vpxor	ymm6,ymm6,YMMWORDrsi  ; xor with input
 	vpxor	ymm8,ymm8,YMMWORD32+rsi
 	vmovdqu	YMMWORDrdi,ymm6
 	vmovdqu	YMMWORD32+rdi,ymm8
 	je	NEAR $L$done8x
 
-	lea	rsi,64+rsi
+	lea	rsi,64+rsi  ; inp+=64*1
 	xor	r10,r10
 	vmovdqa	YMMWORDrsp,ymm1
-	lea	rdi,64+rdi
-	sub	rdx,64
+	lea	rdi,64+rdi  ; out+=64*1
+	sub	rdx,64  ; len-=64*1
 	vmovdqa	YMMWORD32+rsp,ymm5
 	jmp	NEAR $L$oop_tail8x
 
 ALIGN	32
 $L$128_or_more8x:
-	vpxor	ymm6,ymm6,YMMWORDrsi
+	vpxor	ymm6,ymm6,YMMWORDrsi  ; xor with input
 	vpxor	ymm8,ymm8,YMMWORD32+rsi
 	vpxor	ymm1,ymm1,YMMWORD64+rsi
 	vpxor	ymm5,ymm5,YMMWORD96+rsi
@@ -1514,17 +1514,17 @@
 	vmovdqu	YMMWORD96+rdi,ymm5
 	je	NEAR $L$done8x
 
-	lea	rsi,128+rsi
+	lea	rsi,128+rsi  ; inp+=64*2
 	xor	r10,r10
 	vmovdqa	YMMWORDrsp,ymm12
-	lea	rdi,128+rdi
-	sub	rdx,128
+	lea	rdi,128+rdi  ; out+=64*2
+	sub	rdx,128  ; len-=64*2
 	vmovdqa	YMMWORD32+rsp,ymm13
 	jmp	NEAR $L$oop_tail8x
 
 ALIGN	32
 $L$192_or_more8x:
-	vpxor	ymm6,ymm6,YMMWORDrsi
+	vpxor	ymm6,ymm6,YMMWORDrsi  ; xor with input
 	vpxor	ymm8,ymm8,YMMWORD32+rsi
 	vpxor	ymm1,ymm1,YMMWORD64+rsi
 	vpxor	ymm5,ymm5,YMMWORD96+rsi
@@ -1538,17 +1538,17 @@
 	vmovdqu	YMMWORD160+rdi,ymm13
 	je	NEAR $L$done8x
 
-	lea	rsi,192+rsi
+	lea	rsi,192+rsi  ; inp+=64*3
 	xor	r10,r10
 	vmovdqa	YMMWORDrsp,ymm10
-	lea	rdi,192+rdi
-	sub	rdx,192
+	lea	rdi,192+rdi  ; out+=64*3
+	sub	rdx,192  ; len-=64*3
 	vmovdqa	YMMWORD32+rsp,ymm15
 	jmp	NEAR $L$oop_tail8x
 
 ALIGN	32
 $L$256_or_more8x:
-	vpxor	ymm6,ymm6,YMMWORDrsi
+	vpxor	ymm6,ymm6,YMMWORDrsi  ; xor with input
 	vpxor	ymm8,ymm8,YMMWORD32+rsi
 	vpxor	ymm1,ymm1,YMMWORD64+rsi
 	vpxor	ymm5,ymm5,YMMWORD96+rsi
@@ -1566,17 +1566,17 @@
 	vmovdqu	YMMWORD224+rdi,ymm15
 	je	NEAR $L$done8x
 
-	lea	rsi,256+rsi
+	lea	rsi,256+rsi  ; inp+=64*4
 	xor	r10,r10
 	vmovdqa	YMMWORDrsp,ymm14
-	lea	rdi,256+rdi
-	sub	rdx,256
+	lea	rdi,256+rdi  ; out+=64*4
+	sub	rdx,256  ; len-=64*4
 	vmovdqa	YMMWORD32+rsp,ymm2
 	jmp	NEAR $L$oop_tail8x
 
 ALIGN	32
 $L$320_or_more8x:
-	vpxor	ymm6,ymm6,YMMWORDrsi
+	vpxor	ymm6,ymm6,YMMWORDrsi  ; xor with input
 	vpxor	ymm8,ymm8,YMMWORD32+rsi
 	vpxor	ymm1,ymm1,YMMWORD64+rsi
 	vpxor	ymm5,ymm5,YMMWORD96+rsi
@@ -1598,17 +1598,17 @@
 	vmovdqu	YMMWORD288+rdi,ymm2
 	je	NEAR $L$done8x
 
-	lea	rsi,320+rsi
+	lea	rsi,320+rsi  ; inp+=64*5
 	xor	r10,r10
 	vmovdqa	YMMWORDrsp,ymm3
-	lea	rdi,320+rdi
-	sub	rdx,320
+	lea	rdi,320+rdi  ; out+=64*5
+	sub	rdx,320  ; len-=64*5
 	vmovdqa	YMMWORD32+rsp,ymm7
 	jmp	NEAR $L$oop_tail8x
 
 ALIGN	32
 $L$384_or_more8x:
-	vpxor	ymm6,ymm6,YMMWORDrsi
+	vpxor	ymm6,ymm6,YMMWORDrsi  ; xor with input
 	vpxor	ymm8,ymm8,YMMWORD32+rsi
 	vpxor	ymm1,ymm1,YMMWORD64+rsi
 	vpxor	ymm5,ymm5,YMMWORD96+rsi
@@ -1634,17 +1634,17 @@
 	vmovdqu	YMMWORD352+rdi,ymm7
 	je	NEAR $L$done8x
 
-	lea	rsi,384+rsi
+	lea	rsi,384+rsi  ; inp+=64*6
 	xor	r10,r10
 	vmovdqa	YMMWORDrsp,ymm11
-	lea	rdi,384+rdi
-	sub	rdx,384
+	lea	rdi,384+rdi  ; out+=64*6
+	sub	rdx,384  ; len-=64*6
 	vmovdqa	YMMWORD32+rsp,ymm9
 	jmp	NEAR $L$oop_tail8x
 
 ALIGN	32
 $L$448_or_more8x:
-	vpxor	ymm6,ymm6,YMMWORDrsi
+	vpxor	ymm6,ymm6,YMMWORDrsi  ; xor with input
 	vpxor	ymm8,ymm8,YMMWORD32+rsi
 	vpxor	ymm1,ymm1,YMMWORD64+rsi
 	vpxor	ymm5,ymm5,YMMWORD96+rsi
@@ -1674,11 +1674,11 @@
 	vmovdqu	YMMWORD416+rdi,ymm9
 	je	NEAR $L$done8x
 
-	lea	rsi,448+rsi
+	lea	rsi,448+rsi  ; inp+=64*7
 	xor	r10,r10
 	vmovdqa	YMMWORDrsp,ymm0
-	lea	rdi,448+rdi
-	sub	rdx,448
+	lea	rdi,448+rdi  ; out+=64*7
+	sub	rdx,448  ; len-=64*7
 	vmovdqa	YMMWORD32+rsp,ymm4
 
 $L$oop_tail8x:
@@ -1725,20 +1725,20 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
 	lea	r10,$L$ctr32_body
-	cmp	rbx,r10
+	cmp	rbx,r10  ; context->Rip<.Lprologue
 	jb	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
-	lea	r10,$L$no_data
-	cmp	rbx,r10
+	lea	r10,$L$no_data  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=.Lepilogue
 	jae	NEAR $L$common_seh_tail
 
 	lea	rax,((64+24+48))+rax
@@ -1749,40 +1749,40 @@
 	mov	r13,QWORD((-32))+rax
 	mov	r14,QWORD((-40))+rax
 	mov	r15,QWORD((-48))+rax
-	mov	QWORD144+r8,rbx
-	mov	QWORD160+r8,rbp
-	mov	QWORD216+r8,r12
-	mov	QWORD224+r8,r13
-	mov	QWORD232+r8,r14
-	mov	QWORD240+r8,r15
+	mov	QWORD144+r8,rbx  ; restore context->Rbx
+	mov	QWORD160+r8,rbp  ; restore context->Rbp
+	mov	QWORD216+r8,r12  ; restore context->R12
+	mov	QWORD224+r8,r13  ; restore context->R13
+	mov	QWORD232+r8,r14  ; restore context->R14
+	mov	QWORD240+r8,r15  ; restore context->R14
 
 $L$common_seh_tail:
 	mov	rdi,QWORD8+rax
 	mov	rsi,QWORD16+rax
-	mov	QWORD152+r8,rax
-	mov	QWORD168+r8,rsi
-	mov	QWORD176+r8,rdi
+	mov	QWORD152+r8,rax  ; restore context->Rsp
+	mov	QWORD168+r8,rsi  ; restore context->Rsi
+	mov	QWORD176+r8,rdi  ; restore context->Rdi
 
-	mov	rdi,QWORD40+r9
-	mov	rsi,r8
-	mov	ecx,154
-	DD	0xa548f3fc
+	mov	rdi,QWORD40+r9  ; disp->ContextRecord
+	mov	rsi,r8  ; context
+	mov	ecx,154  ; sizeof(CONTEXT)
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	mov	rsi,r9
-	xor	rcx,rcx
-	mov	rdx,QWORD8+rsi
-	mov	r8,QWORDrsi
-	mov	r9,QWORD16+rsi
-	mov	r10,QWORD40+rsi
-	lea	r11,56+rsi
-	lea	r12,24+rsi
-	mov	QWORD32+rsp,r10
-	mov	QWORD40+rsp,r11
-	mov	QWORD48+rsp,r12
-	mov	QWORD56+rsp,rcx
+	xor	rcx,rcx  ; arg1, UNW_FLAG_NHANDLER
+	mov	rdx,QWORD8+rsi  ; arg2, disp->ImageBase
+	mov	r8,QWORDrsi  ; arg3, disp->ControlPc
+	mov	r9,QWORD16+rsi  ; arg4, disp->FunctionEntry
+	mov	r10,QWORD40+rsi  ; disp->ContextRecord
+	lea	r11,56+rsi  ; &disp->HandlerData
+	lea	r12,24+rsi  ; &disp->EstablisherFrame
+	mov	QWORD32+rsp,r10  ; arg5
+	mov	QWORD40+rsp,r11  ; arg6
+	mov	QWORD48+rsp,r12  ; arg7
+	mov	QWORD56+rsp,rcx  ; arg8, (NULL)
 	call	QWORD__imp_RtlVirtualUnwind
 
-	mov	eax,1
+	mov	eax,1  ; ExceptionContinueSearch
 	add	rsp,64
 	popfq
 	pop	r15
@@ -1810,28 +1810,28 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; prologue label
+	cmp	rbx,r10  ; context->Rip<prologue label
 	jb	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD192+r8
+	mov	rax,QWORD192+r8  ; pull context->R9
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$common_seh_tail
 
 	lea	rsi,((-40))+rax
-	lea	rdi,512+r8
+	lea	rdi,512+r8  ; &context.Xmm6
 	mov	ecx,4
-	DD	0xa548f3fc
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	jmp	NEAR $L$common_seh_tail
 
@@ -1850,28 +1850,28 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
-	mov	rsi,QWORD8+r9
-	mov	r11,QWORD56+r9
+	mov	rsi,QWORD8+r9  ; disp->ImageBase
+	mov	r11,QWORD56+r9  ; disp->HandlerData
 
-	mov	r10d,DWORDr11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORDr11  ; HandlerData0
+	lea	r10,r10*1+rsi  ; prologue label
+	cmp	rbx,r10  ; context->Rip<prologue label
 	jb	NEAR $L$common_seh_tail
 
-	mov	rax,QWORD192+r8
+	mov	rax,QWORD192+r8  ; pull context->R9
 
-	mov	r10d,DWORD4+r11
-	lea	r10,r10*1+rsi
-	cmp	rbx,r10
+	mov	r10d,DWORD4+r11  ; HandlerData1
+	lea	r10,r10*1+rsi  ; epilogue label
+	cmp	rbx,r10  ; context->Rip>=epilogue label
 	jae	NEAR $L$common_seh_tail
 
 	lea	rsi,((-168))+rax
-	lea	rdi,512+r8
+	lea	rdi,512+r8  ; &context.Xmm6
 	mov	ecx,20
-	DD	0xa548f3fc
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	jmp	NEAR $L$common_seh_tail
 
@@ -1910,7 +1910,7 @@
 $L$SEH_info_ChaCha20_ctr32_avx2:
 	DB	9,0,0,0
 	DD	full_handler wrt ..imagebase
-	DD	$L$8x_body wrt ..imagebase,$L$8x_epilogue wrt ..imagebase
+	DD	$L$8x_body wrt ..imagebase,$L$8x_epilogue wrt ..imagebase  ; HandlerData
 %else
 ; Work around https://bugzilla.nasm.us/show_bug.cgi?id=3392738
 ret

boringssl-0.20260708.tar.xz/gen/crypto/chacha20_poly1305_x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/crypto/chacha20_poly1305_x86_64-apple.S Changed

@@ -56,7 +56,7 @@
 	cmpq	$13,%r8
 	jne	L$hash_ad_loop
 L$poly_fast_tls_ad:
-
+// Special treatment for the TLS case of 13 bytes
 	movq	(%rcx),%r10
 	movq	5(%rcx),%r11
 	shrq	$24,%r11
@@ -87,21 +87,21 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
 	ret
 L$hash_ad_loop:
-
+// Hash in 16 byte chunk
 	cmpq	$16,%r8
 	jb	L$hash_ad_tail
 	addq	0+0(%rcx),%r10
@@ -133,14 +133,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -151,7 +151,7 @@
 L$hash_ad_tail:
 	cmpq	$0,%r8
 	je	L$hash_ad_done
-
+// Hash last < 16 byte tail
 	xorq	%r13,%r13
 	xorq	%r14,%r14
 	xorq	%r15,%r15
@@ -194,19 +194,19 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
-
+// Finished AD
 L$hash_ad_done:
 	ret
 
@@ -232,8 +232,8 @@
 
 	pushq	%r15
 
-
-
+// We write the calculated authenticator back to keyp at the end, so save
+// the pointer on the stack too.
 	pushq	%r9
 
 	subq	$288 + 0 + 32,%rsp
@@ -248,14 +248,14 @@
 
 	cmpq	$128,%rbx
 	jbe	L$open_sse_128
-
+// For long buffers, prepare the poly key first
 	movdqa	L$chacha20_consts(%rip),%xmm0
 	movdqu	0(%r9),%xmm4
 	movdqu	16(%r9),%xmm8
 	movdqu	32(%r9),%xmm12
 
 	movdqa	%xmm12,%xmm7
-
+// Store on stack, to free keyp
 	movdqa	%xmm4,0+48(%rbp)
 	movdqa	%xmm8,0+64(%rbp)
 	movdqa	%xmm12,0+96(%rbp)
@@ -306,20 +306,20 @@
 
 	decq	%r10
 	jne	L$open_sse_init_rounds
-
+// A0|B0 hold the Poly1305 32-byte key, C0,D0 can be discarded
 	paddd	L$chacha20_consts(%rip),%xmm0
 	paddd	0+48(%rbp),%xmm4
-
+// Clamp and store the key
 	pand	L$clamp(%rip),%xmm0
 	movdqa	%xmm0,0+0(%rbp)
 	movdqa	%xmm4,0+16(%rbp)
-
+// Hash
 	movq	%r8,%r8
 	call	poly_hash_ad_internal
 L$open_sse_main_loop:
 	cmpq	$256,%rbx
 	jb	L$open_sse_tail
-
+// Load state, increment counter blocks
 	movdqa	L$chacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
 	movdqa	0+64(%rbp),%xmm8
@@ -345,8 +345,8 @@
 	movdqa	%xmm14,0+128(%rbp)
 	movdqa	%xmm15,0+144(%rbp)
 
-
-
+// There are 10 ChaCha20 iterations of 2QR each, so for 6 iterations we
+// hash 2 blocks, and for the remaining 4 only 1 block - for a total of 16
 	movq	$4,%rcx
 	movq	%rsi,%r8
 L$open_sse_main_loop_rounds:
@@ -481,14 +481,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -608,14 +608,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -694,7 +694,7 @@
 	subq	$256,%rbx
 	jmp	L$open_sse_main_loop
 L$open_sse_tail:
-
+// Handle the various tail sizes efficiently
 	testq	%rbx,%rbx
 	jz	L$open_sse_finalize
 	cmpq	$192,%rbx
@@ -744,14 +744,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -812,7 +812,7 @@
 	paddd	0+96(%rbp),%xmm12
 
 	jmp	L$open_sse_tail_64_dec_loop
-
+// ############################################################################# 
 L$open_sse_tail_128:
 	movdqa	L$chacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
@@ -860,14 +860,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -988,7 +988,7 @@
 	leaq	64(%rsi),%rsi
 	leaq	64(%rdi),%rdi
 	jmp	L$open_sse_tail_64_dec_loop
-
+// ############################################################################# 
 L$open_sse_tail_192:
 	movdqa	L$chacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
@@ -1045,14 +1045,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -1221,14 +1221,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -1264,14 +1264,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -1318,7 +1318,7 @@
 	leaq	128(%rsi),%rsi
 	leaq	128(%rdi),%rdi
 	jmp	L$open_sse_tail_64_dec_loop
-
+// ############################################################################# 
 L$open_sse_tail_256:
 	movdqa	L$chacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
@@ -1529,14 +1529,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -1600,14 +1600,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -1673,8 +1673,8 @@
 	subq	$192,%rbx
 	leaq	192(%rsi),%rsi
 	leaq	192(%rdi),%rdi
-
-
+// ############################################################################# 
+// Decrypt the remaining data, 16B at a time, using existing stream
 L$open_sse_tail_64_dec_loop:
 	cmpq	$16,%rbx
 	jb	L$open_sse_tail_16_init
@@ -1691,13 +1691,13 @@
 L$open_sse_tail_16_init:
 	movdqa	%xmm0,%xmm1
 
-
+// Decrypt up to 16 bytes at the end.
 L$open_sse_tail_16:
 	testq	%rbx,%rbx
 	jz	L$open_sse_finalize
 
-
-
+// Read the final bytes into %xmm3. They need to be read in reverse order so
+// that they end up in the correct order in %xmm3.
 	pxor	%xmm3,%xmm3
 	leaq	-1(%rsi,%rbx,1),%rsi
 	movq	%rbx,%r8
@@ -1710,10 +1710,10 @@
 
 	movq	%xmm3,%r13
 	pextrq	$1,%xmm3,%r14
-
+// The final bytes of keystream are in %xmm1.
 	pxor	%xmm1,%xmm3
 
-
+// Copy the plaintext bytes out.
 L$open_sse_tail_16_extract:
 	pextrb	$0,%xmm3,(%rdi)
 	psrldq	$1,%xmm3
@@ -1750,14 +1750,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -1793,19 +1793,19 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
-
+// Final reduce
 	movq	%r10,%r13
 	movq	%r11,%r14
 	movq	%r12,%r15
@@ -1815,14 +1815,14 @@
 	cmovcq	%r13,%r10
 	cmovcq	%r14,%r11
 	cmovcq	%r15,%r12
-
+// Add in s part of the key
 	addq	0+0+16(%rbp),%r10
 	adcq	8+0+16(%rbp),%r11
 
 
 	addq	$288 + 0 + 32,%rsp
 
-
+// The tag replaces the key on return
 	popq	%r9
 
 	movq	%r10,(%r9)
@@ -1840,7 +1840,7 @@
 	popq	%rbp
 
 	ret
-
+// ############################################################################# 
 L$open_sse_128:
 
 	movdqu	L$chacha20_consts(%rip),%xmm0
@@ -2003,11 +2003,11 @@
 	paddd	%xmm15,%xmm13
 	paddd	L$sse_inc(%rip),%xmm15
 	paddd	%xmm15,%xmm14
-
+// Clamp and store the key
 	pand	L$clamp(%rip),%xmm0
 	movdqa	%xmm0,0+0(%rbp)
 	movdqa	%xmm4,0+16(%rbp)
-
+// Hash
 	movq	%r8,%r8
 	call	poly_hash_ad_internal
 L$open_sse_128_xor_hash:
@@ -2018,7 +2018,7 @@
 	adcq	8+0(%rsi),%r11
 	adcq	$1,%r12
 
-
+// Load for decryption
 	movdqu	0(%rsi),%xmm3
 	pxor	%xmm3,%xmm1
 	movdqu	%xmm1,0(%rdi)
@@ -2050,19 +2050,19 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
-
+// Shift the stream left
 	movdqa	%xmm5,%xmm1
 	movdqa	%xmm9,%xmm5
 	movdqa	%xmm13,%xmm9
@@ -2074,12 +2074,12 @@
 
 
 
-
-
-
-
-
-
+// ############################################################################## 
+// ############################################################################## 
+// void chacha20_poly1305_seal(uint8_t *out_ciphertext, const uint8_t *plaintext,
+// size_t plaintext_len, const uint8_t *ad,
+// size_t ad_len,
+// union chacha20_poly1305_seal_data *data);
 .globl	_chacha20_poly1305_seal_sse41
 .private_extern _chacha20_poly1305_seal_sse41
 
@@ -2100,8 +2100,8 @@
 
 	pushq	%r15
 
-
-
+// We write the calculated authenticator back to keyp at the end, so save
+// the pointer on the stack too.
 	pushq	%r9
 
 	subq	$288 + 0 + 32,%rsp
@@ -2109,7 +2109,7 @@
 	leaq	32(%rsp),%rbp
 	andq	$-32,%rbp
 
-	movq	56(%r9),%rbx
+	movq	56(%r9),%rbx  // extra_in_len
 	addq	%rdx,%rbx
 	movq	%r8,0+0+32(%rbp)
 	movq	%rbx,8+0+32(%rbp)
@@ -2117,7 +2117,7 @@
 
 	cmpq	$128,%rbx
 	jbe	L$seal_sse_128
-
+// For longer buffers, prepare the poly key + some stream
 	movdqa	L$chacha20_consts(%rip),%xmm0
 	movdqu	0(%r9),%xmm4
 	movdqu	16(%r9),%xmm8
@@ -2138,7 +2138,7 @@
 	paddd	L$sse_inc(%rip),%xmm12
 	movdqa	%xmm12,%xmm13
 	paddd	L$sse_inc(%rip),%xmm12
-
+// Store on stack
 	movdqa	%xmm4,0+48(%rbp)
 	movdqa	%xmm8,0+64(%rbp)
 	movdqa	%xmm12,0+96(%rbp)
@@ -2351,11 +2351,11 @@
 	paddd	0+64(%rbp),%xmm8
 	paddd	0+96(%rbp),%xmm12
 
-
+// Clamp and store the key
 	pand	L$clamp(%rip),%xmm3
 	movdqa	%xmm3,0+0(%rbp)
 	movdqa	%xmm7,0+16(%rbp)
-
+// Hash
 	movq	%r8,%r8
 	call	poly_hash_ad_internal
 	movdqu	0 + 0(%rsi),%xmm3
@@ -2572,14 +2572,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -2700,14 +2700,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -2808,7 +2808,7 @@
 	ja	L$seal_sse_tail_192
 	cmpq	$64,%rbx
 	ja	L$seal_sse_tail_128
-
+// ############################################################################# 
 L$seal_sse_tail_64:
 	movdqa	L$chacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
@@ -2847,14 +2847,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -2932,14 +2932,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -2955,7 +2955,7 @@
 	paddd	0+96(%rbp),%xmm12
 
 	jmp	L$seal_sse_128_tail_xor
-
+// ############################################################################# 
 L$seal_sse_tail_128:
 	movdqa	L$chacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
@@ -3000,14 +3000,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3085,14 +3085,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3169,7 +3169,7 @@
 	subq	$64,%rbx
 	leaq	64(%rsi),%rsi
 	jmp	L$seal_sse_128_tail_hash
-
+// ############################################################################# 
 L$seal_sse_tail_192:
 	movdqa	L$chacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
@@ -3220,14 +3220,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3326,14 +3326,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3446,7 +3446,7 @@
 	movq	$128,%rcx
 	subq	$128,%rbx
 	leaq	128(%rsi),%rsi
-
+// ############################################################################# 
 L$seal_sse_128_tail_hash:
 	cmpq	$16,%rcx
 	jb	L$seal_sse_128_tail_xor
@@ -3479,14 +3479,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3499,11 +3499,11 @@
 	cmpq	$16,%rbx
 	jb	L$seal_sse_tail_16
 	subq	$16,%rbx
-
+// Load for decryption
 	movdqu	0(%rsi),%xmm3
 	pxor	%xmm3,%xmm0
 	movdqu	%xmm0,0(%rdi)
-
+// Then hash
 	addq	0(%rdi),%r10
 	adcq	8(%rdi),%r11
 	adcq	$1,%r12
@@ -3535,19 +3535,19 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
-
+// Shift the stream left
 	movdqa	%xmm4,%xmm0
 	movdqa	%xmm8,%xmm4
 	movdqa	%xmm12,%xmm8
@@ -3560,7 +3560,7 @@
 L$seal_sse_tail_16:
 	testq	%rbx,%rbx
 	jz	L$process_blocks_of_extra_in
-
+// We can only load the PT one byte at a time to avoid buffer overread
 	movq	%rbx,%r8
 	movq	%rbx,%rcx
 	leaq	-1(%rsi,%rbx,1),%rsi
@@ -3572,10 +3572,10 @@
 	decq	%rcx
 	jne	L$seal_sse_tail_16_compose
 
-
+// XOR the keystream with the plaintext.
 	pxor	%xmm0,%xmm15
 
-
+// Write ciphertext out, byte-by-byte.
 	movq	%rbx,%rcx
 	movdqu	%xmm15,%xmm0
 L$seal_sse_tail_16_extract:
@@ -3585,42 +3585,42 @@
 	subq	$1,%rcx
 	jnz	L$seal_sse_tail_16_extract
 
-
-
-
-
-
-
-
+// %xmm15 contains the final (partial, non-empty) block of ciphertext which
+// needs to be fed into the Poly1305 state. The right-most %rbx bytes of it
+// are valid. We need to fill it with extra_in bytes until full, or until we
+// run out of bytes.
+// 
+// %r9 points to the tag output, which is actually a struct with the
+// extra_in pointer and length at offset 48.
 	movq	288 + 0 + 32(%rsp),%r9
-	movq	56(%r9),%r14
-	movq	48(%r9),%r13
+	movq	56(%r9),%r14  // extra_in_len
+	movq	48(%r9),%r13  // extra_in
 	testq	%r14,%r14
-	jz	L$process_partial_block
+	jz	L$process_partial_block  // Common case: no bytes of extra_in
 
 	movq	$16,%r15
-	subq	%rbx,%r15
-	cmpq	%r15,%r14
-
+	subq	%rbx,%r15  // 16-%rbx is the number of bytes that fit into %xmm15.
+	cmpq	%r15,%r14  // if extra_in_len < 16-%rbx, only copy extra_in_len
+// (note that AT&T syntax reverses the arguments)
 	jge	L$load_extra_in
 	movq	%r14,%r15
 
 L$load_extra_in:
-
-
+// %r15 contains the number of bytes of extra_in (pointed to by %r13) to load
+// into %xmm15. They are loaded in reverse order.
 	leaq	-1(%r13,%r15,1),%rsi
-
-
+// Update extra_in and extra_in_len to reflect the bytes that are about to
+// be read.
 	addq	%r15,%r13
 	subq	%r15,%r14
 	movq	%r13,48(%r9)
 	movq	%r14,56(%r9)
 
-
-
+// Update %r8, which is used to select the mask later on, to reflect the
+// extra bytes about to be added.
 	addq	%r15,%r8
 
-
+// Load %r15 bytes of extra_in into %xmm11.
 	pxor	%xmm11,%xmm11
 L$load_extra_load_loop:
 	pslldq	$1,%xmm11
@@ -3629,9 +3629,9 @@
 	subq	$1,%r15
 	jnz	L$load_extra_load_loop
 
-
-
-
+// Shift %xmm11 up the length of the remainder from the main encryption. Sadly,
+// the shift for an XMM register has to be a constant, thus we loop to do
+// this.
 	movq	%rbx,%r15
 
 L$load_extra_shift_loop:
@@ -3639,18 +3639,18 @@
 	subq	$1,%r15
 	jnz	L$load_extra_shift_loop
 
-
-
-
+// Mask %xmm15 (the remainder from the main encryption) so that superfluous
+// bytes are zero. This means that the non-zero bytes in %xmm11 and %xmm15 are
+// disjoint and so we can merge them with an OR.
 	leaq	L$and_masks(%rip),%r15
 	shlq	$4,%rbx
 	pand	-16(%r15,%rbx,1),%xmm15
 
-
+// Merge %xmm11 into %xmm15, forming the remainder block.
 	por	%xmm11,%xmm15
 
-
-
+// The block of ciphertext + extra_in is ready to be included in the
+// Poly1305 state.
 	movq	%xmm15,%r13
 	pextrq	$1,%xmm15,%r14
 	addq	%r13,%r10
@@ -3682,26 +3682,26 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
 
 L$process_blocks_of_extra_in:
-
+// There may be additional bytes of extra_in to process.
 	movq	288+32+0 (%rsp),%r9
-	movq	48(%r9),%rsi
-	movq	56(%r9),%r8
+	movq	48(%r9),%rsi  // extra_in
+	movq	56(%r9),%r8  // extra_in_len
 	movq	%r8,%rcx
-	shrq	$4,%r8
+	shrq	$4,%r8  // number of blocks
 
 L$process_extra_hash_loop:
 	jz	process_extra_in_trailer
@@ -3734,14 +3734,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3751,7 +3751,7 @@
 	jmp	L$process_extra_hash_loop
 .alt_entry process_extra_in_trailer
 process_extra_in_trailer:
-	andq	$15,%rcx
+	andq	$15,%rcx  // remaining num bytes (<16) of extra_in
 	movq	%rcx,%rbx
 	jz	L$do_length_block
 	leaq	-1(%rsi,%rcx,1),%rsi
@@ -3764,7 +3764,7 @@
 	jnz	L$process_extra_in_trailer_load
 
 L$process_partial_block:
-
+// %xmm15 contains %rbx bytes of data to be fed into Poly1305. %rbx
 	leaq	L$and_masks(%rip),%r15
 	shlq	$4,%rbx
 	pand	-16(%r15,%rbx,1),%xmm15
@@ -3799,14 +3799,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3842,19 +3842,19 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
-
+// Final reduce
 	movq	%r10,%r13
 	movq	%r11,%r14
 	movq	%r12,%r15
@@ -3864,14 +3864,14 @@
 	cmovcq	%r13,%r10
 	cmovcq	%r14,%r11
 	cmovcq	%r15,%r12
-
+// Add in s part of the key
 	addq	0+0+16(%rbp),%r10
 	adcq	8+0+16(%rbp),%r11
 
 
 	addq	$288 + 0 + 32,%rsp
 
-
+// The tag replaces the key on return
 	popq	%r9
 
 	movq	%r10,(%r9)
@@ -3889,7 +3889,7 @@
 	popq	%rbp
 
 	ret
-
+// ############################################################################## 
 L$seal_sse_128:
 
 	movdqu	L$chacha20_consts(%rip),%xmm0
@@ -4052,18 +4052,18 @@
 	paddd	%xmm15,%xmm12
 	paddd	L$sse_inc(%rip),%xmm15
 	paddd	%xmm15,%xmm13
-
+// Clamp and store the key
 	pand	L$clamp(%rip),%xmm2
 	movdqa	%xmm2,0+0(%rbp)
 	movdqa	%xmm6,0+16(%rbp)
-
+// Hash
 	movq	%r8,%r8
 	call	poly_hash_ad_internal
 	jmp	L$seal_sse_128_tail_xor
 
 
 
-
+// ############################################################################# 
 .globl	_chacha20_poly1305_open_avx2
 .private_extern _chacha20_poly1305_open_avx2
 
@@ -4084,8 +4084,8 @@
 
 	pushq	%r15
 
-
-
+// We write the calculated authenticator back to keyp at the end, so save
+// the pointer on the stack too.
 	pushq	%r9
 
 	subq	$288 + 0 + 32,%rsp
@@ -4161,16 +4161,16 @@
 	vpaddd	0+160(%rbp),%ymm12,%ymm12
 
 	vperm2i128	$0x02,%ymm0,%ymm4,%ymm3
-
+// Clamp and store key
 	vpand	L$clamp(%rip),%ymm3,%ymm3
 	vmovdqa	%ymm3,0+0(%rbp)
-
+// Stream for the first 64 bytes
 	vperm2i128	$0x13,%ymm0,%ymm4,%ymm0
 	vperm2i128	$0x13,%ymm8,%ymm12,%ymm4
-
+// Hash AD + first 64 bytes
 	movq	%r8,%r8
 	call	poly_hash_ad_internal
-
+// Hash first 64 bytes
 	xorq	%rcx,%rcx
 L$open_avx2_init_hash:
 	addq	0+0(%rsi,%rcx,1),%r10
@@ -4202,14 +4202,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4217,17 +4217,17 @@
 	addq	$16,%rcx
 	cmpq	$64,%rcx
 	jne	L$open_avx2_init_hash
-
+// Decrypt first 64 bytes
 	vpxor	0(%rsi),%ymm0,%ymm0
 	vpxor	32(%rsi),%ymm4,%ymm4
-
+// Store first 64 bytes of decrypted data
 	vmovdqu	%ymm0,0(%rdi)
 	vmovdqu	%ymm4,32(%rdi)
 	leaq	64(%rsi),%rsi
 	leaq	64(%rdi),%rdi
 	subq	$64,%rbx
 L$open_avx2_main_loop:
-
+// Hash and decrypt 512 bytes each iteration
 	cmpq	$512,%rbx
 	jb	L$open_avx2_main_loop_done
 	vmovdqa	L$chacha20_consts(%rip),%ymm0
@@ -4317,14 +4317,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4412,14 +4412,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4507,14 +4507,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4583,14 +4583,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4647,14 +4647,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4697,7 +4697,7 @@
 	movq	%rbx,%rcx
 	andq	$-16,%rcx
 	testq	%rcx,%rcx
-	je	L$open_avx2_tail_128_rounds
+	je	L$open_avx2_tail_128_rounds  // Have nothing to hash
 L$open_avx2_tail_128_rounds_and_x1hash:
 	addq	0+0(%rsi,%r8,1),%r10
 	adcq	8+0(%rsi,%r8,1),%r11
@@ -4728,14 +4728,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4796,7 +4796,7 @@
 	vmovdqa	%ymm3,%ymm8
 
 	jmp	L$open_avx2_tail_128_xor
-
+// ############################################################################# 
 L$open_avx2_tail_256:
 	vmovdqa	L$chacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -4842,14 +4842,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4988,14 +4988,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5033,7 +5033,7 @@
 	leaq	128(%rdi),%rdi
 	subq	$128,%rbx
 	jmp	L$open_avx2_tail_128_xor
-
+// ############################################################################# 
 L$open_avx2_tail_384:
 	vmovdqa	L$chacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -5085,14 +5085,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5185,14 +5185,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5291,14 +5291,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5352,7 +5352,7 @@
 	leaq	256(%rdi),%rdi
 	subq	$256,%rbx
 	jmp	L$open_avx2_tail_128_xor
-
+// ############################################################################# 
 L$open_avx2_tail_512:
 	vmovdqa	L$chacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -5408,14 +5408,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5481,14 +5481,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5562,14 +5562,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5688,14 +5688,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5786,7 +5786,7 @@
 	vmovdqa	%xmm0,%xmm1
 	jb	L$open_avx2_exit
 	subq	$16,%rbx
-
+// load for decryption
 	vpxor	(%rsi),%xmm0,%xmm1
 	vmovdqu	%xmm1,(%rdi)
 	leaq	16(%rsi),%rsi
@@ -5796,7 +5796,7 @@
 L$open_avx2_exit:
 	vzeroupper
 	jmp	L$open_sse_tail_16
-
+// ############################################################################# 
 L$open_avx2_192:
 	vmovdqa	%ymm0,%ymm1
 	vmovdqa	%ymm0,%ymm2
@@ -5897,10 +5897,10 @@
 	vpaddd	%ymm11,%ymm12,%ymm12
 	vpaddd	%ymm15,%ymm13,%ymm13
 	vperm2i128	$0x02,%ymm0,%ymm4,%ymm3
-
+// Clamp and store the key
 	vpand	L$clamp(%rip),%ymm3,%ymm3
 	vmovdqa	%ymm3,0+0(%rbp)
-
+// Stream for up to 192 bytes
 	vperm2i128	$0x13,%ymm0,%ymm4,%ymm0
 	vperm2i128	$0x13,%ymm8,%ymm12,%ymm4
 	vperm2i128	$0x02,%ymm1,%ymm5,%ymm8
@@ -5943,14 +5943,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5983,24 +5983,24 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
-
+// Load + decrypt
 	vpxor	(%rsi),%ymm0,%ymm0
 	vmovdqu	%ymm0,(%rdi)
 	leaq	32(%rsi),%rsi
 	leaq	32(%rdi),%rdi
-
+// Shift stream
 	vmovdqa	%ymm4,%ymm0
 	vmovdqa	%ymm8,%ymm4
 	vmovdqa	%ymm12,%ymm8
@@ -6045,14 +6045,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -6065,7 +6065,7 @@
 L$open_avx2_short_tail_32_exit:
 	vzeroupper
 	jmp	L$open_sse_tail_16
-
+// ############################################################################# 
 L$open_avx2_320:
 	vmovdqa	%ymm0,%ymm1
 	vmovdqa	%ymm0,%ymm2
@@ -6212,10 +6212,10 @@
 	vpaddd	0+192(%rbp),%ymm13,%ymm13
 	vpaddd	0+224(%rbp),%ymm14,%ymm14
 	vperm2i128	$0x02,%ymm0,%ymm4,%ymm3
-
+// Clamp and store the key
 	vpand	L$clamp(%rip),%ymm3,%ymm3
 	vmovdqa	%ymm3,0+0(%rbp)
-
+// Stream for up to 320 bytes
 	vperm2i128	$0x13,%ymm0,%ymm4,%ymm0
 	vperm2i128	$0x13,%ymm8,%ymm12,%ymm4
 	vperm2i128	$0x02,%ymm1,%ymm5,%ymm8
@@ -6229,8 +6229,8 @@
 	jmp	L$open_avx2_short
 
 
-
-
+// ############################################################################# 
+// ############################################################################# 
 .globl	_chacha20_poly1305_seal_avx2
 .private_extern _chacha20_poly1305_seal_avx2
 
@@ -6251,8 +6251,8 @@
 
 	pushq	%r15
 
-
-
+// We write the calculated authenticator back to keyp at the end, so save
+// the pointer on the stack too.
 	pushq	%r9
 
 	subq	$288 + 0 + 32,%rsp
@@ -6260,7 +6260,7 @@
 	leaq	32(%rsp),%rbp
 	andq	$-32,%rbp
 
-	movq	56(%r9),%rbx
+	movq	56(%r9),%rbx  // extra_in_len
 	addq	%rdx,%rbx
 	movq	%r8,0+0+32(%rbp)
 	movq	%rbx,8+0+32(%rbp)
@@ -6488,7 +6488,7 @@
 	vmovdqa	%ymm15,0+0(%rbp)
 	movq	%r8,%r8
 	call	poly_hash_ad_internal
-
+// Safely store 320 bytes (otherwise would handle with optimized call)
 	vpxor	0(%rsi),%ymm3,%ymm3
 	vpxor	32(%rsi),%ymm11,%ymm11
 	vmovdqu	%ymm3,0(%rdi)
@@ -6868,14 +6868,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -6965,14 +6965,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7060,14 +7060,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7115,14 +7115,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7148,14 +7148,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7239,14 +7239,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7272,14 +7272,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7294,7 +7294,7 @@
 	ja	L$seal_avx2_tail_384
 	cmpq	$128,%rbx
 	ja	L$seal_avx2_tail_256
-
+// ############################################################################# 
 L$seal_avx2_tail_128:
 	vmovdqa	L$chacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -7326,14 +7326,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7381,14 +7381,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7433,14 +7433,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7461,7 +7461,7 @@
 	vmovdqa	%ymm3,%ymm8
 
 	jmp	L$seal_avx2_short_loop
-
+// ############################################################################# 
 L$seal_avx2_tail_256:
 	vmovdqa	L$chacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -7505,14 +7505,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7586,14 +7586,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7664,14 +7664,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7711,7 +7711,7 @@
 	leaq	128(%rsi),%rsi
 	subq	$128,%rbx
 	jmp	L$seal_avx2_short_hash_remainder
-
+// ############################################################################# 
 L$seal_avx2_tail_384:
 	vmovdqa	L$chacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -7760,14 +7760,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7841,14 +7841,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7919,14 +7919,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -8020,7 +8020,7 @@
 	leaq	256(%rsi),%rsi
 	subq	$256,%rbx
 	jmp	L$seal_avx2_short_hash_remainder
-
+// ############################################################################# 
 L$seal_avx2_tail_512:
 	vmovdqa	L$chacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -8067,14 +8067,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -8203,14 +8203,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -8336,14 +8336,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -8419,7 +8419,7 @@
 	leaq	384(%rsi),%rsi
 	subq	$384,%rbx
 	jmp	L$seal_avx2_short_hash_remainder
-
+// ############################################################################## 
 L$seal_avx2_320:
 	vmovdqa	%ymm0,%ymm1
 	vmovdqa	%ymm0,%ymm2
@@ -8566,10 +8566,10 @@
 	vpaddd	0+192(%rbp),%ymm13,%ymm13
 	vpaddd	0+224(%rbp),%ymm14,%ymm14
 	vperm2i128	$0x02,%ymm0,%ymm4,%ymm3
-
+// Clamp and store the key
 	vpand	L$clamp(%rip),%ymm3,%ymm3
 	vmovdqa	%ymm3,0+0(%rbp)
-
+// Stream for up to 320 bytes
 	vperm2i128	$0x13,%ymm0,%ymm4,%ymm0
 	vperm2i128	$0x13,%ymm8,%ymm12,%ymm4
 	vperm2i128	$0x02,%ymm1,%ymm5,%ymm8
@@ -8581,7 +8581,7 @@
 	vperm2i128	$0x13,%ymm2,%ymm6,%ymm2
 	vperm2i128	$0x13,%ymm10,%ymm14,%ymm6
 	jmp	L$seal_avx2_short
-
+// ############################################################################## 
 L$seal_avx2_192:
 	vmovdqa	%ymm0,%ymm1
 	vmovdqa	%ymm0,%ymm2
@@ -8682,10 +8682,10 @@
 	vpaddd	%ymm11,%ymm12,%ymm12
 	vpaddd	%ymm15,%ymm13,%ymm13
 	vperm2i128	$0x02,%ymm0,%ymm4,%ymm3
-
+// Clamp and store the key
 	vpand	L$clamp(%rip),%ymm3,%ymm3
 	vmovdqa	%ymm3,0+0(%rbp)
-
+// Stream for up to 192 bytes
 	vperm2i128	$0x13,%ymm0,%ymm4,%ymm0
 	vperm2i128	$0x13,%ymm8,%ymm12,%ymm4
 	vperm2i128	$0x02,%ymm1,%ymm5,%ymm8
@@ -8728,14 +8728,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -8747,11 +8747,11 @@
 	cmpq	$32,%rbx
 	jb	L$seal_avx2_short_tail
 	subq	$32,%rbx
-
+// Encrypt
 	vpxor	(%rsi),%ymm0,%ymm0
 	vmovdqu	%ymm0,(%rdi)
 	leaq	32(%rsi),%rsi
-
+// Load + hash
 	addq	0+0(%rdi),%r10
 	adcq	8+0(%rdi),%r11
 	adcq	$1,%r12
@@ -8781,14 +8781,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -8821,20 +8821,20 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
 	leaq	32(%rdi),%rdi
-
+// Shift stream
 	vmovdqa	%ymm4,%ymm0
 	vmovdqa	%ymm8,%ymm4
 	vmovdqa	%ymm12,%ymm8
@@ -8881,14 +8881,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12

boringssl-0.20260708.tar.xz/gen/crypto/chacha20_poly1305_x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/crypto/chacha20_poly1305_x86_64-linux.S Changed

@@ -56,7 +56,7 @@
 	cmpq	$13,%r8
 	jne	.Lhash_ad_loop
 .Lpoly_fast_tls_ad:
-
+// Special treatment for the TLS case of 13 bytes
 	movq	(%rcx),%r10
 	movq	5(%rcx),%r11
 	shrq	$24,%r11
@@ -87,21 +87,21 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
 	ret
 .Lhash_ad_loop:
-
+// Hash in 16 byte chunk
 	cmpq	$16,%r8
 	jb	.Lhash_ad_tail
 	addq	0+0(%rcx),%r10
@@ -133,14 +133,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -151,7 +151,7 @@
 .Lhash_ad_tail:
 	cmpq	$0,%r8
 	je	.Lhash_ad_done
-
+// Hash last < 16 byte tail
 	xorq	%r13,%r13
 	xorq	%r14,%r14
 	xorq	%r15,%r15
@@ -194,19 +194,19 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
-
+// Finished AD
 .Lhash_ad_done:
 	ret
 .cfi_endproc	
@@ -237,8 +237,8 @@
 	pushq	%r15
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r15,-56
-
-
+// We write the calculated authenticator back to keyp at the end, so save
+// the pointer on the stack too.
 	pushq	%r9
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r9,-64
@@ -254,14 +254,14 @@
 
 	cmpq	$128,%rbx
 	jbe	.Lopen_sse_128
-
+// For long buffers, prepare the poly key first
 	movdqa	.Lchacha20_consts(%rip),%xmm0
 	movdqu	0(%r9),%xmm4
 	movdqu	16(%r9),%xmm8
 	movdqu	32(%r9),%xmm12
 
 	movdqa	%xmm12,%xmm7
-
+// Store on stack, to free keyp
 	movdqa	%xmm4,0+48(%rbp)
 	movdqa	%xmm8,0+64(%rbp)
 	movdqa	%xmm12,0+96(%rbp)
@@ -312,20 +312,20 @@
 
 	decq	%r10
 	jne	.Lopen_sse_init_rounds
-
+// A0|B0 hold the Poly1305 32-byte key, C0,D0 can be discarded
 	paddd	.Lchacha20_consts(%rip),%xmm0
 	paddd	0+48(%rbp),%xmm4
-
+// Clamp and store the key
 	pand	.Lclamp(%rip),%xmm0
 	movdqa	%xmm0,0+0(%rbp)
 	movdqa	%xmm4,0+16(%rbp)
-
+// Hash
 	movq	%r8,%r8
 	call	poly_hash_ad_internal
 .Lopen_sse_main_loop:
 	cmpq	$256,%rbx
 	jb	.Lopen_sse_tail
-
+// Load state, increment counter blocks
 	movdqa	.Lchacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
 	movdqa	0+64(%rbp),%xmm8
@@ -351,8 +351,8 @@
 	movdqa	%xmm14,0+128(%rbp)
 	movdqa	%xmm15,0+144(%rbp)
 
-
-
+// There are 10 ChaCha20 iterations of 2QR each, so for 6 iterations we
+// hash 2 blocks, and for the remaining 4 only 1 block - for a total of 16
 	movq	$4,%rcx
 	movq	%rsi,%r8
 .Lopen_sse_main_loop_rounds:
@@ -487,14 +487,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -614,14 +614,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -700,7 +700,7 @@
 	subq	$256,%rbx
 	jmp	.Lopen_sse_main_loop
 .Lopen_sse_tail:
-
+// Handle the various tail sizes efficiently
 	testq	%rbx,%rbx
 	jz	.Lopen_sse_finalize
 	cmpq	$192,%rbx
@@ -750,14 +750,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -818,7 +818,7 @@
 	paddd	0+96(%rbp),%xmm12
 
 	jmp	.Lopen_sse_tail_64_dec_loop
-
+// ############################################################################# 
 .Lopen_sse_tail_128:
 	movdqa	.Lchacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
@@ -866,14 +866,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -994,7 +994,7 @@
 	leaq	64(%rsi),%rsi
 	leaq	64(%rdi),%rdi
 	jmp	.Lopen_sse_tail_64_dec_loop
-
+// ############################################################################# 
 .Lopen_sse_tail_192:
 	movdqa	.Lchacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
@@ -1051,14 +1051,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -1227,14 +1227,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -1270,14 +1270,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -1324,7 +1324,7 @@
 	leaq	128(%rsi),%rsi
 	leaq	128(%rdi),%rdi
 	jmp	.Lopen_sse_tail_64_dec_loop
-
+// ############################################################################# 
 .Lopen_sse_tail_256:
 	movdqa	.Lchacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
@@ -1535,14 +1535,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -1606,14 +1606,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -1679,8 +1679,8 @@
 	subq	$192,%rbx
 	leaq	192(%rsi),%rsi
 	leaq	192(%rdi),%rdi
-
-
+// ############################################################################# 
+// Decrypt the remaining data, 16B at a time, using existing stream
 .Lopen_sse_tail_64_dec_loop:
 	cmpq	$16,%rbx
 	jb	.Lopen_sse_tail_16_init
@@ -1697,13 +1697,13 @@
 .Lopen_sse_tail_16_init:
 	movdqa	%xmm0,%xmm1
 
-
+// Decrypt up to 16 bytes at the end.
 .Lopen_sse_tail_16:
 	testq	%rbx,%rbx
 	jz	.Lopen_sse_finalize
 
-
-
+// Read the final bytes into %xmm3. They need to be read in reverse order so
+// that they end up in the correct order in %xmm3.
 	pxor	%xmm3,%xmm3
 	leaq	-1(%rsi,%rbx,1),%rsi
 	movq	%rbx,%r8
@@ -1716,10 +1716,10 @@
 
 	movq	%xmm3,%r13
 	pextrq	$1,%xmm3,%r14
-
+// The final bytes of keystream are in %xmm1.
 	pxor	%xmm1,%xmm3
 
-
+// Copy the plaintext bytes out.
 .Lopen_sse_tail_16_extract:
 	pextrb	$0,%xmm3,(%rdi)
 	psrldq	$1,%xmm3
@@ -1756,14 +1756,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -1799,19 +1799,19 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
-
+// Final reduce
 	movq	%r10,%r13
 	movq	%r11,%r14
 	movq	%r12,%r15
@@ -1821,14 +1821,14 @@
 	cmovcq	%r13,%r10
 	cmovcq	%r14,%r11
 	cmovcq	%r15,%r12
-
+// Add in s part of the key
 	addq	0+0+16(%rbp),%r10
 	adcq	8+0+16(%rbp),%r11
 
 .cfi_remember_state	
 	addq	$288 + 0 + 32,%rsp
 .cfi_adjust_cfa_offset	-(288 + 32)
-
+// The tag replaces the key on return
 	popq	%r9
 .cfi_adjust_cfa_offset	-8
 .cfi_restore	%r9
@@ -1853,7 +1853,7 @@
 .cfi_adjust_cfa_offset	-8
 .cfi_restore	%rbp
 	ret
-
+// ############################################################################# 
 .Lopen_sse_128:
 .cfi_restore_state	
 	movdqu	.Lchacha20_consts(%rip),%xmm0
@@ -2016,11 +2016,11 @@
 	paddd	%xmm15,%xmm13
 	paddd	.Lsse_inc(%rip),%xmm15
 	paddd	%xmm15,%xmm14
-
+// Clamp and store the key
 	pand	.Lclamp(%rip),%xmm0
 	movdqa	%xmm0,0+0(%rbp)
 	movdqa	%xmm4,0+16(%rbp)
-
+// Hash
 	movq	%r8,%r8
 	call	poly_hash_ad_internal
 .Lopen_sse_128_xor_hash:
@@ -2031,7 +2031,7 @@
 	adcq	8+0(%rsi),%r11
 	adcq	$1,%r12
 
-
+// Load for decryption
 	movdqu	0(%rsi),%xmm3
 	pxor	%xmm3,%xmm1
 	movdqu	%xmm1,0(%rdi)
@@ -2063,19 +2063,19 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
-
+// Shift the stream left
 	movdqa	%xmm5,%xmm1
 	movdqa	%xmm9,%xmm5
 	movdqa	%xmm13,%xmm9
@@ -2087,12 +2087,12 @@
 .size	chacha20_poly1305_open_sse41, .-chacha20_poly1305_open_sse41
 .cfi_endproc	
 
-
-
-
-
-
-
+// ############################################################################## 
+// ############################################################################## 
+// void chacha20_poly1305_seal(uint8_t *out_ciphertext, const uint8_t *plaintext,
+// size_t plaintext_len, const uint8_t *ad,
+// size_t ad_len,
+// union chacha20_poly1305_seal_data *data);
 .globl	chacha20_poly1305_seal_sse41
 .hidden chacha20_poly1305_seal_sse41
 .type	chacha20_poly1305_seal_sse41,@function
@@ -2118,8 +2118,8 @@
 	pushq	%r15
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r15,-56
-
-
+// We write the calculated authenticator back to keyp at the end, so save
+// the pointer on the stack too.
 	pushq	%r9
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r9,-64
@@ -2128,7 +2128,7 @@
 	leaq	32(%rsp),%rbp
 	andq	$-32,%rbp
 
-	movq	56(%r9),%rbx
+	movq	56(%r9),%rbx  // extra_in_len
 	addq	%rdx,%rbx
 	movq	%r8,0+0+32(%rbp)
 	movq	%rbx,8+0+32(%rbp)
@@ -2136,7 +2136,7 @@
 
 	cmpq	$128,%rbx
 	jbe	.Lseal_sse_128
-
+// For longer buffers, prepare the poly key + some stream
 	movdqa	.Lchacha20_consts(%rip),%xmm0
 	movdqu	0(%r9),%xmm4
 	movdqu	16(%r9),%xmm8
@@ -2157,7 +2157,7 @@
 	paddd	.Lsse_inc(%rip),%xmm12
 	movdqa	%xmm12,%xmm13
 	paddd	.Lsse_inc(%rip),%xmm12
-
+// Store on stack
 	movdqa	%xmm4,0+48(%rbp)
 	movdqa	%xmm8,0+64(%rbp)
 	movdqa	%xmm12,0+96(%rbp)
@@ -2370,11 +2370,11 @@
 	paddd	0+64(%rbp),%xmm8
 	paddd	0+96(%rbp),%xmm12
 
-
+// Clamp and store the key
 	pand	.Lclamp(%rip),%xmm3
 	movdqa	%xmm3,0+0(%rbp)
 	movdqa	%xmm7,0+16(%rbp)
-
+// Hash
 	movq	%r8,%r8
 	call	poly_hash_ad_internal
 	movdqu	0 + 0(%rsi),%xmm3
@@ -2591,14 +2591,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -2719,14 +2719,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -2827,7 +2827,7 @@
 	ja	.Lseal_sse_tail_192
 	cmpq	$64,%rbx
 	ja	.Lseal_sse_tail_128
-
+// ############################################################################# 
 .Lseal_sse_tail_64:
 	movdqa	.Lchacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
@@ -2866,14 +2866,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -2951,14 +2951,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -2974,7 +2974,7 @@
 	paddd	0+96(%rbp),%xmm12
 
 	jmp	.Lseal_sse_128_tail_xor
-
+// ############################################################################# 
 .Lseal_sse_tail_128:
 	movdqa	.Lchacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
@@ -3019,14 +3019,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3104,14 +3104,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3188,7 +3188,7 @@
 	subq	$64,%rbx
 	leaq	64(%rsi),%rsi
 	jmp	.Lseal_sse_128_tail_hash
-
+// ############################################################################# 
 .Lseal_sse_tail_192:
 	movdqa	.Lchacha20_consts(%rip),%xmm0
 	movdqa	0+48(%rbp),%xmm4
@@ -3239,14 +3239,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3345,14 +3345,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3465,7 +3465,7 @@
 	movq	$128,%rcx
 	subq	$128,%rbx
 	leaq	128(%rsi),%rsi
-
+// ############################################################################# 
 .Lseal_sse_128_tail_hash:
 	cmpq	$16,%rcx
 	jb	.Lseal_sse_128_tail_xor
@@ -3498,14 +3498,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3518,11 +3518,11 @@
 	cmpq	$16,%rbx
 	jb	.Lseal_sse_tail_16
 	subq	$16,%rbx
-
+// Load for decryption
 	movdqu	0(%rsi),%xmm3
 	pxor	%xmm3,%xmm0
 	movdqu	%xmm0,0(%rdi)
-
+// Then hash
 	addq	0(%rdi),%r10
 	adcq	8(%rdi),%r11
 	adcq	$1,%r12
@@ -3554,19 +3554,19 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
-
+// Shift the stream left
 	movdqa	%xmm4,%xmm0
 	movdqa	%xmm8,%xmm4
 	movdqa	%xmm12,%xmm8
@@ -3579,7 +3579,7 @@
 .Lseal_sse_tail_16:
 	testq	%rbx,%rbx
 	jz	.Lprocess_blocks_of_extra_in
-
+// We can only load the PT one byte at a time to avoid buffer overread
 	movq	%rbx,%r8
 	movq	%rbx,%rcx
 	leaq	-1(%rsi,%rbx,1),%rsi
@@ -3591,10 +3591,10 @@
 	decq	%rcx
 	jne	.Lseal_sse_tail_16_compose
 
-
+// XOR the keystream with the plaintext.
 	pxor	%xmm0,%xmm15
 
-
+// Write ciphertext out, byte-by-byte.
 	movq	%rbx,%rcx
 	movdqu	%xmm15,%xmm0
 .Lseal_sse_tail_16_extract:
@@ -3604,42 +3604,42 @@
 	subq	$1,%rcx
 	jnz	.Lseal_sse_tail_16_extract
 
-
-
-
-
-
-
-
+// %xmm15 contains the final (partial, non-empty) block of ciphertext which
+// needs to be fed into the Poly1305 state. The right-most %rbx bytes of it
+// are valid. We need to fill it with extra_in bytes until full, or until we
+// run out of bytes.
+// 
+// %r9 points to the tag output, which is actually a struct with the
+// extra_in pointer and length at offset 48.
 	movq	288 + 0 + 32(%rsp),%r9
-	movq	56(%r9),%r14
-	movq	48(%r9),%r13
+	movq	56(%r9),%r14  // extra_in_len
+	movq	48(%r9),%r13  // extra_in
 	testq	%r14,%r14
-	jz	.Lprocess_partial_block
+	jz	.Lprocess_partial_block  // Common case: no bytes of extra_in
 
 	movq	$16,%r15
-	subq	%rbx,%r15
-	cmpq	%r15,%r14
-
+	subq	%rbx,%r15  // 16-%rbx is the number of bytes that fit into %xmm15.
+	cmpq	%r15,%r14  // if extra_in_len < 16-%rbx, only copy extra_in_len
+// (note that AT&T syntax reverses the arguments)
 	jge	.Lload_extra_in
 	movq	%r14,%r15
 
 .Lload_extra_in:
-
-
+// %r15 contains the number of bytes of extra_in (pointed to by %r13) to load
+// into %xmm15. They are loaded in reverse order.
 	leaq	-1(%r13,%r15,1),%rsi
-
-
+// Update extra_in and extra_in_len to reflect the bytes that are about to
+// be read.
 	addq	%r15,%r13
 	subq	%r15,%r14
 	movq	%r13,48(%r9)
 	movq	%r14,56(%r9)
 
-
-
+// Update %r8, which is used to select the mask later on, to reflect the
+// extra bytes about to be added.
 	addq	%r15,%r8
 
-
+// Load %r15 bytes of extra_in into %xmm11.
 	pxor	%xmm11,%xmm11
 .Lload_extra_load_loop:
 	pslldq	$1,%xmm11
@@ -3648,9 +3648,9 @@
 	subq	$1,%r15
 	jnz	.Lload_extra_load_loop
 
-
-
-
+// Shift %xmm11 up the length of the remainder from the main encryption. Sadly,
+// the shift for an XMM register has to be a constant, thus we loop to do
+// this.
 	movq	%rbx,%r15
 
 .Lload_extra_shift_loop:
@@ -3658,18 +3658,18 @@
 	subq	$1,%r15
 	jnz	.Lload_extra_shift_loop
 
-
-
-
+// Mask %xmm15 (the remainder from the main encryption) so that superfluous
+// bytes are zero. This means that the non-zero bytes in %xmm11 and %xmm15 are
+// disjoint and so we can merge them with an OR.
 	leaq	.Land_masks(%rip),%r15
 	shlq	$4,%rbx
 	pand	-16(%r15,%rbx,1),%xmm15
 
-
+// Merge %xmm11 into %xmm15, forming the remainder block.
 	por	%xmm11,%xmm15
 
-
-
+// The block of ciphertext + extra_in is ready to be included in the
+// Poly1305 state.
 	movq	%xmm15,%r13
 	pextrq	$1,%xmm15,%r14
 	addq	%r13,%r10
@@ -3701,26 +3701,26 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
 
 .Lprocess_blocks_of_extra_in:
-
+// There may be additional bytes of extra_in to process.
 	movq	288+32+0 (%rsp),%r9
-	movq	48(%r9),%rsi
-	movq	56(%r9),%r8
+	movq	48(%r9),%rsi  // extra_in
+	movq	56(%r9),%r8  // extra_in_len
 	movq	%r8,%rcx
-	shrq	$4,%r8
+	shrq	$4,%r8  // number of blocks
 
 .Lprocess_extra_hash_loop:
 	jz	process_extra_in_trailer
@@ -3753,14 +3753,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3769,7 +3769,7 @@
 	subq	$1,%r8
 	jmp	.Lprocess_extra_hash_loop
 process_extra_in_trailer:
-	andq	$15,%rcx
+	andq	$15,%rcx  // remaining num bytes (<16) of extra_in
 	movq	%rcx,%rbx
 	jz	.Ldo_length_block
 	leaq	-1(%rsi,%rcx,1),%rsi
@@ -3782,7 +3782,7 @@
 	jnz	.Lprocess_extra_in_trailer_load
 
 .Lprocess_partial_block:
-
+// %xmm15 contains %rbx bytes of data to be fed into Poly1305. %rbx
 	leaq	.Land_masks(%rip),%r15
 	shlq	$4,%rbx
 	pand	-16(%r15,%rbx,1),%xmm15
@@ -3817,14 +3817,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -3860,19 +3860,19 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
-
+// Final reduce
 	movq	%r10,%r13
 	movq	%r11,%r14
 	movq	%r12,%r15
@@ -3882,14 +3882,14 @@
 	cmovcq	%r13,%r10
 	cmovcq	%r14,%r11
 	cmovcq	%r15,%r12
-
+// Add in s part of the key
 	addq	0+0+16(%rbp),%r10
 	adcq	8+0+16(%rbp),%r11
 
 .cfi_remember_state	
 	addq	$288 + 0 + 32,%rsp
 .cfi_adjust_cfa_offset	-(288 + 32)
-
+// The tag replaces the key on return
 	popq	%r9
 .cfi_adjust_cfa_offset	-8
 .cfi_restore	%r9
@@ -3914,7 +3914,7 @@
 .cfi_adjust_cfa_offset	-8
 .cfi_restore	%rbp
 	ret
-
+// ############################################################################## 
 .Lseal_sse_128:
 .cfi_restore_state	
 	movdqu	.Lchacha20_consts(%rip),%xmm0
@@ -4077,18 +4077,18 @@
 	paddd	%xmm15,%xmm12
 	paddd	.Lsse_inc(%rip),%xmm15
 	paddd	%xmm15,%xmm13
-
+// Clamp and store the key
 	pand	.Lclamp(%rip),%xmm2
 	movdqa	%xmm2,0+0(%rbp)
 	movdqa	%xmm6,0+16(%rbp)
-
+// Hash
 	movq	%r8,%r8
 	call	poly_hash_ad_internal
 	jmp	.Lseal_sse_128_tail_xor
 .size	chacha20_poly1305_seal_sse41, .-chacha20_poly1305_seal_sse41
 .cfi_endproc	
 
-
+// ############################################################################# 
 .globl	chacha20_poly1305_open_avx2
 .hidden chacha20_poly1305_open_avx2
 .type	chacha20_poly1305_open_avx2,@function
@@ -4114,8 +4114,8 @@
 	pushq	%r15
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r15,-56
-
-
+// We write the calculated authenticator back to keyp at the end, so save
+// the pointer on the stack too.
 	pushq	%r9
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r9,-64
@@ -4192,16 +4192,16 @@
 	vpaddd	0+160(%rbp),%ymm12,%ymm12
 
 	vperm2i128	$0x02,%ymm0,%ymm4,%ymm3
-
+// Clamp and store key
 	vpand	.Lclamp(%rip),%ymm3,%ymm3
 	vmovdqa	%ymm3,0+0(%rbp)
-
+// Stream for the first 64 bytes
 	vperm2i128	$0x13,%ymm0,%ymm4,%ymm0
 	vperm2i128	$0x13,%ymm8,%ymm12,%ymm4
-
+// Hash AD + first 64 bytes
 	movq	%r8,%r8
 	call	poly_hash_ad_internal
-
+// Hash first 64 bytes
 	xorq	%rcx,%rcx
 .Lopen_avx2_init_hash:
 	addq	0+0(%rsi,%rcx,1),%r10
@@ -4233,14 +4233,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4248,17 +4248,17 @@
 	addq	$16,%rcx
 	cmpq	$64,%rcx
 	jne	.Lopen_avx2_init_hash
-
+// Decrypt first 64 bytes
 	vpxor	0(%rsi),%ymm0,%ymm0
 	vpxor	32(%rsi),%ymm4,%ymm4
-
+// Store first 64 bytes of decrypted data
 	vmovdqu	%ymm0,0(%rdi)
 	vmovdqu	%ymm4,32(%rdi)
 	leaq	64(%rsi),%rsi
 	leaq	64(%rdi),%rdi
 	subq	$64,%rbx
 .Lopen_avx2_main_loop:
-
+// Hash and decrypt 512 bytes each iteration
 	cmpq	$512,%rbx
 	jb	.Lopen_avx2_main_loop_done
 	vmovdqa	.Lchacha20_consts(%rip),%ymm0
@@ -4348,14 +4348,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4443,14 +4443,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4538,14 +4538,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4614,14 +4614,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4678,14 +4678,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4728,7 +4728,7 @@
 	movq	%rbx,%rcx
 	andq	$-16,%rcx
 	testq	%rcx,%rcx
-	je	.Lopen_avx2_tail_128_rounds
+	je	.Lopen_avx2_tail_128_rounds  // Have nothing to hash
 .Lopen_avx2_tail_128_rounds_and_x1hash:
 	addq	0+0(%rsi,%r8,1),%r10
 	adcq	8+0(%rsi,%r8,1),%r11
@@ -4759,14 +4759,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -4827,7 +4827,7 @@
 	vmovdqa	%ymm3,%ymm8
 
 	jmp	.Lopen_avx2_tail_128_xor
-
+// ############################################################################# 
 .Lopen_avx2_tail_256:
 	vmovdqa	.Lchacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -4873,14 +4873,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5019,14 +5019,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5064,7 +5064,7 @@
 	leaq	128(%rdi),%rdi
 	subq	$128,%rbx
 	jmp	.Lopen_avx2_tail_128_xor
-
+// ############################################################################# 
 .Lopen_avx2_tail_384:
 	vmovdqa	.Lchacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -5116,14 +5116,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5216,14 +5216,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5322,14 +5322,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5383,7 +5383,7 @@
 	leaq	256(%rdi),%rdi
 	subq	$256,%rbx
 	jmp	.Lopen_avx2_tail_128_xor
-
+// ############################################################################# 
 .Lopen_avx2_tail_512:
 	vmovdqa	.Lchacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -5439,14 +5439,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5512,14 +5512,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5593,14 +5593,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5719,14 +5719,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -5817,7 +5817,7 @@
 	vmovdqa	%xmm0,%xmm1
 	jb	.Lopen_avx2_exit
 	subq	$16,%rbx
-
+// load for decryption
 	vpxor	(%rsi),%xmm0,%xmm1
 	vmovdqu	%xmm1,(%rdi)
 	leaq	16(%rsi),%rsi
@@ -5827,7 +5827,7 @@
 .Lopen_avx2_exit:
 	vzeroupper
 	jmp	.Lopen_sse_tail_16
-
+// ############################################################################# 
 .Lopen_avx2_192:
 	vmovdqa	%ymm0,%ymm1
 	vmovdqa	%ymm0,%ymm2
@@ -5928,10 +5928,10 @@
 	vpaddd	%ymm11,%ymm12,%ymm12
 	vpaddd	%ymm15,%ymm13,%ymm13
 	vperm2i128	$0x02,%ymm0,%ymm4,%ymm3
-
+// Clamp and store the key
 	vpand	.Lclamp(%rip),%ymm3,%ymm3
 	vmovdqa	%ymm3,0+0(%rbp)
-
+// Stream for up to 192 bytes
 	vperm2i128	$0x13,%ymm0,%ymm4,%ymm0
 	vperm2i128	$0x13,%ymm8,%ymm12,%ymm4
 	vperm2i128	$0x02,%ymm1,%ymm5,%ymm8
@@ -5974,14 +5974,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -6014,24 +6014,24 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
-
+// Load + decrypt
 	vpxor	(%rsi),%ymm0,%ymm0
 	vmovdqu	%ymm0,(%rdi)
 	leaq	32(%rsi),%rsi
 	leaq	32(%rdi),%rdi
-
+// Shift stream
 	vmovdqa	%ymm4,%ymm0
 	vmovdqa	%ymm8,%ymm4
 	vmovdqa	%ymm12,%ymm8
@@ -6076,14 +6076,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -6096,7 +6096,7 @@
 .Lopen_avx2_short_tail_32_exit:
 	vzeroupper
 	jmp	.Lopen_sse_tail_16
-
+// ############################################################################# 
 .Lopen_avx2_320:
 	vmovdqa	%ymm0,%ymm1
 	vmovdqa	%ymm0,%ymm2
@@ -6243,10 +6243,10 @@
 	vpaddd	0+192(%rbp),%ymm13,%ymm13
 	vpaddd	0+224(%rbp),%ymm14,%ymm14
 	vperm2i128	$0x02,%ymm0,%ymm4,%ymm3
-
+// Clamp and store the key
 	vpand	.Lclamp(%rip),%ymm3,%ymm3
 	vmovdqa	%ymm3,0+0(%rbp)
-
+// Stream for up to 320 bytes
 	vperm2i128	$0x13,%ymm0,%ymm4,%ymm0
 	vperm2i128	$0x13,%ymm8,%ymm12,%ymm4
 	vperm2i128	$0x02,%ymm1,%ymm5,%ymm8
@@ -6260,8 +6260,8 @@
 	jmp	.Lopen_avx2_short
 .size	chacha20_poly1305_open_avx2, .-chacha20_poly1305_open_avx2
 .cfi_endproc	
-
-
+// ############################################################################# 
+// ############################################################################# 
 .globl	chacha20_poly1305_seal_avx2
 .hidden chacha20_poly1305_seal_avx2
 .type	chacha20_poly1305_seal_avx2,@function
@@ -6287,8 +6287,8 @@
 	pushq	%r15
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r15,-56
-
-
+// We write the calculated authenticator back to keyp at the end, so save
+// the pointer on the stack too.
 	pushq	%r9
 .cfi_adjust_cfa_offset	8
 .cfi_offset	%r9,-64
@@ -6297,7 +6297,7 @@
 	leaq	32(%rsp),%rbp
 	andq	$-32,%rbp
 
-	movq	56(%r9),%rbx
+	movq	56(%r9),%rbx  // extra_in_len
 	addq	%rdx,%rbx
 	movq	%r8,0+0+32(%rbp)
 	movq	%rbx,8+0+32(%rbp)
@@ -6525,7 +6525,7 @@
 	vmovdqa	%ymm15,0+0(%rbp)
 	movq	%r8,%r8
 	call	poly_hash_ad_internal
-
+// Safely store 320 bytes (otherwise would handle with optimized call)
 	vpxor	0(%rsi),%ymm3,%ymm3
 	vpxor	32(%rsi),%ymm11,%ymm11
 	vmovdqu	%ymm3,0(%rdi)
@@ -6905,14 +6905,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7002,14 +7002,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7097,14 +7097,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7152,14 +7152,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7185,14 +7185,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7276,14 +7276,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7309,14 +7309,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7331,7 +7331,7 @@
 	ja	.Lseal_avx2_tail_384
 	cmpq	$128,%rbx
 	ja	.Lseal_avx2_tail_256
-
+// ############################################################################# 
 .Lseal_avx2_tail_128:
 	vmovdqa	.Lchacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -7363,14 +7363,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7418,14 +7418,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7470,14 +7470,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7498,7 +7498,7 @@
 	vmovdqa	%ymm3,%ymm8
 
 	jmp	.Lseal_avx2_short_loop
-
+// ############################################################################# 
 .Lseal_avx2_tail_256:
 	vmovdqa	.Lchacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -7542,14 +7542,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7623,14 +7623,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7701,14 +7701,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7748,7 +7748,7 @@
 	leaq	128(%rsi),%rsi
 	subq	$128,%rbx
 	jmp	.Lseal_avx2_short_hash_remainder
-
+// ############################################################################# 
 .Lseal_avx2_tail_384:
 	vmovdqa	.Lchacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -7797,14 +7797,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7878,14 +7878,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -7956,14 +7956,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -8057,7 +8057,7 @@
 	leaq	256(%rsi),%rsi
 	subq	$256,%rbx
 	jmp	.Lseal_avx2_short_hash_remainder
-
+// ############################################################################# 
 .Lseal_avx2_tail_512:
 	vmovdqa	.Lchacha20_consts(%rip),%ymm0
 	vmovdqa	0+64(%rbp),%ymm4
@@ -8104,14 +8104,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -8240,14 +8240,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -8373,14 +8373,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -8456,7 +8456,7 @@
 	leaq	384(%rsi),%rsi
 	subq	$384,%rbx
 	jmp	.Lseal_avx2_short_hash_remainder
-
+// ############################################################################## 
 .Lseal_avx2_320:
 	vmovdqa	%ymm0,%ymm1
 	vmovdqa	%ymm0,%ymm2
@@ -8603,10 +8603,10 @@
 	vpaddd	0+192(%rbp),%ymm13,%ymm13
 	vpaddd	0+224(%rbp),%ymm14,%ymm14
 	vperm2i128	$0x02,%ymm0,%ymm4,%ymm3
-
+// Clamp and store the key
 	vpand	.Lclamp(%rip),%ymm3,%ymm3
 	vmovdqa	%ymm3,0+0(%rbp)
-
+// Stream for up to 320 bytes
 	vperm2i128	$0x13,%ymm0,%ymm4,%ymm0
 	vperm2i128	$0x13,%ymm8,%ymm12,%ymm4
 	vperm2i128	$0x02,%ymm1,%ymm5,%ymm8
@@ -8618,7 +8618,7 @@
 	vperm2i128	$0x13,%ymm2,%ymm6,%ymm2
 	vperm2i128	$0x13,%ymm10,%ymm14,%ymm6
 	jmp	.Lseal_avx2_short
-
+// ############################################################################## 
 .Lseal_avx2_192:
 	vmovdqa	%ymm0,%ymm1
 	vmovdqa	%ymm0,%ymm2
@@ -8719,10 +8719,10 @@
 	vpaddd	%ymm11,%ymm12,%ymm12
 	vpaddd	%ymm15,%ymm13,%ymm13
 	vperm2i128	$0x02,%ymm0,%ymm4,%ymm3
-
+// Clamp and store the key
 	vpand	.Lclamp(%rip),%ymm3,%ymm3
 	vmovdqa	%ymm3,0+0(%rbp)
-
+// Stream for up to 192 bytes
 	vperm2i128	$0x13,%ymm0,%ymm4,%ymm0
 	vperm2i128	$0x13,%ymm8,%ymm12,%ymm4
 	vperm2i128	$0x02,%ymm1,%ymm5,%ymm8
@@ -8765,14 +8765,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -8784,11 +8784,11 @@
 	cmpq	$32,%rbx
 	jb	.Lseal_avx2_short_tail
 	subq	$32,%rbx
-
+// Encrypt
 	vpxor	(%rsi),%ymm0,%ymm0
 	vmovdqu	%ymm0,(%rdi)
 	leaq	32(%rsi),%rsi
-
+// Load + hash
 	addq	0+0(%rdi),%r10
 	adcq	8+0(%rdi),%r11
 	adcq	$1,%r12
@@ -8818,14 +8818,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
@@ -8858,20 +8858,20 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12
 
 	leaq	32(%rdi),%rdi
-
+// Shift stream
 	vmovdqa	%ymm4,%ymm0
 	vmovdqa	%ymm8,%ymm4
 	vmovdqa	%ymm12,%ymm8
@@ -8918,14 +8918,14 @@
 	movq	%r13,%r10
 	movq	%r14,%r11
 	movq	%r15,%r12
-	andq	$3,%r12
+	andq	$3,%r12  // At this point acc2 is 2 bits at most (value of 3)
 	movq	%r15,%r13
 	andq	$-4,%r13
 	movq	%r9,%r14
 	shrdq	$2,%r9,%r15
 	shrq	$2,%r9
 	addq	%r13,%r15
-	adcq	%r14,%r9
+	adcq	%r14,%r9  // No carry out since t3 is 61 bits and t1 is 63 bits
 	addq	%r15,%r10
 	adcq	%r9,%r11
 	adcq	$0,%r12

boringssl-0.20260708.tar.xz/gen/crypto/chacha20_poly1305_x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/crypto/chacha20_poly1305_x86_64-win.asm Changed

@@ -64,7 +64,7 @@
 	cmp	r8,13
 	jne	NEAR $L$hash_ad_loop
 $L$poly_fast_tls_ad:
-
+; Special treatment for the TLS case of 13 bytes
 	mov	r10,QWORDrcx
 	mov	r11,QWORD5+rcx
 	shr	r11,24
@@ -95,21 +95,21 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
 
 	ret
 $L$hash_ad_loop:
-
+; Hash in 16 byte chunk
 	cmp	r8,16
 	jb	NEAR $L$hash_ad_tail
 	add	r10,QWORD((0+0))+rcx
@@ -141,14 +141,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -159,7 +159,7 @@
 $L$hash_ad_tail:
 	cmp	r8,0
 	je	NEAR $L$hash_ad_done
-
+; Hash last < 16 byte tail
 	xor	r13,r13
 	xor	r14,r14
 	xor	r15,r15
@@ -202,19 +202,19 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
 
-
+; Finished AD
 $L$hash_ad_done:
 	ret
 
@@ -250,8 +250,8 @@
 
 	push	r15
 
-
-
+; We write the calculated authenticator back to keyp at the end, so save
+; the pointer on the stack too.
 	push	r9
 
 	sub	rsp,288 + 160 + 32
@@ -277,14 +277,14 @@
 
 	cmp	rbx,128
 	jbe	NEAR $L$open_sse_128
-
+; For long buffers, prepare the poly key first
 	movdqa	xmm0,XMMWORD$L$chacha20_consts
 	movdqu	xmm4,XMMWORDr9
 	movdqu	xmm8,XMMWORD16+r9
 	movdqu	xmm12,XMMWORD32+r9
 
 	movdqa	xmm7,xmm12
-
+; Store on stack, to free keyp
 	movdqa	XMMWORD(160+48)+rbp,xmm4
 	movdqa	XMMWORD(160+64)+rbp,xmm8
 	movdqa	XMMWORD(160+96)+rbp,xmm12
@@ -335,20 +335,20 @@
 
 	dec	r10
 	jne	NEAR $L$open_sse_init_rounds
-
+; A0|B0 hold the Poly1305 32-byte key, C0,D0 can be discarded
 	paddd	xmm0,XMMWORD$L$chacha20_consts
 	paddd	xmm4,XMMWORD((160+48))+rbp
-
+; Clamp and store the key
 	pand	xmm0,XMMWORD$L$clamp
 	movdqa	XMMWORD(160+0)+rbp,xmm0
 	movdqa	XMMWORD(160+16)+rbp,xmm4
-
+; Hash
 	mov	r8,r8
 	call	poly_hash_ad_internal
 $L$open_sse_main_loop:
 	cmp	rbx,16*16
 	jb	NEAR $L$open_sse_tail
-
+; Load state, increment counter blocks
 	movdqa	xmm0,XMMWORD$L$chacha20_consts
 	movdqa	xmm4,XMMWORD((160+48))+rbp
 	movdqa	xmm8,XMMWORD((160+64))+rbp
@@ -374,8 +374,8 @@
 	movdqa	XMMWORD(160+128)+rbp,xmm14
 	movdqa	XMMWORD(160+144)+rbp,xmm15
 
-
-
+; There are 10 ChaCha20 iterations of 2QR each, so for 6 iterations we
+; hash 2 blocks, and for the remaining 4 only 1 block - for a total of 16
 	mov	rcx,4
 	mov	r8,rsi
 $L$open_sse_main_loop_rounds:
@@ -510,14 +510,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -637,14 +637,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -723,7 +723,7 @@
 	sub	rbx,16*16
 	jmp	NEAR $L$open_sse_main_loop
 $L$open_sse_tail:
-
+; Handle the various tail sizes efficiently
 	test	rbx,rbx
 	jz	NEAR $L$open_sse_finalize
 	cmp	rbx,12*16
@@ -773,14 +773,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -841,7 +841,7 @@
 	paddd	xmm12,XMMWORD((160+96))+rbp
 
 	jmp	NEAR $L$open_sse_tail_64_dec_loop
-
+; ##############################################################################
 $L$open_sse_tail_128:
 	movdqa	xmm0,XMMWORD$L$chacha20_consts
 	movdqa	xmm4,XMMWORD((160+48))+rbp
@@ -889,14 +889,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -1017,7 +1017,7 @@
 	lea	rsi,64+rsi
 	lea	rdi,64+rdi
 	jmp	NEAR $L$open_sse_tail_64_dec_loop
-
+; ##############################################################################
 $L$open_sse_tail_192:
 	movdqa	xmm0,XMMWORD$L$chacha20_consts
 	movdqa	xmm4,XMMWORD((160+48))+rbp
@@ -1074,14 +1074,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -1250,14 +1250,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -1293,14 +1293,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -1347,7 +1347,7 @@
 	lea	rsi,128+rsi
 	lea	rdi,128+rdi
 	jmp	NEAR $L$open_sse_tail_64_dec_loop
-
+; ##############################################################################
 $L$open_sse_tail_256:
 	movdqa	xmm0,XMMWORD$L$chacha20_consts
 	movdqa	xmm4,XMMWORD((160+48))+rbp
@@ -1558,14 +1558,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -1629,14 +1629,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -1702,8 +1702,8 @@
 	sub	rbx,12*16
 	lea	rsi,192+rsi
 	lea	rdi,192+rdi
-
-
+; ##############################################################################
+; Decrypt the remaining data, 16B at a time, using existing stream
 $L$open_sse_tail_64_dec_loop:
 	cmp	rbx,16
 	jb	NEAR $L$open_sse_tail_16_init
@@ -1720,13 +1720,13 @@
 $L$open_sse_tail_16_init:
 	movdqa	xmm1,xmm0
 
-
+; Decrypt up to 16 bytes at the end.
 $L$open_sse_tail_16:
 	test	rbx,rbx
 	jz	NEAR $L$open_sse_finalize
 
-
-
+; Read the final bytes into %xmm3. They need to be read in reverse order so
+; that they end up in the correct order in %xmm3.
 	pxor	xmm3,xmm3
 	lea	rsi,((-1))+rbx*1+rsi
 	mov	r8,rbx
@@ -1739,10 +1739,10 @@
 
 	movq	r13,xmm3
 	pextrq	r14,xmm3,1
-
+; The final bytes of keystream are in %xmm1.
 	pxor	xmm3,xmm1
 
-
+; Copy the plaintext bytes out.
 $L$open_sse_tail_16_extract:
 	pextrb	XMMWORDrdi,xmm3,0
 	psrldq	xmm3,1
@@ -1779,14 +1779,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -1822,19 +1822,19 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
 
-
+; Final reduce
 	mov	r13,r10
 	mov	r14,r11
 	mov	r15,r12
@@ -1844,7 +1844,7 @@
 	cmovc	r10,r13
 	cmovc	r11,r14
 	cmovc	r12,r15
-
+; Add in s part of the key
 	add	r10,QWORD((0+160+16))+rbp
 	adc	r11,QWORD((8+160+16))+rbp
 
@@ -1862,7 +1862,7 @@
 
 	add	rsp,288 + 160 + 32
 
-
+; The tag replaces the key on return
 	pop	r9
 
 	mov	QWORDr9,r10
@@ -1882,7 +1882,7 @@
 	mov	rdi,QWORD8+rsp	;WIN64 epilogue
 	mov	rsi,QWORD16+rsp
 	ret
-
+; ##############################################################################
 $L$open_sse_128:
 
 	movdqu	xmm0,XMMWORD$L$chacha20_consts
@@ -2045,11 +2045,11 @@
 	paddd	xmm13,xmm15
 	paddd	xmm15,XMMWORD$L$sse_inc
 	paddd	xmm14,xmm15
-
+; Clamp and store the key
 	pand	xmm0,XMMWORD$L$clamp
 	movdqa	XMMWORD(160+0)+rbp,xmm0
 	movdqa	XMMWORD(160+16)+rbp,xmm4
-
+; Hash
 	mov	r8,r8
 	call	poly_hash_ad_internal
 $L$open_sse_128_xor_hash:
@@ -2060,7 +2060,7 @@
 	adc	r11,QWORD((8+0))+rsi
 	adc	r12,1
 
-
+; Load for decryption
 	movdqu	xmm3,XMMWORDrsi
 	pxor	xmm1,xmm3
 	movdqu	XMMWORDrdi,xmm1
@@ -2092,19 +2092,19 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
 
-
+; Shift the stream left
 	movdqa	xmm1,xmm5
 	movdqa	xmm5,xmm9
 	movdqa	xmm9,xmm13
@@ -2116,12 +2116,12 @@
 $L$SEH_end_chacha20_poly1305_open_sse41:
 
 
-
-
-
-
-
-
+; ###############################################################################
+; ###############################################################################
+; void chacha20_poly1305_seal(uint8_t *out_ciphertext, const uint8_t *plaintext,
+; size_t plaintext_len, const uint8_t *ad,
+; size_t ad_len,
+; union chacha20_poly1305_seal_data *data);
 global	chacha20_poly1305_seal_sse41
 
 ALIGN	64
@@ -2152,8 +2152,8 @@
 
 	push	r15
 
-
-
+; We write the calculated authenticator back to keyp at the end, so save
+; the pointer on the stack too.
 	push	r9
 
 	sub	rsp,288 + 160 + 32
@@ -2172,7 +2172,7 @@
 	movaps	XMMWORD(128+0)+rbp,xmm14
 	movaps	XMMWORD(144+0)+rbp,xmm15
 
-	mov	rbx,QWORD56+r9
+	mov	rbx,QWORD56+r9  ; extra_in_len
 	add	rbx,rdx
 	mov	QWORD((0+160+32))+rbp,r8
 	mov	QWORD((8+160+32))+rbp,rbx
@@ -2180,7 +2180,7 @@
 
 	cmp	rbx,128
 	jbe	NEAR $L$seal_sse_128
-
+; For longer buffers, prepare the poly key + some stream
 	movdqa	xmm0,XMMWORD$L$chacha20_consts
 	movdqu	xmm4,XMMWORDr9
 	movdqu	xmm8,XMMWORD16+r9
@@ -2201,7 +2201,7 @@
 	paddd	xmm12,XMMWORD$L$sse_inc
 	movdqa	xmm13,xmm12
 	paddd	xmm12,XMMWORD$L$sse_inc
-
+; Store on stack
 	movdqa	XMMWORD(160+48)+rbp,xmm4
 	movdqa	XMMWORD(160+64)+rbp,xmm8
 	movdqa	XMMWORD(160+96)+rbp,xmm12
@@ -2414,11 +2414,11 @@
 	paddd	xmm8,XMMWORD((160+64))+rbp
 	paddd	xmm12,XMMWORD((160+96))+rbp
 
-
+; Clamp and store the key
 	pand	xmm3,XMMWORD$L$clamp
 	movdqa	XMMWORD(160+0)+rbp,xmm3
 	movdqa	XMMWORD(160+16)+rbp,xmm7
-
+; Hash
 	mov	r8,r8
 	call	poly_hash_ad_internal
 	movdqu	xmm3,XMMWORD((0 + 0))+rsi
@@ -2635,14 +2635,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -2763,14 +2763,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -2871,7 +2871,7 @@
 	ja	NEAR $L$seal_sse_tail_192
 	cmp	rbx,4*16
 	ja	NEAR $L$seal_sse_tail_128
-
+; ##############################################################################
 $L$seal_sse_tail_64:
 	movdqa	xmm0,XMMWORD$L$chacha20_consts
 	movdqa	xmm4,XMMWORD((160+48))+rbp
@@ -2910,14 +2910,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -2995,14 +2995,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -3018,7 +3018,7 @@
 	paddd	xmm12,XMMWORD((160+96))+rbp
 
 	jmp	NEAR $L$seal_sse_128_tail_xor
-
+; ##############################################################################
 $L$seal_sse_tail_128:
 	movdqa	xmm0,XMMWORD$L$chacha20_consts
 	movdqa	xmm4,XMMWORD((160+48))+rbp
@@ -3063,14 +3063,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -3148,14 +3148,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -3232,7 +3232,7 @@
 	sub	rbx,4*16
 	lea	rsi,64+rsi
 	jmp	NEAR $L$seal_sse_128_tail_hash
-
+; ##############################################################################
 $L$seal_sse_tail_192:
 	movdqa	xmm0,XMMWORD$L$chacha20_consts
 	movdqa	xmm4,XMMWORD((160+48))+rbp
@@ -3283,14 +3283,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -3389,14 +3389,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -3509,7 +3509,7 @@
 	mov	rcx,8*16
 	sub	rbx,8*16
 	lea	rsi,128+rsi
-
+; ##############################################################################
 $L$seal_sse_128_tail_hash:
 	cmp	rcx,16
 	jb	NEAR $L$seal_sse_128_tail_xor
@@ -3542,14 +3542,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -3562,11 +3562,11 @@
 	cmp	rbx,16
 	jb	NEAR $L$seal_sse_tail_16
 	sub	rbx,16
-
+; Load for decryption
 	movdqu	xmm3,XMMWORDrsi
 	pxor	xmm0,xmm3
 	movdqu	XMMWORDrdi,xmm0
-
+; Then hash
 	add	r10,QWORDrdi
 	adc	r11,QWORD8+rdi
 	adc	r12,1
@@ -3598,19 +3598,19 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
 
-
+; Shift the stream left
 	movdqa	xmm0,xmm4
 	movdqa	xmm4,xmm8
 	movdqa	xmm8,xmm12
@@ -3623,7 +3623,7 @@
 $L$seal_sse_tail_16:
 	test	rbx,rbx
 	jz	NEAR $L$process_blocks_of_extra_in
-
+; We can only load the PT one byte at a time to avoid buffer overread
 	mov	r8,rbx
 	mov	rcx,rbx
 	lea	rsi,((-1))+rbx*1+rsi
@@ -3635,10 +3635,10 @@
 	dec	rcx
 	jne	NEAR $L$seal_sse_tail_16_compose
 
-
+; XOR the keystream with the plaintext.
 	pxor	xmm15,xmm0
 
-
+; Write ciphertext out, byte-by-byte.
 	mov	rcx,rbx
 	movdqu	xmm0,xmm15
 $L$seal_sse_tail_16_extract:
@@ -3648,42 +3648,42 @@
 	sub	rcx,1
 	jnz	NEAR $L$seal_sse_tail_16_extract
 
-
-
-
-
-
-
-
+; %xmm15 contains the final (partial, non-empty) block of ciphertext which
+; needs to be fed into the Poly1305 state. The right-most %rbx bytes of it
+; are valid. We need to fill it with extra_in bytes until full, or until we
+; run out of bytes.
+; 
+; %r9 points to the tag output, which is actually a struct with the
+; extra_in pointer and length at offset 48.
 	mov	r9,QWORD((288 + 160 + 32))+rsp
-	mov	r14,QWORD56+r9
-	mov	r13,QWORD48+r9
+	mov	r14,QWORD56+r9  ; extra_in_len
+	mov	r13,QWORD48+r9  ; extra_in
 	test	r14,r14
-	jz	NEAR $L$process_partial_block
+	jz	NEAR $L$process_partial_block  ; Common case: no bytes of extra_in
 
 	mov	r15,16
-	sub	r15,rbx
-	cmp	r14,r15
-
+	sub	r15,rbx  ; 16-%rbx is the number of bytes that fit into %xmm15.
+	cmp	r14,r15  ; if extra_in_len < 16-%rbx, only copy extra_in_len
+; (note that AT&T syntax reverses the arguments)
 	jge	NEAR $L$load_extra_in
 	mov	r15,r14
 
 $L$load_extra_in:
-
-
+; %r15 contains the number of bytes of extra_in (pointed to by %r13) to load
+; into %xmm15. They are loaded in reverse order.
 	lea	rsi,((-1))+r15*1+r13
-
-
+; Update extra_in and extra_in_len to reflect the bytes that are about to
+; be read.
 	add	r13,r15
 	sub	r14,r15
 	mov	QWORD48+r9,r13
 	mov	QWORD56+r9,r14
 
-
-
+; Update %r8, which is used to select the mask later on, to reflect the
+; extra bytes about to be added.
 	add	r8,r15
 
-
+; Load %r15 bytes of extra_in into %xmm11.
 	pxor	xmm11,xmm11
 $L$load_extra_load_loop:
 	pslldq	xmm11,1
@@ -3692,9 +3692,9 @@
 	sub	r15,1
 	jnz	NEAR $L$load_extra_load_loop
 
-
-
-
+; Shift %xmm11 up the length of the remainder from the main encryption. Sadly,
+; the shift for an XMM register has to be a constant, thus we loop to do
+; this.
 	mov	r15,rbx
 
 $L$load_extra_shift_loop:
@@ -3702,18 +3702,18 @@
 	sub	r15,1
 	jnz	NEAR $L$load_extra_shift_loop
 
-
-
-
+; Mask %xmm15 (the remainder from the main encryption) so that superfluous
+; bytes are zero. This means that the non-zero bytes in %xmm11 and %xmm15 are
+; disjoint and so we can merge them with an OR.
 	lea	r15,$L$and_masks
 	shl	rbx,4
 	pand	xmm15,XMMWORD((-16))+rbx*1+r15
 
-
+; Merge %xmm11 into %xmm15, forming the remainder block.
 	por	xmm15,xmm11
 
-
-
+; The block of ciphertext + extra_in is ready to be included in the
+; Poly1305 state.
 	movq	r13,xmm15
 	pextrq	r14,xmm15,1
 	add	r10,r13
@@ -3745,26 +3745,26 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
 
 
 $L$process_blocks_of_extra_in:
-
+; There may be additional bytes of extra_in to process.
 	mov	r9,QWORD((288+32+160 ))+rsp
-	mov	rsi,QWORD48+r9
-	mov	r8,QWORD56+r9
+	mov	rsi,QWORD48+r9  ; extra_in
+	mov	r8,QWORD56+r9  ; extra_in_len
 	mov	rcx,r8
-	shr	r8,4
+	shr	r8,4  ; number of blocks
 
 $L$process_extra_hash_loop:
 	jz	NEAR process_extra_in_trailer
@@ -3797,14 +3797,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -3813,7 +3813,7 @@
 	sub	r8,1
 	jmp	NEAR $L$process_extra_hash_loop
 process_extra_in_trailer:
-	and	rcx,15
+	and	rcx,15  ; remaining num bytes (<16) of extra_in
 	mov	rbx,rcx
 	jz	NEAR $L$do_length_block
 	lea	rsi,((-1))+rcx*1+rsi
@@ -3826,7 +3826,7 @@
 	jnz	NEAR $L$process_extra_in_trailer_load
 
 $L$process_partial_block:
-
+; %xmm15 contains %rbx bytes of data to be fed into Poly1305. %rbx != 0
 	lea	r15,$L$and_masks
 	shl	rbx,4
 	pand	xmm15,XMMWORD((-16))+rbx*1+r15
@@ -3861,14 +3861,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -3904,19 +3904,19 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
 
-
+; Final reduce
 	mov	r13,r10
 	mov	r14,r11
 	mov	r15,r12
@@ -3926,7 +3926,7 @@
 	cmovc	r10,r13
 	cmovc	r11,r14
 	cmovc	r12,r15
-
+; Add in s part of the key
 	add	r10,QWORD((0+160+16))+rbp
 	adc	r11,QWORD((8+160+16))+rbp
 
@@ -3944,7 +3944,7 @@
 
 	add	rsp,288 + 160 + 32
 
-
+; The tag replaces the key on return
 	pop	r9
 
 	mov	QWORDr9,r10
@@ -3964,7 +3964,7 @@
 	mov	rdi,QWORD8+rsp	;WIN64 epilogue
 	mov	rsi,QWORD16+rsp
 	ret
-
+; ###############################################################################
 $L$seal_sse_128:
 
 	movdqu	xmm0,XMMWORD$L$chacha20_consts
@@ -4127,18 +4127,18 @@
 	paddd	xmm12,xmm15
 	paddd	xmm15,XMMWORD$L$sse_inc
 	paddd	xmm13,xmm15
-
+; Clamp and store the key
 	pand	xmm2,XMMWORD$L$clamp
 	movdqa	XMMWORD(160+0)+rbp,xmm2
 	movdqa	XMMWORD(160+16)+rbp,xmm6
-
+; Hash
 	mov	r8,r8
 	call	poly_hash_ad_internal
 	jmp	NEAR $L$seal_sse_128_tail_xor
 $L$SEH_end_chacha20_poly1305_seal_sse41:
 
 
-
+; ##############################################################################
 global	chacha20_poly1305_open_avx2
 
 ALIGN	64
@@ -4169,8 +4169,8 @@
 
 	push	r15
 
-
-
+; We write the calculated authenticator back to keyp at the end, so save
+; the pointer on the stack too.
 	push	r9
 
 	sub	rsp,288 + 160 + 32
@@ -4257,16 +4257,16 @@
 	vpaddd	ymm12,ymm12,YMMWORD((160+160))+rbp
 
 	vperm2i128	ymm3,ymm4,ymm0,0x02
-
+; Clamp and store key
 	vpand	ymm3,ymm3,YMMWORD$L$clamp
 	vmovdqa	YMMWORD(160+0)+rbp,ymm3
-
+; Stream for the first 64 bytes
 	vperm2i128	ymm0,ymm4,ymm0,0x13
 	vperm2i128	ymm4,ymm12,ymm8,0x13
-
+; Hash AD + first 64 bytes
 	mov	r8,r8
 	call	poly_hash_ad_internal
-
+; Hash first 64 bytes
 	xor	rcx,rcx
 $L$open_avx2_init_hash:
 	add	r10,QWORD((0+0))+rcx*1+rsi
@@ -4298,14 +4298,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -4313,17 +4313,17 @@
 	add	rcx,16
 	cmp	rcx,2*32
 	jne	NEAR $L$open_avx2_init_hash
-
+; Decrypt first 64 bytes
 	vpxor	ymm0,ymm0,YMMWORDrsi
 	vpxor	ymm4,ymm4,YMMWORD32+rsi
-
+; Store first 64 bytes of decrypted data
 	vmovdqu	YMMWORDrdi,ymm0
 	vmovdqu	YMMWORD32+rdi,ymm4
 	lea	rsi,64+rsi
 	lea	rdi,64+rdi
 	sub	rbx,2*32
 $L$open_avx2_main_loop:
-
+; Hash and decrypt 512 bytes each iteration
 	cmp	rbx,16*32
 	jb	NEAR $L$open_avx2_main_loop_done
 	vmovdqa	ymm0,YMMWORD$L$chacha20_consts
@@ -4413,14 +4413,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -4508,14 +4508,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -4603,14 +4603,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -4679,14 +4679,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -4743,14 +4743,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -4793,7 +4793,7 @@
 	mov	rcx,rbx
 	and	rcx,-16
 	test	rcx,rcx
-	je	NEAR $L$open_avx2_tail_128_rounds
+	je	NEAR $L$open_avx2_tail_128_rounds  ; Have nothing to hash
 $L$open_avx2_tail_128_rounds_and_x1hash:
 	add	r10,QWORD((0+0))+r8*1+rsi
 	adc	r11,QWORD((8+0))+r8*1+rsi
@@ -4824,14 +4824,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -4892,7 +4892,7 @@
 	vmovdqa	ymm8,ymm3
 
 	jmp	NEAR $L$open_avx2_tail_128_xor
-
+; ##############################################################################
 $L$open_avx2_tail_256:
 	vmovdqa	ymm0,YMMWORD$L$chacha20_consts
 	vmovdqa	ymm4,YMMWORD((160+64))+rbp
@@ -4938,14 +4938,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -5084,14 +5084,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -5129,7 +5129,7 @@
 	lea	rdi,128+rdi
 	sub	rbx,4*32
 	jmp	NEAR $L$open_avx2_tail_128_xor
-
+; ##############################################################################
 $L$open_avx2_tail_384:
 	vmovdqa	ymm0,YMMWORD$L$chacha20_consts
 	vmovdqa	ymm4,YMMWORD((160+64))+rbp
@@ -5181,14 +5181,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -5281,14 +5281,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -5387,14 +5387,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -5448,7 +5448,7 @@
 	lea	rdi,256+rdi
 	sub	rbx,8*32
 	jmp	NEAR $L$open_avx2_tail_128_xor
-
+; ##############################################################################
 $L$open_avx2_tail_512:
 	vmovdqa	ymm0,YMMWORD$L$chacha20_consts
 	vmovdqa	ymm4,YMMWORD((160+64))+rbp
@@ -5504,14 +5504,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -5577,14 +5577,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -5658,14 +5658,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -5784,14 +5784,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -5882,7 +5882,7 @@
 	vmovdqa	xmm1,xmm0
 	jb	NEAR $L$open_avx2_exit
 	sub	rbx,16
-
+; load for decryption
 	vpxor	xmm1,xmm0,XMMWORDrsi
 	vmovdqu	XMMWORDrdi,xmm1
 	lea	rsi,16+rsi
@@ -5892,7 +5892,7 @@
 $L$open_avx2_exit:
 	vzeroupper
 	jmp	NEAR $L$open_sse_tail_16
-
+; ##############################################################################
 $L$open_avx2_192:
 	vmovdqa	ymm1,ymm0
 	vmovdqa	ymm2,ymm0
@@ -5993,10 +5993,10 @@
 	vpaddd	ymm12,ymm12,ymm11
 	vpaddd	ymm13,ymm13,ymm15
 	vperm2i128	ymm3,ymm4,ymm0,0x02
-
+; Clamp and store the key
 	vpand	ymm3,ymm3,YMMWORD$L$clamp
 	vmovdqa	YMMWORD(160+0)+rbp,ymm3
-
+; Stream for up to 192 bytes
 	vperm2i128	ymm0,ymm4,ymm0,0x13
 	vperm2i128	ymm4,ymm12,ymm8,0x13
 	vperm2i128	ymm8,ymm5,ymm1,0x02
@@ -6039,14 +6039,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -6079,24 +6079,24 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
 
-
+; Load + decrypt
 	vpxor	ymm0,ymm0,YMMWORDrsi
 	vmovdqu	YMMWORDrdi,ymm0
 	lea	rsi,32+rsi
 	lea	rdi,32+rdi
-
+; Shift stream
 	vmovdqa	ymm0,ymm4
 	vmovdqa	ymm4,ymm8
 	vmovdqa	ymm8,ymm12
@@ -6141,14 +6141,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -6161,7 +6161,7 @@
 $L$open_avx2_short_tail_32_exit:
 	vzeroupper
 	jmp	NEAR $L$open_sse_tail_16
-
+; ##############################################################################
 $L$open_avx2_320:
 	vmovdqa	ymm1,ymm0
 	vmovdqa	ymm2,ymm0
@@ -6308,10 +6308,10 @@
 	vpaddd	ymm13,ymm13,YMMWORD((160+192))+rbp
 	vpaddd	ymm14,ymm14,YMMWORD((160+224))+rbp
 	vperm2i128	ymm3,ymm4,ymm0,0x02
-
+; Clamp and store the key
 	vpand	ymm3,ymm3,YMMWORD$L$clamp
 	vmovdqa	YMMWORD(160+0)+rbp,ymm3
-
+; Stream for up to 320 bytes
 	vperm2i128	ymm0,ymm4,ymm0,0x13
 	vperm2i128	ymm4,ymm12,ymm8,0x13
 	vperm2i128	ymm8,ymm5,ymm1,0x02
@@ -6325,8 +6325,8 @@
 	jmp	NEAR $L$open_avx2_short
 $L$SEH_end_chacha20_poly1305_open_avx2:
 
-
-
+; ##############################################################################
+; ##############################################################################
 global	chacha20_poly1305_seal_avx2
 
 ALIGN	64
@@ -6357,8 +6357,8 @@
 
 	push	r15
 
-
-
+; We write the calculated authenticator back to keyp at the end, so save
+; the pointer on the stack too.
 	push	r9
 
 	sub	rsp,288 + 160 + 32
@@ -6377,7 +6377,7 @@
 	movaps	XMMWORD(128+0)+rbp,xmm14
 	movaps	XMMWORD(144+0)+rbp,xmm15
 
-	mov	rbx,QWORD56+r9
+	mov	rbx,QWORD56+r9  ; extra_in_len
 	add	rbx,rdx
 	mov	QWORD((0+160+32))+rbp,r8
 	mov	QWORD((8+160+32))+rbp,rbx
@@ -6605,7 +6605,7 @@
 	vmovdqa	YMMWORD(160+0)+rbp,ymm15
 	mov	r8,r8
 	call	poly_hash_ad_internal
-
+; Safely store 320 bytes (otherwise would handle with optimized call)
 	vpxor	ymm3,ymm3,YMMWORDrsi
 	vpxor	ymm11,ymm11,YMMWORD32+rsi
 	vmovdqu	YMMWORDrdi,ymm3
@@ -6985,14 +6985,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7082,14 +7082,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7177,14 +7177,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7232,14 +7232,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7265,14 +7265,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7356,14 +7356,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7389,14 +7389,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7411,7 +7411,7 @@
 	ja	NEAR $L$seal_avx2_tail_384
 	cmp	rbx,4*32
 	ja	NEAR $L$seal_avx2_tail_256
-
+; ##############################################################################
 $L$seal_avx2_tail_128:
 	vmovdqa	ymm0,YMMWORD$L$chacha20_consts
 	vmovdqa	ymm4,YMMWORD((160+64))+rbp
@@ -7443,14 +7443,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7498,14 +7498,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7550,14 +7550,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7578,7 +7578,7 @@
 	vmovdqa	ymm8,ymm3
 
 	jmp	NEAR $L$seal_avx2_short_loop
-
+; ##############################################################################
 $L$seal_avx2_tail_256:
 	vmovdqa	ymm0,YMMWORD$L$chacha20_consts
 	vmovdqa	ymm4,YMMWORD((160+64))+rbp
@@ -7622,14 +7622,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7703,14 +7703,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7781,14 +7781,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7828,7 +7828,7 @@
 	lea	rsi,128+rsi
 	sub	rbx,4*32
 	jmp	NEAR $L$seal_avx2_short_hash_remainder
-
+; ##############################################################################
 $L$seal_avx2_tail_384:
 	vmovdqa	ymm0,YMMWORD$L$chacha20_consts
 	vmovdqa	ymm4,YMMWORD((160+64))+rbp
@@ -7877,14 +7877,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -7958,14 +7958,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -8036,14 +8036,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -8137,7 +8137,7 @@
 	lea	rsi,256+rsi
 	sub	rbx,8*32
 	jmp	NEAR $L$seal_avx2_short_hash_remainder
-
+; ##############################################################################
 $L$seal_avx2_tail_512:
 	vmovdqa	ymm0,YMMWORD$L$chacha20_consts
 	vmovdqa	ymm4,YMMWORD((160+64))+rbp
@@ -8184,14 +8184,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -8320,14 +8320,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -8453,14 +8453,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -8536,7 +8536,7 @@
 	lea	rsi,384+rsi
 	sub	rbx,12*32
 	jmp	NEAR $L$seal_avx2_short_hash_remainder
-
+; ###############################################################################
 $L$seal_avx2_320:
 	vmovdqa	ymm1,ymm0
 	vmovdqa	ymm2,ymm0
@@ -8683,10 +8683,10 @@
 	vpaddd	ymm13,ymm13,YMMWORD((160+192))+rbp
 	vpaddd	ymm14,ymm14,YMMWORD((160+224))+rbp
 	vperm2i128	ymm3,ymm4,ymm0,0x02
-
+; Clamp and store the key
 	vpand	ymm3,ymm3,YMMWORD$L$clamp
 	vmovdqa	YMMWORD(160+0)+rbp,ymm3
-
+; Stream for up to 320 bytes
 	vperm2i128	ymm0,ymm4,ymm0,0x13
 	vperm2i128	ymm4,ymm12,ymm8,0x13
 	vperm2i128	ymm8,ymm5,ymm1,0x02
@@ -8698,7 +8698,7 @@
 	vperm2i128	ymm2,ymm6,ymm2,0x13
 	vperm2i128	ymm6,ymm14,ymm10,0x13
 	jmp	NEAR $L$seal_avx2_short
-
+; ###############################################################################
 $L$seal_avx2_192:
 	vmovdqa	ymm1,ymm0
 	vmovdqa	ymm2,ymm0
@@ -8799,10 +8799,10 @@
 	vpaddd	ymm12,ymm12,ymm11
 	vpaddd	ymm13,ymm13,ymm15
 	vperm2i128	ymm3,ymm4,ymm0,0x02
-
+; Clamp and store the key
 	vpand	ymm3,ymm3,YMMWORD$L$clamp
 	vmovdqa	YMMWORD(160+0)+rbp,ymm3
-
+; Stream for up to 192 bytes
 	vperm2i128	ymm0,ymm4,ymm0,0x13
 	vperm2i128	ymm4,ymm12,ymm8,0x13
 	vperm2i128	ymm8,ymm5,ymm1,0x02
@@ -8845,14 +8845,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -8864,11 +8864,11 @@
 	cmp	rbx,32
 	jb	NEAR $L$seal_avx2_short_tail
 	sub	rbx,32
-
+; Encrypt
 	vpxor	ymm0,ymm0,YMMWORDrsi
 	vmovdqu	YMMWORDrdi,ymm0
 	lea	rsi,32+rsi
-
+; Load + hash
 	add	r10,QWORD((0+0))+rdi
 	adc	r11,QWORD((8+0))+rdi
 	adc	r12,1
@@ -8898,14 +8898,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
@@ -8938,20 +8938,20 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0
 
 	lea	rdi,32+rdi
-
+; Shift stream
 	vmovdqa	ymm0,ymm4
 	vmovdqa	ymm4,ymm8
 	vmovdqa	ymm8,ymm12
@@ -8998,14 +8998,14 @@
 	mov	r10,r13
 	mov	r11,r14
 	mov	r12,r15
-	and	r12,3
+	and	r12,3  ; At this point acc2 is 2 bits at most (value of 3)
 	mov	r13,r15
 	and	r13,-4
 	mov	r14,r9
 	shrd	r15,r9,2
 	shr	r9,2
 	add	r15,r13
-	adc	r9,r14
+	adc	r9,r14  ; No carry out since t3 is 61 bits and t1 is 63 bits
 	add	r10,r15
 	adc	r11,r9
 	adc	r12,0

boringssl-0.20260708.tar.xz/gen/crypto/err_data.cc -> boringssl-0.20260813.tar.xz/gen/crypto/err_data.cc Changed

@@ -206,51 +206,51 @@
     0x283500f7,
     0x28358cc1,
     0x2836099a,
-    0x2c3234ce,
+    0x2c3234e7,
     0x2c329443,
-    0x2c3334dc,
-    0x2c33b4ee,
-    0x2c343502,
-    0x2c34b514,
-    0x2c35352f,
-    0x2c35b541,
-    0x2c363571,
+    0x2c3334f5,
+    0x2c33b507,
+    0x2c34351b,
+    0x2c34b52d,
+    0x2c353548,
+    0x2c35b55a,
+    0x2c36358a,
     0x2c36833a,
-    0x2c37357e,
-    0x2c37b5aa,
-    0x2c3835e8,
-    0x2c38b5ff,
-    0x2c39361d,
-    0x2c39b62d,
-    0x2c3a363f,
-    0x2c3ab653,
-    0x2c3b3664,
-    0x2c3bb683,
+    0x2c373597,
+    0x2c37b5c3,
+    0x2c383601,
+    0x2c38b618,
+    0x2c393636,
+    0x2c39b646,
+    0x2c3a3658,
+    0x2c3ab66c,
+    0x2c3b367d,
+    0x2c3bb69c,
     0x2c3c1455,
     0x2c3c946b,
-    0x2c3d36c8,
+    0x2c3d36e1,
     0x2c3d9484,
-    0x2c3e36f2,
-    0x2c3eb700,
-    0x2c3f3718,
-    0x2c3fb730,
-    0x2c40375a,
+    0x2c3e370b,
+    0x2c3eb719,
+    0x2c3f3731,
+    0x2c3fb749,
+    0x2c403773,
     0x2c409330,
-    0x2c41376b,
-    0x2c41b77e,
+    0x2c413784,
+    0x2c41b797,
     0x2c4212f6,
-    0x2c42b78f,
+    0x2c42b7a8,
     0x2c43076d,
-    0x2c43b675,
-    0x2c4435bd,
-    0x2c44b73d,
-    0x2c453554,
-    0x2c45b590,
-    0x2c46360d,
-    0x2c46b697,
-    0x2c4736ac,
-    0x2c47b6e5,
-    0x2c4835cf,
+    0x2c43b68e,
+    0x2c4435d6,
+    0x2c44b756,
+    0x2c45356d,
+    0x2c45b5a9,
+    0x2c463626,
+    0x2c46b6b0,
+    0x2c4736c5,
+    0x2c47b6fe,
+    0x2c4835e8,
     0x30320000,
     0x30328015,
     0x3033001f,
@@ -529,15 +529,15 @@
     0x40773263,
     0x4077b2bf,
     0x407832da,
-    0x4078b313,
-    0x4079332a,
-    0x4079b340,
-    0x407a336c,
-    0x407ab37f,
-    0x407b3394,
-    0x407bb3a6,
-    0x407c33d7,
-    0x407cb3e0,
+    0x4078b32c,
+    0x40793343,
+    0x4079b359,
+    0x407a3385,
+    0x407ab398,
+    0x407b33ad,
+    0x407bb3bf,
+    0x407c33f0,
+    0x407cb3f9,
     0x407d2a6e,
     0x407da2f7,
     0x407e32ef,
@@ -566,7 +566,7 @@
     0x40899c67,
     0x408a2ced,
     0x408a9a85,
-    0x408b33bb,
+    0x408b33d4,
     0x408bb0ff,
     0x408c2692,
     0x408d2006,
@@ -586,7 +586,7 @@
     0x40941f32,
     0x4094ad06,
     0x40952872,
-    0x4095b34c,
+    0x4095b365,
     0x4096305c,
     0x4096a282,
     0x409723d4,
@@ -624,6 +624,7 @@
     0x40a7324b,
     0x40a7a40e,
     0x40a8232c,
+    0x40a8b313,
     0x41f42ba7,
     0x41f92c39,
     0x41fe2b2c,
@@ -713,71 +714,71 @@
     0x4c41954d,
     0x4c4216b6,
     0x4c429495,
-    0x503237a1,
-    0x5032b7b0,
-    0x503337bb,
-    0x5033b7cb,
-    0x503437e4,
-    0x5034b7fe,
-    0x5035380c,
-    0x5035b822,
-    0x50363834,
-    0x5036b84a,
-    0x50373863,
-    0x5037b876,
-    0x5038388e,
-    0x5038b89f,
-    0x503938b4,
-    0x5039b8c8,
-    0x503a38e8,
-    0x503ab8fe,
-    0x503b3916,
-    0x503bb928,
-    0x503c3944,
-    0x503cb95b,
-    0x503d3974,
-    0x503db98a,
-    0x503e3997,
-    0x503eb9ad,
-    0x503f39bf,
+    0x503237ba,
+    0x5032b7c9,
+    0x503337d4,
+    0x5033b7e4,
+    0x503437fd,
+    0x5034b817,
+    0x50353825,
+    0x5035b83b,
+    0x5036384d,
+    0x5036b863,
+    0x5037387c,
+    0x5037b88f,
+    0x503838a7,
+    0x5038b8b8,
+    0x503938cd,
+    0x5039b8e1,
+    0x503a3901,
+    0x503ab917,
+    0x503b392f,
+    0x503bb941,
+    0x503c395d,
+    0x503cb974,
+    0x503d398d,
+    0x503db9a3,
+    0x503e39b0,
+    0x503eb9c6,
+    0x503f39d8,
     0x503f83b3,
-    0x504039d2,
-    0x5040b9e2,
-    0x504139fc,
-    0x5041ba0b,
-    0x50423a25,
-    0x5042ba42,
-    0x50433a52,
-    0x5043ba62,
-    0x50443a7f,
+    0x504039eb,
+    0x5040b9fb,
+    0x50413a15,
+    0x5041ba24,
+    0x50423a3e,
+    0x5042ba5b,
+    0x50433a6b,
+    0x5043ba7b,
+    0x50443a98,
     0x50448469,
-    0x50453a93,
-    0x5045bab1,
-    0x50463ac4,
-    0x5046bada,
-    0x50473aec,
-    0x5047bb01,
-    0x50483b27,
-    0x5048bb35,
-    0x50493b48,
-    0x5049bb5d,
-    0x504a3b73,
-    0x504abb83,
-    0x504b3ba3,
-    0x504bbbb6,
-    0x504c3bd9,
-    0x504cbc07,
-    0x504d3c34,
-    0x504dbc51,
-    0x504e3c6c,
-    0x504ebc88,
-    0x504f3c9a,
-    0x504fbcb1,
-    0x50503cc0,
+    0x50453aac,
+    0x5045baca,
+    0x50463add,
+    0x5046baf3,
+    0x50473b05,
+    0x5047bb1a,
+    0x50483b40,
+    0x5048bb4e,
+    0x50493b61,
+    0x5049bb76,
+    0x504a3b8c,
+    0x504abb9c,
+    0x504b3bbc,
+    0x504bbbcf,
+    0x504c3bf2,
+    0x504cbc20,
+    0x504d3c4d,
+    0x504dbc6a,
+    0x504e3c85,
+    0x504ebca1,
+    0x504f3cb3,
+    0x504fbcca,
+    0x50503cd9,
     0x50508729,
-    0x50513cd3,
-    0x5051ba71,
-    0x50523c19,
+    0x50513cec,
+    0x5051ba8a,
+    0x50523c32,
     0x58321011,
     0x68320fd3,
     0x68328d2b,
@@ -822,19 +823,19 @@
     0x7c32130c,
     0x80321560,
     0x80328090,
-    0x8033349d,
+    0x803334b6,
     0x803380b9,
-    0x803434ac,
-    0x8034b414,
-    0x80353432,
-    0x8035b4c0,
-    0x80363474,
-    0x8036b423,
-    0x80373466,
-    0x8037b401,
-    0x80383487,
-    0x8038b443,
-    0x80393458,
+    0x803434c5,
+    0x8034b42d,
+    0x8035344b,
+    0x8035b4d9,
+    0x8036348d,
+    0x8036b43c,
+    0x8037347f,
+    0x8037b41a,
+    0x803834a0,
+    0x8038b45c,
+    0x80393471,
     0x84320bb0,
     0x84328bc9,
 };
@@ -1436,6 +1437,7 @@
     "UNSUPPORTED_ELLIPTIC_CURVE\0"
     "UNSUPPORTED_PROTOCOL\0"
     "UNSUPPORTED_PROTOCOL_FOR_CUSTOM_KEY\0"
+    "UNUSABLE_ECH_CONFIG_LIST\0"
     "WRONG_CERTIFICATE_TYPE\0"
     "WRONG_CIPHER_RETURNED\0"
     "WRONG_CURVE\0"

boringssl-0.20260708.tar.xz/gen/crypto/md5-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/crypto/md5-x86_64-apple.S Changed

@@ -25,651 +25,651 @@
 
 L$prologue:
 
-
-
-
-	movq	%rdi,%rbp
-	shlq	$6,%rdx
-	leaq	(%rsi,%rdx,1),%rdi
-	movl	0(%rbp),%eax
-	movl	4(%rbp),%ebx
-	movl	8(%rbp),%ecx
-	movl	12(%rbp),%edx
-
-
-
-
-
-
-
-	cmpq	%rdi,%rsi
-	je	L$end
-
-
-L$loop:
+// rdi = arg #1 (ctx, MD5_CTX pointer)
+// rsi = arg #2 (ptr, data pointer)
+// rdx = arg #3 (nbr, number of 16-word blocks to process)
+	movq	%rdi,%rbp  // rbp = ctx
+	shlq	$6,%rdx  // rdx = nbr in bytes
+	leaq	(%rsi,%rdx,1),%rdi  // rdi = end
+	movl	0(%rbp),%eax  // eax = ctx->A
+	movl	4(%rbp),%ebx  // ebx = ctx->B
+	movl	8(%rbp),%ecx  // ecx = ctx->C
+	movl	12(%rbp),%edx  // edx = ctx->D
+// end is 'rdi'
+// ptr is 'rsi'
+// A is 'eax'
+// B is 'ebx'
+// C is 'ecx'
+// D is 'edx'
+
+	cmpq	%rdi,%rsi  // cmp end with ptr
+	je	L$end  // jmp if ptr == end
+
+// BEGIN of loop over 16-word blocks
+L$loop:  // save old values of A, B, C, D
 	movl	%eax,%r8d
 	movl	%ebx,%r9d
 	movl	%ecx,%r14d
 	movl	%edx,%r15d
-	movl	0(%rsi),%r10d
-	movl	%edx,%r11d
-	xorl	%ecx,%r11d
-	leal	-680876936(%rax,%r10,1),%eax
-	andl	%ebx,%r11d
-	xorl	%edx,%r11d
-	movl	4(%rsi),%r10d
-	addl	%r11d,%eax
-	roll	$7,%eax
-	movl	%ecx,%r11d
-	addl	%ebx,%eax
-	xorl	%ebx,%r11d
-	leal	-389564586(%rdx,%r10,1),%edx
-	andl	%eax,%r11d
-	xorl	%ecx,%r11d
-	movl	8(%rsi),%r10d
-	addl	%r11d,%edx
-	roll	$12,%edx
-	movl	%ebx,%r11d
-	addl	%eax,%edx
-	xorl	%eax,%r11d
-	leal	606105819(%rcx,%r10,1),%ecx
-	andl	%edx,%r11d
-	xorl	%ebx,%r11d
-	movl	12(%rsi),%r10d
-	addl	%r11d,%ecx
-	roll	$17,%ecx
-	movl	%eax,%r11d
-	addl	%edx,%ecx
-	xorl	%edx,%r11d
-	leal	-1044525330(%rbx,%r10,1),%ebx
-	andl	%ecx,%r11d
-	xorl	%eax,%r11d
-	movl	16(%rsi),%r10d
-	addl	%r11d,%ebx
-	roll	$22,%ebx
-	movl	%edx,%r11d
-	addl	%ecx,%ebx
-	xorl	%ecx,%r11d
-	leal	-176418897(%rax,%r10,1),%eax
-	andl	%ebx,%r11d
-	xorl	%edx,%r11d
-	movl	20(%rsi),%r10d
-	addl	%r11d,%eax
-	roll	$7,%eax
-	movl	%ecx,%r11d
-	addl	%ebx,%eax
-	xorl	%ebx,%r11d
-	leal	1200080426(%rdx,%r10,1),%edx
-	andl	%eax,%r11d
-	xorl	%ecx,%r11d
-	movl	24(%rsi),%r10d
-	addl	%r11d,%edx
-	roll	$12,%edx
-	movl	%ebx,%r11d
-	addl	%eax,%edx
-	xorl	%eax,%r11d
-	leal	-1473231341(%rcx,%r10,1),%ecx
-	andl	%edx,%r11d
-	xorl	%ebx,%r11d
-	movl	28(%rsi),%r10d
-	addl	%r11d,%ecx
-	roll	$17,%ecx
-	movl	%eax,%r11d
-	addl	%edx,%ecx
-	xorl	%edx,%r11d
-	leal	-45705983(%rbx,%r10,1),%ebx
-	andl	%ecx,%r11d
-	xorl	%eax,%r11d
-	movl	32(%rsi),%r10d
-	addl	%r11d,%ebx
-	roll	$22,%ebx
-	movl	%edx,%r11d
-	addl	%ecx,%ebx
-	xorl	%ecx,%r11d
-	leal	1770035416(%rax,%r10,1),%eax
-	andl	%ebx,%r11d
-	xorl	%edx,%r11d
-	movl	36(%rsi),%r10d
-	addl	%r11d,%eax
-	roll	$7,%eax
-	movl	%ecx,%r11d
-	addl	%ebx,%eax
-	xorl	%ebx,%r11d
-	leal	-1958414417(%rdx,%r10,1),%edx
-	andl	%eax,%r11d
-	xorl	%ecx,%r11d
-	movl	40(%rsi),%r10d
-	addl	%r11d,%edx
-	roll	$12,%edx
-	movl	%ebx,%r11d
-	addl	%eax,%edx
-	xorl	%eax,%r11d
-	leal	-42063(%rcx,%r10,1),%ecx
-	andl	%edx,%r11d
-	xorl	%ebx,%r11d
-	movl	44(%rsi),%r10d
-	addl	%r11d,%ecx
-	roll	$17,%ecx
-	movl	%eax,%r11d
-	addl	%edx,%ecx
-	xorl	%edx,%r11d
-	leal	-1990404162(%rbx,%r10,1),%ebx
-	andl	%ecx,%r11d
-	xorl	%eax,%r11d
-	movl	48(%rsi),%r10d
-	addl	%r11d,%ebx
-	roll	$22,%ebx
-	movl	%edx,%r11d
-	addl	%ecx,%ebx
-	xorl	%ecx,%r11d
-	leal	1804603682(%rax,%r10,1),%eax
-	andl	%ebx,%r11d
-	xorl	%edx,%r11d
-	movl	52(%rsi),%r10d
-	addl	%r11d,%eax
-	roll	$7,%eax
-	movl	%ecx,%r11d
-	addl	%ebx,%eax
-	xorl	%ebx,%r11d
-	leal	-40341101(%rdx,%r10,1),%edx
-	andl	%eax,%r11d
-	xorl	%ecx,%r11d
-	movl	56(%rsi),%r10d
-	addl	%r11d,%edx
-	roll	$12,%edx
-	movl	%ebx,%r11d
-	addl	%eax,%edx
-	xorl	%eax,%r11d
-	leal	-1502002290(%rcx,%r10,1),%ecx
-	andl	%edx,%r11d
-	xorl	%ebx,%r11d
-	movl	60(%rsi),%r10d
-	addl	%r11d,%ecx
-	roll	$17,%ecx
-	movl	%eax,%r11d
-	addl	%edx,%ecx
-	xorl	%edx,%r11d
-	leal	1236535329(%rbx,%r10,1),%ebx
-	andl	%ecx,%r11d
-	xorl	%eax,%r11d
-	movl	0(%rsi),%r10d
-	addl	%r11d,%ebx
-	roll	$22,%ebx
-	movl	%edx,%r11d
-	addl	%ecx,%ebx
-	movl	4(%rsi),%r10d
-	movl	%edx,%r11d
-	movl	%edx,%r12d
-	notl	%r11d
-	leal	-165796510(%rax,%r10,1),%eax
-	andl	%ebx,%r12d
-	andl	%ecx,%r11d
-	movl	24(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ecx,%r11d
-	addl	%r12d,%eax
-	movl	%ecx,%r12d
-	roll	$5,%eax
-	addl	%ebx,%eax
-	notl	%r11d
-	leal	-1069501632(%rdx,%r10,1),%edx
-	andl	%eax,%r12d
-	andl	%ebx,%r11d
-	movl	44(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ebx,%r11d
-	addl	%r12d,%edx
-	movl	%ebx,%r12d
-	roll	$9,%edx
-	addl	%eax,%edx
-	notl	%r11d
-	leal	643717713(%rcx,%r10,1),%ecx
-	andl	%edx,%r12d
-	andl	%eax,%r11d
-	movl	0(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%eax,%r11d
-	addl	%r12d,%ecx
-	movl	%eax,%r12d
-	roll	$14,%ecx
-	addl	%edx,%ecx
-	notl	%r11d
-	leal	-373897302(%rbx,%r10,1),%ebx
-	andl	%ecx,%r12d
-	andl	%edx,%r11d
-	movl	20(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%edx,%r11d
-	addl	%r12d,%ebx
-	movl	%edx,%r12d
-	roll	$20,%ebx
-	addl	%ecx,%ebx
-	notl	%r11d
-	leal	-701558691(%rax,%r10,1),%eax
-	andl	%ebx,%r12d
-	andl	%ecx,%r11d
-	movl	40(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ecx,%r11d
-	addl	%r12d,%eax
-	movl	%ecx,%r12d
-	roll	$5,%eax
-	addl	%ebx,%eax
-	notl	%r11d
-	leal	38016083(%rdx,%r10,1),%edx
-	andl	%eax,%r12d
-	andl	%ebx,%r11d
-	movl	60(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ebx,%r11d
-	addl	%r12d,%edx
-	movl	%ebx,%r12d
-	roll	$9,%edx
-	addl	%eax,%edx
-	notl	%r11d
-	leal	-660478335(%rcx,%r10,1),%ecx
-	andl	%edx,%r12d
-	andl	%eax,%r11d
-	movl	16(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%eax,%r11d
-	addl	%r12d,%ecx
-	movl	%eax,%r12d
-	roll	$14,%ecx
-	addl	%edx,%ecx
-	notl	%r11d
-	leal	-405537848(%rbx,%r10,1),%ebx
-	andl	%ecx,%r12d
-	andl	%edx,%r11d
-	movl	36(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%edx,%r11d
-	addl	%r12d,%ebx
-	movl	%edx,%r12d
-	roll	$20,%ebx
-	addl	%ecx,%ebx
-	notl	%r11d
-	leal	568446438(%rax,%r10,1),%eax
-	andl	%ebx,%r12d
-	andl	%ecx,%r11d
-	movl	56(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ecx,%r11d
-	addl	%r12d,%eax
-	movl	%ecx,%r12d
-	roll	$5,%eax
-	addl	%ebx,%eax
-	notl	%r11d
-	leal	-1019803690(%rdx,%r10,1),%edx
-	andl	%eax,%r12d
-	andl	%ebx,%r11d
-	movl	12(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ebx,%r11d
-	addl	%r12d,%edx
-	movl	%ebx,%r12d
-	roll	$9,%edx
-	addl	%eax,%edx
-	notl	%r11d
-	leal	-187363961(%rcx,%r10,1),%ecx
-	andl	%edx,%r12d
-	andl	%eax,%r11d
-	movl	32(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%eax,%r11d
-	addl	%r12d,%ecx
-	movl	%eax,%r12d
-	roll	$14,%ecx
-	addl	%edx,%ecx
-	notl	%r11d
-	leal	1163531501(%rbx,%r10,1),%ebx
-	andl	%ecx,%r12d
-	andl	%edx,%r11d
-	movl	52(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%edx,%r11d
-	addl	%r12d,%ebx
-	movl	%edx,%r12d
-	roll	$20,%ebx
-	addl	%ecx,%ebx
-	notl	%r11d
-	leal	-1444681467(%rax,%r10,1),%eax
-	andl	%ebx,%r12d
-	andl	%ecx,%r11d
-	movl	8(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ecx,%r11d
-	addl	%r12d,%eax
-	movl	%ecx,%r12d
-	roll	$5,%eax
-	addl	%ebx,%eax
-	notl	%r11d
-	leal	-51403784(%rdx,%r10,1),%edx
-	andl	%eax,%r12d
-	andl	%ebx,%r11d
-	movl	28(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ebx,%r11d
-	addl	%r12d,%edx
-	movl	%ebx,%r12d
-	roll	$9,%edx
-	addl	%eax,%edx
-	notl	%r11d
-	leal	1735328473(%rcx,%r10,1),%ecx
-	andl	%edx,%r12d
-	andl	%eax,%r11d
-	movl	48(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%eax,%r11d
-	addl	%r12d,%ecx
-	movl	%eax,%r12d
-	roll	$14,%ecx
-	addl	%edx,%ecx
-	notl	%r11d
-	leal	-1926607734(%rbx,%r10,1),%ebx
-	andl	%ecx,%r12d
-	andl	%edx,%r11d
-	movl	0(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%edx,%r11d
-	addl	%r12d,%ebx
-	movl	%edx,%r12d
-	roll	$20,%ebx
-	addl	%ecx,%ebx
-	movl	20(%rsi),%r10d
-	movl	%ecx,%r11d
-	leal	-378558(%rax,%r10,1),%eax
-	movl	32(%rsi),%r10d
-	xorl	%edx,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%eax
-	roll	$4,%eax
-	movl	%ebx,%r11d
-	addl	%ebx,%eax
-	leal	-2022574463(%rdx,%r10,1),%edx
-	movl	44(%rsi),%r10d
-	xorl	%ecx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%edx
-	roll	$11,%edx
-	movl	%eax,%r11d
-	addl	%eax,%edx
-	leal	1839030562(%rcx,%r10,1),%ecx
-	movl	56(%rsi),%r10d
-	xorl	%ebx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ecx
-	roll	$16,%ecx
-	movl	%edx,%r11d
-	addl	%edx,%ecx
-	leal	-35309556(%rbx,%r10,1),%ebx
-	movl	4(%rsi),%r10d
-	xorl	%eax,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%ebx
-	roll	$23,%ebx
-	movl	%ecx,%r11d
-	addl	%ecx,%ebx
-	leal	-1530992060(%rax,%r10,1),%eax
-	movl	16(%rsi),%r10d
-	xorl	%edx,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%eax
-	roll	$4,%eax
-	movl	%ebx,%r11d
-	addl	%ebx,%eax
-	leal	1272893353(%rdx,%r10,1),%edx
-	movl	28(%rsi),%r10d
-	xorl	%ecx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%edx
-	roll	$11,%edx
-	movl	%eax,%r11d
-	addl	%eax,%edx
-	leal	-155497632(%rcx,%r10,1),%ecx
-	movl	40(%rsi),%r10d
-	xorl	%ebx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ecx
-	roll	$16,%ecx
-	movl	%edx,%r11d
-	addl	%edx,%ecx
-	leal	-1094730640(%rbx,%r10,1),%ebx
-	movl	52(%rsi),%r10d
-	xorl	%eax,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%ebx
-	roll	$23,%ebx
-	movl	%ecx,%r11d
-	addl	%ecx,%ebx
-	leal	681279174(%rax,%r10,1),%eax
-	movl	0(%rsi),%r10d
-	xorl	%edx,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%eax
-	roll	$4,%eax
-	movl	%ebx,%r11d
-	addl	%ebx,%eax
-	leal	-358537222(%rdx,%r10,1),%edx
-	movl	12(%rsi),%r10d
-	xorl	%ecx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%edx
-	roll	$11,%edx
-	movl	%eax,%r11d
-	addl	%eax,%edx
-	leal	-722521979(%rcx,%r10,1),%ecx
-	movl	24(%rsi),%r10d
-	xorl	%ebx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ecx
-	roll	$16,%ecx
-	movl	%edx,%r11d
-	addl	%edx,%ecx
-	leal	76029189(%rbx,%r10,1),%ebx
-	movl	36(%rsi),%r10d
-	xorl	%eax,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%ebx
-	roll	$23,%ebx
-	movl	%ecx,%r11d
-	addl	%ecx,%ebx
-	leal	-640364487(%rax,%r10,1),%eax
-	movl	48(%rsi),%r10d
-	xorl	%edx,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%eax
-	roll	$4,%eax
-	movl	%ebx,%r11d
-	addl	%ebx,%eax
-	leal	-421815835(%rdx,%r10,1),%edx
-	movl	60(%rsi),%r10d
-	xorl	%ecx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%edx
-	roll	$11,%edx
-	movl	%eax,%r11d
-	addl	%eax,%edx
-	leal	530742520(%rcx,%r10,1),%ecx
-	movl	8(%rsi),%r10d
-	xorl	%ebx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ecx
-	roll	$16,%ecx
-	movl	%edx,%r11d
-	addl	%edx,%ecx
-	leal	-995338651(%rbx,%r10,1),%ebx
-	movl	0(%rsi),%r10d
-	xorl	%eax,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%ebx
-	roll	$23,%ebx
-	movl	%ecx,%r11d
-	addl	%ecx,%ebx
-	movl	0(%rsi),%r10d
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	xorl	%ecx,%r11d  // y ^ ...
+	leal	-680876936(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r11d  // x & ...
+	xorl	%edx,%r11d  // z ^ ...
+	movl	4(%rsi),%r10d  // (NEXT STEP) X1
+	addl	%r11d,%eax  // dst += ...
+	roll	$7,%eax  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%ebx,%eax  // dst += x
+	xorl	%ebx,%r11d  // y ^ ...
+	leal	-389564586(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r11d  // x & ...
+	xorl	%ecx,%r11d  // z ^ ...
+	movl	8(%rsi),%r10d  // (NEXT STEP) X2
+	addl	%r11d,%edx  // dst += ...
+	roll	$12,%edx  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%eax,%edx  // dst += x
+	xorl	%eax,%r11d  // y ^ ...
+	leal	606105819(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r11d  // x & ...
+	xorl	%ebx,%r11d  // z ^ ...
+	movl	12(%rsi),%r10d  // (NEXT STEP) X3
+	addl	%r11d,%ecx  // dst += ...
+	roll	$17,%ecx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%edx,%ecx  // dst += x
+	xorl	%edx,%r11d  // y ^ ...
+	leal	-1044525330(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r11d  // x & ...
+	xorl	%eax,%r11d  // z ^ ...
+	movl	16(%rsi),%r10d  // (NEXT STEP) X4
+	addl	%r11d,%ebx  // dst += ...
+	roll	$22,%ebx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%ecx,%ebx  // dst += x
+	xorl	%ecx,%r11d  // y ^ ...
+	leal	-176418897(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r11d  // x & ...
+	xorl	%edx,%r11d  // z ^ ...
+	movl	20(%rsi),%r10d  // (NEXT STEP) X5
+	addl	%r11d,%eax  // dst += ...
+	roll	$7,%eax  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%ebx,%eax  // dst += x
+	xorl	%ebx,%r11d  // y ^ ...
+	leal	1200080426(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r11d  // x & ...
+	xorl	%ecx,%r11d  // z ^ ...
+	movl	24(%rsi),%r10d  // (NEXT STEP) X6
+	addl	%r11d,%edx  // dst += ...
+	roll	$12,%edx  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%eax,%edx  // dst += x
+	xorl	%eax,%r11d  // y ^ ...
+	leal	-1473231341(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r11d  // x & ...
+	xorl	%ebx,%r11d  // z ^ ...
+	movl	28(%rsi),%r10d  // (NEXT STEP) X7
+	addl	%r11d,%ecx  // dst += ...
+	roll	$17,%ecx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%edx,%ecx  // dst += x
+	xorl	%edx,%r11d  // y ^ ...
+	leal	-45705983(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r11d  // x & ...
+	xorl	%eax,%r11d  // z ^ ...
+	movl	32(%rsi),%r10d  // (NEXT STEP) X8
+	addl	%r11d,%ebx  // dst += ...
+	roll	$22,%ebx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%ecx,%ebx  // dst += x
+	xorl	%ecx,%r11d  // y ^ ...
+	leal	1770035416(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r11d  // x & ...
+	xorl	%edx,%r11d  // z ^ ...
+	movl	36(%rsi),%r10d  // (NEXT STEP) X9
+	addl	%r11d,%eax  // dst += ...
+	roll	$7,%eax  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%ebx,%eax  // dst += x
+	xorl	%ebx,%r11d  // y ^ ...
+	leal	-1958414417(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r11d  // x & ...
+	xorl	%ecx,%r11d  // z ^ ...
+	movl	40(%rsi),%r10d  // (NEXT STEP) X10
+	addl	%r11d,%edx  // dst += ...
+	roll	$12,%edx  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%eax,%edx  // dst += x
+	xorl	%eax,%r11d  // y ^ ...
+	leal	-42063(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r11d  // x & ...
+	xorl	%ebx,%r11d  // z ^ ...
+	movl	44(%rsi),%r10d  // (NEXT STEP) X11
+	addl	%r11d,%ecx  // dst += ...
+	roll	$17,%ecx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%edx,%ecx  // dst += x
+	xorl	%edx,%r11d  // y ^ ...
+	leal	-1990404162(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r11d  // x & ...
+	xorl	%eax,%r11d  // z ^ ...
+	movl	48(%rsi),%r10d  // (NEXT STEP) X12
+	addl	%r11d,%ebx  // dst += ...
+	roll	$22,%ebx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%ecx,%ebx  // dst += x
+	xorl	%ecx,%r11d  // y ^ ...
+	leal	1804603682(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r11d  // x & ...
+	xorl	%edx,%r11d  // z ^ ...
+	movl	52(%rsi),%r10d  // (NEXT STEP) X13
+	addl	%r11d,%eax  // dst += ...
+	roll	$7,%eax  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%ebx,%eax  // dst += x
+	xorl	%ebx,%r11d  // y ^ ...
+	leal	-40341101(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r11d  // x & ...
+	xorl	%ecx,%r11d  // z ^ ...
+	movl	56(%rsi),%r10d  // (NEXT STEP) X14
+	addl	%r11d,%edx  // dst += ...
+	roll	$12,%edx  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%eax,%edx  // dst += x
+	xorl	%eax,%r11d  // y ^ ...
+	leal	-1502002290(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r11d  // x & ...
+	xorl	%ebx,%r11d  // z ^ ...
+	movl	60(%rsi),%r10d  // (NEXT STEP) X15
+	addl	%r11d,%ecx  // dst += ...
+	roll	$17,%ecx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%edx,%ecx  // dst += x
+	xorl	%edx,%r11d  // y ^ ...
+	leal	1236535329(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r11d  // x & ...
+	xorl	%eax,%r11d  // z ^ ...
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
+	addl	%r11d,%ebx  // dst += ...
+	roll	$22,%ebx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%ecx,%ebx  // dst += x
+	movl	4(%rsi),%r10d  // (NEXT STEP) X1
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	movl	%edx,%r12d  // (NEXT STEP) z' = %edx
+	notl	%r11d  // not z
+	leal	-165796510(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r12d  // x & z
+	andl	%ecx,%r11d  // y & (not z)
+	movl	24(%rsi),%r10d  // (NEXT STEP) X6
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%r12d,%eax  // dst += ...
+	movl	%ecx,%r12d  // (NEXT STEP) z' = %ecx
+	roll	$5,%eax  // dst <<< s
+	addl	%ebx,%eax  // dst += x
+	notl	%r11d  // not z
+	leal	-1069501632(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r12d  // x & z
+	andl	%ebx,%r11d  // y & (not z)
+	movl	44(%rsi),%r10d  // (NEXT STEP) X11
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%r12d,%edx  // dst += ...
+	movl	%ebx,%r12d  // (NEXT STEP) z' = %ebx
+	roll	$9,%edx  // dst <<< s
+	addl	%eax,%edx  // dst += x
+	notl	%r11d  // not z
+	leal	643717713(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r12d  // x & z
+	andl	%eax,%r11d  // y & (not z)
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%r12d,%ecx  // dst += ...
+	movl	%eax,%r12d  // (NEXT STEP) z' = %eax
+	roll	$14,%ecx  // dst <<< s
+	addl	%edx,%ecx  // dst += x
+	notl	%r11d  // not z
+	leal	-373897302(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r12d  // x & z
+	andl	%edx,%r11d  // y & (not z)
+	movl	20(%rsi),%r10d  // (NEXT STEP) X5
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%r12d,%ebx  // dst += ...
+	movl	%edx,%r12d  // (NEXT STEP) z' = %edx
+	roll	$20,%ebx  // dst <<< s
+	addl	%ecx,%ebx  // dst += x
+	notl	%r11d  // not z
+	leal	-701558691(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r12d  // x & z
+	andl	%ecx,%r11d  // y & (not z)
+	movl	40(%rsi),%r10d  // (NEXT STEP) X10
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%r12d,%eax  // dst += ...
+	movl	%ecx,%r12d  // (NEXT STEP) z' = %ecx
+	roll	$5,%eax  // dst <<< s
+	addl	%ebx,%eax  // dst += x
+	notl	%r11d  // not z
+	leal	38016083(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r12d  // x & z
+	andl	%ebx,%r11d  // y & (not z)
+	movl	60(%rsi),%r10d  // (NEXT STEP) X15
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%r12d,%edx  // dst += ...
+	movl	%ebx,%r12d  // (NEXT STEP) z' = %ebx
+	roll	$9,%edx  // dst <<< s
+	addl	%eax,%edx  // dst += x
+	notl	%r11d  // not z
+	leal	-660478335(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r12d  // x & z
+	andl	%eax,%r11d  // y & (not z)
+	movl	16(%rsi),%r10d  // (NEXT STEP) X4
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%r12d,%ecx  // dst += ...
+	movl	%eax,%r12d  // (NEXT STEP) z' = %eax
+	roll	$14,%ecx  // dst <<< s
+	addl	%edx,%ecx  // dst += x
+	notl	%r11d  // not z
+	leal	-405537848(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r12d  // x & z
+	andl	%edx,%r11d  // y & (not z)
+	movl	36(%rsi),%r10d  // (NEXT STEP) X9
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%r12d,%ebx  // dst += ...
+	movl	%edx,%r12d  // (NEXT STEP) z' = %edx
+	roll	$20,%ebx  // dst <<< s
+	addl	%ecx,%ebx  // dst += x
+	notl	%r11d  // not z
+	leal	568446438(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r12d  // x & z
+	andl	%ecx,%r11d  // y & (not z)
+	movl	56(%rsi),%r10d  // (NEXT STEP) X14
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%r12d,%eax  // dst += ...
+	movl	%ecx,%r12d  // (NEXT STEP) z' = %ecx
+	roll	$5,%eax  // dst <<< s
+	addl	%ebx,%eax  // dst += x
+	notl	%r11d  // not z
+	leal	-1019803690(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r12d  // x & z
+	andl	%ebx,%r11d  // y & (not z)
+	movl	12(%rsi),%r10d  // (NEXT STEP) X3
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%r12d,%edx  // dst += ...
+	movl	%ebx,%r12d  // (NEXT STEP) z' = %ebx
+	roll	$9,%edx  // dst <<< s
+	addl	%eax,%edx  // dst += x
+	notl	%r11d  // not z
+	leal	-187363961(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r12d  // x & z
+	andl	%eax,%r11d  // y & (not z)
+	movl	32(%rsi),%r10d  // (NEXT STEP) X8
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%r12d,%ecx  // dst += ...
+	movl	%eax,%r12d  // (NEXT STEP) z' = %eax
+	roll	$14,%ecx  // dst <<< s
+	addl	%edx,%ecx  // dst += x
+	notl	%r11d  // not z
+	leal	1163531501(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r12d  // x & z
+	andl	%edx,%r11d  // y & (not z)
+	movl	52(%rsi),%r10d  // (NEXT STEP) X13
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%r12d,%ebx  // dst += ...
+	movl	%edx,%r12d  // (NEXT STEP) z' = %edx
+	roll	$20,%ebx  // dst <<< s
+	addl	%ecx,%ebx  // dst += x
+	notl	%r11d  // not z
+	leal	-1444681467(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r12d  // x & z
+	andl	%ecx,%r11d  // y & (not z)
+	movl	8(%rsi),%r10d  // (NEXT STEP) X2
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%r12d,%eax  // dst += ...
+	movl	%ecx,%r12d  // (NEXT STEP) z' = %ecx
+	roll	$5,%eax  // dst <<< s
+	addl	%ebx,%eax  // dst += x
+	notl	%r11d  // not z
+	leal	-51403784(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r12d  // x & z
+	andl	%ebx,%r11d  // y & (not z)
+	movl	28(%rsi),%r10d  // (NEXT STEP) X7
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%r12d,%edx  // dst += ...
+	movl	%ebx,%r12d  // (NEXT STEP) z' = %ebx
+	roll	$9,%edx  // dst <<< s
+	addl	%eax,%edx  // dst += x
+	notl	%r11d  // not z
+	leal	1735328473(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r12d  // x & z
+	andl	%eax,%r11d  // y & (not z)
+	movl	48(%rsi),%r10d  // (NEXT STEP) X12
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%r12d,%ecx  // dst += ...
+	movl	%eax,%r12d  // (NEXT STEP) z' = %eax
+	roll	$14,%ecx  // dst <<< s
+	addl	%edx,%ecx  // dst += x
+	notl	%r11d  // not z
+	leal	-1926607734(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r12d  // x & z
+	andl	%edx,%r11d  // y & (not z)
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%r12d,%ebx  // dst += ...
+	movl	%edx,%r12d  // (NEXT STEP) z' = %edx
+	roll	$20,%ebx  // dst <<< s
+	addl	%ecx,%ebx  // dst += x
+	movl	20(%rsi),%r10d  // (NEXT STEP) X5
+	movl	%ecx,%r11d  // (NEXT STEP) y' = %ecx
+	leal	-378558(%rax,%r10,1),%eax  // Const + dst + ...
+	movl	32(%rsi),%r10d  // (NEXT STEP) X8
+	xorl	%edx,%r11d  // z ^ ...
+	xorl	%ebx,%r11d  // x ^ ...
+	addl	%r11d,%eax  // dst += ...
+	roll	$4,%eax  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) y' = %ebx
+	addl	%ebx,%eax  // dst += x
+	leal	-2022574463(%rdx,%r10,1),%edx  // Const + dst + ...
+	movl	44(%rsi),%r10d  // (NEXT STEP) X11
+	xorl	%ecx,%r11d  // z ^ ...
+	xorl	%eax,%r11d  // x ^ ...
+	addl	%r11d,%edx  // dst += ...
+	roll	$11,%edx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) y' = %eax
+	addl	%eax,%edx  // dst += x
+	leal	1839030562(%rcx,%r10,1),%ecx  // Const + dst + ...
+	movl	56(%rsi),%r10d  // (NEXT STEP) X14
+	xorl	%ebx,%r11d  // z ^ ...
+	xorl	%edx,%r11d  // x ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	roll	$16,%ecx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) y' = %edx
+	addl	%edx,%ecx  // dst += x
+	leal	-35309556(%rbx,%r10,1),%ebx  // Const + dst + ...
+	movl	4(%rsi),%r10d  // (NEXT STEP) X1
+	xorl	%eax,%r11d  // z ^ ...
+	xorl	%ecx,%r11d  // x ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	roll	$23,%ebx  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) y' = %ecx
+	addl	%ecx,%ebx  // dst += x
+	leal	-1530992060(%rax,%r10,1),%eax  // Const + dst + ...
+	movl	16(%rsi),%r10d  // (NEXT STEP) X4
+	xorl	%edx,%r11d  // z ^ ...
+	xorl	%ebx,%r11d  // x ^ ...
+	addl	%r11d,%eax  // dst += ...
+	roll	$4,%eax  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) y' = %ebx
+	addl	%ebx,%eax  // dst += x
+	leal	1272893353(%rdx,%r10,1),%edx  // Const + dst + ...
+	movl	28(%rsi),%r10d  // (NEXT STEP) X7
+	xorl	%ecx,%r11d  // z ^ ...
+	xorl	%eax,%r11d  // x ^ ...
+	addl	%r11d,%edx  // dst += ...
+	roll	$11,%edx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) y' = %eax
+	addl	%eax,%edx  // dst += x
+	leal	-155497632(%rcx,%r10,1),%ecx  // Const + dst + ...
+	movl	40(%rsi),%r10d  // (NEXT STEP) X10
+	xorl	%ebx,%r11d  // z ^ ...
+	xorl	%edx,%r11d  // x ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	roll	$16,%ecx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) y' = %edx
+	addl	%edx,%ecx  // dst += x
+	leal	-1094730640(%rbx,%r10,1),%ebx  // Const + dst + ...
+	movl	52(%rsi),%r10d  // (NEXT STEP) X13
+	xorl	%eax,%r11d  // z ^ ...
+	xorl	%ecx,%r11d  // x ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	roll	$23,%ebx  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) y' = %ecx
+	addl	%ecx,%ebx  // dst += x
+	leal	681279174(%rax,%r10,1),%eax  // Const + dst + ...
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
+	xorl	%edx,%r11d  // z ^ ...
+	xorl	%ebx,%r11d  // x ^ ...
+	addl	%r11d,%eax  // dst += ...
+	roll	$4,%eax  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) y' = %ebx
+	addl	%ebx,%eax  // dst += x
+	leal	-358537222(%rdx,%r10,1),%edx  // Const + dst + ...
+	movl	12(%rsi),%r10d  // (NEXT STEP) X3
+	xorl	%ecx,%r11d  // z ^ ...
+	xorl	%eax,%r11d  // x ^ ...
+	addl	%r11d,%edx  // dst += ...
+	roll	$11,%edx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) y' = %eax
+	addl	%eax,%edx  // dst += x
+	leal	-722521979(%rcx,%r10,1),%ecx  // Const + dst + ...
+	movl	24(%rsi),%r10d  // (NEXT STEP) X6
+	xorl	%ebx,%r11d  // z ^ ...
+	xorl	%edx,%r11d  // x ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	roll	$16,%ecx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) y' = %edx
+	addl	%edx,%ecx  // dst += x
+	leal	76029189(%rbx,%r10,1),%ebx  // Const + dst + ...
+	movl	36(%rsi),%r10d  // (NEXT STEP) X9
+	xorl	%eax,%r11d  // z ^ ...
+	xorl	%ecx,%r11d  // x ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	roll	$23,%ebx  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) y' = %ecx
+	addl	%ecx,%ebx  // dst += x
+	leal	-640364487(%rax,%r10,1),%eax  // Const + dst + ...
+	movl	48(%rsi),%r10d  // (NEXT STEP) X12
+	xorl	%edx,%r11d  // z ^ ...
+	xorl	%ebx,%r11d  // x ^ ...
+	addl	%r11d,%eax  // dst += ...
+	roll	$4,%eax  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) y' = %ebx
+	addl	%ebx,%eax  // dst += x
+	leal	-421815835(%rdx,%r10,1),%edx  // Const + dst + ...
+	movl	60(%rsi),%r10d  // (NEXT STEP) X15
+	xorl	%ecx,%r11d  // z ^ ...
+	xorl	%eax,%r11d  // x ^ ...
+	addl	%r11d,%edx  // dst += ...
+	roll	$11,%edx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) y' = %eax
+	addl	%eax,%edx  // dst += x
+	leal	530742520(%rcx,%r10,1),%ecx  // Const + dst + ...
+	movl	8(%rsi),%r10d  // (NEXT STEP) X2
+	xorl	%ebx,%r11d  // z ^ ...
+	xorl	%edx,%r11d  // x ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	roll	$16,%ecx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) y' = %edx
+	addl	%edx,%ecx  // dst += x
+	leal	-995338651(%rbx,%r10,1),%ebx  // Const + dst + ...
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
+	xorl	%eax,%r11d  // z ^ ...
+	xorl	%ecx,%r11d  // x ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	roll	$23,%ebx  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) y' = %ecx
+	addl	%ecx,%ebx  // dst += x
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
 	movl	$0xffffffff,%r11d
-	xorl	%edx,%r11d
-	leal	-198630844(%rax,%r10,1),%eax
-	orl	%ebx,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%eax
-	movl	28(%rsi),%r10d
+	xorl	%edx,%r11d  // (NEXT STEP) not z' = not %edx
+	leal	-198630844(%rax,%r10,1),%eax  // Const + dst + ...
+	orl	%ebx,%r11d  // x | ...
+	xorl	%ecx,%r11d  // y ^ ...
+	addl	%r11d,%eax  // dst += ...
+	movl	28(%rsi),%r10d  // (NEXT STEP) X7
 	movl	$0xffffffff,%r11d
-	roll	$6,%eax
-	xorl	%ecx,%r11d
-	addl	%ebx,%eax
-	leal	1126891415(%rdx,%r10,1),%edx
-	orl	%eax,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%edx
-	movl	56(%rsi),%r10d
+	roll	$6,%eax  // dst <<< s
+	xorl	%ecx,%r11d  // (NEXT STEP) not z' = not %ecx
+	addl	%ebx,%eax  // dst += x
+	leal	1126891415(%rdx,%r10,1),%edx  // Const + dst + ...
+	orl	%eax,%r11d  // x | ...
+	xorl	%ebx,%r11d  // y ^ ...
+	addl	%r11d,%edx  // dst += ...
+	movl	56(%rsi),%r10d  // (NEXT STEP) X14
 	movl	$0xffffffff,%r11d
-	roll	$10,%edx
-	xorl	%ebx,%r11d
-	addl	%eax,%edx
-	leal	-1416354905(%rcx,%r10,1),%ecx
-	orl	%edx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%ecx
-	movl	20(%rsi),%r10d
+	roll	$10,%edx  // dst <<< s
+	xorl	%ebx,%r11d  // (NEXT STEP) not z' = not %ebx
+	addl	%eax,%edx  // dst += x
+	leal	-1416354905(%rcx,%r10,1),%ecx  // Const + dst + ...
+	orl	%edx,%r11d  // x | ...
+	xorl	%eax,%r11d  // y ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	movl	20(%rsi),%r10d  // (NEXT STEP) X5
 	movl	$0xffffffff,%r11d
-	roll	$15,%ecx
-	xorl	%eax,%r11d
-	addl	%edx,%ecx
-	leal	-57434055(%rbx,%r10,1),%ebx
-	orl	%ecx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ebx
-	movl	48(%rsi),%r10d
+	roll	$15,%ecx  // dst <<< s
+	xorl	%eax,%r11d  // (NEXT STEP) not z' = not %eax
+	addl	%edx,%ecx  // dst += x
+	leal	-57434055(%rbx,%r10,1),%ebx  // Const + dst + ...
+	orl	%ecx,%r11d  // x | ...
+	xorl	%edx,%r11d  // y ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	movl	48(%rsi),%r10d  // (NEXT STEP) X12
 	movl	$0xffffffff,%r11d
-	roll	$21,%ebx
-	xorl	%edx,%r11d
-	addl	%ecx,%ebx
-	leal	1700485571(%rax,%r10,1),%eax
-	orl	%ebx,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%eax
-	movl	12(%rsi),%r10d
+	roll	$21,%ebx  // dst <<< s
+	xorl	%edx,%r11d  // (NEXT STEP) not z' = not %edx
+	addl	%ecx,%ebx  // dst += x
+	leal	1700485571(%rax,%r10,1),%eax  // Const + dst + ...
+	orl	%ebx,%r11d  // x | ...
+	xorl	%ecx,%r11d  // y ^ ...
+	addl	%r11d,%eax  // dst += ...
+	movl	12(%rsi),%r10d  // (NEXT STEP) X3
 	movl	$0xffffffff,%r11d
-	roll	$6,%eax
-	xorl	%ecx,%r11d
-	addl	%ebx,%eax
-	leal	-1894986606(%rdx,%r10,1),%edx
-	orl	%eax,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%edx
-	movl	40(%rsi),%r10d
+	roll	$6,%eax  // dst <<< s
+	xorl	%ecx,%r11d  // (NEXT STEP) not z' = not %ecx
+	addl	%ebx,%eax  // dst += x
+	leal	-1894986606(%rdx,%r10,1),%edx  // Const + dst + ...
+	orl	%eax,%r11d  // x | ...
+	xorl	%ebx,%r11d  // y ^ ...
+	addl	%r11d,%edx  // dst += ...
+	movl	40(%rsi),%r10d  // (NEXT STEP) X10
 	movl	$0xffffffff,%r11d
-	roll	$10,%edx
-	xorl	%ebx,%r11d
-	addl	%eax,%edx
-	leal	-1051523(%rcx,%r10,1),%ecx
-	orl	%edx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%ecx
-	movl	4(%rsi),%r10d
+	roll	$10,%edx  // dst <<< s
+	xorl	%ebx,%r11d  // (NEXT STEP) not z' = not %ebx
+	addl	%eax,%edx  // dst += x
+	leal	-1051523(%rcx,%r10,1),%ecx  // Const + dst + ...
+	orl	%edx,%r11d  // x | ...
+	xorl	%eax,%r11d  // y ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	movl	4(%rsi),%r10d  // (NEXT STEP) X1
 	movl	$0xffffffff,%r11d
-	roll	$15,%ecx
-	xorl	%eax,%r11d
-	addl	%edx,%ecx
-	leal	-2054922799(%rbx,%r10,1),%ebx
-	orl	%ecx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ebx
-	movl	32(%rsi),%r10d
+	roll	$15,%ecx  // dst <<< s
+	xorl	%eax,%r11d  // (NEXT STEP) not z' = not %eax
+	addl	%edx,%ecx  // dst += x
+	leal	-2054922799(%rbx,%r10,1),%ebx  // Const + dst + ...
+	orl	%ecx,%r11d  // x | ...
+	xorl	%edx,%r11d  // y ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	movl	32(%rsi),%r10d  // (NEXT STEP) X8
 	movl	$0xffffffff,%r11d
-	roll	$21,%ebx
-	xorl	%edx,%r11d
-	addl	%ecx,%ebx
-	leal	1873313359(%rax,%r10,1),%eax
-	orl	%ebx,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%eax
-	movl	60(%rsi),%r10d
+	roll	$21,%ebx  // dst <<< s
+	xorl	%edx,%r11d  // (NEXT STEP) not z' = not %edx
+	addl	%ecx,%ebx  // dst += x
+	leal	1873313359(%rax,%r10,1),%eax  // Const + dst + ...
+	orl	%ebx,%r11d  // x | ...
+	xorl	%ecx,%r11d  // y ^ ...
+	addl	%r11d,%eax  // dst += ...
+	movl	60(%rsi),%r10d  // (NEXT STEP) X15
 	movl	$0xffffffff,%r11d
-	roll	$6,%eax
-	xorl	%ecx,%r11d
-	addl	%ebx,%eax
-	leal	-30611744(%rdx,%r10,1),%edx
-	orl	%eax,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%edx
-	movl	24(%rsi),%r10d
+	roll	$6,%eax  // dst <<< s
+	xorl	%ecx,%r11d  // (NEXT STEP) not z' = not %ecx
+	addl	%ebx,%eax  // dst += x
+	leal	-30611744(%rdx,%r10,1),%edx  // Const + dst + ...
+	orl	%eax,%r11d  // x | ...
+	xorl	%ebx,%r11d  // y ^ ...
+	addl	%r11d,%edx  // dst += ...
+	movl	24(%rsi),%r10d  // (NEXT STEP) X6
 	movl	$0xffffffff,%r11d
-	roll	$10,%edx
-	xorl	%ebx,%r11d
-	addl	%eax,%edx
-	leal	-1560198380(%rcx,%r10,1),%ecx
-	orl	%edx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%ecx
-	movl	52(%rsi),%r10d
+	roll	$10,%edx  // dst <<< s
+	xorl	%ebx,%r11d  // (NEXT STEP) not z' = not %ebx
+	addl	%eax,%edx  // dst += x
+	leal	-1560198380(%rcx,%r10,1),%ecx  // Const + dst + ...
+	orl	%edx,%r11d  // x | ...
+	xorl	%eax,%r11d  // y ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	movl	52(%rsi),%r10d  // (NEXT STEP) X13
 	movl	$0xffffffff,%r11d
-	roll	$15,%ecx
-	xorl	%eax,%r11d
-	addl	%edx,%ecx
-	leal	1309151649(%rbx,%r10,1),%ebx
-	orl	%ecx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ebx
-	movl	16(%rsi),%r10d
+	roll	$15,%ecx  // dst <<< s
+	xorl	%eax,%r11d  // (NEXT STEP) not z' = not %eax
+	addl	%edx,%ecx  // dst += x
+	leal	1309151649(%rbx,%r10,1),%ebx  // Const + dst + ...
+	orl	%ecx,%r11d  // x | ...
+	xorl	%edx,%r11d  // y ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	movl	16(%rsi),%r10d  // (NEXT STEP) X4
 	movl	$0xffffffff,%r11d
-	roll	$21,%ebx
-	xorl	%edx,%r11d
-	addl	%ecx,%ebx
-	leal	-145523070(%rax,%r10,1),%eax
-	orl	%ebx,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%eax
-	movl	44(%rsi),%r10d
+	roll	$21,%ebx  // dst <<< s
+	xorl	%edx,%r11d  // (NEXT STEP) not z' = not %edx
+	addl	%ecx,%ebx  // dst += x
+	leal	-145523070(%rax,%r10,1),%eax  // Const + dst + ...
+	orl	%ebx,%r11d  // x | ...
+	xorl	%ecx,%r11d  // y ^ ...
+	addl	%r11d,%eax  // dst += ...
+	movl	44(%rsi),%r10d  // (NEXT STEP) X11
 	movl	$0xffffffff,%r11d
-	roll	$6,%eax
-	xorl	%ecx,%r11d
-	addl	%ebx,%eax
-	leal	-1120210379(%rdx,%r10,1),%edx
-	orl	%eax,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%edx
-	movl	8(%rsi),%r10d
+	roll	$6,%eax  // dst <<< s
+	xorl	%ecx,%r11d  // (NEXT STEP) not z' = not %ecx
+	addl	%ebx,%eax  // dst += x
+	leal	-1120210379(%rdx,%r10,1),%edx  // Const + dst + ...
+	orl	%eax,%r11d  // x | ...
+	xorl	%ebx,%r11d  // y ^ ...
+	addl	%r11d,%edx  // dst += ...
+	movl	8(%rsi),%r10d  // (NEXT STEP) X2
 	movl	$0xffffffff,%r11d
-	roll	$10,%edx
-	xorl	%ebx,%r11d
-	addl	%eax,%edx
-	leal	718787259(%rcx,%r10,1),%ecx
-	orl	%edx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%ecx
-	movl	36(%rsi),%r10d
+	roll	$10,%edx  // dst <<< s
+	xorl	%ebx,%r11d  // (NEXT STEP) not z' = not %ebx
+	addl	%eax,%edx  // dst += x
+	leal	718787259(%rcx,%r10,1),%ecx  // Const + dst + ...
+	orl	%edx,%r11d  // x | ...
+	xorl	%eax,%r11d  // y ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	movl	36(%rsi),%r10d  // (NEXT STEP) X9
 	movl	$0xffffffff,%r11d
-	roll	$15,%ecx
-	xorl	%eax,%r11d
-	addl	%edx,%ecx
-	leal	-343485551(%rbx,%r10,1),%ebx
-	orl	%ecx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ebx
-	movl	0(%rsi),%r10d
+	roll	$15,%ecx  // dst <<< s
+	xorl	%eax,%r11d  // (NEXT STEP) not z' = not %eax
+	addl	%edx,%ecx  // dst += x
+	leal	-343485551(%rbx,%r10,1),%ebx  // Const + dst + ...
+	orl	%ecx,%r11d  // x | ...
+	xorl	%edx,%r11d  // y ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
 	movl	$0xffffffff,%r11d
-	roll	$21,%ebx
-	xorl	%edx,%r11d
-	addl	%ecx,%ebx
-
+	roll	$21,%ebx  // dst <<< s
+	xorl	%edx,%r11d  // (NEXT STEP) not z' = not %edx
+	addl	%ecx,%ebx  // dst += x
+// add old values of A, B, C, D
 	addl	%r8d,%eax
 	addl	%r9d,%ebx
 	addl	%r14d,%ecx
 	addl	%r15d,%edx
 
-
-	addq	$64,%rsi
-	cmpq	%rdi,%rsi
-	jb	L$loop
-
+// loop control
+	addq	$64,%rsi  // ptr += 64
+	cmpq	%rdi,%rsi  // cmp end with ptr
+	jb	L$loop  // jmp if ptr < end
+// END of loop over 16-word blocks
 
 L$end:
-	movl	%eax,0(%rbp)
-	movl	%ebx,4(%rbp)
-	movl	%ecx,8(%rbp)
-	movl	%edx,12(%rbp)
+	movl	%eax,0(%rbp)  // ctx->A = A
+	movl	%ebx,4(%rbp)  // ctx->B = B
+	movl	%ecx,8(%rbp)  // ctx->C = C
+	movl	%edx,12(%rbp)  // ctx->D = D
 
 	movq	(%rsp),%r15

boringssl-0.20260708.tar.xz/gen/crypto/md5-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/crypto/md5-x86_64-linux.S Changed

@@ -30,651 +30,651 @@
 .cfi_offset	r15,-48
 .Lprologue:
 
+// rdi = arg #1 (ctx, MD5_CTX pointer)
+// rsi = arg #2 (ptr, data pointer)
+// rdx = arg #3 (nbr, number of 16-word blocks to process)
+	movq	%rdi,%rbp  // rbp = ctx
+	shlq	$6,%rdx  // rdx = nbr in bytes
+	leaq	(%rsi,%rdx,1),%rdi  // rdi = end
+	movl	0(%rbp),%eax  // eax = ctx->A
+	movl	4(%rbp),%ebx  // ebx = ctx->B
+	movl	8(%rbp),%ecx  // ecx = ctx->C
+	movl	12(%rbp),%edx  // edx = ctx->D
+// end is 'rdi'
+// ptr is 'rsi'
+// A is 'eax'
+// B is 'ebx'
+// C is 'ecx'
+// D is 'edx'
 
+	cmpq	%rdi,%rsi  // cmp end with ptr
+	je	.Lend  // jmp if ptr == end
 
-
-	movq	%rdi,%rbp
-	shlq	$6,%rdx
-	leaq	(%rsi,%rdx,1),%rdi
-	movl	0(%rbp),%eax
-	movl	4(%rbp),%ebx
-	movl	8(%rbp),%ecx
-	movl	12(%rbp),%edx
-
-
-
-
-
-
-
-	cmpq	%rdi,%rsi
-	je	.Lend
-
-
-.Lloop:
+// BEGIN of loop over 16-word blocks
+.Lloop:  // save old values of A, B, C, D
 	movl	%eax,%r8d
 	movl	%ebx,%r9d
 	movl	%ecx,%r14d
 	movl	%edx,%r15d
-	movl	0(%rsi),%r10d
-	movl	%edx,%r11d
-	xorl	%ecx,%r11d
-	leal	-680876936(%rax,%r10,1),%eax
-	andl	%ebx,%r11d
-	xorl	%edx,%r11d
-	movl	4(%rsi),%r10d
-	addl	%r11d,%eax
-	roll	$7,%eax
-	movl	%ecx,%r11d
-	addl	%ebx,%eax
-	xorl	%ebx,%r11d
-	leal	-389564586(%rdx,%r10,1),%edx
-	andl	%eax,%r11d
-	xorl	%ecx,%r11d
-	movl	8(%rsi),%r10d
-	addl	%r11d,%edx
-	roll	$12,%edx
-	movl	%ebx,%r11d
-	addl	%eax,%edx
-	xorl	%eax,%r11d
-	leal	606105819(%rcx,%r10,1),%ecx
-	andl	%edx,%r11d
-	xorl	%ebx,%r11d
-	movl	12(%rsi),%r10d
-	addl	%r11d,%ecx
-	roll	$17,%ecx
-	movl	%eax,%r11d
-	addl	%edx,%ecx
-	xorl	%edx,%r11d
-	leal	-1044525330(%rbx,%r10,1),%ebx
-	andl	%ecx,%r11d
-	xorl	%eax,%r11d
-	movl	16(%rsi),%r10d
-	addl	%r11d,%ebx
-	roll	$22,%ebx
-	movl	%edx,%r11d
-	addl	%ecx,%ebx
-	xorl	%ecx,%r11d
-	leal	-176418897(%rax,%r10,1),%eax
-	andl	%ebx,%r11d
-	xorl	%edx,%r11d
-	movl	20(%rsi),%r10d
-	addl	%r11d,%eax
-	roll	$7,%eax
-	movl	%ecx,%r11d
-	addl	%ebx,%eax
-	xorl	%ebx,%r11d
-	leal	1200080426(%rdx,%r10,1),%edx
-	andl	%eax,%r11d
-	xorl	%ecx,%r11d
-	movl	24(%rsi),%r10d
-	addl	%r11d,%edx
-	roll	$12,%edx
-	movl	%ebx,%r11d
-	addl	%eax,%edx
-	xorl	%eax,%r11d
-	leal	-1473231341(%rcx,%r10,1),%ecx
-	andl	%edx,%r11d
-	xorl	%ebx,%r11d
-	movl	28(%rsi),%r10d
-	addl	%r11d,%ecx
-	roll	$17,%ecx
-	movl	%eax,%r11d
-	addl	%edx,%ecx
-	xorl	%edx,%r11d
-	leal	-45705983(%rbx,%r10,1),%ebx
-	andl	%ecx,%r11d
-	xorl	%eax,%r11d
-	movl	32(%rsi),%r10d
-	addl	%r11d,%ebx
-	roll	$22,%ebx
-	movl	%edx,%r11d
-	addl	%ecx,%ebx
-	xorl	%ecx,%r11d
-	leal	1770035416(%rax,%r10,1),%eax
-	andl	%ebx,%r11d
-	xorl	%edx,%r11d
-	movl	36(%rsi),%r10d
-	addl	%r11d,%eax
-	roll	$7,%eax
-	movl	%ecx,%r11d
-	addl	%ebx,%eax
-	xorl	%ebx,%r11d
-	leal	-1958414417(%rdx,%r10,1),%edx
-	andl	%eax,%r11d
-	xorl	%ecx,%r11d
-	movl	40(%rsi),%r10d
-	addl	%r11d,%edx
-	roll	$12,%edx
-	movl	%ebx,%r11d
-	addl	%eax,%edx
-	xorl	%eax,%r11d
-	leal	-42063(%rcx,%r10,1),%ecx
-	andl	%edx,%r11d
-	xorl	%ebx,%r11d
-	movl	44(%rsi),%r10d
-	addl	%r11d,%ecx
-	roll	$17,%ecx
-	movl	%eax,%r11d
-	addl	%edx,%ecx
-	xorl	%edx,%r11d
-	leal	-1990404162(%rbx,%r10,1),%ebx
-	andl	%ecx,%r11d
-	xorl	%eax,%r11d
-	movl	48(%rsi),%r10d
-	addl	%r11d,%ebx
-	roll	$22,%ebx
-	movl	%edx,%r11d
-	addl	%ecx,%ebx
-	xorl	%ecx,%r11d
-	leal	1804603682(%rax,%r10,1),%eax
-	andl	%ebx,%r11d
-	xorl	%edx,%r11d
-	movl	52(%rsi),%r10d
-	addl	%r11d,%eax
-	roll	$7,%eax
-	movl	%ecx,%r11d
-	addl	%ebx,%eax
-	xorl	%ebx,%r11d
-	leal	-40341101(%rdx,%r10,1),%edx
-	andl	%eax,%r11d
-	xorl	%ecx,%r11d
-	movl	56(%rsi),%r10d
-	addl	%r11d,%edx
-	roll	$12,%edx
-	movl	%ebx,%r11d
-	addl	%eax,%edx
-	xorl	%eax,%r11d
-	leal	-1502002290(%rcx,%r10,1),%ecx
-	andl	%edx,%r11d
-	xorl	%ebx,%r11d
-	movl	60(%rsi),%r10d
-	addl	%r11d,%ecx
-	roll	$17,%ecx
-	movl	%eax,%r11d
-	addl	%edx,%ecx
-	xorl	%edx,%r11d
-	leal	1236535329(%rbx,%r10,1),%ebx
-	andl	%ecx,%r11d
-	xorl	%eax,%r11d
-	movl	0(%rsi),%r10d
-	addl	%r11d,%ebx
-	roll	$22,%ebx
-	movl	%edx,%r11d
-	addl	%ecx,%ebx
-	movl	4(%rsi),%r10d
-	movl	%edx,%r11d
-	movl	%edx,%r12d
-	notl	%r11d
-	leal	-165796510(%rax,%r10,1),%eax
-	andl	%ebx,%r12d
-	andl	%ecx,%r11d
-	movl	24(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ecx,%r11d
-	addl	%r12d,%eax
-	movl	%ecx,%r12d
-	roll	$5,%eax
-	addl	%ebx,%eax
-	notl	%r11d
-	leal	-1069501632(%rdx,%r10,1),%edx
-	andl	%eax,%r12d
-	andl	%ebx,%r11d
-	movl	44(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ebx,%r11d
-	addl	%r12d,%edx
-	movl	%ebx,%r12d
-	roll	$9,%edx
-	addl	%eax,%edx
-	notl	%r11d
-	leal	643717713(%rcx,%r10,1),%ecx
-	andl	%edx,%r12d
-	andl	%eax,%r11d
-	movl	0(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%eax,%r11d
-	addl	%r12d,%ecx
-	movl	%eax,%r12d
-	roll	$14,%ecx
-	addl	%edx,%ecx
-	notl	%r11d
-	leal	-373897302(%rbx,%r10,1),%ebx
-	andl	%ecx,%r12d
-	andl	%edx,%r11d
-	movl	20(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%edx,%r11d
-	addl	%r12d,%ebx
-	movl	%edx,%r12d
-	roll	$20,%ebx
-	addl	%ecx,%ebx
-	notl	%r11d
-	leal	-701558691(%rax,%r10,1),%eax
-	andl	%ebx,%r12d
-	andl	%ecx,%r11d
-	movl	40(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ecx,%r11d
-	addl	%r12d,%eax
-	movl	%ecx,%r12d
-	roll	$5,%eax
-	addl	%ebx,%eax
-	notl	%r11d
-	leal	38016083(%rdx,%r10,1),%edx
-	andl	%eax,%r12d
-	andl	%ebx,%r11d
-	movl	60(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ebx,%r11d
-	addl	%r12d,%edx
-	movl	%ebx,%r12d
-	roll	$9,%edx
-	addl	%eax,%edx
-	notl	%r11d
-	leal	-660478335(%rcx,%r10,1),%ecx
-	andl	%edx,%r12d
-	andl	%eax,%r11d
-	movl	16(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%eax,%r11d
-	addl	%r12d,%ecx
-	movl	%eax,%r12d
-	roll	$14,%ecx
-	addl	%edx,%ecx
-	notl	%r11d
-	leal	-405537848(%rbx,%r10,1),%ebx
-	andl	%ecx,%r12d
-	andl	%edx,%r11d
-	movl	36(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%edx,%r11d
-	addl	%r12d,%ebx
-	movl	%edx,%r12d
-	roll	$20,%ebx
-	addl	%ecx,%ebx
-	notl	%r11d
-	leal	568446438(%rax,%r10,1),%eax
-	andl	%ebx,%r12d
-	andl	%ecx,%r11d
-	movl	56(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ecx,%r11d
-	addl	%r12d,%eax
-	movl	%ecx,%r12d
-	roll	$5,%eax
-	addl	%ebx,%eax
-	notl	%r11d
-	leal	-1019803690(%rdx,%r10,1),%edx
-	andl	%eax,%r12d
-	andl	%ebx,%r11d
-	movl	12(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ebx,%r11d
-	addl	%r12d,%edx
-	movl	%ebx,%r12d
-	roll	$9,%edx
-	addl	%eax,%edx
-	notl	%r11d
-	leal	-187363961(%rcx,%r10,1),%ecx
-	andl	%edx,%r12d
-	andl	%eax,%r11d
-	movl	32(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%eax,%r11d
-	addl	%r12d,%ecx
-	movl	%eax,%r12d
-	roll	$14,%ecx
-	addl	%edx,%ecx
-	notl	%r11d
-	leal	1163531501(%rbx,%r10,1),%ebx
-	andl	%ecx,%r12d
-	andl	%edx,%r11d
-	movl	52(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%edx,%r11d
-	addl	%r12d,%ebx
-	movl	%edx,%r12d
-	roll	$20,%ebx
-	addl	%ecx,%ebx
-	notl	%r11d
-	leal	-1444681467(%rax,%r10,1),%eax
-	andl	%ebx,%r12d
-	andl	%ecx,%r11d
-	movl	8(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ecx,%r11d
-	addl	%r12d,%eax
-	movl	%ecx,%r12d
-	roll	$5,%eax
-	addl	%ebx,%eax
-	notl	%r11d
-	leal	-51403784(%rdx,%r10,1),%edx
-	andl	%eax,%r12d
-	andl	%ebx,%r11d
-	movl	28(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%ebx,%r11d
-	addl	%r12d,%edx
-	movl	%ebx,%r12d
-	roll	$9,%edx
-	addl	%eax,%edx
-	notl	%r11d
-	leal	1735328473(%rcx,%r10,1),%ecx
-	andl	%edx,%r12d
-	andl	%eax,%r11d
-	movl	48(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%eax,%r11d
-	addl	%r12d,%ecx
-	movl	%eax,%r12d
-	roll	$14,%ecx
-	addl	%edx,%ecx
-	notl	%r11d
-	leal	-1926607734(%rbx,%r10,1),%ebx
-	andl	%ecx,%r12d
-	andl	%edx,%r11d
-	movl	0(%rsi),%r10d
-	orl	%r11d,%r12d
-	movl	%edx,%r11d
-	addl	%r12d,%ebx
-	movl	%edx,%r12d
-	roll	$20,%ebx
-	addl	%ecx,%ebx
-	movl	20(%rsi),%r10d
-	movl	%ecx,%r11d
-	leal	-378558(%rax,%r10,1),%eax
-	movl	32(%rsi),%r10d
-	xorl	%edx,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%eax
-	roll	$4,%eax
-	movl	%ebx,%r11d
-	addl	%ebx,%eax
-	leal	-2022574463(%rdx,%r10,1),%edx
-	movl	44(%rsi),%r10d
-	xorl	%ecx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%edx
-	roll	$11,%edx
-	movl	%eax,%r11d
-	addl	%eax,%edx
-	leal	1839030562(%rcx,%r10,1),%ecx
-	movl	56(%rsi),%r10d
-	xorl	%ebx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ecx
-	roll	$16,%ecx
-	movl	%edx,%r11d
-	addl	%edx,%ecx
-	leal	-35309556(%rbx,%r10,1),%ebx
-	movl	4(%rsi),%r10d
-	xorl	%eax,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%ebx
-	roll	$23,%ebx
-	movl	%ecx,%r11d
-	addl	%ecx,%ebx
-	leal	-1530992060(%rax,%r10,1),%eax
-	movl	16(%rsi),%r10d
-	xorl	%edx,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%eax
-	roll	$4,%eax
-	movl	%ebx,%r11d
-	addl	%ebx,%eax
-	leal	1272893353(%rdx,%r10,1),%edx
-	movl	28(%rsi),%r10d
-	xorl	%ecx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%edx
-	roll	$11,%edx
-	movl	%eax,%r11d
-	addl	%eax,%edx
-	leal	-155497632(%rcx,%r10,1),%ecx
-	movl	40(%rsi),%r10d
-	xorl	%ebx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ecx
-	roll	$16,%ecx
-	movl	%edx,%r11d
-	addl	%edx,%ecx
-	leal	-1094730640(%rbx,%r10,1),%ebx
-	movl	52(%rsi),%r10d
-	xorl	%eax,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%ebx
-	roll	$23,%ebx
-	movl	%ecx,%r11d
-	addl	%ecx,%ebx
-	leal	681279174(%rax,%r10,1),%eax
-	movl	0(%rsi),%r10d
-	xorl	%edx,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%eax
-	roll	$4,%eax
-	movl	%ebx,%r11d
-	addl	%ebx,%eax
-	leal	-358537222(%rdx,%r10,1),%edx
-	movl	12(%rsi),%r10d
-	xorl	%ecx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%edx
-	roll	$11,%edx
-	movl	%eax,%r11d
-	addl	%eax,%edx
-	leal	-722521979(%rcx,%r10,1),%ecx
-	movl	24(%rsi),%r10d
-	xorl	%ebx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ecx
-	roll	$16,%ecx
-	movl	%edx,%r11d
-	addl	%edx,%ecx
-	leal	76029189(%rbx,%r10,1),%ebx
-	movl	36(%rsi),%r10d
-	xorl	%eax,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%ebx
-	roll	$23,%ebx
-	movl	%ecx,%r11d
-	addl	%ecx,%ebx
-	leal	-640364487(%rax,%r10,1),%eax
-	movl	48(%rsi),%r10d
-	xorl	%edx,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%eax
-	roll	$4,%eax
-	movl	%ebx,%r11d
-	addl	%ebx,%eax
-	leal	-421815835(%rdx,%r10,1),%edx
-	movl	60(%rsi),%r10d
-	xorl	%ecx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%edx
-	roll	$11,%edx
-	movl	%eax,%r11d
-	addl	%eax,%edx
-	leal	530742520(%rcx,%r10,1),%ecx
-	movl	8(%rsi),%r10d
-	xorl	%ebx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ecx
-	roll	$16,%ecx
-	movl	%edx,%r11d
-	addl	%edx,%ecx
-	leal	-995338651(%rbx,%r10,1),%ebx
-	movl	0(%rsi),%r10d
-	xorl	%eax,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%ebx
-	roll	$23,%ebx
-	movl	%ecx,%r11d
-	addl	%ecx,%ebx
-	movl	0(%rsi),%r10d
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	xorl	%ecx,%r11d  // y ^ ...
+	leal	-680876936(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r11d  // x & ...
+	xorl	%edx,%r11d  // z ^ ...
+	movl	4(%rsi),%r10d  // (NEXT STEP) X1
+	addl	%r11d,%eax  // dst += ...
+	roll	$7,%eax  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%ebx,%eax  // dst += x
+	xorl	%ebx,%r11d  // y ^ ...
+	leal	-389564586(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r11d  // x & ...
+	xorl	%ecx,%r11d  // z ^ ...
+	movl	8(%rsi),%r10d  // (NEXT STEP) X2
+	addl	%r11d,%edx  // dst += ...
+	roll	$12,%edx  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%eax,%edx  // dst += x
+	xorl	%eax,%r11d  // y ^ ...
+	leal	606105819(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r11d  // x & ...
+	xorl	%ebx,%r11d  // z ^ ...
+	movl	12(%rsi),%r10d  // (NEXT STEP) X3
+	addl	%r11d,%ecx  // dst += ...
+	roll	$17,%ecx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%edx,%ecx  // dst += x
+	xorl	%edx,%r11d  // y ^ ...
+	leal	-1044525330(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r11d  // x & ...
+	xorl	%eax,%r11d  // z ^ ...
+	movl	16(%rsi),%r10d  // (NEXT STEP) X4
+	addl	%r11d,%ebx  // dst += ...
+	roll	$22,%ebx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%ecx,%ebx  // dst += x
+	xorl	%ecx,%r11d  // y ^ ...
+	leal	-176418897(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r11d  // x & ...
+	xorl	%edx,%r11d  // z ^ ...
+	movl	20(%rsi),%r10d  // (NEXT STEP) X5
+	addl	%r11d,%eax  // dst += ...
+	roll	$7,%eax  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%ebx,%eax  // dst += x
+	xorl	%ebx,%r11d  // y ^ ...
+	leal	1200080426(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r11d  // x & ...
+	xorl	%ecx,%r11d  // z ^ ...
+	movl	24(%rsi),%r10d  // (NEXT STEP) X6
+	addl	%r11d,%edx  // dst += ...
+	roll	$12,%edx  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%eax,%edx  // dst += x
+	xorl	%eax,%r11d  // y ^ ...
+	leal	-1473231341(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r11d  // x & ...
+	xorl	%ebx,%r11d  // z ^ ...
+	movl	28(%rsi),%r10d  // (NEXT STEP) X7
+	addl	%r11d,%ecx  // dst += ...
+	roll	$17,%ecx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%edx,%ecx  // dst += x
+	xorl	%edx,%r11d  // y ^ ...
+	leal	-45705983(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r11d  // x & ...
+	xorl	%eax,%r11d  // z ^ ...
+	movl	32(%rsi),%r10d  // (NEXT STEP) X8
+	addl	%r11d,%ebx  // dst += ...
+	roll	$22,%ebx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%ecx,%ebx  // dst += x
+	xorl	%ecx,%r11d  // y ^ ...
+	leal	1770035416(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r11d  // x & ...
+	xorl	%edx,%r11d  // z ^ ...
+	movl	36(%rsi),%r10d  // (NEXT STEP) X9
+	addl	%r11d,%eax  // dst += ...
+	roll	$7,%eax  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%ebx,%eax  // dst += x
+	xorl	%ebx,%r11d  // y ^ ...
+	leal	-1958414417(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r11d  // x & ...
+	xorl	%ecx,%r11d  // z ^ ...
+	movl	40(%rsi),%r10d  // (NEXT STEP) X10
+	addl	%r11d,%edx  // dst += ...
+	roll	$12,%edx  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%eax,%edx  // dst += x
+	xorl	%eax,%r11d  // y ^ ...
+	leal	-42063(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r11d  // x & ...
+	xorl	%ebx,%r11d  // z ^ ...
+	movl	44(%rsi),%r10d  // (NEXT STEP) X11
+	addl	%r11d,%ecx  // dst += ...
+	roll	$17,%ecx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%edx,%ecx  // dst += x
+	xorl	%edx,%r11d  // y ^ ...
+	leal	-1990404162(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r11d  // x & ...
+	xorl	%eax,%r11d  // z ^ ...
+	movl	48(%rsi),%r10d  // (NEXT STEP) X12
+	addl	%r11d,%ebx  // dst += ...
+	roll	$22,%ebx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%ecx,%ebx  // dst += x
+	xorl	%ecx,%r11d  // y ^ ...
+	leal	1804603682(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r11d  // x & ...
+	xorl	%edx,%r11d  // z ^ ...
+	movl	52(%rsi),%r10d  // (NEXT STEP) X13
+	addl	%r11d,%eax  // dst += ...
+	roll	$7,%eax  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%ebx,%eax  // dst += x
+	xorl	%ebx,%r11d  // y ^ ...
+	leal	-40341101(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r11d  // x & ...
+	xorl	%ecx,%r11d  // z ^ ...
+	movl	56(%rsi),%r10d  // (NEXT STEP) X14
+	addl	%r11d,%edx  // dst += ...
+	roll	$12,%edx  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%eax,%edx  // dst += x
+	xorl	%eax,%r11d  // y ^ ...
+	leal	-1502002290(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r11d  // x & ...
+	xorl	%ebx,%r11d  // z ^ ...
+	movl	60(%rsi),%r10d  // (NEXT STEP) X15
+	addl	%r11d,%ecx  // dst += ...
+	roll	$17,%ecx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%edx,%ecx  // dst += x
+	xorl	%edx,%r11d  // y ^ ...
+	leal	1236535329(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r11d  // x & ...
+	xorl	%eax,%r11d  // z ^ ...
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
+	addl	%r11d,%ebx  // dst += ...
+	roll	$22,%ebx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%ecx,%ebx  // dst += x
+	movl	4(%rsi),%r10d  // (NEXT STEP) X1
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	movl	%edx,%r12d  // (NEXT STEP) z' = %edx
+	notl	%r11d  // not z
+	leal	-165796510(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r12d  // x & z
+	andl	%ecx,%r11d  // y & (not z)
+	movl	24(%rsi),%r10d  // (NEXT STEP) X6
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%r12d,%eax  // dst += ...
+	movl	%ecx,%r12d  // (NEXT STEP) z' = %ecx
+	roll	$5,%eax  // dst <<< s
+	addl	%ebx,%eax  // dst += x
+	notl	%r11d  // not z
+	leal	-1069501632(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r12d  // x & z
+	andl	%ebx,%r11d  // y & (not z)
+	movl	44(%rsi),%r10d  // (NEXT STEP) X11
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%r12d,%edx  // dst += ...
+	movl	%ebx,%r12d  // (NEXT STEP) z' = %ebx
+	roll	$9,%edx  // dst <<< s
+	addl	%eax,%edx  // dst += x
+	notl	%r11d  // not z
+	leal	643717713(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r12d  // x & z
+	andl	%eax,%r11d  // y & (not z)
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%r12d,%ecx  // dst += ...
+	movl	%eax,%r12d  // (NEXT STEP) z' = %eax
+	roll	$14,%ecx  // dst <<< s
+	addl	%edx,%ecx  // dst += x
+	notl	%r11d  // not z
+	leal	-373897302(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r12d  // x & z
+	andl	%edx,%r11d  // y & (not z)
+	movl	20(%rsi),%r10d  // (NEXT STEP) X5
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%r12d,%ebx  // dst += ...
+	movl	%edx,%r12d  // (NEXT STEP) z' = %edx
+	roll	$20,%ebx  // dst <<< s
+	addl	%ecx,%ebx  // dst += x
+	notl	%r11d  // not z
+	leal	-701558691(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r12d  // x & z
+	andl	%ecx,%r11d  // y & (not z)
+	movl	40(%rsi),%r10d  // (NEXT STEP) X10
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%r12d,%eax  // dst += ...
+	movl	%ecx,%r12d  // (NEXT STEP) z' = %ecx
+	roll	$5,%eax  // dst <<< s
+	addl	%ebx,%eax  // dst += x
+	notl	%r11d  // not z
+	leal	38016083(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r12d  // x & z
+	andl	%ebx,%r11d  // y & (not z)
+	movl	60(%rsi),%r10d  // (NEXT STEP) X15
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%r12d,%edx  // dst += ...
+	movl	%ebx,%r12d  // (NEXT STEP) z' = %ebx
+	roll	$9,%edx  // dst <<< s
+	addl	%eax,%edx  // dst += x
+	notl	%r11d  // not z
+	leal	-660478335(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r12d  // x & z
+	andl	%eax,%r11d  // y & (not z)
+	movl	16(%rsi),%r10d  // (NEXT STEP) X4
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%r12d,%ecx  // dst += ...
+	movl	%eax,%r12d  // (NEXT STEP) z' = %eax
+	roll	$14,%ecx  // dst <<< s
+	addl	%edx,%ecx  // dst += x
+	notl	%r11d  // not z
+	leal	-405537848(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r12d  // x & z
+	andl	%edx,%r11d  // y & (not z)
+	movl	36(%rsi),%r10d  // (NEXT STEP) X9
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%r12d,%ebx  // dst += ...
+	movl	%edx,%r12d  // (NEXT STEP) z' = %edx
+	roll	$20,%ebx  // dst <<< s
+	addl	%ecx,%ebx  // dst += x
+	notl	%r11d  // not z
+	leal	568446438(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r12d  // x & z
+	andl	%ecx,%r11d  // y & (not z)
+	movl	56(%rsi),%r10d  // (NEXT STEP) X14
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%r12d,%eax  // dst += ...
+	movl	%ecx,%r12d  // (NEXT STEP) z' = %ecx
+	roll	$5,%eax  // dst <<< s
+	addl	%ebx,%eax  // dst += x
+	notl	%r11d  // not z
+	leal	-1019803690(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r12d  // x & z
+	andl	%ebx,%r11d  // y & (not z)
+	movl	12(%rsi),%r10d  // (NEXT STEP) X3
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%r12d,%edx  // dst += ...
+	movl	%ebx,%r12d  // (NEXT STEP) z' = %ebx
+	roll	$9,%edx  // dst <<< s
+	addl	%eax,%edx  // dst += x
+	notl	%r11d  // not z
+	leal	-187363961(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r12d  // x & z
+	andl	%eax,%r11d  // y & (not z)
+	movl	32(%rsi),%r10d  // (NEXT STEP) X8
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%r12d,%ecx  // dst += ...
+	movl	%eax,%r12d  // (NEXT STEP) z' = %eax
+	roll	$14,%ecx  // dst <<< s
+	addl	%edx,%ecx  // dst += x
+	notl	%r11d  // not z
+	leal	1163531501(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r12d  // x & z
+	andl	%edx,%r11d  // y & (not z)
+	movl	52(%rsi),%r10d  // (NEXT STEP) X13
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%r12d,%ebx  // dst += ...
+	movl	%edx,%r12d  // (NEXT STEP) z' = %edx
+	roll	$20,%ebx  // dst <<< s
+	addl	%ecx,%ebx  // dst += x
+	notl	%r11d  // not z
+	leal	-1444681467(%rax,%r10,1),%eax  // Const + dst + ...
+	andl	%ebx,%r12d  // x & z
+	andl	%ecx,%r11d  // y & (not z)
+	movl	8(%rsi),%r10d  // (NEXT STEP) X2
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ecx,%r11d  // (NEXT STEP) z' = %ecx
+	addl	%r12d,%eax  // dst += ...
+	movl	%ecx,%r12d  // (NEXT STEP) z' = %ecx
+	roll	$5,%eax  // dst <<< s
+	addl	%ebx,%eax  // dst += x
+	notl	%r11d  // not z
+	leal	-51403784(%rdx,%r10,1),%edx  // Const + dst + ...
+	andl	%eax,%r12d  // x & z
+	andl	%ebx,%r11d  // y & (not z)
+	movl	28(%rsi),%r10d  // (NEXT STEP) X7
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%ebx,%r11d  // (NEXT STEP) z' = %ebx
+	addl	%r12d,%edx  // dst += ...
+	movl	%ebx,%r12d  // (NEXT STEP) z' = %ebx
+	roll	$9,%edx  // dst <<< s
+	addl	%eax,%edx  // dst += x
+	notl	%r11d  // not z
+	leal	1735328473(%rcx,%r10,1),%ecx  // Const + dst + ...
+	andl	%edx,%r12d  // x & z
+	andl	%eax,%r11d  // y & (not z)
+	movl	48(%rsi),%r10d  // (NEXT STEP) X12
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%eax,%r11d  // (NEXT STEP) z' = %eax
+	addl	%r12d,%ecx  // dst += ...
+	movl	%eax,%r12d  // (NEXT STEP) z' = %eax
+	roll	$14,%ecx  // dst <<< s
+	addl	%edx,%ecx  // dst += x
+	notl	%r11d  // not z
+	leal	-1926607734(%rbx,%r10,1),%ebx  // Const + dst + ...
+	andl	%ecx,%r12d  // x & z
+	andl	%edx,%r11d  // y & (not z)
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
+	orl	%r11d,%r12d  // (y & (not z)) | (x & z)
+	movl	%edx,%r11d  // (NEXT STEP) z' = %edx
+	addl	%r12d,%ebx  // dst += ...
+	movl	%edx,%r12d  // (NEXT STEP) z' = %edx
+	roll	$20,%ebx  // dst <<< s
+	addl	%ecx,%ebx  // dst += x
+	movl	20(%rsi),%r10d  // (NEXT STEP) X5
+	movl	%ecx,%r11d  // (NEXT STEP) y' = %ecx
+	leal	-378558(%rax,%r10,1),%eax  // Const + dst + ...
+	movl	32(%rsi),%r10d  // (NEXT STEP) X8
+	xorl	%edx,%r11d  // z ^ ...
+	xorl	%ebx,%r11d  // x ^ ...
+	addl	%r11d,%eax  // dst += ...
+	roll	$4,%eax  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) y' = %ebx
+	addl	%ebx,%eax  // dst += x
+	leal	-2022574463(%rdx,%r10,1),%edx  // Const + dst + ...
+	movl	44(%rsi),%r10d  // (NEXT STEP) X11
+	xorl	%ecx,%r11d  // z ^ ...
+	xorl	%eax,%r11d  // x ^ ...
+	addl	%r11d,%edx  // dst += ...
+	roll	$11,%edx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) y' = %eax
+	addl	%eax,%edx  // dst += x
+	leal	1839030562(%rcx,%r10,1),%ecx  // Const + dst + ...
+	movl	56(%rsi),%r10d  // (NEXT STEP) X14
+	xorl	%ebx,%r11d  // z ^ ...
+	xorl	%edx,%r11d  // x ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	roll	$16,%ecx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) y' = %edx
+	addl	%edx,%ecx  // dst += x
+	leal	-35309556(%rbx,%r10,1),%ebx  // Const + dst + ...
+	movl	4(%rsi),%r10d  // (NEXT STEP) X1
+	xorl	%eax,%r11d  // z ^ ...
+	xorl	%ecx,%r11d  // x ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	roll	$23,%ebx  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) y' = %ecx
+	addl	%ecx,%ebx  // dst += x
+	leal	-1530992060(%rax,%r10,1),%eax  // Const + dst + ...
+	movl	16(%rsi),%r10d  // (NEXT STEP) X4
+	xorl	%edx,%r11d  // z ^ ...
+	xorl	%ebx,%r11d  // x ^ ...
+	addl	%r11d,%eax  // dst += ...
+	roll	$4,%eax  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) y' = %ebx
+	addl	%ebx,%eax  // dst += x
+	leal	1272893353(%rdx,%r10,1),%edx  // Const + dst + ...
+	movl	28(%rsi),%r10d  // (NEXT STEP) X7
+	xorl	%ecx,%r11d  // z ^ ...
+	xorl	%eax,%r11d  // x ^ ...
+	addl	%r11d,%edx  // dst += ...
+	roll	$11,%edx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) y' = %eax
+	addl	%eax,%edx  // dst += x
+	leal	-155497632(%rcx,%r10,1),%ecx  // Const + dst + ...
+	movl	40(%rsi),%r10d  // (NEXT STEP) X10
+	xorl	%ebx,%r11d  // z ^ ...
+	xorl	%edx,%r11d  // x ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	roll	$16,%ecx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) y' = %edx
+	addl	%edx,%ecx  // dst += x
+	leal	-1094730640(%rbx,%r10,1),%ebx  // Const + dst + ...
+	movl	52(%rsi),%r10d  // (NEXT STEP) X13
+	xorl	%eax,%r11d  // z ^ ...
+	xorl	%ecx,%r11d  // x ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	roll	$23,%ebx  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) y' = %ecx
+	addl	%ecx,%ebx  // dst += x
+	leal	681279174(%rax,%r10,1),%eax  // Const + dst + ...
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
+	xorl	%edx,%r11d  // z ^ ...
+	xorl	%ebx,%r11d  // x ^ ...
+	addl	%r11d,%eax  // dst += ...
+	roll	$4,%eax  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) y' = %ebx
+	addl	%ebx,%eax  // dst += x
+	leal	-358537222(%rdx,%r10,1),%edx  // Const + dst + ...
+	movl	12(%rsi),%r10d  // (NEXT STEP) X3
+	xorl	%ecx,%r11d  // z ^ ...
+	xorl	%eax,%r11d  // x ^ ...
+	addl	%r11d,%edx  // dst += ...
+	roll	$11,%edx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) y' = %eax
+	addl	%eax,%edx  // dst += x
+	leal	-722521979(%rcx,%r10,1),%ecx  // Const + dst + ...
+	movl	24(%rsi),%r10d  // (NEXT STEP) X6
+	xorl	%ebx,%r11d  // z ^ ...
+	xorl	%edx,%r11d  // x ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	roll	$16,%ecx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) y' = %edx
+	addl	%edx,%ecx  // dst += x
+	leal	76029189(%rbx,%r10,1),%ebx  // Const + dst + ...
+	movl	36(%rsi),%r10d  // (NEXT STEP) X9
+	xorl	%eax,%r11d  // z ^ ...
+	xorl	%ecx,%r11d  // x ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	roll	$23,%ebx  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) y' = %ecx
+	addl	%ecx,%ebx  // dst += x
+	leal	-640364487(%rax,%r10,1),%eax  // Const + dst + ...
+	movl	48(%rsi),%r10d  // (NEXT STEP) X12
+	xorl	%edx,%r11d  // z ^ ...
+	xorl	%ebx,%r11d  // x ^ ...
+	addl	%r11d,%eax  // dst += ...
+	roll	$4,%eax  // dst <<< s
+	movl	%ebx,%r11d  // (NEXT STEP) y' = %ebx
+	addl	%ebx,%eax  // dst += x
+	leal	-421815835(%rdx,%r10,1),%edx  // Const + dst + ...
+	movl	60(%rsi),%r10d  // (NEXT STEP) X15
+	xorl	%ecx,%r11d  // z ^ ...
+	xorl	%eax,%r11d  // x ^ ...
+	addl	%r11d,%edx  // dst += ...
+	roll	$11,%edx  // dst <<< s
+	movl	%eax,%r11d  // (NEXT STEP) y' = %eax
+	addl	%eax,%edx  // dst += x
+	leal	530742520(%rcx,%r10,1),%ecx  // Const + dst + ...
+	movl	8(%rsi),%r10d  // (NEXT STEP) X2
+	xorl	%ebx,%r11d  // z ^ ...
+	xorl	%edx,%r11d  // x ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	roll	$16,%ecx  // dst <<< s
+	movl	%edx,%r11d  // (NEXT STEP) y' = %edx
+	addl	%edx,%ecx  // dst += x
+	leal	-995338651(%rbx,%r10,1),%ebx  // Const + dst + ...
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
+	xorl	%eax,%r11d  // z ^ ...
+	xorl	%ecx,%r11d  // x ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	roll	$23,%ebx  // dst <<< s
+	movl	%ecx,%r11d  // (NEXT STEP) y' = %ecx
+	addl	%ecx,%ebx  // dst += x
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
 	movl	$0xffffffff,%r11d
-	xorl	%edx,%r11d
-	leal	-198630844(%rax,%r10,1),%eax
-	orl	%ebx,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%eax
-	movl	28(%rsi),%r10d
+	xorl	%edx,%r11d  // (NEXT STEP) not z' = not %edx
+	leal	-198630844(%rax,%r10,1),%eax  // Const + dst + ...
+	orl	%ebx,%r11d  // x | ...
+	xorl	%ecx,%r11d  // y ^ ...
+	addl	%r11d,%eax  // dst += ...
+	movl	28(%rsi),%r10d  // (NEXT STEP) X7
 	movl	$0xffffffff,%r11d
-	roll	$6,%eax
-	xorl	%ecx,%r11d
-	addl	%ebx,%eax
-	leal	1126891415(%rdx,%r10,1),%edx
-	orl	%eax,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%edx
-	movl	56(%rsi),%r10d
+	roll	$6,%eax  // dst <<< s
+	xorl	%ecx,%r11d  // (NEXT STEP) not z' = not %ecx
+	addl	%ebx,%eax  // dst += x
+	leal	1126891415(%rdx,%r10,1),%edx  // Const + dst + ...
+	orl	%eax,%r11d  // x | ...
+	xorl	%ebx,%r11d  // y ^ ...
+	addl	%r11d,%edx  // dst += ...
+	movl	56(%rsi),%r10d  // (NEXT STEP) X14
 	movl	$0xffffffff,%r11d
-	roll	$10,%edx
-	xorl	%ebx,%r11d
-	addl	%eax,%edx
-	leal	-1416354905(%rcx,%r10,1),%ecx
-	orl	%edx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%ecx
-	movl	20(%rsi),%r10d
+	roll	$10,%edx  // dst <<< s
+	xorl	%ebx,%r11d  // (NEXT STEP) not z' = not %ebx
+	addl	%eax,%edx  // dst += x
+	leal	-1416354905(%rcx,%r10,1),%ecx  // Const + dst + ...
+	orl	%edx,%r11d  // x | ...
+	xorl	%eax,%r11d  // y ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	movl	20(%rsi),%r10d  // (NEXT STEP) X5
 	movl	$0xffffffff,%r11d
-	roll	$15,%ecx
-	xorl	%eax,%r11d
-	addl	%edx,%ecx
-	leal	-57434055(%rbx,%r10,1),%ebx
-	orl	%ecx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ebx
-	movl	48(%rsi),%r10d
+	roll	$15,%ecx  // dst <<< s
+	xorl	%eax,%r11d  // (NEXT STEP) not z' = not %eax
+	addl	%edx,%ecx  // dst += x
+	leal	-57434055(%rbx,%r10,1),%ebx  // Const + dst + ...
+	orl	%ecx,%r11d  // x | ...
+	xorl	%edx,%r11d  // y ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	movl	48(%rsi),%r10d  // (NEXT STEP) X12
 	movl	$0xffffffff,%r11d
-	roll	$21,%ebx
-	xorl	%edx,%r11d
-	addl	%ecx,%ebx
-	leal	1700485571(%rax,%r10,1),%eax
-	orl	%ebx,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%eax
-	movl	12(%rsi),%r10d
+	roll	$21,%ebx  // dst <<< s
+	xorl	%edx,%r11d  // (NEXT STEP) not z' = not %edx
+	addl	%ecx,%ebx  // dst += x
+	leal	1700485571(%rax,%r10,1),%eax  // Const + dst + ...
+	orl	%ebx,%r11d  // x | ...
+	xorl	%ecx,%r11d  // y ^ ...
+	addl	%r11d,%eax  // dst += ...
+	movl	12(%rsi),%r10d  // (NEXT STEP) X3
 	movl	$0xffffffff,%r11d
-	roll	$6,%eax
-	xorl	%ecx,%r11d
-	addl	%ebx,%eax
-	leal	-1894986606(%rdx,%r10,1),%edx
-	orl	%eax,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%edx
-	movl	40(%rsi),%r10d
+	roll	$6,%eax  // dst <<< s
+	xorl	%ecx,%r11d  // (NEXT STEP) not z' = not %ecx
+	addl	%ebx,%eax  // dst += x
+	leal	-1894986606(%rdx,%r10,1),%edx  // Const + dst + ...
+	orl	%eax,%r11d  // x | ...
+	xorl	%ebx,%r11d  // y ^ ...
+	addl	%r11d,%edx  // dst += ...
+	movl	40(%rsi),%r10d  // (NEXT STEP) X10
 	movl	$0xffffffff,%r11d
-	roll	$10,%edx
-	xorl	%ebx,%r11d
-	addl	%eax,%edx
-	leal	-1051523(%rcx,%r10,1),%ecx
-	orl	%edx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%ecx
-	movl	4(%rsi),%r10d
+	roll	$10,%edx  // dst <<< s
+	xorl	%ebx,%r11d  // (NEXT STEP) not z' = not %ebx
+	addl	%eax,%edx  // dst += x
+	leal	-1051523(%rcx,%r10,1),%ecx  // Const + dst + ...
+	orl	%edx,%r11d  // x | ...
+	xorl	%eax,%r11d  // y ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	movl	4(%rsi),%r10d  // (NEXT STEP) X1
 	movl	$0xffffffff,%r11d
-	roll	$15,%ecx
-	xorl	%eax,%r11d
-	addl	%edx,%ecx
-	leal	-2054922799(%rbx,%r10,1),%ebx
-	orl	%ecx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ebx
-	movl	32(%rsi),%r10d
+	roll	$15,%ecx  // dst <<< s
+	xorl	%eax,%r11d  // (NEXT STEP) not z' = not %eax
+	addl	%edx,%ecx  // dst += x
+	leal	-2054922799(%rbx,%r10,1),%ebx  // Const + dst + ...
+	orl	%ecx,%r11d  // x | ...
+	xorl	%edx,%r11d  // y ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	movl	32(%rsi),%r10d  // (NEXT STEP) X8
 	movl	$0xffffffff,%r11d
-	roll	$21,%ebx
-	xorl	%edx,%r11d
-	addl	%ecx,%ebx
-	leal	1873313359(%rax,%r10,1),%eax
-	orl	%ebx,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%eax
-	movl	60(%rsi),%r10d
+	roll	$21,%ebx  // dst <<< s
+	xorl	%edx,%r11d  // (NEXT STEP) not z' = not %edx
+	addl	%ecx,%ebx  // dst += x
+	leal	1873313359(%rax,%r10,1),%eax  // Const + dst + ...
+	orl	%ebx,%r11d  // x | ...
+	xorl	%ecx,%r11d  // y ^ ...
+	addl	%r11d,%eax  // dst += ...
+	movl	60(%rsi),%r10d  // (NEXT STEP) X15
 	movl	$0xffffffff,%r11d
-	roll	$6,%eax
-	xorl	%ecx,%r11d
-	addl	%ebx,%eax
-	leal	-30611744(%rdx,%r10,1),%edx
-	orl	%eax,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%edx
-	movl	24(%rsi),%r10d
+	roll	$6,%eax  // dst <<< s
+	xorl	%ecx,%r11d  // (NEXT STEP) not z' = not %ecx
+	addl	%ebx,%eax  // dst += x
+	leal	-30611744(%rdx,%r10,1),%edx  // Const + dst + ...
+	orl	%eax,%r11d  // x | ...
+	xorl	%ebx,%r11d  // y ^ ...
+	addl	%r11d,%edx  // dst += ...
+	movl	24(%rsi),%r10d  // (NEXT STEP) X6
 	movl	$0xffffffff,%r11d
-	roll	$10,%edx
-	xorl	%ebx,%r11d
-	addl	%eax,%edx
-	leal	-1560198380(%rcx,%r10,1),%ecx
-	orl	%edx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%ecx
-	movl	52(%rsi),%r10d
+	roll	$10,%edx  // dst <<< s
+	xorl	%ebx,%r11d  // (NEXT STEP) not z' = not %ebx
+	addl	%eax,%edx  // dst += x
+	leal	-1560198380(%rcx,%r10,1),%ecx  // Const + dst + ...
+	orl	%edx,%r11d  // x | ...
+	xorl	%eax,%r11d  // y ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	movl	52(%rsi),%r10d  // (NEXT STEP) X13
 	movl	$0xffffffff,%r11d
-	roll	$15,%ecx
-	xorl	%eax,%r11d
-	addl	%edx,%ecx
-	leal	1309151649(%rbx,%r10,1),%ebx
-	orl	%ecx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ebx
-	movl	16(%rsi),%r10d
+	roll	$15,%ecx  // dst <<< s
+	xorl	%eax,%r11d  // (NEXT STEP) not z' = not %eax
+	addl	%edx,%ecx  // dst += x
+	leal	1309151649(%rbx,%r10,1),%ebx  // Const + dst + ...
+	orl	%ecx,%r11d  // x | ...
+	xorl	%edx,%r11d  // y ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	movl	16(%rsi),%r10d  // (NEXT STEP) X4
 	movl	$0xffffffff,%r11d
-	roll	$21,%ebx
-	xorl	%edx,%r11d
-	addl	%ecx,%ebx
-	leal	-145523070(%rax,%r10,1),%eax
-	orl	%ebx,%r11d
-	xorl	%ecx,%r11d
-	addl	%r11d,%eax
-	movl	44(%rsi),%r10d
+	roll	$21,%ebx  // dst <<< s
+	xorl	%edx,%r11d  // (NEXT STEP) not z' = not %edx
+	addl	%ecx,%ebx  // dst += x
+	leal	-145523070(%rax,%r10,1),%eax  // Const + dst + ...
+	orl	%ebx,%r11d  // x | ...
+	xorl	%ecx,%r11d  // y ^ ...
+	addl	%r11d,%eax  // dst += ...
+	movl	44(%rsi),%r10d  // (NEXT STEP) X11
 	movl	$0xffffffff,%r11d
-	roll	$6,%eax
-	xorl	%ecx,%r11d
-	addl	%ebx,%eax
-	leal	-1120210379(%rdx,%r10,1),%edx
-	orl	%eax,%r11d
-	xorl	%ebx,%r11d
-	addl	%r11d,%edx
-	movl	8(%rsi),%r10d
+	roll	$6,%eax  // dst <<< s
+	xorl	%ecx,%r11d  // (NEXT STEP) not z' = not %ecx
+	addl	%ebx,%eax  // dst += x
+	leal	-1120210379(%rdx,%r10,1),%edx  // Const + dst + ...
+	orl	%eax,%r11d  // x | ...
+	xorl	%ebx,%r11d  // y ^ ...
+	addl	%r11d,%edx  // dst += ...
+	movl	8(%rsi),%r10d  // (NEXT STEP) X2
 	movl	$0xffffffff,%r11d
-	roll	$10,%edx
-	xorl	%ebx,%r11d
-	addl	%eax,%edx
-	leal	718787259(%rcx,%r10,1),%ecx
-	orl	%edx,%r11d
-	xorl	%eax,%r11d
-	addl	%r11d,%ecx
-	movl	36(%rsi),%r10d
+	roll	$10,%edx  // dst <<< s
+	xorl	%ebx,%r11d  // (NEXT STEP) not z' = not %ebx
+	addl	%eax,%edx  // dst += x
+	leal	718787259(%rcx,%r10,1),%ecx  // Const + dst + ...
+	orl	%edx,%r11d  // x | ...
+	xorl	%eax,%r11d  // y ^ ...
+	addl	%r11d,%ecx  // dst += ...
+	movl	36(%rsi),%r10d  // (NEXT STEP) X9
 	movl	$0xffffffff,%r11d
-	roll	$15,%ecx
-	xorl	%eax,%r11d
-	addl	%edx,%ecx
-	leal	-343485551(%rbx,%r10,1),%ebx
-	orl	%ecx,%r11d
-	xorl	%edx,%r11d
-	addl	%r11d,%ebx
-	movl	0(%rsi),%r10d
+	roll	$15,%ecx  // dst <<< s
+	xorl	%eax,%r11d  // (NEXT STEP) not z' = not %eax
+	addl	%edx,%ecx  // dst += x
+	leal	-343485551(%rbx,%r10,1),%ebx  // Const + dst + ...
+	orl	%ecx,%r11d  // x | ...
+	xorl	%edx,%r11d  // y ^ ...
+	addl	%r11d,%ebx  // dst += ...
+	movl	0(%rsi),%r10d  // (NEXT STEP) X0
 	movl	$0xffffffff,%r11d
-	roll	$21,%ebx
-	xorl	%edx,%r11d
-	addl	%ecx,%ebx
-
+	roll	$21,%ebx  // dst <<< s
+	xorl	%edx,%r11d  // (NEXT STEP) not z' = not %edx
+	addl	%ecx,%ebx  // dst += x
+// add old values of A, B, C, D
 	addl	%r8d,%eax
 	addl	%r9d,%ebx
 	addl	%r14d,%ecx
 	addl	%r15d,%edx
 
-
-	addq	$64,%rsi
-	cmpq	%rdi,%rsi
-	jb	.Lloop
-
+// loop control
+	addq	$64,%rsi  // ptr += 64
+	cmpq	%rdi,%rsi  // cmp end with ptr
+	jb	.Lloop  // jmp if ptr < end
+// END of loop over 16-word blocks
 
 .Lend:
-	movl	%eax,0(%rbp)
-	movl	%ebx,4(%rbp)
-	movl	%ecx,8(%rbp)
-	movl	%edx,12(%rbp)
+	movl	%eax,0(%rbp)  // ctx->A = A
+	movl	%ebx,4(%rbp)  // ctx->B = B
+	movl	%ecx,8(%rbp)  // ctx->C = C
+	movl	%edx,12(%rbp)  // ctx->D = D
 
 	movq	(%rsp),%r15
 .cfi_restore	r15

boringssl-0.20260708.tar.xz/gen/crypto/md5-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/crypto/md5-x86_64-win.asm Changed

@@ -41,651 +41,651 @@
 
 $L$prologue:
 
-
-
-
-	mov	rbp,rdi
-	shl	rdx,6
-	lea	rdi,rdx*1+rsi
-	mov	eax,DWORDrbp
-	mov	ebx,DWORD4+rbp
-	mov	ecx,DWORD8+rbp
-	mov	edx,DWORD12+rbp
-
-
-
-
-
-
-
-	cmp	rsi,rdi
-	je	NEAR $L$end
-
-
-$L$loop:
+; rdi = arg #1 (ctx, MD5_CTX pointer)
+; rsi = arg #2 (ptr, data pointer)
+; rdx = arg #3 (nbr, number of 16-word blocks to process)
+	mov	rbp,rdi  ; rbp = ctx
+	shl	rdx,6  ; rdx = nbr in bytes
+	lea	rdi,rdx*1+rsi  ; rdi = end
+	mov	eax,DWORDrbp  ; eax = ctx->A
+	mov	ebx,DWORD4+rbp  ; ebx = ctx->B
+	mov	ecx,DWORD8+rbp  ; ecx = ctx->C
+	mov	edx,DWORD12+rbp  ; edx = ctx->D
+; end is 'rdi'
+; ptr is 'rsi'
+; A is 'eax'
+; B is 'ebx'
+; C is 'ecx'
+; D is 'edx'
+
+	cmp	rsi,rdi  ; cmp end with ptr
+	je	NEAR $L$end  ; jmp if ptr == end
+
+; BEGIN of loop over 16-word blocks
+$L$loop:  ; save old values of A, B, C, D
 	mov	r8d,eax
 	mov	r9d,ebx
 	mov	r14d,ecx
 	mov	r15d,edx
-	mov	r10d,DWORDrsi
-	mov	r11d,edx
-	xor	r11d,ecx
-	lea	eax,((-680876936))+r10*1+rax
-	and	r11d,ebx
-	xor	r11d,edx
-	mov	r10d,DWORD4+rsi
-	add	eax,r11d
-	rol	eax,7
-	mov	r11d,ecx
-	add	eax,ebx
-	xor	r11d,ebx
-	lea	edx,((-389564586))+r10*1+rdx
-	and	r11d,eax
-	xor	r11d,ecx
-	mov	r10d,DWORD8+rsi
-	add	edx,r11d
-	rol	edx,12
-	mov	r11d,ebx
-	add	edx,eax
-	xor	r11d,eax
-	lea	ecx,606105819+r10*1+rcx
-	and	r11d,edx
-	xor	r11d,ebx
-	mov	r10d,DWORD12+rsi
-	add	ecx,r11d
-	rol	ecx,17
-	mov	r11d,eax
-	add	ecx,edx
-	xor	r11d,edx
-	lea	ebx,((-1044525330))+r10*1+rbx
-	and	r11d,ecx
-	xor	r11d,eax
-	mov	r10d,DWORD16+rsi
-	add	ebx,r11d
-	rol	ebx,22
-	mov	r11d,edx
-	add	ebx,ecx
-	xor	r11d,ecx
-	lea	eax,((-176418897))+r10*1+rax
-	and	r11d,ebx
-	xor	r11d,edx
-	mov	r10d,DWORD20+rsi
-	add	eax,r11d
-	rol	eax,7
-	mov	r11d,ecx
-	add	eax,ebx
-	xor	r11d,ebx
-	lea	edx,1200080426+r10*1+rdx
-	and	r11d,eax
-	xor	r11d,ecx
-	mov	r10d,DWORD24+rsi
-	add	edx,r11d
-	rol	edx,12
-	mov	r11d,ebx
-	add	edx,eax
-	xor	r11d,eax
-	lea	ecx,((-1473231341))+r10*1+rcx
-	and	r11d,edx
-	xor	r11d,ebx
-	mov	r10d,DWORD28+rsi
-	add	ecx,r11d
-	rol	ecx,17
-	mov	r11d,eax
-	add	ecx,edx
-	xor	r11d,edx
-	lea	ebx,((-45705983))+r10*1+rbx
-	and	r11d,ecx
-	xor	r11d,eax
-	mov	r10d,DWORD32+rsi
-	add	ebx,r11d
-	rol	ebx,22
-	mov	r11d,edx
-	add	ebx,ecx
-	xor	r11d,ecx
-	lea	eax,1770035416+r10*1+rax
-	and	r11d,ebx
-	xor	r11d,edx
-	mov	r10d,DWORD36+rsi
-	add	eax,r11d
-	rol	eax,7
-	mov	r11d,ecx
-	add	eax,ebx
-	xor	r11d,ebx
-	lea	edx,((-1958414417))+r10*1+rdx
-	and	r11d,eax
-	xor	r11d,ecx
-	mov	r10d,DWORD40+rsi
-	add	edx,r11d
-	rol	edx,12
-	mov	r11d,ebx
-	add	edx,eax
-	xor	r11d,eax
-	lea	ecx,((-42063))+r10*1+rcx
-	and	r11d,edx
-	xor	r11d,ebx
-	mov	r10d,DWORD44+rsi
-	add	ecx,r11d
-	rol	ecx,17
-	mov	r11d,eax
-	add	ecx,edx
-	xor	r11d,edx
-	lea	ebx,((-1990404162))+r10*1+rbx
-	and	r11d,ecx
-	xor	r11d,eax
-	mov	r10d,DWORD48+rsi
-	add	ebx,r11d
-	rol	ebx,22
-	mov	r11d,edx
-	add	ebx,ecx
-	xor	r11d,ecx
-	lea	eax,1804603682+r10*1+rax
-	and	r11d,ebx
-	xor	r11d,edx
-	mov	r10d,DWORD52+rsi
-	add	eax,r11d
-	rol	eax,7
-	mov	r11d,ecx
-	add	eax,ebx
-	xor	r11d,ebx
-	lea	edx,((-40341101))+r10*1+rdx
-	and	r11d,eax
-	xor	r11d,ecx
-	mov	r10d,DWORD56+rsi
-	add	edx,r11d
-	rol	edx,12
-	mov	r11d,ebx
-	add	edx,eax
-	xor	r11d,eax
-	lea	ecx,((-1502002290))+r10*1+rcx
-	and	r11d,edx
-	xor	r11d,ebx
-	mov	r10d,DWORD60+rsi
-	add	ecx,r11d
-	rol	ecx,17
-	mov	r11d,eax
-	add	ecx,edx
-	xor	r11d,edx
-	lea	ebx,1236535329+r10*1+rbx
-	and	r11d,ecx
-	xor	r11d,eax
-	mov	r10d,DWORDrsi
-	add	ebx,r11d
-	rol	ebx,22
-	mov	r11d,edx
-	add	ebx,ecx
-	mov	r10d,DWORD4+rsi
-	mov	r11d,edx
-	mov	r12d,edx
-	not	r11d
-	lea	eax,((-165796510))+r10*1+rax
-	and	r12d,ebx
-	and	r11d,ecx
-	mov	r10d,DWORD24+rsi
-	or	r12d,r11d
-	mov	r11d,ecx
-	add	eax,r12d
-	mov	r12d,ecx
-	rol	eax,5
-	add	eax,ebx
-	not	r11d
-	lea	edx,((-1069501632))+r10*1+rdx
-	and	r12d,eax
-	and	r11d,ebx
-	mov	r10d,DWORD44+rsi
-	or	r12d,r11d
-	mov	r11d,ebx
-	add	edx,r12d
-	mov	r12d,ebx
-	rol	edx,9
-	add	edx,eax
-	not	r11d
-	lea	ecx,643717713+r10*1+rcx
-	and	r12d,edx
-	and	r11d,eax
-	mov	r10d,DWORDrsi
-	or	r12d,r11d
-	mov	r11d,eax
-	add	ecx,r12d
-	mov	r12d,eax
-	rol	ecx,14
-	add	ecx,edx
-	not	r11d
-	lea	ebx,((-373897302))+r10*1+rbx
-	and	r12d,ecx
-	and	r11d,edx
-	mov	r10d,DWORD20+rsi
-	or	r12d,r11d
-	mov	r11d,edx
-	add	ebx,r12d
-	mov	r12d,edx
-	rol	ebx,20
-	add	ebx,ecx
-	not	r11d
-	lea	eax,((-701558691))+r10*1+rax
-	and	r12d,ebx
-	and	r11d,ecx
-	mov	r10d,DWORD40+rsi
-	or	r12d,r11d
-	mov	r11d,ecx
-	add	eax,r12d
-	mov	r12d,ecx
-	rol	eax,5
-	add	eax,ebx
-	not	r11d
-	lea	edx,38016083+r10*1+rdx
-	and	r12d,eax
-	and	r11d,ebx
-	mov	r10d,DWORD60+rsi
-	or	r12d,r11d
-	mov	r11d,ebx
-	add	edx,r12d
-	mov	r12d,ebx
-	rol	edx,9
-	add	edx,eax
-	not	r11d
-	lea	ecx,((-660478335))+r10*1+rcx
-	and	r12d,edx
-	and	r11d,eax
-	mov	r10d,DWORD16+rsi
-	or	r12d,r11d
-	mov	r11d,eax
-	add	ecx,r12d
-	mov	r12d,eax
-	rol	ecx,14
-	add	ecx,edx
-	not	r11d
-	lea	ebx,((-405537848))+r10*1+rbx
-	and	r12d,ecx
-	and	r11d,edx
-	mov	r10d,DWORD36+rsi
-	or	r12d,r11d
-	mov	r11d,edx
-	add	ebx,r12d
-	mov	r12d,edx
-	rol	ebx,20
-	add	ebx,ecx
-	not	r11d
-	lea	eax,568446438+r10*1+rax
-	and	r12d,ebx
-	and	r11d,ecx
-	mov	r10d,DWORD56+rsi
-	or	r12d,r11d
-	mov	r11d,ecx
-	add	eax,r12d
-	mov	r12d,ecx
-	rol	eax,5
-	add	eax,ebx
-	not	r11d
-	lea	edx,((-1019803690))+r10*1+rdx
-	and	r12d,eax
-	and	r11d,ebx
-	mov	r10d,DWORD12+rsi
-	or	r12d,r11d
-	mov	r11d,ebx
-	add	edx,r12d
-	mov	r12d,ebx
-	rol	edx,9
-	add	edx,eax
-	not	r11d
-	lea	ecx,((-187363961))+r10*1+rcx
-	and	r12d,edx
-	and	r11d,eax
-	mov	r10d,DWORD32+rsi
-	or	r12d,r11d
-	mov	r11d,eax
-	add	ecx,r12d
-	mov	r12d,eax
-	rol	ecx,14
-	add	ecx,edx
-	not	r11d
-	lea	ebx,1163531501+r10*1+rbx
-	and	r12d,ecx
-	and	r11d,edx
-	mov	r10d,DWORD52+rsi
-	or	r12d,r11d
-	mov	r11d,edx
-	add	ebx,r12d
-	mov	r12d,edx
-	rol	ebx,20
-	add	ebx,ecx
-	not	r11d
-	lea	eax,((-1444681467))+r10*1+rax
-	and	r12d,ebx
-	and	r11d,ecx
-	mov	r10d,DWORD8+rsi
-	or	r12d,r11d
-	mov	r11d,ecx
-	add	eax,r12d
-	mov	r12d,ecx
-	rol	eax,5
-	add	eax,ebx
-	not	r11d
-	lea	edx,((-51403784))+r10*1+rdx
-	and	r12d,eax
-	and	r11d,ebx
-	mov	r10d,DWORD28+rsi
-	or	r12d,r11d
-	mov	r11d,ebx
-	add	edx,r12d
-	mov	r12d,ebx
-	rol	edx,9
-	add	edx,eax
-	not	r11d
-	lea	ecx,1735328473+r10*1+rcx
-	and	r12d,edx
-	and	r11d,eax
-	mov	r10d,DWORD48+rsi
-	or	r12d,r11d
-	mov	r11d,eax
-	add	ecx,r12d
-	mov	r12d,eax
-	rol	ecx,14
-	add	ecx,edx
-	not	r11d
-	lea	ebx,((-1926607734))+r10*1+rbx
-	and	r12d,ecx
-	and	r11d,edx
-	mov	r10d,DWORDrsi
-	or	r12d,r11d
-	mov	r11d,edx
-	add	ebx,r12d
-	mov	r12d,edx
-	rol	ebx,20
-	add	ebx,ecx
-	mov	r10d,DWORD20+rsi
-	mov	r11d,ecx
-	lea	eax,((-378558))+r10*1+rax
-	mov	r10d,DWORD32+rsi
-	xor	r11d,edx
-	xor	r11d,ebx
-	add	eax,r11d
-	rol	eax,4
-	mov	r11d,ebx
-	add	eax,ebx
-	lea	edx,((-2022574463))+r10*1+rdx
-	mov	r10d,DWORD44+rsi
-	xor	r11d,ecx
-	xor	r11d,eax
-	add	edx,r11d
-	rol	edx,11
-	mov	r11d,eax
-	add	edx,eax
-	lea	ecx,1839030562+r10*1+rcx
-	mov	r10d,DWORD56+rsi
-	xor	r11d,ebx
-	xor	r11d,edx
-	add	ecx,r11d
-	rol	ecx,16
-	mov	r11d,edx
-	add	ecx,edx
-	lea	ebx,((-35309556))+r10*1+rbx
-	mov	r10d,DWORD4+rsi
-	xor	r11d,eax
-	xor	r11d,ecx
-	add	ebx,r11d
-	rol	ebx,23
-	mov	r11d,ecx
-	add	ebx,ecx
-	lea	eax,((-1530992060))+r10*1+rax
-	mov	r10d,DWORD16+rsi
-	xor	r11d,edx
-	xor	r11d,ebx
-	add	eax,r11d
-	rol	eax,4
-	mov	r11d,ebx
-	add	eax,ebx
-	lea	edx,1272893353+r10*1+rdx
-	mov	r10d,DWORD28+rsi
-	xor	r11d,ecx
-	xor	r11d,eax
-	add	edx,r11d
-	rol	edx,11
-	mov	r11d,eax
-	add	edx,eax
-	lea	ecx,((-155497632))+r10*1+rcx
-	mov	r10d,DWORD40+rsi
-	xor	r11d,ebx
-	xor	r11d,edx
-	add	ecx,r11d
-	rol	ecx,16
-	mov	r11d,edx
-	add	ecx,edx
-	lea	ebx,((-1094730640))+r10*1+rbx
-	mov	r10d,DWORD52+rsi
-	xor	r11d,eax
-	xor	r11d,ecx
-	add	ebx,r11d
-	rol	ebx,23
-	mov	r11d,ecx
-	add	ebx,ecx
-	lea	eax,681279174+r10*1+rax
-	mov	r10d,DWORDrsi
-	xor	r11d,edx
-	xor	r11d,ebx
-	add	eax,r11d
-	rol	eax,4
-	mov	r11d,ebx
-	add	eax,ebx
-	lea	edx,((-358537222))+r10*1+rdx
-	mov	r10d,DWORD12+rsi
-	xor	r11d,ecx
-	xor	r11d,eax
-	add	edx,r11d
-	rol	edx,11
-	mov	r11d,eax
-	add	edx,eax
-	lea	ecx,((-722521979))+r10*1+rcx
-	mov	r10d,DWORD24+rsi
-	xor	r11d,ebx
-	xor	r11d,edx
-	add	ecx,r11d
-	rol	ecx,16
-	mov	r11d,edx
-	add	ecx,edx
-	lea	ebx,76029189+r10*1+rbx
-	mov	r10d,DWORD36+rsi
-	xor	r11d,eax
-	xor	r11d,ecx
-	add	ebx,r11d
-	rol	ebx,23
-	mov	r11d,ecx
-	add	ebx,ecx
-	lea	eax,((-640364487))+r10*1+rax
-	mov	r10d,DWORD48+rsi
-	xor	r11d,edx
-	xor	r11d,ebx
-	add	eax,r11d
-	rol	eax,4
-	mov	r11d,ebx
-	add	eax,ebx
-	lea	edx,((-421815835))+r10*1+rdx
-	mov	r10d,DWORD60+rsi
-	xor	r11d,ecx
-	xor	r11d,eax
-	add	edx,r11d
-	rol	edx,11
-	mov	r11d,eax
-	add	edx,eax
-	lea	ecx,530742520+r10*1+rcx
-	mov	r10d,DWORD8+rsi
-	xor	r11d,ebx
-	xor	r11d,edx
-	add	ecx,r11d
-	rol	ecx,16
-	mov	r11d,edx
-	add	ecx,edx
-	lea	ebx,((-995338651))+r10*1+rbx
-	mov	r10d,DWORDrsi
-	xor	r11d,eax
-	xor	r11d,ecx
-	add	ebx,r11d
-	rol	ebx,23
-	mov	r11d,ecx
-	add	ebx,ecx
-	mov	r10d,DWORDrsi
+	mov	r10d,DWORDrsi  ; (NEXT STEP) X0
+	mov	r11d,edx  ; (NEXT STEP) z' = %edx
+	xor	r11d,ecx  ; y ^ ...
+	lea	eax,((-680876936))+r10*1+rax  ; Const + dst + ...
+	and	r11d,ebx  ; x & ...
+	xor	r11d,edx  ; z ^ ...
+	mov	r10d,DWORD4+rsi  ; (NEXT STEP) X1
+	add	eax,r11d  ; dst += ...
+	rol	eax,7  ; dst <<< s
+	mov	r11d,ecx  ; (NEXT STEP) z' = %ecx
+	add	eax,ebx  ; dst += x
+	xor	r11d,ebx  ; y ^ ...
+	lea	edx,((-389564586))+r10*1+rdx  ; Const + dst + ...
+	and	r11d,eax  ; x & ...
+	xor	r11d,ecx  ; z ^ ...
+	mov	r10d,DWORD8+rsi  ; (NEXT STEP) X2
+	add	edx,r11d  ; dst += ...
+	rol	edx,12  ; dst <<< s
+	mov	r11d,ebx  ; (NEXT STEP) z' = %ebx
+	add	edx,eax  ; dst += x
+	xor	r11d,eax  ; y ^ ...
+	lea	ecx,606105819+r10*1+rcx  ; Const + dst + ...
+	and	r11d,edx  ; x & ...
+	xor	r11d,ebx  ; z ^ ...
+	mov	r10d,DWORD12+rsi  ; (NEXT STEP) X3
+	add	ecx,r11d  ; dst += ...
+	rol	ecx,17  ; dst <<< s
+	mov	r11d,eax  ; (NEXT STEP) z' = %eax
+	add	ecx,edx  ; dst += x
+	xor	r11d,edx  ; y ^ ...
+	lea	ebx,((-1044525330))+r10*1+rbx  ; Const + dst + ...
+	and	r11d,ecx  ; x & ...
+	xor	r11d,eax  ; z ^ ...
+	mov	r10d,DWORD16+rsi  ; (NEXT STEP) X4
+	add	ebx,r11d  ; dst += ...
+	rol	ebx,22  ; dst <<< s
+	mov	r11d,edx  ; (NEXT STEP) z' = %edx
+	add	ebx,ecx  ; dst += x
+	xor	r11d,ecx  ; y ^ ...
+	lea	eax,((-176418897))+r10*1+rax  ; Const + dst + ...
+	and	r11d,ebx  ; x & ...
+	xor	r11d,edx  ; z ^ ...
+	mov	r10d,DWORD20+rsi  ; (NEXT STEP) X5
+	add	eax,r11d  ; dst += ...
+	rol	eax,7  ; dst <<< s
+	mov	r11d,ecx  ; (NEXT STEP) z' = %ecx
+	add	eax,ebx  ; dst += x
+	xor	r11d,ebx  ; y ^ ...
+	lea	edx,1200080426+r10*1+rdx  ; Const + dst + ...
+	and	r11d,eax  ; x & ...
+	xor	r11d,ecx  ; z ^ ...
+	mov	r10d,DWORD24+rsi  ; (NEXT STEP) X6
+	add	edx,r11d  ; dst += ...
+	rol	edx,12  ; dst <<< s
+	mov	r11d,ebx  ; (NEXT STEP) z' = %ebx
+	add	edx,eax  ; dst += x
+	xor	r11d,eax  ; y ^ ...
+	lea	ecx,((-1473231341))+r10*1+rcx  ; Const + dst + ...
+	and	r11d,edx  ; x & ...
+	xor	r11d,ebx  ; z ^ ...
+	mov	r10d,DWORD28+rsi  ; (NEXT STEP) X7
+	add	ecx,r11d  ; dst += ...
+	rol	ecx,17  ; dst <<< s
+	mov	r11d,eax  ; (NEXT STEP) z' = %eax
+	add	ecx,edx  ; dst += x
+	xor	r11d,edx  ; y ^ ...
+	lea	ebx,((-45705983))+r10*1+rbx  ; Const + dst + ...
+	and	r11d,ecx  ; x & ...
+	xor	r11d,eax  ; z ^ ...
+	mov	r10d,DWORD32+rsi  ; (NEXT STEP) X8
+	add	ebx,r11d  ; dst += ...
+	rol	ebx,22  ; dst <<< s
+	mov	r11d,edx  ; (NEXT STEP) z' = %edx
+	add	ebx,ecx  ; dst += x
+	xor	r11d,ecx  ; y ^ ...
+	lea	eax,1770035416+r10*1+rax  ; Const + dst + ...
+	and	r11d,ebx  ; x & ...
+	xor	r11d,edx  ; z ^ ...
+	mov	r10d,DWORD36+rsi  ; (NEXT STEP) X9
+	add	eax,r11d  ; dst += ...
+	rol	eax,7  ; dst <<< s
+	mov	r11d,ecx  ; (NEXT STEP) z' = %ecx
+	add	eax,ebx  ; dst += x
+	xor	r11d,ebx  ; y ^ ...
+	lea	edx,((-1958414417))+r10*1+rdx  ; Const + dst + ...
+	and	r11d,eax  ; x & ...
+	xor	r11d,ecx  ; z ^ ...
+	mov	r10d,DWORD40+rsi  ; (NEXT STEP) X10
+	add	edx,r11d  ; dst += ...
+	rol	edx,12  ; dst <<< s
+	mov	r11d,ebx  ; (NEXT STEP) z' = %ebx
+	add	edx,eax  ; dst += x
+	xor	r11d,eax  ; y ^ ...
+	lea	ecx,((-42063))+r10*1+rcx  ; Const + dst + ...
+	and	r11d,edx  ; x & ...
+	xor	r11d,ebx  ; z ^ ...
+	mov	r10d,DWORD44+rsi  ; (NEXT STEP) X11
+	add	ecx,r11d  ; dst += ...
+	rol	ecx,17  ; dst <<< s
+	mov	r11d,eax  ; (NEXT STEP) z' = %eax
+	add	ecx,edx  ; dst += x
+	xor	r11d,edx  ; y ^ ...
+	lea	ebx,((-1990404162))+r10*1+rbx  ; Const + dst + ...
+	and	r11d,ecx  ; x & ...
+	xor	r11d,eax  ; z ^ ...
+	mov	r10d,DWORD48+rsi  ; (NEXT STEP) X12
+	add	ebx,r11d  ; dst += ...
+	rol	ebx,22  ; dst <<< s
+	mov	r11d,edx  ; (NEXT STEP) z' = %edx
+	add	ebx,ecx  ; dst += x
+	xor	r11d,ecx  ; y ^ ...
+	lea	eax,1804603682+r10*1+rax  ; Const + dst + ...
+	and	r11d,ebx  ; x & ...
+	xor	r11d,edx  ; z ^ ...
+	mov	r10d,DWORD52+rsi  ; (NEXT STEP) X13
+	add	eax,r11d  ; dst += ...
+	rol	eax,7  ; dst <<< s
+	mov	r11d,ecx  ; (NEXT STEP) z' = %ecx
+	add	eax,ebx  ; dst += x
+	xor	r11d,ebx  ; y ^ ...
+	lea	edx,((-40341101))+r10*1+rdx  ; Const + dst + ...
+	and	r11d,eax  ; x & ...
+	xor	r11d,ecx  ; z ^ ...
+	mov	r10d,DWORD56+rsi  ; (NEXT STEP) X14
+	add	edx,r11d  ; dst += ...
+	rol	edx,12  ; dst <<< s
+	mov	r11d,ebx  ; (NEXT STEP) z' = %ebx
+	add	edx,eax  ; dst += x
+	xor	r11d,eax  ; y ^ ...
+	lea	ecx,((-1502002290))+r10*1+rcx  ; Const + dst + ...
+	and	r11d,edx  ; x & ...
+	xor	r11d,ebx  ; z ^ ...
+	mov	r10d,DWORD60+rsi  ; (NEXT STEP) X15
+	add	ecx,r11d  ; dst += ...
+	rol	ecx,17  ; dst <<< s
+	mov	r11d,eax  ; (NEXT STEP) z' = %eax
+	add	ecx,edx  ; dst += x
+	xor	r11d,edx  ; y ^ ...
+	lea	ebx,1236535329+r10*1+rbx  ; Const + dst + ...
+	and	r11d,ecx  ; x & ...
+	xor	r11d,eax  ; z ^ ...
+	mov	r10d,DWORDrsi  ; (NEXT STEP) X0
+	add	ebx,r11d  ; dst += ...
+	rol	ebx,22  ; dst <<< s
+	mov	r11d,edx  ; (NEXT STEP) z' = %edx
+	add	ebx,ecx  ; dst += x
+	mov	r10d,DWORD4+rsi  ; (NEXT STEP) X1
+	mov	r11d,edx  ; (NEXT STEP) z' = %edx
+	mov	r12d,edx  ; (NEXT STEP) z' = %edx
+	not	r11d  ; not z
+	lea	eax,((-165796510))+r10*1+rax  ; Const + dst + ...
+	and	r12d,ebx  ; x & z
+	and	r11d,ecx  ; y & (not z)
+	mov	r10d,DWORD24+rsi  ; (NEXT STEP) X6
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,ecx  ; (NEXT STEP) z' = %ecx
+	add	eax,r12d  ; dst += ...
+	mov	r12d,ecx  ; (NEXT STEP) z' = %ecx
+	rol	eax,5  ; dst <<< s
+	add	eax,ebx  ; dst += x
+	not	r11d  ; not z
+	lea	edx,((-1069501632))+r10*1+rdx  ; Const + dst + ...
+	and	r12d,eax  ; x & z
+	and	r11d,ebx  ; y & (not z)
+	mov	r10d,DWORD44+rsi  ; (NEXT STEP) X11
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,ebx  ; (NEXT STEP) z' = %ebx
+	add	edx,r12d  ; dst += ...
+	mov	r12d,ebx  ; (NEXT STEP) z' = %ebx
+	rol	edx,9  ; dst <<< s
+	add	edx,eax  ; dst += x
+	not	r11d  ; not z
+	lea	ecx,643717713+r10*1+rcx  ; Const + dst + ...
+	and	r12d,edx  ; x & z
+	and	r11d,eax  ; y & (not z)
+	mov	r10d,DWORDrsi  ; (NEXT STEP) X0
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,eax  ; (NEXT STEP) z' = %eax
+	add	ecx,r12d  ; dst += ...
+	mov	r12d,eax  ; (NEXT STEP) z' = %eax
+	rol	ecx,14  ; dst <<< s
+	add	ecx,edx  ; dst += x
+	not	r11d  ; not z
+	lea	ebx,((-373897302))+r10*1+rbx  ; Const + dst + ...
+	and	r12d,ecx  ; x & z
+	and	r11d,edx  ; y & (not z)
+	mov	r10d,DWORD20+rsi  ; (NEXT STEP) X5
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,edx  ; (NEXT STEP) z' = %edx
+	add	ebx,r12d  ; dst += ...
+	mov	r12d,edx  ; (NEXT STEP) z' = %edx
+	rol	ebx,20  ; dst <<< s
+	add	ebx,ecx  ; dst += x
+	not	r11d  ; not z
+	lea	eax,((-701558691))+r10*1+rax  ; Const + dst + ...
+	and	r12d,ebx  ; x & z
+	and	r11d,ecx  ; y & (not z)
+	mov	r10d,DWORD40+rsi  ; (NEXT STEP) X10
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,ecx  ; (NEXT STEP) z' = %ecx
+	add	eax,r12d  ; dst += ...
+	mov	r12d,ecx  ; (NEXT STEP) z' = %ecx
+	rol	eax,5  ; dst <<< s
+	add	eax,ebx  ; dst += x
+	not	r11d  ; not z
+	lea	edx,38016083+r10*1+rdx  ; Const + dst + ...
+	and	r12d,eax  ; x & z
+	and	r11d,ebx  ; y & (not z)
+	mov	r10d,DWORD60+rsi  ; (NEXT STEP) X15
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,ebx  ; (NEXT STEP) z' = %ebx
+	add	edx,r12d  ; dst += ...
+	mov	r12d,ebx  ; (NEXT STEP) z' = %ebx
+	rol	edx,9  ; dst <<< s
+	add	edx,eax  ; dst += x
+	not	r11d  ; not z
+	lea	ecx,((-660478335))+r10*1+rcx  ; Const + dst + ...
+	and	r12d,edx  ; x & z
+	and	r11d,eax  ; y & (not z)
+	mov	r10d,DWORD16+rsi  ; (NEXT STEP) X4
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,eax  ; (NEXT STEP) z' = %eax
+	add	ecx,r12d  ; dst += ...
+	mov	r12d,eax  ; (NEXT STEP) z' = %eax
+	rol	ecx,14  ; dst <<< s
+	add	ecx,edx  ; dst += x
+	not	r11d  ; not z
+	lea	ebx,((-405537848))+r10*1+rbx  ; Const + dst + ...
+	and	r12d,ecx  ; x & z
+	and	r11d,edx  ; y & (not z)
+	mov	r10d,DWORD36+rsi  ; (NEXT STEP) X9
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,edx  ; (NEXT STEP) z' = %edx
+	add	ebx,r12d  ; dst += ...
+	mov	r12d,edx  ; (NEXT STEP) z' = %edx
+	rol	ebx,20  ; dst <<< s
+	add	ebx,ecx  ; dst += x
+	not	r11d  ; not z
+	lea	eax,568446438+r10*1+rax  ; Const + dst + ...
+	and	r12d,ebx  ; x & z
+	and	r11d,ecx  ; y & (not z)
+	mov	r10d,DWORD56+rsi  ; (NEXT STEP) X14
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,ecx  ; (NEXT STEP) z' = %ecx
+	add	eax,r12d  ; dst += ...
+	mov	r12d,ecx  ; (NEXT STEP) z' = %ecx
+	rol	eax,5  ; dst <<< s
+	add	eax,ebx  ; dst += x
+	not	r11d  ; not z
+	lea	edx,((-1019803690))+r10*1+rdx  ; Const + dst + ...
+	and	r12d,eax  ; x & z
+	and	r11d,ebx  ; y & (not z)
+	mov	r10d,DWORD12+rsi  ; (NEXT STEP) X3
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,ebx  ; (NEXT STEP) z' = %ebx
+	add	edx,r12d  ; dst += ...
+	mov	r12d,ebx  ; (NEXT STEP) z' = %ebx
+	rol	edx,9  ; dst <<< s
+	add	edx,eax  ; dst += x
+	not	r11d  ; not z
+	lea	ecx,((-187363961))+r10*1+rcx  ; Const + dst + ...
+	and	r12d,edx  ; x & z
+	and	r11d,eax  ; y & (not z)
+	mov	r10d,DWORD32+rsi  ; (NEXT STEP) X8
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,eax  ; (NEXT STEP) z' = %eax
+	add	ecx,r12d  ; dst += ...
+	mov	r12d,eax  ; (NEXT STEP) z' = %eax
+	rol	ecx,14  ; dst <<< s
+	add	ecx,edx  ; dst += x
+	not	r11d  ; not z
+	lea	ebx,1163531501+r10*1+rbx  ; Const + dst + ...
+	and	r12d,ecx  ; x & z
+	and	r11d,edx  ; y & (not z)
+	mov	r10d,DWORD52+rsi  ; (NEXT STEP) X13
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,edx  ; (NEXT STEP) z' = %edx
+	add	ebx,r12d  ; dst += ...
+	mov	r12d,edx  ; (NEXT STEP) z' = %edx
+	rol	ebx,20  ; dst <<< s
+	add	ebx,ecx  ; dst += x
+	not	r11d  ; not z
+	lea	eax,((-1444681467))+r10*1+rax  ; Const + dst + ...
+	and	r12d,ebx  ; x & z
+	and	r11d,ecx  ; y & (not z)
+	mov	r10d,DWORD8+rsi  ; (NEXT STEP) X2
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,ecx  ; (NEXT STEP) z' = %ecx
+	add	eax,r12d  ; dst += ...
+	mov	r12d,ecx  ; (NEXT STEP) z' = %ecx
+	rol	eax,5  ; dst <<< s
+	add	eax,ebx  ; dst += x
+	not	r11d  ; not z
+	lea	edx,((-51403784))+r10*1+rdx  ; Const + dst + ...
+	and	r12d,eax  ; x & z
+	and	r11d,ebx  ; y & (not z)
+	mov	r10d,DWORD28+rsi  ; (NEXT STEP) X7
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,ebx  ; (NEXT STEP) z' = %ebx
+	add	edx,r12d  ; dst += ...
+	mov	r12d,ebx  ; (NEXT STEP) z' = %ebx
+	rol	edx,9  ; dst <<< s
+	add	edx,eax  ; dst += x
+	not	r11d  ; not z
+	lea	ecx,1735328473+r10*1+rcx  ; Const + dst + ...
+	and	r12d,edx  ; x & z
+	and	r11d,eax  ; y & (not z)
+	mov	r10d,DWORD48+rsi  ; (NEXT STEP) X12
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,eax  ; (NEXT STEP) z' = %eax
+	add	ecx,r12d  ; dst += ...
+	mov	r12d,eax  ; (NEXT STEP) z' = %eax
+	rol	ecx,14  ; dst <<< s
+	add	ecx,edx  ; dst += x
+	not	r11d  ; not z
+	lea	ebx,((-1926607734))+r10*1+rbx  ; Const + dst + ...
+	and	r12d,ecx  ; x & z
+	and	r11d,edx  ; y & (not z)
+	mov	r10d,DWORDrsi  ; (NEXT STEP) X0
+	or	r12d,r11d  ; (y & (not z)) | (x & z)
+	mov	r11d,edx  ; (NEXT STEP) z' = %edx
+	add	ebx,r12d  ; dst += ...
+	mov	r12d,edx  ; (NEXT STEP) z' = %edx
+	rol	ebx,20  ; dst <<< s
+	add	ebx,ecx  ; dst += x
+	mov	r10d,DWORD20+rsi  ; (NEXT STEP) X5
+	mov	r11d,ecx  ; (NEXT STEP) y' = %ecx
+	lea	eax,((-378558))+r10*1+rax  ; Const + dst + ...
+	mov	r10d,DWORD32+rsi  ; (NEXT STEP) X8
+	xor	r11d,edx  ; z ^ ...
+	xor	r11d,ebx  ; x ^ ...
+	add	eax,r11d  ; dst += ...
+	rol	eax,4  ; dst <<< s
+	mov	r11d,ebx  ; (NEXT STEP) y' = %ebx
+	add	eax,ebx  ; dst += x
+	lea	edx,((-2022574463))+r10*1+rdx  ; Const + dst + ...
+	mov	r10d,DWORD44+rsi  ; (NEXT STEP) X11
+	xor	r11d,ecx  ; z ^ ...
+	xor	r11d,eax  ; x ^ ...
+	add	edx,r11d  ; dst += ...
+	rol	edx,11  ; dst <<< s
+	mov	r11d,eax  ; (NEXT STEP) y' = %eax
+	add	edx,eax  ; dst += x
+	lea	ecx,1839030562+r10*1+rcx  ; Const + dst + ...
+	mov	r10d,DWORD56+rsi  ; (NEXT STEP) X14
+	xor	r11d,ebx  ; z ^ ...
+	xor	r11d,edx  ; x ^ ...
+	add	ecx,r11d  ; dst += ...
+	rol	ecx,16  ; dst <<< s
+	mov	r11d,edx  ; (NEXT STEP) y' = %edx
+	add	ecx,edx  ; dst += x
+	lea	ebx,((-35309556))+r10*1+rbx  ; Const + dst + ...
+	mov	r10d,DWORD4+rsi  ; (NEXT STEP) X1
+	xor	r11d,eax  ; z ^ ...
+	xor	r11d,ecx  ; x ^ ...
+	add	ebx,r11d  ; dst += ...
+	rol	ebx,23  ; dst <<< s
+	mov	r11d,ecx  ; (NEXT STEP) y' = %ecx
+	add	ebx,ecx  ; dst += x
+	lea	eax,((-1530992060))+r10*1+rax  ; Const + dst + ...
+	mov	r10d,DWORD16+rsi  ; (NEXT STEP) X4
+	xor	r11d,edx  ; z ^ ...
+	xor	r11d,ebx  ; x ^ ...
+	add	eax,r11d  ; dst += ...
+	rol	eax,4  ; dst <<< s
+	mov	r11d,ebx  ; (NEXT STEP) y' = %ebx
+	add	eax,ebx  ; dst += x
+	lea	edx,1272893353+r10*1+rdx  ; Const + dst + ...
+	mov	r10d,DWORD28+rsi  ; (NEXT STEP) X7
+	xor	r11d,ecx  ; z ^ ...
+	xor	r11d,eax  ; x ^ ...
+	add	edx,r11d  ; dst += ...
+	rol	edx,11  ; dst <<< s
+	mov	r11d,eax  ; (NEXT STEP) y' = %eax
+	add	edx,eax  ; dst += x
+	lea	ecx,((-155497632))+r10*1+rcx  ; Const + dst + ...
+	mov	r10d,DWORD40+rsi  ; (NEXT STEP) X10
+	xor	r11d,ebx  ; z ^ ...
+	xor	r11d,edx  ; x ^ ...
+	add	ecx,r11d  ; dst += ...
+	rol	ecx,16  ; dst <<< s
+	mov	r11d,edx  ; (NEXT STEP) y' = %edx
+	add	ecx,edx  ; dst += x
+	lea	ebx,((-1094730640))+r10*1+rbx  ; Const + dst + ...
+	mov	r10d,DWORD52+rsi  ; (NEXT STEP) X13
+	xor	r11d,eax  ; z ^ ...
+	xor	r11d,ecx  ; x ^ ...
+	add	ebx,r11d  ; dst += ...
+	rol	ebx,23  ; dst <<< s
+	mov	r11d,ecx  ; (NEXT STEP) y' = %ecx
+	add	ebx,ecx  ; dst += x
+	lea	eax,681279174+r10*1+rax  ; Const + dst + ...
+	mov	r10d,DWORDrsi  ; (NEXT STEP) X0
+	xor	r11d,edx  ; z ^ ...
+	xor	r11d,ebx  ; x ^ ...
+	add	eax,r11d  ; dst += ...
+	rol	eax,4  ; dst <<< s
+	mov	r11d,ebx  ; (NEXT STEP) y' = %ebx
+	add	eax,ebx  ; dst += x
+	lea	edx,((-358537222))+r10*1+rdx  ; Const + dst + ...
+	mov	r10d,DWORD12+rsi  ; (NEXT STEP) X3
+	xor	r11d,ecx  ; z ^ ...
+	xor	r11d,eax  ; x ^ ...
+	add	edx,r11d  ; dst += ...
+	rol	edx,11  ; dst <<< s
+	mov	r11d,eax  ; (NEXT STEP) y' = %eax
+	add	edx,eax  ; dst += x
+	lea	ecx,((-722521979))+r10*1+rcx  ; Const + dst + ...
+	mov	r10d,DWORD24+rsi  ; (NEXT STEP) X6
+	xor	r11d,ebx  ; z ^ ...
+	xor	r11d,edx  ; x ^ ...
+	add	ecx,r11d  ; dst += ...
+	rol	ecx,16  ; dst <<< s
+	mov	r11d,edx  ; (NEXT STEP) y' = %edx
+	add	ecx,edx  ; dst += x
+	lea	ebx,76029189+r10*1+rbx  ; Const + dst + ...
+	mov	r10d,DWORD36+rsi  ; (NEXT STEP) X9
+	xor	r11d,eax  ; z ^ ...
+	xor	r11d,ecx  ; x ^ ...
+	add	ebx,r11d  ; dst += ...
+	rol	ebx,23  ; dst <<< s
+	mov	r11d,ecx  ; (NEXT STEP) y' = %ecx
+	add	ebx,ecx  ; dst += x
+	lea	eax,((-640364487))+r10*1+rax  ; Const + dst + ...
+	mov	r10d,DWORD48+rsi  ; (NEXT STEP) X12
+	xor	r11d,edx  ; z ^ ...
+	xor	r11d,ebx  ; x ^ ...
+	add	eax,r11d  ; dst += ...
+	rol	eax,4  ; dst <<< s
+	mov	r11d,ebx  ; (NEXT STEP) y' = %ebx
+	add	eax,ebx  ; dst += x
+	lea	edx,((-421815835))+r10*1+rdx  ; Const + dst + ...
+	mov	r10d,DWORD60+rsi  ; (NEXT STEP) X15
+	xor	r11d,ecx  ; z ^ ...
+	xor	r11d,eax  ; x ^ ...
+	add	edx,r11d  ; dst += ...
+	rol	edx,11  ; dst <<< s
+	mov	r11d,eax  ; (NEXT STEP) y' = %eax
+	add	edx,eax  ; dst += x
+	lea	ecx,530742520+r10*1+rcx  ; Const + dst + ...
+	mov	r10d,DWORD8+rsi  ; (NEXT STEP) X2
+	xor	r11d,ebx  ; z ^ ...
+	xor	r11d,edx  ; x ^ ...
+	add	ecx,r11d  ; dst += ...
+	rol	ecx,16  ; dst <<< s
+	mov	r11d,edx  ; (NEXT STEP) y' = %edx
+	add	ecx,edx  ; dst += x
+	lea	ebx,((-995338651))+r10*1+rbx  ; Const + dst + ...
+	mov	r10d,DWORDrsi  ; (NEXT STEP) X0
+	xor	r11d,eax  ; z ^ ...
+	xor	r11d,ecx  ; x ^ ...
+	add	ebx,r11d  ; dst += ...
+	rol	ebx,23  ; dst <<< s
+	mov	r11d,ecx  ; (NEXT STEP) y' = %ecx
+	add	ebx,ecx  ; dst += x
+	mov	r10d,DWORDrsi  ; (NEXT STEP) X0
 	mov	r11d,0xffffffff
-	xor	r11d,edx
-	lea	eax,((-198630844))+r10*1+rax
-	or	r11d,ebx
-	xor	r11d,ecx
-	add	eax,r11d
-	mov	r10d,DWORD28+rsi
+	xor	r11d,edx  ; (NEXT STEP) not z' = not %edx
+	lea	eax,((-198630844))+r10*1+rax  ; Const + dst + ...
+	or	r11d,ebx  ; x | ...
+	xor	r11d,ecx  ; y ^ ...
+	add	eax,r11d  ; dst += ...
+	mov	r10d,DWORD28+rsi  ; (NEXT STEP) X7
 	mov	r11d,0xffffffff
-	rol	eax,6
-	xor	r11d,ecx
-	add	eax,ebx
-	lea	edx,1126891415+r10*1+rdx
-	or	r11d,eax
-	xor	r11d,ebx
-	add	edx,r11d
-	mov	r10d,DWORD56+rsi
+	rol	eax,6  ; dst <<< s
+	xor	r11d,ecx  ; (NEXT STEP) not z' = not %ecx
+	add	eax,ebx  ; dst += x
+	lea	edx,1126891415+r10*1+rdx  ; Const + dst + ...
+	or	r11d,eax  ; x | ...
+	xor	r11d,ebx  ; y ^ ...
+	add	edx,r11d  ; dst += ...
+	mov	r10d,DWORD56+rsi  ; (NEXT STEP) X14
 	mov	r11d,0xffffffff
-	rol	edx,10
-	xor	r11d,ebx
-	add	edx,eax
-	lea	ecx,((-1416354905))+r10*1+rcx
-	or	r11d,edx
-	xor	r11d,eax
-	add	ecx,r11d
-	mov	r10d,DWORD20+rsi
+	rol	edx,10  ; dst <<< s
+	xor	r11d,ebx  ; (NEXT STEP) not z' = not %ebx
+	add	edx,eax  ; dst += x
+	lea	ecx,((-1416354905))+r10*1+rcx  ; Const + dst + ...
+	or	r11d,edx  ; x | ...
+	xor	r11d,eax  ; y ^ ...
+	add	ecx,r11d  ; dst += ...
+	mov	r10d,DWORD20+rsi  ; (NEXT STEP) X5
 	mov	r11d,0xffffffff
-	rol	ecx,15
-	xor	r11d,eax
-	add	ecx,edx
-	lea	ebx,((-57434055))+r10*1+rbx
-	or	r11d,ecx
-	xor	r11d,edx
-	add	ebx,r11d
-	mov	r10d,DWORD48+rsi
+	rol	ecx,15  ; dst <<< s
+	xor	r11d,eax  ; (NEXT STEP) not z' = not %eax
+	add	ecx,edx  ; dst += x
+	lea	ebx,((-57434055))+r10*1+rbx  ; Const + dst + ...
+	or	r11d,ecx  ; x | ...
+	xor	r11d,edx  ; y ^ ...
+	add	ebx,r11d  ; dst += ...
+	mov	r10d,DWORD48+rsi  ; (NEXT STEP) X12
 	mov	r11d,0xffffffff
-	rol	ebx,21
-	xor	r11d,edx
-	add	ebx,ecx
-	lea	eax,1700485571+r10*1+rax
-	or	r11d,ebx
-	xor	r11d,ecx
-	add	eax,r11d
-	mov	r10d,DWORD12+rsi
+	rol	ebx,21  ; dst <<< s
+	xor	r11d,edx  ; (NEXT STEP) not z' = not %edx
+	add	ebx,ecx  ; dst += x
+	lea	eax,1700485571+r10*1+rax  ; Const + dst + ...
+	or	r11d,ebx  ; x | ...
+	xor	r11d,ecx  ; y ^ ...
+	add	eax,r11d  ; dst += ...
+	mov	r10d,DWORD12+rsi  ; (NEXT STEP) X3
 	mov	r11d,0xffffffff
-	rol	eax,6
-	xor	r11d,ecx
-	add	eax,ebx
-	lea	edx,((-1894986606))+r10*1+rdx
-	or	r11d,eax
-	xor	r11d,ebx
-	add	edx,r11d
-	mov	r10d,DWORD40+rsi
+	rol	eax,6  ; dst <<< s
+	xor	r11d,ecx  ; (NEXT STEP) not z' = not %ecx
+	add	eax,ebx  ; dst += x
+	lea	edx,((-1894986606))+r10*1+rdx  ; Const + dst + ...
+	or	r11d,eax  ; x | ...
+	xor	r11d,ebx  ; y ^ ...
+	add	edx,r11d  ; dst += ...
+	mov	r10d,DWORD40+rsi  ; (NEXT STEP) X10
 	mov	r11d,0xffffffff
-	rol	edx,10
-	xor	r11d,ebx
-	add	edx,eax
-	lea	ecx,((-1051523))+r10*1+rcx
-	or	r11d,edx
-	xor	r11d,eax
-	add	ecx,r11d
-	mov	r10d,DWORD4+rsi
+	rol	edx,10  ; dst <<< s
+	xor	r11d,ebx  ; (NEXT STEP) not z' = not %ebx
+	add	edx,eax  ; dst += x
+	lea	ecx,((-1051523))+r10*1+rcx  ; Const + dst + ...
+	or	r11d,edx  ; x | ...
+	xor	r11d,eax  ; y ^ ...
+	add	ecx,r11d  ; dst += ...
+	mov	r10d,DWORD4+rsi  ; (NEXT STEP) X1
 	mov	r11d,0xffffffff
-	rol	ecx,15
-	xor	r11d,eax
-	add	ecx,edx
-	lea	ebx,((-2054922799))+r10*1+rbx
-	or	r11d,ecx
-	xor	r11d,edx
-	add	ebx,r11d
-	mov	r10d,DWORD32+rsi
+	rol	ecx,15  ; dst <<< s
+	xor	r11d,eax  ; (NEXT STEP) not z' = not %eax
+	add	ecx,edx  ; dst += x
+	lea	ebx,((-2054922799))+r10*1+rbx  ; Const + dst + ...
+	or	r11d,ecx  ; x | ...
+	xor	r11d,edx  ; y ^ ...
+	add	ebx,r11d  ; dst += ...
+	mov	r10d,DWORD32+rsi  ; (NEXT STEP) X8
 	mov	r11d,0xffffffff
-	rol	ebx,21
-	xor	r11d,edx
-	add	ebx,ecx
-	lea	eax,1873313359+r10*1+rax
-	or	r11d,ebx
-	xor	r11d,ecx
-	add	eax,r11d
-	mov	r10d,DWORD60+rsi
+	rol	ebx,21  ; dst <<< s
+	xor	r11d,edx  ; (NEXT STEP) not z' = not %edx
+	add	ebx,ecx  ; dst += x
+	lea	eax,1873313359+r10*1+rax  ; Const + dst + ...
+	or	r11d,ebx  ; x | ...
+	xor	r11d,ecx  ; y ^ ...
+	add	eax,r11d  ; dst += ...
+	mov	r10d,DWORD60+rsi  ; (NEXT STEP) X15
 	mov	r11d,0xffffffff
-	rol	eax,6
-	xor	r11d,ecx
-	add	eax,ebx
-	lea	edx,((-30611744))+r10*1+rdx
-	or	r11d,eax
-	xor	r11d,ebx
-	add	edx,r11d
-	mov	r10d,DWORD24+rsi
+	rol	eax,6  ; dst <<< s
+	xor	r11d,ecx  ; (NEXT STEP) not z' = not %ecx
+	add	eax,ebx  ; dst += x
+	lea	edx,((-30611744))+r10*1+rdx  ; Const + dst + ...
+	or	r11d,eax  ; x | ...
+	xor	r11d,ebx  ; y ^ ...
+	add	edx,r11d  ; dst += ...
+	mov	r10d,DWORD24+rsi  ; (NEXT STEP) X6
 	mov	r11d,0xffffffff
-	rol	edx,10
-	xor	r11d,ebx
-	add	edx,eax
-	lea	ecx,((-1560198380))+r10*1+rcx
-	or	r11d,edx
-	xor	r11d,eax
-	add	ecx,r11d
-	mov	r10d,DWORD52+rsi
+	rol	edx,10  ; dst <<< s
+	xor	r11d,ebx  ; (NEXT STEP) not z' = not %ebx
+	add	edx,eax  ; dst += x
+	lea	ecx,((-1560198380))+r10*1+rcx  ; Const + dst + ...
+	or	r11d,edx  ; x | ...
+	xor	r11d,eax  ; y ^ ...
+	add	ecx,r11d  ; dst += ...
+	mov	r10d,DWORD52+rsi  ; (NEXT STEP) X13
 	mov	r11d,0xffffffff
-	rol	ecx,15
-	xor	r11d,eax
-	add	ecx,edx
-	lea	ebx,1309151649+r10*1+rbx
-	or	r11d,ecx
-	xor	r11d,edx
-	add	ebx,r11d
-	mov	r10d,DWORD16+rsi
+	rol	ecx,15  ; dst <<< s
+	xor	r11d,eax  ; (NEXT STEP) not z' = not %eax
+	add	ecx,edx  ; dst += x
+	lea	ebx,1309151649+r10*1+rbx  ; Const + dst + ...
+	or	r11d,ecx  ; x | ...
+	xor	r11d,edx  ; y ^ ...
+	add	ebx,r11d  ; dst += ...
+	mov	r10d,DWORD16+rsi  ; (NEXT STEP) X4
 	mov	r11d,0xffffffff
-	rol	ebx,21
-	xor	r11d,edx
-	add	ebx,ecx
-	lea	eax,((-145523070))+r10*1+rax
-	or	r11d,ebx
-	xor	r11d,ecx
-	add	eax,r11d
-	mov	r10d,DWORD44+rsi
+	rol	ebx,21  ; dst <<< s
+	xor	r11d,edx  ; (NEXT STEP) not z' = not %edx
+	add	ebx,ecx  ; dst += x
+	lea	eax,((-145523070))+r10*1+rax  ; Const + dst + ...
+	or	r11d,ebx  ; x | ...
+	xor	r11d,ecx  ; y ^ ...
+	add	eax,r11d  ; dst += ...
+	mov	r10d,DWORD44+rsi  ; (NEXT STEP) X11
 	mov	r11d,0xffffffff
-	rol	eax,6
-	xor	r11d,ecx
-	add	eax,ebx
-	lea	edx,((-1120210379))+r10*1+rdx
-	or	r11d,eax
-	xor	r11d,ebx
-	add	edx,r11d
-	mov	r10d,DWORD8+rsi
+	rol	eax,6  ; dst <<< s
+	xor	r11d,ecx  ; (NEXT STEP) not z' = not %ecx
+	add	eax,ebx  ; dst += x
+	lea	edx,((-1120210379))+r10*1+rdx  ; Const + dst + ...
+	or	r11d,eax  ; x | ...
+	xor	r11d,ebx  ; y ^ ...
+	add	edx,r11d  ; dst += ...
+	mov	r10d,DWORD8+rsi  ; (NEXT STEP) X2
 	mov	r11d,0xffffffff
-	rol	edx,10
-	xor	r11d,ebx
-	add	edx,eax
-	lea	ecx,718787259+r10*1+rcx
-	or	r11d,edx
-	xor	r11d,eax
-	add	ecx,r11d
-	mov	r10d,DWORD36+rsi
+	rol	edx,10  ; dst <<< s
+	xor	r11d,ebx  ; (NEXT STEP) not z' = not %ebx
+	add	edx,eax  ; dst += x
+	lea	ecx,718787259+r10*1+rcx  ; Const + dst + ...
+	or	r11d,edx  ; x | ...
+	xor	r11d,eax  ; y ^ ...
+	add	ecx,r11d  ; dst += ...
+	mov	r10d,DWORD36+rsi  ; (NEXT STEP) X9
 	mov	r11d,0xffffffff
-	rol	ecx,15
-	xor	r11d,eax
-	add	ecx,edx
-	lea	ebx,((-343485551))+r10*1+rbx
-	or	r11d,ecx
-	xor	r11d,edx
-	add	ebx,r11d
-	mov	r10d,DWORDrsi
+	rol	ecx,15  ; dst <<< s
+	xor	r11d,eax  ; (NEXT STEP) not z' = not %eax
+	add	ecx,edx  ; dst += x
+	lea	ebx,((-343485551))+r10*1+rbx  ; Const + dst + ...
+	or	r11d,ecx  ; x | ...
+	xor	r11d,edx  ; y ^ ...
+	add	ebx,r11d  ; dst += ...
+	mov	r10d,DWORDrsi  ; (NEXT STEP) X0
 	mov	r11d,0xffffffff
-	rol	ebx,21
-	xor	r11d,edx
-	add	ebx,ecx
-
+	rol	ebx,21  ; dst <<< s
+	xor	r11d,edx  ; (NEXT STEP) not z' = not %edx
+	add	ebx,ecx  ; dst += x
+; add old values of A, B, C, D
 	add	eax,r8d
 	add	ebx,r9d
 	add	ecx,r14d
 	add	edx,r15d
 
-
-	add	rsi,64
-	cmp	rsi,rdi
-	jb	NEAR $L$loop
-
+; loop control
+	add	rsi,64  ; ptr += 64
+	cmp	rsi,rdi  ; cmp end with ptr
+	jb	NEAR $L$loop  ; jmp if ptr < end
+; END of loop over 16-word blocks
 
 $L$end:
-	mov	DWORDrbp,eax
-	mov	DWORD4+rbp,ebx
-	mov	DWORD8+rbp,ecx
-	mov	DWORD12+rbp,edx
+	mov	DWORDrbp,eax  ; ctx->A = A
+	mov	DWORD4+rbp,ebx  ; ctx->B = B
+	mov	DWORD8+rbp,ecx  ; ctx->C = C
+	mov	DWORD12+rbp,edx  ; ctx->D = D
 
 	mov	r15,QWORDrsp
 
@@ -720,17 +720,17 @@
 	pushfq
 	sub	rsp,64
 
-	mov	rax,QWORD120+r8
-	mov	rbx,QWORD248+r8
+	mov	rax,QWORD120+r8  ; pull context->Rax
+	mov	rbx,QWORD248+r8  ; pull context->Rip
 
 	lea	r10,$L$prologue
-	cmp	rbx,r10
+	cmp	rbx,r10  ; context->Rip<.Lprologue
 	jb	NEAR $L$in_prologue
 
-	mov	rax,QWORD152+r8
+	mov	rax,QWORD152+r8  ; pull context->Rsp
 
 	lea	r10,$L$epilogue
-	cmp	rbx,r10
+	cmp	rbx,r10  ; context->Rip>=.Lepilogue
 	jae	NEAR $L$in_prologue
 
 	lea	rax,40+rax
@@ -740,39 +740,39 @@
 	mov	r12,QWORD((-24))+rax
 	mov	r14,QWORD((-32))+rax
 	mov	r15,QWORD((-40))+rax
-	mov	QWORD144+r8,rbx
-	mov	QWORD160+r8,rbp
-	mov	QWORD216+r8,r12
-	mov	QWORD232+r8,r14
-	mov	QWORD240+r8,r15
+	mov	QWORD144+r8,rbx  ; restore context->Rbx
+	mov	QWORD160+r8,rbp  ; restore context->Rbp
+	mov	QWORD216+r8,r12  ; restore context->R12
+	mov	QWORD232+r8,r14  ; restore context->R14
+	mov	QWORD240+r8,r15  ; restore context->R15
 
 $L$in_prologue:
 	mov	rdi,QWORD8+rax
 	mov	rsi,QWORD16+rax
-	mov	QWORD152+r8,rax
-	mov	QWORD168+r8,rsi
-	mov	QWORD176+r8,rdi
+	mov	QWORD152+r8,rax  ; restore context->Rsp
+	mov	QWORD168+r8,rsi  ; restore context->Rsi
+	mov	QWORD176+r8,rdi  ; restore context->Rdi
 
-	mov	rdi,QWORD40+r9
-	mov	rsi,r8
-	mov	ecx,154
-	DD	0xa548f3fc
+	mov	rdi,QWORD40+r9  ; disp->ContextRecord
+	mov	rsi,r8  ; context
+	mov	ecx,154  ; sizeof(CONTEXT)
+	DD	0xa548f3fc  ; cld; rep movsq
 
 	mov	rsi,r9
-	xor	rcx,rcx
-	mov	rdx,QWORD8+rsi
-	mov	r8,QWORDrsi
-	mov	r9,QWORD16+rsi
-	mov	r10,QWORD40+rsi
-	lea	r11,56+rsi
-	lea	r12,24+rsi
-	mov	QWORD32+rsp,r10
-	mov	QWORD40+rsp,r11
-	mov	QWORD48+rsp,r12
-	mov	QWORD56+rsp,rcx
+	xor	rcx,rcx  ; arg1, UNW_FLAG_NHANDLER
+	mov	rdx,QWORD8+rsi  ; arg2, disp->ImageBase
+	mov	r8,QWORDrsi  ; arg3, disp->ControlPc
+	mov	r9,QWORD16+rsi  ; arg4, disp->FunctionEntry
+	mov	r10,QWORD40+rsi  ; disp->ContextRecord
+	lea	r11,56+rsi  ; &disp->HandlerData
+	lea	r12,24+rsi  ; &disp->EstablisherFrame
+	mov	QWORD32+rsp,r10  ; arg5
+	mov	QWORD40+rsp,r11  ; arg6
+	mov	QWORD48+rsp,r12  ; arg7
+	mov	QWORD56+rsp,rcx  ; arg8, (NULL)
 	call	QWORD__imp_RtlVirtualUnwind
 
-	mov	eax,1
+	mov	eax,1  ; ExceptionContinueSearch
 	add	rsp,64
 	popfq
 	pop	r15

boringssl-0.20260708.tar.xz/gen/sources.bzl -> boringssl-0.20260813.tar.xz/gen/sources.bzl Changed

@@ -406,7 +406,6 @@
     "crypto/fuzzer_mode.cc",
     "crypto/hpke/hpke.cc",
     "crypto/hrss/hrss.cc",
-    "crypto/kyber/kyber.cc",
     "crypto/lhash/lhash.cc",
     "crypto/md4/md4.cc",
     "crypto/md5/md5.cc",
@@ -506,6 +505,7 @@
     "crypto/x509/x509_def.cc",
     "crypto/x509/x509_ext.cc",
     "crypto/x509/x509_lu.cc",
+    "crypto/x509/x509_mtc.cc",
     "crypto/x509/x509_obj.cc",
     "crypto/x509/x509_req.cc",
     "crypto/x509/x509_set.cc",
@@ -675,7 +675,6 @@
     "crypto/fipsmodule/tls/internal.h",
     "crypto/hrss/internal.h",
     "crypto/internal.h",
-    "crypto/kyber/internal.h",
     "crypto/lhash/internal.h",
     "crypto/md5/internal.h",
     "crypto/mem_internal.h",
@@ -794,7 +793,6 @@
     "crypto/hpke/hpke_test.cc",
     "crypto/hrss/hrss_test.cc",
     "crypto/impl_dispatch_test.cc",
-    "crypto/kyber/kyber_test.cc",
     "crypto/lhash/lhash_test.cc",
     "crypto/md5/md5_test.cc",
     "crypto/mem_test.cc",
@@ -905,7 +903,6 @@
     "crypto/hmac/hmac_tests.txt",
     "crypto/hpke/hpke_test_vectors.txt",
     "crypto/hpke/hpke_test_vectors_pq.txt",
-    "crypto/kyber/kyber_tests.txt",
     "crypto/mldsa/mldsa_nist_keygen_44_tests.txt",
     "crypto/mldsa/mldsa_nist_keygen_65_tests.txt",
     "crypto/mldsa/mldsa_nist_keygen_87_tests.txt",
@@ -2180,6 +2177,7 @@
     "pki/testdata/ocsp_unittest/bad_status.pem",
     "pki/testdata/ocsp_unittest/future_response.pem",
     "pki/testdata/ocsp_unittest/good_response.pem",
+    "pki/testdata/ocsp_unittest/good_response_invalid_serial.pem",
     "pki/testdata/ocsp_unittest/good_response_next_update.pem",
     "pki/testdata/ocsp_unittest/good_response_sha256.pem",
     "pki/testdata/ocsp_unittest/has_critical_ct_extension.pem",
@@ -2911,6 +2909,15 @@
     "rust/bssl-sys/src/lib.rs",
 
 
+rust_bssl_tls_tokio_sources = 
+    "rust/bssl-tls-tokio/src/hyper.rs",
+    "rust/bssl-tls-tokio/src/lib.rs",
+    "rust/bssl-tls-tokio/src/tests.rs",
+    "rust/bssl-tls-tokio/src/tests/convenience.rs",
+    "rust/bssl-tls-tokio/src/tests/datagram.rs",
+    "rust/bssl-tls-tokio/src/tests/transport.rs",
+
+
 rust_bssl_x509_sources = 
     "rust/bssl-x509/src/certificates.rs",
     "rust/bssl-x509/src/errors.rs",

boringssl-0.20260708.tar.xz/gen/sources.cmake -> boringssl-0.20260813.tar.xz/gen/sources.cmake Changed

@@ -424,7 +424,6 @@
   crypto/fuzzer_mode.cc
   crypto/hpke/hpke.cc
   crypto/hrss/hrss.cc
-  crypto/kyber/kyber.cc
   crypto/lhash/lhash.cc
   crypto/md4/md4.cc
   crypto/md5/md5.cc
@@ -524,6 +523,7 @@
   crypto/x509/x509_def.cc
   crypto/x509/x509_ext.cc
   crypto/x509/x509_lu.cc
+  crypto/x509/x509_mtc.cc
   crypto/x509/x509_obj.cc
   crypto/x509/x509_req.cc
   crypto/x509/x509_set.cc
@@ -697,7 +697,6 @@
   crypto/fipsmodule/tls/internal.h
   crypto/hrss/internal.h
   crypto/internal.h
-  crypto/kyber/internal.h
   crypto/lhash/internal.h
   crypto/md5/internal.h
   crypto/mem_internal.h
@@ -822,7 +821,6 @@
   crypto/hpke/hpke_test.cc
   crypto/hrss/hrss_test.cc
   crypto/impl_dispatch_test.cc
-  crypto/kyber/kyber_test.cc
   crypto/lhash/lhash_test.cc
   crypto/md5/md5_test.cc
   crypto/mem_test.cc
@@ -937,7 +935,6 @@
   crypto/hmac/hmac_tests.txt
   crypto/hpke/hpke_test_vectors.txt
   crypto/hpke/hpke_test_vectors_pq.txt
-  crypto/kyber/kyber_tests.txt
   crypto/mldsa/mldsa_nist_keygen_44_tests.txt
   crypto/mldsa/mldsa_nist_keygen_65_tests.txt
   crypto/mldsa/mldsa_nist_keygen_87_tests.txt
@@ -2238,6 +2235,7 @@
   pki/testdata/ocsp_unittest/bad_status.pem
   pki/testdata/ocsp_unittest/future_response.pem
   pki/testdata/ocsp_unittest/good_response.pem
+  pki/testdata/ocsp_unittest/good_response_invalid_serial.pem
   pki/testdata/ocsp_unittest/good_response_next_update.pem
   pki/testdata/ocsp_unittest/good_response_sha256.pem
   pki/testdata/ocsp_unittest/has_critical_ct_extension.pem
@@ -2976,6 +2974,17 @@
 )
 
 set(
+  RUST_BSSL_TLS_TOKIO_SOURCES
+
+  rust/bssl-tls-tokio/src/hyper.rs
+  rust/bssl-tls-tokio/src/lib.rs
+  rust/bssl-tls-tokio/src/tests.rs
+  rust/bssl-tls-tokio/src/tests/convenience.rs
+  rust/bssl-tls-tokio/src/tests/datagram.rs
+  rust/bssl-tls-tokio/src/tests/transport.rs
+)
+
+set(
   RUST_BSSL_X509_SOURCES
 
   rust/bssl-x509/src/certificates.rs

boringssl-0.20260708.tar.xz/gen/sources.gni -> boringssl-0.20260813.tar.xz/gen/sources.gni Changed

@@ -406,7 +406,6 @@
   "crypto/fuzzer_mode.cc",
   "crypto/hpke/hpke.cc",
   "crypto/hrss/hrss.cc",
-  "crypto/kyber/kyber.cc",
   "crypto/lhash/lhash.cc",
   "crypto/md4/md4.cc",
   "crypto/md5/md5.cc",
@@ -506,6 +505,7 @@
   "crypto/x509/x509_def.cc",
   "crypto/x509/x509_ext.cc",
   "crypto/x509/x509_lu.cc",
+  "crypto/x509/x509_mtc.cc",
   "crypto/x509/x509_obj.cc",
   "crypto/x509/x509_req.cc",
   "crypto/x509/x509_set.cc",
@@ -675,7 +675,6 @@
   "crypto/fipsmodule/tls/internal.h",
   "crypto/hrss/internal.h",
   "crypto/internal.h",
-  "crypto/kyber/internal.h",
   "crypto/lhash/internal.h",
   "crypto/md5/internal.h",
   "crypto/mem_internal.h",
@@ -794,7 +793,6 @@
   "crypto/hpke/hpke_test.cc",
   "crypto/hrss/hrss_test.cc",
   "crypto/impl_dispatch_test.cc",
-  "crypto/kyber/kyber_test.cc",
   "crypto/lhash/lhash_test.cc",
   "crypto/md5/md5_test.cc",
   "crypto/mem_test.cc",
@@ -905,7 +903,6 @@
   "crypto/hmac/hmac_tests.txt",
   "crypto/hpke/hpke_test_vectors.txt",
   "crypto/hpke/hpke_test_vectors_pq.txt",
-  "crypto/kyber/kyber_tests.txt",
   "crypto/mldsa/mldsa_nist_keygen_44_tests.txt",
   "crypto/mldsa/mldsa_nist_keygen_65_tests.txt",
   "crypto/mldsa/mldsa_nist_keygen_87_tests.txt",
@@ -2180,6 +2177,7 @@
   "pki/testdata/ocsp_unittest/bad_status.pem",
   "pki/testdata/ocsp_unittest/future_response.pem",
   "pki/testdata/ocsp_unittest/good_response.pem",
+  "pki/testdata/ocsp_unittest/good_response_invalid_serial.pem",
   "pki/testdata/ocsp_unittest/good_response_next_update.pem",
   "pki/testdata/ocsp_unittest/good_response_sha256.pem",
   "pki/testdata/ocsp_unittest/has_critical_ct_extension.pem",
@@ -2911,6 +2909,15 @@
   "rust/bssl-sys/src/lib.rs",
 
 
+rust_bssl_tls_tokio_sources = 
+  "rust/bssl-tls-tokio/src/hyper.rs",
+  "rust/bssl-tls-tokio/src/lib.rs",
+  "rust/bssl-tls-tokio/src/tests.rs",
+  "rust/bssl-tls-tokio/src/tests/convenience.rs",
+  "rust/bssl-tls-tokio/src/tests/datagram.rs",
+  "rust/bssl-tls-tokio/src/tests/transport.rs",
+
+
 rust_bssl_x509_sources = 
   "rust/bssl-x509/src/certificates.rs",
   "rust/bssl-x509/src/errors.rs",

boringssl-0.20260708.tar.xz/gen/sources.json -> boringssl-0.20260813.tar.xz/gen/sources.json Changed

@@ -390,7 +390,6 @@
       "crypto/fuzzer_mode.cc",
       "crypto/hpke/hpke.cc",
       "crypto/hrss/hrss.cc",
-      "crypto/kyber/kyber.cc",
       "crypto/lhash/lhash.cc",
       "crypto/md4/md4.cc",
       "crypto/md5/md5.cc",
@@ -490,6 +489,7 @@
       "crypto/x509/x509_def.cc",
       "crypto/x509/x509_ext.cc",
       "crypto/x509/x509_lu.cc",
+      "crypto/x509/x509_mtc.cc",
       "crypto/x509/x509_obj.cc",
       "crypto/x509/x509_req.cc",
       "crypto/x509/x509_set.cc",
@@ -657,7 +657,6 @@
       "crypto/fipsmodule/tls/internal.h",
       "crypto/hrss/internal.h",
       "crypto/internal.h",
-      "crypto/kyber/internal.h",
       "crypto/lhash/internal.h",
       "crypto/md5/internal.h",
       "crypto/mem_internal.h",
@@ -775,7 +774,6 @@
       "crypto/hpke/hpke_test.cc",
       "crypto/hrss/hrss_test.cc",
       "crypto/impl_dispatch_test.cc",
-      "crypto/kyber/kyber_test.cc",
       "crypto/lhash/lhash_test.cc",
       "crypto/md5/md5_test.cc",
       "crypto/mem_test.cc",
@@ -884,7 +882,6 @@
       "crypto/hmac/hmac_tests.txt",
       "crypto/hpke/hpke_test_vectors.txt",
       "crypto/hpke/hpke_test_vectors_pq.txt",
-      "crypto/kyber/kyber_tests.txt",
       "crypto/mldsa/mldsa_nist_keygen_44_tests.txt",
       "crypto/mldsa/mldsa_nist_keygen_65_tests.txt",
       "crypto/mldsa/mldsa_nist_keygen_87_tests.txt",
@@ -2160,6 +2157,7 @@
       "pki/testdata/ocsp_unittest/bad_status.pem",
       "pki/testdata/ocsp_unittest/future_response.pem",
       "pki/testdata/ocsp_unittest/good_response.pem",
+      "pki/testdata/ocsp_unittest/good_response_invalid_serial.pem",
       "pki/testdata/ocsp_unittest/good_response_next_update.pem",
       "pki/testdata/ocsp_unittest/good_response_sha256.pem",
       "pki/testdata/ocsp_unittest/has_critical_ct_extension.pem",
@@ -2894,6 +2892,16 @@
       "rust/bssl-sys/src/lib.rs"
     
   },
+  "rust_bssl_tls_tokio": {
+    "srcs": 
+      "rust/bssl-tls-tokio/src/hyper.rs",
+      "rust/bssl-tls-tokio/src/lib.rs",
+      "rust/bssl-tls-tokio/src/tests.rs",
+      "rust/bssl-tls-tokio/src/tests/convenience.rs",
+      "rust/bssl-tls-tokio/src/tests/datagram.rs",
+      "rust/bssl-tls-tokio/src/tests/transport.rs"
+    
+  },
   "rust_bssl_x509": {
     "srcs": 
       "rust/bssl-x509/src/certificates.rs",

boringssl-0.20260708.tar.xz/gen/sources.mk -> boringssl-0.20260813.tar.xz/gen/sources.mk Changed

@@ -398,7 +398,6 @@
   crypto/fuzzer_mode.cc \
   crypto/hpke/hpke.cc \
   crypto/hrss/hrss.cc \
-  crypto/kyber/kyber.cc \
   crypto/lhash/lhash.cc \
   crypto/md4/md4.cc \
   crypto/md5/md5.cc \
@@ -498,6 +497,7 @@
   crypto/x509/x509_def.cc \
   crypto/x509/x509_ext.cc \
   crypto/x509/x509_lu.cc \
+  crypto/x509/x509_mtc.cc \
   crypto/x509/x509_obj.cc \
   crypto/x509/x509_req.cc \
   crypto/x509/x509_set.cc \
@@ -665,7 +665,6 @@
   crypto/fipsmodule/tls/internal.h \
   crypto/hrss/internal.h \
   crypto/internal.h \
-  crypto/kyber/internal.h \
   crypto/lhash/internal.h \
   crypto/md5/internal.h \
   crypto/mem_internal.h \
@@ -781,7 +780,6 @@
   crypto/hpke/hpke_test.cc \
   crypto/hrss/hrss_test.cc \
   crypto/impl_dispatch_test.cc \
-  crypto/kyber/kyber_test.cc \
   crypto/lhash/lhash_test.cc \
   crypto/md5/md5_test.cc \
   crypto/mem_test.cc \
@@ -890,7 +888,6 @@
   crypto/hmac/hmac_tests.txt \
   crypto/hpke/hpke_test_vectors.txt \
   crypto/hpke/hpke_test_vectors_pq.txt \
-  crypto/kyber/kyber_tests.txt \
   crypto/mldsa/mldsa_nist_keygen_44_tests.txt \
   crypto/mldsa/mldsa_nist_keygen_65_tests.txt \
   crypto/mldsa/mldsa_nist_keygen_87_tests.txt \
@@ -2152,6 +2149,7 @@
   pki/testdata/ocsp_unittest/bad_status.pem \
   pki/testdata/ocsp_unittest/future_response.pem \
   pki/testdata/ocsp_unittest/good_response.pem \
+  pki/testdata/ocsp_unittest/good_response_invalid_serial.pem \
   pki/testdata/ocsp_unittest/good_response_next_update.pem \
   pki/testdata/ocsp_unittest/good_response_sha256.pem \
   pki/testdata/ocsp_unittest/has_critical_ct_extension.pem \
@@ -2879,6 +2877,14 @@
 boringssl_rust_bssl_sys_sources := \
   rust/bssl-sys/src/lib.rs
 
+boringssl_rust_bssl_tls_tokio_sources := \
+  rust/bssl-tls-tokio/src/hyper.rs \
+  rust/bssl-tls-tokio/src/lib.rs \
+  rust/bssl-tls-tokio/src/tests.rs \
+  rust/bssl-tls-tokio/src/tests/convenience.rs \
+  rust/bssl-tls-tokio/src/tests/datagram.rs \
+  rust/bssl-tls-tokio/src/tests/transport.rs
+
 boringssl_rust_bssl_x509_sources := \
   rust/bssl-x509/src/certificates.rs \
   rust/bssl-x509/src/errors.rs \

boringssl-0.20260708.tar.xz/gen/test_support/trampoline-x86_64-apple.S -> boringssl-0.20260813.tar.xz/gen/test_support/trampoline-x86_64-apple.S Changed

@@ -6,13 +6,13 @@
 #if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && defined(__APPLE__)
 .text	
 
-
-
-
-
-
-
-
+// abi_test_trampoline loads callee-saved registers from |state|, calls |func|
+// with |argv|, then saves the callee-saved registers into |state|. It returns
+// the result of |func|. If |unwind| is non-zero, this function triggers unwind
+// instrumentation.
+// uint64_t abi_test_trampoline(void (*func)(...), CallerState *state,
+// const uint64_t *argv, size_t argc,
+// int unwind);
 .globl	_abi_test_trampoline
 .private_extern _abi_test_trampoline
 
@@ -21,15 +21,15 @@
 
 
 _CET_ENDBR
-
-
-
-
-
-
-
-
-
+// Stack layout:
+// 8 bytes - align
+// 48 bytes - saved caller registers
+// 8 bytes - scratch space
+// 8 bytes - saved copy of $unwind (SysV-only)
+// 8 bytes - saved copy of $state
+// 8 bytes - saved copy of $func
+// 8 bytes - if needed for stack alignment
+// 8*4 bytes - parameters for $func
 	subq	$120,%rsp
 
 
@@ -59,13 +59,13 @@
 	movq	24(%rsi),%r13
 	movq	32(%rsi),%r14
 	movq	40(%rsi),%r15
-
+// Stash $func and $state, so they are available after the call returns.
 	movq	%rdi,32(%rsp)
 	movq	%rsi,40(%rsp)
 
-
-
-
+// Load parameters. Note this will clobber $argv and $argc, so we can
+// only use non-parameter volatile registers. There are three, and they
+// are the same between SysV and Win64: %rax, %r10, and %r11.
 	movq	%rdx,%r10
 	movq	%rcx,%r11
 	decq	%r11
@@ -97,11 +97,11 @@
 	decq	%r11
 	js	L$args_done
 
-
-
-
-
-
+// This block should be:
+// movq (%r10), %rtmp
+// movq %rtmp, (%rax)
+// There are no spare registers available, so we spill into the scratch
+// space.
 	movq	%r11,56(%rsp)
 	movq	(%r10),%r11
 	movq	%r11,(%rax)
@@ -117,13 +117,13 @@
 	testq	%r10,%r10
 	jz	L$no_unwind
 
-
+// Set the trap flag.
 	pushfq
 	orq	$0x100,0(%rsp)
 	popfq
 
-
-
+// Run an instruction to trigger a breakpoint immediately before the
+// call.
 	nop
 .globl	_abi_test_unwind_start
 .private_extern _abi_test_unwind_start
@@ -136,11 +136,11 @@
 .alt_entry _abi_test_unwind_return
 _abi_test_unwind_return:
 
-
-
-
+// Clear the trap flag. Note this assumes the trap flag was clear on
+// entry. We do not support instrumenting an unwind-instrumented
+// |abi_test_trampoline|.
 	pushfq
-	andq	$-0x101,0(%rsp)
+	andq	$-0x101,0(%rsp)  // -0x101 is ~0x100
 	popfq
 .globl	_abi_test_unwind_stop
 .private_extern _abi_test_unwind_stop
@@ -153,7 +153,7 @@
 	call	*%rax
 
 L$call_done:
-
+// Store what $func did our state, so our caller can check.
 	movq	40(%rsp),%rsi
 	movq	%rbx,0(%rsi)
 	movq	%rbp,8(%rsi)
@@ -176,7 +176,7 @@
 	addq	$120,%rsp
 
 
-
+// %rax already contains $func's return value, unmodified.
 	ret
 
 
@@ -491,9 +491,9 @@
 	pxor	%xmm15,%xmm15
 	ret
 
-
-
-
+// abi_test_bad_unwind_wrong_register preserves the ABI, but annotates the wrong
+// register in unwind metadata.
+// void abi_test_bad_unwind_wrong_register(void);
 .globl	_abi_test_bad_unwind_wrong_register
 .private_extern _abi_test_bad_unwind_wrong_register
 
@@ -504,12 +504,12 @@
 
 _CET_ENDBR
 	pushq	%r12
+// This should be %r13
+// This should be %r13
 
-
-
-
-
-
+// Windows evaluates epilogs directly in the unwinder, rather than using
+// unwind codes. Add a nop so there is one non-epilog point (immediately
+// before the nop) where the unwinder can observe the mistake.
 	nop
 	popq	%r12
 
@@ -518,9 +518,9 @@
 
 
 
-
-
-
+// abi_test_bad_unwind_temporary preserves the ABI, but temporarily corrupts the
+// storage space for a saved register, breaking unwind.
+// void abi_test_bad_unwind_temporary(void);
 .globl	_abi_test_bad_unwind_temporary
 .private_extern _abi_test_bad_unwind_temporary
 
@@ -538,11 +538,11 @@
 	movq	%r12,%rax
 	incq	%rax
 	movq	%rax,(%rsp)
-
-
+// Unwinding from here is incorrect. Although %r12 itself has not been
+// changed, the unwind codes say to look in (%rsp) instead.
 
 	movq	%r12,(%rsp)
-
+// Unwinding is now fixed.
 
 	popq	%r12
 
@@ -551,9 +551,9 @@
 
 
 
-
-
-
+// abi_test_get_and_clear_direction_flag clears the direction flag. If the flag
+// was previously set, it returns one. Otherwise, it returns zero.
+// int abi_test_get_and_clear_direction_flag(void);
 .globl	_abi_test_get_and_clear_direction_flag
 .private_extern _abi_test_get_and_clear_direction_flag
 
@@ -568,8 +568,8 @@
 	ret
 
 
-
-
+// abi_test_set_direction_flag sets the direction flag.
+// void abi_test_set_direction_flag(void);
 .globl	_abi_test_set_direction_flag
 .private_extern _abi_test_set_direction_flag

boringssl-0.20260708.tar.xz/gen/test_support/trampoline-x86_64-linux.S -> boringssl-0.20260813.tar.xz/gen/test_support/trampoline-x86_64-linux.S Changed

@@ -6,13 +6,13 @@
 #if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && defined(__ELF__)
 .text	
 
-
-
-
-
-
-
-
+// abi_test_trampoline loads callee-saved registers from |state|, calls |func|
+// with |argv|, then saves the callee-saved registers into |state|. It returns
+// the result of |func|. If |unwind| is non-zero, this function triggers unwind
+// instrumentation.
+// uint64_t abi_test_trampoline(void (*func)(...), CallerState *state,
+// const uint64_t *argv, size_t argc,
+// int unwind);
 .globl	abi_test_trampoline
 .hidden abi_test_trampoline
 .type	abi_test_trampoline, @function
@@ -21,15 +21,15 @@
 .cfi_startproc	
 
 _CET_ENDBR
-
-
-
-
-
-
-
-
-
+// Stack layout:
+// 8 bytes - align
+// 48 bytes - saved caller registers
+// 8 bytes - scratch space
+// 8 bytes - saved copy of $unwind (SysV-only)
+// 8 bytes - saved copy of $state
+// 8 bytes - saved copy of $func
+// 8 bytes - if needed for stack alignment
+// 8*4 bytes - parameters for $func
 	subq	$120,%rsp
 .cfi_adjust_cfa_offset	120
 
@@ -59,13 +59,13 @@
 	movq	24(%rsi),%r13
 	movq	32(%rsi),%r14
 	movq	40(%rsi),%r15
-
+// Stash $func and $state, so they are available after the call returns.
 	movq	%rdi,32(%rsp)
 	movq	%rsi,40(%rsp)
 
-
-
-
+// Load parameters. Note this will clobber $argv and $argc, so we can
+// only use non-parameter volatile registers. There are three, and they
+// are the same between SysV and Win64: %rax, %r10, and %r11.
 	movq	%rdx,%r10
 	movq	%rcx,%r11
 	decq	%r11
@@ -97,11 +97,11 @@
 	decq	%r11
 	js	.Largs_done
 
-
-
-
-
-
+// This block should be:
+// movq (%r10), %rtmp
+// movq %rtmp, (%rax)
+// There are no spare registers available, so we spill into the scratch
+// space.
 	movq	%r11,56(%rsp)
 	movq	(%r10),%r11
 	movq	%r11,(%rax)
@@ -117,13 +117,13 @@
 	testq	%r10,%r10
 	jz	.Lno_unwind
 
-
+// Set the trap flag.
 	pushfq
 	orq	$0x100,0(%rsp)
 	popfq
 
-
-
+// Run an instruction to trigger a breakpoint immediately before the
+// call.
 	nop
 .globl	abi_test_unwind_start
 .hidden abi_test_unwind_start
@@ -134,11 +134,11 @@
 .hidden abi_test_unwind_return
 abi_test_unwind_return:
 
-
-
-
+// Clear the trap flag. Note this assumes the trap flag was clear on
+// entry. We do not support instrumenting an unwind-instrumented
+// |abi_test_trampoline|.
 	pushfq
-	andq	$-0x101,0(%rsp)
+	andq	$-0x101,0(%rsp)  // -0x101 is ~0x100
 	popfq
 .globl	abi_test_unwind_stop
 .hidden abi_test_unwind_stop
@@ -150,7 +150,7 @@
 	call	*%rax
 
 .Lcall_done:
-
+// Store what $func did our state, so our caller can check.
 	movq	40(%rsp),%rsi
 	movq	%rbx,0(%rsi)
 	movq	%rbp,8(%rsi)
@@ -173,7 +173,7 @@
 	addq	$120,%rsp
 .cfi_adjust_cfa_offset	-120
 
-
+// %rax already contains $func's return value, unmodified.
 	ret
 .cfi_endproc	
 
@@ -457,9 +457,9 @@
 	pxor	%xmm15,%xmm15
 	ret
 .size	abi_test_clobber_xmm15,.-abi_test_clobber_xmm15
-
-
-
+// abi_test_bad_unwind_wrong_register preserves the ABI, but annotates the wrong
+// register in unwind metadata.
+// void abi_test_bad_unwind_wrong_register(void);
 .globl	abi_test_bad_unwind_wrong_register
 .hidden abi_test_bad_unwind_wrong_register
 .type	abi_test_bad_unwind_wrong_register, @function
@@ -470,12 +470,12 @@
 _CET_ENDBR
 	pushq	%r12
 .cfi_adjust_cfa_offset	8
-.cfi_offset	%r13,-16
-
-
-
-
+.cfi_offset	%r13,-16  // This should be %r13
+// This should be %r13
 
+// Windows evaluates epilogs directly in the unwinder, rather than using
+// unwind codes. Add a nop so there is one non-epilog point (immediately
+// before the nop) where the unwinder can observe the mistake.
 	nop
 	popq	%r12
 .cfi_adjust_cfa_offset	-8
@@ -485,9 +485,9 @@
 .cfi_endproc	
 .size	abi_test_bad_unwind_wrong_register,.-abi_test_bad_unwind_wrong_register
 
-
-
-
+// abi_test_bad_unwind_temporary preserves the ABI, but temporarily corrupts the
+// storage space for a saved register, breaking unwind.
+// void abi_test_bad_unwind_temporary(void);
 .globl	abi_test_bad_unwind_temporary
 .hidden abi_test_bad_unwind_temporary
 .type	abi_test_bad_unwind_temporary, @function
@@ -505,11 +505,11 @@
 	movq	%r12,%rax
 	incq	%rax
 	movq	%rax,(%rsp)
-
-
+// Unwinding from here is incorrect. Although %r12 itself has not been
+// changed, the unwind codes say to look in (%rsp) instead.
 
 	movq	%r12,(%rsp)
-
+// Unwinding is now fixed.
 
 	popq	%r12
 .cfi_adjust_cfa_offset	-8
@@ -519,9 +519,9 @@
 
 .size	abi_test_bad_unwind_temporary,.-abi_test_bad_unwind_temporary
 
-
-
-
+// abi_test_get_and_clear_direction_flag clears the direction flag. If the flag
+// was previously set, it returns one. Otherwise, it returns zero.
+// int abi_test_get_and_clear_direction_flag(void);
 .globl	abi_test_get_and_clear_direction_flag
 .hidden abi_test_get_and_clear_direction_flag
 .type	abi_test_get_and_clear_direction_flag, @function
@@ -535,8 +535,8 @@
 	ret
 .size	abi_test_get_and_clear_direction_flag,.-abi_test_get_and_clear_direction_flag
 
-
-
+// abi_test_set_direction_flag sets the direction flag.
+// void abi_test_set_direction_flag(void);
 .globl	abi_test_set_direction_flag
 .hidden abi_test_set_direction_flag
 .type	abi_test_set_direction_flag, @function

boringssl-0.20260708.tar.xz/gen/test_support/trampoline-x86_64-win.asm -> boringssl-0.20260813.tar.xz/gen/test_support/trampoline-x86_64-win.asm Changed

@@ -14,13 +14,13 @@
 section	.text code align=64
 
 
-
-
-
-
-
-
-
+; abi_test_trampoline loads callee-saved registers from |state|, calls |func|
+; with |argv|, then saves the callee-saved registers into |state|. It returns
+; the result of |func|. If |unwind| is non-zero, this function triggers unwind
+; instrumentation.
+; uint64_t abi_test_trampoline(void (*func)(...), CallerState *state,
+; const uint64_t *argv, size_t argc,
+; int unwind);
 global	abi_test_trampoline
 
 ALIGN	16
@@ -28,15 +28,15 @@
 
 $L$SEH_begin_abi_test_trampoline_1:
 _CET_ENDBR
-
-
-
-
-
-
-
-
-
+; Stack layout:
+; 8 bytes - align
+; 224 bytes - saved caller registers
+; 8 bytes - scratch space
+; 8 bytes - saved copy of $unwind (SysV-only)
+; 8 bytes - saved copy of $state
+; 8 bytes - saved copy of $func
+; 8 bytes - if needed for stack alignment
+; 8*10 bytes - parameters for $func
 	sub	rsp,344
 
 $L$SEH_prologue_abi_test_trampoline_2:
@@ -113,13 +113,13 @@
 	movdqa	xmm13,XMMWORD176+rdx
 	movdqa	xmm14,XMMWORD192+rdx
 	movdqa	xmm15,XMMWORD208+rdx
-
+; Stash $func and $state, so they are available after the call returns.
 	mov	QWORD88+rsp,rcx
 	mov	QWORD96+rsp,rdx
 
-
-
-
+; Load parameters. Note this will clobber $argv and $argc, so we can
+; only use non-parameter volatile registers. There are three, and they
+; are the same between SysV and Win64: %rax, %r10, and %r11.
 	mov	r10,r8
 	mov	r11,r9
 	dec	r11
@@ -143,11 +143,11 @@
 	dec	r11
 	js	NEAR $L$args_done
 
-
-
-
-
-
+; This block should be:
+; movq (%r10), %rtmp
+; movq %rtmp, (%rax)
+; There are no spare registers available, so we spill into the scratch
+; space.
 	mov	QWORD104+rsp,r11
 	mov	r11,QWORDr10
 	mov	QWORDrax,r11
@@ -163,13 +163,13 @@
 	test	r10,r10
 	jz	NEAR $L$no_unwind
 
-
+; Set the trap flag.
 	pushfq
 	or	QWORDrsp,0x100
 	popfq
 
-
-
+; Run an instruction to trigger a breakpoint immediately before the
+; call.
 	nop
 global	abi_test_unwind_start
 abi_test_unwind_start:
@@ -178,11 +178,11 @@
 global	abi_test_unwind_return
 abi_test_unwind_return:
 
-
-
-
+; Clear the trap flag. Note this assumes the trap flag was clear on
+; entry. We do not support instrumenting an unwind-instrumented
+; |abi_test_trampoline|.
 	pushfq
-	and	QWORDrsp,-0x101
+	and	QWORDrsp,-0x101  ; -0x101 is ~0x100
 	popfq
 global	abi_test_unwind_stop
 abi_test_unwind_stop:
@@ -193,7 +193,7 @@
 	call	rax
 
 $L$call_done:
-
+; Store what $func did our state, so our caller can check.
 	mov	rdx,QWORD96+rsp
 	mov	QWORDrdx,rbx
 	mov	QWORD8+rdx,rbp
@@ -252,7 +252,7 @@
 	add	rsp,344
 
 
-
+; %rax already contains $func's return value, unmodified.
 	ret
 
 $L$SEH_end_abi_test_trampoline_22:
@@ -505,9 +505,9 @@
 	pxor	xmm15,xmm15
 	ret
 
-
-
-
+; abi_test_bad_unwind_wrong_register preserves the ABI, but annotates the wrong
+; register in unwind metadata.
+; void abi_test_bad_unwind_wrong_register(void);
 global	abi_test_bad_unwind_wrong_register
 
 ALIGN	16
@@ -516,12 +516,12 @@
 $L$SEH_begin_abi_test_bad_unwind_wrong_register_1:
 _CET_ENDBR
 	push	r12
-
-$L$SEH_prologue_abi_test_bad_unwind_wrong_register_2:
+; This should be %r13
+$L$SEH_prologue_abi_test_bad_unwind_wrong_register_2:  ; This should be %r13
 $L$SEH_endprologue_abi_test_bad_unwind_wrong_register_3:
-
-
-
+; Windows evaluates epilogs directly in the unwinder, rather than using
+; unwind codes. Add a nop so there is one non-epilog point (immediately
+; before the nop) where the unwinder can observe the mistake.
 	nop
 	pop	r12
 
@@ -530,9 +530,9 @@
 
 
 
-
-
-
+; abi_test_bad_unwind_temporary preserves the ABI, but temporarily corrupts the
+; storage space for a saved register, breaking unwind.
+; void abi_test_bad_unwind_temporary(void);
 global	abi_test_bad_unwind_temporary
 
 ALIGN	16
@@ -548,11 +548,11 @@
 	mov	rax,r12
 	inc	rax
 	mov	QWORDrsp,rax
-
-
+; Unwinding from here is incorrect. Although %r12 itself has not been
+; changed, the unwind codes say to look in (%rsp) instead.
 
 	mov	QWORDrsp,r12
-
+; Unwinding is now fixed.
 
 	pop	r12
 
@@ -561,9 +561,9 @@
 $L$SEH_end_abi_test_bad_unwind_temporary_4:
 
 
-
-
-
+; abi_test_get_and_clear_direction_flag clears the direction flag. If the flag
+; was previously set, it returns one. Otherwise, it returns zero.
+; int abi_test_get_and_clear_direction_flag(void);
 global	abi_test_get_and_clear_direction_flag
 
 abi_test_get_and_clear_direction_flag:
@@ -576,8 +576,8 @@
 	ret
 
 
-
-
+; abi_test_set_direction_flag sets the direction flag.
+; void abi_test_set_direction_flag(void);
 global	abi_test_set_direction_flag
 
 abi_test_set_direction_flag:
@@ -585,10 +585,10 @@
 	std
 	ret
 
-
-
-
-
+; abi_test_bad_unwind_epilog preserves the ABI, and correctly annotates the
+; prolog, but the epilog does not match Win64's rules, breaking unwind during
+; the epilog.
+; void abi_test_bad_unwind_epilog(void);
 global	abi_test_bad_unwind_epilog
 
 ALIGN	16
@@ -600,7 +600,7 @@
 
 	nop
 
-
+; The epilog should begin here, but the nop makes it invalid.
 	pop	r12
 	nop
 	ret
@@ -628,7 +628,7 @@
 section	.xdata rdata align=8
 ALIGN	4
 $L$SEH_info_abi_test_trampoline_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_abi_test_trampoline_21-$L$SEH_begin_abi_test_trampoline_1
 	DB	38
 	DB	0
@@ -691,7 +691,7 @@
 	DW	43
 
 $L$SEH_info_abi_test_bad_unwind_wrong_register_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_abi_test_bad_unwind_wrong_register_3-$L$SEH_begin_abi_test_bad_unwind_wrong_register_1
 	DB	1
 	DB	0
@@ -700,7 +700,7 @@
 
 	DW	0
 $L$SEH_info_abi_test_bad_unwind_temporary_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_abi_test_bad_unwind_temporary_3-$L$SEH_begin_abi_test_bad_unwind_temporary_1
 	DB	1
 	DB	0
@@ -709,7 +709,7 @@
 
 	DW	0
 $L$SEH_info_abi_test_bad_unwind_epilog_0:
-	DB	1
+	DB	1  ; version 1, no flags
 	DB	$L$SEH_endprologue_abi_test_bad_unwind_epilog_3-$L$SEH_begin_abi_test_bad_unwind_epilog_1
 	DB	1
 	DB	0

boringssl-0.20260708.tar.xz/go.mod -> boringssl-0.20260813.tar.xz/go.mod Changed

boringssl-0.20260708.tar.xz/include/openssl/base.h -> boringssl-0.20260813.tar.xz/include/openssl/base.h Changed

boringssl-0.20260708.tar.xz/include/openssl/bytestring.h -> boringssl-0.20260813.tar.xz/include/openssl/bytestring.h Changed

@@ -429,6 +429,16 @@
 // OID components are too large.
 OPENSSL_EXPORT char *CBS_asn1_relative_oid_to_text(const CBS *cbs);
 
+// CBS_get_asn1_oid_component gets a single OID component from `cbs`. On
+// success, it sets `*out` to the value, advances `cbs` past the component, and
+// returns one. If the input does not contain a valid OID component or if the
+// OID component is bigger than `uint64_t`, it returns zero.
+//
+// Specifically, this decodes a non-empty, minimal-width, base-128, big-endian
+// integer. The high bit of each byte is set for continuation bytes and unset
+// for the final byte. This encoding is also used for DER tag numbers 31 and up.
+OPENSSL_EXPORT int CBS_get_asn1_oid_component(CBS *cbs, uint64_t *out);
+
 // CBS_parse_generalized_time returns one if `cbs` is a valid DER-encoded, ASN.1
 // GeneralizedTime body within the limitations imposed by RFC 5280, or zero
 // otherwise. If `allow_timezone_offset` is non-zero, four-digit timezone
@@ -449,6 +459,7 @@
 OPENSSL_EXPORT int CBS_parse_utc_time(const CBS *cbs, struct tm *out_tm,
                                       int allow_timezone_offset);
 
+
 // CRYPTO ByteBuilder.
 //
 // `CBB` objects allow one to build length-prefixed serialisations. A `CBB`
@@ -628,6 +639,10 @@
 // It returns one on success and zero otherwise.
 OPENSSL_EXPORT int CBB_add_u32le(CBB *cbb, uint32_t value);
 
+// CBB_add_u48 appends a 48-bit, big-endian number from `value` to `cbb`. It
+// returns one on success and zero otherwise.
+OPENSSL_EXPORT int CBB_add_u48(CBB *cbb, uint64_t value);
+
 // CBB_add_u64 appends a 64-bit, big-endian number from `value` to `cbb`. It
 // returns one on success and zero otherwise.
 OPENSSL_EXPORT int CBB_add_u64(CBB *cbb, uint64_t value);
@@ -706,6 +721,11 @@
 
 // CBB_add_asn1_oid_component appends a single OID component to `cbb`.
 // It returns one on success and zero on error.
+//
+// Specifically, this encodes `value` as a non-empty, minimal-width, base-128,
+// big-endian integer. The high bit of each byte is set for continuation bytes
+// and unset for the final byte. This encoding is also used for DER tag numbers
+// 31 and up.
 OPENSSL_EXPORT int CBB_add_asn1_oid_component(CBB *cbb, uint64_t value);
 
 // CBB_flush_asn1_set_of calls `CBB_flush` on `cbb` and then reorders the

boringssl-0.20260708.tar.xz/include/openssl/cipher.h -> boringssl-0.20260813.tar.xz/include/openssl/cipher.h Changed

boringssl-0.20260708.tar.xz/include/openssl/evp.h -> boringssl-0.20260813.tar.xz/include/openssl/evp.h Changed

@@ -1025,6 +1025,50 @@
 // `EVP_PKEY_CTX_set_rsa_keygen_pubexp` and `EVP_PKEY_keygen`.
 OPENSSL_EXPORT EVP_PKEY *EVP_RSA_gen(unsigned bits);
 
+// EVP_PKEY_from_rsa_public_key decodes `len` bytes from `in` as a DER-encoded
+// RSAPublicKey structure (RFC 8017) of algorithm `alg`. It returns a
+// newly-allocated `EVP_PKEY` on success or NULL on error. `alg` must be an
+// RSA-based algorithm, i.e. `EVP_pkey_rsa` or one of `EVP_pkey_rsa_pss_*`. If
+// unsure, use `EVP_pkey_rsa`.
+OPENSSL_EXPORT EVP_PKEY *EVP_PKEY_from_rsa_public_key(const EVP_PKEY_ALG *alg,
+                                                      const uint8_t *in,
+                                                      size_t len);
+
+// EVP_PKEY_from_rsa_private_key decodes `len` bytes from `in` as a DER-encoded
+// RSAPrivateKey structure (RFC 8017) of algorithm `alg`. It returns a
+// newly-allocated `EVP_PKEY` on success or NULL on error. `alg` must be an
+// RSA-based algorithm, i.e. `EVP_pkey_rsa` or one of `EVP_pkey_rsa_pss_*`. If
+// unsure, use `EVP_pkey_rsa`.
+OPENSSL_EXPORT EVP_PKEY *EVP_PKEY_from_rsa_private_key(const EVP_PKEY_ALG *alg,
+                                                       const uint8_t *in,
+                                                       size_t len);
+
+// EVP_PKEY_marshal_rsa_public_key marshals `key` as a DER-encoded RSAPublicKey
+// structure (RFC 8017) and writes the result to `cbb`. It returns one on
+// success and zero on error. If `key` is not of type `EVP_PKEY_RSA` or
+// `EVP_PKEY_RSA_PSS`, it returns zero.
+//
+// WARNING: If `key` is of type `EVP_PKEY_RSA_PSS`, this representation does not
+// encode the key's RSA-PSS restrictions. If decoding with
+// `EVP_PKEY_from_rsa_public_key`, callers are expected to pass an appropriate
+// `EVP_PKEY_ALG` out of band. If decoding into a low-level `RSA` object, the
+// result will be an unrestricted key.
+OPENSSL_EXPORT int EVP_PKEY_marshal_rsa_public_key(CBB *cbb,
+                                                   const EVP_PKEY *key);
+
+// EVP_PKEY_marshal_rsa_private_key marshals `key` as a DER-encoded
+// RSAPrivateKey structure (RFC 8017) and writes the result to `cbb`. It returns
+// one on success and zero on error. If `key` is not of type `EVP_PKEY_RSA` or
+// `EVP_PKEY_RSA_PSS`, it returns zero.
+//
+// WARNING: If `key` is of type `EVP_PKEY_RSA_PSS`, this representation does not
+// encode the key's RSA-PSS restrictions. If decoding with
+// `EVP_PKEY_from_rsa_private_key`, callers are expected to pass an appropriate
+// `EVP_PKEY_ALG` out of band. If decoding into a low-level `RSA` object, the
+// result will be an unrestricted key.
+OPENSSL_EXPORT int EVP_PKEY_marshal_rsa_private_key(CBB *cbb,
+                                                    const EVP_PKEY *key);
+
 // EVP_PKEY_CTX_set_rsa_padding sets the padding type to use. It should be one
 // of the `RSA_*_PADDING` values. Returns one on success or zero on error. By
 // default, the padding is `RSA_PKCS1_PADDING`.
@@ -1119,6 +1163,50 @@
 
 // EC specific control functions.
 
+// The following functions decode `len` bytes from `in` as an EC public key in
+// compressed or uncompressed X9.62 format, respectively. The EC curve is
+// determined by `alg`, which must be an EC algorithm (i.e. one of
+// `EVP_pkey_ec_*`).
+//
+// The functions return a newly-allocated `EVP_PKEY` on success or NULL on
+// error.
+//
+// To support both uncompressed and compressed forms, call
+// `EVP_PKEY_from_ec_uncompressed_point` when the input begins with 0x04 and
+// `EVP_PKEY_from_ec_compressed_point` otherwise. Uncompressed form is more
+// common.
+OPENSSL_EXPORT EVP_PKEY *EVP_PKEY_from_ec_uncompressed_point(
+    const EVP_PKEY_ALG *alg, const uint8_t *in, size_t len);
+OPENSSL_EXPORT EVP_PKEY *EVP_PKEY_from_ec_compressed_point(
+    const EVP_PKEY_ALG *alg, const uint8_t *in, size_t len);
+
+// The following functions marshal `key`'s EC public key in compressed or
+// uncompressed X9.62 format, respectively, and write the result to `cbb`. They
+// return one on success and zero on error. It is an error if `key` is not an EC
+// key.
+OPENSSL_EXPORT int EVP_PKEY_marshal_ec_uncompressed_point(CBB *cbb,
+                                                          const EVP_PKEY *key);
+OPENSSL_EXPORT int EVP_PKEY_marshal_ec_compressed_point(CBB *cbb,
+                                                        const EVP_PKEY *key);
+
+// EVP_PKEY_from_ec_private_scalar decodes `len` bytes from `in` as an EC
+// private key, encoded as a big-endian, zero-padded integer. The EC curve is
+// determined by `alg`, which must be an EC algorithm (i.e. one of
+// `EVP_pkey_ec_*`). The input must be fully reduced and padded to the size of
+// the group order (e.g. 32 bytes for P-256) or the import will fail.
+//
+// This function returns a newly-allocated `EVP_PKEY` on success or NULL on
+// error.
+OPENSSL_EXPORT EVP_PKEY *EVP_PKEY_from_ec_private_scalar(
+    const EVP_PKEY_ALG *alg, const uint8_t *in, size_t len);
+
+// EVP_PKEY_marshal_ec_private_scalar marshals `key`'s private key as a
+// big-endian, zero-padded integer EC scalar and writes the result to `cbb`. It
+// returns one on success or zero on error. It is an error if `key` is not an EC
+// key.
+OPENSSL_EXPORT int EVP_PKEY_marshal_ec_private_scalar(CBB *cbb,
+                                                      const EVP_PKEY *key);
+
 // EVP_PKEY_get_ec_curve_nid returns `pkey`'s curve as a NID constant, such as
 // `NID_X9_62_prime256v1`, or `NID_undef` if `pkey` is not an EC key.
 OPENSSL_EXPORT int EVP_PKEY_get_ec_curve_nid(const EVP_PKEY *pkey);

boringssl-0.20260708.tar.xz/include/openssl/prefix_symbols.h -> boringssl-0.20260813.tar.xz/include/openssl/prefix_symbols.h Changed

@@ -519,6 +519,7 @@
 #pragma redefine_extname CBB_add_u24_length_prefixed BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBB_add_u24_length_prefixed)
 #pragma redefine_extname CBB_add_u32 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBB_add_u32)
 #pragma redefine_extname CBB_add_u32le BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBB_add_u32le)
+#pragma redefine_extname CBB_add_u48 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBB_add_u48)
 #pragma redefine_extname CBB_add_u64 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBB_add_u64)
 #pragma redefine_extname CBB_add_u64le BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBB_add_u64le)
 #pragma redefine_extname CBB_add_u8 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBB_add_u8)
@@ -554,6 +555,7 @@
 #pragma redefine_extname CBS_get_asn1_element BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBS_get_asn1_element)
 #pragma redefine_extname CBS_get_asn1_int64 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBS_get_asn1_int64)
 #pragma redefine_extname CBS_get_asn1_int64_with_tag BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBS_get_asn1_int64_with_tag)
+#pragma redefine_extname CBS_get_asn1_oid_component BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBS_get_asn1_oid_component)
 #pragma redefine_extname CBS_get_asn1_uint64 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBS_get_asn1_uint64)
 #pragma redefine_extname CBS_get_asn1_uint64_with_tag BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBS_get_asn1_uint64_with_tag)
 #pragma redefine_extname CBS_get_bytes BORINGSSL_ADD_USER_LABEL_AND_PREFIX(CBS_get_bytes)
@@ -1167,10 +1169,15 @@
 #pragma redefine_extname EVP_PKEY_encrypt_init BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_encrypt_init)
 #pragma redefine_extname EVP_PKEY_eq BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_eq)
 #pragma redefine_extname EVP_PKEY_free BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_free)
+#pragma redefine_extname EVP_PKEY_from_ec_compressed_point BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_from_ec_compressed_point)
+#pragma redefine_extname EVP_PKEY_from_ec_private_scalar BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_from_ec_private_scalar)
+#pragma redefine_extname EVP_PKEY_from_ec_uncompressed_point BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_from_ec_uncompressed_point)
 #pragma redefine_extname EVP_PKEY_from_private_key_info BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_from_private_key_info)
 #pragma redefine_extname EVP_PKEY_from_private_seed BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_from_private_seed)
 #pragma redefine_extname EVP_PKEY_from_raw_private_key BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_from_raw_private_key)
 #pragma redefine_extname EVP_PKEY_from_raw_public_key BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_from_raw_public_key)
+#pragma redefine_extname EVP_PKEY_from_rsa_private_key BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_from_rsa_private_key)
+#pragma redefine_extname EVP_PKEY_from_rsa_public_key BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_from_rsa_public_key)
 #pragma redefine_extname EVP_PKEY_from_subject_public_key_info BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_from_subject_public_key_info)
 #pragma redefine_extname EVP_PKEY_generate_from_alg BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_generate_from_alg)
 #pragma redefine_extname EVP_PKEY_get0 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_get0)
@@ -1194,6 +1201,11 @@
 #pragma redefine_extname EVP_PKEY_is_opaque BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_is_opaque)
 #pragma redefine_extname EVP_PKEY_keygen BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_keygen)
 #pragma redefine_extname EVP_PKEY_keygen_init BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_keygen_init)
+#pragma redefine_extname EVP_PKEY_marshal_ec_compressed_point BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_marshal_ec_compressed_point)
+#pragma redefine_extname EVP_PKEY_marshal_ec_private_scalar BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_marshal_ec_private_scalar)
+#pragma redefine_extname EVP_PKEY_marshal_ec_uncompressed_point BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_marshal_ec_uncompressed_point)
+#pragma redefine_extname EVP_PKEY_marshal_rsa_private_key BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_marshal_rsa_private_key)
+#pragma redefine_extname EVP_PKEY_marshal_rsa_public_key BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_marshal_rsa_public_key)
 #pragma redefine_extname EVP_PKEY_missing_parameters BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_missing_parameters)
 #pragma redefine_extname EVP_PKEY_new BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_new)
 #pragma redefine_extname EVP_PKEY_new_raw_private_key BORINGSSL_ADD_USER_LABEL_AND_PREFIX(EVP_PKEY_new_raw_private_key)
@@ -1839,6 +1851,7 @@
 #pragma redefine_extname SHA512_Update BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SHA512_Update)
 #pragma redefine_extname SIPHASH_24 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SIPHASH_24)
 #pragma redefine_extname SLHDSA_SHA2_128S_generate_key BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SLHDSA_SHA2_128S_generate_key)
+#pragma redefine_extname SLHDSA_SHA2_128S_generate_key_from_seed BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SLHDSA_SHA2_128S_generate_key_from_seed)
 #pragma redefine_extname SLHDSA_SHA2_128S_prehash_sign BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SLHDSA_SHA2_128S_prehash_sign)
 #pragma redefine_extname SLHDSA_SHA2_128S_prehash_verify BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SLHDSA_SHA2_128S_prehash_verify)
 #pragma redefine_extname SLHDSA_SHA2_128S_prehash_warning_nonstandard_sign BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SLHDSA_SHA2_128S_prehash_warning_nonstandard_sign)
@@ -1847,6 +1860,7 @@
 #pragma redefine_extname SLHDSA_SHA2_128S_sign BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SLHDSA_SHA2_128S_sign)
 #pragma redefine_extname SLHDSA_SHA2_128S_verify BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SLHDSA_SHA2_128S_verify)
 #pragma redefine_extname SLHDSA_SHAKE_256F_generate_key BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SLHDSA_SHAKE_256F_generate_key)
+#pragma redefine_extname SLHDSA_SHAKE_256F_generate_key_from_seed BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SLHDSA_SHAKE_256F_generate_key_from_seed)
 #pragma redefine_extname SLHDSA_SHAKE_256F_public_from_private BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SLHDSA_SHAKE_256F_public_from_private)
 #pragma redefine_extname SLHDSA_SHAKE_256F_sign BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SLHDSA_SHAKE_256F_sign)
 #pragma redefine_extname SLHDSA_SHAKE_256F_verify BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SLHDSA_SHAKE_256F_verify)
@@ -1878,8 +1892,10 @@
 #pragma redefine_extname SSL_COMP_get_compression_methods BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_COMP_get_compression_methods)
 #pragma redefine_extname SSL_COMP_get_id BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_COMP_get_id)
 #pragma redefine_extname SSL_COMP_get_name BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_COMP_get_name)
+#pragma redefine_extname SSL_CREDENTIAL_add1_trust_anchor_group_inclusion BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CREDENTIAL_add1_trust_anchor_group_inclusion)
 #pragma redefine_extname SSL_CREDENTIAL_dup_ref BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CREDENTIAL_dup_ref)
 #pragma redefine_extname SSL_CREDENTIAL_free BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CREDENTIAL_free)
+#pragma redefine_extname SSL_CREDENTIAL_get0_pre_shared_key_id BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CREDENTIAL_get0_pre_shared_key_id)
 #pragma redefine_extname SSL_CREDENTIAL_get_ex_data BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CREDENTIAL_get_ex_data)
 #pragma redefine_extname SSL_CREDENTIAL_get_ex_new_index BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CREDENTIAL_get_ex_new_index)
 #pragma redefine_extname SSL_CREDENTIAL_is_complete BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CREDENTIAL_is_complete)
@@ -2239,6 +2255,7 @@
 #pragma redefine_extname SSL_get_peer_full_cert_chain BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_get_peer_full_cert_chain)
 #pragma redefine_extname SSL_get_peer_quic_transport_params BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_get_peer_quic_transport_params)
 #pragma redefine_extname SSL_get_peer_signature_algorithm BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_get_peer_signature_algorithm)
+#pragma redefine_extname SSL_get_peer_tmp_key BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_get_peer_tmp_key)
 #pragma redefine_extname SSL_get_pending_cipher BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_get_pending_cipher)
 #pragma redefine_extname SSL_get_privatekey BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_get_privatekey)
 #pragma redefine_extname SSL_get_psk_identity BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_get_psk_identity)
@@ -2385,6 +2402,7 @@
 #pragma redefine_extname SSL_set_quic_use_legacy_codepoint BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_set_quic_use_legacy_codepoint)
 #pragma redefine_extname SSL_set_quiet_shutdown BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_set_quiet_shutdown)
 #pragma redefine_extname SSL_set_read_ahead BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_set_read_ahead)
+#pragma redefine_extname SSL_set_reject_unusable_ech_config BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_set_reject_unusable_ech_config)
 #pragma redefine_extname SSL_set_renegotiate_mode BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_set_renegotiate_mode)
 #pragma redefine_extname SSL_set_resumption_across_names_enabled BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_set_resumption_across_names_enabled)
 #pragma redefine_extname SSL_set_retain_only_sha256_of_client_certs BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_set_retain_only_sha256_of_client_certs)
@@ -3638,6 +3656,7 @@
 #define CBB_add_u24_length_prefixed BORINGSSL_ADD_PREFIX(CBB_add_u24_length_prefixed)
 #define CBB_add_u32 BORINGSSL_ADD_PREFIX(CBB_add_u32)
 #define CBB_add_u32le BORINGSSL_ADD_PREFIX(CBB_add_u32le)
+#define CBB_add_u48 BORINGSSL_ADD_PREFIX(CBB_add_u48)
 #define CBB_add_u64 BORINGSSL_ADD_PREFIX(CBB_add_u64)
 #define CBB_add_u64le BORINGSSL_ADD_PREFIX(CBB_add_u64le)
 #define CBB_add_u8 BORINGSSL_ADD_PREFIX(CBB_add_u8)
@@ -3673,6 +3692,7 @@
 #define CBS_get_asn1_element BORINGSSL_ADD_PREFIX(CBS_get_asn1_element)
 #define CBS_get_asn1_int64 BORINGSSL_ADD_PREFIX(CBS_get_asn1_int64)
 #define CBS_get_asn1_int64_with_tag BORINGSSL_ADD_PREFIX(CBS_get_asn1_int64_with_tag)
+#define CBS_get_asn1_oid_component BORINGSSL_ADD_PREFIX(CBS_get_asn1_oid_component)
 #define CBS_get_asn1_uint64 BORINGSSL_ADD_PREFIX(CBS_get_asn1_uint64)
 #define CBS_get_asn1_uint64_with_tag BORINGSSL_ADD_PREFIX(CBS_get_asn1_uint64_with_tag)
 #define CBS_get_bytes BORINGSSL_ADD_PREFIX(CBS_get_bytes)
@@ -4286,10 +4306,15 @@
 #define EVP_PKEY_encrypt_init BORINGSSL_ADD_PREFIX(EVP_PKEY_encrypt_init)
 #define EVP_PKEY_eq BORINGSSL_ADD_PREFIX(EVP_PKEY_eq)
 #define EVP_PKEY_free BORINGSSL_ADD_PREFIX(EVP_PKEY_free)
+#define EVP_PKEY_from_ec_compressed_point BORINGSSL_ADD_PREFIX(EVP_PKEY_from_ec_compressed_point)
+#define EVP_PKEY_from_ec_private_scalar BORINGSSL_ADD_PREFIX(EVP_PKEY_from_ec_private_scalar)
+#define EVP_PKEY_from_ec_uncompressed_point BORINGSSL_ADD_PREFIX(EVP_PKEY_from_ec_uncompressed_point)
 #define EVP_PKEY_from_private_key_info BORINGSSL_ADD_PREFIX(EVP_PKEY_from_private_key_info)
 #define EVP_PKEY_from_private_seed BORINGSSL_ADD_PREFIX(EVP_PKEY_from_private_seed)
 #define EVP_PKEY_from_raw_private_key BORINGSSL_ADD_PREFIX(EVP_PKEY_from_raw_private_key)
 #define EVP_PKEY_from_raw_public_key BORINGSSL_ADD_PREFIX(EVP_PKEY_from_raw_public_key)
+#define EVP_PKEY_from_rsa_private_key BORINGSSL_ADD_PREFIX(EVP_PKEY_from_rsa_private_key)
+#define EVP_PKEY_from_rsa_public_key BORINGSSL_ADD_PREFIX(EVP_PKEY_from_rsa_public_key)
 #define EVP_PKEY_from_subject_public_key_info BORINGSSL_ADD_PREFIX(EVP_PKEY_from_subject_public_key_info)
 #define EVP_PKEY_generate_from_alg BORINGSSL_ADD_PREFIX(EVP_PKEY_generate_from_alg)
 #define EVP_PKEY_get0 BORINGSSL_ADD_PREFIX(EVP_PKEY_get0)
@@ -4313,6 +4338,11 @@
 #define EVP_PKEY_is_opaque BORINGSSL_ADD_PREFIX(EVP_PKEY_is_opaque)
 #define EVP_PKEY_keygen BORINGSSL_ADD_PREFIX(EVP_PKEY_keygen)
 #define EVP_PKEY_keygen_init BORINGSSL_ADD_PREFIX(EVP_PKEY_keygen_init)
+#define EVP_PKEY_marshal_ec_compressed_point BORINGSSL_ADD_PREFIX(EVP_PKEY_marshal_ec_compressed_point)
+#define EVP_PKEY_marshal_ec_private_scalar BORINGSSL_ADD_PREFIX(EVP_PKEY_marshal_ec_private_scalar)
+#define EVP_PKEY_marshal_ec_uncompressed_point BORINGSSL_ADD_PREFIX(EVP_PKEY_marshal_ec_uncompressed_point)
+#define EVP_PKEY_marshal_rsa_private_key BORINGSSL_ADD_PREFIX(EVP_PKEY_marshal_rsa_private_key)
+#define EVP_PKEY_marshal_rsa_public_key BORINGSSL_ADD_PREFIX(EVP_PKEY_marshal_rsa_public_key)
 #define EVP_PKEY_missing_parameters BORINGSSL_ADD_PREFIX(EVP_PKEY_missing_parameters)
 #define EVP_PKEY_new BORINGSSL_ADD_PREFIX(EVP_PKEY_new)
 #define EVP_PKEY_new_raw_private_key BORINGSSL_ADD_PREFIX(EVP_PKEY_new_raw_private_key)
@@ -4958,6 +4988,7 @@
 #define SHA512_Update BORINGSSL_ADD_PREFIX(SHA512_Update)
 #define SIPHASH_24 BORINGSSL_ADD_PREFIX(SIPHASH_24)
 #define SLHDSA_SHA2_128S_generate_key BORINGSSL_ADD_PREFIX(SLHDSA_SHA2_128S_generate_key)
+#define SLHDSA_SHA2_128S_generate_key_from_seed BORINGSSL_ADD_PREFIX(SLHDSA_SHA2_128S_generate_key_from_seed)
 #define SLHDSA_SHA2_128S_prehash_sign BORINGSSL_ADD_PREFIX(SLHDSA_SHA2_128S_prehash_sign)
 #define SLHDSA_SHA2_128S_prehash_verify BORINGSSL_ADD_PREFIX(SLHDSA_SHA2_128S_prehash_verify)
 #define SLHDSA_SHA2_128S_prehash_warning_nonstandard_sign BORINGSSL_ADD_PREFIX(SLHDSA_SHA2_128S_prehash_warning_nonstandard_sign)
@@ -4966,6 +4997,7 @@
 #define SLHDSA_SHA2_128S_sign BORINGSSL_ADD_PREFIX(SLHDSA_SHA2_128S_sign)
 #define SLHDSA_SHA2_128S_verify BORINGSSL_ADD_PREFIX(SLHDSA_SHA2_128S_verify)
 #define SLHDSA_SHAKE_256F_generate_key BORINGSSL_ADD_PREFIX(SLHDSA_SHAKE_256F_generate_key)
+#define SLHDSA_SHAKE_256F_generate_key_from_seed BORINGSSL_ADD_PREFIX(SLHDSA_SHAKE_256F_generate_key_from_seed)
 #define SLHDSA_SHAKE_256F_public_from_private BORINGSSL_ADD_PREFIX(SLHDSA_SHAKE_256F_public_from_private)
 #define SLHDSA_SHAKE_256F_sign BORINGSSL_ADD_PREFIX(SLHDSA_SHAKE_256F_sign)
 #define SLHDSA_SHAKE_256F_verify BORINGSSL_ADD_PREFIX(SLHDSA_SHAKE_256F_verify)
@@ -4997,8 +5029,10 @@
 #define SSL_COMP_get_compression_methods BORINGSSL_ADD_PREFIX(SSL_COMP_get_compression_methods)
 #define SSL_COMP_get_id BORINGSSL_ADD_PREFIX(SSL_COMP_get_id)
 #define SSL_COMP_get_name BORINGSSL_ADD_PREFIX(SSL_COMP_get_name)
+#define SSL_CREDENTIAL_add1_trust_anchor_group_inclusion BORINGSSL_ADD_PREFIX(SSL_CREDENTIAL_add1_trust_anchor_group_inclusion)
 #define SSL_CREDENTIAL_dup_ref BORINGSSL_ADD_PREFIX(SSL_CREDENTIAL_dup_ref)
 #define SSL_CREDENTIAL_free BORINGSSL_ADD_PREFIX(SSL_CREDENTIAL_free)
+#define SSL_CREDENTIAL_get0_pre_shared_key_id BORINGSSL_ADD_PREFIX(SSL_CREDENTIAL_get0_pre_shared_key_id)
 #define SSL_CREDENTIAL_get_ex_data BORINGSSL_ADD_PREFIX(SSL_CREDENTIAL_get_ex_data)
 #define SSL_CREDENTIAL_get_ex_new_index BORINGSSL_ADD_PREFIX(SSL_CREDENTIAL_get_ex_new_index)
 #define SSL_CREDENTIAL_is_complete BORINGSSL_ADD_PREFIX(SSL_CREDENTIAL_is_complete)
@@ -5358,6 +5392,7 @@
 #define SSL_get_peer_full_cert_chain BORINGSSL_ADD_PREFIX(SSL_get_peer_full_cert_chain)
 #define SSL_get_peer_quic_transport_params BORINGSSL_ADD_PREFIX(SSL_get_peer_quic_transport_params)
 #define SSL_get_peer_signature_algorithm BORINGSSL_ADD_PREFIX(SSL_get_peer_signature_algorithm)
+#define SSL_get_peer_tmp_key BORINGSSL_ADD_PREFIX(SSL_get_peer_tmp_key)
 #define SSL_get_pending_cipher BORINGSSL_ADD_PREFIX(SSL_get_pending_cipher)
 #define SSL_get_privatekey BORINGSSL_ADD_PREFIX(SSL_get_privatekey)
 #define SSL_get_psk_identity BORINGSSL_ADD_PREFIX(SSL_get_psk_identity)
@@ -5504,6 +5539,7 @@
 #define SSL_set_quic_use_legacy_codepoint BORINGSSL_ADD_PREFIX(SSL_set_quic_use_legacy_codepoint)
 #define SSL_set_quiet_shutdown BORINGSSL_ADD_PREFIX(SSL_set_quiet_shutdown)
 #define SSL_set_read_ahead BORINGSSL_ADD_PREFIX(SSL_set_read_ahead)
+#define SSL_set_reject_unusable_ech_config BORINGSSL_ADD_PREFIX(SSL_set_reject_unusable_ech_config)
 #define SSL_set_renegotiate_mode BORINGSSL_ADD_PREFIX(SSL_set_renegotiate_mode)
 #define SSL_set_resumption_across_names_enabled BORINGSSL_ADD_PREFIX(SSL_set_resumption_across_names_enabled)
 #define SSL_set_retain_only_sha256_of_client_certs BORINGSSL_ADD_PREFIX(SSL_set_retain_only_sha256_of_client_certs)

boringssl-0.20260708.tar.xz/include/openssl/slhdsa.h -> boringssl-0.20260813.tar.xz/include/openssl/slhdsa.h Changed

@@ -15,7 +15,7 @@
 #ifndef OPENSSL_HEADER_SLHDSA_H
 #define OPENSSL_HEADER_SLHDSA_H
 
-#include <openssl/base.h>   // IWYU pragma: export
+#include <openssl/base.h>  // IWYU pragma: export
 
 #if defined(__cplusplus)
 extern "C" {
@@ -25,6 +25,10 @@
 // SLH-DSA.
 
 
+// SLHDSA_SHA2_128S_SEED_BYTES is the number of bytes in an SLH-DSA-SHA2-128s
+// private seed.
+#define SLHDSA_SHA2_128S_SEED_BYTES 48
+
 // SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES is the number of bytes in an
 // SLH-DSA-SHA2-128s public key.
 #define SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES 32
@@ -37,6 +41,10 @@
 // SLH-DSA-SHA2-128s signature.
 #define SLHDSA_SHA2_128S_SIGNATURE_BYTES 7856
 
+// SLHDSA_SHAKE_256F_SEED_BYTES is the number of bytes in an SLH-DSA-SHAKE-256f
+// private seed.
+#define SLHDSA_SHAKE_256F_SEED_BYTES 96
+
 // SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES is the number of bytes in an
 // SLH-DSA-SHAKE-256f public key.
 #define SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES 64
@@ -49,6 +57,22 @@
 // SLH-DSA-SHAKE-256f signature.
 #define SLHDSA_SHAKE_256F_SIGNATURE_BYTES 49856
 
+// SLHDSA_SHA2_128S_generate_key_from_seed generates a SLH-DSA-SHA2-128s key
+// pair from the given `seed` and writes the result to `out_public_key` and
+// `out_private_key`.
+OPENSSL_EXPORT void SLHDSA_SHA2_128S_generate_key_from_seed(
+    uint8_t out_public_keySLHDSA_SHA2_128S_PUBLIC_KEY_BYTES,
+    uint8_t out_private_keySLHDSA_SHA2_128S_PRIVATE_KEY_BYTES,
+    const uint8_t seedSLHDSA_SHA2_128S_SEED_BYTES);
+
+// SLHDSA_SHAKE_256F_generate_key_from_seed generates a SLH-DSA-SHA2-128s key
+// pair from the given `seed` and writes the result to `out_public_key` and
+// `out_private_key`.
+OPENSSL_EXPORT void SLHDSA_SHAKE_256F_generate_key_from_seed(
+    uint8_t out_public_keySLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES,
+    uint8_t out_private_keySLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES,
+    const uint8_t seedSLHDSA_SHAKE_256F_SEED_BYTES);
+
 // SLHDSA_SHA2_128S_generate_key generates a SLH-DSA-SHA2-128s key pair and
 // writes the result to `out_public_key` and `out_private_key`.
 OPENSSL_EXPORT void SLHDSA_SHA2_128S_generate_key(

boringssl-0.20260708.tar.xz/include/openssl/ssl.h -> boringssl-0.20260813.tar.xz/include/openssl/ssl.h Changed

@@ -856,8 +856,8 @@
                                                      CRYPTO_BUFFER *ocsp);
 
 // SSL_CREDENTIAL_set1_certificate_properties parses
-// `certificate_property_list` as a CertificatePropertyList (see Section 6 of
-// draft-ietf-tls-trust-anchor-ids-00) and applies recognized properties to
+// `certificate_property_list` as a CertificatePropertyList (see Section 7 of
+// draft-ietf-tls-trust-anchor-ids-04) and applies recognized properties to
 // `cred`. It returns one on success and zero on error. It is an error if
 // `certificate_property_list` does not parse correctly, or if any recognized
 // properties from `certificate_property_list` cannot be applied to `cred`.
@@ -868,7 +868,9 @@
 // logic, without requiring application changes for each property defined.
 //
 // BoringSSL currently supports the following properties:
-// * trust_anchor_identifier (see `SSL_CREDENTIAL_set1_trust_anchor_id`)
+// * trust_anchor_id (see `SSL_CREDENTIAL_set1_trust_anchor_id`)
+// * trust_anchor_group_inclusions (see
+//   `SSL_CREDENTIAL_add1_trust_anchor_group_inclusion`)
 //
 // Note this function does not automatically enable issuer matching. Callers
 // must separately call `SSL_CREDENTIAL_set_must_match_issuer` if desired.
@@ -2616,7 +2618,6 @@
 #define SSL_GROUP_SECP521R1 25
 #define SSL_GROUP_X25519 29
 #define SSL_GROUP_X25519_MLKEM768 0x11ec
-#define SSL_GROUP_X25519_KYBER768_DRAFT00 0x6399
 #define SSL_GROUP_MLKEM1024 0x0202
 
 // SSL_CTX_set1_group_ids sets the preferred groups for `ctx` to `group_ids`.
@@ -3245,19 +3246,29 @@
 // SSL_CREDENTIAL_set1_trust_anchor_id sets `cred`'s trust anchor ID to `id`, or
 // clears it if `id_len` is zero. It returns one on success and zero on
 // error. If not clearing, `id` must be in binary format (Section 3 of
-// draft-ietf-tls-trust-anchor-ids-00) of length `id_len`, and describe the
+// draft-ietf-tls-trust-anchor-ids-04) of length `id_len`, and describe the
 // issuer of the final certificate in `cred`'s certificate chain.
 //
 // Additionally, `cred` must enable issuer matching (see
 // `SSL_CREDENTIAL_set_must_match_issuer`) for this value to take effect.
 //
-// For better extensibility, callers are recommended to configure this
-// information with a CertificatePropertyList instead. See
-// `SSL_CREDENTIAL_set1_certificate_properties`.
+// For extensibility, callers are recommended to configure this information with
+// a CertificatePropertyList. See `SSL_CREDENTIAL_set1_certificate_properties`.
 OPENSSL_EXPORT int SSL_CREDENTIAL_set1_trust_anchor_id(SSL_CREDENTIAL *cred,
                                                        const uint8_t *id,
                                                        size_t id_len);
 
+// SSL_CREDENTIAL_add1_trust_anchor_group_inclusion specifies that `cred`
+// matches all trust anchor IDs equal to `base` followed some component between
+// `min` and `max`, inclusive. It returns one on success and zero on error. This
+// function may be called multiple times to register multiple group inclusions.
+//
+// For extensibility, callers are recommended to configure this information with
+// a CertificatePropertyList. See `SSL_CREDENTIAL_set1_certificate_properties`.
+OPENSSL_EXPORT int SSL_CREDENTIAL_add1_trust_anchor_group_inclusion(
+    SSL_CREDENTIAL *cred, const uint8_t *base, size_t base_len, uint64_t min,
+    uint64_t max);
+
 // SSL_CTX_set1_requested_trust_anchors configures `ctx` to request a
 // certificate issued by one of the trust anchors in `ids`. It returns one on
 // success and zero on error. `ids` must be a list of trust anchor IDs in
@@ -3265,10 +3276,10 @@
 //
 // The list may describe application's full list of supported trust anchors, or
 // a, possibly empty, subset. Applications can select this subset using
-// out-of-band information, such as the DNS hint in Section 5 of
-// draft-ietf-tls-trust-anchor-ids-00. Client applications sending a subset
+// out-of-band information, such as the DNS hint in Section 6 of
+// draft-ietf-tls-trust-anchor-ids-04. Client applications sending a subset
 // should use `SSL_get0_peer_available_trust_anchors` to implement the retry
-// flow from Section 4.3 of draft-ietf-tls-trust-anchor-ids-00.
+// flow from Section 4.3 of draft-ietf-tls-trust-anchor-ids-04.
 //
 // If empty (`ids_len` is zero), the trust_anchors extension will still be sent
 // in ClientHello. This may be used by a client application to signal support
@@ -3307,7 +3318,7 @@
 // This value is only available during the handshake and is expected to be
 // called in the event of certificate verification failure. Client applications
 // can use it to retry the connection, requesting different trust anchors. See
-// Section 4.3 of draft-ietf-tls-trust-anchor-ids-00 for details.
+// Section 4.3 of draft-ietf-tls-trust-anchor-ids-04 for details.
 // `CBS_get_u8_length_prefixed` may be used to iterate over the format.
 //
 // If needed in other contexts, callers may save the value during certificate
@@ -3413,7 +3424,13 @@
 // `protos`. `protos` must be in wire-format (i.e. a series of non-empty, 8-bit
 // length-prefixed strings), or the empty string to disable ALPN. It returns
 // zero on success and one on failure. Configuring a non-empty string enables
-// ALPN on a client.
+// ALPN on a client. On a client, it will advertise these protocols. On a
+// server, it will use them to automatically select a protocol if the client
+// supports ALPN and no select callback is set.
+//
+// Those configuring HTTP/2 must also configure the cipher suite set on the
+// SSL_CTX so that the selected cipher is compliant with RFC 7540 Section 9.2.
+// Servers should install their own ALPN callback to comply with the RFC.
 //
 // WARNING: this function is dangerous because it breaks the usual return value
 // convention.
@@ -3424,7 +3441,13 @@
 // `protos` must be in wire-format (i.e. a series of non-empty, 8-bit
 // length-prefixed strings), or the empty string to disable ALPN. It returns
 // zero on success and one on failure. Configuring a non-empty string enables
-// ALPN on a client.
+// ALPN on a client. On a client, it will advertise these protocols. On a
+// server, it will use them to automatically select a protocol if the client
+// supports ALPN and no select callback is set.
+//
+// Those configuring HTTP/2 must also configure the cipher suite set on the
+// SSL_CTX so that the selected cipher is compliant with RFC 7540 Section 9.2.
+// Servers should install their own ALPN callback to comply with the RFC.
 //
 // WARNING: this function is dangerous because it breaks the usual return value
 // convention.
@@ -3835,6 +3858,12 @@
     const uint8_t *key, size_t key_len, const uint8_t *id, size_t id_len,
     const EVP_MD *md, const uint8_t *context, size_t context_len);
 
+// SSL_CREDENTIAL_get0_pre_shared_key_id returns the external identity of this
+// pre-shared key credential, or NULL if `cred` is not a pre-shared key
+// credential or `id_len` is NULL.
+OPENSSL_EXPORT const uint8_t *SSL_CREDENTIAL_get0_pre_shared_key_id(
+    const SSL_CREDENTIAL *cred, size_t *id_len);
+
 
 // TLS 1.2 pre-shared keys.
 //
@@ -4574,6 +4603,11 @@
 // ECH extension when no supported ECHConfig is available.
 OPENSSL_EXPORT void SSL_set_enable_ech_grease(SSL *ssl, int enable);
 
+// SSL_set_reject_unusable_ech_config configures whether the client will fail
+// the handshake if a valid, supported ECHConfig cannot be selected to offer
+// ECH.
+OPENSSL_EXPORT void SSL_set_reject_unusable_ech_config(SSL *ssl, int enable);
+
 // SSL_set1_ech_config_list configures `ssl` to, as a client, offer ECH with the
 // specified configuration. `ech_config_list` should contain a serialized
 // ECHConfigList structure. It returns one on success and zero on error.
@@ -5123,8 +5157,7 @@
 // should log `line` followed by a newline, synchronizing with any concurrent
 // access to the log.
 //
-// The format is described in
-// https://www.ietf.org/archive/id/draft-ietf-tls-keylogfile-01.html
+// The format is described in RFC 9850.
 //
 // WARNING: The data in `line` allows an attacker to break security properties
 // of the TLS protocol, including confidentiality, integrity, and forward
@@ -5800,6 +5833,9 @@
 // SSL_get_server_tmp_key returns zero.
 OPENSSL_EXPORT int SSL_get_server_tmp_key(SSL *ssl, EVP_PKEY **out_key);
 
+// SSL_get_peer_tmp_key returns zero.
+OPENSSL_EXPORT int SSL_get_peer_tmp_key(SSL *ssl, EVP_PKEY **out_key);
+
 // SSL_CTX_set_tmp_dh returns 1.
 OPENSSL_EXPORT int SSL_CTX_set_tmp_dh(SSL_CTX *ctx, const DH *dh);
 
@@ -6238,7 +6274,6 @@
 #define SSL_CURVE_SECP384R1 SSL_GROUP_SECP384R1
 #define SSL_CURVE_SECP521R1 SSL_GROUP_SECP521R1
 #define SSL_CURVE_X25519 SSL_GROUP_X25519
-#define SSL_CURVE_X25519_KYBER768_DRAFT00 SSL_GROUP_X25519_KYBER768_DRAFT00
 
 // SSL_get_curve_id calls `SSL_get_group_id`.
 OPENSSL_EXPORT uint16_t SSL_get_curve_id(const SSL *ssl);
@@ -7077,6 +7112,7 @@
 #define SSL_R_UNSUPPORTED_CERTIFICATE 334
 #define SSL_R_MISSING_KEY 335
 #define SSL_R_INVALID_RAW_PUBLIC_KEY 336
+#define SSL_R_UNUSABLE_ECH_CONFIG_LIST 337
 #define SSL_R_SSLV3_ALERT_CLOSE_NOTIFY 1000
 #define SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE 1010
 #define SSL_R_SSLV3_ALERT_BAD_RECORD_MAC 1020

boringssl-0.20260708.tar.xz/infra/config/generated/cr-buildbucket.cfg -> boringssl-0.20260813.tar.xz/infra/config/generated/cr-buildbucket.cfg Changed

@@ -22,6 +22,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 5400
       caches {
@@ -51,6 +52,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\",\"BUILD_SHARED_LIBS\":\"1\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"FIPS\":\"1\",\"OPENSSL_NO_ASM\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"**/lib*.so*\""
       }
       execution_timeout_secs: 5400
       caches {
@@ -80,6 +82,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\",\"BUILD_SHARED_LIBS\":\"1\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"**/lib*.so*\""
       }
       execution_timeout_secs: 5400
       caches {
@@ -109,6 +112,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 5400
       caches {
@@ -138,10 +142,12 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "android:true"
+        properties_j: "check_prefixed_symbols:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\"}"
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -171,6 +177,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\",\"CMAKE_BUILD_TYPE\":\"Release\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 5400
       caches {
@@ -200,6 +207,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"armeabi-v7a\",\"ANDROID_PLATFORM\":\"android-24\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 5400
       caches {
@@ -233,6 +241,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -262,6 +271,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"armeabi-v7a\",\"ANDROID_ARM_MODE\":\"arm\",\"ANDROID_PLATFORM\":\"android-24\",\"CMAKE_BUILD_TYPE\":\"Release\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 5400
       caches {
@@ -291,6 +301,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"armeabi-v7a\",\"ANDROID_PLATFORM\":\"android-24\",\"BUILD_SHARED_LIBS\":\"1\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"**/lib*.so*\""
       }
       execution_timeout_secs: 5400
       caches {
@@ -324,6 +335,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -353,6 +365,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"armeabi-v7a\",\"ANDROID_PLATFORM\":\"android-24\",\"CMAKE_BUILD_TYPE\":\"Release\",\"CMAKE_CXX_FLAGS\":\"-DOPENSSL_NO_STATIC_NEON_FOR_TESTING=1\",\"CMAKE_C_FLAGS\":\"-DOPENSSL_NO_STATIC_NEON_FOR_TESTING=1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 5400
       caches {
@@ -385,6 +398,7 @@
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"riscv64\",\"ANDROID_PLATFORM\":\"android-35\",\"CMAKE_BUILD_TYPE\":\"Release\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -418,6 +432,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -477,6 +492,7 @@
         properties_j: "cmake_args:{\"CMAKE_OSX_ARCHITECTURES\":\"arm64\",\"CMAKE_OSX_SYSROOT\":\"iphoneos\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -509,10 +525,12 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
+        properties_j: "check_prefixed_symbols:true"
         properties_j: "cmake_args:{\"CMAKE_OSX_ARCHITECTURES\":\"arm64\",\"CMAKE_OSX_SYSROOT\":\"iphoneos\"}"
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -548,6 +566,7 @@
         properties_j: "check_stack:true"
         properties_j: "cmake_args:{\"BORINGSSL_ALLOW_CXX_RUNTIME\":\"1\",\"RUST_BINDINGS\":\"x86_64-unknown-linux-gnu\"}"
         properties_j: "rust:true"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -578,6 +597,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "check_stack:true"
         properties_j: "cmake_args:{\"CMAKE_ASM_FLAGS\":\"-m32 -msse2\",\"CMAKE_CXX_FLAGS\":\"-m32 -msse2\",\"CMAKE_C_FLAGS\":\"-m32 -msse2\",\"CMAKE_SYSTEM_NAME\":\"Linux\",\"CMAKE_SYSTEM_PROCESSOR\":\"x86\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -607,6 +627,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"CMAKE_ASM_FLAGS\":\"-m32 -msse2\",\"CMAKE_CXX_FLAGS\":\"-m32 -msse2\",\"CMAKE_C_FLAGS\":\"-m32 -msse2\",\"CMAKE_SYSTEM_NAME\":\"Linux\",\"CMAKE_SYSTEM_PROCESSOR\":\"x86\",\"OPENSSL_NO_ASM\":\"1\",\"OPENSSL_NO_SSE2_FOR_TESTING\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -640,6 +661,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -669,6 +691,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"CMAKE_ASM_FLAGS\":\"-m32 -msse2\",\"CMAKE_BUILD_TYPE\":\"Release\",\"CMAKE_CXX_FLAGS\":\"-m32 -msse2\",\"CMAKE_C_FLAGS\":\"-m32 -msse2\",\"CMAKE_SYSTEM_NAME\":\"Linux\",\"CMAKE_SYSTEM_PROCESSOR\":\"x86\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -700,6 +723,7 @@
         properties_j: "cmake_args:{\"CMAKE_ASM_FLAGS\":\"-m32 -msse2\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"CMAKE_CXX_FLAGS\":\"-m32 -msse2\",\"CMAKE_C_FLAGS\":\"-m32 -msse2\",\"CMAKE_SYSTEM_NAME\":\"Linux\",\"CMAKE_SYSTEM_PROCESSOR\":\"x86\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "sde:true"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 10800
       caches {
@@ -758,6 +782,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"CFI\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -786,10 +811,12 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
+        properties_j: "check_prefixed_symbols:true"
         properties_j: "clang:true"
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -820,6 +847,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -851,6 +879,7 @@
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\",\"MSAN\":\"1\",\"USE_CUSTOM_LIBCXX\":\"1\"}"
         properties_j: "gclient_vars:{\"checkout_libcxx\":true}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -883,6 +912,7 @@
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\",\"TSAN\":\"1\",\"USE_CUSTOM_LIBCXX\":\"1\"}"
         properties_j: "gclient_vars:{\"checkout_libcxx\":true}"
         properties_j: "run_ssl_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -913,6 +943,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"UBSAN\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -942,6 +973,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -972,6 +1004,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1002,6 +1035,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\",\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1032,6 +1066,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"ASAN\":\"1\",\"FIPS\":\"1\",\"OPENSSL_NO_ASM\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1061,6 +1096,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\",\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1092,6 +1128,7 @@
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"FUZZ\":\"1\",\"LIBFUZZER_FROM_DEPS\":\"1\"}"
         properties_j: "gclient_vars:{\"checkout_fuzzer\":true}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1122,6 +1159,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"ASAN\":\"1\",\"OPENSSL_NO_ASM\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1151,6 +1189,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"OPENSSL_NO_ASM\":\"1\",\"OPENSSL_NO_SSE2_FOR_TESTING\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1183,6 +1222,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1212,6 +1252,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"CMAKE_CXX_FLAGS\":\"-DOPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED=1\",\"CMAKE_C_FLAGS\":\"-DOPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED=1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1246,6 +1287,7 @@
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
         properties_j: "rust:true"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1275,6 +1317,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1306,6 +1349,7 @@
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "sde:true"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 10800
       caches {
@@ -1335,6 +1379,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"BUILD_SHARED_LIBS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"**/lib*.so*\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1364,6 +1409,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"CMAKE_CXX_FLAGS\":\"-DOPENSSL_SMALL=1\",\"CMAKE_C_FLAGS\":\"-DOPENSSL_SMALL=1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1394,6 +1440,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"RUST_BINDINGS\":\"x86_64-apple-darwin\"}"
         properties_j: "rust:true"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -1428,6 +1475,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"CMAKE_EXE_LINKER_FLAGS\":\"-Wl,-dead_strip\",\"CMAKE_SHARED_LINKER_FLAGS\":\"-Wl,-dead_strip\",\"RUST_BINDINGS\":\"aarch64-apple-darwin\"}"
         properties_j: "rust:true"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -1495,6 +1543,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -1527,9 +1576,11 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
+        properties_j: "check_prefixed_symbols:true"
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -1563,6 +1614,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\",\"CMAKE_EXE_LINKER_FLAGS\":\"-Wl,-dead_strip\",\"CMAKE_SHARED_LINKER_FLAGS\":\"-Wl,-dead_strip\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -1596,6 +1648,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"CMAKE_CXX_FLAGS\":\"-DOPENSSL_SMALL=1\",\"CMAKE_C_FLAGS\":\"-DOPENSSL_SMALL=1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -1629,6 +1682,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "msvc_target:\"x86\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1660,6 +1714,7 @@
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"CMAKE_ASM_FLAGS\":\"-m32 -msse2\",\"CMAKE_CXX_FLAGS\":\"-m32 -msse2\",\"CMAKE_C_FLAGS\":\"-m32 -msse2\",\"CMAKE_SYSTEM_NAME\":\"Windows\",\"CMAKE_SYSTEM_PROCESSOR\":\"x86\"}"
         properties_j: "msvc_target:\"x86\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1694,6 +1749,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1726,6 +1782,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1756,6 +1813,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\"}"
         properties_j: "msvc_target:\"x86\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1788,6 +1846,7 @@
         properties_j: "msvc_target:\"x86\""
         properties_j: "run_ssl_tests:false"
         properties_j: "sde:true"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 10800
       caches {
@@ -1818,6 +1877,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"BUILD_SHARED_LIBS\":\"1\"}"
         properties_j: "msvc_target:\"x86\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"**/*.dll\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1849,6 +1909,7 @@
         properties_j: "cmake_args:{\"BUILD_SHARED_LIBS\":\"1\"}"
         properties_j: "msvc_target:\"x86\""
         properties_j: "prefixed_symbols:true"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"**/*.dll\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1879,6 +1940,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"CMAKE_CXX_FLAGS\":\"/DWIN32 /D_WINDOWS /EHsc /DOPENSSL_SMALL=1\",\"CMAKE_C_FLAGS\":\"/DWIN32 /D_WINDOWS /DOPENSSL_SMALL=1\"}"
         properties_j: "msvc_target:\"x86\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1909,6 +1971,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "gclient_vars:{\"windows_sdk_version\":\"uploaded:2024-01-11\"}"
         properties_j: "msvc_target:\"x86\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1938,6 +2001,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "msvc_target:\"x64\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -1968,6 +2032,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "clang:true"
         properties_j: "msvc_target:\"x64\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -2001,6 +2066,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -2033,6 +2099,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -2064,6 +2131,7 @@
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\",\"RUST_BINDINGS\":\"x86_64-pc-windows-msvc\"}"
         properties_j: "msvc_target:\"x64\""
         properties_j: "rust:true"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -2096,6 +2164,7 @@
         properties_j: "msvc_target:\"x64\""
         properties_j: "run_ssl_tests:false"
         properties_j: "sde:true"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 10800
       caches {
@@ -2126,6 +2195,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"BUILD_SHARED_LIBS\":\"1\"}"
         properties_j: "msvc_target:\"x64\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"**/*.dll\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -2157,6 +2227,7 @@
         properties_j: "cmake_args:{\"BUILD_SHARED_LIBS\":\"1\"}"
         properties_j: "msvc_target:\"x64\""
         properties_j: "prefixed_symbols:true"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"**/*.dll\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -2187,6 +2258,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "cmake_args:{\"CMAKE_CXX_FLAGS\":\"/DWIN32 /D_WINDOWS /EHsc /DOPENSSL_SMALL=1\",\"CMAKE_C_FLAGS\":\"/DWIN32 /D_WINDOWS /DOPENSSL_SMALL=1\"}"
         properties_j: "msvc_target:\"x64\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -2217,6 +2289,7 @@
         properties_j: "$gatekeeper:{\"group\":\"client.boringssl\"}"
         properties_j: "gclient_vars:{\"windows_sdk_version\":\"uploaded:2024-01-11\"}"
         properties_j: "msvc_target:\"x64\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -2251,6 +2324,7 @@
         properties_j: "msvc_target:\"arm64\""
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -2284,6 +2358,7 @@
         properties_j: "msvc_target:\"arm64\""
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -2318,6 +2393,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -2353,6 +2429,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       caches {
@@ -2417,6 +2494,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 5400
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2435,6 +2513,7 @@
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2450,6 +2529,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\",\"BUILD_SHARED_LIBS\":\"1\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"FIPS\":\"1\",\"OPENSSL_NO_ASM\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"**/lib*.so*\""
       }
       execution_timeout_secs: 5400
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2468,6 +2548,7 @@
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\",\"BUILD_SHARED_LIBS\":\"1\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"FIPS\":\"1\",\"OPENSSL_NO_ASM\":\"1\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"**/lib*.so*\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2483,6 +2564,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\",\"BUILD_SHARED_LIBS\":\"1\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"**/lib*.so*\""
       }
       execution_timeout_secs: 5400
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2501,6 +2583,7 @@
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\",\"BUILD_SHARED_LIBS\":\"1\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"FIPS\":\"1\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"**/lib*.so*\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2516,6 +2599,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 5400
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2534,6 +2618,7 @@
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"FIPS\":\"1\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2549,10 +2634,12 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "android:true"
+        properties_j: "check_prefixed_symbols:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\"}"
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2568,6 +2655,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\",\"CMAKE_BUILD_TYPE\":\"Release\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 5400
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2586,6 +2674,7 @@
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"arm64-v8a\",\"ANDROID_PLATFORM\":\"android-24\",\"CMAKE_BUILD_TYPE\":\"Release\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2601,6 +2690,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"armeabi-v7a\",\"ANDROID_PLATFORM\":\"android-24\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 5400
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2620,6 +2710,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2635,6 +2726,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"armeabi-v7a\",\"ANDROID_ARM_MODE\":\"arm\",\"ANDROID_PLATFORM\":\"android-24\",\"CMAKE_BUILD_TYPE\":\"Release\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 5400
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2653,6 +2745,7 @@
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"armeabi-v7a\",\"ANDROID_ARM_MODE\":\"arm\",\"ANDROID_PLATFORM\":\"android-24\",\"CMAKE_BUILD_TYPE\":\"Release\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2671,6 +2764,7 @@
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"armeabi-v7a\",\"ANDROID_PLATFORM\":\"android-24\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2686,6 +2780,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"armeabi-v7a\",\"ANDROID_PLATFORM\":\"android-24\",\"BUILD_SHARED_LIBS\":\"1\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"**/lib*.so*\""
       }
       execution_timeout_secs: 5400
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2704,6 +2799,7 @@
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"armeabi-v7a\",\"ANDROID_PLATFORM\":\"android-24\",\"BUILD_SHARED_LIBS\":\"1\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"FIPS\":\"1\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"**/lib*.so*\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2723,6 +2819,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2738,6 +2835,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "android:true"
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"armeabi-v7a\",\"ANDROID_PLATFORM\":\"android-24\",\"CMAKE_BUILD_TYPE\":\"Release\",\"CMAKE_CXX_FLAGS\":\"-DOPENSSL_NO_STATIC_NEON_FOR_TESTING=1\",\"CMAKE_C_FLAGS\":\"-DOPENSSL_NO_STATIC_NEON_FOR_TESTING=1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 5400
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2756,6 +2854,7 @@
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"armeabi-v7a\",\"ANDROID_PLATFORM\":\"android-24\",\"CMAKE_BUILD_TYPE\":\"Release\",\"CMAKE_CXX_FLAGS\":\"-DOPENSSL_NO_STATIC_NEON_FOR_TESTING=1\",\"CMAKE_C_FLAGS\":\"-DOPENSSL_NO_STATIC_NEON_FOR_TESTING=1\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2774,6 +2873,7 @@
         properties_j: "cmake_args:{\"ANDROID_ABI\":\"riscv64\",\"ANDROID_PLATFORM\":\"android-35\",\"CMAKE_BUILD_TYPE\":\"Release\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2793,6 +2893,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2824,6 +2925,7 @@
         properties_j: "cmake_args:{\"CMAKE_OSX_ARCHITECTURES\":\"arm64\",\"CMAKE_OSX_SYSROOT\":\"iphoneos\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -2842,10 +2944,12 @@
         name: "boringssl"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
+        properties_j: "check_prefixed_symbols:true"
         properties_j: "cmake_args:{\"CMAKE_OSX_ARCHITECTURES\":\"arm64\",\"CMAKE_OSX_SYSROOT\":\"iphoneos\"}"
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -2867,6 +2971,7 @@
         properties_j: "check_stack:true"
         properties_j: "cmake_args:{\"BORINGSSL_ALLOW_CXX_RUNTIME\":\"1\",\"RUST_BINDINGS\":\"x86_64-unknown-linux-gnu\"}"
         properties_j: "rust:true"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2883,6 +2988,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "check_stack:true"
         properties_j: "cmake_args:{\"CMAKE_ASM_FLAGS\":\"-m32 -msse2\",\"CMAKE_CXX_FLAGS\":\"-m32 -msse2\",\"CMAKE_C_FLAGS\":\"-m32 -msse2\",\"CMAKE_SYSTEM_NAME\":\"Linux\",\"CMAKE_SYSTEM_PROCESSOR\":\"x86\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2898,6 +3004,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"CMAKE_ASM_FLAGS\":\"-m32 -msse2\",\"CMAKE_CXX_FLAGS\":\"-m32 -msse2\",\"CMAKE_C_FLAGS\":\"-m32 -msse2\",\"CMAKE_SYSTEM_NAME\":\"Linux\",\"CMAKE_SYSTEM_PROCESSOR\":\"x86\",\"OPENSSL_NO_ASM\":\"1\",\"OPENSSL_NO_SSE2_FOR_TESTING\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2917,6 +3024,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2932,6 +3040,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"CMAKE_ASM_FLAGS\":\"-m32 -msse2\",\"CMAKE_BUILD_TYPE\":\"Release\",\"CMAKE_CXX_FLAGS\":\"-m32 -msse2\",\"CMAKE_C_FLAGS\":\"-m32 -msse2\",\"CMAKE_SYSTEM_NAME\":\"Linux\",\"CMAKE_SYSTEM_PROCESSOR\":\"x86\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2949,6 +3058,7 @@
         properties_j: "cmake_args:{\"CMAKE_ASM_FLAGS\":\"-m32 -msse2\",\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"CMAKE_CXX_FLAGS\":\"-m32 -msse2\",\"CMAKE_C_FLAGS\":\"-m32 -msse2\",\"CMAKE_SYSTEM_NAME\":\"Linux\",\"CMAKE_SYSTEM_PROCESSOR\":\"x86\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "sde:true"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 10800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2979,6 +3089,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"CFI\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -2993,10 +3104,12 @@
         name: "boringssl"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
+        properties_j: "check_prefixed_symbols:true"
         properties_j: "clang:true"
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3013,6 +3126,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3030,6 +3144,7 @@
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\",\"MSAN\":\"1\",\"USE_CUSTOM_LIBCXX\":\"1\"}"
         properties_j: "gclient_vars:{\"checkout_libcxx\":true}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3048,6 +3163,7 @@
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\",\"TSAN\":\"1\",\"USE_CUSTOM_LIBCXX\":\"1\"}"
         properties_j: "gclient_vars:{\"checkout_libcxx\":true}"
         properties_j: "run_ssl_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3064,6 +3180,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\",\"UBSAN\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3079,6 +3196,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3095,6 +3213,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3111,6 +3230,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\",\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3127,6 +3247,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"ASAN\":\"1\",\"FIPS\":\"1\",\"OPENSSL_NO_ASM\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3142,6 +3263,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\",\"FIPS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3159,6 +3281,7 @@
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"FUZZ\":\"1\",\"LIBFUZZER_FROM_DEPS\":\"1\"}"
         properties_j: "gclient_vars:{\"checkout_fuzzer\":true}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3175,6 +3298,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"ASAN\":\"1\",\"OPENSSL_NO_ASM\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3190,6 +3314,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"OPENSSL_NO_ASM\":\"1\",\"OPENSSL_NO_SSE2_FOR_TESTING\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3208,6 +3333,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3223,6 +3349,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"CMAKE_CXX_FLAGS\":\"-DOPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED=1\",\"CMAKE_C_FLAGS\":\"-DOPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED=1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3243,6 +3370,7 @@
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
         properties_j: "rust:true"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3258,6 +3386,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3275,6 +3404,7 @@
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"RelWithAsserts\"}"
         properties_j: "run_ssl_tests:false"
         properties_j: "sde:true"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 10800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3290,6 +3420,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"BUILD_SHARED_LIBS\":\"1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"**/lib*.so*\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3305,6 +3436,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"CMAKE_CXX_FLAGS\":\"-DOPENSSL_SMALL=1\",\"CMAKE_C_FLAGS\":\"-DOPENSSL_SMALL=1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3321,6 +3453,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"RUST_BINDINGS\":\"x86_64-apple-darwin\"}"
         properties_j: "rust:true"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -3341,6 +3474,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"CMAKE_EXE_LINKER_FLAGS\":\"-Wl,-dead_strip\",\"CMAKE_SHARED_LINKER_FLAGS\":\"-Wl,-dead_strip\",\"RUST_BINDINGS\":\"aarch64-apple-darwin\"}"
         properties_j: "rust:true"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -3380,6 +3514,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -3398,9 +3533,11 @@
         name: "boringssl"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
+        properties_j: "check_prefixed_symbols:true"
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -3420,6 +3557,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\",\"CMAKE_EXE_LINKER_FLAGS\":\"-Wl,-dead_strip\",\"CMAKE_SHARED_LINKER_FLAGS\":\"-Wl,-dead_strip\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -3439,6 +3577,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"CMAKE_CXX_FLAGS\":\"-DOPENSSL_SMALL=1\",\"CMAKE_C_FLAGS\":\"-DOPENSSL_SMALL=1\"}"
+        properties_j: "upload_to_cas:\"*_bench\",\"*_test\",\"bssl\",\"generate_*\",\"jitter_deltas\",\"ssl/test/bssl_shim\",\"test_*\",\"libcrypto.a\",\"libdecrepit.a\",\"libpki.a\",\"libssl.a\""
       }
       execution_timeout_secs: 3600
       caches {
@@ -3473,6 +3612,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "msvc_target:\"x86\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3490,6 +3630,7 @@
         properties_j: "clang:true"
         properties_j: "cmake_args:{\"CMAKE_ASM_FLAGS\":\"-m32 -msse2\",\"CMAKE_CXX_FLAGS\":\"-m32 -msse2\",\"CMAKE_C_FLAGS\":\"-m32 -msse2\",\"CMAKE_SYSTEM_NAME\":\"Windows\",\"CMAKE_SYSTEM_PROCESSOR\":\"x86\"}"
         properties_j: "msvc_target:\"x86\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3509,6 +3650,7 @@
         properties_j: "msvc_target:\"x86\""
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3529,6 +3671,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3546,6 +3689,7 @@
         properties_j: "msvc_target:\"x86\""
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3564,6 +3708,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3580,6 +3725,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\"}"
         properties_j: "msvc_target:\"x86\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3598,6 +3744,7 @@
         properties_j: "msvc_target:\"x86\""
         properties_j: "run_ssl_tests:false"
         properties_j: "sde:true"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 10800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3614,6 +3761,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"BUILD_SHARED_LIBS\":\"1\"}"
         properties_j: "msvc_target:\"x86\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"**/*.dll\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3632,6 +3780,7 @@
         properties_j: "msvc_target:\"x86\""
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"**/*.dll\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3649,6 +3798,7 @@
         properties_j: "cmake_args:{\"BUILD_SHARED_LIBS\":\"1\"}"
         properties_j: "msvc_target:\"x86\""
         properties_j: "prefixed_symbols:true"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"**/*.dll\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3668,6 +3818,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"**/*.dll\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3684,6 +3835,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"CMAKE_CXX_FLAGS\":\"/DWIN32 /D_WINDOWS /EHsc /DOPENSSL_SMALL=1\",\"CMAKE_C_FLAGS\":\"/DWIN32 /D_WINDOWS /DOPENSSL_SMALL=1\"}"
         properties_j: "msvc_target:\"x86\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3700,6 +3852,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "gclient_vars:{\"windows_sdk_version\":\"uploaded:2024-01-11\"}"
         properties_j: "msvc_target:\"x86\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3715,6 +3868,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/main"
         properties_j: "msvc_target:\"x64\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3731,6 +3885,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "clang:true"
         properties_j: "msvc_target:\"x64\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3749,6 +3904,7 @@
         properties_j: "msvc_target:\"x64\""
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3768,6 +3924,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3785,6 +3942,7 @@
         properties_j: "msvc_target:\"x64\""
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3803,6 +3961,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3820,6 +3979,7 @@
         properties_j: "cmake_args:{\"CMAKE_BUILD_TYPE\":\"Release\",\"RUST_BINDINGS\":\"x86_64-pc-windows-msvc\"}"
         properties_j: "msvc_target:\"x64\""
         properties_j: "rust:true"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3838,6 +3998,7 @@
         properties_j: "msvc_target:\"x64\""
         properties_j: "run_ssl_tests:false"
         properties_j: "sde:true"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 10800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3854,6 +4015,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"BUILD_SHARED_LIBS\":\"1\"}"
         properties_j: "msvc_target:\"x64\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"**/*.dll\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3872,6 +4034,7 @@
         properties_j: "msvc_target:\"x64\""
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"**/*.dll\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3889,6 +4052,7 @@
         properties_j: "cmake_args:{\"BUILD_SHARED_LIBS\":\"1\"}"
         properties_j: "msvc_target:\"x64\""
         properties_j: "prefixed_symbols:true"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"**/*.dll\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3908,6 +4072,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"**/*.dll\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3924,6 +4089,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "cmake_args:{\"CMAKE_CXX_FLAGS\":\"/DWIN32 /D_WINDOWS /EHsc /DOPENSSL_SMALL=1\",\"CMAKE_C_FLAGS\":\"/DWIN32 /D_WINDOWS /DOPENSSL_SMALL=1\"}"
         properties_j: "msvc_target:\"x64\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3940,6 +4106,7 @@
         cipd_version: "refs/heads/main"
         properties_j: "gclient_vars:{\"windows_sdk_version\":\"uploaded:2024-01-11\"}"
         properties_j: "msvc_target:\"x64\""
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3960,6 +4127,7 @@
         properties_j: "msvc_target:\"arm64\""
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3979,6 +4147,7 @@
         properties_j: "msvc_target:\"arm64\""
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -3999,6 +4168,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"
@@ -4020,6 +4190,7 @@
         properties_j: "prefixed_symbols:true"
         properties_j: "run_ssl_tests:false"
         properties_j: "run_unit_tests:false"
+        properties_j: "upload_to_cas:\"*_bench.exe\",\"*_test.exe\",\"bssl.exe\",\"generate_*.exe\",\"jitter_deltas.exe\",\"ssl/test/bssl_shim.exe\",\"test_*.exe\",\"crypto.lib\",\"decrepit.lib\",\"pki.lib\",\"ssl.lib\""
       }
       execution_timeout_secs: 1800
       service_account: "boringssl-try-builder@chops-service-accounts.iam.gserviceaccount.com"

boringssl-0.20260708.tar.xz/infra/config/main.star -> boringssl-0.20260813.tar.xz/infra/config/main.star Changed

@@ -617,6 +617,51 @@
 # SDE tests take longer to run.
 SDE_TIMEOUT = 3 * 60 * time.minute
 
+def finished_output_files(exe_suffix, lib_prefix, lib_suffix):
+    """Calculates the list of patterns for useful finished output files.
+
+    Args:
+      exe_suffix: the file suffix of executables (with period if any).
+      lib_prefix: the file prefix of libraries.
+      lib_suffix: the file suffix of libraries (with period if any).
+
+    Returns:
+      A list of wildcard patterns for all files to return.
+    """
+    is_static = lib_suffix in ("a", "lib")
+    outputs = 
+    for name in 
+        "*_bench",
+        "*_test",
+        "bssl",
+        "generate_*",
+        "jitter_deltas",
+        "ssl/test/bssl_shim",
+        "test_*",
+    :
+        outputs.append("{0}{1}".format(name, exe_suffix))
+    if lib_suffix in (".a", ".lib"):
+        # When building static libs, only export the actually interesting ones.
+        for name in 
+            "crypto",
+            "decrepit",
+            "pki",
+            "ssl",
+        :
+            outputs.append("{1}{0}{2}".format(name, lib_prefix, lib_suffix))
+    else:
+        # When building dynamic libs, export all, as they are required for
+        # running the binaries.
+        outputs.append("**/{0}*{1}".format(lib_prefix, lib_suffix))
+    return outputs
+
+FINISHED_OUTPUT_FILES_LINUX_STATIC = finished_output_files("", "lib", ".a")
+FINISHED_OUTPUT_FILES_LINUX_SHARED = finished_output_files("", "lib", ".so*")
+FINISHED_OUTPUT_FILES_WIN_STATIC = finished_output_files(".exe", "", ".lib")
+FINISHED_OUTPUT_FILES_WIN_SHARED = finished_output_files(".exe", "", ".dll")
+FINISHED_OUTPUT_FILES_MAC_STATIC = finished_output_files("", "lib", ".a")
+FINISHED_OUTPUT_FILES_MAC_SHARED = finished_output_files("", "lib", ".dylib")
+
 # TODO(davidben): Switch the BoringSSL recipe to specify most flags in
 # properties rather than parsing names. Then we can add new configurations
 # without having to touch multiple repositories.
@@ -642,6 +687,7 @@
             "ANDROID_ABI": "arm64-v8a",
             "ANDROID_PLATFORM": "android-24",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -656,6 +702,7 @@
             "ANDROID_PLATFORM": "android-24",
             "CMAKE_BUILD_TYPE": "Release",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -673,6 +720,7 @@
             "CMAKE_BUILD_TYPE": "RelWithAsserts",
             "FIPS": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_SHARED,
     },
 )
 
@@ -692,6 +740,7 @@
             "CMAKE_BUILD_TYPE": "RelWithAsserts",
             "FIPS": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_SHARED,
     },
 )
 
@@ -711,6 +760,7 @@
             "CMAKE_BUILD_TYPE": "RelWithAsserts",
             "FIPS": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 
@@ -727,6 +777,8 @@
             "ANDROID_PLATFORM": "android-24",
         },
         "prefixed_symbols": True,
+        "check_prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     }),
 )
 
@@ -740,6 +792,7 @@
             "ANDROID_ABI": "armeabi-v7a",
             "ANDROID_PLATFORM": "android-24",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -760,6 +813,7 @@
             "CMAKE_C_FLAGS": "-DOPENSSL_NO_STATIC_NEON_FOR_TESTING=1",
             "CMAKE_CXX_FLAGS": "-DOPENSSL_NO_STATIC_NEON_FOR_TESTING=1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -777,6 +831,7 @@
             "CMAKE_BUILD_TYPE": "RelWithAsserts",
             "FIPS": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_SHARED,
     },
 )
 both_builders(
@@ -789,6 +844,7 @@
             "ANDROID_PLATFORM": "android-24",
         },
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     }),
 )
 
@@ -804,6 +860,7 @@
             "ANDROID_PLATFORM": "android-24",
             "CMAKE_BUILD_TYPE": "Release",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -817,6 +874,7 @@
             "ANDROID_PLATFORM": "android-24",
         },
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     }),
 )
 both_builders(
@@ -829,6 +887,7 @@
             "ANDROID_PLATFORM": "android-35",
             "CMAKE_BUILD_TYPE": "Release",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     }),
 )
 both_builders(
@@ -842,6 +901,7 @@
             "ANDROID_PLATFORM": "android-24",
         },
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     }),
 )
 
@@ -864,6 +924,7 @@
             "CMAKE_OSX_ARCHITECTURES": "arm64",
             "CMAKE_OSX_SYSROOT": "iphoneos",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_MAC_STATIC,
     }),
 )
 both_builders(
@@ -878,6 +939,8 @@
             "CMAKE_OSX_SYSROOT": "iphoneos",
         },
         "prefixed_symbols": True,
+        "check_prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_MAC_STATIC,
     }),
 )
 
@@ -894,6 +957,7 @@
         },
         # Also build and test the Rust code.
         "rust": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -903,6 +967,7 @@
         "cmake_args": {
             "CMAKE_BUILD_TYPE": "Release",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -916,6 +981,7 @@
         "prefixed_symbols": True,
         # Also build and test the Rust code.
         "rust": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     }),
 )
 both_builders(
@@ -931,6 +997,7 @@
             "CMAKE_CXX_FLAGS": "-m32 -msse2",
             "CMAKE_C_FLAGS": "-m32 -msse2",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -946,6 +1013,7 @@
             "CMAKE_C_FLAGS": "-m32 -msse2",
             "CMAKE_CXX_FLAGS": "-m32 -msse2",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -965,6 +1033,7 @@
         },
         "run_ssl_tests": False,
         "sde": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -981,6 +1050,7 @@
             "CMAKE_C_FLAGS": "-m32 -msse2",
             "CMAKE_CXX_FLAGS": "-m32 -msse2",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -997,6 +1067,7 @@
             "CMAKE_C_FLAGS": "-m32 -msse2",
         },
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     }),
 )
 both_builders(
@@ -1008,6 +1079,7 @@
         "cmake_args": {
             "CFI": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1018,6 +1090,7 @@
         "cmake_args": {
             "CMAKE_BUILD_TYPE": "Release",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1034,6 +1107,7 @@
         "gclient_vars": {
             "checkout_libcxx": True,
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1054,6 +1128,7 @@
         # SSL tests are all single-threaded, so running them under TSan is a
         # waste of time.
         "run_ssl_tests": False,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1066,6 +1141,7 @@
             "CMAKE_BUILD_TYPE": "RelWithAsserts",
             "UBSAN": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1075,6 +1151,7 @@
         "cmake_args": {
             "FIPS": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1085,6 +1162,7 @@
             "CMAKE_BUILD_TYPE": "Release",
             "FIPS": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1095,6 +1173,7 @@
         "cmake_args": {
             "FIPS": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1106,6 +1185,7 @@
             "CMAKE_BUILD_TYPE": "Release",
             "FIPS": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1118,6 +1198,7 @@
             "FIPS": "1",
             "OPENSSL_NO_ASM": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1132,6 +1213,7 @@
         "gclient_vars": {
             "checkout_fuzzer": True,
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1143,6 +1225,7 @@
             "ASAN": "1",
             "OPENSSL_NO_ASM": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1154,6 +1237,8 @@
     properties = compile_only({
         "clang": True,
         "prefixed_symbols": True,
+        "check_prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     }),
 )
 
@@ -1165,6 +1250,7 @@
             "CMAKE_C_FLAGS": "-DOPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED=1",
             "CMAKE_CXX_FLAGS": "-DOPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED=1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1178,6 +1264,7 @@
         },
         "run_ssl_tests": False,
         "sde": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1187,6 +1274,7 @@
         "cmake_args": {
             "BUILD_SHARED_LIBS": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_SHARED,
     },
 )
 both_builders(
@@ -1197,6 +1285,7 @@
             "CMAKE_C_FLAGS": "-DOPENSSL_SMALL=1",
             "CMAKE_CXX_FLAGS": "-DOPENSSL_SMALL=1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1207,6 +1296,7 @@
             "OPENSSL_NO_ASM": "1",
             "OPENSSL_NO_SSE2_FOR_TESTING": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     },
 )
 both_builders(
@@ -1218,6 +1308,7 @@
             "OPENSSL_NO_SSE2_FOR_TESTING": "1",
         },
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_LINUX_STATIC,
     }),
 )
 
@@ -1236,6 +1327,7 @@
         },
         # Also build and test the Rust code.
         "rust": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_MAC_STATIC,
     },
 )
 both_builders(
@@ -1247,6 +1339,7 @@
             "CMAKE_EXE_LINKER_FLAGS": "-Wl,-dead_strip",
             "CMAKE_SHARED_LINKER_FLAGS": "-Wl,-dead_strip",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_MAC_STATIC,
     },
 )
 both_builders(
@@ -1257,6 +1350,7 @@
             "CMAKE_C_FLAGS": "-DOPENSSL_SMALL=1",
             "CMAKE_CXX_FLAGS": "-DOPENSSL_SMALL=1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_MAC_STATIC,
     },
 )
 both_builders(
@@ -1267,6 +1361,8 @@
     cq_enabled = False,
     properties = compile_only({
         "prefixed_symbols": True,
+        "check_prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_MAC_STATIC,
     }),
 )
 both_builders(
@@ -1280,6 +1376,7 @@
         },
         # Also build and test the Rust code.
         "rust": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_MAC_STATIC,
     },
 )
 both_builders(
@@ -1287,6 +1384,7 @@
     MAC_ARM64_HOST,
     properties = compile_only({
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_MAC_STATIC,
     }),
 )
 both_builders(
@@ -1301,6 +1399,7 @@
     cq_compile_only = WIN_HOST,  # Reduce CQ cycle times.
     properties = {
         "msvc_target": "x86",
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     },
 )
 
@@ -1314,6 +1413,7 @@
         "gclient_vars": {
             "windows_sdk_version": "uploaded:2024-01-11",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     },
 )
 both_builders(
@@ -1324,6 +1424,7 @@
             "CMAKE_BUILD_TYPE": "Release",
         },
         "msvc_target": "x86",
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     },
 )
 both_builders(
@@ -1338,6 +1439,7 @@
         "msvc_target": "x86",
         "run_ssl_tests": False,
         "sde": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     },
 )
 both_builders(
@@ -1346,6 +1448,7 @@
     properties = compile_only({
         "msvc_target": "x86",
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     }),
 )
 both_builders(
@@ -1357,6 +1460,7 @@
         "cmake_args": {
             "BUILD_SHARED_LIBS": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_SHARED,
     },
 )
 both_builders(
@@ -1369,6 +1473,7 @@
             "BUILD_SHARED_LIBS": "1",
         },
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_SHARED,
     },
 )
 both_builders(
@@ -1384,6 +1489,7 @@
             "CMAKE_CXX_FLAGS": "/DWIN32 /D_WINDOWS /EHsc /DOPENSSL_SMALL=1",
         },
         "msvc_target": "x86",
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     },
 )
 
@@ -1403,6 +1509,7 @@
             "CMAKE_C_FLAGS": "-m32 -msse2",
             "CMAKE_CXX_FLAGS": "-m32 -msse2",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     },
 )
 both_builders(
@@ -1421,6 +1528,7 @@
             "CMAKE_CXX_FLAGS": "-m32 -msse2",
         },
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     }),
 )
 
@@ -1430,6 +1538,7 @@
     cq_compile_only = WIN_HOST,  # Reduce CQ cycle times.
     properties = {
         "msvc_target": "x64",
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     },
 )
 
@@ -1443,6 +1552,7 @@
         "gclient_vars": {
             "windows_sdk_version": "uploaded:2024-01-11",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     },
 )
 
@@ -1457,6 +1567,7 @@
         "msvc_target": "x64",
         # Also build and test the Rust code.
         "rust": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     },
 )
 both_builders(
@@ -1471,6 +1582,7 @@
         "msvc_target": "x64",
         "run_ssl_tests": False,
         "sde": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     },
 )
 both_builders(
@@ -1479,6 +1591,7 @@
     properties = compile_only({
         "msvc_target": "x64",
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     }),
 )
 both_builders(
@@ -1490,6 +1603,7 @@
         "cmake_args": {
             "BUILD_SHARED_LIBS": "1",
         },
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_SHARED,
     },
 )
 both_builders(
@@ -1502,6 +1616,7 @@
             "BUILD_SHARED_LIBS": "1",
         },
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_SHARED,
     },
 )
 both_builders(
@@ -1517,6 +1632,7 @@
             "CMAKE_CXX_FLAGS": "/DWIN32 /D_WINDOWS /EHsc /DOPENSSL_SMALL=1",
         },
         "msvc_target": "x64",
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     },
 )
 
@@ -1527,6 +1643,7 @@
     properties = {
         "clang": True,
         "msvc_target": "x64",
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     },
 )
 both_builders(
@@ -1536,6 +1653,7 @@
         "clang": True,
         "msvc_target": "x64",
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     }),
 )
 
@@ -1557,6 +1675,7 @@
             "checkout_nasm": False,
         },
         "msvc_target": "arm64",
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     }),
 )
 both_builders(
@@ -1578,6 +1697,7 @@
         },
         "msvc_target": "arm64",
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     }),
 )
 
@@ -1597,6 +1717,7 @@
             "checkout_nasm": False,
         },
         "msvc_target": "arm64",
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     }),
 )
 both_builders(
@@ -1616,5 +1737,6 @@
         },
         "msvc_target": "arm64",
         "prefixed_symbols": True,
+        "upload_to_cas": FINISHED_OUTPUT_FILES_WIN_STATIC,
     }),
 )

boringssl-0.20260708.tar.xz/pki/certificate.cc -> boringssl-0.20260813.tar.xz/pki/certificate.cc Changed

@@ -31,20 +31,9 @@
 std::shared_ptr<const bssl::ParsedCertificate> ParseCertificateFromDer(
     bssl::Span<const uint8_t>cert, std::string *out_diagnostic) {
   bssl::ParseCertificateOptions default_options{};
-  // We follow Chromium in setting `allow_invalid_serial_numbers` in order to
-  // not choke on 21-byte serial numbers, which are common.  davidben explains
-  // why:
-  //
-  // The reason for the discrepancy is that unsigned numbers with the high bit
-  // otherwise set get an extra 0 byte in front to keep them positive. So if you
-  // do:
-  //    var num 20byte
-  //    fillWithRandom(num:)
-  //    serialNumber := new(big.Int).SetBytes(num:)
-  //    encodeASN1Integer(serialNumber)
-  //
-  // Then half of your serial numbers will be encoded with 21 bytes. (And
-  // 1/512th will have 19 bytes instead of 20.)
+  // TODO(crbug.com/533048005): Remove this option. It now only controls serials
+  // that aren't even valid integers. Historically, people needed to set it to
+  // tolerate length over 20, but this is now always enabled.
   default_options.allow_invalid_serial_numbers = true;
 
   bssl::UniquePtr<CRYPTO_BUFFER> buffer(

boringssl-0.20260708.tar.xz/pki/crl.cc -> boringssl-0.20260813.tar.xz/pki/crl.cc Changed

boringssl-0.20260708.tar.xz/pki/ocsp.cc -> boringssl-0.20260813.tar.xz/pki/ocsp.cc Changed

@@ -75,11 +75,9 @@
   if (!parser.ReadTag(CBS_ASN1_INTEGER, &out->serial_number)) {
     return false;
   }
-  CertErrors errors;
-  if (!VerifySerialNumber(out->serial_number, false /*warnings_only*/,
-                          &errors)) {
-    return false;
-  }
+  // TODO(crbug.com/533048005): We do not check `out->serial_number` is a valid
+  // INTEGER because our certificate serial parser does not yet check for valid
+  // INTEGERs. This ensures those non-integers can be represented in OCSP.
 
   return !parser.HasMore();
 }
@@ -601,7 +599,7 @@
 // would either pass in the parsed bits, or have a better abstraction for lazily
 // parsing.
 std::shared_ptr<const ParsedCertificate> OCSPParseCertificate(
-    std::string_view der) {
+    Span<const uint8_t> der) {
   ParseCertificateOptions parse_options;
   parse_options.allow_invalid_serial_numbers = true;
 
@@ -613,9 +611,9 @@
   // parsing model.
   CertErrors errors;
   return ParsedCertificate::Create(
-      bssl::UniquePtr<CRYPTO_BUFFER>(CRYPTO_BUFFER_new(
-          reinterpret_cast<const uint8_t *>(der.data()), der.size(), nullptr)),
-      {}, &errors);
+      bssl::UniquePtr<CRYPTO_BUFFER>(
+          CRYPTO_BUFFER_new(der.data(), der.size(), nullptr)),
+      parse_options, &errors);
 }
 
 // Checks that the ResponderID `id` matches the certificate `cert` either
@@ -716,7 +714,7 @@
   //  (3) Has signed the OCSP response using its public key.
   for (const auto &responder_cert_tlv : response.certs) {
     std::shared_ptr<const ParsedCertificate> cur_responder_certificate =
-        OCSPParseCertificate(BytesAsStringView(responder_cert_tlv));
+        OCSPParseCertificate(responder_cert_tlv);
 
     // If failed parsing the certificate, keep looking.
     if (!cur_responder_certificate) {
@@ -936,11 +934,12 @@
   std::shared_ptr<const ParsedCertificate> parsed_certificate;
   std::shared_ptr<const ParsedCertificate> parsed_issuer_certificate;
   if (!certificate) {
-    parsed_certificate = OCSPParseCertificate(certificate_der);
+    parsed_certificate = OCSPParseCertificate(StringAsBytes(certificate_der));
     certificate = parsed_certificate.get();
   }
   if (!issuer_certificate) {
-    parsed_issuer_certificate = OCSPParseCertificate(issuer_certificate_der);
+    parsed_issuer_certificate =
+        OCSPParseCertificate(StringAsBytes(issuer_certificate_der));
     issuer_certificate = parsed_issuer_certificate.get();
   }

boringssl-0.20260708.tar.xz/pki/ocsp_unittest.cc -> boringssl-0.20260813.tar.xz/pki/ocsp_unittest.cc Changed

@@ -21,6 +21,7 @@
 #include <openssl/span.h>
 
 #include "encode_values.h"
+#include "parsed_certificate.h"
 #include "string_util.h"
 #include "test_helpers.h"
 
@@ -38,10 +39,14 @@
     std::string_view data) {
   CertErrors errors;
   auto bytes = StringAsBytes(data);
+  // TODO(crbug.com/533048005): Remove this option when
+  // good_response_invalid_serial is removed.
+  ParseCertificateOptions options;
+  options.allow_invalid_serial_numbers = true;
   return ParsedCertificate::Create(
       bssl::UniquePtr<CRYPTO_BUFFER>(
           CRYPTO_BUFFER_new(bytes.data(), bytes.size(), nullptr)),
-      {}, &errors);
+      options, &errors);
 }
 
 struct TestParams {
@@ -57,6 +62,8 @@
      OCSPVerifyResult::PROVIDED},
     {"good_response_sha256.pem", OCSPRevocationStatus::GOOD,
      OCSPVerifyResult::PROVIDED},
+    {"good_response_invalid_serial.pem", OCSPRevocationStatus::GOOD,
+     OCSPVerifyResult::PROVIDED},
     {"no_response.pem", OCSPRevocationStatus::UNKNOWN,
      OCSPVerifyResult::NO_MATCHING_RESPONSE},
     {"malformed_request.pem", OCSPRevocationStatus::UNKNOWN,

boringssl-0.20260708.tar.xz/pki/parse_certificate.cc -> boringssl-0.20260813.tar.xz/pki/parse_certificate.cc Changed

@@ -264,6 +264,10 @@
                         CertErrors *errors) {
   // If `warnings_only` was set to true, the exact same errors will be logged,
   // only they will be logged with a lower severity (warning rather than error).
+  //
+  // TODO(crbug.com/533048005): Remove this option. It now only controls serials
+  // that aren't even valid integers. Historically, people needed to set it to
+  // tolerate length over 20, but this is now always enabled.
   CertError::Severity error_severity =
       warnings_only ? CertError::SEVERITY_WARNING : CertError::SEVERITY_HIGH;
 
@@ -290,10 +294,13 @@
   //    Certificate users MUST be able to handle serialNumber values up to 20
   //    octets. Conforming CAs MUST NOT use serialNumber values longer than 20
   //    octets.
+  //
+  // We do not attempt to enforce this as an error. In practice, it is common
+  // for serials to be off, e.g. with 21 octets due to the extra byte needed to
+  // keep values positive.
   if (value.size() > 20) {
-    errors->Add(error_severity, kSerialNumberLengthOver20,
-                CreateCertErrorParams1SizeT("length", value.size()));
-    return false;
+    errors->AddWarning(kSerialNumberLengthOver20,
+                       CreateCertErrorParams1SizeT("length", value.size()));
   }
 
   return true;

boringssl-0.20260708.tar.xz/pki/parse_certificate.h -> boringssl-0.20260813.tar.xz/pki/parse_certificate.h Changed

@@ -95,10 +95,11 @@
     der::GeneralizedTime *not_after);
 
 struct OPENSSL_EXPORT ParseCertificateOptions {
-  // If set to true, then parsing will skip checks on the certificate's serial
-  // number. The only requirement will be that the serial number is an INTEGER,
-  // however it is not required to be a valid DER-encoding (i.e. minimal
-  // encoding), nor is it required to be constrained to any particular length.
+  // If set to true, then parsing will accept serial numbers that are not valid
+  // integers.
+  //
+  // TODO(crbug.com/533048005): Historically, people needed to set it to
+  // tolerate length over 20, but this is now always enabled.
   bool allow_invalid_serial_numbers = false;
 };
 
@@ -217,11 +218,6 @@
   //
   // If the option `allow_invalid_serial_numbers=true` was used during
   // parsing, then nothing further can be assumed about these bytes.
-  //
-  // Otherwise if `allow_invalid_serial_numbers=false` then in addition
-  // to being a valid DER-encoded INTEGER, parsing guarantees that
-  // the serial number is at most 20 bytes long. Parsing does NOT guarantee
-  // that the integer is positive (might be zero or negative).
   der::Input serial_number;
 
   // Corresponds with "signatureAlgorithm" from RFC 5280:

boringssl-0.20260708.tar.xz/pki/parsed_certificate_unittest.cc -> boringssl-0.20260813.tar.xz/pki/parsed_certificate_unittest.cc Changed

@@ -497,16 +497,11 @@
 
 // Tests a serial number where the MSB is >= 0x80, causing the encoded
 // length to be 21 bytes long. This is an error, as RFC 5280 specifies a
-// maximum of 20 bytes.
+// maximum of 20 bytes. We do not constrain the serial number length because too
+// many certificates get it wrong.
 TEST(ParsedCertificateTest, SerialNumberZeroPadded21BytesLong) {
   std::shared_ptr<const ParsedCertificate> cert =
       ParseCertificateFromFile("serial_zero_padded_21_bytes.pem", {});
-  ASSERT_FALSE(cert);
-
-  // Try again with allow_invalid_serial_numbers=true. Parsing should succeed.
-  ParseCertificateOptions options;
-  options.allow_invalid_serial_numbers = true;
-  cert = ParseCertificateFromFile("serial_zero_padded_21_bytes.pem", options);
   ASSERT_TRUE(cert);
 
   static const uint8_t expected_serial21 = {
@@ -528,16 +523,11 @@
 }
 
 // Tests a serial number which is very long. RFC 5280 specifies a maximum of 20
-// bytes.
+// bytes. We do not constrain the serial number length because too many
+// certificates get it wrong.
 TEST(ParsedCertificateTest, SerialNumber37BytesLong) {
   std::shared_ptr<const ParsedCertificate> cert =
-      ParseCertificateFromFile("serial_37_bytes.pem", {});
-  ASSERT_FALSE(cert);
-
-  // Try again with allow_invalid_serial_numbers=true. Parsing should succeed.
-  ParseCertificateOptions options;
-  options.allow_invalid_serial_numbers = true;
-  cert = ParseCertificateFromFile("serial_37_bytes.pem", options);
+        ParseCertificateFromFile("serial_37_bytes.pem", {});
   ASSERT_TRUE(cert);
 
   static const uint8_t expected_serial37 = {
@@ -572,6 +562,16 @@
   std::shared_ptr<const ParsedCertificate> cert =
       ParseCertificateFromFile("serial_not_minimal.pem", {});
   ASSERT_FALSE(cert);
+
+  // Try again with allow_invalid_serial_numbers=true. Parsing should succeed.
+  // TODO(crbug.com/533048005): Remove this option.
+  ParseCertificateOptions options;
+  options.allow_invalid_serial_numbers = true;
+  cert = ParseCertificateFromFile("serial_not_minimal.pem", options);
+  ASSERT_TRUE(cert);
+
+  static const uint8_t expected_serial = {0x00, 0x01};
+  EXPECT_EQ(der::Input(expected_serial), cert->tbs().serial_number);
 }
 
 // Tests parsing a certificate that has an inhibitAnyPolicy extension.

boringssl-0.20260813.tar.xz/pki/testdata/ocsp_unittest/good_response_invalid_serial.pem Added

@@ -0,0 +1,179 @@
+Is a valid response for the cert, but the cert has an incorrectly encoded
+serial number. Until we fix the cert parser (https://crbug.com/533048005), it
+is prudent (though not critical) for every acceptable serial number to be
+representable in OCSP.
+
+This input is not generated by make_ocsp.py because it needs to output an
+invalid INTEGER. Instead, it was modified from good_response.pem with der-ascii
+and then the signature manually refreshed.
+
+$ openssl asn1parse -i < OCSP RESPONSE
+    0:d=0  hl=4 l= 441 cons: SEQUENCE          
+    4:d=1  hl=2 l=   1 prim:  ENUMERATED        :00
+    7:d=1  hl=4 l= 434 cons:  cont  0         
+   11:d=2  hl=4 l= 430 cons:   SEQUENCE          
+   15:d=3  hl=2 l=   9 prim:    OBJECT            :Basic OCSP Response
+   26:d=3  hl=4 l= 415 prim:    OCTET STRING      
+    0:d=0  hl=4 l= 411 cons:      SEQUENCE          
+    4:d=1  hl=3 l= 134 cons:       SEQUENCE          
+    7:d=2  hl=2 l=  33 cons:        cont  1         
+    9:d=3  hl=2 l=  31 cons:         SEQUENCE          
+   11:d=4  hl=2 l=  29 cons:          SET               
+   13:d=5  hl=2 l=  27 cons:           SEQUENCE          
+   15:d=6  hl=2 l=   3 prim:            OBJECT            :commonName
+   20:d=6  hl=2 l=  20 prim:            UTF8STRING        :Test Intermediate CA
+   42:d=2  hl=2 l=  15 prim:        GENERALIZEDTIME   :20170302000000Z
+   59:d=2  hl=2 l=  80 cons:        SEQUENCE          
+   61:d=3  hl=2 l=  78 cons:         SEQUENCE          
+   63:d=4  hl=2 l=  57 cons:          SEQUENCE          
+   65:d=5  hl=2 l=   7 cons:           SEQUENCE          
+   67:d=6  hl=2 l=   5 prim:            OBJECT            :sha1
+   74:d=5  hl=2 l=  20 prim:           OCTET STRING      HEX DUMP:449B1C5B31C6E9990966523E49C3F773C024190A
+   96:d=5  hl=2 l=  20 prim:           OCTET STRING      HEX DUMP:345CB28B1D8CDD6CBFF8F5CCF46521E87A8DF391
+  118:d=5  hl=2 l=   2 prim:           INTEGER           :BAD INTEGER:0005
+  122:d=4  hl=2 l=   0 prim:          cont  0         
+  124:d=4  hl=2 l=  15 prim:          GENERALIZEDTIME   :20170301000000Z
+  141:d=1  hl=2 l=  11 cons:       SEQUENCE          
+  143:d=2  hl=2 l=   9 prim:        OBJECT            :sha1WithRSAEncryption
+  154:d=1  hl=4 l= 257 prim:       BIT STRING        
+-----BEGIN OCSP RESPONSE-----
+MIIBuQoBAKCCAbIwggGuBgkrBgEFBQcwAQEEggGfMIIBmzCBhqEhMB8xHTAbBgNVBAMMFFRlc3Q
+gSW50ZXJtZWRpYXRlIENBGA8yMDE3MDMwMjAwMDAwMFowUDBOMDkwBwYFKw4DAhoEFESbHFsxxu
+mZCWZSPknD93PAJBkKBBQ0XLKLHYzdbL/49cz0ZSHoeo3zkQICAAWAABgPMjAxNzAzMDEwMDAwM
+DBaMAsGCSqGSIb3DQEBBQOCAQEAKo1IH2jKiU1EMMDxo8YQ9qPKbVmdvt5EkQ5qzOfNoVKPE9oW
+GvTN78vxP0imCnGsZboIDRHCmufqxcQ9qLIWK09BkwbsBlVRxhFQsciqsxuRTgMBUtsgV0aRpCT
+jJBb5BBJDk7KsWO7CnpUABsfSpVsJM0AfqpRc/E0f08WXPqaT5OhjyajzfY0xdqdmBISpUYsBdi
+HC8lewfLkKZGzTEMOExIFWblbXXdWTvOP+Imt04y1DjUeO3eaGlQ5GgM4LZNmFGJtM6TGoJalPj
+MqGwI1a1cuEVrm5MbsYJxlYM6b4dq/T1izhaqZtF4ORZQrkrWoLpq+VAy+4pNFpdNnAtQ==
+-----END OCSP RESPONSE-----
+
+$ openssl x509 -text < CA CERTIFICATE
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Test CA
+        Validity
+            Not Before: Jan  1 00:00:00 2017 GMT
+            Not After : Jan  1 00:00:00 2018 GMT
+        Subject: CN=Test Intermediate CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b6:34:d0:4e:c4:a4:f7:e0:90:a6:1f:54:37:d7:
+                    02:5e:33:3d:39:99:9c:15:f5:d6:7a:e5:59:87:bf:
+                    52:53:2d:8b:f6:31:ef:54:a2:e6:74:29:d5:52:54:
+                    6f:25:9e:24:30:29:15:f1:71:68:cd:d9:77:48:94:
+                    e5:96:a3:43:8b:35:2e:5f:da:00:a7:d3:ef:37:e8:
+                    ef:e9:6e:b6:c9:dc:2b:90:cb:64:90:70:32:69:d9:
+                    39:dd:9a:a8:51:98:61:99:0b:36:92:5e:f4:57:54:
+                    8f:c7:9f:b2:28:df:0b:73:bb:2c:c8:96:26:6d:a0:
+                    04:a9:93:a8:77:98:f9:ea:26:e0:92:6f:1b:34:03:
+                    31:bd:fe:36:cc:86:02:21:f9:f3:41:c4:0d:c4:6e:
+                    86:09:35:4b:f1:d6:4c:49:8a:bb:e5:d2:96:fa:fe:
+                    ae:5c:95:8a:83:41:e6:36:9a:e8:3d:f2:73:e1:a6:
+                    93:2d:ef:8f:35:95:67:f2:2b:b7:5e:72:24:de:1b:
+                    c0:8d:cc:8f:2f:b3:94:74:15:cb:cc:5f:e4:dd:ee:
+                    9b:fb:b2:86:64:1d:c3:ae:ac:58:eb:5e:5a:58:28:
+                    4f:ea:49:f8:d3:ce:3a:f8:f1:a5:44:d4:ff:89:71:
+                    dd:88:d5:64:b7:39:02:4b:d7:0e:87:55:9a:be:c3:
+                    a2:6b
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        48:77:56:03:36:fd:be:c2:46:c7:b8:88:b1:58:a0:e9:34:77:
+        91:0c:ec:ad:f5:9c:c7:49:0e:d7:f4:22:b1:3b:6a:b5:1a:e1:
+        ed:16:1e:43:25:8c:2a:27:3a:66:4e:a0:af:6e:e1:d0:4f:f3:
+        9c:63:08:07:2f:55:c1:af:55:c3:13:ec:a9:62:fc:d7:bb:4f:
+        6b:6c:09:7e:ce:b5:0f:54:2c:33:94:fe:33:44:d4:db:d3:7c:
+        ad:7a:62:fb:b7:c5:03:52:20:38:d0:b1:27:81:9f:e2:4f:02:
+        fb:26:a9:69:16:7b:56:f7:2f:f6:44:7b:31:39:71:40:72:ac:
+        3b:f7:09:c5:c8:0c:73:c2:2f:9d:5d:bb:e9:fd:66:40:a9:dd:
+        dc:c9:85:81:d4:0f:6a:9c:01:ff:60:d5:26:5d:d3:af:54:af:
+        38:44:44:7f:c0:e1:1e:1f:37:f2:df:25:cb:96:91:6a:2f:33:
+        4f:42:73:05:ee:85:82:3f:33:79:8f:85:be:92:73:dd:49:c7:
+        da:45:6d:1c:10:ba:d9:29:06:83:c3:c2:4b:70:8d:65:f5:1e:
+        56:6c:bc:d4:e7:71:0e:13:63:a6:88:41:36:66:a9:6c:92:d1:
+        de:c5:e6:c4:0d:a5:17:d1:9d:ec:3e:b5:d8:7b:bd:2d:ae:69:
+        70:1c:13:0c
+-----BEGIN CA CERTIFICATE-----
+MIICqjCCAZKgAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdUZXN0IENBMB4XDTE
+3MDEwMTAwMDAwMFoXDTE4MDEwMTAwMDAwMFowHzEdMBsGA1UEAwwUVGVzdCBJbnRlcm1lZGlhdG
+UgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2NNBOxKT34JCmH1Q31wJeMz05m
+ZwV9dZ65VmHv1JTLYv2Me9UouZ0KdVSVG8lniQwKRXxcWjN2XdIlOWWo0OLNS5f2gCn0+836O/p
+brbJ3CuQy2SQcDJp2TndmqhRmGGZCzaSXvRXVI/Hn7Io3wtzuyzIliZtoASpk6h3mPnqJuCSbxs
+0AzG9/jbMhgIh+fNBxA3EboYJNUvx1kxJirvl0pb6/q5clYqDQeY2mug98nPhppMt7481lWfyK7
+deciTeG8CNzI8vs5R0FcvMX+Td7pv7soZkHcOurFjrXlpYKE/qSfjTzjr48aVE1P+Jcd2I1WS3O
+QJL1w6HVZq+w6JrAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAEh3VgM2/b7CRse4iLFYoOk0d5EM
+7K31nMdJDtf0IrE7arUa4e0WHkMljConOmZOoK9u4dBP85xjCAcvVcGvVcMT7Kli/Ne7T2tsCX7
+OtQ9ULDOU/jNE1NvTfK16Yvu3xQNSIDjQsSeBn+JPAvsmqWkWe1b3L/ZEezE5cUByrDv3CcXIDH
+PCL51du+n9ZkCp3dzJhYHUD2qcAf9g1SZd069UrzhERH/A4R4fN/LfJcuWkWovM09CcwXuhYI/M
+3mPhb6Sc91Jx9pFbRwQutkpBoPDwktwjWX1HlZsvNTncQ4TY6aIQTZmqWyS0d7F5sQNpRfRnew+
+tdh7vS2uaXAcEww=
+-----END CA CERTIFICATE-----
+
+$ openssl asn1parse -i < CERTIFICATE
+    0:d=0  hl=4 l= 685 cons: SEQUENCE          
+    4:d=1  hl=4 l= 405 cons:  SEQUENCE          
+    8:d=2  hl=2 l=   3 cons:   cont  0         
+   10:d=3  hl=2 l=   1 prim:    INTEGER           :02
+   13:d=2  hl=2 l=   2 prim:   INTEGER           :BAD INTEGER:0005
+   17:d=2  hl=2 l=  13 cons:   SEQUENCE          
+   19:d=3  hl=2 l=   9 prim:    OBJECT            :sha256WithRSAEncryption
+   30:d=3  hl=2 l=   0 prim:    NULL              
+   32:d=2  hl=2 l=  31 cons:   SEQUENCE          
+   34:d=3  hl=2 l=  29 cons:    SET               
+   36:d=4  hl=2 l=  27 cons:     SEQUENCE          
+   38:d=5  hl=2 l=   3 prim:      OBJECT            :commonName
+   43:d=5  hl=2 l=  20 prim:      UTF8STRING        :Test Intermediate CA
+   65:d=2  hl=2 l=  30 cons:   SEQUENCE          
+   67:d=3  hl=2 l=  13 prim:    UTCTIME           :170101000000Z
+   82:d=3  hl=2 l=  13 prim:    UTCTIME           :180101000000Z
+   97:d=2  hl=2 l=  20 cons:   SEQUENCE          
+   99:d=3  hl=2 l=  18 cons:    SET               
+  101:d=4  hl=2 l=  16 cons:     SEQUENCE          
+  103:d=5  hl=2 l=   3 prim:      OBJECT            :commonName
+  108:d=5  hl=2 l=   9 prim:      UTF8STRING        :Test Cert
+  119:d=2  hl=4 l= 290 cons:   SEQUENCE          
+  123:d=3  hl=2 l=  13 cons:    SEQUENCE          
+  125:d=4  hl=2 l=   9 prim:     OBJECT            :rsaEncryption
+  136:d=4  hl=2 l=   0 prim:     NULL              
+  138:d=3  hl=4 l= 271 prim:    BIT STRING        
+  413:d=1  hl=2 l=  13 cons:  SEQUENCE          
+  415:d=2  hl=2 l=   9 prim:   OBJECT            :sha256WithRSAEncryption
+  426:d=2  hl=2 l=   0 prim:   NULL              
+  428:d=1  hl=4 l= 257 prim:  BIT STRING        
+-----BEGIN CERTIFICATE-----
+MIICrTCCAZWgAwIBAgICAAUwDQYJKoZIhvcNAQELBQAwHzEdMBsGA1UEAwwUVGVzdCBJbnRlcm1
+lZGlhdGUgQ0EwHhcNMTcwMTAxMDAwMDAwWhcNMTgwMTAxMDAwMDAwWjAUMRIwEAYDVQQDDAlUZX
+N0IENlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8xQEfHCA7qzXLNBPOsCdAd
+FJFawmHFAESDDnD+2mQLtRKSxZC25x3kAQs6lrfmCmv5OvopVSbopsEj/7G81AWlRJoAcyZx3XP
+oGR3UOii4lFvxrCLQwtOMaVo8X22HWarzxW6l/IoHwDHSluKJIS7YS7afpBOo4k1GeG+FJ3Ek57
+mcgCAZ/dcAtUv5K7wiey0lHZvx5W7bpfHzlkBdryyhcp8sOepApmkNnOPJCAM1H1ntosD4uXcty
+sz2ChlkVVhJUnqWRydIew2vqaSZA/5IrF51qf+U3xDglNPj14zFZxzMLEMglaFukQhyb8O8MJKr
+XF+NfX4GOZGZj0XTjuJAgMBAAEwDQYJKoZIhvcNAQELBQADggEBACiJwPZNBsVdgjB91Ez0qCUR
+OoB8QQ6LIoC59MSxxDw8afXttGEybTecZ7kNCbzP18u23VHWDmyhDDjluW2tnQzIilmnPkwz5Pk
+9vLJyF8OXbV+yRZaM/KvXPLaSJFf8mhUMkQ+p2BhFMZJqzifZWHtDJ34wei3m84CLNdRJA6jT6y
+5RjKdGUmlsJwu9fuKoxEoeY8lLXo9Oa+g1L/q1ifJ32UpT+lgqZmwxbeYvlzk8xqKyeFSJznM/p
+/bpAkLcWwXWByhlobDs6cxSlXdGkn0i7hnadHOvAKkBmTraYn7dFXDx3Xom3HckUQNzy3EoLnZR
+7OaTMjUqihkVes+H1fE=
+-----END CERTIFICATE-----
+
+$ openssl asn1parse -i < OCSP REQUEST
+    0:d=0  hl=2 l=  67 cons: SEQUENCE          
+    2:d=1  hl=2 l=  65 cons:  SEQUENCE          
+    4:d=2  hl=2 l=  63 cons:   SEQUENCE          
+    6:d=3  hl=2 l=  61 cons:    SEQUENCE          
+    8:d=4  hl=2 l=  59 cons:     SEQUENCE          
+   10:d=5  hl=2 l=   9 cons:      SEQUENCE          
+   12:d=6  hl=2 l=   5 prim:       OBJECT            :sha1
+   19:d=6  hl=2 l=   0 prim:       NULL              
+   21:d=5  hl=2 l=  20 prim:      OCTET STRING      HEX DUMP:449B1C5B31C6E9990966523E49C3F773C024190A
+   43:d=5  hl=2 l=  20 prim:      OCTET STRING      HEX DUMP:345CB28B1D8CDD6CBFF8F5CCF46521E87A8DF391
+   65:d=5  hl=2 l=   2 prim:      INTEGER           :BAD INTEGER:0005
+-----BEGIN OCSP REQUEST-----
+MEMwQTA/MD0wOzAJBgUrDgMCGgUABBREmxxbMcbpmQlmUj5Jw/dzwCQZCgQUNFyyix2M3Wy/+PX
+M9GUh6HqN85ECAgAF
+-----END OCSP REQUEST-----

boringssl-0.20260708.tar.xz/pki/testdata/parse_certificate_unittest/serial_37_bytes.pem -> boringssl-0.20260813.tar.xz/pki/testdata/parse_certificate_unittest/serial_37_bytes.pem Changed

@@ -12,10 +12,9 @@
 MIICdDCCAd2gAwIBAgIlAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJTANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMB4XDTE0MDQyMzIwNTA0MFoXDTE3MDQyMjIwNTA0MFowRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2CvIpjLkYv9N89CtWYtFp73xR78JWHsivTWulyWGlKCAwLQfdpFnRjHQEIS3Ih5wI5FyyOlteTqFd4APxJUWdcVKcUzIYz+j8mOcKk+a+svBcW4ohSigJx5lHK4H1VtvLUPtK5CxjK8kba7pFzoFwb+4HK5lOxtYwtmu1qpniPECAwEAAaNQME4wHQYDVR0OBBYEFIt11azLCL4OH2W3+la+bKd12oWvMB8GA1UdIwQYMBaAFIt11azLCL4OH2W3+la+bKd12oWvMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAO+h4bZXWPWr3ExksG8KIriKr9I0y9XxxZ88t0RzCw4fi6b6JXOQ0q0iRwj+VritHniV4a0+aEKRy/c/3AgywCgikWuLldH4RHTlgaskfafMuYybcnu9regrhVFeYqnKReAR+H49lTR8LEqycJA+EFBpVLR+78J0JsghcWTJlgCY=
 -----END CERTIFICATE-----
 
-ERROR: Serial number is longer than 20 octets
+WARNING: Serial number is longer than 20 octets
   length: 37
-ERROR: Failed parsing TBSCertificate
 
 -----BEGIN ERRORS-----
-RVJST1I6IFNlcmlhbCBudW1iZXIgaXMgbG9uZ2VyIHRoYW4gMjAgb2N0ZXRzCiAgbGVuZ3RoOiAzNwpFUlJPUjogRmFpbGVkIHBhcnNpbmcgVEJTQ2VydGlmaWNhdGUK
+V0FSTklORzogU2VyaWFsIG51bWJlciBpcyBsb25nZXIgdGhhbiAyMCBvY3RldHMKICBsZW5ndGg6IDM3Cg==
 -----END ERRORS-----

boringssl-0.20260708.tar.xz/pki/testdata/parse_certificate_unittest/serial_zero_padded_21_bytes.pem -> boringssl-0.20260813.tar.xz/pki/testdata/parse_certificate_unittest/serial_zero_padded_21_bytes.pem Changed

@@ -13,10 +13,9 @@
 MIICZDCCAc2gAwIBAgIVAIABAgMEBQYHCAkKCwwNDg8QERITMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTQwNDIzMjA1MDQwWhcNMTcwNDIyMjA1MDQwWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYK8imMuRi/03z0K1Zi0WnvfFHvwlYeyK9Na6XJYaUoIDAtB92kWdGMdAQhLciHnAjkXLI6W15OoV3gA/ElRZ1xUpxTMhjP6PyY5wqT5r6y8FxbiiFKKAnHmUcrgfVW28tQ+0rkLGMryRtrukXOgXBv7gcrmU7G1jC2a7WqmeI8QIDAQABo1AwTjAdBgNVHQ4EFgQUi3XVrMsIvg4fZbf6Vr5sp3Xaha8wHwYDVR0jBBgwFoAUi3XVrMsIvg4fZbf6Vr5sp3Xaha8wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQA76HhtldY9avcTGSwbwoiuIqv0jTL1fHFnzy3RHMLDh+Lpvolc5DSrSJHCP5WuK0eeJXhrT5oQpHL9z/cCDLAKCKRa4uV0fhEdOWBqyR9p8y5jJtye72t6CuFUV5iqcpF4BH4fj2VNHwsSrJwkD4QUGlUtH7vwnQmyCFxZMmWAJg==
 -----END CERTIFICATE-----
 
-ERROR: Serial number is longer than 20 octets
+WARNING: Serial number is longer than 20 octets
   length: 21
-ERROR: Failed parsing TBSCertificate
 
 -----BEGIN ERRORS-----
-RVJST1I6IFNlcmlhbCBudW1iZXIgaXMgbG9uZ2VyIHRoYW4gMjAgb2N0ZXRzCiAgbGVuZ3RoOiAyMQpFUlJPUjogRmFpbGVkIHBhcnNpbmcgVEJTQ2VydGlmaWNhdGUK
+V0FSTklORzogU2VyaWFsIG51bWJlciBpcyBsb25nZXIgdGhhbiAyMCBvY3RldHMKICBsZW5ndGg6IDIxCg==
 -----END ERRORS-----

boringssl-0.20260708.tar.xz/pki/verify.cc -> boringssl-0.20260813.tar.xz/pki/verify.cc Changed

@@ -48,19 +48,9 @@
 std::optional<std::shared_ptr<const ParsedCertificate>>
 InternalParseCertificate(Span<const uint8_t> cert, std::string *out_diagnostic) {
   ParseCertificateOptions default_options{};
-  // We follow Chromium in setting `allow_invalid_serial_numbers` in order to
-  // not choke on 21-byte serial numbers, which are common.
-  //
-  // The reason for the discrepancy is that unsigned numbers with the high bit
-  // otherwise set get an extra 0 byte in front to keep them positive. So if you
-  // do:
-  //    var num 20byte
-  //    fillWithRandom(num:)
-  //    serialNumber := new(big.Int).SetBytes(num:)
-  //    encodeASN1Integer(serialNumber)
-  //
-  // Then half of your serial numbers will be encoded with 21 bytes. (And
-  // 1/512th will have 19 bytes instead of 20.)
+  // TODO(crbug.com/533048005): Remove this option. It now only controls serials
+  // that aren't even valid integers. Historically, people needed to set it to
+  // tolerate length over 20, but this is now always enabled.
   default_options.allow_invalid_serial_numbers = true;
 
   UniquePtr<CRYPTO_BUFFER> buffer(

boringssl-0.20260708.tar.xz/rust/Cargo.lock -> boringssl-0.20260813.tar.xz/rust/Cargo.lock Changed

@@ -3,6 +3,12 @@
 version = 4
 
 package
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+package
 name = "bitflags"
 version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -58,7 +64,10 @@
  "bssl-tls",
  "bssl-x509",
  "futures",
+ "hyper",
+ "hyper-util",
  "tokio",
+ "tower",
 
 
 package
@@ -100,6 +109,12 @@
 checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
 
 package
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+package
 name = "errno"
 version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -116,6 +131,12 @@
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 package
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+package
 name = "futures"
 version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -215,6 +236,115 @@
 
 
 package
+name = "h2"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+dependencies = 
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+
+
+package
+name = "hashbrown"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+
+package
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = 
+ "bytes",
+ "itoa",
+
+
+package
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = 
+ "bytes",
+ "http",
+
+
+package
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+package
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+package
+name = "hyper"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
+dependencies = 
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+
+
+package
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = 
+ "bytes",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "tokio",
+
+
+package
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = 
+ "equivalent",
+ "hashbrown",
+
+
+package
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+package
 name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -495,11 +625,48 @@
 
 
 package
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = 
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+
+
+package
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = 
+ "tower-layer",
+ "tower-service",
+ "tracing",
+
+
+package
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+package
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+package
 name = "tracing"
 version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = 
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -552,6 +719,12 @@
 
 
 package
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+package
 name = "unicode-ident"
 version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -570,6 +743,15 @@
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
 package
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = 
+ "try-lock",
+
+
+package
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"

boringssl-0.20260708.tar.xz/rust/bssl-crypto/src/ec.rs -> boringssl-0.20260813.tar.xz/rust/bssl-crypto/src/ec.rs Changed

boringssl-0.20260708.tar.xz/rust/bssl-crypto/src/ecdsa.rs -> boringssl-0.20260813.tar.xz/rust/bssl-crypto/src/ecdsa.rs Changed

@@ -100,12 +100,32 @@
     /// produce the digest if the curve of this public key is P-384.
     pub fn verify(&self, signed_msg: &u8, signature: &u8) -> Result<(), InvalidSignatureError> {
         let digest = C::hash(signed_msg);
+        self.verify_already_hashed(&digest, signature)
+    }
+
+    /// Verify `signature` as a valid ASN.1-based signature of `hashed_msg` with
+    /// this public key. `hashed_msg` must already have been hashed with a
+    /// secure hash function: passing unhashed data here breaks the security
+    /// properties of the signature scheme. If you have unhashed data, use
+    /// `verify` instead.
+    ///
+    /// This function exists because sometimes the "wrong" hash function is used
+    /// with a key. A key should not be used with different hash functions and
+    /// there is an obvious correspondence between NIST's standard elliptic
+    /// curves and the SHA-2 family of hash functions that implicitly defines
+    /// the correct hash function to use with a given key. But, if mistakes have
+    /// been made, this function is here for you.
+    pub fn verify_already_hashed(
+        &self,
+        hashed_msg: &u8,
+        signature: &u8,
+    ) -> Result<(), InvalidSignatureError> {
         let result = self.point.with_point_as_ec_key(|ec_key| unsafe {
             // Safety: `ec_key` is valid per `with_point_as_ec_key`.
             bssl_sys::ECDSA_verify(
                 /*type=*/ 0,
-                digest.as_slice().as_ffi_ptr(),
-                digest.len(),
+                hashed_msg.as_ffi_ptr(),
+                hashed_msg.len(),
                 signature.as_ffi_ptr(),
                 signature.len(),
                 ec_key,
@@ -373,10 +393,18 @@
         )
         .unwrap();
         assert!(public_key.verify(signed_message, sig.as_slice()).is_ok());
+        let mut digest = C::hash(signed_message);
+        assert!(public_key
+            .verify_already_hashed(digest.as_slice(), sig.as_slice())
+            .is_ok());
         assert!(public_key
             .verify_p1363(signed_message, sig_p1363.as_slice())
             .is_ok());
 
+        digest0 ^= 1;
+        assert!(public_key
+            .verify_already_hashed(digest.as_slice(), sig.as_slice())
+            .is_err());
         sig10 ^= 1;
         assert!(public_key.verify(signed_message, sig.as_slice()).is_err());
         sig_p136310 ^= 1;

boringssl-0.20260708.tar.xz/rust/bssl-crypto/src/lib.rs -> boringssl-0.20260813.tar.xz/rust/bssl-crypto/src/lib.rs Changed

@@ -29,7 +29,10 @@
 
 use alloc::boxed::Box;
 use alloc::vec::Vec;
-use core::ffi::c_void;
+use core::{
+    debug_assert,
+    ffi::c_void, //
+};
 
 #macro_use
 mod macros;
@@ -132,6 +135,89 @@
     }
 }
 
+#doc(hidden)
+/// The reverse of `FfiSlice`, to re-interpret a FFI pointer back into a Rust slice.
+pub trait FromFfiSlice: Sized {
+    /// Converts an FFI pointer and length to a Rust slice. This is similar to
+    /// core::slice::from_raw_parts but handles a mismatch between C and Rust empty slice
+    /// conventions.
+    /// In C, empty slices may use a `NULL` pointer in C.
+    /// In Rust, they may not.
+    ///
+    /// **NOTE** This trait is set up only for BoringSSL internal use.
+    ///
+    /// # Safety
+    ///
+    /// The caller must meet the following safety pre-conditions:
+    /// - The `ptr` and `len` are from a slice returned from BoringSSL via FFI.
+    /// - The memory referenced by the returned slice must not be mutated or deallocated for the
+    ///   duration of lifetime `'a`, including by BoringSSL.
+    ///
+    /// The first condition implies the following properties:
+    ///
+    /// - `ptr` is correctly aligned for Self.
+    /// - The total bytes of the slice, in other words `size_of<Self>() * len`, is below isize::MAX.
+    /// - If `ptr.is_null()` then `len == 0`.
+    /// - There are `len` objects of type Self at ptr.
+    /// - The entire memory range for these objects is contained in a single allocation.
+    /// - The entire memory range is not mutated within the `'a` lifetime through aliased accesses.
+    /// - Each element of the slice has a valid bit pattern as a value of `Self`.
+    unsafe fn from_ffi_ptr<'a>(ptr: *const Self, len: usize) -> &'a Self;
+}
+
+impl<T> FromFfiSlice for T {
+    #inline
+    unsafe fn from_ffi_ptr<'a>(ptr: *const T, len: usize) -> &'a T {
+        debug_assert!(ptr.is_aligned());
+        #cfg(debug_assertions)
+        if let Some(len) = len.checked_mul(core::mem::size_of::<T>()) {
+            debug_assert!(len < isize::MAX.unsigned_abs());
+        } else {
+            unreachable!("length overflow");
+        };
+
+        if len == 0 {
+            &
+        } else {
+            debug_assert!(!ptr.is_null());
+            unsafe {
+                // Safety:
+                // - pre-condition has asserted that the pointer outlives the returned slice.
+                // - pre-condition has asserted that the memory range does not overlap with any
+                //   other allocations.
+                // - pre-condition has asserted that the bit pattern behind the pointer is valid for
+                //   the type `T`.
+                core::slice::from_raw_parts(ptr, len)
+            }
+        }
+    }
+}
+
+/// Sanitize the data pointer and length and reconstitute the mutable slice.
+///
+/// This method will **zeroize** the content.
+///
+/// This method returns an empty slice if the length is 0.
+///
+/// # Safety
+///
+/// Caller must ensure that
+/// - `ptr` outlives `'a`.
+/// - access to `out` is exclusive and strictly not aliased.
+/// - if `ptr` is NULL, `capacity == 0`.
+#inline
+pub unsafe fn zeroize_mut_byteslice<'a>(ptr: *mut u8, capacity: usize) -> &'a mut u8 {
+    if capacity == 0 {
+        return &mut ;
+    }
+    debug_assert!(capacity < isize::MAX.unsigned_abs() && !ptr.is_null());
+    unsafe {
+        // Safety: `out` is 1-aligned and `0` is a valid pattern for `u8`.
+        core::ptr::write_bytes(ptr, 0, capacity);
+        core::slice::from_raw_parts_mut(ptr, capacity)
+    }
+}
+
 /// This is a helper struct which provides functions for passing slices over FFI.
 ///
 /// Deprecated: use `FfiSlice` which adds less noise and lets one grep for `as_ptr`

boringssl-0.20260708.tar.xz/rust/bssl-macros/src/lib.rs -> boringssl-0.20260813.tar.xz/rust/bssl-macros/src/lib.rs Changed

boringssl-0.20260708.tar.xz/rust/bssl-sys/build.rs -> boringssl-0.20260813.tar.xz/rust/bssl-sys/build.rs Changed

@@ -74,7 +74,7 @@
     }
 
     let crate_dir = env::var_os("CARGO_MANIFEST_DIR").unwrap();
-    return Path::new(&crate_dir).join("../../build");
+    Path::new(&crate_dir).join("../../build")
 }
 
 fn get_cpp_runtime_lib() -> Option<String> {
@@ -104,11 +104,13 @@
     // Find the bindgen generated target platform bindings file and put it into
     // OUT_DIR/bindgen.rs.
     let bindgen_source_file = bssl_sys_build_dir.join(format!("wrapper_{}.rs", target));
-    std::fs::copy(&bindgen_source_file, &bindgen_out_file).expect(&format!(
-        "Could not copy bindings from '{}' to '{}'",
-        bindgen_source_file.display(),
-        bindgen_out_file.display()
-    ));
+    std::fs::copy(&bindgen_source_file, &bindgen_out_file).unwrap_or_else(|_| {
+        panic!(
+            "Could not copy bindings from '{}' to '{}'",
+            bindgen_source_file.display(),
+            bindgen_out_file.display()
+        )
+    });
     println!("cargo:rerun-if-changed={}", bindgen_source_file.display());
 
     // Statically link libraries.

boringssl-0.20260708.tar.xz/rust/bssl-sys/src/lib.rs -> boringssl-0.20260813.tar.xz/rust/bssl-sys/src/lib.rs Changed

boringssl-0.20260708.tar.xz/rust/bssl-tls-tokio/Cargo.toml -> boringssl-0.20260813.tar.xz/rust/bssl-tls-tokio/Cargo.toml Changed

boringssl-0.20260813.tar.xz/rust/bssl-tls-tokio/src/hyper.rs Added

@@ -0,0 +1,92 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Hyper support
+
+use crate::TlsConnector;
+
+use std::{
+    error::Error,
+    fmt::Debug,
+    future::Future,
+    pin::Pin,
+    sync::Arc,
+    task::{
+        Context,
+        Poll, //
+    }, //
+};
+
+use hyper::http;
+use tower::Service;
+
+/// A connector for `hyper` using `bssl-tls`.
+#derive(Clone)
+pub struct HyperBsslConnector<Inner> {
+    inner: Inner,
+    connector: Arc<TlsConnector>,
+}
+
+impl<Inner: Debug> std::fmt::Debug for HyperBsslConnector<Inner> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("HyperBsslConnector")
+            .field("inner", &self.inner)
+            .finish()
+    }
+}
+
+impl<Inner> HyperBsslConnector<Inner> {
+    /// Construct a new `HyperBsslConnector`.
+    pub fn new(inner: Inner, connector: TlsConnector) -> Self {
+        Self {
+            inner,
+            connector: Arc::new(connector),
+        }
+    }
+}
+
+impl<Inner> Service<http::Uri> for HyperBsslConnector<Inner>
+where
+    Inner: Service<http::Uri>,
+    Inner::Response: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + Sync + 'static,
+    Inner::Future: Send + 'static,
+    Inner::Error: Into<Box<dyn Error + Send + Sync>>,
+{
+    type Response = crate::TlsStream<bssl_tls::connection::Client, Inner::Response>;
+    type Error = Box<dyn Error + Send + Sync>;
+    type Future = Pin<Box<dyn Future<Output = Result<Self::Response, Self::Error>> + Send>>;
+
+    fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+        self.inner.poll_ready(cx).map_err(Into::into)
+    }
+
+    fn call(&mut self, uri: http::Uri) -> Self::Future {
+        let domain = uri
+            .host()
+            .unwrap_or("")
+            .trim_start_matches('')
+            .trim_end_matches('')
+            .to_string();
+        if domain.is_empty() {
+            return Box::pin(std::future::ready(Err("empty domain".into())));
+        }
+        let fut = self.inner.call(uri);
+        let connector = self.connector.clone();
+
+        Box::pin(async move {
+            let stream = fut.await.map_err(Into::into)?;
+            Ok(connector.connect(&domain, stream).await?)
+        })
+    }
+}

boringssl-0.20260708.tar.xz/rust/bssl-tls-tokio/src/lib.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls-tokio/src/lib.rs Changed

@@ -75,7 +75,7 @@
 //! #
 //! #     let server_task = tokio::spawn(async move {
 //! #         let (stream, _) = listener.accept().await.unwrap();
-//! #         let mut conn = server_ctx.new_server_connection(None).unwrap().build();
+//! #         let mut conn = server_ctx.new_server_connection().build();
 //! #         conn.set_io(TokioIo(stream)).unwrap();
 //! #         conn.async_handshake().await.unwrap();
 //! #         
@@ -90,7 +90,7 @@
 //!
 //!     let client_ctx = client_ctx_builder.build();
 //!
-//!     let mut conn = client_ctx.new_client_connection(None).unwrap().build();
+//!     let mut conn = client_ctx.new_client_connection().build();
 //!     conn.in_handshake().unwrap().set_host("www.google.com")?;
 //!     conn.set_io(TokioIo(stream))?;
 //!
@@ -113,6 +113,7 @@
 };
 use std::{
     io,
+    marker::PhantomData,
     ops::{
         Deref,
         DerefMut, //
@@ -141,16 +142,26 @@
 };
 use bssl_tls::{
     connection::{
+        Client,
+        Server,
         TlsConnection,
         lifecycle::ShutdownStatus, //
     },
-    context::TlsMode,
+    context::{
+        TlsContext,
+        TlsContextBuilder,
+        TlsMode, //
+    },
+    errors::Error,
     io::{
         AbstractReader, AbstractSocket, AbstractSocketResult, AbstractWriter, IoStatus,
         NoAsyncContext, stdio::PollFor,
     }, //
 };
 
+#cfg(test)
+mod tests;
+
 /// Translates a `std::io::Error` into an `AbstractSocketResult`.
 fn translate_stdio_err(err: io::Error) -> AbstractSocketResult {
     match err.kind() {
@@ -495,3 +506,129 @@
         }
     }
 }
+
+/// A wrapper around `TlsContext` for creating Tokio-based client connections.
+pub struct TlsConnector {
+    ctx: TlsContext,
+}
+
+impl TlsConnector {
+    /// Construct a new `TlsConnector`.
+    pub(crate) fn new(ctx: TlsContext) -> Self {
+        Self { ctx }
+    }
+
+    /// Connect to the given domain using the provided stream.
+    pub async fn connect<S>(&self, domain: &str, stream: S) -> Result<TlsStream<Client, S>, Error>
+    where
+        S: AsyncRead + AsyncWrite + Send + Unpin + 'static,
+    {
+        let mut conn = self.ctx.new_client_connection().build();
+        conn.in_handshake().unwrap().set_host(domain)?;
+
+        conn.set_io(TokioIo(stream))?;
+
+        conn.async_handshake().await?;
+
+        Ok(TlsStream {
+            conn: TokioTlsConnection::new(conn),
+            _marker: PhantomData,
+        })
+    }
+}
+
+/// A wrapper around `TlsContext` for creating Tokio-based server connections.
+pub struct TlsAcceptor {
+    ctx: TlsContext,
+}
+
+impl TlsAcceptor {
+    /// Construct a new `TlsAcceptor`.
+    pub(crate) fn new(ctx: TlsContext) -> Self {
+        Self { ctx }
+    }
+
+    /// Accept a new connection using the provided stream.
+    pub async fn accept<S>(&self, stream: S) -> Result<TlsStream<Server, S>, Error>
+    where
+        S: AsyncRead + AsyncWrite + Send + Unpin + 'static,
+    {
+        let mut conn = self.ctx.new_server_connection().build();
+
+        conn.set_io(TokioIo(stream))?;
+
+        conn.async_handshake().await?;
+
+        Ok(TlsStream {
+            conn: TokioTlsConnection::new(conn),
+            _marker: PhantomData,
+        })
+    }
+}
+
+/// A TLS stream driven by Tokio I/O.
+pub struct TlsStream<Role, Stream> {
+    conn: TokioTlsConnection<Role>,
+    _marker: PhantomData<Stream>,
+}
+
+impl<Role, S> TlsStream<Role, S> {
+    /// Get a reference to the underlying `TlsConnection`.
+    pub fn get_ref(&self) -> &TlsConnection<Role> {
+        &self.conn
+    }
+
+    /// Get a mutable reference to the underlying `TlsConnection`.
+    pub fn get_mut(&mut self) -> &mut TlsConnection<Role> {
+        &mut self.conn
+    }
+}
+
+impl<Role, S: Unpin> AsyncRead for TlsStream<Role, S> {
+    fn poll_read(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &mut ReadBuf<'_>,
+    ) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.conn).poll_read(cx, buf)
+    }
+}
+
+impl<Role, S: Unpin> AsyncWrite for TlsStream<Role, S> {
+    fn poll_write(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &u8,
+    ) -> Poll<io::Result<usize>> {
+        Pin::new(&mut self.conn).poll_write(cx, buf)
+    }
+
+    fn poll_flush(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.conn).poll_flush(cx)
+    }
+
+    fn poll_shutdown(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.conn).poll_shutdown(cx)
+    }
+}
+
+/// Extension trait for `TlsContextBuilder` to support Tokio TLS.
+pub trait TokioTlsExt {
+    /// Build a `TlsConnector`.
+    fn build_tokio_connector(self) -> TlsConnector;
+    /// Build a `TlsAcceptor`.
+    fn build_tokio_acceptor(self) -> TlsAcceptor;
+}
+
+impl TokioTlsExt for TlsContextBuilder<TlsMode> {
+    fn build_tokio_connector(self) -> TlsConnector {
+        TlsConnector::new(self.build())
+    }
+
+    fn build_tokio_acceptor(self) -> TlsAcceptor {
+        TlsAcceptor::new(self.build())
+    }
+}
+
+#cfg(feature = "hyper")
+pub mod hyper;

boringssl-0.20260813.tar.xz/rust/bssl-tls-tokio/src/tests Added

boringssl-0.20260813.tar.xz/rust/bssl-tls-tokio/src/tests.rs Added

@@ -0,0 +1,58 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+mod convenience;
+mod datagram;
+mod transport;
+
+const CA: &u8 = include_bytes!("../../test-data/BoringSSLCATest.crt");
+const RSA_SERVER_CERT: &u8 = include_bytes!("../../test-data/BoringSSLServerTest-RSA.crt");
+const RSA_SERVER_KEY: &u8 = include_bytes!("../../test-data/BoringSSLServerTest-RSA.key");
+
+use bssl_tls::credentials::{
+    Certificate,
+    TlsCredential,
+    TlsCredentialBuilder, //
+};
+use bssl_x509::{
+    certificates::X509Certificate,
+    keys::PrivateKey,
+    params::Trust,
+    store::{X509Store, X509StoreBuilder}, //
+};
+
+/// Returns a server credential with the test certificate chain and private key.
+fn server_credential() -> TlsCredential {
+    let ca = Certificate::parse_one_from_pem(CA, None).unwrap();
+    let server_cert = Certificate::parse_one_from_pem(RSA_SERVER_CERT, None).unwrap();
+    let server_key = PrivateKey::from_pem(RSA_SERVER_KEY, || unreachable!()).unwrap();
+    let mut builder = TlsCredentialBuilder::new();
+    builder
+        .with_certificate_chain(&server_cert, ca)
+        .unwrap()
+        .with_private_key(server_key)
+        .unwrap();
+    builder.build().unwrap()
+}
+
+/// Returns a certificate store trusting the test CA.
+fn client_cert_store() -> X509Store {
+    let mut store = X509StoreBuilder::new();
+    store
+        .set_trust(Trust::SslServer)
+        .unwrap()
+        .add_cert(X509Certificate::parse_one_from_pem(CA).unwrap())
+        .unwrap();
+    store.build()
+}

boringssl-0.20260813.tar.xz/rust/bssl-tls-tokio/src/tests/convenience.rs Added

@@ -0,0 +1,62 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use bssl_tls::context::TlsContextBuilder;
+
+use tokio::io::{
+    AsyncReadExt,
+    AsyncWriteExt, //
+};
+
+use crate::TokioTlsExt;
+
+#tokio::test
+async fn high_level_tokio() -> Result<(), bssl_tls::errors::Error> {
+    let mut server_builder = TlsContextBuilder::new_tls();
+    server_builder.with_credential(super::server_credential())?;
+    let acceptor = server_builder.build_tokio_acceptor();
+
+    let mut client_builder = TlsContextBuilder::new_tls();
+    client_builder.with_certificate_store(&super::client_cert_store());
+    let connector = client_builder.build_tokio_connector();
+
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+
+    let server_task = tokio::spawn(async move {
+        let (stream, _) = listener.accept().await.unwrap();
+        let mut tls_stream = acceptor.accept(stream).await.unwrap();
+
+        let mut buf = 0; 5;
+        tls_stream.read_exact(&mut buf).await.unwrap();
+        assert_eq!(&buf, b"hello");
+
+        tls_stream.write_all(b"world").await.unwrap();
+        tls_stream.flush().await.unwrap();
+    });
+
+    let stream = tokio::net::TcpStream::connect(addr).await.unwrap();
+    let mut tls_stream = connector.connect("www.google.com", stream).await.unwrap();
+
+    tls_stream.write_all(b"hello").await.unwrap();
+    tls_stream.flush().await.unwrap();
+
+    let mut buf = 0; 5;
+    tls_stream.read_exact(&mut buf).await.unwrap();
+    assert_eq!(&buf, b"world");
+
+    server_task.await.unwrap();
+
+    Ok(())
+}

boringssl-0.20260813.tar.xz/rust/bssl-tls-tokio/src/tests/datagram.rs Added

@@ -0,0 +1,138 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#!cfg(unix)
+
+use bssl_tls::{
+    connection::{
+        Client,
+        Server,
+        TlsConnection, //
+    },
+    context::{
+        DtlsMode,
+        TlsContextBuilder, //
+    },
+    errors::Error, //
+};
+
+use crate::{
+    TokioDatagramIo,
+    new_std_datagram_with_tokio, //
+};
+
+fn dumb_dtls_server_client() -> (
+    TlsConnection<Server, DtlsMode>,
+    TlsConnection<Client, DtlsMode>,
+) {
+    let mut server_ctx_builder = TlsContextBuilder::new_dtls();
+    server_ctx_builder
+        .with_credential(super::server_credential())
+        .unwrap();
+    let server_conn = server_ctx_builder.build().new_server_connection().build();
+
+    let mut client_ctx_builder = TlsContextBuilder::new_dtls();
+    client_ctx_builder.with_certificate_store(&super::client_cert_store());
+    let client_conn = client_ctx_builder.build().new_client_connection().build();
+
+    (server_conn, client_conn)
+}
+
+async fn async_ping_pong(
+    mut server_conn: TlsConnection<Server, DtlsMode>,
+    mut client_conn: TlsConnection<Client, DtlsMode>,
+) -> Result<(), Error> {
+    use bssl_tls::io::IoStatus;
+    use std::time::Duration;
+
+    let task = tokio::spawn(async move {
+        server_conn.async_handshake().await?;
+
+        let mut message = 0; 21;
+        let mut read_bytes = 0;
+        while read_bytes < 21 {
+            match server_conn
+                .as_pin_mut()
+                .async_read(&mut messageread_bytes..)
+                .await?
+            {
+                IoStatus::Ok(n) => read_bytes += n,
+                IoStatus::EndOfStream => break,
+                _ => {}
+            }
+        }
+        assert_eq!(&message, b"BoringSSL is awesome!");
+        tokio::time::sleep(Duration::from_secs(2)).await;
+        server_conn
+            .as_pin_mut()
+            .async_write(b"Oh yeah definitely!")
+            .await?;
+        server_conn.as_pin_mut().async_shutdown().await?;
+        Ok::<_, Error>(())
+    });
+
+    client_conn.async_handshake().await?;
+    client_conn
+        .as_pin_mut()
+        .async_write(b"BoringSSL is awesome!")
+        .await?;
+    let mut message = 0; 19;
+    let mut read_bytes = 0;
+    while read_bytes < 19 {
+        match client_conn
+            .as_pin_mut()
+            .async_read(&mut messageread_bytes..)
+            .await?
+        {
+            IoStatus::Ok(n) => read_bytes += n,
+            IoStatus::EndOfStream => break,
+            _ => {}
+        }
+    }
+    assert_eq!(&message, b"Oh yeah definitely!");
+    assert!(matches!(
+        client_conn.as_pin_mut().async_shutdown().await,
+        Ok(_) | Err(Error::Io(bssl_tls::errors::IoError::EndOfStream))
+    ));
+    task.await.unwrap()?;
+    Ok(())
+}
+
+#cfg(unix)
+#tokio::test
+#ignore = "https://crbug.com/532601068"
+async fn async_dtls() -> Result<(), Error> {
+    let (mut server_conn, mut client_conn) = dumb_dtls_server_client();
+    let (server_sock, client_sock) = tokio::net::UnixDatagram::pair().unwrap();
+    server_conn.set_io(TokioDatagramIo(server_sock)).unwrap();
+    client_conn.set_io(TokioDatagramIo(client_sock)).unwrap();
+
+    async_ping_pong(server_conn, client_conn).await
+}
+
+#cfg(unix)
+#tokio::test
+#ignore = "https://crbug.com/532601068"
+async fn async_dtls_over_fd() -> Result<(), Error> {
+    let (mut server_conn, mut client_conn) = dumb_dtls_server_client();
+    let (server_sock, client_sock) = std::os::unix::net::UnixDatagram::pair().unwrap();
+    server_sock.set_nonblocking(true).unwrap();
+    client_sock.set_nonblocking(true).unwrap();
+    let server_sock = new_std_datagram_with_tokio(server_sock).unwrap();
+    let client_sock = new_std_datagram_with_tokio(client_sock).unwrap();
+    server_conn.set_io(server_sock).unwrap();
+    client_conn.set_io(client_sock).unwrap();
+
+    async_ping_pong(server_conn, client_conn).await
+}

boringssl-0.20260813.tar.xz/rust/bssl-tls-tokio/src/tests/transport.rs Added

@@ -0,0 +1,98 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use bssl_tls::{
+    connection::{
+        Client,
+        Server,
+        TlsConnection, //
+    },
+    errors::Error, //
+};
+use futures::future::FutureExt;
+use tokio::io::{
+    AsyncReadExt,
+    AsyncWriteExt, //
+};
+
+use crate::{
+    TokioIo,
+    TokioTlsConnection, //
+};
+
+fn dumb_server_client() -> (TlsConnection<Server>, TlsConnection<Client>) {
+    use bssl_tls::context::TlsContextBuilder;
+
+    let mut server_builder = TlsContextBuilder::new_tls();
+    server_builder
+        .with_credential(super::server_credential())
+        .unwrap();
+    let server_conn = server_builder.build().new_server_connection().build();
+
+    let mut client_builder = TlsContextBuilder::new_tls();
+    client_builder.with_certificate_store(&super::client_cert_store());
+    let client_conn = client_builder.build().new_client_connection().build();
+
+    (server_conn, client_conn)
+}
+
+#cfg(unix)
+#tokio::test
+async fn tokio_io() -> Result<(), Error> {
+    let (server_conn, client_conn) = dumb_server_client();
+
+    let (server_tx, server_rx) = tokio::net::unix::pipe::pipe().unwrap();
+    let (client_tx, client_rx) = tokio::net::unix::pipe::pipe().unwrap();
+    let (send_signal, recv_signal) = tokio::sync::oneshot::channel();
+    let server_rx = TokioIo(server_rx);
+    let server_tx = TokioIo(server_tx);
+    let client_rx = TokioIo(client_rx);
+    let client_tx = TokioIo(client_tx);
+
+    let mut server_conn = TokioTlsConnection::new(server_conn);
+    let mut client_conn = TokioTlsConnection::new(client_conn);
+
+    server_conn.set_split_io(client_rx, server_tx)?;
+    client_conn.set_split_io(server_rx, client_tx)?;
+
+    let thread = tokio::spawn(async move {
+        let mut message = 0; 21;
+        server_conn.read_exact(&mut message).await.unwrap();
+        assert_eq!(message, *b"BoringSSL is awesome!");
+        server_conn.write_all(b"Oh yeah definitely!").await.unwrap();
+
+        // The original test used sync_shutdown on established()
+        // We use wrapper's shutdown instead.
+
+        let res = server_conn.shutdown().now_or_never();
+        assert!(res.is_none(), "{res:?}");
+
+        // Make the client progress
+        send_signal.send(()).unwrap();
+
+        server_conn.shutdown().await.unwrap();
+    });
+    client_conn
+        .write_all(b"BoringSSL is awesome!")
+        .await
+        .unwrap();
+    recv_signal.await.unwrap();
+    let mut message = 0; 19;
+    client_conn.read_exact(&mut message).await.unwrap();
+    assert_eq!(message, *b"Oh yeah definitely!");
+    client_conn.shutdown().await.unwrap();
+    thread.await.unwrap();
+
+    Ok(())
+}

boringssl-0.20260813.tar.xz/rust/bssl-tls-tokio/tests/hyper.rs Added

@@ -0,0 +1,194 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#!cfg(feature = "hyper")
+
+use bssl_tls::alpn::H2;
+use bssl_tls::context::TlsContextBuilder;
+use bssl_tls::credentials::{Certificate, TlsCredential, TlsCredentialBuilder};
+use bssl_tls_tokio::TokioTlsExt;
+use bssl_tls_tokio::hyper::HyperBsslConnector;
+use bssl_x509::{
+    certificates::X509Certificate,
+    keys::PrivateKey,
+    params::Trust,
+    store::{X509Store, X509StoreBuilder},
+};
+use hyper::body::{Body, Bytes, Frame};
+use hyper::service::service_fn;
+use hyper_util::rt::TokioIo as HyperTokioIo;
+use std::convert::Infallible;
+use std::future::Future;
+use std::pin::Pin;
+use std::task::{Context, Poll};
+use tokio::net::{TcpListener, TcpStream};
+use tower::Service;
+
+const CA: &u8 = include_bytes!("../../test-data/BoringSSLCATest.crt");
+const RSA_SERVER_CERT: &u8 = include_bytes!("../../test-data/BoringSSLServerTest-RSA.crt");
+const RSA_SERVER_KEY: &u8 = include_bytes!("../../test-data/BoringSSLServerTest-RSA.key");
+
+fn server_credential() -> TlsCredential {
+    let ca = Certificate::parse_one_from_pem(CA, None).unwrap();
+    let server_cert = Certificate::parse_one_from_pem(RSA_SERVER_CERT, None).unwrap();
+    let server_key = PrivateKey::from_pem(RSA_SERVER_KEY, || unreachable!()).unwrap();
+    let mut builder = TlsCredentialBuilder::new();
+    builder
+        .with_certificate_chain(&server_cert, ca)
+        .unwrap()
+        .with_private_key(server_key)
+        .unwrap();
+    builder.build().unwrap()
+}
+
+fn client_cert_store() -> X509Store {
+    let mut store = X509StoreBuilder::new();
+    store
+        .set_trust(Trust::SslServer)
+        .unwrap()
+        .add_cert(X509Certificate::parse_one_from_pem(CA).unwrap())
+        .unwrap();
+    store.build()
+}
+
+/// A body that yields a single data frame, or is empty.
+struct SimpleBody(Option<Bytes>);
+
+impl SimpleBody {
+    fn new(data: &'static str) -> Self {
+        Self(Some(Bytes::from(data)))
+    }
+
+    fn empty() -> Self {
+        Self(None)
+    }
+}
+
+impl Body for SimpleBody {
+    type Data = Bytes;
+    type Error = Infallible;
+
+    fn poll_frame(
+        mut self: Pin<&mut Self>,
+        _cx: &mut Context<'_>,
+    ) -> Poll<Option<Result<Frame<Self::Data>, Self::Error>>> {
+        match self.0.take() {
+            Some(data) => Poll::Ready(Some(Ok(Frame::data(data)))),
+            None => Poll::Ready(None),
+        }
+    }
+}
+
+/// A mock TCP connector that connects to a fixed address, implementing
+/// `tower::Service<Uri>` so it can be wrapped in `HyperBsslConnector`.
+struct MockTcpConnector {
+    addr: std::net::SocketAddr,
+}
+
+impl Service<hyper::http::Uri> for MockTcpConnector {
+    type Response = TcpStream;
+    type Error = std::io::Error;
+    type Future = Pin<Box<dyn Future<Output = Result<Self::Response, Self::Error>> + Send>>;
+
+    fn poll_ready(&mut self, _: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+        Poll::Ready(Ok(()))
+    }
+
+    fn call(&mut self, _: hyper::http::Uri) -> Self::Future {
+        let addr = self.addr;
+        Box::pin(TcpStream::connect(addr))
+    }
+}
+
+/// Sends an HTTP/2 request over TLS using `HyperBsslConnector` and verifies
+/// that a hyper HTTP/2 server receives and responds correctly.
+#tokio::test
+async fn test_hyper_h2_roundtrip() {
+    // Bind to an ephemeral port.
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+
+    // Set up the TLS server context.
+    let mut server_ctx_builder = TlsContextBuilder::new_tls();
+    server_ctx_builder
+        .with_credential(server_credential())
+        .unwrap();
+    server_ctx_builder.set_alpn_protocols(H2).unwrap();
+    let acceptor = server_ctx_builder.build_tokio_acceptor();
+
+    // Server: accept a connection, do TLS, then serve one HTTP/2 request.
+    let server_fut = async move {
+        let (stream, _) = listener.accept().await.unwrap();
+        let tls_stream = acceptor.accept(stream).await.unwrap();
+
+        hyper::server::conn::http2::Builder::new(hyper_util::rt::TokioExecutor::new())
+            .serve_connection(
+                HyperTokioIo::new(tls_stream),
+                service_fn(|_req| async {
+                    Ok::<_, hyper::Error>(hyper::Response::new(SimpleBody::new(
+                        "hello from h2 server",
+                    )))
+                }),
+            )
+            .await
+            .unwrap();
+    };
+
+    // Client: use HyperBsslConnector to establish TLS, then do HTTP/2.
+    let client_fut = async move {
+        let mock_connector = MockTcpConnector { addr };
+
+        let mut client_ctx_builder = TlsContextBuilder::new_tls();
+        client_ctx_builder.with_certificate_store(&client_cert_store());
+        client_ctx_builder.set_alpn_protocols(H2).unwrap();
+        let connector = client_ctx_builder.build_tokio_connector();
+
+        let mut hyper_connector = HyperBsslConnector::new(mock_connector, connector);
+        let tls_stream = hyper_connector
+            .call("https://localhost/".parse().unwrap())
+            .await
+            .unwrap();
+
+        let (mut sender, conn) = hyper::client::conn::http2::handshake(
+            hyper_util::rt::TokioExecutor::new(),
+            HyperTokioIo::new(tls_stream),
+        )
+        .await
+        .unwrap();
+
+        // Drive the connection in the background.
+        tokio::spawn(async move {
+            conn.await.unwrap();
+        });
+
+        let req = hyper::Request::get("/").body(SimpleBody::empty()).unwrap();
+        let resp = sender.send_request(req).await.unwrap();
+        assert_eq!(resp.status(), 200);
+
+        // Read the response body frame by frame.
+        let body = resp.into_body();
+        let mut body = std::pin::pin!(body);
+        let mut result = Vec::new();
+        while let Some(frame) = futures::future::poll_fn(|cx| body.as_mut().poll_frame(cx)).await {
+            if let Ok(frame) = frame {
+                if let Some(data) = frame.data_ref() {
+                    result.extend_from_slice(data);
+                }
+            }
+        }
+        assert_eq!(result, b"hello from h2 server");
+    };
+
+    tokio::join!(server_fut, client_fut);
+}

boringssl-0.20260813.tar.xz/rust/bssl-tls/src/alpn.rs Added

@@ -0,0 +1,89 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! ALPN configuration and handling.
+//!
+//! The ALPN extension RFC 7301 allows negotiating different application-layer
+//! protocols over a single port.
+//! This is used, for example, to negotiate HTTP/2.
+/// A full list of values is available in IANA.
+///
+/// RFC 7301: <https://datatracker.ietf.org/doc/html/rfc7301>
+/// IANA: <https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids>
+use alloc::vec::Vec;
+
+#derive(Default, Debug, Clone, PartialEq, Eq)
+pub(crate) struct AlpnProtocols(Vec<u8>);
+
+impl AlpnProtocols {
+    /// Append one ALPN protocol to the list.
+    ///
+    /// This method returns `Err` if `config` is empty or longer than 255 bytes, or the list
+    /// would exceed `u16::MAX` bytes.
+    pub fn append_protocol(&mut self, proto: &u8) -> Result<(), ()> {
+        if proto.is_empty() {
+            return Err(());
+        }
+        let Ok(len) = u8::try_from(proto.len()) else {
+            return Err(());
+        };
+        if self.0.len() + 1 + len as usize > u16::MAX as usize {
+            return Err(());
+        }
+
+        self.0.push(len);
+        self.0.extend_from_slice(proto);
+        Ok(())
+    }
+
+    pub fn as_slice(&self) -> &u8 {
+        &self.0
+    }
+}
+
+/// HTTP/2 over TLS protocol identifier.
+pub const H2: &u8 = b"h2";
+
+/// HTTP/2 over plain TCP protocol identifier.
+pub const H2C: &u8 = b"h2c";
+
+/// HTTP/1.1 protocol identifier.
+pub const HTTP11: &u8 = b"http/1.1";
+
+/// WebRTC protocol identifier.
+pub const WEBRTC: &u8 = b"webrtc";
+
+/// Confidential WebRTC protocol identifier.
+pub const CONFIDENTIAL_WEBRTC: &u8 = b"c-webrtc";
+
+/// CoAP over TLS protocol identifier.
+pub const COAP: &u8 = b"coap";
+
+/// CoAP/DTLS protocol identifier.
+pub const COAP_DTLS: &u8 = b"co";
+
+/// HTTP/3 protocol identifier.
+pub const H3: &u8 = b"h3";
+
+/// ACME protocol identifier.
+pub const ACME: &u8 = b"acme-tls/1";
+
+/// IMAP over TLS protocol identifier.
+pub const IMAP: &u8 = b"imap";
+
+/// POP3 over TLS protocol identifier.
+pub const POP3: &u8 = b"pop3";
+
+/// FTP over TLS protocol identifier.
+pub const FTP: &u8 = b"ftp";

boringssl-0.20260813.tar.xz/rust/bssl-tls/src/ciphers.rs Added

@@ -0,0 +1,129 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! TLS Ciphers
+
+use core::{
+    ffi::CStr,
+    ptr::NonNull, //
+};
+
+use crate::config::{
+    CipherSuite,
+    ProtocolVersion, //
+};
+
+/// A TLS cipher suite.
+#derive(Clone, Copy)
+#repr(transparent)
+pub struct CipherDescription(pub(crate) NonNull<bssl_sys::SSL_CIPHER>);
+
+// Safety: `SSL_CIPHER` is immutable and thread-safe.
+unsafe impl Send for CipherDescription {}
+unsafe impl Sync for CipherDescription {}
+
+impl CipherDescription {
+    /// Returns the cipher suite corresponding to the given RFC value.
+    pub fn from_value(value: CipherSuite) -> Option<Self> {
+        let ptr = unsafe {
+            // Safety: the cipher code is valid by construction.
+            bssl_sys::SSL_get_cipher_by_value(value.0)
+        };
+        Self::from_ptr(ptr)
+    }
+
+    pub(crate) fn from_ptr(ptr: *const bssl_sys::SSL_CIPHER) -> Option<Self> {
+        NonNull::new(ptr as *mut _).map(Self)
+    }
+
+    pub(crate) fn ptr(self) -> *const bssl_sys::SSL_CIPHER {
+        self.0.as_ptr()
+    }
+
+    /// Returns the two-byte protocol ID of the cipher suite per IANA.
+    ///
+    /// IANA: <https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4>
+    pub fn id(&self) -> u16 {
+        unsafe {
+            // Safety: the cipher handle is valid.
+            bssl_sys::SSL_CIPHER_get_protocol_id(self.ptr())
+        }
+    }
+
+    /// Returns true if the cipher suite uses an AEAD cipher.
+    pub fn is_aead(&self) -> bool {
+        unsafe {
+            // Safety: the cipher handle is valid.
+            bssl_sys::SSL_CIPHER_is_aead(self.ptr()) != 0
+        }
+    }
+
+    /// Returns true if the cipher suite uses a block cipher.
+    pub fn is_block_cipher(&self) -> bool {
+        unsafe {
+            // Safety: the cipher handle is valid.
+            bssl_sys::SSL_CIPHER_is_block_cipher(self.ptr()) != 0
+        }
+    }
+
+    /// Returns the minimum protocol version required for the cipher suite.
+    pub fn min_version(&self) -> ProtocolVersion {
+        let version = unsafe {
+            // Safety: the cipher handle is valid.
+            bssl_sys::SSL_CIPHER_get_min_version(self.ptr())
+        };
+        let Ok(version) = ProtocolVersion::try_from(version) else {
+            unreachable!("BoringSSL invariant violated")
+        };
+        version
+    }
+
+    /// Returns the maximum protocol version that supports the cipher suite.
+    pub fn max_version(&self) -> ProtocolVersion {
+        let version = unsafe {
+            // Safety: the cipher handle is valid.
+            bssl_sys::SSL_CIPHER_get_max_version(self.ptr())
+        };
+        let Ok(version) = ProtocolVersion::try_from(version) else {
+            unreachable!("BoringSSL invariant violated")
+        };
+        version
+    }
+
+    /// Returns the standard IETF name for the cipher suite.
+    pub fn standard_name(&self) -> &'static str {
+        // Safety: the cipher handle is valid.
+        let ptr = unsafe { bssl_sys::SSL_CIPHER_standard_name(self.ptr()) };
+        // Safety: BoringSSL returns cipher names as static strings which are valid UTF-8.
+        unsafe { CStr::from_ptr(ptr).to_str().unwrap() }
+    }
+
+    /// Returns a string that describes the key-exchange method used by the cipher suite.
+    pub fn kx_name(&self) -> &'static str {
+        // Safety: the cipher handle is valid.
+        let ptr = unsafe { bssl_sys::SSL_CIPHER_get_kx_name(self.ptr()) };
+        // Safety: BoringSSL returns key exchange group names as static strings
+        // which are valid UTF-8.
+        unsafe { CStr::from_ptr(ptr).to_str().unwrap() }
+    }
+}
+
+impl core::fmt::Debug for CipherDescription {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        f.debug_struct("Cipher")
+            .field("id", &self.id())
+            .field("name", &self.standard_name())
+            .finish()
+    }
+}

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/config.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/config.rs Changed

@@ -14,7 +14,6 @@
 
 //! TLS Configurations
 
-use alloc::string::String;
 use core::ffi::c_int;
 
 use bssl_macros::bssl_enum;
@@ -22,6 +21,7 @@
 bssl_enum! {
     /// Protocol version for TLS or DTLS
     #derive(Clone, Copy, PartialEq, Eq)
+    #non_exhaustive
     pub enum ProtocolVersion: u16 {
         /// TLS version 1.2
         Tls12 = bssl_sys::TLS1_2_VERSION as u16,
@@ -63,6 +63,7 @@
 bssl_enum! {
     /// Key exchange groups for TLS or DTLS
     #derive(Clone, Copy, PartialEq, Eq)
+    #non_exhaustive
     pub enum KeyExchangeGroups: u16 {
         /// Key exchange using `ECDH-P256`
         Secp256r1 = bssl_sys::SSL_GROUP_SECP256R1 as u16,
@@ -92,6 +93,7 @@
 
 /// Configuration errors
 #derive(Debug)
+#non_exhaustive
 pub enum ConfigurationError {
     /// Some parameters are specified twice in the list.
     DuplicatedParameters,
@@ -110,6 +112,8 @@
     InvalidIp,
     /// Invalid parameters.
     InvalidParameters,
+    /// Invalid ALPN protocols.
+    InvalidAlpnProtocols,
 }
 
 impl core::fmt::Display for ConfigurationError {
@@ -127,26 +131,11 @@
             ConfigurationError::ValueOutOfRange => f.write_str("value is out of range"),
             ConfigurationError::InvalidIp => f.write_str("invalid IP address"),
             ConfigurationError::InvalidParameters => f.write_str("invalid parameters"),
+            ConfigurationError::InvalidAlpnProtocols => f.write_str("invalid ALPN protocols"),
         }
     }
 }
 
-/// Cipher information
-#derive(Clone)
-#non_exhaustive
-pub struct CipherInfo {
-    /// Protocol ID as assigned by IANA(https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4)
-    pub id: u32,
-    /// IETF Name of the cipher
-    pub ietf_name: String,
-    /// Indicates whether this cipher is an AEAD cipher
-    pub is_aead: bool,
-    /// Indicates whether this cipher is a block cipher
-    pub is_block_cipher: bool,
-    /// Cipher strength in bits
-    pub strength: u16,
-}
-
 /// Supported cipher suites as registered with IANA.
 ///
 /// The following cipher suite values are assigned by IANA and correspond to
@@ -241,49 +230,3 @@
     pub const RsaWith3desEdeCbcSha: Self =
         Self(bssl_sys::SSL_CIPHER_RSA_WITH_3DES_EDE_CBC_SHA as u16);
 }
-
-bssl_enum! {
-    /// Compliance Policy.
-    #derive(Clone, Copy, PartialEq, Eq)
-    pub enum CompliancePolicy: u8 {
-        /// FIPS 202205
-        ///
-        /// This policy configures a TLS connection to use:
-        /// - TLS 1.2 or 1.3;
-        /// - For TLS 1.2, only `ECDHE_RSA|ECDSA_WITH_AES_*_GCM_SHA*`;
-        /// - For TLS 1.3, only `AES-GCM`;
-        /// - P-256 or P-384 for key agreement;
-        /// - For server signatures, only PKCS#1/PSS with SHA256/384/512,
-        ///   or ECDSA with P-256 or P-384 and SHA256/SHA384.
-        Fips202205 = bssl_sys::ssl_compliance_policy_t_ssl_compliance_policy_fips_202205 as u8,
-        /// WPA3-192 202304
-        ///
-        /// This policy configures a TLS connection to use:
-        /// - TLS 1.2 or 1.3.
-        /// - For TLS 1.2, only `TLS_ECDHE_ECDSA|RSA_WITH_AES_256_GCM_SHA384`.
-        /// - For TLS 1.3, only `AES-256-GCM`.
-        /// - P-384 for key agreement.
-        /// - For handshake signatures, only ECDSA with P-384 and SHA-384, or RSA
-        ///     with SHA-384 or SHA-512.
-        ///
-        /// No limitations on the certificate chain nor leaf public key are imposed,
-        /// other than by the supported signature algorithms.
-        /// But WPA3's "192-bit" mode requires at least P-384 or 3072-bit RSA along the chain.
-        /// The caller must enforce this themselves on the verified chain using functions such as
-        /// `crate::credentials::TlsCredentialBuilder::with_certificate_chain`.
-        ///
-        /// Note that this setting is less secure than the default.
-        /// The implementation risks of using a more obscure primitive like P-384 dominate other
-        /// considerations.
-        Wpa3_192_202304 = bssl_sys::ssl_compliance_policy_t_ssl_compliance_policy_wpa3_192_202304 as u8,
-        /// CNSA 202407
-        ///
-        /// This policy configures a TLS connection to use:
-        /// - For TLS 1.3, AES-256-GCM over AES-128-GCM over ChaCha20-Poly1305.
-        ///
-        /// I.e. it ensures that AES-GCM will be used whenever the client supports it.
-        /// The cipher suite configuration mini-language can be used to similarly
-        /// configure prior TLS versions if they are enabled.
-        Cnsa202407 = bssl_sys::ssl_compliance_policy_t_ssl_compliance_policy_cnsa_202407 as u8,
-    }
-}

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/connection.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/connection.rs Changed

boringssl-0.20260813.tar.xz/rust/bssl-tls/src/connection/alpn.rs Added

@@ -0,0 +1,88 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use core::ptr::null;
+
+use bssl_crypto::FromFfiSlice;
+
+use crate::{
+    alpn::AlpnProtocols,
+    config::ConfigurationError,
+    connection::lifecycle::{
+        EstablishedTlsConnection,
+        TlsConnectionInHandshake, //
+    },
+    errors::Error,
+    ffi::slice_into_ffi_raw_parts, //
+};
+
+impl<R, M> TlsConnectionInHandshake<'_, R, M> {
+    /// Set ALPN protocols.
+    ///
+    /// Per RFC 7301, empty protocol names, names longer than 255 bytes are invalid.
+    /// Also, the total size of the ALPN protocol list must not exceed `u16::MAX` bytes.
+    ///
+    /// **This method has no effect after handshake completion.**
+    ///
+    /// RFC 7301: <https://datatracker.ietf.org/doc/html/rfc7301#section-3.1>
+    pub fn set_alpn_protocols<'a>(
+        &mut self,
+        protocols: impl IntoIterator<Item = &'a u8>,
+    ) -> Result<&mut Self, Error> {
+        let mut protos = AlpnProtocols::default();
+        for proto in protocols {
+            protos
+                .append_protocol(proto)
+                .map_err(|_| Error::Configuration(ConfigurationError::InvalidAlpnProtocols))?;
+        }
+        let (protos, len) = slice_into_ffi_raw_parts(protos.as_slice());
+        let rc = unsafe {
+            // Safety:
+            // - the validity of the handle `self.ptr()` is witnessed by `self`.
+            // - the validity of ALPN string is guaranteed by `AlpnProtocols` type.
+            // Note: `SSL_set_alpn_protos` flips the return value around.
+            bssl_sys::SSL_set_alpn_protos(self.ptr(), protos, len)
+        };
+        if rc == 1 {
+            Err(Error::extract_lib_err())
+        } else {
+            Ok(self)
+        }
+    }
+}
+
+/// Application-layer Protocol Negotiation.
+impl<R, M> EstablishedTlsConnection<'_, R, M> {
+    /// Get the selected Application-layer Protocol.
+    ///
+    /// This function returns `None` when no ALPN protocol was negotiated.
+    pub fn get_selected_alpn(&self) -> Option<&u8> {
+        let mut name = null();
+        let mut len = 0;
+        unsafe {
+            // Safety: the validity of the handle `self.ptr()` is witnessed by `self`.
+            bssl_sys::SSL_get0_alpn_selected(self.ptr(), &raw mut name, &raw mut len);
+        }
+        let Ok(len) = usize::try_from(len) else {
+            panic!("invalid slice length")
+        };
+        let proto = unsafe {
+            // Safety:
+            // - `self` outlives the output slice.
+            // - `name` is generated by BoringSSL.
+            u8::from_ffi_ptr(name, len)
+        };
+        (!proto.is_empty()).then_some(proto)
+    }
+}

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/connection/credentials.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/connection/credentials.rs Changed

@@ -18,10 +18,7 @@
 };
 use core::{
     ffi::CStr,
-    ptr::{
-        NonNull,
-        null, //
-    }, //
+    ptr::null, //
 };
 
 use bssl_x509::{
@@ -31,6 +28,7 @@
 
 use super::{
     Client,
+    Server,
     TlsConnection,
     TlsConnectionBuilder,
     lifecycle::{
@@ -46,11 +44,19 @@
     credentials::{
         CertificateType,
         CertificateVerificationMode,
+        DistinguishedName,
         PrivateKeyDelegate,
         SignatureAlgorithm,
         TlsCredential,
         VerifyCertificate,
-        cert_cb, //
+        cert_cb,
+        get_peer_certificate_type,
+        get_peer_raw_public_key,
+        select_cert::{
+            ClientCertificateSelector,
+            ServerCertificateSelector,
+            select_cert_cb, //
+        }, //
     },
     errors::Error,
     ffi::slice_into_ffi_raw_parts,
@@ -86,16 +92,18 @@
         &mut self,
         key_method: Option<Box<dyn PrivateKeyDelegate>>,
     ) -> &mut Self {
-        let ctx = self.0.ptr();
         if key_method.is_some() {
             unsafe {
                 // Safety: we only install our own vtable.
-                bssl_sys::SSL_set_private_key_method(ctx, <M as HasPrivateKeyMethods>::METHODS);
+                bssl_sys::SSL_set_private_key_method(
+                    self.ptr(),
+                    <M as HasPrivateKeyMethods>::METHODS,
+                );
             }
         } else {
             unsafe {
                 // Safety: we only uninstall the vtable.
-                bssl_sys::SSL_set_private_key_method(ctx, core::ptr::null());
+                bssl_sys::SSL_set_private_key_method(self.ptr(), core::ptr::null());
             }
         }
         self.0.get_connection_methods().private_key_delegate = key_method;
@@ -175,6 +183,38 @@
     }
 }
 
+/// # Select certificate - Server
+impl<M> TlsConnectionBuilder<Server, M>
+where
+    M: HasTlsConnectionMethod,
+{
+    /// Set certificate selection callback on **server** side.
+    pub fn with_server_side_certificate_callback<T: 'static + ServerCertificateSelector<M>>(
+        &mut self,
+        cb: T,
+    ) -> &mut Self {
+        self.as_in_handshake()
+            .set_server_side_certificate_callback(cb);
+        self
+    }
+}
+
+/// # Select certificate - Client
+impl<M> TlsConnectionBuilder<Client, M>
+where
+    M: HasTlsConnectionMethod,
+{
+    /// Set certificate selection callback on **client** side.
+    pub fn with_client_side_certificate_callback<T: 'static + ClientCertificateSelector<M>>(
+        &mut self,
+        cb: T,
+    ) -> &mut Self {
+        self.as_in_handshake()
+            .set_client_side_certificate_callback(cb);
+        self
+    }
+}
+
 /// # Custom certificate verification
 impl<R, M> TlsConnectionInHandshake<'_, R, M>
 where
@@ -185,10 +225,9 @@
         &mut self,
         mode: CertificateVerificationMode,
     ) -> &mut Self {
-        let ctx = self.0.ptr();
         unsafe {
             // Safety: this method only updates the mode value.
-            bssl_sys::SSL_set_verify(ctx, mode as _, None);
+            bssl_sys::SSL_set_verify(self.ptr(), mode as _, None);
         }
         self
     }
@@ -202,11 +241,10 @@
     where
         V: VerifyCertificate + 'static,
     {
-        let ctx = self.0.ptr();
         unsafe {
             // Safety: we only install our own vtable.
             bssl_sys::SSL_set_custom_verify(
-                ctx,
+                self.ptr(),
                 mode as _,
                 Some(cert_cb::<super::methods::RustConnectionMethods<M>>),
             );
@@ -217,10 +255,9 @@
 
     /// Remove custom certificate verifier.
     pub fn remove_certificate_verifier(&mut self, mode: CertificateVerificationMode) -> &mut Self {
-        let ctx = self.0.ptr();
         unsafe {
             // Safety: we only uninstall the vtable.
-            bssl_sys::SSL_set_custom_verify(ctx, mode as _, None);
+            bssl_sys::SSL_set_custom_verify(self.ptr(), mode as _, None);
         }
         self.0.get_connection_methods().verify_certificate_methods = None;
         self
@@ -230,7 +267,7 @@
     pub fn get_certificate_verification_mode(&self) -> Option<CertificateVerificationMode> {
         unsafe {
             // Safety: the validity of the handle `self.0` is witnessed by `self`.
-            bssl_sys::SSL_get_verify_mode(self.0.ptr())
+            bssl_sys::SSL_get_verify_mode(self.ptr())
         }
         .try_into()
         .ok()
@@ -249,7 +286,7 @@
     pub fn add_credential(&mut self, credential: &TlsCredential) -> Result<&mut Self, Error> {
         check_lib_error!(unsafe {
             // Safety: `credential` is still valid.
-            bssl_sys::SSL_add1_credential(self.0.ptr(), credential.ptr())
+            bssl_sys::SSL_add1_credential(self.ptr(), credential.ptr())
         });
         Ok(self)
     }
@@ -258,7 +295,57 @@
     pub fn clear_credentials(&mut self) -> &mut Self {
         unsafe {
             // Safety: `credential` is still valid.
-            bssl_sys::SSL_certs_clear(self.0.ptr());
+            bssl_sys::SSL_certs_clear(self.ptr());
+        }
+        self
+    }
+}
+
+/// # Select certificate - Server
+impl<M> TlsConnectionInHandshake<'_, Server, M>
+where
+    M: HasTlsConnectionMethod,
+{
+    /// Set certificate selection callback on **server** side.
+    pub fn set_server_side_certificate_callback<T: 'static + ServerCertificateSelector<M>>(
+        &mut self,
+        cb: T,
+    ) -> &mut Self {
+        let conn = self.ptr();
+        let methods = self.0.get_connection_methods();
+        methods.server_cert_cb = Some(Box::new(cb) as _);
+        unsafe {
+            // Safety: we only install our own vtable.
+            bssl_sys::SSL_set_cert_cb(
+                conn,
+                Some(select_cert_cb::<super::methods::RustConnectionMethods<M>, M>),
+                core::ptr::null_mut(),
+            );
+        }
+        self
+    }
+}
+
+/// # Select certificate - Client
+impl<M> TlsConnectionInHandshake<'_, Client, M>
+where
+    M: HasTlsConnectionMethod,
+{
+    /// Set certificate selection callback on **client** side.
+    pub fn set_client_side_certificate_callback<T: 'static + ClientCertificateSelector<M>>(
+        &mut self,
+        cb: T,
+    ) -> &mut Self {
+        let conn = self.ptr();
+        let methods = self.0.get_connection_methods();
+        methods.client_cert_cb = Some(Box::new(cb) as _);
+        unsafe {
+            // Safety: we only install our own vtable.
+            bssl_sys::SSL_set_cert_cb(
+                conn,
+                Some(select_cert_cb::<super::methods::RustConnectionMethods<M>, M>),
+                core::ptr::null_mut(),
+            );
         }
         self
     }
@@ -275,7 +362,7 @@
     pub fn enable_signed_certificate_timestamps(&mut self) -> &mut Self {
         unsafe {
             // Safety: the validity of the handle `self.0` is witnessed by `self`.
-            bssl_sys::SSL_enable_signed_cert_timestamps(self.0.ptr());
+            bssl_sys::SSL_enable_signed_cert_timestamps(self.ptr());
         }
         self
     }
@@ -290,7 +377,7 @@
             // - the validity of the handle `self.0` is witnessed by `self`.
             // - when pending handshake, the assignment is always successful.
             // - `SSL_set1_verify_cert_store` bumps the ref-count on the store.
-            bssl_sys::SSL_set1_verify_cert_store(self.0.ptr(), store.as_mut_ptr());
+            bssl_sys::SSL_set1_verify_cert_store(self.ptr(), store.as_mut_ptr());
         }
         self
     }
@@ -314,7 +401,7 @@
         let (prefs, prefs_len) = slice_into_ffi_raw_parts(algs);
         check_lib_error!(unsafe {
             // Safety: the validity of the handle `self.0` is witnessed by `self`.
-            bssl_sys::SSL_set_verify_algorithm_prefs(self.0.ptr(), prefs, prefs_len)
+            bssl_sys::SSL_set_verify_algorithm_prefs(self.ptr(), prefs, prefs_len)
         });
         Ok(self)
     }
@@ -330,7 +417,21 @@
             // Safety:
             // - the validity of the handle `self.0` is witnessed by `self`.
             // - the host name string has been sanitised for internal NUL-bytes and NUL-terminated.
-            bssl_sys::SSL_set1_host(self.0.ptr(), host_name.as_ptr())
+            bssl_sys::SSL_set1_host(self.ptr(), host_name.as_ptr())
+        });
+        Ok(self)
+    }
+
+    /// Set SNI extension hostname.
+    pub fn set_tlsext_host_name(&mut self, host_name: &str) -> Result<&mut Self, Error> {
+        let host_name = CString::new(host_name)
+            .map_err(|_| Error::Configuration(ConfigurationError::InvalidString))?;
+        check_lib_error!(unsafe {
+            // Safety:
+            // - the validity of the handle `self.0` is witnessed by `self`.
+            // - the host name string has been sanitised for internal NUL-bytes and NUL-terminated.
+            // - BoringSSL copies the string internally, so the pointer does not need to outlive the call.
+            bssl_sys::SSL_set_tlsext_host_name(self.0.ptr(), host_name.as_ptr())
         });
         Ok(self)
     }
@@ -345,7 +446,7 @@
             .map_err(|_| Error::Configuration(ConfigurationError::ValueOutOfRange))?;
         unsafe {
             // Safety: the validity of the handle `self.0` is witnessed by `self`.
-            bssl_sys::SSL_set_verify_depth(self.0.ptr(), depth);
+            bssl_sys::SSL_set_verify_depth(self.ptr(), depth);
         }
         Ok(self)
     }
@@ -356,7 +457,7 @@
     pub fn get_verify_depth(&self) -> Option<u16> {
         unsafe {
             // Safety: the validity and state of the handle `self.0` is witnessed by `self`.
-            bssl_sys::SSL_get_verify_depth(self.0.ptr()).try_into().ok()
+            bssl_sys::SSL_get_verify_depth(self.ptr()).try_into().ok()
         }
     }
 
@@ -369,7 +470,7 @@
             // Safety:
             // - the validity of the handle `self.0` is witnessed by `self`.
             // - `SSL_set1_param` claims shared ownership of `params` by bumping ref-count.
-            bssl_sys::SSL_set1_param(self.0.ptr(), params.as_ptr())
+            bssl_sys::SSL_set1_param(self.ptr(), params.as_ptr())
         });
         Ok(self)
     }
@@ -379,10 +480,12 @@
 impl<R, M> TlsConnectionInHandshake<'_, R, M> {
     /// Disable session creation.
     pub fn disable_session(&mut self) -> &mut Self {
-        let ptr = self.0.ptr();
         unsafe {
             // Safety: the validity of the handle `ptr` is witnessed by `self`.
-            bssl_sys::SSL_set_mode(ptr, super::ConnectionMode::MODE_NO_SESSION_CREATION.bits());
+            bssl_sys::SSL_set_mode(
+                self.ptr(),
+                super::ConnectionMode::MODE_NO_SESSION_CREATION.bits(),
+            );
         }
         self
     }
@@ -391,7 +494,7 @@
     pub fn set_session(&mut self, session: &crate::sessions::TlsSession) -> &mut Self {
         unsafe {
             // Safety: self.ptr and session.0 are valid.
-            bssl_sys::SSL_set_session(self.0.ptr.as_ptr(), session.0.as_ptr());
+            bssl_sys::SSL_set_session(self.ptr(), session.ptr());
         }
         self
     }
@@ -409,7 +512,7 @@
             // Safety:
             // - `self.ptr()` is a valid handle.
             // - `CertificateType` is a `u8` with acceptable values by construction.
-            bssl_sys::SSL_set1_accepted_peer_cert_types(self.0.ptr(), types as *const _, types_len)
+            bssl_sys::SSL_set1_accepted_peer_cert_types(self.ptr(), types as *const _, types_len)
         });
         Ok(self)
     }
@@ -460,23 +563,66 @@
 
 impl<R, M> TlsConnection<R, M> {
     /// Get the peer's `CertificateType`.
+    ///
+    /// Returns `None` if the handshake has not completed.
     pub fn get_peer_certificate_type(&self) -> Option<CertificateType> {
-        let ty = unsafe {
-            // Safety:
-            // - `self.ptr()` is a valid `SSL` handle.
-            bssl_sys::SSL_get_peer_cert_type(self.ptr())
-        };
-        ty.try_into().ok().and_then(|ty: u8| ty.try_into().ok())
+        if self.is_in_handshake() {
+            return None;
+        }
+        get_peer_certificate_type(self.ptr())
     }
 
     /// Get the peer's raw public key as DER-encoded `SubjectPublicKeyInfo`.
+    ///
+    /// Returns `None` if the handshake has not completed.
     pub fn get_peer_raw_public_key(&self) -> Option<Vec<u8>> {
-        let pkey = unsafe {
-            // Safety:
-            // - `self.ptr()` is a valid `SSL` handle.
-            // - `pkey` does not escape the current function frame.
-            NonNull::new(bssl_sys::SSL_get0_peer_rpk(self.ptr()))?
-        };
-        Some(crate::credentials::marshal_evp_into_spki(pkey))
+        if self.is_in_handshake() {
+            return None;
+        }
+        get_peer_raw_public_key(self.ptr())
+    }
+}
+
+/// # Certificate authorities - Client
+///
+/// TLS can send a list of supported certificate authorities to guide the peer in certificate
+/// selection.
+impl<M> TlsConnectionInHandshake<'_, Client, M> {
+    /// This setting advertises the list of certificate authorities names in the
+    /// `certificate_authorities` extension to send the client.
+    pub fn set_ca_acceptable_by_client(
+        &mut self,
+        names: impl IntoIterator<Item = DistinguishedName>,
+    ) -> &mut Self {
+        unsafe {
+            // Safety: this call only transfers the ownership of the stack.
+            bssl_sys::SSL_set0_CA_names(
+                self.ptr(),
+                DistinguishedName::into_crypto_buffer_stack(names),
+            )
+        }
+        self
+    }
+}
+
+/// # Certificate authorities - Server
+///
+/// TLS can send a list of supported certificate authorities to guide the peer in certificate
+/// selection.
+impl<M> TlsConnectionInHandshake<'_, Server, M> {
+    /// This setting advertises the list of certificate authorities names in the
+    /// `certificate_authorities` extension to send the server.
+    pub fn set_ca_acceptable_by_server(
+        &mut self,
+        names: impl IntoIterator<Item = DistinguishedName>,
+    ) -> &mut Self {
+        unsafe {
+            // Safety: this call only transfers the ownership of the stack.
+            bssl_sys::SSL_set0_client_CAs(
+                self.ptr(),
+                DistinguishedName::into_crypto_buffer_stack(names),
+            )
+        }
+        self
     }
 }

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/connection/lifecycle.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/connection/lifecycle.rs Changed

@@ -19,21 +19,27 @@
     string::ToString, //
 };
 use core::{
+    ffi::c_int,
     future::poll_fn,
     ops::{
         Deref,
         DerefMut, //
     },
+    ptr::NonNull,
     task::Poll, //
 };
 
 use crate::{
+    HandshakeCompleteMethods,
+    Methods,
+    abort_on_panic,
     alerts::AlertDescription,
     check_tls_error,
     connection::{
         Client,
         Server,
         TlsConnection,
+        TlsConnectionBuilder,
         methods::HasTlsConnectionMethod, //
     },
     context::{
@@ -41,6 +47,7 @@
         SupportedMode,
         TlsMode, //
     },
+    credentials::TlsCredential,
     errors::{
         Error,
         TlsErrorReason,
@@ -90,14 +97,7 @@
     /// Access handshake-related options if a handshake is completed and
     /// the connection is initialised.
     pub fn established<'a>(&'a mut self) -> Option<EstablishedTlsConnection<'a, R, M>> {
-        let session = unsafe {
-            // Safety: the validity of the handle `self.0` is witnessed by `self`.
-            bssl_sys::SSL_get_session(self.ptr())
-        };
-        if session.is_null() {
-            return None;
-        }
-        Some(EstablishedTlsConnection(self))
+        (!self.is_in_handshake()).then_some(EstablishedTlsConnection(self))
     }
 }
 
@@ -175,6 +175,12 @@
 #repr(transparent)
 pub struct TlsConnectionInHandshake<'a, R, M>(pub(crate) &'a mut TlsConnection<R, M>);
 
+impl<R, M> TlsConnectionInHandshake<'_, R, M> {
+    pub(crate) fn ptr(&self) -> *mut bssl_sys::SSL {
+        self.0.ptr()
+    }
+}
+
 /// # Handshake
 impl<R, M> TlsConnection<R, M>
 where
@@ -240,17 +246,6 @@
     }
 }
 
-impl<'a, R, M> EstablishedTlsConnection<'a, R, M> {
-    /// Get the current session.
-    pub fn get_session(&self) -> Option<crate::sessions::TlsSession> {
-        let session = unsafe {
-            // Safety: self.ptr() is valid.
-            bssl_sys::SSL_get1_session(self.ptr())
-        };
-        core::ptr::NonNull::new(session).map(crate::sessions::TlsSession)
-    }
-}
-
 impl<R, M> EstablishedTlsConnection<'_, R, M>
 where
     M: HasTlsConnectionMethod + HasBasicIo,
@@ -360,3 +355,105 @@
     /// The read half of the connection reaches the end of the stream.
     EndOfStream,
 }
+
+bssl_macros::bssl_enum! {
+    enum InfoCallbackConnectionState : i32 {
+        ReadAlert = bssl_sys::SSL_CB_READ_ALERT as i32,
+        WriteAlert = bssl_sys::SSL_CB_WRITE_ALERT as i32,
+        HandshakeStart = bssl_sys::SSL_CB_HANDSHAKE_START as i32,
+        HandshakeDone = bssl_sys::SSL_CB_HANDSHAKE_DONE as i32,
+    }
+}
+
+/// A callback that allows you to inspect the handshake information when the handshake concludes
+/// successfully.
+pub trait HandshakeComplete: Send {
+    /// The callback to be called when handshake is complete with success.
+    fn handshake_complete(&mut self, hs: &HandshakeInfo);
+}
+
+/// A handle to extract handshake information, such as credential.
+pub struct HandshakeInfo(NonNull<bssl_sys::SSL>);
+
+impl HandshakeInfo {
+    /// Return the selected credential for the connection.
+    pub fn get_selected_credential(&self) -> Option<TlsCredential> {
+        let cred = unsafe {
+            // Safety: by BoringSSL invariant, `self.0` is still a valid connection handle.
+            bssl_sys::SSL_get0_selected_credential(self.0.as_ptr())
+        };
+        NonNull::new(cred as *mut _).map(TlsCredential::from_raw_and_upref)
+    }
+}
+
+unsafe extern "C" fn info_callback<M: Methods + HandshakeCompleteMethods>(
+    ssl: *const bssl_sys::SSL,
+    ty: c_int,
+    _: c_int,
+) {
+    // Safety: the const-to-mut cast is safe; we only mutate our own method table, not SSL.
+    let Some(ssl) = NonNull::new(ssl as *mut _) else {
+        return;
+    };
+    let Some(state) = InfoCallbackConnectionState::try_from(ty).ok() else {
+        return;
+    };
+    abort_on_panic(move || {
+        match state {
+            InfoCallbackConnectionState::HandshakeDone => {
+                let Some(mut callback) = (unsafe {
+                    // Safety: `ssl` is a valid handle passed in from BoringSSL.
+                    M::from_ssl(ssl.as_ptr())
+                })
+                .and_then(|methods| methods.handshake_complete_methods()) else {
+                    return;
+                };
+                callback.handshake_complete(&HandshakeInfo(ssl));
+            }
+            InfoCallbackConnectionState::ReadAlert
+            | InfoCallbackConnectionState::WriteAlert
+            | InfoCallbackConnectionState::HandshakeStart => {}
+        }
+    });
+}
+
+/// # Handshake-complete callback
+impl<R, M> TlsConnectionBuilder<R, M>
+where
+    M: HasTlsConnectionMethod,
+{
+    /// Set a callback to be called when the handshake completes successfully.
+    ///
+    /// The callback receives a `HandshakeInfo` handle that can be used to
+    /// inspect the result of the handshake, such as the selected credential.
+    pub fn with_handshake_complete_callback(
+        &mut self,
+        callback: impl HandshakeComplete + 'static,
+    ) -> &mut Self {
+        self.as_in_handshake()
+            .set_handshake_complete_callback(callback);
+        self
+    }
+}
+
+/// # Handshake completion notification callback
+impl<R, M> TlsConnectionInHandshake<'_, R, M>
+where
+    M: HasTlsConnectionMethod,
+{
+    /// Set a callback to be called when the handshake completes successfully.
+    pub fn set_handshake_complete_callback(
+        &mut self,
+        callback: impl HandshakeComplete + 'static,
+    ) -> &mut Self {
+        unsafe {
+            // Safety: we only install our own callback function.
+            bssl_sys::SSL_set_info_callback(
+                self.ptr(),
+                Some(info_callback::<super::methods::RustConnectionMethods<M>>),
+            );
+        }
+        self.0.get_connection_methods().handshake_complete = Some(Box::new(callback));
+        self
+    }
+}

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/connection/methods.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/connection/methods.rs Changed

@@ -19,7 +19,6 @@
         c_long,
         c_void, //
     },
-    marker::PhantomData,
     ptr::{
         NonNull,
         null_mut, //
@@ -30,14 +29,19 @@
 use once_cell::sync::Lazy;
 
 use crate::{
+    CertCallback,
+    HandshakeCompleteMethods,
     Methods,
+    MethodsRef,
     PrivateKeyMethods,
     VerifyCertificateMethods,
     abort_on_panic,
     context::{
+        DtlsExternalVerifierMode,
         DtlsMode,
         QuicMode,
-        TlsMode, //
+        TlsExternalVerifierMode, //
+        TlsMode,
     },
     credentials::{
         PrivateKeyDelegate,
@@ -48,6 +52,10 @@
             complete,
             decrypt,
             sign, //
+        },
+        select_cert::{
+            ClientCertificateSelector,
+            ServerCertificateSelector, //
         }, //
     },
     errors::TlsRetryReason,
@@ -63,9 +71,12 @@
     pub private_key_delegate: Option<Box<dyn PrivateKeyDelegate>>,
     /// Certificate verifier handle.
     pub verify_certificate_methods: Option<Box<dyn VerifyCertificate>>,
+    /// Handshake-complete callback.
+    pub handshake_complete: Option<Box<dyn super::lifecycle::HandshakeComplete>>,
+    pub server_cert_cb: Option<Box<dyn ServerCertificateSelector<Mode>>>,
+    pub client_cert_cb: Option<Box<dyn ClientCertificateSelector<Mode>>>,
     /// A mailbox to propagate IO retrying reasons.
     pub pending_reason: Option<TlsRetryReason>,
-    _p: PhantomData<fn() -> Mode>,
 }
 
 impl<M> RustConnectionMethods<M> {
@@ -74,8 +85,10 @@
             bio: None,
             private_key_delegate: None,
             verify_certificate_methods: None,
+            handshake_complete: None,
+            server_cert_cb: None,
+            client_cert_cb: None,
             pending_reason: None,
-            _p: PhantomData,
         }
     }
 
@@ -95,7 +108,7 @@
     }
 }
 
-impl<Mode: HasTlsConnectionMethod> Methods for RustConnectionMethods<Mode> {
+impl<Mode: HasTlsConnectionMethod> MethodsRef for RustConnectionMethods<Mode> {
     unsafe extern "C" fn from_ssl<'a>(ssl: *mut bssl_sys::SSL) -> Option<&'a Self> {
         unsafe {
             // Safety: `ssl` is originated from `TlsConnection::from_ssl`.
@@ -104,7 +117,23 @@
                 !methods.is_null(),
                 "connection method should have been attached at construction time"
             );
-            // Safety: `ctx` is originated from `Box::into_raw`
+            // Safety: `methods` is originated from `Box::into_raw`
+            Some(&*(methods as *const RustConnectionMethods<Mode>))
+        }
+    }
+}
+
+impl<Mode: HasTlsConnectionMethod> Methods for RustConnectionMethods<Mode> {
+    unsafe extern "C" fn from_ssl<'a>(ssl: *mut bssl_sys::SSL) -> Option<&'a mut Self> {
+        unsafe {
+            // Safety: `ssl` is originated from `TlsConnection::from_ssl`.
+            let methods = bssl_sys::SSL_get_ex_data(ssl, Mode::registration());
+            debug_assert!(
+                !methods.is_null(),
+                "connection method should have been attached at construction time"
+            );
+            // Safety: `methods` is originated from `Box::into_raw`.
+            // The caller must ensure exclusive access to the connection.
             Some(&mut *(methods as *mut RustConnectionMethods<Mode>))
         }
     }
@@ -122,6 +151,24 @@
     }
 }
 
+impl<M: HasTlsConnectionMethod> HandshakeCompleteMethods for RustConnectionMethods<M> {
+    fn handshake_complete_methods(
+        &mut self,
+    ) -> Option<Box<dyn super::lifecycle::HandshakeComplete>> {
+        self.handshake_complete.take()
+    }
+}
+
+impl<M: HasTlsConnectionMethod> CertCallback<M> for RustConnectionMethods<M> {
+    fn server_cert_cb(&self) -> Option<&(dyn ServerCertificateSelector<M> + 'static)> {
+        self.server_cert_cb.as_deref()
+    }
+
+    fn client_cert_cb(&self) -> Option<&(dyn ClientCertificateSelector<M> + 'static)> {
+        self.client_cert_cb.as_deref()
+    }
+}
+
 // NOTE(@xfding): the reason that we are not using the `register_ex_data` macro is because
 // declarative macros today cannot handle generics well enough.
 fn register_tls_connection_vtable<Mode: HasTlsConnectionMethod>() -> c_int {
@@ -300,63 +347,54 @@
     fn registration() -> c_int;
 }
 
-impl HasTlsConnectionMethod for TlsMode {
-    #inline(always)
-    fn registration() -> c_int {
-        static TLS_CONTEXT_METHOD: Lazy<c_int> =
-            Lazy::new(register_tls_connection_vtable::<TlsMode>);
-        *TLS_CONTEXT_METHOD
-    }
-}
-
-impl HasTlsConnectionMethod for DtlsMode {
-    #inline(always)
-    fn registration() -> c_int {
-        static TLS_CONTEXT_METHOD: Lazy<c_int> =
-            Lazy::new(register_tls_connection_vtable::<DtlsMode>);
-        *TLS_CONTEXT_METHOD
-    }
+macro_rules! impl_has_tls_connection_method {
+    ($($mode:ty),+ $(,)?) => {
+        $(
+            impl HasTlsConnectionMethod for $mode {
+                #inline(always)
+                fn registration() -> c_int {
+                    static TLS_CONTEXT_METHOD: Lazy<c_int> =
+                        Lazy::new(register_tls_connection_vtable::<$mode>);
+                    *TLS_CONTEXT_METHOD
+                }
+            }
+        )+
+    };
 }
 
-impl HasTlsConnectionMethod for QuicMode {
-    #inline(always)
-    fn registration() -> c_int {
-        static TLS_CONTEXT_METHOD: Lazy<c_int> =
-            Lazy::new(register_tls_connection_vtable::<QuicMode>);
-        *TLS_CONTEXT_METHOD
-    }
+impl_has_tls_connection_method! {
+    TlsMode,
+    TlsExternalVerifierMode,
+    DtlsMode,
+    DtlsExternalVerifierMode,
+    QuicMode,
 }
 
 pub(super) trait HasPrivateKeyMethods {
     const METHODS: *const bssl_sys::SSL_PRIVATE_KEY_METHOD;
 }
 
-impl HasPrivateKeyMethods for TlsMode {
-    const METHODS: *const bssl_sys::SSL_PRIVATE_KEY_METHOD = {
-        &bssl_sys::SSL_PRIVATE_KEY_METHOD {
-            sign: Some(sign::<RustConnectionMethods<TlsMode>>),
-            decrypt: Some(decrypt::<RustConnectionMethods<TlsMode>>),
-            complete: Some(complete::<RustConnectionMethods<TlsMode>>),
-        } as _
-    };
-}
-
-impl HasPrivateKeyMethods for DtlsMode {
-    const METHODS: *const bssl_sys::SSL_PRIVATE_KEY_METHOD = {
-        &bssl_sys::SSL_PRIVATE_KEY_METHOD {
-            sign: Some(sign::<RustConnectionMethods<DtlsMode>>),
-            decrypt: Some(decrypt::<RustConnectionMethods<DtlsMode>>),
-            complete: Some(complete::<RustConnectionMethods<DtlsMode>>),
-        } as _
+macro_rules! impl_private_key_methods {
+    ($wrapper:ident, $($mode:ty),+ $(,)?) => {
+        $(
+            impl HasPrivateKeyMethods for $mode {
+                const METHODS: *const bssl_sys::SSL_PRIVATE_KEY_METHOD = {
+                    &bssl_sys::SSL_PRIVATE_KEY_METHOD {
+                        sign: Some(sign::<$wrapper<$mode>>),
+                        decrypt: Some(decrypt::<$wrapper<$mode>>),
+                        complete: Some(complete::<$wrapper<$mode>>),
+                    } as _
+                };
+            }
+        )+
     };
 }
 
-impl HasPrivateKeyMethods for QuicMode {
-    const METHODS: *const bssl_sys::SSL_PRIVATE_KEY_METHOD = {
-        &bssl_sys::SSL_PRIVATE_KEY_METHOD {
-            sign: Some(sign::<RustConnectionMethods<QuicMode>>),
-            decrypt: Some(decrypt::<RustConnectionMethods<QuicMode>>),
-            complete: Some(complete::<RustConnectionMethods<QuicMode>>),
-        } as _
-    };
+impl_private_key_methods! {
+    RustConnectionMethods,
+    TlsMode,
+    DtlsMode,
+    QuicMode,
+    TlsExternalVerifierMode,
+    DtlsExternalVerifierMode,
 }

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/connection/transport.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/connection/transport.rs Changed

@@ -15,7 +15,10 @@
 //! TLS Connection transport settings
 //!
 
-use core::mem::{MaybeUninit, transmute};
+use core::mem::{
+    MaybeUninit,
+    transmute, //
+};
 
 use crate::{
     check_lib_error,
@@ -26,6 +29,7 @@
         TlsConnectionBuilder,
         methods::HasTlsConnectionMethod, //
     },
+    context::DtlsMode,
     context::HasBasicIo,
     errors::Error,
     io::{
@@ -77,60 +81,6 @@
         Ok(self)
     }
 
-    /// **For DTLS only**, trigger timeout handling on the connection.
-    ///
-    /// On success, this method call returns `true` when a timeout is hit and successfully handled;
-    /// `false` when no timeout has expired yet.
-    pub fn dtlsv1_handle_timeout(&mut self) -> Result<bool, Error> {
-        let conn = self.ptr();
-        let rc = unsafe {
-            // Safety: the connection handle here is still valid.
-            bssl_sys::DTLSv1_handle_timeout(conn)
-        };
-        if rc == 0 {
-            return Ok(false);
-        }
-        let _ = check_tls_error!(conn, rc);
-        Ok(true)
-    }
-
-    /// **For DTLS only**, get connection's remaining timeout.
-    ///
-    /// If a timeout is in effect, this method call returns the remaining seconds,
-    /// followed by the remaining microseconds.
-    pub fn dtlsv1_get_timeout(&self) -> Option<(i64, i64)> {
-        #cfg(windows)
-        #repr(C)
-        struct timeval {
-            tv_sec: core::ffi::c_long,
-            tv_usec: core::ffi::c_long,
-        }
-        #cfg(not(windows))
-        use bssl_sys::timeval;
-
-        let mut timeval = MaybeUninit::<timeval>::zeroed();
-        let rc = unsafe {
-            // Safety:
-            // - the validity of the handle `self.0` is witnessed by `self`;
-            // - the buffer for timeval is valid.
-            // - on Windows, the timeval structure should match the winsock2.h definition precisely.
-            bssl_sys::DTLSv1_get_timeout(self.ptr(), transmute(timeval.as_mut_ptr()))
-        };
-        match rc {
-            1 => {
-                let timeval = unsafe {
-                    // Safety: timeval is now valid as per BoringSSL specification.
-                    timeval.assume_init()
-                };
-                Some((timeval.tv_sec as i64, timeval.tv_usec as i64))
-            }
-            0 => None,
-            rc => {
-                unreachable!("BoringSSL should never return {rc} when calling dtlsv1_get_timeout")
-            }
-        }
-    }
-
     /// Check if the underlying **transport** has closed its write end.
     pub fn is_write_closed(&self) -> bool {
         self.get_connection_methods_ref()
@@ -185,3 +135,60 @@
         Ok(self)
     }
 }
+
+/// # DTLS
+impl<R> TlsConnection<R, DtlsMode> {
+    /// Trigger timeout handling on the connection.
+    ///
+    /// On success, this method call returns `true` when a timeout is hit and successfully handled;
+    /// `false` when no timeout has expired yet.
+    pub fn dtlsv1_handle_timeout(&mut self) -> Result<bool, Error> {
+        let conn = self.ptr();
+        let rc = unsafe {
+            // Safety: the connection handle here is still valid.
+            bssl_sys::DTLSv1_handle_timeout(conn)
+        };
+        if rc == 0 {
+            return Ok(false);
+        }
+        let _ = check_tls_error!(conn, rc);
+        Ok(true)
+    }
+
+    /// Get connection's remaining timeout.
+    ///
+    /// If a timeout is in effect, this method call returns the remaining seconds,
+    /// followed by the remaining microseconds.
+    pub fn dtlsv1_get_timeout(&self) -> Option<(i64, i64)> {
+        #cfg(windows)
+        #repr(C)
+        struct timeval {
+            tv_sec: core::ffi::c_long,
+            tv_usec: core::ffi::c_long,
+        }
+        #cfg(not(windows))
+        use bssl_sys::timeval;
+
+        let mut timeval = MaybeUninit::<timeval>::zeroed();
+        let rc = unsafe {
+            // Safety:
+            // - the validity of the handle `self.0` is witnessed by `self`;
+            // - the buffer for timeval is valid.
+            // - on Windows, the timeval structure should match the winsock2.h definition precisely.
+            bssl_sys::DTLSv1_get_timeout(self.ptr(), transmute(timeval.as_mut_ptr()))
+        };
+        match rc {
+            1 => {
+                let timeval = unsafe {
+                    // Safety: timeval is now valid as per BoringSSL specification.
+                    timeval.assume_init()
+                };
+                Some((timeval.tv_sec as i64, timeval.tv_usec as i64))
+            }
+            0 => None,
+            rc => {
+                unreachable!("BoringSSL should never return {rc} when calling dtlsv1_get_timeout")
+            }
+        }
+    }
+}

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/context.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/context.rs Changed

@@ -26,7 +26,6 @@
 use crate::{
     check_lib_error,
     config::{
-        CompliancePolicy,
         ConfigurationError,
         KeyExchangeGroupFlag,
         KeyExchangeGroups,
@@ -49,6 +48,7 @@
     Server, //
 };
 
+mod alpn;
 mod credentials;
 mod methods;
 mod sessions;
@@ -62,8 +62,28 @@
 /// QUIC mode
 pub enum QuicMode {}
 
+/// TLS mode without built-in X.509 support.
+///
+/// This mode uses `TLS_with_buffers_method`, which avoids all use of crypto/x509.
+/// All client connections will fail unless a certificate verifier is installed with
+/// `TlsContextBuilder::with_certificate_verifier`.
+pub enum TlsExternalVerifierMode {}
+
+/// DTLS mode without built-in X.509 support.
+///
+/// This mode uses `DTLS_with_buffers_method`, which avoids all use of crypto/x509.
+/// All client connections will fail unless a certificate verifier is installed with
+/// `TlsContextBuilder::with_certificate_verifier`.
+pub enum DtlsExternalVerifierMode {}
+
 pub(crate) trait HasBasicIo {}
 
+/// A marker trait for modes that have built-in X.509 support.
+pub trait UseBuiltinX509 {}
+
+impl UseBuiltinX509 for TlsMode {}
+impl UseBuiltinX509 for DtlsMode {}
+
 /// A collection of supported mode of operations.
 pub trait SupportedMode:
     HasTlsContextMethod + HasTlsConnectionMethod + HasPrivateKeyMethods
@@ -73,9 +93,13 @@
 impl SupportedMode for TlsMode {}
 impl SupportedMode for DtlsMode {}
 impl SupportedMode for QuicMode {}
+impl SupportedMode for TlsExternalVerifierMode {}
+impl SupportedMode for DtlsExternalVerifierMode {}
 
 impl HasBasicIo for TlsMode {}
 impl HasBasicIo for DtlsMode {}
+impl HasBasicIo for TlsExternalVerifierMode {}
+impl HasBasicIo for DtlsExternalVerifierMode {}
 
 /// General TLS configuration
 ///
@@ -142,6 +166,34 @@
     }
 }
 
+/// # Make a TLS context builder without built-in X.509 support
+impl TlsContextBuilder<TlsExternalVerifierMode> {
+    /// Creates a new TLS context builder without X.509 support.
+    ///
+    /// All client connections will fail unless a certificate verifier is installed
+    /// with `TlsContextBuilder::with_certificate_verifier`.
+    pub fn new_tls_no_x509() -> Self {
+        Self::new_inner(unsafe {
+            // Safety: this call returns a static immutable data
+            bssl_sys::TLS_with_buffers_method()
+        })
+    }
+}
+
+/// # Make a DTLS context builder without built-in X.509 support
+impl TlsContextBuilder<DtlsExternalVerifierMode> {
+    /// Creates a new DTLS context builder without X.509 support.
+    ///
+    /// All client connections will fail unless a certificate verifier is installed
+    /// with `TlsContextBuilder::with_certificate_verifier`.
+    pub fn new_dtls_no_x509() -> Self {
+        Self::new_inner(unsafe {
+            // Safety: this call returns a static immutable data
+            bssl_sys::DTLS_with_buffers_method()
+        })
+    }
+}
+
 /// # Configure the context through a context builder
 impl<M> TlsContextBuilder<M>
 where
@@ -364,6 +416,19 @@
     }
 }
 
+#cfg(feature = "std")
+impl TlsContextBuilder<TlsMode> {
+    /// Builds and returns a synchronous `TlsConnector` using the configured context.
+    pub fn build_connector(self) -> crate::sync_io::TlsConnector {
+        crate::sync_io::TlsConnector::new(self.build())
+    }
+
+    /// Builds and returns a synchronous `TlsAcceptor` using the configured context.
+    pub fn build_acceptor(self) -> crate::sync_io::TlsAcceptor {
+        crate::sync_io::TlsAcceptor::new(self.build())
+    }
+}
+
 impl<M> Drop for TlsContextBuilder<M> {
     fn drop(&mut self) {
         unsafe {
@@ -391,21 +456,12 @@
 where
     M: HasTlsContextMethod + HasTlsConnectionMethod,
 {
-    fn new_connection(
-        &self,
-        compliance_policy: Option<CompliancePolicy>,
-    ) -> NonNull<bssl_sys::SSL> {
+    fn new_connection(&self) -> NonNull<bssl_sys::SSL> {
         let conn = unsafe {
             // Safety: in this type-state, our SSL_CTX is effectively immutable,
             // so we can freely alias.
             bssl_sys::SSL_new(self.ptr())
         };
-        if let Some(policy) = compliance_policy {
-            unsafe {
-                // Safety: `policy` is a valid enum value per construction.
-                bssl_sys::SSL_set_compliance_policy(conn, policy as _);
-            }
-        }
         NonNull::new(conn).expect("allocation failure")
     }
 
@@ -415,11 +471,8 @@
     /// from the server.
     /// To override this default, use
     /// `TlsConnectionBuilder::with_certificate_verification_mode`.
-    pub fn new_client_connection(
-        &self,
-        compliance_policy: Option<CompliancePolicy>,
-    ) -> Result<TlsConnectionBuilder<Client, M>, Error> {
-        let conn = self.new_connection(compliance_policy);
+    pub fn new_client_connection(&self) -> TlsConnectionBuilder<Client, M> {
+        let conn = self.new_connection();
         unsafe {
             // Safety: the connection is still valid here
             bssl_sys::SSL_set_connect_state(conn.as_ptr());
@@ -430,20 +483,17 @@
         builder.with_certificate_verification_mode(
             crate::credentials::CertificateVerificationMode::PeerCertRequested,
         );
-        Ok(builder)
+        builder
     }
 
     /// Make a new server-half connection inheriting the configuration of this context
-    pub fn new_server_connection(
-        &self,
-        compliance_policy: Option<CompliancePolicy>,
-    ) -> Result<TlsConnectionBuilder<Server, M>, Error> {
-        let conn = self.new_connection(compliance_policy);
+    pub fn new_server_connection(&self) -> TlsConnectionBuilder<Server, M> {
+        let conn = self.new_connection();
         unsafe {
             // Safety: the connection is still valid here
             bssl_sys::SSL_set_accept_state(conn.as_ptr());
         }
-        Ok(TlsConnectionBuilder::from_ssl(conn))
+        TlsConnectionBuilder::from_ssl(conn)
     }
 
     /// Expose the fully built BoringSSL's `SSL_CTX` pointer.

boringssl-0.20260813.tar.xz/rust/bssl-tls/src/context/alpn.rs Added

@@ -0,0 +1,59 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use super::TlsContextBuilder;
+
+use crate::{
+    alpn::AlpnProtocols,
+    config::ConfigurationError,
+    context::SupportedMode,
+    errors::Error,
+    ffi::slice_into_ffi_raw_parts, //
+};
+
+/// ALPN configurations.
+impl<M: SupportedMode> TlsContextBuilder<M> {
+    /// Set ALPN protocols.
+    ///
+    /// By passing an empty `AlpnProtocols` this method disables ALPN.
+    ///
+    /// Per RFC 7301, empty protocol names, names longer than 255 bytes are invalid.
+    /// Also, the total size of the ALPN protocol list must not exceed `u16::MAX` bytes.
+    ///
+    /// RFC 7301: <https://datatracker.ietf.org/doc/html/rfc7301#section-3.1>
+    pub fn set_alpn_protocols<'a>(
+        &mut self,
+        protocols: impl IntoIterator<Item = &'a u8>,
+    ) -> Result<&mut Self, Error> {
+        let mut protos = AlpnProtocols::default();
+        for proto in protocols {
+            protos
+                .append_protocol(proto)
+                .map_err(|_| Error::Configuration(ConfigurationError::InvalidAlpnProtocols))?;
+        }
+        let (protos, len) = slice_into_ffi_raw_parts(protos.as_slice());
+        let rc = unsafe {
+            // Safety:
+            // - the validity of the handle `self.ptr()` is witnessed by `self`.
+            // - the validity of ALPN string is guaranteed by `AlpnProtocols` type.
+            // Note: `SSL_CTX_set_alpn_protos` flips the return value around for error signal.
+            bssl_sys::SSL_CTX_set_alpn_protos(self.ptr(), protos, len)
+        };
+        if rc == 1 {
+            Err(Error::extract_lib_err())
+        } else {
+            Ok(self)
+        }
+    }
+}

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/context/credentials.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/context/credentials.rs Changed

@@ -26,11 +26,15 @@
     context::{
         CertificateCache,
         SupportedMode,
-        methods::HasPrivateKeyMethods, //
+        methods::{
+            HasPrivateKeyMethods,
+            RustContextMethods, //
+        }, //
     },
     credentials::{
         CertificateType,
         CertificateVerificationMode,
+        DistinguishedName,
         PrivateKeyDelegate,
         SignatureAlgorithm,
         TlsCredential,
@@ -38,8 +42,13 @@
         cert_cb,
         early_callback::{
             EarlyCallback,
-            early_select_cert_cb, //
+            early_cb, //
         }, //
+        select_cert::{
+            ClientCertificateSelector,
+            ServerCertificateSelector,
+            select_cert_cb, //
+        },
     },
     errors::Error,
     ffi::slice_into_ffi_raw_parts,
@@ -175,7 +184,7 @@
             // Safety: we only install our own vtable.
             bssl_sys::SSL_CTX_set_select_certificate_cb(
                 ctx,
-                Some(early_select_cert_cb::<M, super::methods::RustContextMethods<M>>),
+                Some(early_cb::<M, super::methods::RustContextMethods<M>>),
             );
         }
         self.get_context_methods().early_callback_handler = Some(Box::new(handler) as _);
@@ -239,8 +248,56 @@
     }
 }
 
-/// # Certificate verification
-impl<M> TlsContextBuilder<M> {
+/// # Certificate selection
+impl<M: SupportedMode> TlsContextBuilder<M> {
+    /// Set certificate selection callback on **client** side.
+    pub fn with_client_side_certificate_callback<T: 'static + ClientCertificateSelector<M>>(
+        &mut self,
+        cb: T,
+    ) -> &mut Self {
+        let ctx = self.ptr();
+        let methods = self.get_context_methods();
+        methods.client_cert_cb = Some(Box::new(cb) as _);
+        unsafe {
+            // Safety: we only install our own vtable.
+            bssl_sys::SSL_CTX_set_cert_cb(
+                ctx,
+                Some(select_cert_cb::<RustContextMethods<M>, M>),
+                null_mut(),
+            );
+        }
+        self
+    }
+
+    /// Set certificate selection callback on **server** side.
+    pub fn with_server_side_certificate_callback<T: 'static + ServerCertificateSelector<M>>(
+        &mut self,
+        cb: T,
+    ) -> &mut Self {
+        let ctx = self.ptr();
+        let methods = self.get_context_methods();
+        methods.server_cert_cb = Some(Box::new(cb) as _);
+        unsafe {
+            // Safety: we only install our own vtable.
+            bssl_sys::SSL_CTX_set_cert_cb(
+                ctx,
+                Some(select_cert_cb::<RustContextMethods<M>, M>),
+                null_mut(),
+            );
+        }
+        self
+    }
+}
+
+/// # Certificate verification, X.509
+///
+/// These methods require built-in X.509 support and are not available for
+/// `TlsExternalVerifierMode`(super::TlsExternalVerifierMode) or
+/// `DtlsExternalVerifierMode`(super::DtlsExternalVerifierMode).
+impl<M> TlsContextBuilder<M>
+where
+    M: super::UseBuiltinX509,
+{
     /// Set certificate verification parameters.
     pub fn with_certificate_verification_params(
         &mut self,
@@ -282,7 +339,10 @@
         }
         self
     }
+}
 
+/// # Signature algorithm preferences
+impl<M> TlsContextBuilder<M> {
     /// Set a preference list of signature algorithms for verification.
     ///
     /// This method returns `ConfigurationError::InvalidParameters` if the list of algorithms
@@ -333,3 +393,25 @@
         Ok(self)
     }
 }
+
+/// # Certificate authorities - Server
+///
+/// TLS can send a list of supported certificate authorities to guide the peer in certificate
+/// selection.
+impl<M> TlsContextBuilder<M> {
+    /// This setting advertises the list of certificate authorities names in the
+    /// `certificate_authorities` extension to send the client.
+    pub fn set_ca_names(
+        &mut self,
+        names: impl IntoIterator<Item = DistinguishedName>,
+    ) -> &mut Self {
+        unsafe {
+            // Safety: this call only transfers the ownership of the stack.
+            bssl_sys::SSL_CTX_set0_client_CAs(
+                self.ptr(),
+                DistinguishedName::into_crypto_buffer_stack(names),
+            )
+        }
+        self
+    }
+}

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/context/methods.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/context/methods.rs Changed

@@ -14,21 +14,23 @@
 
 use core::{
     ffi::c_int,
-    marker::PhantomData,
     ptr::null_mut, //
 };
 
 use once_cell::sync::Lazy;
 
 use crate::{
+    CertCallback,
     EarlyCallbackMethods,
-    Methods,
+    MethodsRef,
     PrivateKeyMethods,
     VerifyCertificateMethods,
     context::{
+        DtlsExternalVerifierMode,
         DtlsMode,
         QuicMode,
-        TlsMode, //
+        TlsExternalVerifierMode, //
+        TlsMode,
     },
     credentials::{
         PrivateKeyDelegate,
@@ -38,6 +40,10 @@
             complete,
             decrypt,
             sign, //
+        },
+        select_cert::{
+            ClientCertificateSelector,
+            ServerCertificateSelector, //
         }, //
     },
     methods::drop_box_rust_methods, //
@@ -47,7 +53,8 @@
     pub(crate) private_key_methods: Option<Box<dyn PrivateKeyDelegate>>,
     pub(crate) verify_certificate_methods: Option<Box<dyn VerifyCertificate>>,
     pub(crate) early_callback_handler: Option<Box<dyn EarlyCallback<M>>>,
-    _p: PhantomData<fn() -> M>,
+    pub(crate) server_cert_cb: Option<Box<dyn ServerCertificateSelector<M>>>,
+    pub(crate) client_cert_cb: Option<Box<dyn ClientCertificateSelector<M>>>,
 }
 
 // NOTE(@xfding): the reason we do not use `register_ex_data` for this type is because we need to
@@ -58,12 +65,13 @@
             private_key_methods: None,
             verify_certificate_methods: None,
             early_callback_handler: None,
-            _p: PhantomData,
+            server_cert_cb: None,
+            client_cert_cb: None,
         }
     }
 }
 
-impl<M: HasTlsContextMethod> Methods for RustContextMethods<M> {
+impl<M: HasTlsContextMethod> MethodsRef for RustContextMethods<M> {
     unsafe extern "C" fn from_ssl<'a>(ssl: *mut bssl_sys::SSL) -> Option<&'a Self> {
         unsafe {
             // Safety: `ssl` must be still valid by BoringSSL invariant.
@@ -73,8 +81,8 @@
             }
             // Safety: `ctx` is originated from `TlsContext::new_inner`.
             let methods = bssl_sys::SSL_CTX_get_ex_data(ctx, M::registration());
-            // Safety: `ctx` is originated from `Box::into_raw`
-            Some(&mut *(methods as *mut RustContextMethods<_>))
+            // Safety: `methods` is originated from `Box::into_raw`
+            Some(&*(methods as *const RustContextMethods<_>))
         }
     }
 }
@@ -97,6 +105,16 @@
     }
 }
 
+impl<M: HasTlsContextMethod> CertCallback<M> for RustContextMethods<M> {
+    fn server_cert_cb(&self) -> Option<&(dyn ServerCertificateSelector<M> + 'static)> {
+        self.server_cert_cb.as_deref()
+    }
+
+    fn client_cert_cb(&self) -> Option<&(dyn ClientCertificateSelector<M> + 'static)> {
+        self.client_cert_cb.as_deref()
+    }
+}
+
 fn register_tls_context_vtable<M: HasTlsContextMethod>() -> c_int {
     unsafe {
         // Safety: this a one-time registration uses only valid function pointers.
@@ -119,58 +137,54 @@
     fn registration() -> c_int;
 }
 
-impl HasTlsContextMethod for TlsMode {
-    #inline(always)
-    fn registration() -> c_int {
-        static TLS_CONTEXT_METHOD: Lazy<c_int> = Lazy::new(register_tls_context_vtable::<TlsMode>);
-        *TLS_CONTEXT_METHOD
-    }
-}
-
-impl HasTlsContextMethod for DtlsMode {
-    #inline(always)
-    fn registration() -> c_int {
-        static TLS_CONTEXT_METHOD: Lazy<c_int> = Lazy::new(register_tls_context_vtable::<DtlsMode>);
-        *TLS_CONTEXT_METHOD
-    }
+macro_rules! impl_has_tls_context_method {
+    ($($mode:ty),+ $(,)?) => {
+        $(
+            impl HasTlsContextMethod for $mode {
+                #inline(always)
+                fn registration() -> c_int {
+                    static TLS_CONTEXT_METHOD: Lazy<c_int> =
+                        Lazy::new(register_tls_context_vtable::<$mode>);
+                    *TLS_CONTEXT_METHOD
+                }
+            }
+        )+
+    };
 }
 
-impl HasTlsContextMethod for QuicMode {
-    #inline(always)
-    fn registration() -> c_int {
-        static TLS_CONTEXT_METHOD: Lazy<c_int> = Lazy::new(register_tls_context_vtable::<QuicMode>);
-        *TLS_CONTEXT_METHOD
-    }
+impl_has_tls_context_method! {
+    TlsMode,
+    TlsExternalVerifierMode,
+    DtlsMode,
+    DtlsExternalVerifierMode,
+    QuicMode,
 }
 
 pub(super) trait HasPrivateKeyMethods {
     const METHODS: *const bssl_sys::SSL_PRIVATE_KEY_METHOD;
 }
 
-impl HasPrivateKeyMethods for TlsMode {
-    const METHODS: *const bssl_sys::SSL_PRIVATE_KEY_METHOD = {
-        &bssl_sys::SSL_PRIVATE_KEY_METHOD {
-            sign: Some(sign::<RustContextMethods<TlsMode>>),
-            decrypt: Some(decrypt::<RustContextMethods<TlsMode>>),
-            complete: Some(complete::<RustContextMethods<TlsMode>>),
-        } as _
-    };
-}
-impl HasPrivateKeyMethods for DtlsMode {
-    const METHODS: *const bssl_sys::SSL_PRIVATE_KEY_METHOD = {
-        &bssl_sys::SSL_PRIVATE_KEY_METHOD {
-            sign: Some(sign::<RustContextMethods<DtlsMode>>),
-            decrypt: Some(decrypt::<RustContextMethods<DtlsMode>>),
-            complete: Some(complete::<RustContextMethods<DtlsMode>>),
-        } as _
+macro_rules! impl_private_key_methods {
+    ($wrapper:ident, $($mode:ty),+ $(,)?) => {
+        $(
+            impl HasPrivateKeyMethods for $mode {
+                const METHODS: *const bssl_sys::SSL_PRIVATE_KEY_METHOD = {
+                    &bssl_sys::SSL_PRIVATE_KEY_METHOD {
+                        sign: Some(sign::<$wrapper<$mode>>),
+                        decrypt: Some(decrypt::<$wrapper<$mode>>),
+                        complete: Some(complete::<$wrapper<$mode>>),
+                    } as _
+                };
+            }
+        )+
     };
 }
-impl HasPrivateKeyMethods for QuicMode {
-    const METHODS: *const bssl_sys::SSL_PRIVATE_KEY_METHOD = {
-        &bssl_sys::SSL_PRIVATE_KEY_METHOD {
-            sign: Some(sign::<RustContextMethods<QuicMode>>),
-            decrypt: Some(decrypt::<RustContextMethods<QuicMode>>),
-            complete: Some(complete::<RustContextMethods<QuicMode>>),
-        } as _
-    };
+
+impl_private_key_methods! {
+    RustContextMethods,
+    TlsMode,
+    TlsExternalVerifierMode,
+    DtlsMode,
+    DtlsExternalVerifierMode,
+    QuicMode,
 }

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/credentials.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/credentials.rs Changed

@@ -40,9 +40,10 @@
     }, //
 };
 
+use bssl_crypto::FromFfiSlice;
 use bssl_x509::{
     errors::PemReason,
-    keys::PrivateKey, //
+    keys::{PrivateKey, PublicKey},
 };
 
 use crate::{
@@ -65,7 +66,9 @@
     ffi::{
         Alloc,
         Bio,
-        sanitize_slice,
+        CryptoBufferWrapper,
+        Stack,
+        StackIterator,
         slice_into_ffi_raw_parts, //
     },
     has_duplicates, //
@@ -73,6 +76,7 @@
 
 pub mod early_callback;
 pub(crate) mod methods;
+pub mod select_cert;
 
 /// TLS credentials builder
 pub struct TlsCredentialBuilder<Mode>(NonNull<bssl_sys::SSL_CREDENTIAL>, PhantomData<fn() -> Mode>);
@@ -83,10 +87,10 @@
 /// Raw Public Key credential
 pub enum RawPublicKeyMode {}
 
-pub(crate) trait NeedsPrivateKey {}
+pub(crate) trait HasPrivateKey {}
 
-impl NeedsPrivateKey for X509Mode {}
-impl NeedsPrivateKey for RawPublicKeyMode {}
+impl HasPrivateKey for X509Mode {}
+impl HasPrivateKey for RawPublicKeyMode {}
 
 // Safety: At this type state, the credential handle is exclusively owned.
 unsafe impl<M> Send for TlsCredentialBuilder<M> {}
@@ -149,78 +153,20 @@
         );
         this.set_ex_data()
     }
-}
-
-impl TlsCredentialBuilder<RawPublicKeyMode> {
-    /// Construct raw public key credential instance.
-    ///
-    /// TLS connection may use this credential to perform authentication per RFC 7250.
-    ///
-    /// RFC 7250: <https://tools.ietf.org/html/rfc7250>
-    pub fn new_raw_public_key(mut key: PrivateKey) -> Self {
-        let this = Self(
-            NonNull::new(unsafe {
-                // Safety:
-                // - the `PrivateKey` type already contains both public and private key parts.
-                // - the constructor call also claims the ownership of the key.
-                bssl_sys::SSL_CREDENTIAL_new_raw_public_key(key.as_mut_ptr())
-            })
-            .expect("allocation failure"),
-            PhantomData,
-        );
-        this.set_ex_data()
-    }
-}
-
-impl<M> TlsCredentialBuilder<M>
-where
-    M: NeedsPrivateKey,
-{
-    /// Set `SignatureAlgorithm` preferences.
-    ///
-    /// This controls which signature algorithms will be used with this credential.
-    pub fn with_signing_algorithm_preferences(
-        &mut self,
-        algs: &SignatureAlgorithm,
-    ) -> Result<&mut Self, Error> {
-        let algs: &u16 = unsafe {
-            // Safety: `SignatureAlgorithm` has a `repr(u16)`
-            core::mem::transmute(algs)
-        };
-        if has_duplicates(algs) {
-            return Err(Error::Configuration(
-                ConfigurationError::DuplicatedParameters,
-            ));
-        }
-        let (ptr, len) = slice_into_ffi_raw_parts(algs);
-        check_lib_error!(unsafe {
-            // Safety
-            bssl_sys::SSL_CREDENTIAL_set1_signing_algorithm_prefs(self.ptr(), ptr, len)
-        });
-        Ok(self)
-    }
 
     /// Set private key delegate.
     ///
     /// This will override the `TlsConnection` private key delegate.
     pub fn with_private_key_delegate<T: 'static + PrivateKeyDelegate>(
         &mut self,
-        key_method: Option<T>,
+        key_method: T,
     ) -> &mut Self {
         let cred = self.ptr();
-        if let Some(key_method) = key_method {
-            unsafe {
-                // Safety: we only install our own vtable.
-                bssl_sys::SSL_CREDENTIAL_set_private_key_method(cred, methods::PRIVATE_KEY_METHODS);
-            }
-            self.get_credential_methods().private_key_methods = Some(Box::new(key_method) as _);
-        } else {
-            unsafe {
-                // Safety: we only uninstall the vtable.
-                bssl_sys::SSL_CREDENTIAL_set_private_key_method(cred, core::ptr::null());
-            }
-            self.get_credential_methods().private_key_methods.take();
+        unsafe {
+            // Safety: we only install our own vtable.
+            bssl_sys::SSL_CREDENTIAL_set_private_key_method(cred, methods::PRIVATE_KEY_METHODS);
         }
+        self.get_credential_methods().private_key_methods = Some(Box::new(key_method) as _);
         self
     }
 
@@ -245,9 +191,6 @@
             Ok(self)
         }
     }
-}
-
-impl TlsCredentialBuilder<X509Mode> {
     /// Set certificate chain.
     ///
     /// The leaf, also known as end-entity, certificate **must come first** in `certs`.
@@ -303,6 +246,85 @@
     }
 }
 
+impl TlsCredentialBuilder<RawPublicKeyMode> {
+    /// Construct raw public key credential instance.
+    ///
+    /// TLS connection may use this credential to perform authentication per RFC 7250.
+    ///
+    /// RFC 7250: <https://tools.ietf.org/html/rfc7250>
+    pub fn new_raw_public_key(mut key: PrivateKey) -> Self {
+        let this = Self(
+            NonNull::new(unsafe {
+                // Safety:
+                // - the `PrivateKey` type already contains both public and private key parts.
+                // - the constructor call also claims the ownership of the key.
+                bssl_sys::SSL_CREDENTIAL_new_raw_public_key(key.as_mut_ptr())
+            })
+            .expect("allocation failure"),
+            PhantomData,
+        );
+        this.set_ex_data()
+    }
+
+    /// Construct raw public key credential, with a private key delegate.
+    ///
+    /// This credential is suitable for cases where the private key is stored off the device or in a
+    /// credential store.
+    /// TLS connection may use this credential to perform authentication per RFC 7250.
+    ///
+    /// RFC 7250: <https://tools.ietf.org/html/rfc7250>
+    pub fn new_raw_public_key_with_delegate<T: PrivateKeyDelegate + 'static>(
+        mut key: PublicKey,
+        delegate: T,
+    ) -> Self {
+        let mut this = Self(
+            NonNull::new(unsafe {
+                // Safety:
+                // - the `PublicKey` type contains the public key part.
+                // - the constructor bumps the ref-count on the public key.
+                bssl_sys::SSL_CREDENTIAL_new_raw_public_key_custom(
+                    key.as_mut_ptr(),
+                    methods::PRIVATE_KEY_METHODS,
+                )
+            })
+            .expect("allocation failure"),
+            PhantomData,
+        )
+        .set_ex_data();
+        this.get_credential_methods().private_key_methods = Some(Box::new(delegate) as _);
+        this
+    }
+}
+
+impl<M> TlsCredentialBuilder<M>
+where
+    M: HasPrivateKey,
+{
+    /// Set `SignatureAlgorithm` preferences.
+    ///
+    /// This controls which signature algorithms will be used with this credential.
+    pub fn with_signing_algorithm_preferences(
+        &mut self,
+        algs: &SignatureAlgorithm,
+    ) -> Result<&mut Self, Error> {
+        let algs: &u16 = unsafe {
+            // Safety: `SignatureAlgorithm` has a `repr(u16)`
+            core::mem::transmute(algs)
+        };
+        if has_duplicates(algs) {
+            return Err(Error::Configuration(
+                ConfigurationError::DuplicatedParameters,
+            ));
+        }
+        let (ptr, len) = slice_into_ffi_raw_parts(algs);
+        check_lib_error!(unsafe {
+            // Safety
+            bssl_sys::SSL_CREDENTIAL_set1_signing_algorithm_prefs(self.ptr(), ptr, len)
+        });
+        Ok(self)
+    }
+}
+
 impl<M> TlsCredentialBuilder<M> {
     /// Finalise the credential.
     pub fn build(mut self) -> Option<TlsCredential> {
@@ -325,6 +347,7 @@
 ///
 /// RFC 9258: <https://datatracker.ietf.org/doc/html/rfc9258#section-5.1>
 #derive(Clone, Copy, Debug, Eq, PartialEq, Hash)
+#non_exhaustive
 pub enum PskHash {
     /// SHA-256
     Sha256,
@@ -358,6 +381,14 @@
         self.0.as_ptr()
     }
 
+    pub(crate) fn from_raw_and_upref(cred: NonNull<bssl_sys::SSL_CREDENTIAL>) -> Self {
+        unsafe {
+            // Safety: we are only bumping the ref-count.
+            bssl_sys::SSL_CREDENTIAL_up_ref(cred.as_ptr());
+        }
+        Self(cred)
+    }
+
     /// Create a new pre-shared key credential for TLS 1.3.
     ///
     /// See RFC 9258(https://datatracker.ietf.org/doc/html/rfc9258) for details.
@@ -390,6 +421,24 @@
         let cred = NonNull::new(cred).ok_or_else(|| Error::extract_lib_err())?;
         Ok(TlsCredential(cred))
     }
+
+    /// Return the external identity of this pre-shared key credential.
+    ///
+    /// Returns `None` if this credential is not a pre-shared key credential.
+    pub fn get_pre_shared_key_id(&self) -> Option<&u8> {
+        let mut id_len: usize = 0;
+        let id_ptr = unsafe {
+            // Safety: `self.0` is a valid `SSL_CREDENTIAL` handle.
+            bssl_sys::SSL_CREDENTIAL_get0_pre_shared_key_id(self.ptr(), &mut id_len)
+        };
+        if id_ptr.is_null() {
+            return None;
+        }
+        unsafe {
+            // Safety: `id_ptr` will be outlived by `self`.
+            Some(u8::from_ffi_ptr(id_ptr, id_len))
+        }
+    }
 }
 
 impl Clone for TlsCredential {
@@ -496,12 +545,10 @@
             if buf.to_bytes() != b"CERTIFICATE" {
                 continue;
             }
-            let Some(contents) = (unsafe {
+            let contents = unsafe {
                 // Safety: the slice is only used within the loop and we will copy the contents
                 // when constructing the certificate object.
-                sanitize_slice(data.0, len)
-            }) else {
-                return Err(Error::Io(IoError::TooLong));
+                u8::from_ffi_ptr(data.0, len)
             };
             let cert = Certificate::from_bytes(contents, cache)?;
             return Ok((cert, eof));
@@ -519,7 +566,7 @@
         };
         unsafe {
             // Safety: `data` will be outlived by `self`
-            sanitize_slice(data, len).expect("buffer is too large")
+            u8::from_ffi_ptr(data, len)
         }
     }
 }
@@ -592,7 +639,7 @@
 ///
 /// This protocol allows for asynchronous signing and decryption operations.
 /// BoringSSL will call one of `Self::sign` or `Self::decrypt` for operation initiation,
-/// and call `Self::complete` to poll for completion as long as
+/// and call `PrivateKeyOperation::complete` to poll for completion as long as
 /// `PrivateKeyOperationResult::Pending` is returned.
 pub trait PrivateKeyDelegate: Send + Sync {
     /// Sign operation.
@@ -699,6 +746,7 @@
     ///
     /// IANA: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-16
     #derive(Debug, Copy, Clone, PartialEq, Eq, Hash)
+    #non_exhaustive
     pub enum SignatureAlgorithm: u16 {
         /// IANA entry `rsa_pkcs1_sha256`
         RsaPkcs1Sha256 = bssl_sys::SSL_SIGN_RSA_PKCS1_SHA256 as u16,
@@ -759,7 +807,7 @@
             core::mem::transmute(call_slice_getter!(
                 bssl_sys::SSL_get0_ech_name_override,
                 self.ptr()
-            )?)
+            ))
         };
         if name.is_empty() || !name.is_ascii() {
             return None;
@@ -776,7 +824,7 @@
     /// RFC 2560: <https://datatracker.ietf.org/doc/html/rfc6960>
     pub fn get_ocsp_response(&self) -> Option<&u8> {
         // Safety: response, when it exists, is outlived by the connection.
-        let response = call_slice_getter!(bssl_sys::SSL_get0_ocsp_response, self.ptr())?;
+        let response = call_slice_getter!(bssl_sys::SSL_get0_ocsp_response, self.ptr());
         (!response.is_empty()).then_some(response)
     }
 
@@ -785,7 +833,7 @@
     /// RFC 6962: <https://datatracker.ietf.org/doc/html/rfc6962#section-3.2>
     pub fn get_signed_cert_timestamp_list(&self) -> Option<&u8> {
         // Safety: list, when it exists, is outlived by the connection.
-        let list = call_slice_getter!(bssl_sys::SSL_get0_signed_cert_timestamp_list, self.ptr())?;
+        let list = call_slice_getter!(bssl_sys::SSL_get0_signed_cert_timestamp_list, self.ptr());
         (!list.is_empty()).then_some(list)
     }
 
@@ -918,67 +966,55 @@
 /// Certificate chain iterator.
 ///
 /// This iterator will supply the peer leaf certificate as the first element in the chain, if any.
+pub type CertificateChainIterator<'a> = CryptoBufferIterator<'a, Certificate>;
+
 #derive(Clone, Copy)
-pub struct CertificateChainIterator<'a> {
-    certs: *const bssl_sys::stack_st_CRYPTO_BUFFER,
-    len: usize,
-    curr: usize,
-    _p: PhantomData<&'a ()>,
+#doc(hidden)
+pub struct CryptoBufferIterator<'a, T> {
+    inner: StackIterator<'a, bssl_sys::CRYPTO_BUFFER>,
+    _p: PhantomData<fn() -> T>,
 }
 
-impl<'a> CertificateChainIterator<'a> {
-    /// Safety: caller must ensure that `certs` is outlived by,
-    /// or in other words stays alive as long as, `'a`.
-    pub(crate) unsafe fn new(certs: *const bssl_sys::stack_st_CRYPTO_BUFFER) -> Self {
-        let len = if certs.is_null() {
-            0
-        } else {
-            unsafe {
-                // Safety: `certs` is valid now.
-                bssl_sys::sk_CRYPTO_BUFFER_num(certs)
-            }
-        };
+impl<T: CryptoBufferWrapper> CryptoBufferIterator<'_, T> {
+    /// Safety: caller must ensure that `sk` outlives `'a`.
+    pub(crate) unsafe fn new(sk: *const bssl_sys::stack_st_CRYPTO_BUFFER) -> Self {
         Self {
-            certs,
-            len,
-            curr: 0,
+            inner: unsafe {
+                // Safety: `sk` outlives `'a` per pre-condition.
+                StackIterator::new(sk)
+            },
             _p: PhantomData,
         }
     }
 }
 
-impl<'a> Iterator for CertificateChainIterator<'a> {
-    type Item = Certificate;
+impl<T: CryptoBufferWrapper> Iterator for CryptoBufferIterator<'_, T> {
+    type Item = T;
 
     fn next(&mut self) -> Option<Self::Item> {
-        if self.curr >= self.len {
-            return None;
-        }
-        let cert = unsafe {
-            // Safety: `self.certs` is still valid now and `self.curr` is within the bound.
-            bssl_sys::sk_CRYPTO_BUFFER_value(self.certs, self.curr)
-        };
-        self.curr += 1;
-        let Some(cert) = NonNull::new(cert) else {
-            // Fuse the iterator.
-            self.curr = self.len;
-            return None;
-        };
-        unsafe {
-            // Safety: `cert` is valid here.
-            bssl_sys::CRYPTO_BUFFER_up_ref(cert.as_ptr());
-        }
-        Some(Certificate(cert))
+        self.inner
+            .next()
+            .map(|buf| unsafe {
+                // Safety: we are only bumping the ref-count
+                bssl_sys::CRYPTO_BUFFER_dup_ref(buf)
+            })
+            .and_then(|ptr| NonNull::new(ptr as *mut _))
+            .map(|buf| {
+                unsafe {
+                    // Safety: `buf` is now exclusively owned.
+                    T::from_crypto_buffer(buf)
+                }
+            })
     }
 }
 
-impl ExactSizeIterator for CertificateChainIterator<'_> {
+impl<T: CryptoBufferWrapper> ExactSizeIterator for CryptoBufferIterator<'_, T> {
     fn len(&self) -> usize {
-        self.len - self.curr
+        self.inner.len()
     }
 }
 
-impl FusedIterator for CertificateChainIterator<'_> {}
+impl<T: CryptoBufferWrapper> FusedIterator for CryptoBufferIterator<'_, T> {}
 
 /// Safety: this callback stub must be installed with a context object allocated
 /// as a `Box<dyn VerifyCertificate>`.
@@ -1069,6 +1105,7 @@
     ///
     /// IANA: https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#tls-extensiontype-values-3
     #derive(Debug, Copy, Clone, PartialEq, Eq, Hash)
+    #non_exhaustive
     pub enum CertificateType: u8 {
         /// X.509 certificate type.
         X509 = bssl_sys::TLSEXT_cert_type_x509 as u8,
@@ -1122,5 +1159,53 @@
     buffer.as_ref().to_vec()
 }
 
+/// Get the peer's `CertificateType` from a valid SSL handle.
+///
+/// # Safety
+/// `ssl` must be a valid `SSL` pointer.
+pub(crate) fn get_peer_certificate_type(ssl: *mut bssl_sys::SSL) -> Option<CertificateType> {
+    let ty = unsafe {
+        // Safety: `ssl` is a valid `SSL` handle by caller invariant.
+        bssl_sys::SSL_get_peer_cert_type(ssl)
+    };
+    ty.try_into().ok().and_then(|ty: u8| ty.try_into().ok())
+}
+
+/// Get the peer's raw public key as DER-encoded `SubjectPublicKeyInfo` from a valid SSL handle.
+///
+/// # Safety
+/// `ssl` must be a valid `SSL` pointer.
+pub(crate) fn get_peer_raw_public_key(ssl: *mut bssl_sys::SSL) -> Option<Vec<u8>> {
+    let pkey = unsafe {
+        // Safety: `ssl` is a valid `SSL` handle by caller invariant.
+        // `pkey` does not escape the current function frame.
+        NonNull::new(bssl_sys::SSL_get0_peer_rpk(ssl))?
+    };
+    Some(marshal_evp_into_spki(pkey))
+}
+
+crypto_buffer_wrapper! {
+    /// A name `DistinguishedName` encoded into DER per RFC 5280.
+    /// Typically this is used to enclose a certificate authority name.
+    ///
+    /// RFC 5280: <https://datatracker.ietf.org/doc/html/rfc5280#appendix-A.1>
+    pub struct DistinguishedName
+}
+
+impl DistinguishedName {
+    pub(crate) fn into_crypto_buffer_stack(
+        names: impl IntoIterator<Item = Self>,
+    ) -> *mut bssl_sys::stack_st_CRYPTO_BUFFER {
+        let mut sk = Stack::new();
+        for name in names {
+            unsafe {
+                // Safety: `name` is owned at the moment.
+                sk.push(name.into_raw());
+            }
+        }
+        sk.into_raw()
+    }
+}
+
 #cfg(test)
 mod tests;

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/credentials/early_callback.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/credentials/early_callback.rs Changed

@@ -23,6 +23,8 @@
     }, //
 };
 
+use bssl_crypto::FromFfiSlice;
+
 use crate::{
     EarlyCallbackMethods,
     abort_on_panic,
@@ -30,8 +32,7 @@
     connection::{
         Server,
         lifecycle::TlsConnectionInHandshake, //
-    },
-    ffi::sanitize_slice, //
+    }, //
 };
 
 bssl_macros::bssl_enum! {
@@ -158,7 +159,7 @@
     ($client_hello:expr, $data:ident, $len:ident) => {
         unsafe {
             // Safety: `$client_hello` is a valid pointer
-            sanitize_slice($client_hello.$data, $client_hello.$len)?
+            u8::from_ffi_ptr($client_hello.$data, $client_hello.$len)
         }
     };
 }
@@ -215,22 +216,12 @@
 
     /// Get the legacy compression methods bytes.
     pub fn legacy_compression_methods(&self) -> &'a u8 {
-        unsafe {
-            // Safety: `self.ptr` is a valid pointer to `SSL_CLIENT_HELLO` provided by BoringSSL.
-            sanitize_slice(
-                (*self.ptr).compression_methods,
-                (*self.ptr).compression_methods_len,
-            )
-            .unwrap_or(&)
-        }
+        client_hello_getter!(*self.ptr, compression_methods, compression_methods_len)
     }
 
     /// Get the extensions bytes.
     pub fn extensions(&self) -> &'a u8 {
-        unsafe {
-            // Safety: `self.ptr` is a valid pointer to `SSL_CLIENT_HELLO` provided by BoringSSL.
-            sanitize_slice((*self.ptr).extensions, (*self.ptr).extensions_len).unwrap_or(&)
-        }
+        client_hello_getter!(*self.ptr, extensions, extensions_len)
     }
 
     /// Extract a specific extension from the client hello.
@@ -253,7 +244,7 @@
         if ret == 1 {
             unsafe {
                 // Safety: `out_data` and `out_len` are valid if the function returns 1.
-                sanitize_slice(out_data, out_len)
+                Some(u8::from_ffi_ptr(out_data, out_len))
             }
         } else {
             None
@@ -274,7 +265,8 @@
     fn process(&self, client_hello: &mut ClientHello<'_, M>) -> EarlyCallbackResult;
 }
 
-pub(crate) unsafe extern "C" fn early_select_cert_cb<Mode, MethodsT>(
+// For this callback, MethodsT could only be RustContextMethods<Mode>.
+pub(crate) unsafe extern "C" fn early_cb<Mode, MethodsT>(
     client_hello: *const bssl_sys::SSL_CLIENT_HELLO,
 ) -> bssl_sys::ssl_select_cert_result_t
 where

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/credentials/methods.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/credentials/methods.rs Changed

@@ -22,10 +22,11 @@
     }, //
 };
 
+use bssl_crypto::FromFfiSlice;
 use once_cell::sync::Lazy;
 
 use crate::{
-    Methods,
+    MethodsRef,
     PrivateKeyMethods,
     abort_on_panic,
     connection::methods::private_key_op_from_ssl,
@@ -36,10 +37,6 @@
         SignatureOperation,
         waker_data_from_ssl, //
     },
-    ffi::{
-        sanitise_mut_byteslice,
-        sanitize_slice, //
-    },
     methods::drop_box_rust_methods, //
 };
 
@@ -64,7 +61,7 @@
     pub(crate) private_key_methods: Option<Box<dyn PrivateKeyDelegate>>,
 }
 
-impl Methods for RustCredentialMethods {
+impl MethodsRef for RustCredentialMethods {
     unsafe extern "C" fn from_ssl<'a>(ssl: *mut bssl_sys::SSL) -> Option<&'a Self> {
         unsafe {
             // Safety: `ssl` is valid per BoringSSL invariant.
@@ -77,8 +74,8 @@
             if methods.is_null() {
                 return None;
             }
-            // Safety: `cred` is originated from `Box::into_raw`.
-            Some(&*(methods as *mut RustCredentialMethods))
+            // Safety: `methods` is originated from `Box::into_raw`.
+            Some(&*(methods as *const RustCredentialMethods))
         }
     }
 }
@@ -144,20 +141,16 @@
         // TODO(@xfding) maybe we should log this error?
         Err(_) => return bssl_sys::ssl_private_key_result_t_ssl_private_key_failure,
     };
-    let Some(output) = (unsafe {
-        // Safety: the slice will only be used within this callback.
-        sanitise_mut_byteslice(out, max_out)
-    }) else {
-        return bssl_sys::ssl_private_key_result_t_ssl_private_key_failure;
+    let output = unsafe {
+        // Safety: the slice comes from BoringSSL and it will only be used within this callback.
+        bssl_crypto::zeroize_mut_byteslice(out, max_out)
     };
     if output.is_empty() {
         return bssl_sys::ssl_private_key_result_t_ssl_private_key_failure;
     }
-    let Some(message) = (unsafe {
+    let message = unsafe {
         // Safety: `msg` outlives `message` because it is owned by BoringSSL.
-        sanitize_slice(msg, msg_len)
-    }) else {
-        return bssl_sys::ssl_private_key_result_t_ssl_private_key_failure;
+        u8::from_ffi_ptr(msg, msg_len)
     };
     // Unwind-safety: when panic happens, we will not inspect the `output` buffer.
     abort_on_panic(move || {
@@ -204,20 +197,16 @@
 
     // Unwind-safety: later when panic happens, we detach the poisoned private key method
     // without calling destructor.
-    let Some(output) = (unsafe {
-        // Safety: the slice will only be used within this callback.
-        sanitise_mut_byteslice(out, max_out)
-    }) else {
-        return bssl_sys::ssl_private_key_result_t_ssl_private_key_failure;
+    let output = unsafe {
+        // Safety: the slice comes from BoringSSL and it will only be used within this callback.
+        bssl_crypto::zeroize_mut_byteslice(out, max_out)
     };
     if output.is_empty() {
         return bssl_sys::ssl_private_key_result_t_ssl_private_key_failure;
     }
-    let Some(ciphertext) = (unsafe {
+    let ciphertext = unsafe {
         // Safety: `ciphertext` is now owned by BoringSSL and outlives the slice.
-        sanitize_slice(ciphertext, ciphertext_len)
-    }) else {
-        return bssl_sys::ssl_private_key_result_t_ssl_private_key_failure;
+        u8::from_ffi_ptr(ciphertext, ciphertext_len)
     };
     // Unwind-safety: when panic happens, we will not inspect the `output` buffer.
     abort_on_panic(move || {
@@ -252,11 +241,9 @@
 
     // Unwind-safety: later when panic happens, we detach the poisoned private key method
     // without calling destructor.
-    let Some(output) = (unsafe {
-        // Safety: the slice will only be used within this callback.
-        sanitise_mut_byteslice(out, max_out)
-    }) else {
-        return bssl_sys::ssl_private_key_result_t_ssl_private_key_failure;
+    let output = unsafe {
+        // Safety: the slice comes from BoringSSL and it will only be used within this callback.
+        bssl_crypto::zeroize_mut_byteslice(out, max_out)
     };
     if output.is_empty() {
         return bssl_sys::ssl_private_key_result_t_ssl_private_key_failure;

boringssl-0.20260813.tar.xz/rust/bssl-tls/src/credentials/select_cert.rs Added

@@ -0,0 +1,317 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! TLS certificate selection hook.
+
+use alloc::vec::Vec;
+use core::{
+    ffi::{
+        c_int,
+        c_void, //
+    },
+    marker::PhantomData,
+    ptr::{
+        NonNull,
+        null, //
+    },
+    task::Context,
+};
+
+use bssl_crypto::FromFfiSlice;
+
+use super::{
+    CryptoBufferIterator,
+    DistinguishedName,
+    SignatureAlgorithm,
+    get_peer_certificate_type,
+    get_peer_raw_public_key, //
+};
+use crate::{
+    CertCallback,
+    abort_on_panic,
+    config::ProtocolVersion,
+    connection::methods::waker_data_from_ssl,
+    context::TlsContext, //
+};
+
+/// Result of certificate selection.
+#derive(Debug, Copy, Clone, PartialEq, Eq)
+pub enum CertificateSelectionResult {
+    /// Certificate selection succeeded.
+    Success,
+    /// Certificate selection is pending (e.g. waiting for async operation).
+    /// The handshake will be paused and can be retried later.
+    Pending,
+    /// Certificate selection failed. The handshake will be aborted.
+    Error,
+}
+
+/// Server certificate selection.
+///
+/// Implementations must be `Send + Sync`. If the selector needs mutable state,
+/// use interior mutability (e.g. `Mutex`).
+pub trait ServerCertificateSelector<Mode>: Send + Sync {
+    /// This method should return `CertificateSelectionResult` to indicate the outcome of the selection.
+    fn select(
+        &self,
+        ctx: ServerCertificateSelectionContext<'_, Mode>,
+        waker: Option<&'_ mut Context<'_>>,
+    ) -> CertificateSelectionResult;
+}
+
+/// Client certificate selection.
+///
+/// Implementations must be `Send + Sync`. If the selector needs mutable state,
+/// use interior mutability (e.g. `Mutex`).
+pub trait ClientCertificateSelector<M>: Send + Sync {
+    /// This method should return `CertificateSelectionResult` to indicate the outcome of the selection.
+    fn select(
+        &self,
+        ctx: ClientCertificateSelectionContext<'_, M>,
+        waker: Option<&'_ mut Context<'_>>,
+    ) -> CertificateSelectionResult;
+}
+
+/// Certificate selection callback.
+pub(crate) unsafe extern "C" fn select_cert_cb<M: CertCallback<Mode>, Mode>(
+    ssl: *mut bssl_sys::SSL,
+    _ctx: *mut c_void,
+) -> c_int {
+    let is_server = unsafe {
+        // Safety: `ssl` is still valid by BoringSSL invariant.
+        bssl_sys::SSL_is_server(ssl) == 1
+    };
+    let Some(ssl) = NonNull::new(ssl) else {
+        return 0;
+    };
+    let Some(methods) = (unsafe {
+        // Safety: this callback is installed by this crate so the ex_data index must be valid.
+        M::from_ssl(ssl.as_ptr())
+    }) else {
+        return 0;
+    };
+    let waker = unsafe {
+        // Safety: this callback is installed by this crate so the associated data must have been
+        // set up correctly.
+        waker_data_from_ssl(ssl)
+    };
+    let waker = if let Some(waker) = &waker {
+        Some(&mut core::task::Context::from_waker(waker))
+    } else {
+        None
+    };
+    if is_server {
+        let ctx = ServerCertificateSelectionContext::new(ssl);
+        let Some(server_cert_cb) = methods.server_cert_cb() else {
+            return 1;
+        };
+        match abort_on_panic(move || server_cert_cb.select(ctx, waker)) {
+            CertificateSelectionResult::Success => 1,
+            CertificateSelectionResult::Pending => -1,
+            CertificateSelectionResult::Error => 0,
+        }
+    } else {
+        let ctx = ClientCertificateSelectionContext::new(ssl);
+        let Some(client_cert_cb) = methods.client_cert_cb() else {
+            return 1;
+        };
+        match abort_on_panic(move || client_cert_cb.select(ctx, waker)) {
+            CertificateSelectionResult::Success => 1,
+            CertificateSelectionResult::Pending => -1,
+            CertificateSelectionResult::Error => 0,
+        }
+    }
+}
+
+/// Server certificate selection context.
+#repr(transparent)
+pub struct ServerCertificateSelectionContext<'a, Mode>(
+    NonNull<bssl_sys::SSL>,
+    PhantomData<&'a fn() -> Mode>,
+);
+
+impl<'a, M> ServerCertificateSelectionContext<'a, M> {
+    pub(crate) fn new(ssl: NonNull<bssl_sys::SSL>) -> Self {
+        Self(ssl, PhantomData)
+    }
+
+    /// Switch context.
+    pub fn set_context(&mut self, ctx: &TlsContext<M>) {
+        unsafe {
+            // Safety: `self.0` is still valid by BoringSSL invariant.
+            bssl_sys::SSL_set_SSL_CTX(self.0.as_ptr(), ctx.ptr());
+        }
+    }
+
+    /// Append `credential` to the list of credentials of this connection.
+    ///
+    /// Earlier calls to this method append a credential that is preferred over those added
+    /// in later calls.
+    pub fn add_credential(
+        &mut self,
+        credential: &super::TlsCredential,
+    ) -> Result<(), super::super::errors::Error> {
+        crate::check_lib_error!(unsafe {
+            // Safety: both `self.0` and `credential` are still valid.
+            bssl_sys::SSL_add1_credential(self.0.as_ptr(), credential.ptr())
+        });
+        Ok(())
+    }
+
+    /// Get the peer's `CertificateType`(super::CertificateType).
+    pub fn get_peer_certificate_type(&self) -> Option<super::CertificateType> {
+        get_peer_certificate_type(self.0.as_ptr())
+    }
+
+    /// Get the peer's raw public key as DER-encoded `SubjectPublicKeyInfo`.
+    pub fn get_peer_raw_public_key(&self) -> Option<Vec<u8>> {
+        get_peer_raw_public_key(self.0.as_ptr())
+    }
+}
+
+bssl_macros::bssl_enum! {
+    /// Requested certificate types defined in RFC 5246 §7.4.4.
+    ///
+    /// RFC 5246: <https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.4>
+    #derive(Debug, Copy, Clone, PartialEq, Eq)
+    #non_exhaustive
+    pub enum RequestedCertificateType: u8 {
+        /// RSA signed certificate.
+        RsaSign = 1,
+        /// DSS signed certificate.
+        DssSign = 2,
+        /// RSA signed certificate with a static Diffie-Hellman key.
+        RsaFixedDh = 3,
+        /// DSS signed certificate with a static Diffie-Hellman key.
+        DssFixedDh = 4,
+        /// Reserved.
+        RsaEphemeralDh = 5,
+        /// Reserved.
+        DssEphemeralDh = 6,
+        /// Reserved.
+        FortezzaDms = 20,
+    }
+}
+
+/// Client Certificate Selection.
+pub struct ClientCertificateSelectionContext<'a, Mode>(
+    NonNull<bssl_sys::SSL>,
+    PhantomData<&'a fn() -> Mode>,
+);
+
+impl<'a, M> ClientCertificateSelectionContext<'a, M> {
+    pub(crate) fn new(ssl: NonNull<bssl_sys::SSL>) -> Self {
+        Self(ssl, PhantomData)
+    }
+
+    pub(crate) fn ptr(&self) -> *mut bssl_sys::SSL {
+        self.0.as_ptr()
+    }
+
+    /// Protocol version selected.
+    ///
+    /// This method returns `None` if the protocol version is unrecognised.
+    pub fn protocol_version(&self) -> Option<ProtocolVersion> {
+        ProtocolVersion::try_from(unsafe {
+            // Safety: `self.0` is still valid by BoringSSL invariant.
+            bssl_sys::SSL_version(self.ptr())
+        })
+        .ok()
+    }
+    /// Get verification algorithm from the peer.
+    ///
+    /// If a signature algorithm is unrecognised, it will be reported as an `Err` value.
+    /// This method might return an empty list if the protocol version is not TLS 1.3.
+    pub fn get_tls13_peer_verification_algorithms(&self) -> Vec<Result<SignatureAlgorithm, u16>> {
+        let mut algs = null();
+        let len = unsafe {
+            // Safety: `self.0` is still valid by BoringSSL invariant.
+            bssl_sys::SSL_get0_peer_verify_algorithms(self.ptr(), &raw mut algs)
+        };
+        let slice = unsafe {
+            // Safety:
+            // - `slice` is only live within this call.
+            // - `slice` is generated by BoringSSL.
+            u16::from_ffi_ptr(algs, len)
+        };
+        slice
+            .iter()
+            .copied()
+            .map(SignatureAlgorithm::try_from)
+            .collect()
+    }
+
+    /// Get TLS 1.2 certificate types.
+    ///
+    /// If a certificate type is unrecognised, it will be reported as an `Err` value.
+    /// This method returns an empty list if the protocol version is TLS 1.3.
+    pub fn get_tls12_certificate_types(&self) -> Vec<Result<RequestedCertificateType, u8>> {
+        let mut types = null();
+        let len = unsafe {
+            // Safety: `self.0` is still valid by BoringSSL invariant.
+            bssl_sys::SSL_get0_certificate_types(self.ptr(), &raw mut types)
+        };
+        let slice = unsafe {
+            // Safety:
+            // - `types` is only live within this call.
+            // - `types` is generated by BoringSSL.
+            u8::from_ffi_ptr(types, len)
+        };
+        slice
+            .iter()
+            .copied()
+            .map(RequestedCertificateType::try_from)
+            .collect()
+    }
+
+    /// Get server requested CAs for client authentication.
+    ///
+    /// These names are sent by the server and they are the acceptable CAs by server.
+    pub fn get_server_ca_list(&self) -> Vec<DistinguishedName> {
+        let names = unsafe {
+            // Safety: `self.ptr()` is still valid by BoringSSL invariant.
+            bssl_sys::SSL_get0_server_requested_CAs(self.ptr())
+        };
+        let names: CryptoBufferIterator<'_, DistinguishedName> = unsafe {
+            // Safety: `names` is owned by SSL and only live within this call.
+            CryptoBufferIterator::new(names)
+        };
+        names.collect()
+    }
+
+    /// Append `credential` to the list of credentials of this connection.
+    ///
+    /// Earlier calls to this method append a credential that is preferred over those added
+    /// in later calls.
+    pub fn add_credential(
+        &mut self,
+        credential: &super::TlsCredential,
+    ) -> Result<(), super::super::errors::Error> {
+        crate::check_lib_error!(unsafe {
+            // Safety: both `self.0` and `credential` are still valid.
+            bssl_sys::SSL_add1_credential(self.0.as_ptr(), credential.ptr())
+        });
+        Ok(())
+    }
+
+    /// Get the peer's `CertificateType`(super::CertificateType).
+    pub fn get_peer_certificate_type(&self) -> Option<super::CertificateType> {
+        super::get_peer_certificate_type(self.ptr())
+    }
+
+    /// Get the peer's raw public key as DER-encoded `SubjectPublicKeyInfo`.
+    pub fn get_peer_raw_public_key(&self) -> Option<Vec<u8>> {
+        super::get_peer_raw_public_key(self.ptr())
+    }
+}

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/credentials/tests.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/credentials/tests.rs Changed

@@ -12,13 +12,51 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use bssl_x509::keys::PrivateKeyAlgorithm;
+use std::{
+    future::{
+        Ready,
+        ready, //
+    },
+    sync::{
+        Arc,
+        Mutex, //
+    }, //
+};
+
+use bssl_crypto::ecdsa::ParsedPrivateKey;
+use bssl_x509::{
+    keys::{
+        PrivateKey,
+        PrivateKeyAlgorithm, //
+    },
+    params::Trust, //
+};
 use futures::future::try_join;
 
 use super::*;
 use crate::{
-    context::TlsMode,
-    tests::create_mock_pipe, //
+    connection::lifecycle::{
+        HandshakeComplete,
+        HandshakeInfo, //
+    },
+    context::{
+        TlsContextBuilder,
+        TlsMode, //
+    },
+    errors::Error,
+    tests::{
+        P256_SERVER_CERT,
+        P256_SERVER_CERT_DER,
+        P256_SERVER_KEY,
+        P256_SERVER_KEY_DER,
+        RSA_SERVER_CERT,
+        RSA_SERVER_CERT_DER,
+        TEST_CA_DN,
+        create_mock_pipe,
+        load_trust_store,
+        load_x509_credential,
+        run_async_handshake, //
+    }, //
 };
 
 #test
@@ -29,51 +67,40 @@
 
 #test
 fn parse_one() {
-    const PEM: &'_ u8 = b"
-Hello world!
------BEGIN CERTIFICATE-----
-SGVsbG8gV29ybGQh
------END CERTIFICATE-----
-";
-    let certs = Certificate::parse_all_from_pem(PEM, None).unwrap();
+    let pem = b"extra data\n", P256_SERVER_CERT, b"\nextra data\n".concat();
+    let certs = Certificate::parse_all_from_pem(&pem, None).unwrap();
     assert_eq!(certs.len(), 1);
-    assert_eq!(certs0.as_der_bytes(), b"Hello World!");
+    assert_eq!(certs0.as_der_bytes(), P256_SERVER_CERT_DER);
 }
 
 #test
 fn parse_all_pems() {
-    const PEM: &'_ u8 = b"
-Hello world!
------BEGIN CERTIFICATE-----
-SGVsbG8gV29ybGQh
------END CERTIFICATE-----
-BoringSSL is ...
------BEGIN CERTIFICATE-----
-QXdlc29tZSBCb3JpbmdTU0wh
------END CERTIFICATE-----
-Trailing bits ...
-";
-    let certs = Certificate::parse_all_from_pem(PEM, None).unwrap();
+    let pem = 
+        b"extra data\n",
+        P256_SERVER_CERT,
+        b"\nextra data\n",
+        RSA_SERVER_CERT,
+        b"\nextra data\n",
+    
+    .concat();
+    let certs = Certificate::parse_all_from_pem(&pem, None).unwrap();
     assert_eq!(certs.len(), 2);
-    assert_eq!(certs0.as_der_bytes(), b"Hello World!");
-    assert_eq!(certs1.as_der_bytes(), b"Awesome BoringSSL!");
+    assert_eq!(certs0.as_der_bytes(), P256_SERVER_CERT_DER);
+    assert_eq!(certs1.as_der_bytes(), RSA_SERVER_CERT_DER);
 }
 
 #test
 fn parse_all_pems_fail() {
-    const PEM: &'_ u8 = b"
-Hello world!
------BEGIN CERTIFICATE-----
-SGVsbG8gV29ybGQh
------END CERTIFICATE-----
-BoringSSL is ...
------BEGIN CERTIFICATE-----
-QXdlc29tZSBCb3JpbmdTU0wh
------END CERTIFICATE-----
-But something badddd...
------BEGIN CERTIFICATE-----
-";
-    let _ = Certificate::parse_all_from_pem(PEM, None).unwrap_err();
+    let pem = 
+        b"extra data\n",
+        P256_SERVER_CERT,
+        b"\nextra data\n",
+        RSA_SERVER_CERT,
+        // Invalid PEM block.
+        b"\n-----BEGIN CERTIFICATE-----\n",
+    
+    .concat();
+    let _ = Certificate::parse_all_from_pem(&pem, None).unwrap_err();
 }
 
 #test
@@ -142,25 +169,49 @@
 
 #test
 fn psk_tls13_handshake() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    let key = b"test-key-test-key-test-key-test-key";
-    let identity = b"test-identity";
+    let key_a = b"test-key-aaaa-test-key-aaaa-aaaa";
+    let key_b = b"test-key-bbbb-test-key-bbbb-bbbb";
+    let identity_a = b"identity-a";
+    let identity_b = b"identity-b";
     let context = b"test-context";
 
-    let cred = TlsCredential::new_pre_shared_key(key, identity, PskHash::Sha256, context)?;
-
-    let mut server_ctx = crate::context::TlsContextBuilder::new_tls();
-    server_ctx.with_credential(cred.clone())?;
-
-    let mut client_ctx = crate::context::TlsContextBuilder::new_tls();
-    client_ctx.with_credential(cred)?;
+    let cred_a = TlsCredential::new_pre_shared_key(key_a, identity_a, PskHash::Sha256, context)?;
+    let cred_b = TlsCredential::new_pre_shared_key(key_b, identity_b, PskHash::Sha256, context)?;
 
+    // Server only has cred_b, so it must select cred_b.
+    let mut server_ctx = TlsContextBuilder::new_tls();
+    server_ctx.with_credential(cred_b.clone())?;
     let server_ctx = server_ctx.build();
+
+    // Client offers both cred_a and cred_b.
+    let mut client_ctx = TlsContextBuilder::new_tls();
+    client_ctx
+        .with_credential(cred_a)?
+        .with_credential(cred_b)?;
     let client_ctx = client_ctx.build();
 
     let (client_socket, server_socket, mut executor) = create_mock_pipe();
 
-    let mut client_conn = client_ctx.new_client_connection(None)?.build();
-    let mut server_conn = server_ctx.new_server_connection(None)?.build();
+    let selected_cred: Arc<Mutex<Option<TlsCredential>>> = Arc::new(Mutex::new(None));
+
+    struct Callback {
+        selected: Arc<Mutex<Option<TlsCredential>>>,
+    }
+
+    impl HandshakeComplete for Callback {
+        fn handshake_complete(&mut self, hs: &HandshakeInfo) {
+            let cred = hs.get_selected_credential();
+            *self.selected.lock().unwrap() = cred;
+        }
+    }
+
+    let mut server_builder = server_ctx.new_server_connection();
+    server_builder.with_handshake_complete_callback(Callback {
+        selected: selected_cred.clone(),
+    });
+    let mut server_conn = server_builder.build();
+
+    let mut client_conn = client_ctx.new_client_connection().build();
 
     client_conn.set_io(client_socket)?;
     server_conn.set_io(server_socket)?;
@@ -168,19 +219,32 @@
     let test_future = async {
         let client_handshake = async {
             assert!(client_conn.async_handshake().await?.is_none());
-            Ok::<(), crate::errors::Error>(())
+            Ok::<(), Error>(())
         };
 
         let server_handshake = async {
             assert!(server_conn.async_handshake().await?.is_none());
-            Ok::<(), crate::errors::Error>(())
+            Ok::<(), Error>(())
         };
 
         try_join(client_handshake, server_handshake).await?;
-        Ok::<(), crate::errors::Error>(())
+        Ok::<(), Error>(())
     };
 
     executor.run(test_future)?;
+    let client_conn = client_ctx.new_client_connection().build();
+    let server_conn = server_ctx.new_server_connection().build();
+    run_async_handshake(client_conn, server_conn)?;
+
+    let selected = selected_cred.lock().unwrap();
+    let selected = selected
+        .as_ref()
+        .expect("handshake complete callback should have been called");
+    assert_eq!(
+        selected.get_pre_shared_key_id(),
+        Some(identity_b.as_slice()),
+        "server should have selected cred_b (identity-b)"
+    );
 
     Ok(())
 }
@@ -205,16 +269,16 @@
 
     let cred = TlsCredential::new_pre_shared_key(key, identity, PskHash::Sha256, context)?;
 
-    let mut server_ctx = crate::context::TlsContextBuilder::new_tls();
+    let mut server_ctx = TlsContextBuilder::new_tls();
     server_ctx.with_credential(cred.clone())?;
     let server_ctx = server_ctx.build();
 
-    let mut client_ctx = crate::context::TlsContextBuilder::new_tls();
+    let mut client_ctx = TlsContextBuilder::new_tls();
     client_ctx.with_credential(cred)?;
     let client_ctx = client_ctx.build();
 
-    let mut client_conn = client_ctx.new_client_connection(None)?.build();
-    let mut server_conn = server_ctx.new_server_connection(None)?.build();
+    let mut client_conn = client_ctx.new_client_connection().build();
+    let mut server_conn = server_ctx.new_server_connection().build();
 
     client_conn.set_split_io(client_reader, client_writer)?;
     server_conn.set_split_io(server_reader, server_writer)?;
@@ -231,45 +295,23 @@
     Ok(())
 }
 
-unsafe extern "C" fn accept_any_verify(
-    _ssl: *mut bssl_sys::SSL,
-    _out_alert: *mut u8,
-) -> bssl_sys::ssl_verify_result_t {
-    bssl_sys::ssl_verify_result_t_ssl_verify_ok
-}
-
-#test
-fn rpk_tls13_handshake() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    use bssl_x509::keys::PrivateKey;
-
-    let priv_key = PrivateKey::from_pem(crate::tests::RSA_SERVER_KEY, || unreachable!()).unwrap();
-
-    let cred = TlsCredentialBuilder::<RawPublicKeyMode>::new_raw_public_key(priv_key)
-        .build()
-        .unwrap();
-
-    let mut server_ctx = crate::context::TlsContextBuilder::new_tls();
-    server_ctx.with_credential(cred.clone())?;
+/// Helper: perform an RPK handshake with the given server credential and client verifier.
+fn rpk_handshake_test(
+    cred: TlsCredential,
+    verifier: impl VerifyCertificate + 'static,
+) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    let mut server_ctx = TlsContextBuilder::new_tls();
+    server_ctx.with_credential(cred)?;
     let server_ctx = server_ctx.build();
 
-    let mut client_ctx = crate::context::TlsContextBuilder::new_tls();
-    client_ctx.with_accepted_peer_cert_types(&CertificateType::Rpk)?;
+    let mut client_ctx = TlsContextBuilder::new_tls();
+    client_ctx
+        .with_accepted_peer_cert_types(&CertificateType::Rpk)?
+        .with_certificate_verifier(CertificateVerificationMode::PeerCertMandatory, verifier);
     let client_ctx = client_ctx.build();
 
-    let mut client_conn_builder = client_ctx.new_client_connection(None)?;
-    client_conn_builder.with_certificate_verification_mode(CertificateVerificationMode::None);
-    let mut client_conn = client_conn_builder.build();
-    unsafe {
-        // Safety:
-        // - `client_conn.ptr()` is a valid `SSL` handle.
-        // - `accept_any_verify` is a valid callback.
-        bssl_sys::SSL_set_custom_verify(
-            client_conn.ptr(),
-            bssl_sys::SSL_VERIFY_PEER as _,
-            Some(accept_any_verify),
-        );
-    }
-    let mut server_conn = server_ctx.new_server_connection(None)?.build();
+    let mut client_conn = client_ctx.new_client_connection().build();
+    let mut server_conn = server_ctx.new_server_connection().build();
 
     let (sock_client, sock_server, mut executor) = create_mock_pipe();
 
@@ -289,6 +331,61 @@
     Ok(())
 }
 
+#test
+fn rpk_tls13_handshake() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    let priv_key = PrivateKey::from_pem(crate::tests::RSA_SERVER_KEY, || unreachable!()).unwrap();
+
+    let cred = TlsCredentialBuilder::new_raw_public_key(priv_key)
+        .build()
+        .unwrap();
+
+    rpk_handshake_test(cred, AcceptAnyVerifier)
+}
+
+#test
+fn rpk_tls13_handshake_with_delegate() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    use crate::credentials::{
+        AsyncPrivateKeyDelegate, AsyncPrivateKeyDelegateAdapter, SignatureAlgorithm,
+    };
+
+    let priv_key = PrivateKey::from_pem(P256_SERVER_KEY, || unreachable!()).unwrap();
+    let pub_key = priv_key.to_public_key().clone();
+    let expected_spki_der = pub_key.to_der();
+
+    struct P256KeyDelegate {
+        key_der: &'static u8,
+    }
+
+    impl AsyncPrivateKeyDelegate for P256KeyDelegate {
+        type SignOp = Ready<Option<Vec<u8>>>;
+        type DecryptOp = Ready<Option<Vec<u8>>>;
+
+        fn sign(&self, message: &u8, algorithm: SignatureAlgorithm) -> Self::SignOp {
+            assert!(matches!(
+                algorithm,
+                SignatureAlgorithm::EcdsaSecp256r1Sha256
+            ));
+            let Some(ParsedPrivateKey::P256(key)) = ParsedPrivateKey::from_der(self.key_der) else {
+                panic!("failed to parse P256 key")
+            };
+            ready(Some(key.sign(message)))
+        }
+
+        fn decrypt(&self, _ciphertext: &u8) -> Self::DecryptOp {
+            unreachable!()
+        }
+    }
+
+    let delegate = AsyncPrivateKeyDelegateAdapter(P256KeyDelegate {
+        key_der: P256_SERVER_KEY_DER,
+    });
+    let cred = TlsCredentialBuilder::new_raw_public_key_with_delegate(pub_key, delegate)
+        .build()
+        .unwrap();
+
+    rpk_handshake_test(cred, RpkVerifier { expected_spki_der })
+}
+
 struct AcceptAnyVerifier;
 
 impl VerifyCertificate for AcceptAnyVerifier {
@@ -389,6 +486,7 @@
                 .is_some();
 
             if offered_rpk {
+                // TODO: switch to `try` block on stabilisation
                 if (|| {
                     client_hello
                         .connection_mut()
@@ -396,7 +494,7 @@
                         .set_certificate_verification_mode(
                             CertificateVerificationMode::PeerCertMandatory,
                         );
-                    Ok::<_, crate::errors::Error>(())
+                    Ok::<_, Error>(())
                 })()
                 .is_err()
                 {
@@ -455,10 +553,10 @@
 
         let (sock_client, sock_server, mut executor) = create_mock_pipe();
 
-        let mut server_conn = server_ctx.new_server_connection(None)?.build();
+        let mut server_conn = server_ctx.new_server_connection().build();
         server_conn.set_io(sock_server)?;
 
-        let mut client_conn_builder = client_ctx.new_client_connection(None)?;
+        let mut client_conn_builder = client_ctx.new_client_connection();
         client_conn_builder
             .with_certificate_verification_mode(CertificateVerificationMode::None)
             .with_certificate_verifier(
@@ -478,7 +576,7 @@
 
             if !offer_psk && !offer_rpk {
                 assert!(handshake_result.is_err(), "Handshake should have failed");
-                return Ok::<(), crate::errors::Error>(());
+                return Ok::<(), Error>(());
             }
 
             handshake_result?;
@@ -497,7 +595,7 @@
             assert!(matches!(read_len, IoStatus::Ok(5)));
             assert_eq!(&client_buf, b"world");
 
-            Ok::<(), crate::errors::Error>(())
+            Ok::<(), Error>(())
         };
 
         executor.run(test_future)?;
@@ -529,3 +627,228 @@
 
     Ok(())
 }
+
+#test
+fn test_mutual_certificate_selectors() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    use crate::credentials::{
+        DistinguishedName,
+        select_cert::{
+            CertificateSelectionResult,
+            ClientCertificateSelectionContext,
+            ClientCertificateSelector,
+            ServerCertificateSelectionContext,
+            ServerCertificateSelector, //
+        },
+    };
+    use std::sync::{
+        Arc,
+        atomic::{
+            AtomicBool,
+            Ordering, //
+        }, //
+    };
+
+    let cred = load_x509_credential();
+
+    struct TestServerSelector {
+        cred: TlsCredential,
+        called: Arc<AtomicBool>,
+    }
+
+    impl ServerCertificateSelector<TlsMode> for TestServerSelector {
+        fn select(
+            &self,
+            mut ctx: ServerCertificateSelectionContext<'_, TlsMode>,
+            _waker: Option<&'_ mut Context<'_>>,
+        ) -> CertificateSelectionResult {
+            self.called.store(true, Ordering::SeqCst);
+            ctx.add_credential(&self.cred).unwrap();
+            CertificateSelectionResult::Success
+        }
+    }
+
+    struct TestClientSelector {
+        cred: TlsCredential,
+        called: Arc<AtomicBool>,
+        ca_dn: &'static u8,
+    }
+
+    impl ClientCertificateSelector<TlsMode> for TestClientSelector {
+        fn select(
+            &self,
+            mut ctx: ClientCertificateSelectionContext<'_, TlsMode>,
+            _waker: Option<&'_ mut Context<'_>>,
+        ) -> CertificateSelectionResult {
+            self.called.store(true, Ordering::SeqCst);
+            assert!(matches!(
+                ctx.protocol_version(),
+                Some(crate::config::ProtocolVersion::Tls13)
+            ));
+            let _algs = ctx.get_tls13_peer_verification_algorithms();
+            let server_ca_list = ctx.get_server_ca_list();
+            assert!(!server_ca_list.is_empty());
+            assert_eq!(server_ca_list0.as_ref(), self.ca_dn);
+
+            ctx.add_credential(&self.cred).unwrap();
+            CertificateSelectionResult::Success
+        }
+    }
+
+    let server_called = Arc::new(AtomicBool::new(false));
+    let server_selector = TestServerSelector {
+        cred: cred.clone(),
+        called: server_called.clone(),
+    };
+
+    let client_called = Arc::new(AtomicBool::new(false));
+    let client_selector = TestClientSelector {
+        cred: cred.clone(),
+        called: client_called.clone(),
+        ca_dn: TEST_CA_DN,
+    };
+
+    let mut server_ctx_builder = TlsContextBuilder::new_tls();
+    let server_cert_store = load_trust_store(Trust::SslClient);
+    server_ctx_builder
+        .with_server_side_certificate_callback(server_selector)
+        .with_certificate_store(&server_cert_store)
+        .set_ca_names(vec!DistinguishedName::from_bytes(TEST_CA_DN, None)?);
+    let server_ctx = server_ctx_builder.build();
+
+    let mut client_ctx_builder = TlsContextBuilder::new_tls();
+    let client_cert_store = load_trust_store(Trust::SslServer);
+    client_ctx_builder
+        .with_client_side_certificate_callback(client_selector)
+        .with_certificate_store(&client_cert_store)
+        .set_ca_names(vec!DistinguishedName::from_bytes(TEST_CA_DN, None)?);
+    let client_ctx = client_ctx_builder.build();
+
+    let mut server_conn = server_ctx.new_server_connection();
+    server_conn.with_certificate_verification_mode(CertificateVerificationMode::PeerCertMandatory);
+    let server_conn = server_conn.build();
+    let mut client_conn = client_ctx.new_client_connection();
+    client_conn.with_certificate_verification_mode(CertificateVerificationMode::PeerCertMandatory);
+    let mut client_conn = client_conn.build();
+
+    client_conn
+        .in_handshake()
+        .unwrap()
+        .set_host("www.google.com")?;
+
+    run_async_handshake(client_conn, server_conn)?;
+    assert!(server_called.load(Ordering::SeqCst));
+    assert!(client_called.load(Ordering::SeqCst));
+    Ok(())
+}
+
+#test
+fn test_mutual_certificate_selectors_connection()
+-> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    use crate::credentials::{
+        DistinguishedName,
+        select_cert::{
+            CertificateSelectionResult, ClientCertificateSelectionContext,
+            ClientCertificateSelector, ServerCertificateSelectionContext,
+            ServerCertificateSelector,
+        },
+    };
+    use std::sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    };
+
+    let cred = load_x509_credential();
+
+    struct TestServerSelector {
+        cred: TlsCredential,
+        called: Arc<AtomicBool>,
+    }
+
+    impl ServerCertificateSelector<TlsMode> for TestServerSelector {
+        fn select(
+            &self,
+            mut ctx: ServerCertificateSelectionContext<'_, TlsMode>,
+            _waker: Option<&'_ mut Context<'_>>,
+        ) -> CertificateSelectionResult {
+            self.called.store(true, Ordering::SeqCst);
+            ctx.add_credential(&self.cred).unwrap();
+            CertificateSelectionResult::Success
+        }
+    }
+
+    struct TestClientSelector {
+        cred: TlsCredential,
+        called: Arc<AtomicBool>,
+        ca_dn: &'static u8,
+    }
+
+    impl ClientCertificateSelector<TlsMode> for TestClientSelector {
+        fn select(
+            &self,
+            mut ctx: ClientCertificateSelectionContext<'_, TlsMode>,
+            _waker: Option<&'_ mut Context<'_>>,
+        ) -> CertificateSelectionResult {
+            self.called.store(true, Ordering::SeqCst);
+            assert!(matches!(
+                ctx.protocol_version(),
+                Some(crate::config::ProtocolVersion::Tls13)
+            ));
+            let _algs = ctx.get_tls13_peer_verification_algorithms();
+            let server_ca_list = ctx.get_server_ca_list();
+            assert!(!server_ca_list.is_empty());
+            assert_eq!(server_ca_list0.as_ref(), self.ca_dn);
+
+            ctx.add_credential(&self.cred).unwrap();
+            CertificateSelectionResult::Success
+        }
+    }
+
+    let server_called = Arc::new(AtomicBool::new(false));
+    let server_selector = TestServerSelector {
+        cred: cred.clone(),
+        called: server_called.clone(),
+    };
+
+    let client_called = Arc::new(AtomicBool::new(false));
+    let client_selector = TestClientSelector {
+        cred: cred.clone(),
+        called: client_called.clone(),
+        ca_dn: TEST_CA_DN,
+    };
+
+    let mut server_ctx_builder = TlsContextBuilder::new_tls();
+    let server_cert_store = load_trust_store(Trust::SslClient);
+    server_ctx_builder
+        .with_certificate_store(&server_cert_store)
+        .set_ca_names(vec!DistinguishedName::from_bytes(TEST_CA_DN, None)?);
+    let server_ctx = server_ctx_builder.build();
+
+    let mut client_ctx_builder = TlsContextBuilder::new_tls();
+    let client_cert_store = load_trust_store(Trust::SslServer);
+    client_ctx_builder
+        .with_certificate_store(&client_cert_store)
+        .set_ca_names(vec!DistinguishedName::from_bytes(TEST_CA_DN, None)?);
+    let client_ctx = client_ctx_builder.build();
+
+    let mut server_conn_builder = server_ctx.new_server_connection();
+    server_conn_builder
+        .with_certificate_verification_mode(CertificateVerificationMode::PeerCertMandatory)
+        .with_server_side_certificate_callback(server_selector);
+    let server_conn = server_conn_builder.build();
+
+    let mut client_conn_builder = client_ctx.new_client_connection();
+    client_conn_builder
+        .with_certificate_verification_mode(CertificateVerificationMode::PeerCertMandatory)
+        .with_client_side_certificate_callback(client_selector);
+    let mut client_conn = client_conn_builder.build();
+
+    client_conn
+        .in_handshake()
+        .unwrap()
+        .set_host("www.google.com")?;
+
+    run_async_handshake(client_conn, server_conn)?;
+    assert!(server_called.load(Ordering::SeqCst));
+    assert!(client_called.load(Ordering::SeqCst));
+    Ok(())
+}

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/errors.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/errors.rs Changed

@@ -43,7 +43,6 @@
 #derive(Debug)
 pub enum Error {
     /// Error reported by the BoringSSL library
-    #allow(private_interfaces)
     Library(u32, Option<LibCode>, Option<i32>),
     /// Configuration errors
     Configuration(ConfigurationError),
@@ -189,6 +188,7 @@
 bssl_enum! {
     /// SSL reason codes.
     #derive(Debug, Copy, Clone, PartialEq, Eq)
+    #non_exhaustive
     pub enum TlsErrorReason: i32 {
         /// `SSL_R_APP_DATA_IN_HANDSHAKE`
         AppDataInHandshake = bssl_sys::SSL_R_APP_DATA_IN_HANDSHAKE as i32,
@@ -732,6 +732,10 @@
         WantRead = bssl_sys::SSL_ERROR_WANT_READ as i32,
         /// TLS is blocked on write.
         WantWrite = bssl_sys::SSL_ERROR_WANT_WRITE as i32,
+        /// Pending certificate look-up.
+        PendingCertificateLookup = bssl_sys::SSL_ERROR_WANT_X509_LOOKUP as i32,
+        /// Syscall failed.
+        Syscall = bssl_sys::SSL_ERROR_SYSCALL as i32,
         /// Pending session.
         /// Caller may retry the last operation when the session lookup is ready.
         PendingSession = bssl_sys::SSL_ERROR_PENDING_SESSION as i32,
@@ -770,6 +774,8 @@
         match self {
             TlsRetryReason::WantRead => f.write_str("want to read"),
             TlsRetryReason::WantWrite => f.write_str("want to write"),
+            TlsRetryReason::PendingCertificateLookup => f.write_str("pending certificate lookup"),
+            TlsRetryReason::Syscall => f.write_str("syscall error"),
             TlsRetryReason::PendingSession => f.write_str("pending session"),
             TlsRetryReason::PendingCertificate => f.write_str("pending certificate"),
             TlsRetryReason::PendingTicket => f.write_str("pending ticket"),

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/ffi.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/ffi.rs Changed

@@ -13,20 +13,23 @@
 // limitations under the License.
 
 use core::{
+    iter::FusedIterator,
     marker::PhantomData,
-    mem::MaybeUninit,
+    mem::{
+        MaybeUninit,
+        forget, //
+    },
     ptr::{
         NonNull,
         null,
         null_mut, //
-    },
-    slice::{
-        from_raw_parts,
-        from_raw_parts_mut, //
     }, //
 };
 
-use bssl_crypto::FfiSlice;
+use bssl_crypto::{
+    FfiSlice,
+    FromFfiSlice, //
+};
 
 use crate::{
     context::CertificateCache,
@@ -65,50 +68,6 @@
     }
 }
 
-/// Sanitize the data pointer and length and reconstitute the slice.
-///
-/// This method returns an empty slice if the length is 0 or the pointer is NULL.
-/// # Safety
-/// Caller must ensure that `'a` outlives `input`.
-#inline
-pub(crate) unsafe fn sanitize_slice<'a, T>(input: *const T, len: usize) -> Option<&'a T> {
-    if len == 0 || input.is_null() {
-        return Some(&);
-    }
-    if !input.is_aligned() || len.checked_mul(size_of::<T>())? > isize::MAX as usize {
-        return None;
-    }
-    unsafe {
-        // Safety: the pointer and the size has been sanitised.
-        Some(from_raw_parts(input, len))
-    }
-}
-
-/// Sanitize the data pointer and length and reconstitute the mutable slice.
-///
-/// `capacity` counts the number of `T`s that `out` can hold, **not number of bytes**.
-///
-/// This method returns an empty slice if the length is 0 or the pointer is NULL.
-/// # Safety
-/// Caller must ensure that `'a` outlives `input`.
-#inline
-pub(crate) unsafe fn sanitise_mut_byteslice<'a>(
-    out: *mut u8,
-    capacity: usize,
-) -> Option<&'a mut u8> {
-    if capacity == 0 || out.is_null() {
-        return Some(&mut );
-    }
-    if capacity > isize::MAX as usize {
-        return None;
-    }
-    unsafe {
-        // Safety: `out` is 1-aligned and `0` is a valid pattern for `u8`.
-        core::ptr::write_bytes(out, 0, capacity);
-        Some(from_raw_parts_mut(out, capacity))
-    }
-}
-
 pub(crate) fn crypto_buffer_from_buf(
     buf: &u8,
     pool: Option<&CertificateCache>,
@@ -249,7 +208,7 @@
         unsafe {
             // Safety: `self` still exclusively owns the buffer region and the range of bytes
             // is known to be initialised by us. See `advance`.
-            sanitize_slice(self.ptr, self.cursor).unwrap_or(&)
+            u8::from_ffi_ptr(self.ptr, self.cursor)
         }
     }
 
@@ -271,3 +230,178 @@
         self.filled()
     }
 }
+
+pub(crate) trait CryptoBufferWrapper {
+    /// Safety: `buf` must be exclusively owned.
+    unsafe fn from_crypto_buffer(buf: core::ptr::NonNull<::bssl_sys::CRYPTO_BUFFER>) -> Self;
+}
+
+pub(crate) unsafe trait BsslStack: Sized {
+    type Element: StackElement;
+
+    fn new() -> *mut Self;
+
+    /// Safety: `this` handle must be a live `stack_st_*` handle.
+    unsafe fn size(this: *const Self) -> usize;
+
+    /// Safety: `this` handle must be live and `idx` must be in bounds.
+    unsafe fn index(this: *const Self, idx: usize) -> *const Self::Element;
+
+    /// Safety: both `this` and `elem` cannot be aliased.
+    unsafe fn push(this: *mut Self, elem: *mut Self::Element);
+
+    const POP_FREE: unsafe extern "C" fn(
+        *mut Self,
+        Option<unsafe extern "C" fn(*mut Self::Element)>,
+    );
+}
+
+unsafe impl BsslStack for bssl_sys::stack_st_CRYPTO_BUFFER {
+    type Element = bssl_sys::CRYPTO_BUFFER;
+
+    fn new() -> *mut Self {
+        let st = unsafe {
+            // Safety: this call only allocates memory
+            bssl_sys::sk_CRYPTO_BUFFER_new_null()
+        };
+        if st.is_null() {
+            panic!("allocation failed")
+        }
+        st
+    }
+
+    unsafe fn size(this: *const Self) -> usize {
+        unsafe {
+            // Safety: `this` is still live and valid.
+            bssl_sys::sk_CRYPTO_BUFFER_num(this)
+        }
+    }
+
+    unsafe fn index(this: *const Self, idx: usize) -> *const Self::Element {
+        unsafe {
+            // Safety: `this` is valid and live
+            bssl_sys::sk_CRYPTO_BUFFER_value(this, idx)
+        }
+    }
+
+    unsafe fn push(this: *mut Self, elem: *mut bssl_sys::CRYPTO_BUFFER) {
+        let rc = unsafe {
+            // Safety: `this` and `elem` are exclusively owned and valid.
+            bssl_sys::sk_CRYPTO_BUFFER_push(this, elem)
+        };
+        if rc == 0 {
+            panic!("allocation failed")
+        }
+    }
+
+    const POP_FREE: unsafe extern "C" fn(
+        *mut Self,
+        Option<unsafe extern "C" fn(*mut Self::Element)>,
+    ) = bssl_sys::sk_CRYPTO_BUFFER_pop_free;
+}
+
+pub(crate) unsafe trait StackElement: Sized {
+    type Stack: BsslStack<Element = Self>;
+
+    const FREE: unsafe extern "C" fn(*mut Self);
+}
+
+unsafe impl StackElement for bssl_sys::CRYPTO_BUFFER {
+    type Stack = bssl_sys::stack_st_CRYPTO_BUFFER;
+
+    const FREE: unsafe extern "C" fn(*mut Self) = bssl_sys::CRYPTO_BUFFER_free;
+}
+
+pub(crate) struct Stack<T: StackElement> {
+    inner: *mut T::Stack,
+    _p: PhantomData<T>,
+}
+
+impl<T: StackElement> Drop for Stack<T> {
+    fn drop(&mut self) {
+        unsafe {
+            // Safety: we still own the stack at this moment
+            T::Stack::POP_FREE(self.inner, Some(T::FREE))
+        }
+    }
+}
+
+impl<T: StackElement> Stack<T> {
+    pub fn new() -> Self {
+        Self {
+            inner: T::Stack::new(),
+            _p: PhantomData,
+        }
+    }
+
+    // Safety: `elem` must not alias because its ownership will be transferred.
+    pub unsafe fn push(&mut self, elem: *mut T) {
+        unsafe {
+            // Safety: `this` is owned by the caller.
+            T::Stack::push(self.inner, elem);
+        }
+    }
+
+    pub fn into_raw(self) -> *mut T::Stack {
+        let ptr = self.inner;
+        forget(self);
+        ptr
+    }
+}
+
+#derive(Clone, Copy)
+pub(crate) struct StackIterator<'a, T: StackElement> {
+    sk: *const T::Stack,
+    len: usize,
+    curr: usize,
+    _p: PhantomData<&'a fn() -> T>,
+}
+
+impl<'a, T: StackElement> StackIterator<'a, T> {
+    /// Safety: caller must ensure that `sk` outlives `'a`.
+    pub(crate) unsafe fn new(sk: *const T::Stack) -> Self {
+        let len = if sk.is_null() {
+            0
+        } else {
+            unsafe {
+                // Safety: `sk` is valid now.
+                T::Stack::size(sk)
+            }
+        };
+        Self {
+            sk,
+            len,
+            curr: 0,
+            _p: PhantomData,
+        }
+    }
+}
+
+impl<'a, T: StackElement> Iterator for StackIterator<'a, T> {
+    type Item = *const T;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        if self.curr >= self.len {
+            return None;
+        }
+        let elem = unsafe {
+            // Safety: `self.sk` is still valid now and `self.curr` is within the bound.
+            T::Stack::index(self.sk, self.curr)
+        };
+        self.curr += 1;
+        if elem.is_null() {
+            // Fuse the iterator.
+            self.curr = self.len;
+            return None;
+        }
+        Some(elem)
+    }
+}
+
+impl<T: StackElement> ExactSizeIterator for StackIterator<'_, T> {
+    fn len(&self) -> usize {
+        self.len - self.curr
+    }
+}
+
+impl<T: StackElement> FusedIterator for StackIterator<'_, T> {}

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/io.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/io.rs Changed

@@ -31,6 +31,7 @@
     },
 };
 
+use bssl_crypto::FromFfiSlice;
 use once_cell::sync::Lazy;
 
 use crate::{
@@ -38,11 +39,7 @@
     errors::{
         Error,
         TlsRetryReason, //
-    },
-    ffi::{
-        sanitise_mut_byteslice,
-        sanitize_slice, //
-    },
+    }, //
 };
 
 #cfg(feature = "std")
@@ -369,11 +366,9 @@
     };
     // Zero the buffer now.
     // TODO(@xfding): maybe we want to have a buffer wrapper that tracks initialised region.
-    let Some(buf) = (unsafe {
+    let buf = unsafe {
         // Safety: `buffer` and `len` are sanitised and initialised for the right memory region.
-        sanitise_mut_byteslice(buffer as *mut u8, len)
-    }) else {
-        return -1;
+        bssl_crypto::zeroize_mut_byteslice(buffer as *mut u8, len)
     };
     let work = {
         let Some(reader) = rust_bio.get_reader() else {
@@ -429,11 +424,11 @@
     } else {
         None
     };
-    let Some(buf) = (unsafe {
-        // Safety: `buffer` and `len` are sanitised and initialised for the right memory region.
-        sanitize_slice(buffer as *mut u8, len)
-    }) else {
-        return -1;
+    let buf = unsafe {
+        // Safety:
+        // - `buffer` and `len` are sanitised and initialised for the right memory region.
+        // - in `libssl` context, `buffer` is an allocation generated by BoringSSL.
+        u8::from_ffi_ptr(buffer as *const u8, len)
     };
     let work = {
         let Some(writer) = rust_bio.get_writer() else {

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/lib.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/lib.rs Changed

@@ -36,6 +36,8 @@
 use core::panic::AssertUnwindSafe;
 
 pub mod alerts;
+pub mod alpn;
+pub mod ciphers;
 pub mod config;
 pub mod connection;
 pub mod context;
@@ -45,6 +47,10 @@
 pub mod io;
 mod methods;
 pub mod sessions;
+#cfg(feature = "std")
+/// Synchronous I/O high-level APIs.
+pub mod sync_io;
+
 #macro_use
 #doc(hidden)
 mod macros;
@@ -59,24 +65,56 @@
     list.iter().any(|elem| !seen.insert(elem))
 }
 
+/// Method table accessor for connection-level state.
+///
+/// Returns `&'a mut Self` because connection state is exclusively owned.
+#allow(unused) // This trait will be used by certificate selection callback.
 pub(crate) trait Methods {
-    /// Safety: `ssl` must outlive `'a` and it must be passed in from BoringSSL
-    /// through vtable calls.
+    /// Safety:
+    /// - `ssl` must outlive `'a` and it must be passed in from BoringSSL
+    ///   through vtable calls.
+    /// - the returned method table **must not** be aliased.
+    unsafe extern "C" fn from_ssl<'a>(ssl: *mut bssl_sys::SSL) -> Option<&'a mut Self>;
+}
+
+/// Shared method table accessor.
+///
+/// Returns `&'a Self` for shared (non-exclusive) access to the method table.
+/// Used by context, connection, and credential method tables for read-only lookups.
+pub(crate) trait MethodsRef {
+    /// Safety:
+    /// - `ssl` must outlive `'a` and it must be passed in from BoringSSL
+    ///   through vtable calls.
     unsafe extern "C" fn from_ssl<'a>(ssl: *mut bssl_sys::SSL) -> Option<&'a Self>;
 }
 
-pub(crate) trait PrivateKeyMethods: Methods {
+pub(crate) trait HandshakeCompleteMethods: Methods {
+    fn handshake_complete_methods(
+        &mut self,
+    ) -> Option<Box<dyn connection::lifecycle::HandshakeComplete>>;
+}
+
+pub(crate) trait PrivateKeyMethods: MethodsRef {
     fn private_key_methods(&self) -> Option<&dyn credentials::PrivateKeyDelegate>;
 }
 
-pub(crate) trait VerifyCertificateMethods: Methods {
+pub(crate) trait VerifyCertificateMethods: MethodsRef {
     fn verify_certificate_methods(&self) -> Option<&dyn credentials::VerifyCertificate>;
 }
 
-pub(crate) trait EarlyCallbackMethods<M>: Methods {
+pub(crate) trait EarlyCallbackMethods<M>: MethodsRef {
     fn early_callback_handler(&self) -> Option<&dyn credentials::early_callback::EarlyCallback<M>>;
 }
 
+pub(crate) trait CertCallback<Mode>: MethodsRef {
+    fn server_cert_cb(
+        &self,
+    ) -> Option<&(dyn credentials::select_cert::ServerCertificateSelector<Mode> + 'static)>;
+    fn client_cert_cb(
+        &self,
+    ) -> Option<&(dyn credentials::select_cert::ClientCertificateSelector<Mode> + 'static)>;
+}
+
 #inline
 fn abort_on_panic<T>(work: impl FnOnce() -> T) -> T {
     let assert_unwind_safe = AssertUnwindSafe(work);

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/macros.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/macros.rs Changed

@@ -77,6 +77,12 @@
             }
         }
 
+        impl $crate::ffi::CryptoBufferWrapper for $name {
+            unsafe fn from_crypto_buffer(buf: ::core::ptr::NonNull<::bssl_sys::CRYPTO_BUFFER>) -> Self {
+                Self(buf)
+            }
+        }
+
         impl ::core::ops::Deref for $name {
             type Target = u8;
             fn deref(&self) -> &Self::Target {
@@ -87,15 +93,12 @@
                         ::bssl_sys::CRYPTO_BUFFER_len(self.ptr()),
                     )
                 };
-                if data.is_null() || len == 0 || len > isize::MAX as usize {
-                    &
-                } else {
-                    unsafe {
-                        // Safety:
-                        // - `data` is 1-size and 1-align and `len` is valid by BoringSSL invariant.
-                        // - `len` is sanitised to be within bound.
-                        ::core::slice::from_raw_parts(data, len)
-                    }
+                unsafe {
+                    // Safety:
+                    // - `data` is 1-size and 1-align and `len` is valid by BoringSSL invariant.
+                    // - `len` is sanitised to be within bound.
+                    // - `data` is sourced from BoringSSL.
+                    ::bssl_crypto::FromFfiSlice::from_ffi_ptr(data, len)
                 }
             }
         }
@@ -148,7 +151,7 @@
         #allow(unused_unsafe)
         unsafe {
             // Safety: data and len are returned by BoringSSL and are valid.
-            $crate::ffi::sanitize_slice(data, len)
+            ::bssl_crypto::FromFfiSlice::from_ffi_ptr(data, len)
         }
     }};
 }

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/methods.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/methods.rs Changed

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/sessions.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/sessions.rs Changed

@@ -15,10 +15,9 @@
 //! TLS Session support for BoringSSL.
 
 use alloc::vec::Vec;
-use core::ptr::{
-    NonNull,
-    null_mut, //
-};
+use core::ptr::NonNull;
+
+use bssl_crypto::FromFfiSlice;
 
 use crate::{
     call_slice_getter,
@@ -27,7 +26,6 @@
     errors::Error,
     ffi::{
         Alloc,
-        sanitize_slice,
         slice_into_ffi_raw_parts, //
     }, //
 };
@@ -35,24 +33,6 @@
 /// A TLS session.
 ///
 /// See RFC 8446 Section 2.2(https://datatracker.ietf.org/doc/html/rfc8446#section-2.2).
-///
-/// # Example
-///
-/// ```rust,no_run
-/// # use bssl_tls::{context::TlsContext, sessions::TlsSession};
-/// # use bssl_tls::context::{Client, TlsMode};
-/// # use bssl_tls::connection::lifecycle::EstablishedTlsConnection;
-/// // Assuming `conn` is an `EstablishedTlsConnection`
-/// # let conn: EstablishedTlsConnection<'_, Client, TlsMode> = todo!();
-/// # let ctx: TlsContext = todo!();
-/// if let Some(session) = conn.get_session() {
-///     // Serialize the session to store it
-///     let session_bytes = session.to_bytes().unwrap();
-///
-///     // Deserialize the session to resume it later
-///     let recovered_session = TlsSession::from_bytes(&session_bytes, &ctx).unwrap();
-/// }
-/// ```
 pub struct TlsSession(pub(crate) NonNull<bssl_sys::SSL_SESSION>);
 
 // Safety: once constructed an `SSL_SESSION` is immutable and has no thread-local data.
@@ -97,7 +77,7 @@
         let out_data = Alloc(out_data);
         let slice = unsafe {
             // Safety: out_data.0 and out_len are returned by BoringSSL and are valid.
-            sanitize_slice(out_data.0, out_len).unwrap()
+            u8::from_ffi_ptr(out_data.0, out_len)
         };
         Ok(slice.to_vec())
     }
@@ -116,7 +96,7 @@
         let out_data = Alloc(out_data);
         let slice = unsafe {
             // Safety: out_data.0 and out_len are returned by BoringSSL and are valid.
-            sanitize_slice(out_data.0, out_len).unwrap()
+            u8::from_ffi_ptr(out_data.0, out_len)
         };
         Ok(slice.to_vec())
     }
@@ -186,11 +166,9 @@
                     bssl_sys::CRYPTO_BUFFER_len(buf),
                 )
             };
-            let Some(slice) = (unsafe {
+            let slice = unsafe {
                 // Safety: data and len are valid.
-                sanitize_slice(data, len)
-            }) else {
-                continue;
+                u8::from_ffi_ptr(data, len)
             };
             res.push(slice.to_vec());
         }
@@ -199,61 +177,19 @@
 
     /// Get the signed certificate timestamp list, if any.
     pub fn get_signed_cert_timestamp_list(&self) -> Option<&u8> {
-        call_slice_getter!(
+        let sct = call_slice_getter!(
             bssl_sys::SSL_SESSION_get0_signed_cert_timestamp_list,
             self.ptr()
-        )
+        );
+        (!sct.is_empty()).then_some(sct)
     }
 
     /// Get the OCSP response, if any.
     ///
     /// See RFC 8446 §4.4.2.1(https://datatracker.ietf.org/doc/html/rfc8446#section-4.4.2.1).
     pub fn get_ocsp_response(&self) -> Option<&u8> {
-        call_slice_getter!(bssl_sys::SSL_SESSION_get0_ocsp_response, self.ptr())
-    }
-
-    /// Get the master key.
-    ///
-    /// In TLS 1.3, this returns the **Resumption Master Secret**.
-    /// See RFC 8446 §7.1(https://datatracker.ietf.org/doc/html/rfc8446#section-7.1).
-    ///
-    /// BoringSSL uses this secret to automatically derive the Pre-Shared Key (PSK) for
-    /// session resumption. Users should not attempt to manually expand this secret or
-    /// perform manual cryptography; BoringSSL handles the key expansion internally when
-    /// a session is configured for resumption.
-    ///
-    /// # Example
-    ///
-    /// If you need to derive a PSK for external use (e.g. for external PSK resumption),
-    /// you can use `bssl_crypto::hkdf`:
-    ///
-    /// ```rust,no_run
-    /// # use bssl_tls::sessions::TlsSession;
-    /// # // Assuming `session` is a `TlsSession`
-    /// # let session: TlsSession = todo!();
-    /// let master_key = session.get_master_key();
-    ///
-    /// // Treat the master key as a PRK in HKDF
-    /// let prk = bssl_crypto::hkdf::Prk::new::<bssl_crypto::digest::Sha256>(&master_key)
-    ///     .expect("Invalid master key length");
-    ///
-    /// // Expand it to derive a PSK
-    /// let mut psk = vec!0u8; 32;
-    /// prk.expand_into(b"resumption psk", &mut psk)
-    ///     .expect("HKDF expansion failed");
-    /// ```
-    pub fn get_master_key(&self) -> Vec<u8> {
-        let len = unsafe {
-            // Safety: self.ptr() is valid.
-            bssl_sys::SSL_SESSION_get_master_key(self.ptr(), null_mut(), 0)
-        };
-        let mut out = vec!0u8; len;
-        let len = unsafe {
-            // Safety: self.ptr() is valid.
-            bssl_sys::SSL_SESSION_get_master_key(self.ptr(), out.as_mut_ptr(), out.len())
-        };
-        out.truncate(len);
-        out
+        let ocsp = call_slice_getter!(bssl_sys::SSL_SESSION_get0_ocsp_response, self.ptr());
+        (!ocsp.is_empty()).then_some(ocsp)
     }
 
     /// Check if the session should be single use.
@@ -282,7 +218,8 @@
 
     /// Get the ticket, if any.
     pub fn get_ticket(&self) -> Option<&u8> {
-        call_slice_getter!(bssl_sys::SSL_SESSION_get0_ticket, self.ptr())
+        let ticket = call_slice_getter!(bssl_sys::SSL_SESSION_get0_ticket, self.ptr());
+        (!ticket.is_empty()).then_some(ticket)
     }
 
     /// Check if the session has a peer SHA256.
@@ -295,7 +232,8 @@
 
     /// Get the peer SHA256, if any.
     pub fn get_peer_sha256(&self) -> Option<&u8> {
-        call_slice_getter!(bssl_sys::SSL_SESSION_get0_peer_sha256, self.ptr())
+        let sha256 = call_slice_getter!(bssl_sys::SSL_SESSION_get0_peer_sha256, self.ptr());
+        (!sha256.is_empty()).then_some(sha256)
     }
 
     /// Check if the session is resumable across names.
@@ -325,161 +263,3 @@
         }
     }
 }
-
-#cfg(test)
-mod tests {
-    use core::pin::Pin;
-
-    use futures::future::try_join;
-
-    use super::*;
-
-    use crate::tests::create_mock_pipe;
-    use crate::{
-        context::TlsContextBuilder,
-        credentials::{
-            PskHash,
-            TlsCredential, //
-        }, //
-    };
-
-    const TEST_KEY: &u8; 32 = b"0123456789abcdef0123456789abcdef";
-    const TEST_IDENTITY: &u8 = b"test-identity";
-    const TEST_CONTEXT: &u8 = b"test-context";
-
-    #test
-    fn test_session_ops() {
-        let ctx = TlsContextBuilder::new_tls().build();
-        let dummy_bytes = vec!0u8; 32;
-        let res = TlsSession::from_bytes(&dummy_bytes, &ctx);
-        assert!(res.is_err());
-    }
-
-    #test
-    fn test_psk_resumption() {
-        let cred_client = TlsCredential::new_pre_shared_key(
-            TEST_KEY,
-            TEST_IDENTITY,
-            PskHash::Sha256,
-            TEST_CONTEXT,
-        )
-        .unwrap();
-        let cred_server = TlsCredential::new_pre_shared_key(
-            TEST_KEY,
-            TEST_IDENTITY,
-            PskHash::Sha256,
-            TEST_CONTEXT,
-        )
-        .unwrap();
-
-        let mut ctx_client = TlsContextBuilder::new_tls();
-        ctx_client.with_credential(cred_client).unwrap();
-        let ctx_client = ctx_client.build();
-
-        let mut ctx_server = TlsContextBuilder::new_tls();
-        ctx_server.with_credential(cred_server).unwrap();
-        let ctx_server = ctx_server.build();
-
-        let mut conn_client = ctx_client.new_client_connection(None).unwrap().build();
-        let mut conn_server = ctx_server.new_server_connection(None).unwrap().build();
-
-        let (sock_client, sock_server, mut executor) = create_mock_pipe();
-
-        conn_client.set_io(sock_client).unwrap();
-        conn_server.set_io(sock_server).unwrap();
-
-        executor
-            .run(try_join(
-                conn_client.async_handshake(),
-                conn_server.async_handshake(),
-            ))
-            .unwrap();
-
-        let est_client = conn_client.established().unwrap();
-        let session = est_client.get_session().unwrap();
-
-        let session_bytes = session.to_bytes().unwrap();
-        assert!(!session_bytes.is_empty());
-
-        let session_recovered = TlsSession::from_bytes(&session_bytes, &ctx_client).unwrap();
-
-        let session_bytes_2 = session_recovered.to_bytes().unwrap();
-        assert_eq!(session_bytes, session_bytes_2);
-    }
-
-    #test
-    fn test_ticket_based_resumption() {
-        let cred_client = TlsCredential::new_pre_shared_key(
-            TEST_KEY,
-            TEST_IDENTITY,
-            PskHash::Sha256,
-            TEST_CONTEXT,
-        )
-        .unwrap();
-        let cred_server = TlsCredential::new_pre_shared_key(
-            TEST_KEY,
-            TEST_IDENTITY,
-            PskHash::Sha256,
-            TEST_CONTEXT,
-        )
-        .unwrap();
-
-        let mut ctx_client = TlsContextBuilder::new_tls();
-        ctx_client.with_credential(cred_client).unwrap();
-        let ctx_client = ctx_client.build();
-
-        let mut ctx_server = TlsContextBuilder::new_tls();
-        ctx_server.with_credential(cred_server).unwrap();
-        let ctx_server = ctx_server.build();
-        let mut conn_client = ctx_client.new_client_connection(None).unwrap().build();
-        let mut conn_server = ctx_server.new_server_connection(None).unwrap().build();
-
-        let (sock_client, sock_server, mut executor) = create_mock_pipe();
-
-        conn_client.set_io(sock_client).unwrap();
-        conn_server.set_io(sock_server).unwrap();
-
-        executor
-            .run(try_join(
-                conn_client.async_handshake(),
-                conn_server.async_handshake(),
-            ))
-            .unwrap();
-
-        let est_client = conn_client.established().unwrap();
-        let session = est_client.get_session().unwrap();
-        let peer = session.get_peer_sha256().unwrap();
-
-        // === SESSION RESUMPTION ===
-        // Use the session for a new connection
-        let (sock_client_2, sock_server_2, mut executor) = create_mock_pipe();
-
-        let mut builder_client_2 = ctx_client.new_client_connection(None).unwrap();
-        builder_client_2.with_session(&session);
-        let mut conn_client_2 = builder_client_2.build();
-
-        let builder_server_2 = ctx_server.new_server_connection(None).unwrap();
-        let mut conn_server_2 = builder_server_2.build();
-
-        conn_client_2.set_io(sock_client_2).unwrap();
-        conn_server_2.set_io(sock_server_2).unwrap();
-
-        executor
-            .run(try_join(
-                Pin::new(&mut conn_client_2).async_write(b"hello"),
-                Pin::new(&mut conn_server_2).async_write(b"world"),
-            ))
-            .unwrap();
-        // The peer identity should be the same as before
-        assert_eq!(
-            conn_client_2
-                .established()
-                .unwrap()
-                .get_session()
-                .unwrap()
-                .get_peer_sha256()
-                .unwrap(),
-            peer
-        );
-    }
-}

boringssl-0.20260813.tar.xz/rust/bssl-tls/src/sync_io.rs Added

@@ -0,0 +1,128 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::{
+    connection::{
+        Client,
+        Server,
+        TlsConnection, //
+    },
+    context::TlsContext,
+    io::sync_io::{NoAsync, StdIoWithReactor}, //
+};
+
+use std::{
+    io::{
+        Read,
+        Write, //
+    },
+    marker::PhantomData, //
+};
+
+/// A convenient wrapper around `TlsContext` for creating synchronous client connections.
+pub struct TlsConnector {
+    ctx: TlsContext,
+}
+
+impl TlsConnector {
+    /// Construct a new `TlsConnector`.
+    pub(crate) fn new(ctx: TlsContext) -> Self {
+        Self { ctx }
+    }
+
+    /// Connect to the given domain using the provided stream.
+    pub fn connect<S>(
+        &self,
+        domain: &str,
+        stream: S,
+    ) -> Result<TlsStream<Client, S>, crate::errors::Error>
+    where
+        S: Read + Write + Send + 'static,
+    {
+        let mut conn = self.ctx.new_client_connection().build();
+        {
+            conn.in_handshake()
+                .expect("connection is freshly constructed and it cannot already be established")
+                .set_host(domain)?;
+            conn.set_io(StdIoWithReactor::new(stream, NoAsync))?
+                .do_handshake()?;
+        }
+
+        Ok(TlsStream {
+            conn,
+            _marker: PhantomData,
+        })
+    }
+}
+
+/// A wrapper around `TlsContext` for creating synchronous server connections.
+pub struct TlsAcceptor {
+    ctx: TlsContext,
+}
+
+impl TlsAcceptor {
+    /// Construct a new `TlsAcceptor`.
+    pub(crate) fn new(ctx: TlsContext) -> Self {
+        Self { ctx }
+    }
+
+    /// Accept a new connection using the provided stream.
+    pub fn accept<S>(&self, stream: S) -> Result<TlsStream<Server, S>, crate::errors::Error>
+    where
+        S: Read + Write + Send + 'static,
+    {
+        let mut conn = self.ctx.new_server_connection().build();
+        conn.set_io(StdIoWithReactor::new(stream, NoAsync))?;
+        conn.do_handshake()?;
+
+        Ok(TlsStream {
+            conn,
+            _marker: PhantomData,
+        })
+    }
+}
+
+/// A TLS stream driven by synchronous I/O.
+pub struct TlsStream<Role, S> {
+    conn: TlsConnection<Role>,
+    _marker: PhantomData<S>,
+}
+
+impl<Role, S> TlsStream<Role, S> {
+    /// Get a reference to the underlying `TlsConnection`.
+    pub fn get_ref(&self) -> &TlsConnection<Role> {
+        &self.conn
+    }
+
+    /// Get a mutable reference to the underlying `TlsConnection`.
+    pub fn get_mut(&mut self) -> &mut TlsConnection<Role> {
+        &mut self.conn
+    }
+}
+
+impl<Role, S> Read for TlsStream<Role, S> {
+    fn read(&mut self, buf: &mut u8) -> std::io::Result<usize> {
+        self.conn.read(buf)
+    }
+}
+
+impl<Role, S> Write for TlsStream<Role, S> {
+    fn write(&mut self, buf: &u8) -> std::io::Result<usize> {
+        self.conn.write(buf)
+    }
+
+    fn flush(&mut self) -> std::io::Result<()> {
+        Write::flush(&mut self.conn)
+    }
+}

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/tests.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/tests.rs Changed

@@ -31,10 +31,7 @@
         TlsConnection, //
     },
     context::TlsContextBuilder,
-    credentials::{
-        Certificate,
-        TlsCredentialBuilder, //
-    },
+    credentials::{Certificate, TlsCredential, TlsCredentialBuilder},
     errors::Error,
     io::{
         AbstractReader,
@@ -49,52 +46,59 @@
     certificates::X509Certificate,
     keys::PrivateKey,
     params::Trust,
-    store::X509StoreBuilder, //
+    store::{
+        X509Store,
+        X509StoreBuilder, //
+    },
 };
 use futures::future::join;
 
+mod alpn;
+mod credentials;
+mod datagram;
+mod handshake;
+mod transport;
+
 pub(crate) const CA: &u8 = include_bytes!("../../test-data/BoringSSLCATest.crt");
 pub(crate) const RSA_SERVER_CERT: &u8 =
     include_bytes!("../../test-data/BoringSSLServerTest-RSA.crt");
+pub(crate) const RSA_SERVER_CERT_DER: &u8 =
+    include_bytes!("../../test-data/BoringSSLServerTest-RSA-Cert.der");
 pub(crate) const RSA_SERVER_KEY: &u8 =
     include_bytes!("../../test-data/BoringSSLServerTest-RSA.key");
 pub(crate) const P256_SERVER_CERT: &u8 =
     include_bytes!("../../test-data/BoringSSLServerTest-ECDSA-P256.crt");
+pub(crate) const P256_SERVER_CERT_DER: &u8 =
+    include_bytes!("../../test-data/BoringSSLServerTest-ECDSA-P256-Cert.der");
+pub(crate) const P256_SERVER_KEY: &u8 =
+    include_bytes!("../../test-data/BoringSSLServerTest-ECDSA-P256.key");
 pub(crate) const P256_SERVER_KEY_DER: &u8 =
     include_bytes!("../../test-data/BoringSSLServerTest-ECDSA-P256.der");
 
-mod credentials;
-mod datagram;
-mod handshake;
-mod transport;
+// DER-encoded DistinguishedName representing "CN=TestCA".
+// Can be verified using:
+// echo -n "3011310f300d06035504031306546573744341" | xxd -r -p | openssl asn1parse -inform DER
+//
+// Output:
+//   0:d=0  hl=2 l=  17 cons: SEQUENCE
+//   2:d=1  hl=2 l=  15 cons: SET
+//   4:d=2  hl=2 l=  13 cons: SEQUENCE
+//   6:d=3  hl=2 l=   3 prim: OBJECT            :commonName
+//  11:d=3  hl=2 l=   6 prim: PRINTABLESTRING   :TestCA
+pub(crate) const TEST_CA_DN: &u8 = b"\x30\x11\x31\x0f\x30\x0d\x06\x03\x55\x04\x03\x13\x06TestCA";
 
 /// Dumb server-client pair that does no certificate verification.
 fn dumb_server_client() -> Result<(TlsConnection<Server>, TlsConnection<Client>), Error> {
-    let ca = Certificate::parse_one_from_pem(CA, None)?;
-    let server_cert = Certificate::parse_one_from_pem(RSA_SERVER_CERT, None)?;
-    let server_key = PrivateKey::from_pem(RSA_SERVER_KEY, || unreachable!())?;
-
     let mut server_ctx_builder = TlsContextBuilder::new_tls();
-    let server_cred = {
-        let mut builder = TlsCredentialBuilder::new();
-        builder
-            .with_certificate_chain(&server_cert, ca)?
-            .with_private_key(server_key)?;
-        builder.build()
-    };
-    server_ctx_builder.with_credential(server_cred.unwrap())?;
+    server_ctx_builder.with_credential(load_x509_credential())?;
     let server_ctx = server_ctx_builder.build();
-    let server_conn = server_ctx.new_server_connection(None)?.build();
+    let server_conn = server_ctx.new_server_connection().build();
 
     let mut client_ctx_builder = TlsContextBuilder::new_tls();
-    let mut cert_store = X509StoreBuilder::new();
-    cert_store
-        .set_trust(Trust::SslServer)?
-        .add_cert(X509Certificate::parse_one_from_pem(CA)?)?;
-    let cert_store = cert_store.build();
+    let cert_store = load_trust_store(Trust::SslServer);
     client_ctx_builder.with_certificate_store(&cert_store);
     let client_ctx = client_ctx_builder.build();
-    let client_conn = client_ctx.new_client_connection(None)?.build();
+    let client_conn = client_ctx.new_client_connection().build();
 
     Ok((server_conn, client_conn))
 }
@@ -376,6 +380,57 @@
     create_mock_socket::<MockDatagram>()
 }
 
+/// Builds a `TlsCredential` from the test RSA certificate chain (server cert + CA)
+/// and private key.
+pub(crate) fn load_x509_credential() -> TlsCredential {
+    let ca = Certificate::parse_one_from_pem(CA, None).unwrap();
+    let server_cert = Certificate::parse_one_from_pem(RSA_SERVER_CERT, None).unwrap();
+    let server_key = PrivateKey::from_pem(RSA_SERVER_KEY, || unreachable!()).unwrap();
+
+    let mut builder = TlsCredentialBuilder::new();
+    builder
+        .with_certificate_chain(&server_cert, ca)
+        .unwrap()
+        .with_private_key(server_key)
+        .unwrap();
+    builder.build().unwrap()
+}
+
+/// Builds an X509 trust store with the test CA certificate.
+pub(crate) fn load_trust_store(trust: Trust) -> X509Store {
+    let mut cert_store = X509StoreBuilder::new();
+    cert_store
+        .set_trust(trust)
+        .unwrap()
+        .add_cert(X509Certificate::parse_one_from_pem(CA).unwrap())
+        .unwrap();
+    cert_store.build()
+}
+
+/// Runs an async TLS handshake between a client and server connection using mock
+/// pipe IO. Returns `Ok(())` on successful handshake.
+pub(crate) fn run_async_handshake(
+    mut client_conn: TlsConnection<Client>,
+    mut server_conn: TlsConnection<Server>,
+) -> Result<(), Error> {
+    let (client_socket, server_socket, mut executor) = create_mock_pipe();
+    client_conn.set_io(client_socket)?;
+    server_conn.set_io(server_socket)?;
+
+    executor.run(async {
+        let client_handshake = async {
+            assert!(client_conn.async_handshake().await?.is_none());
+            Ok::<(), Error>(())
+        };
+        let server_handshake = async {
+            assert!(server_conn.async_handshake().await?.is_none());
+            Ok::<(), Error>(())
+        };
+        futures::future::try_join(client_handshake, server_handshake).await?;
+        Ok::<(), Error>(())
+    })
+}
+
 #test
 fn test_async() -> Result<(), Error> {
     let (mut server_conn, mut client_conn) = dumb_server_client()?;

boringssl-0.20260813.tar.xz/rust/bssl-tls/src/tests/alpn.rs Added

@@ -0,0 +1,39 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::alpn::{
+    AlpnProtocols,
+    H2,
+    HTTP11, //
+};
+
+#test
+fn alpn_config() {
+    let mut config = AlpnProtocols::default();
+    assert!(config.append_protocol(H2).is_ok());
+    assert!(config.append_protocol(HTTP11).is_ok());
+    assert_eq!(config.as_slice(), b"\x02h2\x08http/1.1");
+
+    // Empty protocol is rejected.
+    let mut config = AlpnProtocols::default();
+    assert!(config.append_protocol(b"").is_err());
+
+    // > 255 bytes is rejected, 255 is accepted.
+    let mut config = AlpnProtocols::default();
+    assert!(config.append_protocol(&b'a'; 256).is_err());
+    assert_eq!(config.as_slice(), b"");
+    assert!(config.append_protocol(&b'a'; 255).is_ok());
+    assert_eq!(config.as_slice()0, 255);
+    assert_eq!(&config.as_slice()1.., &b'a'; 255);
+}

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/tests/credentials.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/tests/credentials.rs Changed

@@ -110,14 +110,14 @@
         let mut builder = TlsCredentialBuilder::new();
         builder
             .with_certificate_chain(&server_cert, ca)?
-            .with_private_key_delegate(Some(crate::credentials::AsyncPrivateKeyDelegateAdapter(
+            .with_private_key_delegate(crate::credentials::AsyncPrivateKeyDelegateAdapter(
                 private_key_method,
-            )));
+            ));
         builder.build().unwrap()
     };
     server_ctx_builder.with_credential(server_cred)?;
     let server_ctx = server_ctx_builder.build();
-    let mut server_conn = server_ctx.new_server_connection(None)?.build();
+    let mut server_conn = server_ctx.new_server_connection().build();
 
     let mut client_ctx_builder = TlsContextBuilder::new_tls();
     let mut cert_store = X509StoreBuilder::new();
@@ -127,7 +127,7 @@
     let cert_store = cert_store.build();
     client_ctx_builder.with_certificate_store(&cert_store);
     let client_ctx = client_ctx_builder.build();
-    let mut client_conn = client_ctx.new_client_connection(None)?;
+    let mut client_conn = client_ctx.new_client_connection();
     client_conn.with_certificate_verification_mode(CertificateVerificationMode::PeerCertMandatory);
     let mut client_conn = client_conn.build();
     client_conn

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/tests/datagram.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/tests/datagram.rs Changed

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/tests/handshake.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/tests/handshake.rs Changed

boringssl-0.20260708.tar.xz/rust/bssl-tls/src/tests/transport.rs -> boringssl-0.20260813.tar.xz/rust/bssl-tls/src/tests/transport.rs Changed

@@ -12,6 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+use bssl_x509::params::Trust;
+
 use crate::tests::dumb_server_client;
 
 #cfg(unix)
@@ -54,3 +56,68 @@
     client_conn.established().unwrap().sync_shutdown().unwrap();
     thread.join().unwrap();
 }
+
+#cfg(feature = "std")
+#test
+fn high_level_sync() -> Result<(), crate::errors::Error> {
+    use crate::context::TlsContextBuilder;
+    use crate::credentials::{Certificate, TlsCredentialBuilder};
+    use crate::tests::{CA, RSA_SERVER_CERT, RSA_SERVER_KEY};
+    use bssl_x509::certificates::X509Certificate;
+    use bssl_x509::keys::PrivateKey;
+    use bssl_x509::store::X509StoreBuilder;
+    use std::io::{Read, Write};
+
+    let ca = Certificate::parse_one_from_pem(CA, None)?;
+    let server_cert = Certificate::parse_one_from_pem(RSA_SERVER_CERT, None)?;
+    let server_key = PrivateKey::from_pem(RSA_SERVER_KEY, || unreachable!())?;
+
+    let mut server_ctx_builder = TlsContextBuilder::new_tls();
+    let server_cred = {
+        let mut builder = TlsCredentialBuilder::new();
+        builder
+            .with_certificate_chain(&server_cert, ca)?
+            .with_private_key(server_key)?;
+        builder.build()
+    };
+    server_ctx_builder.with_credential(server_cred.unwrap())?;
+    let mut builder = TlsContextBuilder::new_tls();
+    let ca = X509Certificate::parse_one_from_pem(CA)?;
+    let store = {
+        let mut store = X509StoreBuilder::new();
+        store.set_trust(Trust::SslServer)?.add_cert(ca)?;
+        store.build()
+    };
+    builder.with_certificate_store(&store);
+    let connector = builder.build_connector();
+    let acceptor = server_ctx_builder.build_acceptor();
+
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    let addr = listener.local_addr().unwrap();
+
+    let server_thread = std::thread::spawn(move || {
+        let (stream, _) = listener.accept().unwrap();
+        let mut tls_stream = acceptor.accept(stream).unwrap();
+
+        let mut buf = 0; 5;
+        tls_stream.read_exact(&mut buf).unwrap();
+        assert_eq!(&buf, b"hello");
+
+        tls_stream.write_all(b"world").unwrap();
+        tls_stream.flush().unwrap();
+    });
+
+    let stream = std::net::TcpStream::connect(addr).unwrap();
+    let mut tls_stream = connector.connect("www.google.com", stream).unwrap();
+
+    tls_stream.write_all(b"hello").unwrap();
+    tls_stream.flush().unwrap();
+
+    let mut buf = 0; 5;
+    tls_stream.read_exact(&mut buf).unwrap();
+    assert_eq!(&buf, b"world");
+
+    server_thread.join().unwrap();
+
+    Ok(())
+}

boringssl-0.20260708.tar.xz/rust/bssl-x509/src/certificates.rs -> boringssl-0.20260813.tar.xz/rust/bssl-x509/src/certificates.rs Changed

@@ -72,10 +72,22 @@
     ptr::{NonNull, null_mut},
 };
 
+use bssl_crypto::FromFfiSlice;
+
 use crate::{
-    errors::{PemReason, PkiError, X509Error},
-    ffi::{Bio, sanitize_slice, slice_into_ffi_raw_parts},
-    keys::{PrivateKey, PublicKey},
+    errors::{
+        PemReason,
+        PkiError,
+        X509Error, //
+    },
+    ffi::{
+        Bio,
+        slice_into_ffi_raw_parts, //
+    },
+    keys::{
+        PrivateKey,
+        PublicKey, //
+    },
 };
 
 bssl_macros::bssl_enum! {
@@ -175,8 +187,10 @@
         return None;
     }
     let bytes = unsafe {
-        // Safety: `'a` will still outlive the input buffer and this byte slice.
-        sanitize_slice(ptr, str_len)?
+        // Safety:
+        // - `'a` will still outlive the input buffer and this byte slice.
+        // - `ptr` is sourced from BoringSSL.
+        u8::from_ffi_ptr(ptr, str_len)
     };
     core::str::from_utf8(bytes).ok()
 }
@@ -249,8 +263,10 @@
                                 continue;
                             }
                             let bytes = unsafe {
-                                // Safety: `self` will outlive the input buffer and this byte slice.
-                                sanitize_slice(ptr, len as usize)?
+                                // Safety:
+                                // - `self` will outlive the input buffer and this byte slice.
+                                // - `ptr` is sourced from BoringSSL.
+                                u8::from_ffi_ptr(ptr, len as usize)
                             };
                             return Some(GeneralName::Ip(bytes));
                         }

boringssl-0.20260708.tar.xz/rust/bssl-x509/src/errors.rs -> boringssl-0.20260813.tar.xz/rust/bssl-x509/src/errors.rs Changed

@@ -14,7 +14,7 @@
 
 //! X.509 certificate verification errors.
 
-use core::ffi::{c_char, CStr};
+use core::ffi::{CStr, c_char};
 use core::fmt::{self, Debug, Display};
 
 use bssl_macros::bssl_enum;
@@ -23,6 +23,7 @@
 bssl_enum! {
     /// X.509 certificate verification result code.
     #derive(Debug, Copy, Clone, PartialEq, Eq)
+    #non_exhaustive
     pub enum X509VerifyResult: i32 {
         /// The operation was successful.
         Ok = bssl_sys::X509_V_OK as i32,
@@ -152,6 +153,7 @@
 bssl_enum! {
     /// X.509 reason codes.
     #derive(Debug, Copy, Clone, PartialEq, Eq)
+    #non_exhaustive
     pub enum X509Reason: i32 {
         /// `X509_R_AKID_MISMATCH`
         AkidMismatch = bssl_sys::X509_R_AKID_MISMATCH as i32,
@@ -289,6 +291,7 @@
 
 /// X.509 related errors
 #derive(Debug)
+#non_exhaustive
 pub enum X509Error {
     /// PEM string is too long.
     PemTooLong,
@@ -324,6 +327,7 @@
 
 /// Main PKI errors
 #derive(Debug)
+#non_exhaustive
 pub enum PkiError {
     /// X.509 errors
     X509(X509Error),

boringssl-0.20260708.tar.xz/rust/bssl-x509/src/ffi.rs -> boringssl-0.20260813.tar.xz/rust/bssl-x509/src/ffi.rs Changed

boringssl-0.20260708.tar.xz/rust/bssl-x509/src/keys.rs -> boringssl-0.20260813.tar.xz/rust/bssl-x509/src/keys.rs Changed

boringssl-0.20260708.tar.xz/rust/bssl-x509/src/params.rs -> boringssl-0.20260813.tar.xz/rust/bssl-x509/src/params.rs Changed

boringssl-0.20260813.tar.xz/rust/test-data/BoringSSLServerTest-ECDSA-P256-Cert.der Added

boringssl-0.20260813.tar.xz/rust/test-data/BoringSSLServerTest-RSA-Cert.der Added

boringssl-0.20260708.tar.xz/ssl/d1_both.cc -> boringssl-0.20260813.tar.xz/ssl/d1_both.cc Changed

@@ -19,7 +19,9 @@
 #include <string.h>
 
 #include <algorithm>
+#include <variant>
 
+#include <openssl/bytestring.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/mem.h>
@@ -27,7 +29,6 @@
 
 #include "../crypto/bytestring/internal.h"
 #include "../crypto/internal.h"
-#include "../crypto/bytestring/internal.h"
 #include "internal.h"
 
 
@@ -176,44 +177,109 @@
 
 // Receiving handshake messages.
 
-static UniquePtr<DTLSIncomingMessage> dtls_new_incoming_message(
-    const struct hm_header_st *msg_hdr) {
-  ScopedCBB cbb;
-  UniquePtr<DTLSIncomingMessage> frag = MakeUnique<DTLSIncomingMessage>();
-  if (!frag) {
-    return nullptr;
-  }
-  frag->type = msg_hdr->type;
-  frag->seq = msg_hdr->seq;
+DTLSIncomingMessage::DTLSIncomingMessage(const DTLSHandshakeHeader &hdr)
+    : type_(hdr.type), seq_(hdr.seq), msg_(FragmentList{{}, hdr.msg_len}) {}
 
-  // Allocate space for the reassembled message and fill in the header.
-  if (!frag->data.InitForOverwrite(DTLS1_HM_HEADER_LENGTH + msg_hdr->msg_len)) {
-    return nullptr;
+static bool AppendU24(Vector<uint8_t> *out, uint32_t v) {
+  uint8_t bytes3 = {static_cast<uint8_t>(v >> 16),
+                      static_cast<uint8_t>(v >> 8), static_cast<uint8_t>(v)};
+  return out->Append(bytes);
+}
+
+bool DTLSIncomingMessage::AddFragment(uint32_t offset,
+                                      Span<const uint8_t> data) {
+  assert(offset <= msg_len());
+  assert(data.size() <= msg_len() - offset);
+
+  if (auto *list = std::get_if<FragmentList>(&msg_); list != nullptr) {
+    if (list->fragments.size() + data.size() < list->msg_len) {
+      // Including this new fragment, it is not yet possible for the message to
+      // be complete yet. Avoid allocating a ReassemblyBuffer.
+      //
+      // `list->fragments.size()` includes a six-byte header per fragment, so
+      // this comparison is loose. We may switch to ReassemblyBuffer before it
+      // is possible for to have complete message, but this is fine.
+      return AppendU24(&list->fragments, offset) &&
+             AppendU24(&list->fragments, static_cast<uint32_t>(data.size())) &&
+             list->fragments.Append(data);
+    }
+
+    // Convert the saved fragments to a ReassemblyBuffer. We have received
+    // enough that the memory use is proportional to data received.
+    ReassemblyBuffer new_buf;
+    if (!new_buf.msg.InitForOverwrite(DTLS1_HM_HEADER_LENGTH + list->msg_len) ||
+        !new_buf.reassembly.Init(list->msg_len)) {
+      return false;
+    }
+
+    // Reconstruct an unfragmented message header.
+    CBB cbb;
+    BSSL_CHECK(CBB_init_fixed(&cbb, new_buf.msg.data(), new_buf.msg.size()));
+    BSSL_CHECK(CBB_add_u8(&cbb, type_));
+    BSSL_CHECK(CBB_add_u24(&cbb, list->msg_len));
+    BSSL_CHECK(CBB_add_u16(&cbb, seq_));
+    BSSL_CHECK(CBB_add_u24(&cbb, 0 /* frag_off */));
+    BSSL_CHECK(CBB_add_u24(&cbb, list->msg_len));
+
+    // Replay the saved fragments.
+    CBS fragments(list->fragments);
+    while (CBS_len(&fragments) != 0) {
+      uint32_t saved_offset;
+      CBS saved_data;
+      BSSL_CHECK(CBS_get_u24(&fragments, &saved_offset));
+      BSSL_CHECK(CBS_get_u24_length_prefixed(&fragments, &saved_data));
+      new_buf.AddFragment(saved_offset, saved_data);
+    }
+
+    msg_ = std::move(new_buf);
   }
 
-  if (!CBB_init_fixed(cbb.get(), frag->data.data(), DTLS1_HM_HEADER_LENGTH) ||
-      !CBB_add_u8(cbb.get(), msg_hdr->type) ||
-      !CBB_add_u24(cbb.get(), msg_hdr->msg_len) ||
-      !CBB_add_u16(cbb.get(), msg_hdr->seq) ||
-      !CBB_add_u24(cbb.get(), 0 /* frag_off */) ||
-      !CBB_add_u24(cbb.get(), msg_hdr->msg_len) ||
-      !CBB_finish(cbb.get(), nullptr, nullptr)) {
-    return nullptr;
+  auto &buf = std::get<ReassemblyBuffer>(msg_);
+  buf.AddFragment(offset, data);
+  return true;
+}
+
+bool DTLSIncomingMessage::IsComplete() const {
+  auto *buf = std::get_if<ReassemblyBuffer>(&msg_);
+  return buf != nullptr && buf->reassembly.IsComplete();
+}
+
+std::optional<SSLMessage> DTLSIncomingMessage::GetMessage() const {
+  auto *buf = std::get_if<ReassemblyBuffer>(&msg_);
+  if (buf == nullptr || !buf->reassembly.IsComplete()) {
+    return std::nullopt;
   }
 
-  if (!frag->reassembly.Init(msg_hdr->msg_len)) {
-    return nullptr;
+  SSLMessage msg;
+  msg.type = type_;
+  msg.raw = CBS(buf->msg);
+  msg.body = CBS(Span(buf->msg).subspan(DTLS1_HM_HEADER_LENGTH));
+  msg.is_v2_hello = false;
+  return msg;
+}
+
+void DTLSIncomingMessage::ReassemblyBuffer::AddFragment(
+    uint32_t offset, Span<const uint8_t> data) {
+  if (reassembly.IsComplete()) {
+    // The message is already assembled.
+    return;
   }
 
-  return frag;
+  // Copy the body into the fragment.
+  Span<uint8_t> dest =
+      Span(msg).subspan(DTLS1_HM_HEADER_LENGTH).subspan(offset, data.size());
+  assert(dest.size() == data.size());
+  OPENSSL_memcpy(dest.data(), data.data(), data.size());
+  reassembly.MarkRange(offset, offset + data.size());
 }
 
 // dtls1_is_current_message_complete returns whether the current handshake
 // message is complete.
-static bool dtls1_is_current_message_complete(const SSLImpl *ssl) {
+maybe_unused static bool dtls1_is_current_message_complete(
+    const SSLImpl *ssl) {
   size_t idx = ssl->d1->handshake_read_seq % SSL_MAX_HANDSHAKE_FLIGHT;
-  DTLSIncomingMessage *frag = ssl->d1->incoming_messagesidx.get();
-  return frag != nullptr && frag->reassembly.IsComplete();
+  const DTLSIncomingMessage *frag = ssl->d1->incoming_messagesidx.get();
+  return frag != nullptr && frag->IsComplete();
 }
 
 // dtls1_get_incoming_message returns the incoming message corresponding to
@@ -221,21 +287,20 @@
 // queue. Otherwise, it checks `msg_hdr` is consistent with the existing one. It
 // returns NULL on failure. The caller does not take ownership of the result.
 static DTLSIncomingMessage *dtls1_get_incoming_message(
-    SSLImpl *ssl, uint8_t *out_alert, const struct hm_header_st *msg_hdr) {
-  if (msg_hdr->seq < ssl->d1->handshake_read_seq ||
-      msg_hdr->seq - ssl->d1->handshake_read_seq >= SSL_MAX_HANDSHAKE_FLIGHT) {
+    SSLImpl *ssl, uint8_t *out_alert, const DTLSHandshakeHeader &msg_hdr) {
+  if (msg_hdr.seq < ssl->d1->handshake_read_seq ||
+      msg_hdr.seq - ssl->d1->handshake_read_seq >= SSL_MAX_HANDSHAKE_FLIGHT) {
     *out_alert = SSL_AD_INTERNAL_ERROR;
     return nullptr;
   }
 
-  size_t idx = msg_hdr->seq % SSL_MAX_HANDSHAKE_FLIGHT;
+  size_t idx = msg_hdr.seq % SSL_MAX_HANDSHAKE_FLIGHT;
   DTLSIncomingMessage *frag = ssl->d1->incoming_messagesidx.get();
   if (frag != nullptr) {
-    assert(frag->seq == msg_hdr->seq);
+    assert(frag->seq() == msg_hdr.seq);
     // The new fragment must be compatible with the previous fragments from this
     // message.
-    if (frag->type != msg_hdr->type ||  //
-        frag->msg_len() != msg_hdr->msg_len) {
+    if (frag->type() != msg_hdr.type || frag->msg_len() != msg_hdr.msg_len) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_FRAGMENT_MISMATCH);
       *out_alert = SSL_AD_ILLEGAL_PARAMETER;
       return nullptr;
@@ -244,7 +309,7 @@
   }
 
   // This is the first fragment from this message.
-  ssl->d1->incoming_messagesidx = dtls_new_incoming_message(msg_hdr);
+  ssl->d1->incoming_messagesidx = MakeUnique<DTLSIncomingMessage>(msg_hdr);
   if (!ssl->d1->incoming_messagesidx) {
     *out_alert = SSL_AD_INTERNAL_ERROR;
     return nullptr;
@@ -260,7 +325,7 @@
   CBS cbs = record;
   while (CBS_len(&cbs) > 0) {
     // Read a handshake fragment.
-    struct hm_header_st msg_hdr;
+    DTLSHandshakeHeader msg_hdr;
     CBS body;
     if (!dtls1_parse_fragment(&cbs, &msg_hdr, &body)) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_HANDSHAKE_RECORD);
@@ -325,23 +390,14 @@
     }
 
     DTLSIncomingMessage *frag =
-        dtls1_get_incoming_message(ssl, out_alert, &msg_hdr);
+        dtls1_get_incoming_message(ssl, out_alert, msg_hdr);
     if (frag == nullptr) {
       return false;
     }
-    assert(frag->msg_len() == msg_len);
-
-    if (frag->reassembly.IsComplete()) {
-      // The message is already assembled.
-      continue;
+    if (!frag->AddFragment(frag_off, body)) {
+      *out_alert = SSL_AD_INTERNAL_ERROR;
+      return false;
     }
-    assert(msg_len > 0);
-
-    // Copy the body into the fragment.
-    Span<uint8_t> dest = frag->msg().subspan(frag_off, CBS_len(&body));
-    assert(dest.size() == CBS_len(&body));
-    OPENSSL_memcpy(dest.data(), CBS_data(&body), CBS_len(&body));
-    frag->reassembly.MarkRange(frag_off, frag_off + frag_len);
   }
 
   if (implicit_ack) {
@@ -434,16 +490,20 @@
 }
 
 bool dtls1_get_message(const SSLImpl *ssl, SSLMessage *out) {
-  if (!dtls1_is_current_message_complete(ssl)) {
+  size_t idx = ssl->d1->handshake_read_seq % SSL_MAX_HANDSHAKE_FLIGHT;
+  const DTLSIncomingMessage *frag = ssl->d1->incoming_messagesidx.get();
+  if (frag == nullptr) {
+    assert(!dtls1_is_current_message_complete(ssl));
     return false;
   }
 
-  size_t idx = ssl->d1->handshake_read_seq % SSL_MAX_HANDSHAKE_FLIGHT;
-  const DTLSIncomingMessage *frag = ssl->d1->incoming_messagesidx.get();
-  out->type = frag->type;
-  out->raw = CBS(frag->data);
-  out->body = CBS(frag->msg());
-  out->is_v2_hello = false;
+  std::optional<SSLMessage> msg = frag->GetMessage();
+  assert(dtls1_is_current_message_complete(ssl) == msg.has_value());
+  if (!msg.has_value()) {
+    return false;
+  }
+
+  *out = *msg;
   if (!ssl->s3->has_message) {
     ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_HANDSHAKE, out->raw);
     ssl->s3->has_message = true;
@@ -483,10 +543,9 @@
   return false;
 }
 
-bool dtls1_parse_fragment(CBS *cbs, struct hm_header_st *out_hdr,
+bool dtls1_parse_fragment(CBS *cbs, DTLSHandshakeHeader *out_hdr,
                           CBS *out_body) {
-  OPENSSL_memset(out_hdr, 0x00, sizeof(struct hm_header_st));
-
+  *out_hdr = DTLSHandshakeHeader{};
   if (!CBS_get_u8(cbs, &out_hdr->type) ||
       !CBS_get_u24(cbs, &out_hdr->msg_len) ||
       !CBS_get_u16(cbs, &out_hdr->seq) ||
@@ -745,7 +804,7 @@
 
     // Decode `msg`'s header.
     CBS cbs(msg.data), body_cbs;
-    struct hm_header_st hdr;
+    DTLSHandshakeHeader hdr;
     if (!dtls1_parse_fragment(&cbs, &hdr, &body_cbs) ||  //
         hdr.frag_off != 0 ||                             //
         hdr.frag_len != CBS_len(&body_cbs) ||            //

boringssl-0.20260708.tar.xz/ssl/d1_pkt.cc -> boringssl-0.20260813.tar.xz/ssl/d1_pkt.cc Changed

boringssl-0.20260708.tar.xz/ssl/encrypted_client_hello.cc -> boringssl-0.20260813.tar.xz/ssl/encrypted_client_hello.cc Changed

boringssl-0.20260708.tar.xz/ssl/extensions.cc -> boringssl-0.20260813.tar.xz/ssl/extensions.cc Changed

@@ -16,6 +16,7 @@
 
 #include <assert.h>
 #include <limits.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -38,6 +39,7 @@
 #include <openssl/nid.h>
 #include <openssl/pool.h>
 #include <openssl/rand.h>
+#include <openssl/span.h>
 
 #include "../crypto/bytestring/internal.h"
 #include "../crypto/internal.h"
@@ -105,14 +107,7 @@
 }
 
 static bool is_post_quantum_group(uint16_t id) {
-  switch (id) {
-    case SSL_GROUP_X25519_KYBER768_DRAFT00:
-    case SSL_GROUP_X25519_MLKEM768:
-    case SSL_GROUP_MLKEM1024:
-      return true;
-    default:
-      return false;
-  }
+  return id == SSL_GROUP_X25519_MLKEM768 || id == SSL_GROUP_MLKEM1024;
 }
 
 bool ssl_parse_client_hello_with_trailing_data(const SSLImpl *ssl, CBS *cbs,
@@ -1031,7 +1026,7 @@
   if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_signature_algorithms) ||
       !CBB_add_u16_length_prefixed(out_compressible, &contents) ||
       !CBB_add_u16_length_prefixed(&contents, &sigalgs_cbb)) {
-        return false;
+    return false;
   }
   // Add a fake signature algorithm. See RFC 8701.
   if (hs->ssl->ctx->grease_sigalgs_enabled &&
@@ -1501,14 +1496,51 @@
   return false;
 }
 
+static int default_alpn_select_cb(SSL *ssl, const uint8_t **out,
+                                  uint8_t *out_len, const uint8_t *in,
+                                  unsigned inlen, void *arg) {
+  auto *ssl_impl = FromOpaque(ssl);
+  SSL_HANDSHAKE *hs = ssl_impl->s3->hs.get();
+  if (hs == nullptr) {
+    return SSL_TLSEXT_ERR_ALERT_FATAL;
+  }
+
+  bssl::Span<const uint8_t> client_protos(in, inlen);
+  CBS cbs = client_protos;
+  CBS proto;
+  while (CBS_len(&cbs) != 0) {
+    if (!CBS_get_u8_length_prefixed(&cbs, &proto) || CBS_len(&proto) == 0) {
+      return SSL_TLSEXT_ERR_ALERT_FATAL;
+    }
+    if (ssl_alpn_list_contains_protocol(hs->config->alpn_client_proto_list,
+                                        proto)) {
+      *out = CBS_data(&proto);
+      *out_len = static_cast<uint8_t>(CBS_len(&proto));
+      return SSL_TLSEXT_ERR_OK;
+    }
+  }
+
+  return SSL_TLSEXT_ERR_ALERT_FATAL;
+}
+
 bool ssl_negotiate_alpn(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                         const SSL_CLIENT_HELLO *client_hello) {
   SSLImpl *const ssl = hs->ssl;
   CBS contents;
-  if (ssl->ctx->alpn_select_cb == nullptr ||
-      !ssl_client_hello_get_extension(
-          client_hello, &contents,
-          TLSEXT_TYPE_application_layer_protocol_negotiation)) {
+  const bool has_extension = ssl_client_hello_get_extension(
+      client_hello, &contents,
+      TLSEXT_TYPE_application_layer_protocol_negotiation);
+
+  auto alpn_select_cb = ssl->ctx->alpn_select_cb;
+  void *alpn_select_cb_arg = ssl->ctx->alpn_select_cb_arg;
+
+  if (alpn_select_cb == nullptr &&
+      !hs->config->alpn_client_proto_list.empty()) {
+    alpn_select_cb = default_alpn_select_cb;
+    alpn_select_cb_arg = nullptr;
+  }
+
+  if (!has_extension || alpn_select_cb == nullptr) {
     if (SSL_is_quic(ssl)) {
       // ALPN is required when QUIC is used.
       OPENSSL_PUT_ERROR(SSL, SSL_R_NO_APPLICATION_PROTOCOL);
@@ -1533,12 +1565,11 @@
 
   // `protocol_name_list` fits in `unsigned` because TLS extensions use 16-bit
   // lengths.
-  const uint8_t *selected;
-  uint8_t selected_len;
-  int ret = ssl->ctx->alpn_select_cb(
+  const uint8_t *selected = nullptr;
+  uint8_t selected_len = 0;
+  int ret = alpn_select_cb(
       ssl, &selected, &selected_len, CBS_data(&protocol_name_list),
-      static_cast<unsigned>(CBS_len(&protocol_name_list)),
-      ssl->ctx->alpn_select_cb_arg);
+      static_cast<unsigned>(CBS_len(&protocol_name_list)), alpn_select_cb_arg);
   // ALPN is required when QUIC is used.
   if (SSL_is_quic(ssl) &&
       (ret == SSL_TLSEXT_ERR_NOACK || ret == SSL_TLSEXT_ERR_ALERT_WARNING)) {

boringssl-0.20260708.tar.xz/ssl/internal.h -> boringssl-0.20260813.tar.xz/ssl/internal.h Changed

@@ -24,6 +24,7 @@
 #include <algorithm>
 #include <atomic>
 #include <bitset>
+#include <cstdint>
 #include <initializer_list>
 #include <limits>
 #include <new>
@@ -365,7 +366,7 @@
                                    enum ssl_compliance_policy_t policy);
 
 // ssl_cipher_is_deprecated returns true if `cipher` is deprecated.
-OPENSSL_EXPORT bool ssl_cipher_is_deprecated(const SSL_CIPHER *cipher);
+bool ssl_cipher_is_deprecated(const SSL_CIPHER *cipher);
 
 
 // Transcript layer.
@@ -917,7 +918,7 @@
 Span<const NamedGroup> NamedGroups();
 
 // kNumNamedGroups is the number of supported groups.
-constexpr size_t kNumNamedGroups = 7u;
+constexpr size_t kNumNamedGroups = 6u;
 
 // DefaultSupportedGroupIds returns the list of IDs for the default groups that
 // are supported when the caller hasn't explicitly configured supported groups.
@@ -1430,6 +1431,14 @@
   kRawPublicKey,
 };
 
+struct SSLTrustAnchorRange {
+  Array<uint8_t> base;
+  uint64_t min = 0;
+  uint64_t max = 0;
+
+  bool Contains(Span<const uint8_t> id) const;
+};
+
 class SSLCredential : public ssl_credential_st,
                       public RefCounted<SSLCredential> {
  public:
@@ -1552,6 +1561,10 @@
   // chain in `chain`.
   Array<uint8_t> trust_anchor_id;
 
+  // trust_anchor_group_inclusions describes trust anchor groups that also match
+  // this credential.
+  Vector<SSLTrustAnchorRange> trust_anchor_group_inclusions;
+
   CRYPTO_EX_DATA ex_data;
 
   // must_match_issuer is a flag indicating that this credential should be
@@ -3084,7 +3097,7 @@
   size_t first_unmarked_byte_ = 0;
 };
 
-struct hm_header_st {
+struct DTLSHandshakeHeader {
   uint8_t type;
   uint32_t msg_len;
   uint16_t seq;
@@ -3094,24 +3107,59 @@
 
 // An DTLSIncomingMessage is an incoming DTLS message, possibly not yet
 // assembled.
-struct DTLSIncomingMessage {
+class DTLSIncomingMessage {
+ public:
   static constexpr bool kAllowUniquePtr = true;
 
-  Span<uint8_t> msg() { return Span(data).subspan(DTLS1_HM_HEADER_LENGTH); }
-  Span<const uint8_t> msg() const {
-    return Span(data).subspan(DTLS1_HM_HEADER_LENGTH);
+  explicit DTLSIncomingMessage(const DTLSHandshakeHeader &hdr);
+
+  uint8_t type() const { return type_; }
+  uint16_t seq() const { return seq_; }
+  size_t msg_len() const {
+    return std::holds_alternative<FragmentList>(msg_)
+               ? std::get<FragmentList>(msg_).msg_len
+               : std::get<ReassemblyBuffer>(msg_).msg.size() -
+                     DTLS1_HM_HEADER_LENGTH;
   }
-  size_t msg_len() const { return msg().size(); }
 
-  // type is the type of the message.
-  uint8_t type = 0;
-  // seq is the sequence number of this message.
-  uint16_t seq = 0;
-  // data contains the message, including the message header of length
-  // `DTLS1_HM_HEADER_LENGTH`.
-  Array<uint8_t> data;
-  // reassembly tracks which parts of the message have been received.
-  DTLSMessageBitmap reassembly;
+  // AddFragment adds the fragment to the incoming message. It returns true on
+  // success and false on error. The caller must have checked that `offset` and
+  // `data` fit in the message body.
+  bool AddFragment(uint32_t offset, Span<const uint8_t> data);
+
+  // IsComplete returns whether the incoming message is complete.
+  bool IsComplete() const;
+
+  // GetMessage returns the message as an SSLMessage if complete, and
+  // std::nullopt otherwise.
+  std::optional<SSLMessage> GetMessage() const;
+
+ private:
+  struct FragmentList {
+    // fragments contains fragment data in order of 24-bit offset, 24-bit
+    // length, data.
+    Vector<uint8_t> fragments;
+    // msg_len contains the length of the handshake message.
+    uint32_t msg_len;
+  };
+
+  struct ReassemblyBuffer {
+    void AddFragment(uint32_t offset, Span<const uint8_t> data);
+
+    // msg holds the message data, including `DTLS1_HM_HEADER_LENGTH` bytes
+    // of reconstructed header.
+    Array<uint8_t> msg;
+    // reassembly tracks which parts of the message have been received.
+    DTLSMessageBitmap reassembly;
+  };
+
+  uint8_t type_;
+  uint16_t seq_;
+  // msg_ holds the message data. Before enough data has been received for the
+  // message to be complete, it stores a FragmentList, which is proportional to
+  // total data received. Once the message might be complete, it switches to
+  // ReassemblyBuffer, which is proportional to the final amount.
+  std::variant<FragmentList, ReassemblyBuffer> msg_;
 };
 
 struct DTLSOutgoingMessage {
@@ -3491,6 +3539,10 @@
   // ClientHello.
   bool ech_grease_enabled : 1;
 
+  // reject_unusable_ech_config controls whether the client will fail the
+  // handshake if ECH cannot be offered.
+  bool reject_unusable_ech_config : 1;
+
   // Enable signed certificate time stamps. Currently client only.
   bool signed_cert_timestamps_enabled : 1;
 
@@ -3582,13 +3634,14 @@
 
 // SSL_SESSION_parse parses an `SSL_SESSION` from `cbs` and advances `cbs` over
 // the parsed data.
-OPENSSL_EXPORT UniquePtr<SSL_SESSION> SSL_SESSION_parse(
-    CBS *cbs, const SSL_X509_METHOD *x509_method, CRYPTO_BUFFER_POOL *pool);
+UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
+                                         const SSL_X509_METHOD *x509_method,
+                                         CRYPTO_BUFFER_POOL *pool);
 
 // ssl_session_serialize writes `in` to `cbb` as if it were serialising a
 // session for Session-ID resumption. It returns true on success and false on
 // error.
-OPENSSL_EXPORT bool ssl_session_serialize(const SSL_SESSION *in, CBB *cbb);
+bool ssl_session_serialize(const SSL_SESSION *in, CBB *cbb);
 
 enum class SSLSessionType {
   // The session is not resumable.
@@ -3732,7 +3785,7 @@
 int dtls1_write_record(SSLImpl *ssl, int type, Span<const uint8_t> in,
                        uint16_t epoch);
 
-bool dtls1_parse_fragment(CBS *cbs, struct hm_header_st *out_hdr,
+bool dtls1_parse_fragment(CBS *cbs, DTLSHandshakeHeader *out_hdr,
                           CBS *out_body);
 
 // DTLS1_MTU_TIMEOUTS is the maximum number of retransmit timeouts to expire

boringssl-0.20260708.tar.xz/ssl/ssl_cert.cc -> boringssl-0.20260813.tar.xz/ssl/ssl_cert.cc Changed

boringssl-0.20260708.tar.xz/ssl/ssl_credential.cc -> boringssl-0.20260813.tar.xz/ssl/ssl_credential.cc Changed

@@ -12,11 +12,14 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#include <openssl/base.h>
 #include <openssl/ssl.h>
 
 #include <assert.h>
 
+#include <algorithm>
+#include <optional>
+
+#include <openssl/bytestring.h>
 #include <openssl/hkdf.h>
 #include <openssl/span.h>
 
@@ -83,9 +86,10 @@
       }
     }
   }
+
   // If the credential has a trust anchor ID and it matches one sent by the
   // peer, it is good.
-  if (!cred->trust_anchor_id.empty() && hs->peer_requested_trust_anchors) {
+  if (hs->peer_requested_trust_anchors) {
     CBS cbs = CBS(*hs->peer_requested_trust_anchors), candidate;
     while (CBS_len(&cbs) > 0) {
       if (!CBS_get_u8_length_prefixed(&cbs, &candidate) ||
@@ -93,7 +97,12 @@
         OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
         return false;
       }
-      if (candidate == Span(cred->trust_anchor_id)) {
+      if (candidate == Span(cred->trust_anchor_id) ||
+          std::any_of(cred->trust_anchor_group_inclusions.begin(),
+                      cred->trust_anchor_group_inclusions.end(),
+                      &(const SSLTrustAnchorRange &r) {
+                        return r.Contains(candidate);
+                      })) {
         hs->matched_peer_trust_anchor = true;
         return true;
       }
@@ -117,6 +126,22 @@
   }
 }
 
+bool SSLTrustAnchorRange::Contains(Span<const uint8_t> id) const {
+  // See draft-ietf-tls-trust-anchor-ids-04, Section 3.1.
+  if (!base.empty() && (base.back() & 0x80)) {
+    return false;  // `base` is a truncated OID component.
+  }
+  if (id.size() <= base.size() || id.first(base.size()) != base) {
+    return false;  // `base` is not a strict prefix of `id`.
+  }
+  CBS rest = id.subspan(base.size());
+  uint64_t v;
+  if (!CBS_get_asn1_oid_component(&rest, &v) || CBS_len(&rest) != 0) {
+    return false;  // `id` was not exactly one OID component more than `base`.
+  }
+  return min <= v && v <= max;
+}
+
 static ExDataClass g_ex_data_class;
 
 SSLCredential::SSLCredential(SSLCredentialType type_arg)
@@ -368,6 +393,18 @@
   return cred.release();
 }
 
+const uint8_t *SSL_CREDENTIAL_get0_pre_shared_key_id(const SSL_CREDENTIAL *cred,
+                                                     size_t *id_len) {
+  *id_len = 0;
+  auto *cred_impl = FromOpaque(cred);
+  if (cred_impl == nullptr ||
+      cred_impl->type != SSLCredentialType::kPreSharedKey) {
+    return nullptr;
+  }
+  *id_len = cred_impl->epsk_id.size();
+  return cred_impl->epsk_id.data();
+}
+
 SSL_CREDENTIAL *SSL_CREDENTIAL_new_delegated() {
   return New<SSLCredential>(SSLCredentialType::kDelegated);
 }
@@ -725,6 +762,27 @@
   return 1;
 }
 
+int SSL_CREDENTIAL_add1_trust_anchor_group_inclusion(SSL_CREDENTIAL *cred,
+                                                     const uint8_t *base,
+                                                     size_t base_len,
+                                                     uint64_t min,
+                                                     uint64_t max) {
+  auto *cred_impl = FromOpaque(cred);
+  // For now, this is only valid for X.509.
+  if (!cred_impl->UsesX509()) {
+    OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+
+  SSLTrustAnchorRange range;
+  if (!range.base.CopyFrom(Span(base, base_len))) {
+    return 0;
+  }
+  range.min = min;
+  range.max = max;
+  return cred_impl->trust_anchor_group_inclusions.Push(std::move(range));
+}
+
 int SSL_CREDENTIAL_set1_certificate_properties(
     SSL_CREDENTIAL *cred, CRYPTO_BUFFER *cert_property_list) {
   auto *cred_impl = FromOpaque(cred);
@@ -733,53 +791,71 @@
     OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
-  std::optional<CBS> trust_anchor;
-  CBS cbs, cpl;
-  CRYPTO_BUFFER_init_CBS(cert_property_list, &cbs);
 
-  if (!CBS_get_u16_length_prefixed(&cbs, &cpl)) {
+  CBS cbs, list;
+  CRYPTO_BUFFER_init_CBS(cert_property_list, &cbs);
+  if (!CBS_get_u16_length_prefixed(&cbs, &list) || CBS_len(&cbs) != 0) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_CERTIFICATE_PROPERTY_LIST);
     return 0;
   }
-  while (CBS_len(&cpl) != 0) {
-    uint16_t cp_type;
-    CBS cp_data;
-    if (!CBS_get_u16(&cpl, &cp_type) ||
-        !CBS_get_u16_length_prefixed(&cpl, &cp_data)) {
+  std::optional<uint16_t> last_type;
+  while (CBS_len(&list) != 0) {
+    uint16_t type;
+    CBS data;
+    if (!CBS_get_u16(&list, &type) ||
+        !CBS_get_u16_length_prefixed(&list, &data) ||
+        // Properties must be numerically sorted by type and must not contain
+        // duplicates.
+        (last_type.has_value() && type <= last_type.value())) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_CERTIFICATE_PROPERTY_LIST);
       return 0;
     }
-    switch (cp_type) {
-      case 0:  // trust anchor identifier.
-        if (trust_anchor.has_value()) {
+    last_type = type;
+
+    switch (type) {
+      case 0:  // trust_anchor_id
+        // See draft-ietf-tls-trust-anchor-ids-04, Section 7.1.
+        if (!CBS_len(&data)) {
+          OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_TRUST_ANCHOR_LIST);
+          return 0;
+        }
+        if (!SSL_CREDENTIAL_set1_trust_anchor_id(cred_impl, CBS_data(&data),
+                                                 CBS_len(&data))) {
+          return 0;
+        }
+        break;
+      case 1: {  // trust_anchor_group_inclusions
+        // See draft-ietf-tls-trust-anchor-ids-04, Section 7.2.
+        CBS range_list;
+        if (!CBS_get_u16_length_prefixed(&data, &range_list) ||
+            CBS_len(&data) != 0 || CBS_len(&range_list) == 0) {
           OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_CERTIFICATE_PROPERTY_LIST);
           return 0;
         }
-        trust_anchor = cp_data;
+        while (CBS_len(&range_list) != 0) {
+          CBS base;
+          uint64_t min, max;
+          if (!CBS_get_u8_length_prefixed(&range_list, &base) ||
+              CBS_len(&base) == 0 ||  //
+              !CBS_get_u64(&range_list, &min) ||
+              !CBS_get_u64(&range_list, &max)) {
+            OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_CERTIFICATE_PROPERTY_LIST);
+            return 0;
+          }
+          if (!SSL_CREDENTIAL_add1_trust_anchor_group_inclusion(
+                  cred_impl, CBS_data(&base), CBS_len(&base), min, max)) {
+            return 0;
+          }
+        }
         break;
+      }
       default:
         break;
     }
   }
-  if (CBS_len(&cbs) != 0) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_CERTIFICATE_PROPERTY_LIST);
-    return 0;
-  }
-  // Certificate property list has parsed correctly.
 
   // We do not currently retain `cert_property_list`, but if we define another
   // property with larger fields (e.g. stapled SCTs), it may make sense for
   // those fields to retain `cert_property_list` and alias into it.
-  if (trust_anchor.has_value()) {
-    if (!CBS_len(&trust_anchor.value())) {
-      OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_TRUST_ANCHOR_LIST);
-      return 0;
-    }
-    if (!SSL_CREDENTIAL_set1_trust_anchor_id(cred_impl,
-                                             CBS_data(&trust_anchor.value()),
-                                             CBS_len(&trust_anchor.value()))) {
-      return 0;
-    }
-  }
   return 1;
 }

boringssl-0.20260708.tar.xz/ssl/ssl_key_share.cc -> boringssl-0.20260813.tar.xz/ssl/ssl_key_share.cc Changed

@@ -33,7 +33,6 @@
 #include <openssl/span.h>
 
 #include "../crypto/internal.h"
-#include "../crypto/kyber/internal.h"
 #include "internal.h"
 
 BSSL_NAMESPACE_BEGIN
@@ -193,96 +192,7 @@
   uint8_t private_key_32;
 };
 
-// draft-tls-westerbaan-xyber768d00-03
-class X25519Kyber768KeyShare : public SSLKeyShare {
- public:
-  X25519Kyber768KeyShare() {}
-
-  uint16_t GroupID() const override {
-    return SSL_GROUP_X25519_KYBER768_DRAFT00;
-  }
-
-  bool Generate(CBB *out) override {
-    uint8_t x25519_public_key32;
-    X25519_keypair(x25519_public_key, x25519_private_key_);
-
-    uint8_t kyber_public_keyKYBER_PUBLIC_KEY_BYTES;
-    KYBER_generate_key(kyber_public_key, &kyber_private_key_);
-
-    if (!CBB_add_bytes(out, x25519_public_key, sizeof(x25519_public_key)) ||
-        !CBB_add_bytes(out, kyber_public_key, sizeof(kyber_public_key))) {
-      return false;
-    }
-
-    return true;
-  }
-
-  bool Encap(CBB *out_ciphertext, Array<uint8_t> *out_secret,
-             uint8_t *out_alert, Span<const uint8_t> peer_key) override {
-    Array<uint8_t> secret;
-    if (!secret.InitForOverwrite(32 + KYBER_SHARED_SECRET_BYTES)) {
-      return false;
-    }
-
-    uint8_t x25519_public_key32;
-    X25519_keypair(x25519_public_key, x25519_private_key_);
-    KYBER_public_key peer_kyber_pub;
-    CBS peer_key_cbs, peer_x25519_cbs, peer_kyber_cbs;
-    CBS_init(&peer_key_cbs, peer_key.data(), peer_key.size());
-    if (!CBS_get_bytes(&peer_key_cbs, &peer_x25519_cbs, 32) ||
-        !CBS_get_bytes(&peer_key_cbs, &peer_kyber_cbs,
-                       KYBER_PUBLIC_KEY_BYTES) ||
-        CBS_len(&peer_key_cbs) != 0 ||
-        !X25519(secret.data(), x25519_private_key_,
-                CBS_data(&peer_x25519_cbs)) ||
-        !KYBER_parse_public_key(&peer_kyber_pub, &peer_kyber_cbs)) {
-      *out_alert = SSL_AD_ILLEGAL_PARAMETER;
-      OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
-      return false;
-    }
-
-    uint8_t kyber_ciphertextKYBER_CIPHERTEXT_BYTES;
-    KYBER_encap(kyber_ciphertext, secret.data() + 32, &peer_kyber_pub);
-
-    if (!CBB_add_bytes(out_ciphertext, x25519_public_key,
-                       sizeof(x25519_public_key)) ||
-        !CBB_add_bytes(out_ciphertext, kyber_ciphertext,
-                       sizeof(kyber_ciphertext))) {
-      return false;
-    }
-
-    *out_secret = std::move(secret);
-    return true;
-  }
-
-  bool Decap(Array<uint8_t> *out_secret, uint8_t *out_alert,
-             Span<const uint8_t> ciphertext) override {
-    *out_alert = SSL_AD_INTERNAL_ERROR;
-
-    Array<uint8_t> secret;
-    if (!secret.InitForOverwrite(32 + KYBER_SHARED_SECRET_BYTES)) {
-      return false;
-    }
-
-    if (ciphertext.size() != 32 + KYBER_CIPHERTEXT_BYTES ||
-        !X25519(secret.data(), x25519_private_key_, ciphertext.data())) {
-      *out_alert = SSL_AD_ILLEGAL_PARAMETER;
-      OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
-      return false;
-    }
-
-    KYBER_decap(secret.data() + 32, ciphertext.data() + 32,
-                &kyber_private_key_);
-    *out_secret = std::move(secret);
-    return true;
-  }
-
- private:
-  uint8_t x25519_private_key_32;
-  KYBER_private_key kyber_private_key_;
-};
-
-// draft-ietf-tls-ecdhe-mlkem-00
+// RFC 10024
 class X25519MLKEM768KeyShare : public SSLKeyShare {
  public:
   X25519MLKEM768KeyShare() {}
@@ -440,8 +350,6 @@
     {NID_secp384r1, SSL_GROUP_SECP384R1, "P-384", "secp384r1"},
     {NID_secp521r1, SSL_GROUP_SECP521R1, "P-521", "secp521r1"},
     {NID_X25519, SSL_GROUP_X25519, "X25519", "x25519"},
-    {NID_X25519Kyber768Draft00, SSL_GROUP_X25519_KYBER768_DRAFT00,
-     "X25519Kyber768Draft00", ""},
     {NID_X25519MLKEM768, SSL_GROUP_X25519_MLKEM768, "X25519MLKEM768", ""},
     {NID_ML_KEM_1024, SSL_GROUP_MLKEM1024, "MLKEM1024", ""},
 };
@@ -455,6 +363,7 @@
 
 Span<const uint16_t> DefaultSupportedGroupIds() {
   static const uint16_t kDefaultSupportedGroupIds = {
+      SSL_GROUP_X25519_MLKEM768,
       SSL_GROUP_X25519,
       SSL_GROUP_SECP256R1,
       SSL_GROUP_SECP384R1,
@@ -472,8 +381,6 @@
       return MakeUnique<ECKeyShare>(EC_group_p521(), SSL_GROUP_SECP521R1);
     case SSL_GROUP_X25519:
       return MakeUnique<X25519KeyShare>();
-    case SSL_GROUP_X25519_KYBER768_DRAFT00:
-      return MakeUnique<X25519Kyber768KeyShare>();
     case SSL_GROUP_X25519_MLKEM768:
       return MakeUnique<X25519MLKEM768KeyShare>();
     case SSL_GROUP_MLKEM1024:

boringssl-0.20260708.tar.xz/ssl/ssl_lib.cc -> boringssl-0.20260813.tar.xz/ssl/ssl_lib.cc Changed

boringssl-0.20260708.tar.xz/ssl/ssl_test.cc -> boringssl-0.20260813.tar.xz/ssl/ssl_test.cc Changed

@@ -21,6 +21,7 @@
 #include <algorithm>
 #include <iterator>
 #include <limits>
+#include <optional>
 #include <string>
 #include <utility>
 #include <vector>
@@ -43,6 +44,7 @@
 #include <openssl/pem.h>
 #include <openssl/rand.h>
 #include <openssl/sha.h>
+#include <openssl/span.h>
 #include <openssl/ssl.h>
 #include <openssl/x509.h>
 
@@ -488,29 +490,12 @@
     "SHA1", "RSA",     "SSLv3", "TLSv1", "TLSv1.2",
 };
 
-static const struct {
-  const char *rule;
-  int expected_included_deprecated_count;
-} kDeprecatedCBCSHA256Rules = {
-    {"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", 1},
-    {"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", 1},
-    {"ALL:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", 1},
-    {"ALL:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", 1},
-    {"ALL:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:TLS_ECDHE_RSA_WITH_AES_128_"
-     "CBC_SHA256",
-     2},
-};
-
 static const CurveTest kCurveTests = {
     {
         "P-256",
         {SSL_GROUP_SECP256R1},
     },
     {
-        "P-256:X25519Kyber768Draft00",
-        {SSL_GROUP_SECP256R1, SSL_GROUP_X25519_KYBER768_DRAFT00},
-    },
-    {
         "P-256:X25519MLKEM768",
         {SSL_GROUP_SECP256R1, SSL_GROUP_X25519_MLKEM768},
     },
@@ -612,6 +597,7 @@
     // Test strict mode.
     if (t.strict_fail) {
       EXPECT_FALSE(SSL_CTX_set_strict_cipher_list(ctx.get(), t.rule));
+      EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_SSL, SSL_R_INVALID_COMMAND}}));
     } else {
       ASSERT_TRUE(SSL_CTX_set_strict_cipher_list(ctx.get(), t.rule));
       EXPECT_TRUE(CipherListsEqual(ctx.get(), t.expected))
@@ -637,12 +623,27 @@
     ASSERT_TRUE(SSL_CTX_set_strict_cipher_list(ctx.get(), rule));
     for (const SSL_CIPHER *cipher : SSL_CTX_get_ciphers(ctx.get())) {
       EXPECT_NE(NID_undef, SSL_CIPHER_get_cipher_nid(cipher));
+#if !defined(BORINGSSL_SHARED_LIBRARY)
       EXPECT_FALSE(ssl_cipher_is_deprecated(cipher));
+#endif
     }
   }
 }
 
+#if !defined(BORINGSSL_SHARED_LIBRARY)
 TEST(SSLTest, CipherRulesDeprecated) {
+  static const struct {
+    const char *rule;
+    int expected_included_deprecated_count;
+  } kDeprecatedCBCSHA256Rules = {
+      {"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", 1},
+      {"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", 1},
+      {"ALL:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", 1},
+      {"ALL:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", 1},
+      {"ALL:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:"
+       "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+       2},
+  };
   for (const auto &test : kDeprecatedCBCSHA256Rules) {
     SCOPED_TRACE(test.rule);
     bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
@@ -658,6 +659,7 @@
     EXPECT_EQ(found, test.expected_included_deprecated_count);
   }
 }
+#endif  // BORINGSSL_SHARED_LIBRARY
 
 TEST(SSLTest, CurveRules) {
   for (const CurveTest &t : kCurveTests) {
@@ -684,8 +686,8 @@
 }
 
 TEST(SSLTest, DefaultCurves) {
-  const uint16_t kDefaults = {SSL_GROUP_X25519, SSL_GROUP_SECP256R1,
-                                SSL_GROUP_SECP384R1};
+  const uint16_t kDefaults = {SSL_GROUP_X25519_MLKEM768, SSL_GROUP_X25519,
+                                SSL_GROUP_SECP256R1, SSL_GROUP_SECP384R1};
 
   // Test the group ID APIs.
   {
@@ -922,7 +924,7 @@
       },
       {
           "Hint one group, not supported by client",
-          {SSL_GROUP_X25519_KYBER768_DRAFT00},
+          {SSL_GROUP_SECP384R1},
           kDefaultKeyShares,
       },
       {
@@ -1666,6 +1668,13 @@
 static size_t GetClientHelloLen(uint16_t max_version, uint16_t session_version,
                                 size_t ticket_len) {
   bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
+
+  // Reduce the number of supported groups, as we need ClientHellos smaller
+  // than 254 bytes for SSLTest.Padding.
+  uint16_t groups = {SSL_GROUP_X25519, SSL_GROUP_SECP256R1,
+                       SSL_GROUP_SECP384R1};
+  SSL_CTX_set1_group_ids(ctx.get(), groups, sizeof(groups) / sizeof(*groups));
+
   bssl::UniquePtr<SSL_SESSION> session =
       CreateSessionWithTicket(session_version, ticket_len);
   if (!ctx || !session) {
@@ -2340,7 +2349,8 @@
 // Test that the SSL group flags are defaulted to zero when zero groups are set
 // (i.e. using the default groups).
 TEST(SSLTest, SetGroupIdsWithFlags_DefaultGroups) {
-  const uint16_t kDefaultGroups = {SSL_GROUP_X25519, SSL_GROUP_SECP256R1,
+  const uint16_t kDefaultGroups = {SSL_GROUP_X25519_MLKEM768,
+                                     SSL_GROUP_X25519, SSL_GROUP_SECP256R1,
                                      SSL_GROUP_SECP384R1};
   const uint32_t kBogusFlags = {SSL_GROUP_FLAG_EQUAL_PREFERENCE_WITH_NEXT,
                                   SSL_GROUP_FLAG_EQUAL_PREFERENCE_WITH_NEXT, 0};
@@ -2698,6 +2708,8 @@
   EXPECT_FALSE(SSL_ECH_KEYS_add(keys.get(), /*is_retry_config=*/1,
                                 ech_config.data(), ech_config.size(),
                                 key.get()));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_SSL, SSL_R_UNSUPPORTED_ECH_SERVER_CONFIG}}));
 
   // Invalid public names are rejected.
   ECHConfigParams invalid_public_name;
@@ -3078,9 +3090,11 @@
   EXPECT_FALSE(SSL_export_keying_material(client.get(), buffer.data(),
                                           buffer.size(), label, strlen(label),
                                           nullptr, 0, 0));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_SSL, SSL_R_HANDSHAKE_NOT_COMPLETE}}));
   EXPECT_FALSE(SSL_export_keying_material(server.get(), buffer.data(),
                                           buffer.size(), label, strlen(label),
                                           nullptr, 0, 0));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_SSL, SSL_R_HANDSHAKE_NOT_COMPLETE}}));
 
   // Send the client's first flight of handshake messages.
   int client_ret = SSL_do_handshake(client.get());
@@ -5502,17 +5516,24 @@
 
   // There is no key or certificate, so `SSL_CTX_check_private_key` fails.
   EXPECT_FALSE(SSL_CTX_check_private_key(ctx.get()));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED}}));
 
   // With only a certificate, `SSL_CTX_check_private_key` still fails.
   ASSERT_TRUE(SSL_CTX_use_certificate(ctx.get(), leaf.get()));
   EXPECT_FALSE(SSL_CTX_check_private_key(ctx.get()));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED}}));
 
   // The private key does not match the certificate, so it should fail.
   EXPECT_FALSE(SSL_CTX_use_PrivateKey(ctx.get(), key.get()));
+  EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_X509, X509_R_KEY_VALUES_MISMATCH}}));
 
   // Checking the private key fails, but this is really because there is still
   // no private key.
   EXPECT_FALSE(SSL_CTX_check_private_key(ctx.get()));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED}}));
   EXPECT_EQ(nullptr, SSL_CTX_get0_privatekey(ctx.get()));
 }
 
@@ -5527,10 +5548,14 @@
 
   // There is no key or certificate, so `SSL_CTX_check_private_key` fails.
   EXPECT_FALSE(SSL_CTX_check_private_key(ctx.get()));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED}}));
 
   // With only a key, `SSL_CTX_check_private_key` still fails.
   ASSERT_TRUE(SSL_CTX_use_PrivateKey(ctx.get(), key.get()));
   EXPECT_FALSE(SSL_CTX_check_private_key(ctx.get()));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_SSL, SSL_R_NO_CERTIFICATE_ASSIGNED}}));
 
   // If configuring a certificate that doesn't match the key, configuration
   // actually succeeds. We just silently drop the private key.
@@ -5542,6 +5567,8 @@
   // by way of noticing there is no private key. The actual consistency check
   // happened in `SSL_CTX_use_certificate`.
   EXPECT_FALSE(SSL_CTX_check_private_key(ctx.get()));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED}}));
 }
 
 TEST(SSLTest, OverrideCertAndKey) {
@@ -5907,97 +5934,70 @@
 }
 
 TEST(SSLTest, CredentialCertProperties) {
-  // A CertificatePropertyList containing a trust_anchors property, and an
-  // unknown property 0xbb with 0 bytes of data.
   bssl::UniquePtr<SSL_CREDENTIAL> cred(SSL_CREDENTIAL_new_x509());
   ASSERT_TRUE(cred);
-  ASSERT_FALSE(SSL_CREDENTIAL_is_complete(cred.get()));
-  static const uint8_t kTestProperties1 = {0x00, 0x0b, 0x00, 0x00, 0x00,
-                                             0x03, 0xba, 0xdb, 0x0b, 0x00,
-                                             0xbb, 0x00, 0x00};
-  bssl::UniquePtr<CRYPTO_BUFFER> pl(
-      CRYPTO_BUFFER_new(kTestProperties1, sizeof(kTestProperties1), nullptr));
-  ASSERT_TRUE(pl);
-  EXPECT_TRUE(SSL_CREDENTIAL_set1_certificate_properties(cred.get(), pl.get()));
-
-  // A CertificatePropertyList containing a trust_anchors property, and an
-  // unknown property 0xbb with 1 byte of data.
-  static const uint8_t kTestProperties2 = {0x00, 0x0c, 0x00, 0x00, 0x00,
-                                             0x03, 0xba, 0xdb, 0x0b, 0x00,
-                                             0xbb, 0x00, 0x01, 0xba};
-  pl.reset(
-      CRYPTO_BUFFER_new(kTestProperties2, sizeof(kTestProperties2), nullptr));
-  ASSERT_TRUE(pl);
-  EXPECT_TRUE(SSL_CREDENTIAL_set1_certificate_properties(cred.get(), pl.get()));
-
-  // A CertificatePropertyList containing a trust_anchors property, and an
-  // unknown but malformed property 0xbb with missing data.
-  static const uint8_t kTestProperties3 = {0x00, 0x09, 0x00, 0x00, 0x00, 0x03,
-                                             0xba, 0xdb, 0x0b, 0x00, 0xbb};
-  pl.reset(
-      CRYPTO_BUFFER_new(kTestProperties3, sizeof(kTestProperties3), nullptr));
-  ASSERT_TRUE(pl);
-  EXPECT_FALSE(
-      SSL_CREDENTIAL_set1_certificate_properties(cred.get(), pl.get()));
-  EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_SSL,
-                          SSL_R_INVALID_CERTIFICATE_PROPERTY_LIST));
 
-  // A CertificatePropertyList containing a trust_anchors property, and an
-  // unknown but malformed property 0xbb with incorrect length data.
-  static const uint8_t kTestProperties4 = {0x00, 0x0c, 0x00, 0x00, 0x00,
-                                             0x03, 0xba, 0xdb, 0x0b, 0x00,
-                                             0xbb, 0x00, 0x03, 0xba};
-  pl.reset(
-      CRYPTO_BUFFER_new(kTestProperties4, sizeof(kTestProperties4), nullptr));
-  ASSERT_TRUE(pl);
-  EXPECT_FALSE(
-      SSL_CREDENTIAL_set1_certificate_properties(cred.get(), pl.get()));
-  EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_SSL,
-                          SSL_R_INVALID_CERTIFICATE_PROPERTY_LIST));
-
-  // A CertificatePropertyList containing a trust_anchors property with 0 bytes
-  // of data.
-  static const uint8_t kTestProperties5 = {0x00, 0x04, 0x00,
-                                             0x00, 0x00, 0x00};
-  pl.reset(
-      CRYPTO_BUFFER_new(kTestProperties5, sizeof(kTestProperties5), nullptr));
-  ASSERT_TRUE(pl);
-  EXPECT_FALSE(
-      SSL_CREDENTIAL_set1_certificate_properties(cred.get(), pl.get()));
-  EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_SSL,
-                          SSL_R_INVALID_TRUST_ANCHOR_LIST));
-
-  // A CertificatePropertyList containing a trust_anchors property with extra
-  // data.
-  static const uint8_t kTestProperties6 = {0x00, 0x08, 0x00, 0x00, 0x00,
-                                             0x03, 0xba, 0xdb, 0x0b, 0xbb};
-  pl.reset(
-      CRYPTO_BUFFER_new(kTestProperties6, sizeof(kTestProperties6), nullptr));
-  ASSERT_TRUE(pl);
-  EXPECT_FALSE(
-      SSL_CREDENTIAL_set1_certificate_properties(cred.get(), pl.get()));
-  EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_SSL,
-                          SSL_R_INVALID_CERTIFICATE_PROPERTY_LIST));
-
-  // A CertificatePropertyList containing a trust_anchors property with missing
-  // data.
-  static const uint8_t kTestProperties7 = {0x00, 0x06, 0x00, 0x00,
-                                             0x00, 0x03, 0xba, 0xdb};
-  pl.reset(
-      CRYPTO_BUFFER_new(kTestProperties7, sizeof(kTestProperties7), nullptr));
-  ASSERT_TRUE(pl);
-  EXPECT_FALSE(
-      SSL_CREDENTIAL_set1_certificate_properties(cred.get(), pl.get()));
-  EXPECT_TRUE(ErrorEquals(ERR_get_error(), ERR_LIB_SSL,
-                          SSL_R_INVALID_CERTIFICATE_PROPERTY_LIST));
-
-  // A CertificatePropertyList containing only a trust_anchors property.
-  static const uint8_t kTestProperties8 = {0x00, 0x07, 0x00, 0x00, 0x00,
-                                             0x03, 0xba, 0xdb, 0x0b};
-  pl.reset(
-      CRYPTO_BUFFER_new(kTestProperties8, sizeof(kTestProperties8), nullptr));
-  ASSERT_TRUE(pl);
-  EXPECT_TRUE(SSL_CREDENTIAL_set1_certificate_properties(cred.get(), pl.get()));
+  static const struct {
+    std::vector<uint8_t> props;
+    bool ok;
+  } kTests = {
+      // trust_anchors and an unknown property 0xbb with 0 bytes of data.
+      {{0x00, 0x0b, 0x00, 0x00, 0x00, 0x03, 0xba, 0xdb, 0x0b, 0x00, 0xbb, 0x00,
+        0x00},
+       true},
+      // trust_anchors and an unknown property 0xbb with 1 byte of data.
+      {{0x00, 0x0c, 0x00, 0x00, 0x00, 0x03, 0xba, 0xdb, 0x0b, 0x00, 0xbb, 0x00,
+        0x01, 0xba},
+       true},
+      // trust_anchors and an unknown but malformed property 0xbb with missing
+      // data.
+      {{0x00, 0x09, 0x00, 0x00, 0x00, 0x03, 0xba, 0xdb, 0x0b, 0x00, 0xbb},
+       false},
+      // trust_anchors and an unknown but malformed property 0xbb with incorrect
+      // length data.
+      {{0x00, 0x0c, 0x00, 0x00, 0x00, 0x03, 0xba, 0xdb, 0x0b, 0x00, 0xbb, 0x00,
+        0x03, 0xba},
+       false},
+      // trust_anchors with 0 bytes of data.
+      {{0x00, 0x04, 0x00, 0x00, 0x00, 0x00}, false},
+      // trust_anchors with extra data.
+      {{0x00, 0x08, 0x00, 0x00, 0x00, 0x03, 0xba, 0xdb, 0x0b, 0xbb}, false},
+      // trust_anchors with missing data.
+      {{0x00, 0x06, 0x00, 0x00, 0x00, 0x03, 0xba, 0xdb}, false},
+      // Only trust_anchors.
+      {{0x00, 0x07, 0x00, 0x00, 0x00, 0x03, 0xba, 0xdb, 0x0b}, true},
+      // Duplicate trust_anchors.
+      {{0x00, 0x0e, 0x00, 0x00, 0x00, 0x03, 0x11, 0x11, 0x11, 0x00, 0x00, 0x00,
+        0x03, 0x22, 0x22, 0x22},
+       false},
+      // Only unknown properties.
+      {{0x00, 0x08, 0xaa, 0xaa, 0x00, 0x00, 0xbb, 0xbb, 0x00, 0x00}, true},
+      // Duplicate unknown properties.
+      {{0x00, 0x08, 0xaa, 0xaa, 0x00, 0x00, 0xaa, 0xaa, 0x00, 0x00}, false},
+      // Out of order unknown properties.
+      {{0x00, 0x08, 0xbb, 0xbb, 0x00, 0x00, 0xaa, 0xaa, 0x00, 0x00}, false},
+      // Empty trust_anchor_group_inclusions (should have been omitted).
+      {{0x00, 0x06, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00}, false},
+      // Trailing data after trust_anchor_group_inclusions.
+      {{0x00, 0x1b, 0x00, 0x01, 0x00, 0x17, 0x00, 0x14, 0x03, 0x11,
+        0x11, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00},
+       false},
+  };
+  for (const auto &t : kTests) {
+    SCOPED_TRACE(Bytes(t.props));
+    bssl::UniquePtr<CRYPTO_BUFFER> props(
+        CRYPTO_BUFFER_new(t.props.data(), t.props.size(), nullptr));
+    ASSERT_TRUE(props);
+    if (t.ok) {
+      EXPECT_TRUE(
+          SSL_CREDENTIAL_set1_certificate_properties(cred.get(), props.get()));
+    } else {
+      EXPECT_FALSE(
+          SSL_CREDENTIAL_set1_certificate_properties(cred.get(), props.get()));
+      ERR_clear_error();
+    }
+  }
 }
 
 TEST(SSLTest, SetChainAndKeyCtx) {
@@ -7209,8 +7209,8 @@
 
   // The default list of groups is used before applying the handoff.
   EXPECT_THAT(FromOpaque(server.get())->config->supported_group_list,
-              ElementsAreArray({SSL_GROUP_X25519, SSL_GROUP_SECP256R1,
-                                SSL_GROUP_SECP384R1}));
+              ElementsAreArray({SSL_GROUP_X25519_MLKEM768, SSL_GROUP_X25519,
+                                SSL_GROUP_SECP256R1, SSL_GROUP_SECP384R1}));
   ASSERT_TRUE(SSL_apply_handoff(server.get(), handoff));
   EXPECT_EQ(1u, FromOpaque(server.get())->config->supported_group_list.size());
   EXPECT_EQ(SSL_GROUP_SECP256R1,
@@ -9490,6 +9490,8 @@
   // Servers cannot call `SSL_process_tls13_new_session_ticket`.
   ASSERT_FALSE(SSL_process_tls13_new_session_ticket(server.get(), kTicket,
                                                     sizeof(kTicket)));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
 
   // Clients cannot call `SSL_process_tls13_new_session_ticket` before the
   // handshake completes.
@@ -9498,6 +9500,8 @@
   SSL_set_connect_state(client2.get());
   ASSERT_FALSE(SSL_process_tls13_new_session_ticket(client2.get(), kTicket,
                                                     sizeof(kTicket)));
+  EXPECT_TRUE(
+      ErrorsAreAndClear({{ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED}}));
 }
 
 TEST(SSLTest, BIO) {
@@ -9604,6 +9608,90 @@
   check_alpn_proto({});
 }
 
+TEST(SSLTest, DeclarativeServerALPN) {
+  bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(TLS_method()));
+  bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(TLS_method()));
+  ASSERT_TRUE(client_ctx);
+  ASSERT_TRUE(server_ctx);
+  bssl::UniquePtr<X509> cert = GetTestCertificate();
+  bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
+  ASSERT_TRUE(cert);
+  ASSERT_TRUE(key);
+  ASSERT_TRUE(SSL_CTX_use_certificate(server_ctx.get(), cert.get()));
+  ASSERT_TRUE(SSL_CTX_use_PrivateKey(server_ctx.get(), key.get()));
+  SSL_CTX_set_custom_verify(client_ctx.get(), SSL_VERIFY_PEER,
+                            AcceptAnyCertificate);
+
+  // Helper to run connection and check negotiated ALPN.
+  auto check_negotiation =
+      &(bssl::Span<const uint8_t> client_protos,
+          bssl::Span<const uint8_t> server_protos,
+          std::optional<bssl::Span<const uint8_t>> expected_alpn) {
+        ASSERT_EQ(
+            0, SSL_CTX_set_alpn_protos(client_ctx.get(), client_protos.data(),
+                                       client_protos.size()));
+        ASSERT_EQ(
+            0, SSL_CTX_set_alpn_protos(server_ctx.get(), server_protos.data(),
+                                       server_protos.size()));
+
+        bssl::UniquePtr<SSL> client, server;
+        bool success = ConnectClientAndServer(
+            &client, &server, client_ctx.get(), server_ctx.get());
+        if (!expected_alpn.has_value()) {
+          EXPECT_FALSE(success);
+          return;
+        }
+
+        ASSERT_TRUE(success);
+        const uint8_t *alpn = nullptr;
+        unsigned alpn_len = 0;
+        SSL_get0_alpn_selected(client.get(), &alpn, &alpn_len);
+        EXPECT_EQ(Bytes(*expected_alpn), Bytes(alpn, alpn_len));
+        SSL_get0_alpn_selected(server.get(), &alpn, &alpn_len);
+        EXPECT_EQ(Bytes(*expected_alpn), Bytes(alpn, alpn_len));
+      };
+  const auto kBar = bssl::StringAsBytes("bar");
+  const auto kH2 = bssl::StringAsBytes("h2");
+
+  // 1. Basic match: Client "foo", "bar", Server "bar", "baz" ->
+  // negotiates "bar"
+  const uint8_t kClient1 = {3, 'f', 'o', 'o', 3, 'b', 'a', 'r'};
+  const uint8_t kServer1 = {3, 'b', 'a', 'r', 3, 'b', 'a', 'z'};
+  check_negotiation(kClient1, kServer1, kBar);
+
+  // 2. Client preference: Client "bar", "foo", Server "foo", "bar" ->
+  // negotiates "bar"
+  const uint8_t kClient2 = {3, 'b', 'a', 'r', 3, 'f', 'o', 'o'};
+  const uint8_t kServer2 = {3, 'f', 'o', 'o', 3, 'b', 'a', 'r'};
+  check_negotiation(kClient2, kServer2, kBar);
+
+  // 3. No overlap -> Handshake fails
+  const uint8_t kClient3 = {3, 'f', 'o', 'o'};
+  const uint8_t kServer3 = {3, 'b', 'a', 'r'};
+  check_negotiation(kClient3, kServer3, std::nullopt);
+
+  // 4. HTTP/2 example.
+  SSL_CTX_set_min_proto_version(client_ctx.get(), TLS1_2_VERSION);
+  SSL_CTX_set_max_proto_version(client_ctx.get(), TLS1_2_VERSION);
+  SSL_CTX_set_min_proto_version(server_ctx.get(), TLS1_2_VERSION);
+  SSL_CTX_set_max_proto_version(server_ctx.get(), TLS1_2_VERSION);
+
+  const uint8_t kClientH2 = {2,   'h', '2', 8,   'h', 't',
+                               't', 'p', '/', '1', '.', '1'};
+  const uint8_t kServerH2 = {2, 'h', '2'};
+
+  ASSERT_TRUE(
+      SSL_CTX_set_cipher_list(client_ctx.get(), "ECDHE-RSA-AES128-SHA256"));
+  ASSERT_TRUE(
+      SSL_CTX_set_cipher_list(server_ctx.get(), "ECDHE-RSA-AES128-SHA256"));
+
+  // Yes, this is a violation of RFC 7540, Section 9.2.
+  // However, we made a conscious decision to negotiate "h2" anyway.
+  // Users should install their own ALPN callback to enforce the cipher suite
+  // restrictions.
+  check_negotiation(kClientH2, kServerH2, kH2);
+}
+
 TEST(SSLTest, AcceptedPeerCertTypesConfig) {
   bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
   ASSERT_TRUE(ctx);
@@ -11075,16 +11163,22 @@
   Span<const uint8_t> client_read, client_write, server_read, server_write;
   bool client_ok =
       SSL_get_traffic_secrets(client_.get(), &client_read, &client_write);
-  bool server_ok =
-      SSL_get_traffic_secrets(server_.get(), &server_read, &server_write);
   if (!is_dtls() && version() >= TLS1_3_VERSION) {
+    bool server_ok =
+        SSL_get_traffic_secrets(server_.get(), &server_read, &server_write);
     ASSERT_TRUE(client_ok);
     ASSERT_TRUE(server_ok);
     EXPECT_EQ(Bytes(client_read), Bytes(server_write));
     EXPECT_EQ(Bytes(server_read), Bytes(client_write));
   } else {
     EXPECT_FALSE(client_ok);
+    int expected_reason =
+        is_dtls() ? ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED : SSL_R_WRONG_SSL_VERSION;
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_SSL, expected_reason}}));
+    bool server_ok =
+        SSL_get_traffic_secrets(server_.get(), &server_read, &server_write);
     EXPECT_FALSE(server_ok);
+    EXPECT_TRUE(ErrorsAreAndClear({{ERR_LIB_SSL, expected_reason}}));
   }
 }

boringssl-0.20260708.tar.xz/ssl/test/bssl_shim.cc -> boringssl-0.20260813.tar.xz/ssl/test/bssl_shim.cc Changed

@@ -502,9 +502,7 @@
     }
   }
 
-  // early_callback_called is updated in the handshaker, so we don't see it
-  // here.
-  if (!config->handoff && config->is_server && !state->early_callback_called) {
+  if (config->is_server && !state->early_callback_called) {
     fprintf(stderr, "early callback not called\n");
     return false;
   }
@@ -781,8 +779,7 @@
   return true;
 }
 
-static bool DoExchange(bssl::UniquePtr<SSL_SESSION> *out_session,
-                       bssl::UniquePtr<SSL> *ssl_uniqueptr,
+static bool DoExchange(bssl::UniquePtr<SSL_SESSION> *out_session, SSL *ssl,
                        const TestConfig *config, bool is_resume, bool is_retry,
                        SettingsWriter *writer);
 
@@ -869,7 +866,8 @@
     bio.release();  // SSL_set_bio takes ownership.
   }
 
-  bool ret = DoExchange(out_session, &ssl, config, is_resume, false, writer);
+  bool ret =
+      DoExchange(out_session, ssl.get(), config, is_resume, false, writer);
   if (!config->is_server && is_resume && config->expect_reject_early_data) {
     // We must have failed due to an early data rejection.
     if (ret) {
@@ -914,9 +912,9 @@
       return false;
     }
 
-    assert(!config->handoff);
     config = retry_config;
-    ret = DoExchange(out_session, &ssl, retry_config, is_resume, true, writer);
+    ret = DoExchange(out_session, ssl.get(), retry_config, is_resume, true,
+                     writer);
   }
 
   // An ECH rejection appears as a failed connection. Note `ssl` may use a
@@ -978,29 +976,14 @@
   return true;
 }
 
-static bool DoExchange(bssl::UniquePtr<SSL_SESSION> *out_session,
-                       bssl::UniquePtr<SSL> *ssl_uniqueptr,
+static bool DoExchange(bssl::UniquePtr<SSL_SESSION> *out_session, SSL *ssl,
                        const TestConfig *config, bool is_resume, bool is_retry,
                        SettingsWriter *writer) {
   int ret;
-  SSL *ssl = ssl_uniqueptr->get();
   SSL_CTX *session_ctx = SSL_get_SSL_CTX(ssl);
   TestState *test_state = GetTestState(ssl);
 
   if (!config->implicit_handshake) {
-    if (config->handoff) {
-#if defined(HANDSHAKER_SUPPORTED)
-      if (!DoSplitHandshake(ssl_uniqueptr, writer, is_resume)) {
-        return false;
-      }
-      ssl = ssl_uniqueptr->get();
-      test_state = GetTestState(ssl);
-#else
-      fprintf(stderr, "The external handshaker can only be used on Linux\n");
-      return false;
-#endif
-    }
-
     do {
       ret = CheckIdempotentError("SSL_do_handshake", ssl, &() -> int {
         return SSL_do_handshake(ssl);

boringssl-0.20260708.tar.xz/ssl/test/fuzzer.h -> boringssl-0.20260813.tar.xz/ssl/test/fuzzer.h Changed

@@ -30,7 +30,6 @@
 #include <openssl/evp.h>
 #include <openssl/hpke.h>
 #include <openssl/rand.h>
-#include <openssl/rsa.h>
 #include <openssl/ssl.h>
 #include <openssl/x509.h>
 
@@ -336,60 +335,19 @@
       SSL_set_tlsext_host_name(ssl.get(), "hostname");
     }
 
-    // ssl_handoff may or may not be used.
-    bssl::UniquePtr<SSL> ssl_handoff(SSL_new(ctx_.get()));
-    bssl::UniquePtr<SSL> ssl_handback(SSL_new(ctx_.get()));
-    SSL_set_accept_state(ssl_handoff.get());
-
     SSL_set0_rbio(ssl.get(), MakeBIO(CBS_data(&cbs), CBS_len(&cbs)).release());
     SSL_set0_wbio(ssl.get(), BIO_new(BIO_s_mem()));
 
-    SSL *ssl_handshake = ssl.get();
-    bool handshake_successful = false;
-    bool handback_successful = false;
-    for (;;) {
-      int ret = SSL_do_handshake(ssl_handshake);
-      if (ret < 0 && SSL_get_error(ssl_handshake, ret) == SSL_ERROR_HANDOFF) {
-        MoveBIOs(ssl_handoff.get(), ssl.get());
-        // Ordinarily we would call SSL_serialize_handoff(ssl.get().  But for
-        // fuzzing, use the serialized handoff that's getting fuzzed.
-        if (!bssl::SSL_apply_handoff(ssl_handoff.get(), handoff_)) {
-          if (debug_) {
-            fprintf(stderr, "Handoff failed.\n");
-          }
-          break;
-        }
-        ssl_handshake = ssl_handoff.get();
-      } else if (ret < 0 &&
-                 SSL_get_error(ssl_handshake, ret) == SSL_ERROR_HANDBACK) {
-        MoveBIOs(ssl_handback.get(), ssl_handoff.get());
-        if (!bssl::SSL_apply_handback(ssl_handback.get(), handback_)) {
-          if (debug_) {
-            fprintf(stderr, "Handback failed.\n");
-          }
-          break;
-        }
-        handback_successful = true;
-        ssl_handshake = ssl_handback.get();
-      } else {
-        handshake_successful = ret == 1;
-        break;
-      }
-    }
-
-    if (debug_) {
-      if (!handshake_successful) {
-        fprintf(stderr, "Handshake failed.\n");
-      } else if (handback_successful) {
-        fprintf(stderr, "Handback successful.\n");
-      }
+    bool handshake_successful = SSL_do_handshake(ssl.get()) == 1;
+    if (debug_ && !handshake_successful) {
+      fprintf(stderr, "Handshake failed.\n");
     }
 
     if (handshake_successful) {
       // Keep reading application data until error or EOF.
       uint8_t tmp1024;
       for (;;) {
-        if (SSL_read(ssl_handshake, tmp, sizeof(tmp)) <= 0) {
+        if (SSL_read(ssl.get(), tmp, sizeof(tmp)) <= 0) {
           break;
         }
       }
@@ -406,12 +364,9 @@
   // Init initializes `ctx_` with settings common to all inputs.
   bool Init() {
     ctx_.reset(SSL_CTX_new(protocol_ == kDTLS ? DTLS_method() : TLS_method()));
-    bssl::UniquePtr<EVP_PKEY> pkey(EVP_PKEY_new());
-    bssl::UniquePtr<RSA> privkey(RSA_private_key_from_bytes(
-        kRSAPrivateKeyDER, sizeof(kRSAPrivateKeyDER)));
-    if (!ctx_ || !privkey || !pkey ||
-        !EVP_PKEY_set1_RSA(pkey.get(), privkey.get()) ||
-        !SSL_CTX_use_PrivateKey(ctx_.get(), pkey.get())) {
+    bssl::UniquePtr<EVP_PKEY> pkey(EVP_PKEY_from_rsa_private_key(
+        EVP_pkey_rsa(), kRSAPrivateKeyDER, sizeof(kRSAPrivateKeyDER)));
+    if (!ctx_ || !pkey || !SSL_CTX_use_PrivateKey(ctx_.get(), pkey.get())) {
       return false;
     }
 
@@ -452,10 +407,8 @@
     }
 
     static const uint16_t kGroups = {
-        SSL_GROUP_X25519_MLKEM768, SSL_GROUP_X25519_KYBER768_DRAFT00,
-        SSL_GROUP_MLKEM1024,       SSL_GROUP_X25519,
-        SSL_GROUP_SECP256R1,       SSL_GROUP_SECP384R1,
-        SSL_GROUP_SECP521R1};
+        SSL_GROUP_X25519_MLKEM768, SSL_GROUP_MLKEM1024, SSL_GROUP_X25519,
+        SSL_GROUP_SECP256R1,       SSL_GROUP_SECP384R1, SSL_GROUP_SECP521R1};
     if (!SSL_CTX_set1_group_ids(ctx_.get(), kGroups, std::size(kGroups))) {
       return false;
     }
@@ -512,8 +465,6 @@
     // `ctx` is shared between runs, so we must clear any modifications to it
     // made later on in this function.
     SSL_CTX_flush_sessions(ctx_.get(), 0);
-    handoff_ = {};
-    handback_ = {};
 
     bssl::UniquePtr<SSL> ssl(SSL_new(ctx_.get()));
     if (role_ == kServer) {
@@ -557,28 +508,6 @@
           SSL_set_verify(ssl.get(), SSL_VERIFY_PEER, nullptr);
           break;
 
-        case kHandoffTag: {
-          CBS handoff;
-          if (!CBS_get_u24_length_prefixed(cbs, &handoff)) {
-            return nullptr;
-          }
-          handoff_.assign(CBS_data(&handoff),
-                          CBS_data(&handoff) + CBS_len(&handoff));
-          bssl::SSL_set_handoff_mode(ssl.get(), 1);
-          break;
-        }
-
-        case kHandbackTag: {
-          CBS handback;
-          if (!CBS_get_u24_length_prefixed(cbs, &handback)) {
-            return nullptr;
-          }
-          handback_.assign(CBS_data(&handback),
-                           CBS_data(&handback) + CBS_len(&handback));
-          bssl::SSL_set_handoff_mode(ssl.get(), 1);
-          break;
-        }
-
         case kHintsTag: {
           CBS hints;
           if (!CBS_get_u24_length_prefixed(cbs, &hints)) {
@@ -650,7 +579,6 @@
   Protocol protocol_;
   Role role_;
   bssl::UniquePtr<SSL_CTX> ctx_;
-  std::vector<uint8_t> handoff_, handback_;
 };
 
 }  // namespace

boringssl-0.20260708.tar.xz/ssl/test/fuzzer_tags.h -> boringssl-0.20260813.tar.xz/ssl/test/fuzzer_tags.h Changed

boringssl-0.20260708.tar.xz/ssl/test/handshake_util.cc -> boringssl-0.20260813.tar.xz/ssl/test/handshake_util.cc Changed

@@ -138,24 +138,6 @@
 
 #if defined(HANDSHAKER_SUPPORTED)
 
-// MoveBIOs moves the `BIO`s of `src` to `dst`.  It is used for handoff.
-static void MoveBIOs(SSL *dest, SSL *src) {
-  BIO *rbio = SSL_get_rbio(src);
-  BIO_up_ref(rbio);
-  SSL_set0_rbio(dest, rbio);
-
-  BIO *wbio = SSL_get_wbio(src);
-  BIO_up_ref(wbio);
-  SSL_set0_wbio(dest, wbio);
-
-  SSL_set0_rbio(src, nullptr);
-  SSL_set0_wbio(src, nullptr);
-}
-
-static bool HandoffReady(SSL *ssl, int ret) {
-  return ret < 0 && SSL_get_error(ssl, ret) == SSL_ERROR_HANDOFF;
-}
-
 static ssize_t read_eintr(int fd, void *out, size_t len) {
   ssize_t ret;
   do {
@@ -180,130 +162,6 @@
   return ret;
 }
 
-// Proxy relays data between `socket`, which is connected to the client, and the
-// handshaker, which is connected to the numerically specified file descriptors,
-// until the handshaker returns control.
-static bool Proxy(BIO *socket, bool async, int control, int rfd, int wfd) {
-  for (;;) {
-    fd_set rfds;
-    FD_ZERO(&rfds);
-    FD_SET(wfd, &rfds);
-    FD_SET(control, &rfds);
-    int fd_max = wfd > control ? wfd : control;
-    if (select(fd_max + 1, &rfds, nullptr, nullptr, nullptr) == -1) {
-      perror("select");
-      return false;
-    }
-
-    char buf64;
-    ssize_t bytes;
-    if (FD_ISSET(wfd, &rfds) &&
-        (bytes = read_eintr(wfd, buf, sizeof(buf))) > 0) {
-      char *b = buf;
-      while (bytes) {
-        int written = BIO_write(socket, b, bytes);
-        if (!written) {
-          fprintf(stderr, "BIO_write wrote nothing\n");
-          return false;
-        }
-        if (written < 0) {
-          if (async) {
-            AsyncBioAllowWrite(socket, 1);
-            continue;
-          }
-          fprintf(stderr, "BIO_write failed\n");
-          return false;
-        }
-        b += written;
-        bytes -= written;
-      }
-      // Flush all pending data from the handshaker to the client before
-      // considering control messages.
-      continue;
-    }
-
-    if (!FD_ISSET(control, &rfds)) {
-      continue;
-    }
-
-    char msg;
-    if (read_eintr(control, &msg, 1) != 1) {
-      perror("read");
-      return false;
-    }
-    switch (msg) {
-      case kControlMsgDone:
-        return true;
-      case kControlMsgError:
-        return false;
-      case kControlMsgUnimplemented:
-        exit(kExitCodeUnimplemented);
-      case kControlMsgWantRead:
-        break;
-      default:
-        fprintf(stderr, "Unknown control message from handshaker: %c\n", msg);
-        return false;
-    }
-
-    auto proxy_data = &(uint8_t *out, size_t len) -> bool {
-      if (async) {
-        AsyncBioAllowRead(socket, len);
-      }
-
-      while (len > 0) {
-        int bytes_read = BIO_read(socket, out, len);
-        if (bytes_read < 1) {
-          fprintf(stderr, "BIO_read failed\n");
-          return false;
-        }
-
-        ssize_t bytes_written = write_eintr(rfd, out, bytes_read);
-        if (bytes_written == -1) {
-          perror("write");
-          return false;
-        }
-        if (bytes_written != bytes_read) {
-          fprintf(stderr, "short write (%zd of %d bytes)\n", bytes_written,
-                  bytes_read);
-          return false;
-        }
-
-        len -= bytes_read;
-        out += bytes_read;
-      }
-      return true;
-    };
-
-    // Process one SSL record at a time.  That way, we don't send the handshaker
-    // anything it doesn't want to process, e.g. early data.
-    uint8_t headerSSL3_RT_HEADER_LENGTH;
-    if (!proxy_data(header, sizeof(header))) {
-      return false;
-    }
-    if (header1 != 3) {
-       fprintf(stderr, "bad header\n");
-       return false;
-    }
-    size_t remaining = (header3 << 8) + header4;
-    while (remaining > 0) {
-      uint8_t readbuf64;
-      size_t len = remaining > sizeof(readbuf) ? sizeof(readbuf) : remaining;
-      if (!proxy_data(readbuf, len)) {
-        return false;
-      }
-      remaining -= len;
-    }
-
-    // The handshaker blocks on the control channel, so we have to signal
-    // it that the data have been written.
-    msg = kControlMsgWriteCompleted;
-    if (write_eintr(control, &msg, 1) != 1) {
-      perror("write");
-      return false;
-    }
-  }
-}
-
 class ScopedFD {
  public:
   ScopedFD() : fd_(-1) {}
@@ -486,76 +344,6 @@
   return true;
 }
 
-// RunHandshaker forks and execs the handshaker binary, handing off `input`,
-// and, after proxying some amount of handshake traffic, handing back `out`.
-static bool RunHandshaker(BIO *bio, const TestConfig *config, bool is_resume,
-                          Span<const uint8_t> input,
-                          std::vector<uint8_t> *out) {
-  int rfd2, wfd2;
-  // We use pipes, rather than some other mechanism, for their buffers.  During
-  // the handshake, this process acts as a dumb proxy until receiving the
-  // handback signal, which arrives asynchronously.  The race condition means
-  // that this process could incorrectly proxy post-handshake data from the
-  // client to the handshaker.
-  //
-  // To avoid this, this process never proxies data to the handshaker that the
-  // handshaker has not explicitly requested as a result of hitting
-  // `SSL_ERROR_WANT_READ`.  Pipes allow the data to sit in a buffer while the
-  // two processes synchronize over the `control` channel.
-  if (pipe(rfd) != 0) {
-    perror("pipe");
-    return false;
-  }
-  ScopedFD rfd0_closer(rfd0), rfd1_closer(rfd1);
-
-  if (pipe(wfd) != 0) {
-    perror("pipe");
-    return false;
-  }
-  ScopedFD wfd0_closer(wfd0), wfd1_closer(wfd1);
-
-  ScopedProcess handshaker;
-  ScopedFD control;
-  if (!StartHandshaker(
-          &handshaker, &control, config, is_resume,
-          {{kFdProxyToHandshaker, rfd0}, {kFdHandshakerToProxy, wfd1}},
-          {rfd1, wfd0})) {
-    return false;
-  }
-
-  rfd0_closer.Reset();
-  wfd1_closer.Reset();
-
-  if (write_eintr(control.fd(), input.data(), input.size()) == -1) {
-    perror("write");
-    return false;
-  }
-  bool ok = Proxy(bio, config->async, control.fd(), rfd1, wfd0);
-  int wstatus;
-  if (!handshaker.Wait(&wstatus)) {
-    perror("waitpid");
-    return false;
-  }
-  if (ok && wstatus) {
-    fprintf(stderr, "handshaker exited irregularly\n");
-    return false;
-  }
-  if (!ok) {
-    return false;  // This is a "good", i.e. expected, error.
-  }
-
-  constexpr size_t kBufSize = 1024 * 1024;
-  std::vector<uint8_t> buf(kBufSize);
-  ssize_t len = read_eintr(control.fd(), buf.data(), buf.size());
-  if (len == -1) {
-    perror("read");
-    return false;
-  }
-  buf.resize(len);
-  *out = std::move(buf);
-  return true;
-}
-
 static bool RequestHandshakeHint(const TestConfig *config, bool is_resume,
                                  Span<const uint8_t> input, bool *out_has_hints,
                                  std::vector<uint8_t> *out_hints) {
@@ -613,86 +401,6 @@
   return true;
 }
 
-// PrepareHandoff accepts the `ClientHello` from `ssl` and serializes state to
-// be passed to the handshaker.  The serialized state includes both the SSL
-// handoff, as well test-related state.
-static bool PrepareHandoff(SSL *ssl, SettingsWriter *writer,
-                           std::vector<uint8_t> *out_handoff) {
-  SSL_set_handoff_mode(ssl, 1);
-
-  const TestConfig *config = GetTestConfig(ssl);
-  int ret = -1;
-  do {
-    ret = CheckIdempotentError(
-        "SSL_do_handshake", ssl,
-        &() -> int { return SSL_do_handshake(ssl); });
-  } while (!HandoffReady(ssl, ret) &&
-           config->async &&
-           RetryAsync(ssl, ret));
-  if (!HandoffReady(ssl, ret)) {
-    fprintf(stderr, "Handshake failed while waiting for handoff.\n");
-    return false;
-  }
-
-  ScopedCBB cbb;
-  SSL_CLIENT_HELLO hello;
-  if (!CBB_init(cbb.get(), 512) ||
-      !SSL_serialize_handoff(ssl, cbb.get(), &hello) ||
-      !writer->WriteHandoff({CBB_data(cbb.get()), CBB_len(cbb.get())}) ||
-      !SerializeContextState(SSL_get_SSL_CTX(ssl), cbb.get()) ||
-      !GetTestState(ssl)->Serialize(cbb.get())) {
-    fprintf(stderr, "Handoff serialisation failed.\n");
-    return false;
-  }
-  out_handoff->assign(CBB_data(cbb.get()),
-                      CBB_data(cbb.get()) + CBB_len(cbb.get()));
-  return true;
-}
-
-// DoSplitHandshake delegates the SSL handshake to a separate process, called
-// the handshaker.  This process proxies I/O between the handshaker and the
-// client, using the `BIO` from `ssl`.  After a successful handshake, `ssl` is
-// replaced with a new `SSL` object, in a way that is intended to be invisible
-// to the caller.
-bool DoSplitHandshake(UniquePtr<SSL> *ssl, SettingsWriter *writer,
-                      bool is_resume) {
-  assert(SSL_get_rbio(ssl->get()) == SSL_get_wbio(ssl->get()));
-  std::vector<uint8_t> handshaker_input;
-  const TestConfig *config = GetTestConfig(ssl->get());
-  // out is the response from the handshaker, which includes a serialized
-  // handback message, but also serialized updates to the `TestState`.
-  std::vector<uint8_t> out;
-  if (!PrepareHandoff(ssl->get(), writer, &handshaker_input) ||
-      !RunHandshaker(SSL_get_rbio(ssl->get()), config, is_resume,
-                     handshaker_input, &out)) {
-    fprintf(stderr, "Handoff failed.\n");
-    return false;
-  }
-
-  SSL_CTX *ctx = SSL_get_SSL_CTX(ssl->get());
-  UniquePtr<SSL> ssl_handback = config->NewSSL(ctx, nullptr, nullptr);
-  if (!ssl_handback) {
-    return false;
-  }
-  CBS output, handback;
-  CBS_init(&output, out.data(), out.size());
-  if (!CBS_get_u24_length_prefixed(&output, &handback) ||
-      !DeserializeContextState(&output, ctx) ||
-      !SetTestState(ssl_handback.get(), TestState::Deserialize(&output, ctx)) ||
-      !GetTestState(ssl_handback.get()) || !writer->WriteHandback(handback) ||
-      !SSL_apply_handback(ssl_handback.get(), handback)) {
-    fprintf(stderr, "Handback failed.\n");
-    return false;
-  }
-  MoveBIOs(ssl_handback.get(), ssl->get());
-  GetTestState(ssl_handback.get())->async_bio =
-      GetTestState(ssl->get())->async_bio;
-  GetTestState(ssl->get())->async_bio = nullptr;
-
-  *ssl = std::move(ssl_handback);
-  return true;
-}
-
 bool GetHandshakeHint(SSL *ssl, SettingsWriter *writer, bool is_resume,
                       const SSL_CLIENT_HELLO *client_hello) {
   ScopedCBB input;

boringssl-0.20260708.tar.xz/ssl/test/handshake_util.h -> boringssl-0.20260813.tar.xz/ssl/test/handshake_util.h Changed

boringssl-0.20260708.tar.xz/ssl/test/handshaker.cc -> boringssl-0.20260813.tar.xz/ssl/test/handshaker.cc Changed

@@ -18,6 +18,7 @@
 #include <signal.h>
 #include <unistd.h>
 
+#include <cstdio>
 #include <memory>
 
 #include <openssl/bytestring.h>
@@ -48,94 +49,6 @@
   return ret;
 }
 
-bool HandbackReady(SSL *ssl, int ret) {
-  return ret < 0 && SSL_get_error(ssl, ret) == SSL_ERROR_HANDBACK;
-}
-
-bool Handshaker(const TestConfig *config, int rfd, int wfd,
-                Span<const uint8_t> input, int control) {
-  UniquePtr<SSL_CTX> ctx = config->SetupCtx(/*old_ctx=*/nullptr);
-  if (!ctx) {
-    return false;
-  }
-  UniquePtr<SSL> ssl =
-      config->NewSSL(ctx.get(), /*session=*/nullptr, /*test_state=*/nullptr);
-  if (!ssl) {
-    fprintf(stderr, "Error creating SSL object in handshaker.\n");
-    ERR_print_errors_fp(stderr);
-    return false;
-  }
-
-  // Set `O_NONBLOCK` in order to break out of the loop when we hit
-  // `SSL_ERROR_WANT_READ`, so that we can send `kControlMsgWantRead` to the
-  // proxy.
-  if (fcntl(rfd, F_SETFL, O_NONBLOCK) != 0) {
-    perror("fcntl");
-    return false;
-  }
-  SSL_set_rfd(ssl.get(), rfd);
-  SSL_set_wfd(ssl.get(), wfd);
-
-  CBS cbs, handoff;
-  CBS_init(&cbs, input.data(), input.size());
-  if (!CBS_get_asn1_element(&cbs, &handoff, CBS_ASN1_SEQUENCE) ||
-      !DeserializeContextState(&cbs, ctx.get()) ||
-      !SetTestState(ssl.get(), TestState::Deserialize(&cbs, ctx.get())) ||
-      !GetTestState(ssl.get()) ||
-      !SSL_apply_handoff(ssl.get(), handoff)) {
-    fprintf(stderr, "Handoff application failed.\n");
-    return false;
-  }
-
-  int ret = 0;
-  for (;;) {
-    ret = CheckIdempotentError(
-        "SSL_do_handshake", ssl.get(),
-        &() -> int { return SSL_do_handshake(ssl.get()); });
-    if (SSL_get_error(ssl.get(), ret) == SSL_ERROR_WANT_READ) {
-      // Synchronize with the proxy, i.e. don't let the handshake continue until
-      // the proxy has sent more data.
-      char msg = kControlMsgWantRead;
-      if (write_eintr(control, &msg, 1) != 1 ||
-          read_eintr(control, &msg, 1) != 1 ||
-          msg != kControlMsgWriteCompleted) {
-        fprintf(stderr, "read via proxy failed\n");
-        return false;
-      }
-      continue;
-    }
-    if (!RetryAsync(ssl.get(), ret)) {
-      break;
-    }
-  }
-  if (!HandbackReady(ssl.get(), ret)) {
-    fprintf(stderr, "Handshaker: %s\n",
-            SSL_error_description(SSL_get_error(ssl.get(), ret)));
-    ERR_print_errors_fp(stderr);
-    return false;
-  }
-
-  ScopedCBB output;
-  CBB handback;
-  if (!CBB_init(output.get(), 1024) ||
-      !CBB_add_u24_length_prefixed(output.get(), &handback) ||
-      !SSL_serialize_handback(ssl.get(), &handback) ||
-      !SerializeContextState(ctx.get(), output.get()) ||
-      !GetTestState(ssl.get())->Serialize(output.get())) {
-    fprintf(stderr, "Handback serialisation failed.\n");
-    return false;
-  }
-
-  char msg = kControlMsgDone;
-  if (write_eintr(control, &msg, 1) == -1 ||
-      write_eintr(control, CBB_data(output.get()), CBB_len(output.get())) ==
-          -1) {
-    perror("write");
-    return false;
-  }
-  return true;
-}
-
 bool GenerateHandshakeHint(const TestConfig *config,
                            bssl::Span<const uint8_t> request, int control) {
   // The handshake hint contains the ClientHello and the capabilities string.
@@ -267,15 +180,13 @@
   }
 #endif  // FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
 
-  if (config->handshake_hints) {
-    if (!GenerateHandshakeHint(config, request, kFdControl)) {
-      return SignalError();
-    }
-  } else {
-    if (!Handshaker(config, kFdProxyToHandshaker, kFdHandshakerToProxy,
-                    request, kFdControl)) {
-      return SignalError();
-    }
+  if (!config->handshake_hints) {
+    // Historically omitting -handshake-hints ran the split handshakes mode.
+    fprintf(stderr, "Handshaker missing -handshake-hints flag.");
+    return SignalError();
+  }
+  if (!GenerateHandshakeHint(config, request, kFdControl)) {
+    return SignalError();
   }
   return 0;
 }

boringssl-0.20260708.tar.xz/ssl/test/runner/basic_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/basic_tests.go Changed

boringssl-0.20260708.tar.xz/ssl/test/runner/certificate_selection_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/certificate_selection_tests.go Changed

boringssl-0.20260708.tar.xz/ssl/test/runner/common.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/common.go Changed

@@ -18,6 +18,7 @@
 	"time"
 
 	"boringssl.googlesource.com/boringssl.git/ssl/test/runner/hpke"
+	"golang.org/x/crypto/cryptobyte"
 )
 
 const (
@@ -262,7 +263,6 @@
 	CurveP521           CurveID = 25
 	CurveX25519         CurveID = 29
 	CurveX25519MLKEM768 CurveID = 0x11ec
-	CurveX25519Kyber768 CurveID = 0x6399
 	CurveMLKEM1024      CurveID = 0x0202
 )
 
@@ -2363,7 +2363,7 @@
 	return ret
 }
 
-var defaultCurvePreferences = CurveID{CurveX25519MLKEM768, CurveX25519Kyber768, CurveMLKEM1024, CurveX25519, CurveP256, CurveP384, CurveP521}
+var defaultCurvePreferences = CurveID{CurveX25519MLKEM768, CurveMLKEM1024, CurveX25519, CurveP256, CurveP384, CurveP521}
 
 func (c *Config) curvePreferences() CurveID {
 	if c == nil || len(c.CurvePreferences) == 0 {
@@ -2433,6 +2433,50 @@
 	return supportedSignatureAlgorithms
 }
 
+type TrustAnchorRange struct {
+	Base     byte
+	Min, Max uint64
+}
+
+const (
+	certPropTrustAnchorID              uint16 = 0
+	certPropTrustAnchorGroupInclusions uint16 = 1
+)
+
+type CertificatePropertyList struct {
+	TrustAnchorID              byte
+	TrustAnchorGroupInclusions TrustAnchorRange
+}
+
+func (c *CertificatePropertyList) Empty() bool {
+	return len(c.TrustAnchorID) == 0 && len(c.TrustAnchorGroupInclusions) == 0
+}
+
+func (c *CertificatePropertyList) Marshal() byte {
+	bb := cryptobyte.NewBuilder(nil)
+	bb.AddUint16LengthPrefixed(func(props *cryptobyte.Builder) {
+		if len(c.TrustAnchorID) != 0 {
+			props.AddUint16(certPropTrustAnchorID)
+			// The ID is encoded directly in the property data, with
+			// no additional length prefix.
+			addUint16LengthPrefixedBytes(props, c.TrustAnchorID)
+		}
+		if len(c.TrustAnchorGroupInclusions) != 0 {
+			props.AddUint16(certPropTrustAnchorGroupInclusions)
+			props.AddUint16LengthPrefixed(func(prop *cryptobyte.Builder) {
+				prop.AddUint16LengthPrefixed(func(ranges *cryptobyte.Builder) {
+					for _, r := range c.TrustAnchorGroupInclusions {
+						addUint8LengthPrefixedBytes(ranges, r.Base)
+						ranges.AddUint64(r.Min)
+						ranges.AddUint64(r.Max)
+					}
+				})
+			})
+		}
+	})
+	return bb.BytesOrPanic()
+}
+
 type CredentialType int
 
 const (
@@ -2522,9 +2566,9 @@
 	// AppendToImportedPSKIdentity is a byte string that is appended to the
 	// imported PSK identity.
 	AppendToImportedPSKIdentity byte
-	// TrustAnchorID, if not empty, is the trust anchor ID for the issuer
-	// of the certificate chain.
-	TrustAnchorID byte
+	// Properties is the certificate properties (draft-ietf-tls-trust-anchor-ids)
+	// associated with this credential.
+	Properties CertificatePropertyList
 }
 
 func (c *Credential) WithSignatureAlgorithms(sigAlgs ...signatureAlgorithm) *Credential {
@@ -2560,11 +2604,17 @@
 
 func (c *Credential) WithTrustAnchorID(id byte) *Credential {
 	ret := *c
-	ret.TrustAnchorID = id
+	ret.Properties.TrustAnchorID = id
 	ret.MustMatchIssuer = true
 	return &ret
 }
 
+func (c *Credential) WithProperties(props CertificatePropertyList) *Credential {
+	ret := *c
+	ret.Properties = props
+	return &ret
+}
+
 type handshakeMessage interface {
 	marshal() byte
 	unmarshal(byte) bool
@@ -2759,6 +2809,3 @@
 	}
 	return true
 }
-
-// https://github.com/golang/go/issues/45624
-func ptrToT any(t T) *T { return &t }

boringssl-0.20260708.tar.xz/ssl/test/runner/curve_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/curve_tests.go Changed

@@ -27,7 +27,6 @@
 	{"P-384", CurveP384},
 	{"P-521", CurveP521},
 	{"X25519", CurveX25519},
-	{"Kyber", CurveX25519Kyber768},
 	{"X25519MLKEM768", CurveX25519MLKEM768},
 	{"MLKEM1024", CurveMLKEM1024},
 }
@@ -37,7 +36,7 @@
 const curveEqualPreferenceWithNextFlag = 0x01
 
 func isPqGroup(r CurveID) bool {
-	return r == CurveX25519Kyber768 || isMLKEMGroup(r)
+	return isMLKEMGroup(r)
 }
 
 func isMLKEMGroup(r CurveID) bool {
@@ -49,7 +48,7 @@
 }
 
 func isX25519Group(r CurveID) bool {
-	return r == CurveX25519 || r == CurveX25519Kyber768 || r == CurveX25519MLKEM768
+	return r == CurveX25519 || r == CurveX25519MLKEM768
 }
 
 func addCurveTests() {
@@ -582,14 +581,13 @@
 		})
 	}
 
-	// ML-KEM and Kyber should not be offered by default as a client.
+	// ML-KEM should be offered by default as a client.
 	testCases = append(testCases, testCase{
-		name: "PostQuantumNotEnabledByDefaultInClients",
+		name: "PostQuantumEnabledByDefaultInClients",
 		config: Config{
-			MinVersion: VersionTLS13,
-			Bugs: ProtocolBugs{
-				FailIfPostQuantumOffered: true,
-			},
+			MinVersion:       VersionTLS13,
+			CurvePreferences: CurveID{CurveX25519MLKEM768},
+			Bugs:             ProtocolBugs{},
 		},
 	})
 
@@ -664,10 +662,14 @@
 			},
 		})
 
-		// If both ML-KEM and Kyber are configured, only the preferred one's
+		// If multiple PQ groups are configured, only the preferred one's
 		// key share should be sent.
+		otherMLKEM := CurveMLKEM1024
+		if curve.id == CurveMLKEM1024 {
+			otherMLKEM = CurveX25519MLKEM768
+		}
 		testCases = append(testCases, testCase{
-			name: "BothMLKEMAndKyber-" + curve.name,
+			name: "MultiplePQGroups-" + curve.name,
 			config: Config{
 				MinVersion: VersionTLS13,
 				Bugs: ProtocolBugs{
@@ -676,24 +678,23 @@
 			},
 			flags: string{
 				"-curves", strconv.Itoa(int(curve.id)),
-				"-curves", strconv.Itoa(int(CurveX25519Kyber768)),
+				"-curves", strconv.Itoa(int(otherMLKEM)),
 				"-expect-curve-id", strconv.Itoa(int(curve.id)),
 			},
 		})
 	}
 
-	// As a server, ML-KEMs and Kyber are not yet supported by default.
 	testCases = append(testCases, testCase{
 		testType: serverTest,
-		name:     "PostQuantumNotEnabledByDefaultForAServer",
+		name:     "PostQuantumEnabledByDefaultForAServer",
 		config: Config{
 			MinVersion:       VersionTLS13,
-			CurvePreferences: CurveID{CurveX25519MLKEM768, CurveMLKEM1024, CurveX25519Kyber768, CurveX25519},
-			DefaultCurves:    CurveID{CurveX25519MLKEM768, CurveMLKEM1024, CurveX25519Kyber768},
+			CurvePreferences: CurveID{CurveX25519MLKEM768},
+			DefaultCurves:    CurveID{CurveX25519MLKEM768},
 		},
 		flags: string{
 			"-server-preference",
-			"-expect-curve-id", strconv.Itoa(int(CurveX25519)),
+			"-expect-curve-id", strconv.Itoa(int(CurveX25519MLKEM768)),
 		},
 	})

boringssl-0.20260708.tar.xz/ssl/test/runner/dtls.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/dtls.go Changed

boringssl-0.20260708.tar.xz/ssl/test/runner/ech_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/ech_tests.go Changed

@@ -484,6 +484,10 @@
 					"-ech-is-retry-config", "1",
 					"-expect-ech-accept",
 					"-expect-msg-callback", expectMsgCallback,
+					// Exact message trace of the handshake depends on selected curves,
+					// as MLKEM causes messages to be split due to its handshake size
+					// and DTLS trying to respect a MTU here.
+					"-curves", strconv.Itoa(int(CurveX25519)),
 				},
 				expectations: connectionExpectations{
 					echAccepted: true,
@@ -2383,6 +2387,10 @@
 				"-ech-config-list", base64FlagValue(CreateECHConfigList(echConfig.ECHConfig.Raw)),
 				"-expect-ech-accept",
 				"-expect-msg-callback", clientAndServerHelloInitial + finishHandshake,
+				// Exact message trace of the handshake depends on selected curves,
+				// as MLKEM causes messages to be split due to its handshake size
+				// and DTLS trying to respect a MTU here.
+				"-curves", strconv.Itoa(int(CurveX25519)),
 			},
 			expectations: connectionExpectations{echAccepted: true},
 		})
@@ -2405,8 +2413,115 @@
 				"-expect-ech-accept",
 				"-expect-hrr", // Check we triggered HRR.
 				"-expect-msg-callback", clientAndServerHelloInitial + clientAndServerHello + finishHandshake,
+				// Exact message trace of the handshake depends on selected curves,
+				// as MLKEM causes messages to be split due to its handshake size
+				// and DTLS trying to respect a MTU here.
+				"-curves", strconv.Itoa(int(CurveX25519)), "-curves", strconv.Itoa(int(CurveP384)),
 			},
 			expectations: connectionExpectations{echAccepted: true},
 		})
+		unsupportedConfig := generateServerECHConfig(&ECHConfig{
+			ConfigID:     42,
+			KEM:          0x9999,
+			CipherSuites: HPKECipherSuite{{KDF: 0x1111, AEAD: 0x2222}},
+		})
+		testCases = append(testCases, testCase{
+			testType: clientTest,
+			protocol: protocol,
+			name:     prefix + "ECH-Client-RejectUnusableConfig-Success",
+			config: Config{
+				MinVersion:       VersionTLS13,
+				MaxVersion:       VersionTLS13,
+				ServerECHConfigs: ServerECHConfig{echConfig},
+				Credential:       &echSecretCertificate,
+			},
+			flags: string{
+				"-reject-unusable-ech-config",
+				"-ech-config-list", base64FlagValue(CreateECHConfigList(echConfig.ECHConfig.Raw)),
+				"-host-name", "secret.example",
+				"-expect-ech-accept",
+			},
+			expectations: connectionExpectations{echAccepted: true},
+		})
+		testCases = append(testCases, testCase{
+			testType: clientTest,
+			protocol: protocol,
+			name:     prefix + "ECH-Client-RejectUnusableConfig-UnsupportedConfig",
+			config: Config{
+				MinVersion: VersionTLS13,
+				MaxVersion: VersionTLS13,
+			},
+			flags: string{
+				"-reject-unusable-ech-config",
+				"-ech-config-list", base64FlagValue(CreateECHConfigList(unsupportedConfig.ECHConfig.Raw)),
+			},
+			shouldFail:    true,
+			expectedError: ":UNUSABLE_ECH_CONFIG_LIST:",
+		})
+		testCases = append(testCases, testCase{
+			testType: clientTest,
+			protocol: protocol,
+			name:     prefix + "ECH-Client-RejectUnusableConfig-PartialUnsupportedConfig",
+			config: Config{
+				MinVersion:       VersionTLS13,
+				MaxVersion:       VersionTLS13,
+				ServerECHConfigs: ServerECHConfig{echConfig},
+				Credential:       &echSecretCertificate,
+			},
+			flags: string{
+				"-reject-unusable-ech-config",
+				"-ech-config-list", base64FlagValue(CreateECHConfigList(unsupportedConfig.ECHConfig.Raw, echConfig.ECHConfig.Raw)),
+				"-host-name", "secret.example",
+				"-expect-ech-accept",
+			},
+			expectations: connectionExpectations{echAccepted: true},
+		})
+		testCases = append(testCases, testCase{
+			testType: clientTest,
+			protocol: protocol,
+			name:     prefix + "ECH-Client-RejectUnusableConfig-Unset",
+			config: Config{
+				MinVersion: VersionTLS13,
+				MaxVersion: VersionTLS13,
+			},
+			flags: string{
+				"-reject-unusable-ech-config",
+			},
+			shouldFail:    true,
+			expectedError: ":UNUSABLE_ECH_CONFIG_LIST:",
+		})
+		if protocol == tls {
+			testCases = append(testCases, testCase{
+				testType: clientTest,
+				protocol: protocol,
+				name:     prefix + "ECH-Client-RejectUnusableConfig-TLS12",
+				config: Config{
+					MaxVersion: VersionTLS12,
+				},
+				flags: string{
+					"-reject-unusable-ech-config",
+					"-max-version", strconv.Itoa(VersionTLS12),
+					"-ech-config-list", base64FlagValue(CreateECHConfigList(echConfig.ECHConfig.Raw)),
+				},
+				shouldFail:    true,
+				expectedError: ":UNUSABLE_ECH_CONFIG_LIST:",
+			})
+		} else if protocol == dtls {
+			testCases = append(testCases, testCase{
+				testType: clientTest,
+				protocol: protocol,
+				name:     prefix + "ECH-Client-RejectUnusableConfig-TLS12",
+				config: Config{
+					MaxVersion: VersionDTLS12,
+				},
+				flags: string{
+					"-reject-unusable-ech-config",
+					"-max-version", strconv.Itoa(VersionDTLS12),
+					"-ech-config-list", base64FlagValue(CreateECHConfigList(echConfig.ECHConfig.Raw)),
+				},
+				shouldFail:    true,
+				expectedError: ":UNUSABLE_ECH_CONFIG_LIST:",
+			})
+		}
 	}
 }

boringssl-0.20260708.tar.xz/ssl/test/runner/extension_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/extension_tests.go Changed

@@ -16,6 +16,7 @@
 
 import (
 	"fmt"
+	"strconv"
 )
 
 func addExtensionTests() {
@@ -137,7 +138,7 @@
 				flags:         string{"-expect-server-name", "example.com"},
 				resumeSession: true,
 				expectations: connectionExpectations{
-					serverNameAck: ptrTo(true),
+					serverNameAck: new(true),
 				},
 			})
 			testCases = append(testCases, testCase{
@@ -154,7 +155,7 @@
 				},
 				resumeSession: true,
 				expectations: connectionExpectations{
-					serverNameAck: ptrTo(false),
+					serverNameAck: new(false),
 				},
 			})
 
@@ -1998,10 +1999,13 @@
 				RequireClientHelloSize: 512,
 			},
 		},
-		// This hostname just needs to be long enough to push the
-		// ClientHello into F5's danger zone between 256 and 511 bytes
-		// long.
-		flags: string{"-host-name", "01234567890123456789012345678901234567890123456789012345678901234567890123456789.com"},
+		flags: string{
+			// This hostname just needs to be long enough to push the
+			// ClientHello into F5's danger zone between 256 and 511 bytes long.
+			"-host-name", "01234567890123456789012345678901234567890123456789012345678901234567890123456789.com",
+			// Curve chosen to make handshakes short enough to end up in the danger zone.
+			"-curves", strconv.Itoa(int(CurveX25519)),
+		},
 	})
 
 	// Test that illegal extensions in TLS 1.3 are rejected by the client if

boringssl-0.20260708.tar.xz/ssl/test/runner/handshake_messages.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/handshake_messages.go Changed

@@ -1241,7 +1241,7 @@
 			if !body.ReadUint16(&serverPaddingRequest) || len(body) != 0 {
 				return false
 			}
-			m.serverPaddingRequest = ptrTo(serverPaddingRequest)
+			m.serverPaddingRequest = new(serverPaddingRequest)
 		case extensionClientCertificateType:
 			var certTypes cryptobyte.String
 			if !body.ReadUint8LengthPrefixed(&certTypes) || len(body) != 0 {
@@ -1997,15 +1997,15 @@
 			if !body.ReadUint8(&certType) || len(body) != 0 {
 				return false
 			}
-			m.clientCertificateType = ptrTo(CertificateType(certType))
+			m.clientCertificateType = new(CertificateType(certType))
 		case extensionServerCertificateType:
 			var certType uint8
 			if !body.ReadUint8(&certType) || len(body) != 0 {
 				return false
 			}
-			m.serverCertificateType = ptrTo(CertificateType(certType))
+			m.serverCertificateType = new(CertificateType(certType))
 		case extensionServerPaddingRequest:
-			m.serverPadding = ptrTo(uint16(len(body)))
+			m.serverPadding = new(uint16(len(body)))
 			if !isAllZero(body) {
 				return false
 			}

boringssl-0.20260708.tar.xz/ssl/test/runner/handshake_server.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/handshake_server.go Changed

@@ -1184,9 +1184,9 @@
 		if config.Bugs.AlwaysMatchTrustAnchorID {
 			certMsg.matchedTrustAnchor = true
 		} else {
-			if hs.clientHello.trustAnchors != nil && useCert.TrustAnchorID != nil {
+			if hs.clientHello.trustAnchors != nil && useCert.Properties.TrustAnchorID != nil {
 				for _, id := range hs.clientHello.trustAnchors {
-					if bytes.Equal(useCert.TrustAnchorID, id) {
+					if bytes.Equal(useCert.Properties.TrustAnchorID, id) {
 						certMsg.matchedTrustAnchor = true
 					}
 				}
@@ -1820,7 +1820,7 @@
 		if len(sendClientCertType) == 0 {
 			serverExtensions.clientCertificateType = nil
 		} else {
-			serverExtensions.clientCertificateType = ptrTo(sendClientCertType0)
+			serverExtensions.clientCertificateType = new(sendClientCertType0)
 			c.clientCertificateType = serverExtensions.clientCertificateType
 		}
 	}
@@ -1831,7 +1831,7 @@
 		if len(sendServerCertType) == 0 {
 			serverExtensions.serverCertificateType = nil
 		} else {
-			serverExtensions.serverCertificateType = ptrTo(sendServerCertType0)
+			serverExtensions.serverCertificateType = new(sendServerCertType0)
 			c.serverCertificateType = serverExtensions.serverCertificateType
 		}
 	}

boringssl-0.20260708.tar.xz/ssl/test/runner/hint_mismatch_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/hint_mismatch_tests.go Changed

@@ -17,23 +17,18 @@
 import "strconv"
 
 func addHintMismatchTests() {
-	// Each of these tests skips split handshakes because split handshakes does
-	// not handle a mismatch between shim and handshaker. Handshake hints,
-	// however, are designed to tolerate the mismatch.
-	//
-	// Note also these tests do not specify -handshake-hints directly. Instead,
-	// we define normal tests, that run even without a handshaker, and rely on
-	// convertToSplitHandshakeTests to generate a handshaker hints variant. This
+	// These tests do not specify -handshake-hints directly. Instead,  we define
+	// normal tests, that run even without a handshaker, and rely on
+	// convertToHandshakeHintTests to generate a handshaker hints variant. This
 	// avoids repeating the -is-handshaker-supported and -handshaker-path logic.
 	// (While not useful, the tests will still pass without a handshaker.)
 	for _, protocol := range protocol{tls, quic} {
 		// If the signing payload is different, the handshake still completes
 		// successfully. Different ALPN preferences will trigger a mismatch.
 		testCases = append(testCases, testCase{
-			name:               protocol.String() + "-HintMismatch-SignatureInput",
-			testType:           serverTest,
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			name:     protocol.String() + "-HintMismatch-SignatureInput",
+			testType: serverTest,
+			protocol: protocol,
 			config: Config{
 				MinVersion: VersionTLS13,
 				MaxVersion: VersionTLS13,
@@ -52,10 +47,9 @@
 
 		// The shim and handshaker may have different curve preferences.
 		testCases = append(testCases, testCase{
-			name:               protocol.String() + "-HintMismatch-KeyShare",
-			testType:           serverTest,
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			name:     protocol.String() + "-HintMismatch-KeyShare",
+			testType: serverTest,
+			protocol: protocol,
 			config: Config{
 				MinVersion: VersionTLS13,
 				MaxVersion: VersionTLS13,
@@ -74,10 +68,9 @@
 		})
 		if protocol != quic {
 			testCases = append(testCases, testCase{
-				name:               protocol.String() + "-HintMismatch-ECDHE-Group",
-				testType:           serverTest,
-				protocol:           protocol,
-				skipSplitHandshake: true,
+				name:     protocol.String() + "-HintMismatch-ECDHE-Group",
+				testType: serverTest,
+				protocol: protocol,
 				config: Config{
 					MinVersion:    VersionTLS12,
 					MaxVersion:    VersionTLS12,
@@ -97,10 +90,9 @@
 		// If the handshaker does HelloRetryRequest, it will omit most hints.
 		// The shim should still work.
 		testCases = append(testCases, testCase{
-			name:               protocol.String() + "-HintMismatch-HandshakerHelloRetryRequest",
-			testType:           serverTest,
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			name:     protocol.String() + "-HintMismatch-HandshakerHelloRetryRequest",
+			testType: serverTest,
+			protocol: protocol,
 			config: Config{
 				MinVersion:    VersionTLS13,
 				MaxVersion:    VersionTLS13,
@@ -120,10 +112,9 @@
 		// will be ignored. This is not reported as a mismatch because hints
 		// would not have helped the shim anyway.
 		testCases = append(testCases, testCase{
-			name:               protocol.String() + "-HintMismatch-ShimHelloRetryRequest",
-			testType:           serverTest,
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			name:     protocol.String() + "-HintMismatch-ShimHelloRetryRequest",
+			testType: serverTest,
+			protocol: protocol,
 			config: Config{
 				MinVersion:    VersionTLS13,
 				MaxVersion:    VersionTLS13,
@@ -141,10 +132,9 @@
 		// The shim and handshaker may have different signature algorithm
 		// preferences.
 		testCases = append(testCases, testCase{
-			name:               protocol.String() + "-HintMismatch-SignatureAlgorithm-TLS13",
-			testType:           serverTest,
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			name:     protocol.String() + "-HintMismatch-SignatureAlgorithm-TLS13",
+			testType: serverTest,
+			protocol: protocol,
 			config: Config{
 				MinVersion: VersionTLS13,
 				MaxVersion: VersionTLS13,
@@ -162,10 +152,9 @@
 		})
 		if protocol != quic {
 			testCases = append(testCases, testCase{
-				name:               protocol.String() + "-HintMismatch-SignatureAlgorithm-TLS12",
-				testType:           serverTest,
-				protocol:           protocol,
-				skipSplitHandshake: true,
+				name:     protocol.String() + "-HintMismatch-SignatureAlgorithm-TLS12",
+				testType: serverTest,
+				protocol: protocol,
 				config: Config{
 					MinVersion: VersionTLS12,
 					MaxVersion: VersionTLS12,
@@ -191,10 +180,9 @@
 			DNSNames:   string{"test"},
 		}).ToCredential()
 		testCases = append(testCases, testCase{
-			name:               protocol.String() + "-HintMismatch-Certificate-TLS13",
-			testType:           serverTest,
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			name:     protocol.String() + "-HintMismatch-Certificate-TLS13",
+			testType: serverTest,
+			protocol: protocol,
 			config: Config{
 				MinVersion: VersionTLS13,
 				MaxVersion: VersionTLS13,
@@ -208,10 +196,9 @@
 		})
 		if protocol != quic {
 			testCases = append(testCases, testCase{
-				name:               protocol.String() + "-HintMismatch-Certificate-TLS12",
-				testType:           serverTest,
-				protocol:           protocol,
-				skipSplitHandshake: true,
+				name:     protocol.String() + "-HintMismatch-Certificate-TLS12",
+				testType: serverTest,
+				protocol: protocol,
 				config: Config{
 					MinVersion: VersionTLS12,
 					MaxVersion: VersionTLS12,
@@ -229,10 +216,9 @@
 		// We run the first connection with tickets enabled, so the client is
 		// issued a ticket, then disable tickets on the second connection.
 		testCases = append(testCases, testCase{
-			name:               protocol.String() + "-HintMismatch-NoTickets1-TLS13",
-			testType:           serverTest,
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			name:     protocol.String() + "-HintMismatch-NoTickets1-TLS13",
+			testType: serverTest,
+			protocol: protocol,
 			config: Config{
 				MinVersion: VersionTLS13,
 				MaxVersion: VersionTLS13,
@@ -245,10 +231,9 @@
 			expectResumeRejected: true,
 		})
 		testCases = append(testCases, testCase{
-			name:               protocol.String() + "-HintMismatch-NoTickets2-TLS13",
-			testType:           serverTest,
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			name:     protocol.String() + "-HintMismatch-NoTickets2-TLS13",
+			testType: serverTest,
+			protocol: protocol,
 			config: Config{
 				MinVersion: VersionTLS13,
 				MaxVersion: VersionTLS13,
@@ -261,10 +246,9 @@
 		})
 		if protocol != quic {
 			testCases = append(testCases, testCase{
-				name:               protocol.String() + "-HintMismatch-NoTickets1-TLS12",
-				testType:           serverTest,
-				protocol:           protocol,
-				skipSplitHandshake: true,
+				name:     protocol.String() + "-HintMismatch-NoTickets1-TLS12",
+				testType: serverTest,
+				protocol: protocol,
 				config: Config{
 					MinVersion: VersionTLS12,
 					MaxVersion: VersionTLS12,
@@ -277,10 +261,9 @@
 				expectResumeRejected: true,
 			})
 			testCases = append(testCases, testCase{
-				name:               protocol.String() + "-HintMismatch-NoTickets2-TLS12",
-				testType:           serverTest,
-				protocol:           protocol,
-				skipSplitHandshake: true,
+				name:     protocol.String() + "-HintMismatch-NoTickets2-TLS12",
+				testType: serverTest,
+				protocol: protocol,
 				config: Config{
 					MinVersion: VersionTLS12,
 					MaxVersion: VersionTLS12,
@@ -296,10 +279,9 @@
 		// The shim and handshaker may disagree on whether to request a client
 		// certificate.
 		testCases = append(testCases, testCase{
-			name:               protocol.String() + "-HintMismatch-CertificateRequest",
-			testType:           serverTest,
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			name:     protocol.String() + "-HintMismatch-CertificateRequest",
+			testType: serverTest,
+			protocol: protocol,
 			config: Config{
 				MinVersion: VersionTLS13,
 				MaxVersion: VersionTLS13,
@@ -314,10 +296,9 @@
 		// The shim and handshaker may negotiate different versions altogether.
 		if protocol != quic {
 			testCases = append(testCases, testCase{
-				name:               protocol.String() + "-HintMismatch-Version1",
-				testType:           serverTest,
-				protocol:           protocol,
-				skipSplitHandshake: true,
+				name:     protocol.String() + "-HintMismatch-Version1",
+				testType: serverTest,
+				protocol: protocol,
 				config: Config{
 					MinVersion: VersionTLS12,
 					MaxVersion: VersionTLS13,
@@ -332,10 +313,9 @@
 				},
 			})
 			testCases = append(testCases, testCase{
-				name:               protocol.String() + "-HintMismatch-Version2",
-				testType:           serverTest,
-				protocol:           protocol,
-				skipSplitHandshake: true,
+				name:     protocol.String() + "-HintMismatch-Version2",
+				testType: serverTest,
+				protocol: protocol,
 				config: Config{
 					MinVersion: VersionTLS12,
 					MaxVersion: VersionTLS13,
@@ -355,10 +335,9 @@
 		// algorithm, whether to enable certificate compression, or certificate
 		// compression inputs.
 		testCases = append(testCases, testCase{
-			name:               protocol.String() + "-HintMismatch-CertificateCompression-ShimOnly",
-			testType:           serverTest,
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			name:     protocol.String() + "-HintMismatch-CertificateCompression-ShimOnly",
+			testType: serverTest,
+			protocol: protocol,
 			config: Config{
 				MinVersion: VersionTLS13,
 				MaxVersion: VersionTLS13,
@@ -375,10 +354,9 @@
 			},
 		})
 		testCases = append(testCases, testCase{
-			name:               protocol.String() + "-HintMismatch-CertificateCompression-HandshakerOnly",
-			testType:           serverTest,
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			name:     protocol.String() + "-HintMismatch-CertificateCompression-HandshakerOnly",
+			testType: serverTest,
+			protocol: protocol,
 			config: Config{
 				MinVersion: VersionTLS13,
 				MaxVersion: VersionTLS13,
@@ -395,10 +373,9 @@
 			},
 		})
 		testCases = append(testCases, testCase{
-			testType:           serverTest,
-			name:               protocol.String() + "-HintMismatch-CertificateCompression-AlgorithmMismatch",
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			testType: serverTest,
+			name:     protocol.String() + "-HintMismatch-CertificateCompression-AlgorithmMismatch",
+			protocol: protocol,
 			config: Config{
 				MinVersion: VersionTLS13,
 				MaxVersion: VersionTLS13,
@@ -418,10 +395,9 @@
 			},
 		})
 		testCases = append(testCases, testCase{
-			testType:           serverTest,
-			name:               protocol.String() + "-HintMismatch-CertificateCompression-InputMismatch",
-			protocol:           protocol,
-			skipSplitHandshake: true,
+			testType: serverTest,
+			name:     protocol.String() + "-HintMismatch-CertificateCompression-InputMismatch",
+			protocol: protocol,
 			config: Config{
 				MinVersion: VersionTLS13,
 				MaxVersion: VersionTLS13,
@@ -451,10 +427,9 @@
 		// selects ECDHE_RSA (hints are useful).
 		if protocol != quic {
 			testCases = append(testCases, testCase{
-				testType:           serverTest,
-				name:               protocol.String() + "-HintMismatch-CipherMismatch1",
-				protocol:           protocol,
-				skipSplitHandshake: true,
+				testType: serverTest,
+				name:     protocol.String() + "-HintMismatch-CipherMismatch1",
+				protocol: protocol,
 				config: Config{
 					MinVersion: VersionTLS12,
 					MaxVersion: VersionTLS12,
@@ -469,10 +444,9 @@
 				},
 			})
 			testCases = append(testCases, testCase{
-				testType:           serverTest,
-				name:               protocol.String() + "-HintMismatch-CipherMismatch2",
-				protocol:           protocol,
-				skipSplitHandshake: true,
+				testType: serverTest,
+				name:     protocol.String() + "-HintMismatch-CipherMismatch2",
+				protocol: protocol,
 				config: Config{
 					MinVersion: VersionTLS12,
 					MaxVersion: VersionTLS12,

boringssl-0.20260708.tar.xz/ssl/test/runner/key_agreement.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/key_agreement.go Changed

@@ -17,7 +17,6 @@
 	"math/big"
 	"slices"
 
-	"boringssl.googlesource.com/boringssl.git/ssl/test/runner/kyber"
 	"golang.org/x/crypto/cryptobyte"
 )
 
@@ -329,57 +328,6 @@
 	return e.privateKey.ECDH(peerKey)
 }
 
-// kyberKEM implements Kyber-768
-type kyberKEM struct {
-	kyberPrivateKey *kyber.PrivateKey
-}
-
-func (e *kyberKEM) encapsulationKeySize() int {
-	return kyber.PublicKeySize
-}
-
-func (e *kyberKEM) ciphertextSize() int {
-	return kyber.CiphertextSize
-}
-
-func (e *kyberKEM) generate(config *Config) (publicKey byte, err error) {
-	var kyberEntropy 64byte
-	if _, err := io.ReadFull(config.rand(), kyberEntropy:); err != nil {
-		return nil, err
-	}
-	var kyberPublic *kyber.PublicKeySizebyte
-	e.kyberPrivateKey, kyberPublic = kyber.NewPrivateKey(&kyberEntropy)
-	return kyberPublic:, nil
-}
-
-func (e *kyberKEM) encap(config *Config, peerKey byte) (ciphertext byte, secret byte, err error) {
-	if len(peerKey) != kyber.PublicKeySize {
-		return nil, nil, errors.New("tls: bad length Kyber offer")
-	}
-
-	kyberPublicKey, ok := kyber.UnmarshalPublicKey((*kyber.PublicKeySizebyte)(peerKey))
-	if !ok {
-		return nil, nil, errors.New("tls: bad Kyber offer")
-	}
-
-	var kyberShared, kyberEntropy 32byte
-	if _, err := io.ReadFull(config.rand(), kyberEntropy:); err != nil {
-		return nil, nil, err
-	}
-	kyberCiphertext := kyberPublicKey.Encap(kyberShared:, &kyberEntropy)
-	return kyberCiphertext:, kyberShared:, nil
-}
-
-func (e *kyberKEM) decap(config *Config, ciphertext byte) (secret byte, err error) {
-	if len(ciphertext) != kyber.CiphertextSize {
-		return nil, errors.New("tls: bad length Kyber reply")
-	}
-
-	var kyberShared 32byte
-	e.kyberPrivateKey.Decap(kyberShared:, (*kyber.CiphertextSizebyte)(ciphertext))
-	return kyberShared:, nil
-}
-
 // mlkem768KEM implements ML-KEM-768
 type mlkem768KEM struct {
 	decapKey *mlkem.DecapsulationKey768
@@ -565,11 +513,8 @@
 		kem = &ecdhKEM{curve: ecdh.P521()}
 	case CurveX25519:
 		kem = &ecdhKEM{curve: ecdh.X25519()}
-	case CurveX25519Kyber768:
-		// draft-tls-westerbaan-xyber768d00-03
-		kem = &concatKEM{kem1: &ecdhKEM{curve: ecdh.X25519()}, kem2: &kyberKEM{}}
 	case CurveX25519MLKEM768:
-		// draft-ietf-tls-ecdhe-mlkem-00
+		// RFC 10024
 		kem = &concatKEM{kem1: &mlkem768KEM{}, kem2: &ecdhKEM{curve: ecdh.X25519()}}
 	case CurveMLKEM1024:
 		// draft-ietf-tls-mlkem-04

boringssl-0.20260708.tar.xz/ssl/test/runner/key_update_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/key_update_tests.go Changed

boringssl-0.20260708.tar.xz/ssl/test/runner/pake_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/pake_tests.go Changed

boringssl-0.20260708.tar.xz/ssl/test/runner/psk_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/psk_tests.go Changed

boringssl-0.20260708.tar.xz/ssl/test/runner/raw_public_key_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/raw_public_key_tests.go Changed

@@ -402,9 +402,8 @@
 				expectations: connectionExpectations{
 					peerCertificate: expectedServerCredential,
 				},
-				shimCredentials:    test.serverCredentialsConfigured,
-				resumeSession:      true,
-				skipSplitHandshake: true,
+				shimCredentials: test.serverCredentialsConfigured,
+				resumeSession:   true,
 			}
 			// Test that the server can defer configuring credentials to the cert
 			// callback.
@@ -926,7 +925,6 @@
 					expectedError:      test.expectedError,
 					expectedLocalError: test.expectedLocalError,
 					resumeSession:      test.expectedError == "" && test.expectedLocalError == "",
-					skipSplitHandshake: true,
 				})
 			}
 		}
@@ -952,10 +950,9 @@
 					ExpectClientCertificateTypes: certTypesListRPKOnly,
 				},
 			},
-			flags:              shimFlags,
-			skipSplitHandshake: true,
-			shouldFail:         true,
-			expectedError:      expectedError,
+			flags:         shimFlags,
+			shouldFail:    true,
+			expectedError: expectedError,
 		})
 		shimFlags = append(string{"-verify-peer"},
 			flagCertTypes("-accepted-peer-cert-types", certTypesListRPKOnly)...)
@@ -976,8 +973,7 @@
 					SkipCertificateVerify:        true,
 				},
 			},
-			flags:              shimFlags,
-			skipSplitHandshake: true,
+			flags: shimFlags,
 		})
 		if ver.version >= VersionTLS13 {
 			// If the client sends an otherwise valid Certificate message with an RPK,
@@ -999,7 +995,6 @@
 				flags:              shimFlags,
 				shouldFail:         true,
 				expectedLocalError: "remote error: unexpected message",
-				skipSplitHandshake: true,
 			})
 		}
 		// Test that RPK client cert verification fails if we force it to fail.
@@ -1017,10 +1012,9 @@
 					ExpectClientCertificateTypes: certTypesListRPKOnly,
 				},
 			},
-			flags:              shimFlags,
-			shouldFail:         true,
-			expectedError:      ":CERTIFICATE_VERIFY_FAILED:",
-			skipSplitHandshake: true,
+			flags:         shimFlags,
+			shouldFail:    true,
+			expectedError: ":CERTIFICATE_VERIFY_FAILED:",
 		})
 	}
 }

boringssl-0.20260708.tar.xz/ssl/test/runner/resumption_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/resumption_tests.go Changed

boringssl-0.20260708.tar.xz/ssl/test/runner/runner.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/runner.go Changed

@@ -47,6 +47,7 @@
 	"boringssl.googlesource.com/boringssl.git/util/testresult"
 	"filippo.io/mldsa"
 	"golang.org/x/crypto/cryptobyte"
+	"golang.org/x/term"
 )
 
 var (
@@ -59,7 +60,7 @@
 	mallocTest         = flag.Int64("malloc-test", -1, "If non-negative, run each test with each malloc in turn failing from the given number onwards.")
 	mallocTestDebug    = flag.Bool("malloc-test-debug", false, "If true, ask bssl_shim to abort rather than fail a malloc. This can be used with a specific value for --malloc-test to identity the malloc failing that is causing problems.")
 	jsonOutput         = flag.String("json-output", "", "The file to output JSON results to.")
-	pipe               = flag.Bool("pipe", false, "If true, print status output suitable for piping into another program.")
+	pipe               = flag.Bool("pipe", !term.IsTerminal(int(os.Stdout.Fd())), "If true, print status output suitable for piping into another program.")
 	testToRun          = flag.String("test", "", "Semicolon-separated patterns of tests to run, or empty to run all tests")
 	skipTest           = flag.String("skip", "", "Semicolon-separated patterns of tests to skip")
 	allowHintMismatch  = flag.String("allow-hint-mismatch", "", "Semicolon-separated patterns of tests where hints may mismatch")
@@ -686,9 +687,6 @@
 	// should retry for early rejection. In a server test, this is whether the
 	// test expects the shim to reject early data.
 	expectEarlyDataRejected bool
-	// skipSplitHandshake, if true, will skip the generation of a split
-	// handshake copy of the test.
-	skipSplitHandshake bool
 	// skipHints, if true, will skip the generation of a handshake hints copy of
 	// the test.
 	skipHints bool
@@ -1613,7 +1611,9 @@
 	default:
 		panic(fmt.Sprintf("unknown PSK hash %s", cred.PSKHash))
 	}
-	handleBase64Field("trust-anchor-id", cred.TrustAnchorID)
+	if !cred.Properties.Empty() {
+		handleBase64Field("cert-properties", cred.Properties.Marshal())
+	}
 	return flags
 }
 
@@ -1627,12 +1627,12 @@
 	}()
 
 	// Make a copy of the testCase before modifying it in-place.
-	test = ptrTo(*test)
+	test = new(*test)
 	if test.resumeConfig != nil {
-		test.resumeConfig = ptrTo(*test.resumeConfig)
+		test.resumeConfig = new(*test.resumeConfig)
 	}
 	if test.resumeExpectations != nil {
-		test.resumeExpectations = ptrTo(*test.resumeExpectations)
+		test.resumeExpectations = new(*test.resumeExpectations)
 	}
 
 	var flags string
@@ -2066,7 +2066,7 @@
 	return ret
 }
 
-func convertToSplitHandshakeTests(tests testCase) (splitHandshakeTests testCase, err error) {
+func convertToHandshakeHintTests(tests testCase) (handshakeHintTests testCase, err error) {
 	var stdout bytes.Buffer
 	var flags string
 	if len(*shimExtraFlags) > 0 {
@@ -2079,7 +2079,7 @@
 		return nil, err
 	}
 
-	switch strings.TrimSpace(string(stdout.Bytes())) {
+	switch strings.TrimSpace(stdout.String()) {
 	case "No":
 		return
 	case "Yes":
@@ -2093,32 +2093,6 @@
 		allowHintMismatchPattern = strings.Split(*allowHintMismatch, ";")
 	}
 
-NextTest:
-	for _, test := range tests {
-		if test.protocol != tls ||
-			test.testType != serverTest ||
-			len(test.shimCredentials) != 0 ||
-			len(test.resumeShimCredentials) != 0 ||
-			strings.Contains(test.name, "ECH-Server") ||
-			test.skipSplitHandshake {
-			continue
-		}
-
-		for _, flag := range test.flags {
-			if flag == "-implicit-handshake" {
-				continue NextTest
-			}
-		}
-
-		shTest := test
-		shTest.name += "-Split"
-		shTest.flags = make(string, len(test.flags), len(test.flags)+3)
-		copy(shTest.flags, test.flags)
-		shTest.flags = append(shTest.flags, "-handoff", "-handshaker-path", *handshakerPath)
-
-		splitHandshakeTests = append(splitHandshakeTests, shTest)
-	}
-
 	for _, test := range tests {
 		if test.protocol == dtls ||
 			test.testType != serverTest ||
@@ -2134,19 +2108,19 @@
 			}
 		}
 
-		shTest := test
-		shTest.name += "-Hints"
-		shTest.flags = make(string, len(test.flags), len(test.flags)+3)
-		copy(shTest.flags, test.flags)
-		shTest.flags = append(shTest.flags, "-handshake-hints", "-handshaker-path", *handshakerPath)
+		hintTest := test
+		hintTest.name += "-Hints"
+		hintTest.flags = make(string, len(test.flags), len(test.flags)+3)
+		copy(hintTest.flags, test.flags)
+		hintTest.flags = append(hintTest.flags, "-handshake-hints", "-handshaker-path", *handshakerPath)
 		if matched {
-			shTest.flags = append(shTest.flags, "-allow-hint-mismatch")
+			hintTest.flags = append(hintTest.flags, "-allow-hint-mismatch")
 		}
 
-		splitHandshakeTests = append(splitHandshakeTests, shTest)
+		handshakeHintTests = append(handshakeHintTests, hintTest)
 	}
 
-	return splitHandshakeTests, nil
+	return handshakeHintTests, nil
 }
 
 func worker(dispatcher *shimDispatcher, statusChan chan statusMsg, c chan *testCase, shimPath string, wg *sync.WaitGroup) {
@@ -2402,9 +2376,9 @@
 	addRawPublicKeyTests()
 	addServerPaddingTests()
 
-	toAppend, err := convertToSplitHandshakeTests(testCases)
+	toAppend, err := convertToHandshakeHintTests(testCases)
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error making split handshake tests: %s", err)
+		fmt.Fprintf(os.Stderr, "Error making handshake hint tests: %s", err)
 		os.Exit(1)
 	}
 	testCases = append(testCases, toAppend...)

boringssl-0.20260708.tar.xz/ssl/test/runner/server_padding_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/server_padding_tests.go Changed

@@ -22,7 +22,7 @@
 		config: Config{
 			MinVersion: VersionTLS13,
 			Bugs: ProtocolBugs{
-				SendServerPaddingLength: ptrTo(uint16(10)),
+				SendServerPaddingLength: new(uint16(10)),
 			},
 		},
 		flags: string{
@@ -37,7 +37,7 @@
 		config: Config{
 			MinVersion: VersionTLS13,
 			Bugs: ProtocolBugs{
-				SendServerPaddingLength: ptrTo(uint16(0)),
+				SendServerPaddingLength: new(uint16(0)),
 			},
 		},
 		flags: string{
@@ -52,7 +52,7 @@
 		config: Config{
 			MinVersion: VersionTLS13,
 			Bugs: ProtocolBugs{
-				SendServerPaddingLength: ptrTo(uint16(16384)),
+				SendServerPaddingLength: new(uint16(16384)),
 			},
 		},
 		flags: string{
@@ -68,7 +68,7 @@
 		config: Config{
 			MinVersion: VersionTLS13,
 			Bugs: ProtocolBugs{
-				SendServerPaddingLength: ptrTo(uint16(5)),
+				SendServerPaddingLength: new(uint16(5)),
 			},
 		},
 		flags: string{
@@ -86,7 +86,7 @@
 		config: Config{
 			MinVersion: VersionTLS13,
 			Bugs: ProtocolBugs{
-				SendServerPaddingLength: ptrTo(uint16(50)),
+				SendServerPaddingLength: new(uint16(50)),
 			},
 		},
 		flags: string{
@@ -127,7 +127,7 @@
 		config: Config{
 			MaxVersion: VersionTLS12,
 			Bugs: ProtocolBugs{
-				SendServerPaddingLength: ptrTo(uint16(10)),
+				SendServerPaddingLength: new(uint16(10)),
 			},
 		},
 		flags: string{
@@ -152,7 +152,7 @@
 		testType: serverTest,
 		config: Config{
 			MinVersion:           VersionTLS13,
-			RequestServerPadding: ptrTo(uint16(10)),
+			RequestServerPadding: new(uint16(10)),
 		},
 	})
 	// Runner requests padding, shim sends padding.
@@ -161,7 +161,7 @@
 		testType: serverTest,
 		config: Config{
 			MinVersion:           VersionTLS13,
-			RequestServerPadding: ptrTo(uint16(10)),
+			RequestServerPadding: new(uint16(10)),
 			Bugs: ProtocolBugs{
 				ExpectedServerPadding: true,
 			},
@@ -175,7 +175,7 @@
 		testType: serverTest,
 		config: Config{
 			MinVersion:           VersionTLS13,
-			RequestServerPadding: ptrTo(uint16(0)),
+			RequestServerPadding: new(uint16(0)),
 			Bugs: ProtocolBugs{
 				ExpectedServerPadding: true,
 			},
@@ -189,7 +189,7 @@
 		testType: serverTest,
 		config: Config{
 			MinVersion:           VersionTLS13,
-			RequestServerPadding: ptrTo(uint16(16384)),
+			RequestServerPadding: new(uint16(16384)),
 			Bugs: ProtocolBugs{
 				ExpectedServerPadding: true,
 			},
@@ -205,7 +205,7 @@
 		testType: serverTest,
 		config: Config{
 			MinVersion:           VersionTLS13,
-			RequestServerPadding: ptrTo(uint16(16385)),
+			RequestServerPadding: new(uint16(16385)),
 		},
 		flags: string{
 			"-server-supports-padding",
@@ -218,7 +218,7 @@
 		testType: serverTest,
 		config: Config{
 			MaxVersion:           VersionTLS12,
-			RequestServerPadding: ptrTo(uint16(1024)),
+			RequestServerPadding: new(uint16(1024)),
 		},
 		flags: string{
 			"-server-supports-padding",
@@ -233,7 +233,7 @@
 		resumeSession: true,
 		config: Config{
 			MinVersion:           VersionTLS13,
-			RequestServerPadding: ptrTo(uint16(10)),
+			RequestServerPadding: new(uint16(10)),
 			Bugs: ProtocolBugs{
 				ExpectedServerPadding: true,
 			},

boringssl-0.20260708.tar.xz/ssl/test/runner/tls13_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/tls13_tests.go Changed

@@ -262,7 +262,6 @@
 					CurveP384,
 					CurveP521,
 					CurveX25519,
-					CurveX25519Kyber768,
 					CurveX25519MLKEM768,
 					CurveMLKEM1024,
 				},
@@ -273,14 +272,12 @@
 			"-curves", strconv.Itoa(int(CurveP384)),
 			"-curves", strconv.Itoa(int(CurveP521)),
 			"-curves", strconv.Itoa(int(CurveX25519)),
-			"-curves", strconv.Itoa(int(CurveX25519Kyber768)),
 			"-curves", strconv.Itoa(int(CurveX25519MLKEM768)),
 			"-curves", strconv.Itoa(int(CurveMLKEM1024)),
 			"-key-shares", strconv.Itoa(int(CurveP256)),
 			"-key-shares", strconv.Itoa(int(CurveP384)),
 			"-key-shares", strconv.Itoa(int(CurveP521)),
 			"-key-shares", strconv.Itoa(int(CurveX25519)),
-			"-key-shares", strconv.Itoa(int(CurveX25519Kyber768)),
 			"-key-shares", strconv.Itoa(int(CurveX25519MLKEM768)),
 			"-key-shares", strconv.Itoa(int(CurveMLKEM1024)),
 		},
@@ -1221,7 +1218,7 @@
 		config: Config{
 			MaxVersion: VersionTLS13,
 			Bugs: ProtocolBugs{
-				AlwaysSelectPSKIdentity: ptrTo(uint16(0)),
+				AlwaysSelectPSKIdentity: new(uint16(0)),
 			},
 		},
 		shouldFail:    true,
@@ -1236,7 +1233,7 @@
 		resumeConfig: &Config{
 			MaxVersion: VersionTLS13,
 			Bugs: ProtocolBugs{
-				AlwaysSelectPSKIdentity: ptrTo(uint16(1)),
+				AlwaysSelectPSKIdentity: new(uint16(1)),
 			},
 		},
 		resumeSession: true,

boringssl-0.20260708.tar.xz/ssl/test/runner/trust_anchor_tests.go -> boringssl-0.20260813.tar.xz/ssl/test/runner/trust_anchor_tests.go Changed

@@ -165,7 +165,7 @@
 			RequestTrustAnchors: byte{id2},
 			Bugs: ProtocolBugs{
 				ExpectPeerAvailableTrustAnchors: byte{id1, id2},
-				ExpectPeerMatchTrustAnchor:      ptrTo(true),
+				ExpectPeerMatchTrustAnchor:      new(true),
 			},
 		},
 		shimCredentials: *Credential{
@@ -196,7 +196,7 @@
 			RequestTrustAnchors: byte{id1},
 			Bugs: ProtocolBugs{
 				ExpectPeerAvailableTrustAnchors: byte{id2, id3},
-				ExpectPeerMatchTrustAnchor:      ptrTo(false),
+				ExpectPeerMatchTrustAnchor:      new(false),
 			},
 		},
 		shimCredentials: *Credential{
@@ -222,7 +222,7 @@
 			VerifySignatureAlgorithms: signatureAlgorithm{signatureRSAPSSWithSHA256, signatureECDSAWithP256AndSHA256},
 			Bugs: ProtocolBugs{
 				ExpectPeerAvailableTrustAnchors: byte{id2},
-				ExpectPeerMatchTrustAnchor:      ptrTo(false),
+				ExpectPeerMatchTrustAnchor:      new(false),
 			},
 		},
 		shimCredentials: *Credential{
@@ -246,7 +246,7 @@
 			VerifySignatureAlgorithms: signatureAlgorithm{signatureRSAPSSWithSHA256, signatureECDSAWithP256AndSHA256},
 			Bugs: ProtocolBugs{
 				ExpectPeerAvailableTrustAnchors: byte{},
-				ExpectPeerMatchTrustAnchor:      ptrTo(false),
+				ExpectPeerMatchTrustAnchor:      new(false),
 			},
 		},
 		shimCredentials: *Credential{
@@ -309,7 +309,7 @@
 			RequestTrustAnchors: byte{},
 			Bugs: ProtocolBugs{
 				ExpectPeerAvailableTrustAnchors: byte{id1, id2},
-				ExpectPeerMatchTrustAnchor:      ptrTo(false),
+				ExpectPeerMatchTrustAnchor:      new(false),
 			},
 		},
 		shimCredentials: *Credential{
@@ -352,4 +352,83 @@
 		expectedError:      ":UNEXPECTED_EXTENSION:",
 		expectedLocalError: "remote error: unsupported extension",
 	})
+
+	group := byte{1, 2, 3, 4, 5}
+	// These ranges match the test group.
+	match := TrustAnchorRange{Base: byte{1, 2, 3, 4}, Min: 1, Max: 10}
+	matchExact := TrustAnchorRange{Base: byte{1, 2, 3, 4}, Min: 5, Max: 5}
+	// These ranges do not.
+	wrongBase := TrustAnchorRange{Base: byte{1, 2, 3, 5}, Min: 5, Max: 10}
+	componentTooLow := TrustAnchorRange{Base: byte{1, 2, 3, 4}, Min: 1, Max: 4}
+	componentTooHigh := TrustAnchorRange{Base: byte{1, 2, 3, 4}, Min: 6, Max: 10}
+	matchParent := TrustAnchorRange{Base: byte{1, 2, 3}, Min: 1, Max: 10}
+	matchChild := TrustAnchorRange{Base: byte{1, 2, 3, 4, 5}, Min: 1, Max: 10}
+	matchChild2 := TrustAnchorRange{Base: byte{1, 2, 3, 4, 5}, Min: 0, Max: 0}
+	matchGrandChild := TrustAnchorRange{Base: byte{1, 2, 3, 4, 5, 6}, Min: 1, Max: 10}
+
+	testCases = append(testCases, testCase{
+		testType: serverTest,
+		name:     "TrustAnchorGroups-Match-Server",
+		config: Config{
+			MinVersion:          VersionTLS13,
+			RequestTrustAnchors: byte{group},
+			Bugs: ProtocolBugs{
+				ExpectPeerAvailableTrustAnchors: byte{id1, id2},
+				ExpectPeerMatchTrustAnchor:      new(true),
+			},
+		},
+		shimCredentials: *Credential{
+			// Neither the ID nor the group inclusions match.
+			rsaCertificate.WithMustMatchIssuer(true).WithProperties(CertificatePropertyList{
+				TrustAnchorID: id1,
+				TrustAnchorGroupInclusions: TrustAnchorRange{
+					wrongBase, componentTooLow, componentTooHigh, matchParent, matchChild, matchChild2, matchGrandChild,
+				},
+			}),
+			// The group inclusions match, after skipping some irrelevant inclusions.
+			ecdsaP256Certificate.WithMustMatchIssuer(true).WithProperties(CertificatePropertyList{
+				TrustAnchorID: id2,
+				TrustAnchorGroupInclusions: TrustAnchorRange{
+					wrongBase, match,
+				},
+			}),
+		},
+		expectations: connectionExpectations{
+			peerCertificate: &ecdsaP256Certificate,
+		},
+		flags: string{"-expect-selected-credential", "1"},
+	})
+
+	testCases = append(testCases, testCase{
+		testType: serverTest,
+		name:     "TrustAnchorGroups-MatchExact-Server",
+		config: Config{
+			MinVersion:          VersionTLS13,
+			RequestTrustAnchors: byte{group},
+			Bugs: ProtocolBugs{
+				ExpectPeerAvailableTrustAnchors: byte{id1, id2},
+				ExpectPeerMatchTrustAnchor:      new(true),
+			},
+		},
+		shimCredentials: *Credential{
+			// Neither the ID nor the group inclusions match.
+			rsaCertificate.WithMustMatchIssuer(true).WithProperties(CertificatePropertyList{
+				TrustAnchorID: id1,
+				TrustAnchorGroupInclusions: TrustAnchorRange{
+					wrongBase, componentTooLow, componentTooHigh, matchParent, matchChild, matchGrandChild,
+				},
+			}),
+			// The group inclusions match, after skipping some irrelevant inclusions.
+			ecdsaP256Certificate.WithMustMatchIssuer(true).WithProperties(CertificatePropertyList{
+				TrustAnchorID: id2,
+				TrustAnchorGroupInclusions: TrustAnchorRange{
+					wrongBase, matchExact,
+				},
+			}),
+		},
+		expectations: connectionExpectations{
+			peerCertificate: &ecdsaP256Certificate,
+		},
+		flags: string{"-expect-selected-credential", "1"},
+	})
 }

boringssl-0.20260708.tar.xz/ssl/test/settings_writer.cc -> boringssl-0.20260813.tar.xz/ssl/test/settings_writer.cc Changed

boringssl-0.20260708.tar.xz/ssl/test/settings_writer.h -> boringssl-0.20260813.tar.xz/ssl/test/settings_writer.h Changed

boringssl-0.20260708.tar.xz/ssl/test/test_config.cc -> boringssl-0.20260813.tar.xz/ssl/test/test_config.cc Changed

@@ -351,6 +351,8 @@
         StringFlag("-trust-cert", &TestConfig::trust_cert),
         StringFlag("-expect-server-name", &TestConfig::expect_server_name),
         BoolFlag("-enable-ech-grease", &TestConfig::enable_ech_grease),
+        BoolFlag("-reject-unusable-ech-config",
+                 &TestConfig::reject_unusable_ech_config),
         Base64VectorFlag("-ech-server-config", &TestConfig::ech_server_configs),
         Base64VectorFlag("-ech-server-key", &TestConfig::ech_server_keys),
         IntVectorFlag("-ech-is-retry-config", &TestConfig::ech_is_retry_config),
@@ -526,7 +528,6 @@
         StringFlag("-expect-msg-callback", &TestConfig::expect_msg_callback),
         BoolFlag("-allow-false-start-without-alpn",
                  &TestConfig::allow_false_start_without_alpn),
-        BoolFlag("-handoff", &TestConfig::handoff),
         BoolFlag("-handshake-hints", &TestConfig::handshake_hints),
         BoolFlag("-allow-hint-mismatch", &TestConfig::allow_hint_mismatch),
         BoolFlag("-use-ocsp-callback", &TestConfig::use_ocsp_callback),
@@ -629,7 +630,7 @@
         CredentialFlag(SetValueFlag("-psk-importer-sha384",
                                     &CredentialConfig::psk_hash, EVP_sha384())),
         CredentialFlag(
-            Base64Flag("-trust-anchor-id", &CredentialConfig::trust_anchor_id)),
+            Base64Flag("-cert-properties", &CredentialConfig::cert_properties)),
         IntFlag("-private-key-delay-ms", &TestConfig::private_key_delay_ms),
         BoolFlag("-resumption-across-names-enabled",
                  &TestConfig::resumption_across_names_enabled),
@@ -1640,10 +1641,12 @@
     SSL_CREDENTIAL_set_must_match_issuer(cred.get(), 1);
   }
 
-  if (!cred_config.trust_anchor_id.empty()) {
-    if (!SSL_CREDENTIAL_set1_trust_anchor_id(
-            cred.get(), cred_config.trust_anchor_id.data(),
-            cred_config.trust_anchor_id.size())) {
+  if (!cred_config.cert_properties.empty()) {
+    bssl::UniquePtr<CRYPTO_BUFFER> buf(
+        CRYPTO_BUFFER_new(cred_config.cert_properties.data(),
+                          cred_config.cert_properties.size(), nullptr));
+    if (buf == nullptr ||
+        !SSL_CREDENTIAL_set1_certificate_properties(cred.get(), buf.get())) {
       return nullptr;
     }
   }
@@ -2450,6 +2453,9 @@
   if (enable_ech_grease) {
     SSL_set_enable_ech_grease(ssl.get(), 1);
   }
+  if (reject_unusable_ech_config) {
+    SSL_set_reject_unusable_ech_config(ssl.get(), 1);
+  }
   if (!ech_config_list.empty() &&
       !SSL_set1_ech_config_list(ssl.get(), ech_config_list.data(),
                                 ech_config_list.size())) {

boringssl-0.20260708.tar.xz/ssl/test/test_config.h -> boringssl-0.20260813.tar.xz/ssl/test/test_config.h Changed

boringssl-0.20260708.tar.xz/ssl/test/test_state.cc -> boringssl-0.20260813.tar.xz/ssl/test/test_state.cc Changed

@@ -79,103 +79,3 @@
 void CopySessions(SSL_CTX *dst, const SSL_CTX *src) {
   lh_SSL_SESSION_doall_arg(FromOpaque(src)->sessions, ssl_ctx_add_session, dst);
 }
-
-static void push_session(SSL_SESSION *session, void *arg) {
-  auto s = reinterpret_cast<std::vector<SSL_SESSION *> *>(arg);
-  s->push_back(session);
-}
-
-bool SerializeContextState(SSL_CTX *ctx, CBB *cbb) {
-  CBB out, ctx_sessions, ticket_keys;
-  uint8_t keys48;
-  if (!CBB_add_u24_length_prefixed(cbb, &out) ||
-      !CBB_add_u16(&out, 0 /* version */) ||
-      !SSL_CTX_get_tlsext_ticket_keys(ctx, &keys, sizeof(keys)) ||
-      !CBB_add_u8_length_prefixed(&out, &ticket_keys) ||
-      !CBB_add_bytes(&ticket_keys, keys, sizeof(keys)) ||
-      !CBB_add_asn1(&out, &ctx_sessions, CBS_ASN1_SEQUENCE)) {
-    return false;
-  }
-  std::vector<SSL_SESSION *> sessions;
-  lh_SSL_SESSION_doall_arg(FromOpaque(ctx)->sessions, push_session, &sessions);
-  for (const auto &sess : sessions) {
-    if (!ssl_session_serialize(sess, &ctx_sessions)) {
-      return false;
-    }
-  }
-  return CBB_flush(cbb);
-}
-
-bool DeserializeContextState(CBS *cbs, SSL_CTX *ctx) {
-  CBS in, sessions, ticket_keys;
-  uint16_t version;
-  constexpr uint16_t kVersion = 0;
-  if (!CBS_get_u24_length_prefixed(cbs, &in) ||
-      !CBS_get_u16(&in, &version) ||
-      version > kVersion ||
-      !CBS_get_u8_length_prefixed(&in, &ticket_keys) ||
-      !SSL_CTX_set_tlsext_ticket_keys(ctx, CBS_data(&ticket_keys),
-                                      CBS_len(&ticket_keys)) ||
-      !CBS_get_asn1(&in, &sessions, CBS_ASN1_SEQUENCE)) {
-    return false;
-  }
-  while (CBS_len(&sessions)) {
-    UniquePtr<SSL_SESSION> session = SSL_SESSION_parse(
-        &sessions, FromOpaque(ctx)->x509_method, FromOpaque(ctx)->pool.get());
-    if (!session) {
-      return false;
-    }
-    SSL_CTX_add_session(ctx, session.get());
-  }
-  return true;
-}
-
-bool TestState::Serialize(CBB *cbb) const {
-  CBB out, pending, text;
-  if (!CBB_add_u24_length_prefixed(cbb, &out) ||
-      !CBB_add_u16(&out, 0 /* version */) ||
-      !CBB_add_u24_length_prefixed(&out, &pending) ||
-      (pending_session &&
-       !ssl_session_serialize(pending_session.get(), &pending)) ||
-      !CBB_add_u16_length_prefixed(&out, &text) ||
-      !CBB_add_bytes(
-          &text, reinterpret_cast<const uint8_t *>(msg_callback_text.data()),
-          msg_callback_text.length()) ||
-      !CBB_add_asn1_uint64(&out, g_clock.tv_sec) ||
-      !CBB_add_asn1_uint64(&out, g_clock.tv_usec) ||
-      !CBB_flush(cbb)) {
-    return false;
-  }
-  return true;
-}
-
-std::unique_ptr<TestState> TestState::Deserialize(CBS *cbs, SSL_CTX *ctx) {
-  CBS in, pending_session, text;
-  auto state = std::make_unique<TestState>();
-  uint16_t version;
-  constexpr uint16_t kVersion = 0;
-  uint64_t sec, usec;
-  if (!CBS_get_u24_length_prefixed(cbs, &in) ||  //
-      !CBS_get_u16(&in, &version) ||             //
-      version > kVersion ||
-      !CBS_get_u24_length_prefixed(&in, &pending_session) ||
-      !CBS_get_u16_length_prefixed(&in, &text) ||
-      !CBS_get_asn1_uint64(&in, &sec) ||   //
-      !CBS_get_asn1_uint64(&in, &usec) ||  //
-      usec >= 1000000) {
-    return nullptr;
-  }
-  if (CBS_len(&pending_session)) {
-    state->pending_session =
-        SSL_SESSION_parse(&pending_session, FromOpaque(ctx)->x509_method,
-                          FromOpaque(ctx)->pool.get());
-    if (!state->pending_session) {
-      return nullptr;
-    }
-  }
-  state->msg_callback_text = std::string(
-      reinterpret_cast<const char *>(CBS_data(&text)), CBS_len(&text));
-  g_clock.tv_sec = sec;
-  g_clock.tv_usec = usec;
-  return state;
-}

boringssl-0.20260708.tar.xz/ssl/test/test_state.h -> boringssl-0.20260813.tar.xz/ssl/test/test_state.h Changed

@@ -25,17 +25,6 @@
 #include "mock_quic_transport.h"
 
 struct TestState {
-  // Serialize writes `pending_session` and `msg_callback_text` to `out`, for
-  // use in split-handshake tests.  We don't try to serialize every bit of test
-  // state, but serializing `pending_session` is necessary to exercise session
-  // resumption, and `msg_callback_text` is especially useful.  In the general
-  // case, checks of state updated during the handshake can be skipped when
-  // `config->handoff`.
-  bool Serialize(CBB *out) const;
-
-  // Deserialize returns a new `TestState` from data written by `Serialize`.
-  static std::unique_ptr<TestState> Deserialize(CBS *cbs, SSL_CTX *ctx);
-
   // async_bio is async BIO which pauses reads and writes.
   BIO *async_bio = nullptr;
   // packeted_bio is the packeted BIO which simulates read timeouts.
@@ -82,12 +71,4 @@
 
 void CopySessions(SSL_CTX *dest, const SSL_CTX *src);
 
-// SerializeContextState writes session material (sessions and ticket keys) from
-// `ctx` into `cbb`.
-bool SerializeContextState(SSL_CTX *ctx, CBB *cbb);
-
-// DeserializeContextState updates `out` with material previously serialized by
-// SerializeContextState.
-bool DeserializeContextState(CBS *in, SSL_CTX *out);
-
 #endif  // HEADER_TEST_STATE

boringssl-0.20260708.tar.xz/third_party/fiat/README.chromium -> boringssl-0.20260813.tar.xz/third_party/fiat/README.chromium Changed

boringssl-0.20260708.tar.xz/tool/server.cc -> boringssl-0.20260813.tar.xz/tool/server.cc Changed

boringssl-0.20260708.tar.xz/tool/transport_common.cc -> boringssl-0.20260813.tar.xz/tool/transport_common.cc Changed

boringssl-0.20260708.tar.xz/util/all_tests.json -> boringssl-0.20260813.tar.xz/util/all_tests.json Changed

@@ -4,35 +4,42 @@
     "shard": true
   },
   {
-    "cmd": "crypto_test", "--gtest_also_run_disabled_tests", "--gtest_filter=BNTest.DISABLED_WycheproofPrimality"
+    "cmd": "crypto_test", "--gtest_also_run_disabled_tests", "--gtest_filter=BNTest.DISABLED_WycheproofPrimality",
+    "skip_sde": true
   },
   {
-    "cmd": "urandom_test"
+    "cmd": "urandom_test",
+    "skip_sde": true
   },
   {
     "comment": "Without RDRAND",
     "cmd": "urandom_test",
-    "env": "OPENSSL_ia32cap=~0x4000000000000000"
+    "env": "OPENSSL_ia32cap=~0x4000000000000000",
+    "skip_sde": true
   },
   {
     "comment": "Potentially with RDRAND, but not Intel",
     "cmd": "urandom_test",
-    "env": "OPENSSL_ia32cap=~0x0000000040000000"
+    "env": "OPENSSL_ia32cap=~0x0000000040000000",
+    "skip_sde": true
   },
   {
     "comment": "Potentially with RDRAND, and forced to Intel",
     "cmd": "urandom_test",
-    "env": "OPENSSL_ia32cap=|0x0000000040000000"
+    "env": "OPENSSL_ia32cap=|0x0000000040000000",
+    "skip_sde": true
   },
   {
     "comment": "No RDRAND and without WIPEONFORK",
     "cmd": "urandom_test",
-    "env": "OPENSSL_ia32cap=~0x4000000000000000", "BORINGSSL_IGNORE_MADV_WIPEONFORK=1"
+    "env": "OPENSSL_ia32cap=~0x4000000000000000", "BORINGSSL_IGNORE_MADV_WIPEONFORK=1",
+    "skip_sde": true
   },
   {
     "comment": "Potentially with RDRAND, but not Intel, and no WIPEONFORK",
     "cmd": "urandom_test",
-    "env": "OPENSSL_ia32cap=~0x0000000040000000", "BORINGSSL_IGNORE_MADV_WIPEONFORK=1"
+    "env": "OPENSSL_ia32cap=~0x0000000040000000", "BORINGSSL_IGNORE_MADV_WIPEONFORK=1",
+    "skip_sde": true
   },
   {
     "cmd": "crypto_test", "--fork_unsafe_buffering", "--gtest_filter=RandTest.*:-RandTest.Fork"

boringssl-0.20260708.tar.xz/util/audit_symbols.go -> boringssl-0.20260813.tar.xz/util/audit_symbols.go Changed

@@ -132,12 +132,52 @@
 	os.Exit(1)
 }
 
+func guessArchiveFiles() string {
+	var paths string
+	for _, name := range string{
+		// List of libraries for which symbol prefixing is stable.
+		"crypto",
+	} {
+		found := ""
+		// Trying patterns for all platforms as the current build might be a cross compile.
+		for _, pattern := range string{
+			"lib%s.a",     // Linux and macOS static.
+			"lib%s.so",    // Linux shared.
+			"%s.lib",      // Windows static.
+			"%s.dll",      // Windows shared.
+			"lib%s.dylib", // macOS shared.
+		} {
+			path := fmt.Sprintf(pattern, name)
+			if _, err := os.Stat(path); err == nil {
+				if found != "" {
+					fmt.Fprintf(os.Stderr, "Multiple library files for lib%s found in the current directory: %s and %s - please specify explicitly, or do a clean build first.\n", name, found, path)
+					return nil // Will show usage.
+				}
+				found = path
+			}
+		}
+		if found == "" {
+			// Fail if _any_ of the libraries that should be there isn't there.
+			// This guards against an accidentally successful result from an incomplete build.
+			fmt.Fprintf(os.Stderr, "No library file for lib%s found in the current directory - please specify explicitly, or chdir to where it is first.\n", name)
+			return nil // Will show usage.
+		}
+		paths = append(paths, found)
+	}
+	return paths
+}
+
 func main() {
 	flag.Parse()
-	if flag.NArg() < 1 {
+	archiveFiles := flag.Args()
+
+	if len(archiveFiles) == 0 {
+		archiveFiles = guessArchiveFiles()
+	}
+
+	if len(archiveFiles) == 0 {
 		printAndExit("Usage: %s -out OUT -obj-file-format FORMAT ARCHIVE_FILE ARCHIVE_FILE ...", os.Args0)
 	}
-	archiveFiles := flag.Args()
 
 	out := os.Stdout
 	if *outFlag != "-" {
@@ -164,6 +204,8 @@
 	}
 
 	for _, archive := range archiveFiles {
+		fmt.Fprintf(os.Stderr, "Checking %s...\n", archive)
+
 		f, err := os.Open(archive)
 		if err != nil {
 			printAndExit("Error opening %s: %s", archive, err)

boringssl-0.20260708.tar.xz/util/bot/DEPS -> boringssl-0.20260813.tar.xz/util/bot/DEPS Changed

boringssl-0.20260708.tar.xz/util/bot/UPDATING -> boringssl-0.20260813.tar.xz/util/bot/UPDATING Changed

boringssl-0.20260708.tar.xz/util/bot/nasm-win32.exe.sha1 -> boringssl-0.20260813.tar.xz/util/bot/nasm-win32.exe.sha1 Changed

boringssl-0.20260708.tar.xz/util/bot/sde-linux64.tar.xz.sha1 -> boringssl-0.20260813.tar.xz/util/bot/sde-linux64.tar.xz.sha1 Changed

boringssl-0.20260708.tar.xz/util/bot/sde-win32.tar.xz.sha1 -> boringssl-0.20260813.tar.xz/util/bot/sde-win32.tar.xz.sha1 Changed

boringssl-0.20260708.tar.xz/util/fipstools/acvp/ACVP.md -> boringssl-0.20260813.tar.xz/util/fipstools/acvp/ACVP.md Changed

boringssl-0.20260708.tar.xz/util/fipstools/acvp/acvptool/subprocess/mldsa.go -> boringssl-0.20260813.tar.xz/util/fipstools/acvp/acvptool/subprocess/mldsa.go Changed

@@ -59,6 +59,7 @@
 	ID                 uint64            `json:"tgId"`
 	TestType           string            `json:"testType"`
 	ParameterSet       string            `json:"parameterSet"`
+	KeyFormat          string            `json:"keyFormat"`
 	Deterministic      bool              `json:"deterministic"`
 	SignatureInterface string            `json:"signatureInterface"`
 	Tests              mldsaSigGenTest `json:"tests"`
@@ -68,6 +69,7 @@
 	ID         uint64 `json:"tcId"`
 	Message    string `json:"message"`
 	PrivateKey string `json:"sk"`
+	Seed       string `json:"seed"`
 	Randomizer string `json:"rnd"`
 	Context    string `json:"context"`
 	Mu         string `json:"mu"`
@@ -200,12 +202,25 @@
 			return nil, fmt.Errorf("invalid parameter set: %s", group.ParameterSet)
 		}
 		cmdName := group.ParameterSet + "/sigGen"
+		if group.KeyFormat == "seed" {
+			cmdName = group.ParameterSet + "/sigGen/seed"
+		}
 
 		for _, test := range group.Tests {
-			sk, err := hex.DecodeString(test.PrivateKey)
-			if err != nil {
-				return nil, fmt.Errorf("failed to decode private key in test case %d/%d: %s",
-					group.ID, test.ID, err)
+			var sk byte
+			var err error
+			if group.KeyFormat == "seed" {
+				sk, err = hex.DecodeString(test.Seed)
+				if err != nil {
+					return nil, fmt.Errorf("failed to decode seed in test case %d/%d: %s",
+						group.ID, test.ID, err)
+				}
+			} else {
+				sk, err = hex.DecodeString(test.PrivateKey)
+				if err != nil {
+					return nil, fmt.Errorf("failed to decode private key in test case %d/%d: %s",
+						group.ID, test.ID, err)
+				}
 			}
 
 			msg, err := hex.DecodeString(test.Message)

boringssl-0.20260708.tar.xz/util/fipstools/acvp/acvptool/subprocess/mlkem.go -> boringssl-0.20260813.tar.xz/util/fipstools/acvp/acvptool/subprocess/mlkem.go Changed

@@ -59,6 +59,7 @@
 	TestType     string                `json:"testType"`
 	ParameterSet string                `json:"parameterSet"`
 	Function     string                `json:"function"`
+	KeyFormat    string                `json:"keyFormat"`
 	Tests        mlkemEncapDecapTest `json:"tests"`
 }
 
@@ -66,6 +67,8 @@
 	ID uint64 `json:"tcId"`
 	EK string `json:"ek,omitempty"`
 	DK string `json:"dk,omitempty"`
+	D  string `json:"d,omitempty"`
+	Z  string `json:"z,omitempty"`
 	M  string `json:"m,omitempty"`
 	C  string `json:"c,omitempty"`
 }
@@ -213,12 +216,33 @@
 
 		case "decapsulation":
 			cmdName := group.ParameterSet + "/decap"
+			if group.KeyFormat == "seed" {
+				cmdName = group.ParameterSet + "/decap/seed"
+			}
 
 			for _, test := range group.Tests {
-				dk, err := decodeNonEmptyHex(test.DK)
-				if err != nil {
-					return nil, fmt.Errorf("failed to decode dk in test case %d/%d: %s",
-						group.ID, test.ID, err)
+				var key byte
+				if group.KeyFormat == "seed" {
+					d, err := decodeNonEmptyHex(test.D)
+					if err != nil {
+						return nil, fmt.Errorf("failed to decode d in test case %d/%d: %s",
+							group.ID, test.ID, err)
+					}
+					z, err := decodeNonEmptyHex(test.Z)
+					if err != nil {
+						return nil, fmt.Errorf("failed to decode z in test case %d/%d: %s",
+							group.ID, test.ID, err)
+					}
+					key = make(byte, 0, len(d)+len(z))
+					key = append(key, d...)
+					key = append(key, z...)
+				} else {
+					var err error
+					key, err = decodeNonEmptyHex(test.DK)
+					if err != nil {
+						return nil, fmt.Errorf("failed to decode dk in test case %d/%d: %s",
+							group.ID, test.ID, err)
+					}
 				}
 
 				c, err := decodeNonEmptyHex(test.C)
@@ -227,7 +251,7 @@
 						group.ID, test.ID, err)
 				}
 
-				result, err := t.Transact(cmdName, 1, dk, c)
+				result, err := t.Transact(cmdName, 1, key, c)
 				if err != nil {
 					return nil, fmt.Errorf("decapsulation failed for test case %d/%d: %s",
 						group.ID, test.ID, err)

boringssl-0.20260813.tar.xz/util/fipstools/acvp/acvptool/test/expected/ML-DSA-seed.bz2 Added

@@ -0,0 +1,66 @@
+{
+    "time": "2026-08-03T16:10:48-04:00",
+    "url": "acvp/v1/testSessions/757446",
+    "vectorSetUrls": 
+        "/acvp/v1/testSessions/757446/vectorSets/3990091"
+    
+},{
+    "algorithm": "ML-DSA",
+    "testGroups": 
+        {
+            "tgId": 1,
+            "tests": 
+                {
+                    "tcId": 11,
+                    "signature": "9e03268e97669140a718c928669b9da3161937b27f659bfbebfa5db6e25bbab51a1676a07942c92affb358d313d773a8a771091b071a907e1a4402ab2ed0df69d0907d6a5078ce9148dc5b7978f1859959a7433edadcc68a085abfdb310acc53d092b47f61d42e1d92ab1d99464cd451f68519d616a3ab8ba7e9de2dd3ee3f635f4a5bb9a84f8d9355ca0ac260ca45ff3633cd891d5062c76c311706361b638f350907c8520e31a6cea60b4676976cefd32bf66b2d393eb9431da97db0c183cd29340dcedd698ee3b8b84da2cca08a870a816410c6f5ca5ad6c65286368531013e51b59bfef526d60445ed77aacafdf6fc20f8923abef86dd2d0d8fda34f10d373d5b1fcf5376600be67163033dea63fa57e976bcaccb0f3d64b11cb066f702e53586294ba0fe778e7434081c5e8377ab1d79dc59d87590dfd7de35c64a536582b93e4691399d065d1cfcd6865ae4744d1943249b80012dc03b2dca11411d695b74206c2817b1e1fdefedba0f287c3567ee41d6bc3e24fa3904cb97ce588a2e953f346bd7076cef9fac0d52abf01c101f59462087aa9385e14060661c2856c9c85c083cbc2836b3d3f420e4b14ce127209d2c9632746d65e728b2b2ad65dfb336c92611f803e5194872aed5f70d6b60f60cd1f9701281989fd660a1ea8a7785080bbaf668f511f9cddaf08e5f1ce326bc2a2d6c4c347d8dd8c639fe02286f799ab4fe144dc844aee4d623822fe4de65a21230a12ce5bf30709a586a21dd27d11d69b6744e70564ea6d6c40523853947f34a6afee9b85351e765b94f0b49bd74309516fe22d87cadffd8ac22735311a71ab4be0e0c646762501c1c27fb02407e2cf88f603168d434677fc46b02ab87371b8451cbb0b40a14d0de4834eb7b6c67b962fe4414aaefaa3c5bb591d124a0462761a6d4e4dcc4c34e74a7b67b45f7a31d3fd5b89aa75483e40c883e4fae97732c299c774b8b65cd4372b120449dddbc0a7d4ea7dfa2ee6c467b6dd6d39044d6fec2d3d4f1270612e6613af722ef6c57991fb5a011e0253663c7d4cc301cb2eb35be9329ca371520fc467e233716f1f8f77e145558bd9d618129540e07d9d17fa26291f0309e2d37ae2276ce707f196d2ea163cf543130656ca30786a40b15cc799dea58b611d345bce734e132b8c35a5e905760affc3af75c8e88e5661200d9f29ffc4af69ad0ea6fcecba288065106dbaee8c6fc0b56fd3f6ed4fca54f1842744cc33d65496db9218bdfbb4f39f6bb87a0894a02ced4a0963b478beed4c41ea75cf69c9f437a9503d8fbb42f8b54815e6aa04e08a4b1a416f5d7ad76ff6bd28e2c6a7f9b69558e638b60f57d38d127f2ae4936095b03be52395300c6b93d4b81068c266268a6b40cd71ab408970ea0217dd8c735c9b20602a2d7ecf08fe8406c2f93b70b59f32c2e1e00de45ce5bbb931f41b324782daa873a0580fbe52c2878452d2a485088c60a76505b535816c8735aa2ddfd26368d203dd4436c7aa6bd340ab455fccc61f910ed04be118d38c8340eb2089d86c0666769d2034a9980948f2286c879736cbd3e1de9a6dfac7e8509a2fc5e39968da08d01f5a53535690e19072fc2b1fd72232dbc559f132d4a86bfd0ea826c11a90ebe27b4ec51e8ea8ebf7b27885d8716e43aa6dfc2fbda06ce5297c6c939e368f96d402f12d5d3573319ba26d4671615c0a1f92b609f711227bc97e3ea3c96d4700bfdbc2b0e5e6ccea2c6ddc86551c04bb38f5a2c3cfd05cc0f00352c1beb640925660e533bfe4007af7e58a6271ccd3c1a3e24742b45c82daf1c08d0c5ad7b459d7bd17827c8f600fc24fae68111ee385ecb84652566803b68c9da61418e8a3b8cfb12f981977af326153350614137192ebc2eed66215b330c36526be6692fa7096a58be8789f71d09eb2e8cc7fa26785bb9600d2eba5a8f36343d1e06974c76c8ce177515f2ba5bc648bfed3e519c805f47c1fba48201ffb8995582c5e42366a8a13c9b63b2acd2a226640e3b5c29f1ee4a3230e186483eb6a87fb739779d53e477f79e4c91514113f8910c14534e8705e9b51dd29cab5d5a2c414946399c5a4120ad4d819f33d9705a58a246b540d8ac53784fd1aab2fddb0d400b9b9b5a4f03728b8d4fba028c9a41b2b2c63b9770b043a1abf9472987344d716245420ff4700ee5055199dc95f8eb2f2a19b840655d9514418b3289306204015d1f685cec933f4360bd66ea551f330d763fa387d160a12af2ccca82408cb53eeacfa788a786641da9b56028161d3db0541e8ffc3a9962909e3f11c881b0b432555722fc187203ff6263487b44f1fdc4e4d1b95b03a6f86b3d050fb4a8ab0b98c2e310e6569da6c88df2c19120ccf8656658fea7e878696026a509fb59ca9fda2e8a98247ce29727328da7eedea84b9677af6ec78882b3a48f826a2ec224b2252fce7418458675bb6cf76354e74da026da5cd9746a7d60f954f87f34528264f9e4ad1add5666177c146a90a6a6cb20a3c18ec1ad66555afa1e13e65b968a21df7b6c7a1cedaf7fbc2cb406af6d3f7712db011e7e1568a5b517029fa887211b222b003366a260fc8dc69f726b37a1e57dea0d476922f23405a4589df399531ed86ab5cf987f80531da0d7e6d49f80aa5521b6f62d95782e18bb723b51c998814b2da709365d5251fb23735d680d22da8aecbaf7c498518b476eebd4a3bc2b5a1cc4b44f903e227ed4751c81640bd930744e290e8aad004cb0b265d0ea1becded274d27e1911f8cf8d914a5043b9edbcde450e62524e69bfef13e8a2d3e00592ab9ba31eb2f0fc3243523b4ebd3a3d9c0e260af323da6c70508f943589e5e6de3540f1febfca4eaa055270347604c0b3a0d85efaf6689de6775b9612eae1f6b6eb899726bf700da8fdb40b669597a17045fc0bfbdec3b892eeafaaa3fad8543a6f5c56e40594b8acc7689c5ea21aeaf3b9a908e01987421084b1022108e932c234d20cc3fe57525e12eb622d6a4e05d77ef5c9bc639d09d2661fc6171b0e0df42c99e6158c823de029ed1d56d169d9f32557a482d98d4c26344b5715c39742e9e0d6b8b432ea7306f52210ebc26369e8e245ce49017e905d31281bd4f0b9c5bfbcc4038559229e01c12d3fc4a5fe5f8f90f3375d7a08c60908164787780eec052df4bbe11e4be32d9d301aecbc1a11bdccd06a846dd8c1b9f6b3dd29f6cb1220b89134a776cff8dec25d53a89452de8e9e4aa414dbe6778c7b810a231c7394449edeed7af7fcc09a882dde263c21311c12462e9c7291244a8db8d59c7ca8b0203183368708e96a5cad6d7071d393e4b737b9293dfe1e3e51321303a3b4751626365848cacb0ccf02032393a60637a9fa8b1e4f20000000000000000000000000000000000000000000000000000000c192935"
+                }
+            
+        },
+        {
+            "tgId": 2,
+            "tests": 
+                {
+                    "tcId": 26,
+                    "signature": "0234ce8f505892749650e66b0a959644a6e5ca7931f4f159130bb2190a9319c2f4933460eeb87310ed65b509782771ffba8835f4ca88b8a84843016ca192dfb96c2e1d9dca0943be15a92635959bcc029b1ad3a3a14c63f26d41cfade0aef2404096ec7c05948120defb298b7f36fcd07f911ae7af70d36760efaf1793c57c94d6547a6c646ee554bb33558b2e1dc263e03defbb9fb3cf8f4e200285b7e18d6a3042ca36772936285d04ad4ffd7c1c1f6e8715a6d546d6f2ae01b09f847d5ed4846ffcc8d801d43020aa79d05bcfdd3a1c97e38d4afa220ea6c9975b37334eba386ba665dde444b3ff1da130db2df7b2622f8946fcd0be9efead3a04ccd3e42f720228fc182cc47a61d4f7bf491b26470ad03497c990ad6c8439069b0758dc77180655b18814f9f1c4862f4975339f7db3e7d0c3b7b8a81279c7d3e34e166811e6d2c5aa531755b5194e93f1463e308e73cf311b5d172fb6a9fdea97138c56a552310580d67a1d0f675f333de0faba555417535ddbc256f4538bb6f913df8d1c0dc53ad251d9196a2b695d20a7d606d03f92bf6922c08e11d9ee371716602332bc96d7648de1d1600b7649bab9718004ffc4a94c163e73419f7c8e819b8834be71c5f953a0fef08c47780c87b3c13b89911d2dcb32df69e250ac7abc4ee980d5d177b8d480c4dad4ec43177de3377ab9653913dd0b5060067eb7771881cae6068941a64ef696c32d1f7f7cd726ffd6dd2a5a356029409922fb109a3b35a9e9d8f04b983c60c74f20873e9f3eb57d1f425cbbf44184bb98f5d0b75fd858cc8580f028dd610e4c7ec179de69b0697558aaa40d63aca43ac7e755a9dd55fe676f8850934bccb9583792d51bacf5fe10eb4da2627acc084906a12beefc8b403e116c75a56bff4f8f5be50f149e24e251bb735011bacb19bad6f6cceebba82221dff8f425b217b335202d3227b00407c01870cf78aa5090df636e94c56e8684e3826df36f997dfb35a0a818b5bf0a400003441d71f84f312f5822ead7406b26b6a6fad96e27bbddecbb18d11ed76f1744cd44ecca8bb41b58e538512dec7d97d839b4afd1f3e6beb642277e2c719a50c2b88c705173bbe8a8aec9f67f6b0fe59c6dcdc46cc3c8668a0358fc99759628758aa9ba4315ef5af69fb910fcdd071a71cf780f31d64ac0246d9755933b9ef3733e4dbf93abfff6ab52a9fdec32224f42034b0c70f877cceb78a4aff9cd4ef3bd3d7b11a6a3000a8e273788101f31186c4752ced217485455065ac893fcb5288deb118e02008ef6b0d73e53317e522fdde02bc8f4e5243484357b35fae00cf121653d47674aeea7204b3859c15c3a61d4878a655ad5c61e02b74b9ca0752f548a35437e014ee4160f3d416b2baa4c8838c1a57105a50e092ee1f42f2ac5051a1194c0a0bd8ae9f4a04d234d0252b3be1340930c7dc676a14d3db08095105f5b94416b55f54d540cf20d116836d5c13c3eda16c9650b2e625b46301ce488d5e2f475e8466f304b20496d8e2862dc9253815b40f05decaee64247e22514af10004ac14b73cae069bd5e9882f3bd4d3111eb9039c8830c958def1ae82c4cc9565b89609d06a577a987e3e4fc45e04197c1267f9d56208bf4e47162b3e37f884031c62a78e9390220493531ba065cd858937bf2a739cb74459fc0395c2baa0f16f84cf54a616ea56ccef5e1e856342522ddd73adcc2a80298dbafd7142803774adf06d5ec9a91b111d850e6040b2ae7a77d0155b90515467629a7bbdb49d229cad9c17c01ca24deaaba650d5e944f0f9f004483d651d9a2bcfdaf559c2594c0c0d8bddcd4ef9113c50740d5b35a3f466f609649d45a1869ec84caae798aeb73a1ff5bb941dbbad385fdfb4b946310c41184667d7323d5d16f670321af09341c43185849d5a56fd5ff3169e363672eac37761f172c0008b9cc54edef2222c0bde39c8edc155ed6a96d2b6105183e16bdee322be1aaef1045b57b09fb1a1eb99f98eae2e6a29c856a0031e89239f655001a937e6cc3835a6edd6aa2469bf2394e17499beb3698abc38a4afe574f4a10b62f95e9efec9ded6b28bddfc28de3b87ba89b6db304ddbd7c7b316e8fdca7f153ce595cce8b79f57ebe6f0e87eb28f8962ac9cff1988ab4d0beb243dd9f69b4ff4e919af2365c222e72751f693304342dd10256ae0373544fe01062b1b7873633351fd198e6b7a75fc7fcd49462d64b4b3394b6690def88acee5e25af15d1d6da8e93812fb69d8c9b08c0279d5edc5c1e718ad84968de023d8fd25433fcffa9ba16b7524fbbadd3cde345f093c8147dadfa9a177b922231425d2b8a15173a1d385c2753eb67f38669ac97903eb7d0c0d69abbf60c957a6e98681dabbcb443ab93901d47200a76ca1ef874412af7d94f33f9d2a3fedd7f3d51721332cda0d4182499fcecdb038c11b42bb410c48b3155f69a06d6e250a1e34e72742afad98e65a05eb4be9d153a522ed18dd27ba9035629d2525d84ea155169fbdfe275f6dd299ab4206b3573146a9b58a5d0c19ad4f9160808b34913f1e1ac68e184dff323dd251f4bdc90614740ee1719bdb0e5bca32bdfc41a0fd01567b00b57b214a7e395e3e27a5f07a37974476472f8379fdd63f448949ebb342ad45372ea3f50d959b62c70d61a9ab9beff5c6367af4ca56d83f15dc22a1676d62dbecece302527df2b55d3cd0b9278abab0be608107ec2321c58df3c137542c0dfe4d3705698d8a52b00fc54363bab6ef8f55afb0805afb39adab6e9d3bd827063a65b5b6504500a776be291eabde3b8891193405dfb0d5e8ff4c78cab917c23a543e657b6822700e184ac5620ec15c1838c5cd0feb92b2f275eda4e59b7d95e1abe4b9f4d53ae4c51abafab5e6eead002669d36e942a79cea73f5bddc82da56cf434bf2bda4bd14d6b52445ebac8e4695152603064b6853f0c15cdab488dd70cff751afa314d377cc72908dfa6ade53cb5d6a9c43a92a280a2213acaed96f3d819d399aa6b172b9a86ca5b0b05ab8058dfaa7b2daba23578c678f3df1edd18ffe9647cd13188f417c823f4046c8e10b1beb4896fd8fff5c44a67b9abc9c084a3df990c0ee4134d5998805b1b7b328c5948b730bf5bcc502b410944023427febbc129bc3c617e8a27f8b9867feebc2e2f005d66650c29cc07b3ae86bfc642e89193a19ca396480bc545e5fd43da6881e822da6306e45298d1e4237556ca9c89d011e6cf8642e6755d66a3da48f077d8c2c8f1d22ea6d6afae3c86c70cb466adf2cb4cf0bbe527e5c3fce36228ea47b7e6f3aa025315a14d61b66a5b7f2e162170bef6fd0e5c45c81f7a550c5404b940002d891ec079f9678d038aaee4752db15ab2c8fbbe54c932b18e501b0f90627c5392307721b62b12e87176dd661d8021f8d1b515bffe18f0f2dd26e8ca3f379d31bf4548e0e8d074b480e139f9823a4d378bed676c7602828679fef6c3a3a69eed170403270bfbc19545903daed684f0a6978b7795ee70e14c1b559f80b9fd0253e2ff4be518bf08f58d4d0ddb52bec7d69fd27336f2d37ecba5bda49ffc32b8b5fda879eda8ddcfafc0d19524d2c9c87617d850013836451e3f7cc28c6d9b924fa8eeb956c75c4c7fb46039a6e4ae8f56b4ad0de327a06fee69ad45c29dcc70f14327c43414271e50155626f9061a0554d5986b61e8e30c7d6fd7bd082824726f421ed0fcf768c40df2770f0bd58647131c353ef01934693812e0b442f8a2a2ef3234406aa2789e0cf4470560ebc61d869d77e707dc63445b54c760f2552965af0edd079ebc80ffc34d09788bc580491a5bc6d1539d3894dde322cf9572305cd728d3cc59121a1abc4bd1cf455ae3b76f0c8e13729ccd8c37b95002f22590307ca2fc8b1e8829d13093ee83d69121f6a814f0b4a386c74bfe498097bbbdd9611b88e813462c4fd589ed0f63458bc9979c9343c2871d21cc7758a8d9fa42cc2cb50f3af486c2d721c205c1ff6c8ec112ba3a809d560a5c2d35a683d1a5191ab7f44a6fbb8ed78f7a4ab14641113de58aa0a86bc3f1a161590fb521fe79b9befd8c4fdd42006e464c41842460143a6ede3b866526087e5fd8be5fd2ffd698f79349a54fe78a600eda150d2ce1f5baffb20989b560e1df76c92b7b13db87f135fe3eab4413ec8b69a205d6840ba287bb5c2ee0c97df585a537fe1b4f519dbfad5921cbd05ce3eedfee117146be9ac5c9c1e16d054ecc9733b5ffa5ff6ff8ce025ba29bd3b1167167828e9117a0cd14b06b317fa74670fde9f52760f82a1a65510a14de91b4e1d18ae84d789f22e55325647dbe86aa12dc1b7e9beddc5dea2da84d6381f4034f1fbc67bb67d0e1cd30e80c4e83ed403982faed68b3b3300d31165cc09045127958f8ba4fbe69370f1908694d4037c910d0eb5a6924dcc44c56f5941d92f06d63467637c88cc6c66f78ff8050bed691246ba20220615b500525d46e004633b226bfee1d9b666e33f7a4d86ef52faeb8618264c14977cfb856df8f2594803fbff3df6b4a10e8d6d356fa9566ff6a806a306a4cf5ecc429ae047ec07b2aa7f922480adff85a04de1ccb99e931b4063979ca8b6fb4d93bee5566de0ec0e467291fb0176859bb1e1f00e1a3c9da5b9000000000000000000000000000000000000000000080c10151c22"
+                }
+            
+        },
+        {
+            "tgId": 3,
+            "tests": 
+                {
+                    "tcId": 41,
+                    "signature": "d0e50060f0fe2b03b34cd859b9b836270e4c8136a8e374ed9f4b82db62c185a1d6924ee88939daefa742be88c29b689bcebceb87810631351e6ebb291d8bb746dfed78b91a8bb55123ff53a477caa558daa31da24df96e2e4a3bfdd9e3c4ba0aa11458a5c5e013d541d9d0361dcd8bcabad51287aa40b82c9b1f18d80f7525687ee5e35931b227d0f60897dfd3a4c152d14466245e7c16531108ce8f9f122ff4a5dd362367c34a3f2e7dbb6e26279a0dbabd326aed0ecc11689d0a86b87610fea4e412b848de861164c358f17c252761609ea28cea825485c65b631658ca443926cac9f7fcc4780801498e02b55c4e47e12e4f875b465ee8e3d6be5109b5ed4447f4a51d98583dc64e7aead60732584f73f23dc889e2a415d183f0d7cd82219d5234f168216f39c54541e2fca1082e26f2ad11bf819d2b66e6a65c7ef9cd769afe562013779f67f98e94aca4a4ac55d06b307ab4449e78269a9d22aed66d966a526e65b1bd2a75dba19548c080d5446c00638a1aa3e35b7c4e527909193ae437523ad1fb380a89f972f92223cb9d88187f4035dc7ec3c65efe984c0ee3356376e3200d7650dd621b49605bb3f7d50be066f453d4385c209507e284df5ce1eb9bd48687aa21e943d3bc24a598dc619cf1a6fe72d2735f14958f64bd9af8bbe09c362a719644e14080cad70b388281b0b76435e128f5b2c58a7e194ce56e8c55966b65d1f11c237e3efa7dbe8ed7e3d84206f7cb0aaf2aeb762e232aec9d60a7d6eaa3d90cd24c511b2cc74f862757f4b3c186b6fa010c8c6eee6ef562a4451bc92a0b99980a6766e7581c4b5fe307462a18e15a683f9edc5c76bc7a5a551b6750a0d14ec90eac2bf50f7f19ce58f0190969d0c7bf3a98a8a50ea64c1a6358776c65e618c3026bcc49b02e9e612575f25774a3a530159feda74ab9b0f5e8d43573b4370ef4cd02f1529824950152ab33bfff4a20ff8dcf4c28665d6caa9f9ddca9e9ac55df14978f1a313a98d633ac4b0dcf4bbf33a870e3a0726ce9bdcdfd5629adef41effa4fc4d26c6b34d0a1abcf6319440fc7547f299bb51c95a90bb242a60a20ca5aeca593529b160312d562266441372db27f1d005fb1af64ad10369c53685be913f4da3e75ef708532f46534c0c43e8490f0503d9997a14f49a9e38f4fc5e861257e4ab0f12ac15f051980c8e2c85cac7837950fc971be00bda9b1b366da9778621abce998b0b30197844eac2550c1dbcb7beaed9ce35aafd61b0af5db09d42ea5dbbb3b41161b28e8db0101d6da66606489e50c063b2f284de6cb6f7dc892b789126e6bcbc1334bf546ec3d25f4280a513b699a4b637972981a2108ce48bd36167446ae9587b68d55d764eac22469f7e67c5081aee19c3df56e2aee3ef17394f5e8650641b835d6e7215ae83c3b61fd22e354c9aed87de3031bfcb61c347158265a86642ded63adac99900cf95bfb3a02d178a31dd2b67e8f049038001a4beeae16ecbcf163a66d49cdc34e5fa1a647b443bfb885025b057496316aa38114318bd042fd6cbffc6b09c1f165451b4239138bf6d864a8a1d13e8dcc399ef22689ca69b7ad406781f232bf09caefbacc732d402f65456903a0296bcf9ddaea70afa95d226057233f32cec21b93ccab13cbdddea968ad9c1ae44591428069b837e93e500262d1856c095dceb52011125270f2aee903cb1cf6faede20428eda8c522471321b86a67b8d632fd0d86e86f2167f04862e91c49aa7c848df4a01ec89b2555415d19433dfcc3453ca4b130abe84ce1ed29710707f7a131b7583feaa53917e67b63c7728cf239963f0ea9c881722ad736362e5b25af17bf0f2bbc1b32024260fff26226872df066cf85d128c8d5cbc249d83c76b466cecedf1aa5bad110ef9bb3faf751bcc55b5d69c534713478a829788049e5173ddd254120c8144966d57a9d9eb76013d1b232adf9156035abd284a4aeef252f93d37022b44621bba3d1b4857b238a3179cd4c0d7e8b6975d5950503345aaf92f5c02a5e96c9c84023b5b27c6938eb43a8b6a6b4d90897d06d680d88db7e7ec33ca6a8f3b790cf3659ec362f86c061a136682e58c78750cf68a1e354a9cd187933a34330f8af7db6161df414519cb3742d214adfa9bff6e2068f465431ee963522eb903934e59ccecababe01980d2e1a7643680b862c6f283796c87c75676d8b0fe532439c72913131f3420b9709f694ada89ff72ccf6cea09d9270e2f6c5fe23b851f5fbcb174e8f78243a088bef74448715326e8f76fd816dba4c5a32f8722af46f6ed5e41358d2e720ae1781f0b179668a7e227d9df35ebb60c79b13527ae31e80198b07947ddc95c2f9766b5aec59d369b2ceb10918833f4f4cf4ecb01364185c2dc3601560bef28d6882443efa462c92da74373da1d2caaa14a86b0e68b6dd9a7e92fb6b930e901003d23756002102c20a768de41000e0dc234705ef8f3a4e9477defdd4d85029843f9626a8aaf025053f551ed48643fd4bff4a168db183846ddb31f09b51372f763256b9308b69df313348b5838bb093aaa3826453ddb00bdc4a9d1836efb7c7e933444accc9f12afa7168f5ad67d93c6503553153e835d364ecc28ff34929b8c7e828475674384068f083d62880354d3695e792bc9df077ee60aa62e22170bad96bb8c4bea02c7ee85ebf79f21c4413fb36f4249ab9f35ef1316bb544993bcd5445a677258c38b576034821e369d2e27ebacfbb35de6248ba363e5a8def4d2dd9674e5d3410fb686a6daface68ed8abcd9dbe3317f0ddf6d5f091e7edab4a5ebc7f5e1f326700c0f8b81893c3a7236f932942abcb16da5cbaf095acef112d362745d5153b02c162e8bb665081333ca353a855585d2993b90445cb038805e4f509eb813ec2ca9aa12c22b1ca7744673c743e80c5f07e186f0b5163877f3dd0c068dd91439472866da8b30595cd8e1e1292b5419d8850f1405fb98d72367ee8b30d20606fd5d109f196550ed27f4a80e0ccbc294d3d5ba886f93966c126536d279eff432a96f119484910881fd413de2b9e075a98b85e615adf049aa0b585b001fa09413d9d6a6935e4a34ca5b1f76b9162159a8986065413dd31c5095c072d6f3b8c305f075d066c72dcec4c1fdb4ba54f2b9d40237f0c9ff07432bc9802e26751f4261e3a018cd96596af877246e6c273d56d808f43d3113b3d278dd11bcf7ec6d6d0cb13809a1337bc9a614365a7a8296544721d63731f4ff652f6962b5a5ca503985f60e2f82d8457fa6b3c1d522049347d169f4bf21abdf9d7744f558f69880085391ec209b0bf498436b5edb999f1619fc99062e3d0df961da2748142303f3f72d6d795fab433f890589fbde8344849bd4c31a69cafe66d2a09da0260a7dfe472d4ed4018d914f24596a672fbe306b7e70e47dec3892169ef16c890048a7d0f247da51fe8e7b770afb5737d52b77311ea7acb4f4d4493218e1fc3b2262903bb63c13db4b9cacac295934588ae4a612da51b145f31ca3b72d996d4ce91c1c789de29c8e80877571ec09cd576b0954c0b2811d3fba8f02cf6faf56dd40c6dc308f80606273b67136cd173460a2b74dcec0bf3108c62c102a98a052b12e6a5f6e566f6e6e191a01d2d248481a35201c50d10e7d9b3a89dbdb18e413df018dc10a7a6fb9a3f4bef9087a2fd27a0bfd262aacb609951c06a9cb36532aa60e041277e06d6b2876fba87dc69b8f51db4c2fec5a730fbf5735ff55da2f314dc2098adc8e94646f49667fcf49420f8ad29324ba8da9ef4f83079fe3f6e15c8d490c7be0a3312a6b503d23bdf6cff4914e7b8b6efaab1d89bb873b8854ae8b4747d3e7fdf184aef7463eb89d5f34f36bc2bda702c526dcc7311af8cd2349637786d84d5a6e9a7470cdb252dcb7ead8220bf4813d875c1582da0ee49a5d8259ab0b29b627c23ea6874aaeb2e91d217d55aae26dc41b545f0c02a4da78565a73371f65bb37aa0fc10c59197276fd0e695d4c1f177f1d2fdb2090d74d46940a3850791e6173db714f144b2cd80154662f097cc1361ac669f91a89e6a5865e1e563ecbecdf12ab8916183ce5271e700b947017931b7621e935e8c382215ddffc10f5b00cebc18ad7dffa20345bbcad5f8550db47123a4f252312619374e662f787c002a2ebfae7eaa896a95515b6ed8fbc30e630b7638ce3c99977509735a6f6ea751015164ae5471303c9bea1ef445205cad1ecedfed653813719a9a09a825912c085d2e4780e2a93f7c1943225a8bd429532c5018dfaef5b6cfa74be6ee03ef7172a87e3db1d96c5c900cccdefbe1a86c42b95f91784476c512e42e490339f0bc7bbc3860033af26ac4bcbbc89bf2062f40536d04ded9a26d753180bd507954643c60648aece6f895ee292be433d6ada79c9f2b5f1217473537dadebc6fb1e9afa333e2936333b6c5073c6761b2411d2b0250f6c7475a466c1a6e3f4fede8e37620b8895df2c16f28925540dfe0905d6f150ffc0c49468c36cbaad646adb80a464e2a343e4b5448d8e55abb4f3d371d279eec363219536000b933a103803cb9d5effaf498ef1097878c6675198e5c93b2692dfee8759a3a62131b2d845839a09db8e018e436ed0653a079637aa3399ef8c37f04ad499fbb44f63ccdb9d3b47b54cb9e20bea4ea58981a449b40d4e2bddacf42d775a99467a610939af472bbd71b76976e7b155152a01b4aeba7525251694dc5e3d4e8c70ab27562554030d043852f1d3c564656c99a2c4f3805a9b54e6a93d379f859d89dd32d7fed62010f617070589028c06bcb7714ea00c7aea1d65b40f80d1c18b3110223b99d8a3ccf4a68eac3613318b4d838582d66c2bb60e84ae87bfd6edd4df76276c9f383b5d74099100c478504e81161d50152b9c6e81375ea32376eb5a2a4c538aaa713920659fecdf581886bc860d3ed881e1c42203f99716a0a8c22bf97922bdfc20be7cf2b4f8536881477afddfa3fab5f79ab11e57988b014cbbcef523963418179ac8c352945b0f30b61ac80eb552bba34471bcb9b87a3496dc31ad278318a633405636cc75238e53e926b963d7f2780d4135f8412753d2083cded8c91d812593bf0bf4a5f900ab890b4459c4ac88b1c8c7f9f6c241548155bea7a3ea75b288ba4767701bb3d397f7c54d2fc7841938fc6f969942f4dd294c2d4a86c5afafbfd5b8365798d17c392ce6b3e78e60c6c04e0b35eed8e7d47d4336984b427ae29683c8e1b1389ac3c779e6b833901f19b3f9b3787819ad4aa46a1d6fe8fceb81106302c206a7930d77efb44b3d58b472029fcdb17f339de79dca9c926d0815f23f3d3c3536329ea126647ca2272ac1ee462c84577efd1d245062099f213c546578e578e889de964ae77c55c1b9543dc11dd68ec6f654b32bf7bd8bb4d38930a2c7e27c8517e9055412c69de01ca3f194c362f473655aac18b1220ca0cf123435483b0c682f39601bb59684994f6e8380bf9f6bcdf4ff1aaaf08d6de01e0c650d4bd82c17f4c85c09f46405623c234dfa248b3d2148525419bb104f5c5655dd5a06fe7c88be36951bba96cc059b5c4c2006a391daed4f65419ee0c0e3fc7fc86705ba2fc5fc972be63d29710045c4d99285bd1f29e3a247c45a2295f0515175689008ac323fc5ae11be0a60295b3390d072ab3104d657289e3643ef0157c09a519a40bf57334af6399368d1fb6cf160bf3a7c9eb75ff2429f03dd3f197250116187c1c86fbe7a17d97fea260d17660cbbb4fbc58d895c7e80dbfde8d7bdf7ee606819442d964861a9890736b0131b9b8495c0e2df78ab31853673e82dbfc4b8e122daad58da1a7a1f463a9ffbd42d58a3f3cfc326d3154c908b8d8deacc06f20683a8facdcf66b343910349c182e5f121464e6e129f6ca1cdba4f60a001a7c58314d5e764075fe89fcbaf3a70cb6e089e52fe7310f8b2ecbd1a285c6e4acb141d184cb73577b6f49768b5fc742093195105b73a5b0654f113814271dbc8c6eb23d8e5bf29f53c68e15f0046f8747b6039864cc29c31001b337351d63c1f385a5fe67c223209c539fe9878871f25aa23e9b2ea41b46b9ff0fd544fce5f6a9ea9ace028b81ab1bc1fd69f2d63699b2efcfac980b154ea71c5e015b6a565a42e796a58b8d968237f0be4ea8ba7dd35c004301f844f013d72946b5287563d050a6b59f746db926ab8282bee248ad92f1eff2b9af47f81c1358e9dce5c7f54306196b0b1829f9fe152e55b6a7d2b022b46f033d66f452ee55138d9bac7cef42cf70f4f767b7663f2ad27e9f58eaf3e3f973971aa800d31dc9a52081907aa5d4207e02290ff4ebba01e6a73f1506b663bac88a8e5785456b05f234f1d480aaf8af7a81fc61b7fc384ece8b0a7d841e9f108c4796f5b5cb0a609a9b566b8621c95b1a62b992ee147faaead373a638b98abb4e1081154577c8187c6c7cbd0ed192495bd05132e38485496eaeb49e9080b2a94d000020d1c6e7ba9102f3e506491000000000000000000000000000000000000000000000814182123282f35"
+                }
+            
+        },
+        {
+            "tgId": 7,
+            "tests": 
+                {
+                    "tcId": 101,
+                    "signature": "c6b999ff142736fae7336fd6d1869e5ee0a2fd7d4b820387982fc8a8fd9a0d994f51dc9ab115d0a52ee89c2b9d313ecb4a7ea98dcc9761556eac4f0ecd5cb733c70fde200b7ae57ad58b1a56ddde5b4e347e7486701831b7566c442913e0531a264eb549208ee1d8a3e5498baf64b375fecf8fb5a7e25a87be1204598fef8ae0ff232bc4c7867414ca5e6869ec940ec6cdb57834b11b4edf1c83794ff6a9c18c9d7280d829eb4b4428dc8435e89a06b68e292055cf3fb21b3f8f2dc9d5d168f67fc94ccf5e26a36923e7d67e10513f3457c81253138eb3d4e33418a27aaab6f71cc9ae3d777d946913c90158909b29c9d5b42008ed2e4e42a83c9c3379a7bbeeac5d8363c53a2a75aaafdfe6c1d9f8d6e298ca83f48080aa1936e6a799f79f50d73646ef0c5cc84f99e7f930c2535e57a9f70a8a198c5f4ab2413158733bac39167df389f6ea4a5e179b6a611cab5963854b5a0c23097c10f0d5c28c4ba0200cd224b72e04c7255ee6ce5225e8ea93853183ca291e2eb0613d46ce7c81d477dd0498e258ef3ee7546261429689a79076f13f3ac1502dac681be6a7ed57f2a5dbb820b8a0394d9183b998ebaa36bf84815a9b463211569fe22f785678c2d4e15b8f1cd63084c5c42efaa2c90fd0cf5d1fb5d8ee0d3063ca8ad326f4abfe35a980b1beaecf754d2eca6672b004c1f995618eab9313c8e0b1f476aed2395666b4f06503f6b985ebc9020df2d80b7e934356a10e354e488cab14eeeea7e7c4608573d9cb4743e7c1ef28efcf3cb599e071af1fcdfaff755b93c5cc6a10b1f62031fa3ac2c8a5296446a5169596bac46b5c67eb962e23232f1d33034624d902b28511bf85f68d2bfbef7a30a16d539cd14bcb932e8f8408e0d2782f07f550389e3d89dfb857edd5532c57c144c6fd2e4c2a87f6fcd23a7876ba58f982433879abebe12830a1ee9c94d2808e85045096cc74799be5b7401a7ef8165d357e0fd266de2db1973b375eb63699c94d20de9153e615288728bf547e70b840fbbfcd0f166acd4298697ba0603188981a5f0463cc548a08915d1489c797a34eef28565c803d018eea9189ec16864d797c8f5580281d49c99859390f6a1fb09ecbe4ce98172e6140acce99a2d9ddc4b347c1baf92dc9dc6e198bafb3d4bf3cbd56a26b30f6f66956c4696d77179754c0c6e434a73b187c862a085ad56f2cc33bcff9344fe27e4b222f1694acd997ba59e47425f39757cb6250fbe3c76f605c7ff7352d6d24d1bee9e6dfd6d752885403bbf0d3d7400f5c453eaa80f7e09006b89e0b0246df6e8501dfcf3dc66f91ffdd42229e452321c5ada6aade8ad05a30324fb6e147e1281d6dd1c73714044f69281c718dc2241bb81cf31aec2ae810452618216c6a2c409777057b08f719458e360c8c880dced6eeaea2a6674ae2eff82f2039960db6785b29942fd507cbae4273c91de5301315c248e877cecb48893ea7f081f9777c9dc1da7adb8bd88552f0ecc8326c8ad77c506e4b78def7397c9e84282493ef06e70e0e555c2636475b4154ad8600619785805f3f5d5882a29d388cdfa51c04a9c2db1cfbb7387ef11b8e4a5e1773958fdc8dad19caa558e8bfda9e834268f87f0e7328ea9b9e9c58337b52d01519f5d0f4e94a285a3e3d7e87c75f9b474062b08c3542653cf2ff8ace8c08da097644ab26df133406760216c2a2e31b3dbe82591bd9e93282f847362b47c04a96f852124685b8cafc69a60dd433a63d1d1713dce23ad39be14ce8370cbc80a8bdc230583312df351918b999143b1b8d398712b03929ab869f0409ec9880ca1101329dd160a2e70acef6753d94c745e95b088d896499c4d3de935a202f13ebe2bfb1f80edccd40d277fcf3b6927b2c69bd3a69fc92358e9dd501c142fd3cd09a0d575c432689d617271dce1e6a3bb7f72748ea6f4532d9823bdda1f04a59bfe9b593cddb021442baf3877e4e350bcfb3e5fec518ff14142cde4772611b2899a77f85b4de3eb80efb020d67fcd26a8c361f5d218b6e5d7a08998c1f084d2bc20df0950f3f1cb0c07c7e9ab90a779b416f8afb2cb86cc0829b8f3901d08c852f003fb430b437b7eb6287b1e8e2c656ea128b445573f4b559f08f159bcfd0c0bf419b49b803caf4451c2c9f2e8d16c297f4f0db41578d844dd8a09ea5786cc615d5f69ef12468d36550901b59047763fe5494a19666834596ccb7fd687eaee3995a538869da78e352e1cdf2ba65b2d137b4e4750b95eced0a6097264ad64913c274a2f1113eef1824399cd5adf274c0cb5356d8763ef6b7dc30ff7334050941f3cc3866d771da1744591ea40c75d5352479a05e49a5f8c5862c481df68d13b2df910d08ada24e0a6422e761ec8d29bc691b4935b58587aa093d378df227ffc159850892e861b7f0f6b5a6cc30637df1c8c02060f13aa8da8feb05d009ba1496fccf2f1714bd71ee08f03a437c98a41cc135d0621b47b3ece6c863cd72aac66abfd4a64925151d1fe8265edb0f636ac0d1de7f31e285925e1fdd11769338593fc335cc780f100b3fab8906d675bf630342e96a087ded7f491f497fd4bdfae7a128e596602c159a60612b8820f52b5945104147d316581b4126e5c19437494492a165c4b9b1fdaca5abb8d64cb14e5004cb3c3753cce53d2ce1f097644a322bbc1365e792da263586fd8acf00f5b90ae37cf003d4a70b93ecc7e423b4605a7cf38dacfb3e01c8b9a827d5718072fc2631848aa27cffaaebd2343eea5d8ce86303b399a16f21eecd84a48a9906c3857972fe1d0fb9df1a86a3a8fedc3263e413054eb2439578dfeaefeb5bb613efec7a79efa4f026cf3c68e2c38f02b033260b6c9036d8b6b38283d512af6d7ff23a72a420fdd8ebdf9e374dc9fa63d077b141a4b930dfc277b76c089856fb84f60cf53ab7a2b281526300166db0ce65bf522aca15e1e9947b36079de5617f3f4ed0ad9a1cf4d3a6e8499b1525618a3bdc3a1c036f237fec35139a43f99d15523f48269e1ce201fb8b0c3c556f22a6f93f13ea643662b1c7df8b56521fbb31e5b9d3217671dbc80e95392501e1c85bd10e64a9aa4d2e6bd1157029f77e6c51057c070aa88f2f4876b56b7f06d10f596ca1df545fa9fc622241cda1c55a5255866fd5ff8dd9fa4f9aa9ab2a20399149bf723e2489c6b21ebdd27f28a4d691c4ffd139a4c2a06e654b13ae73f6366b682ef19f9b9dd3d51aa4a9bc11b025dcdafb6d922cf12ee73f4c4ac769476cd6d66fabfdf3c192890809c0984c9c3b212cf3e6ec61d7f51f7082fb91613e01031039609babb2b7cacee3efff0626515f7381858a8e959ea2b2b7bbd4e4e8fcff151c20292d32637b819091a4b2cdf9082c2f32575a5b5d63697d81b9c100000000000000000000000000000000000e22313f"
+                }
+            
+        },
+        {
+            "tgId": 8,
+            "tests": 
+                {
+                    "tcId": 116,
+                    "signature": "56323ca40b5dce4a84db86abd00cf6d18c4ed167f06d234034ab8182155d9fd196f23bef7f3ec9615485486cec9543a19d6d5083689527b3bfd2d3caacc67f22465c56712adc97beb79a13164aba3e2e99539c4e66db7de73abdfd263db02b942a099413bab219c0ec172d837404193d698e4a23cae390c5fc087cb5224a1a15788c0ae0779bfe586428ee253926965d1208401534b9bbada1052464be1932a2834fdd36c1bb2927596b9585fb59c0ee3ecfdb3ab5a1b2cfd7e2d0ea21122b87e9110069f0feb8826c27607c316c9c7b637a63127514b69175a9d909c3fff67555ae6e035f7e8e3a29a9737cdc1331c3b2f45157dbbbe1a24c0363f9d180f46cbf5ffe865b55d5a5ba329c8cef33afeddb1bc0f3857b0b24a4790ee452e01c6e134b6d92b21cdf22991b717ffe4aa37d7ee352611745c1fea4f260fc1b4b396fa7b1368c9a36cd4e0a9ea9c270df769ab23d23ac13b699981c1cea25010855eb20140ee9090a9d6dfae4bc48f31c7333ab5862e609a51a5ac0ee063659283db63dca4757ee2f2d38a4b4bbbda2331f2f8648ef312143290bb7203abc4e9b4f5ed419a76876a62d428160c3bb20b2538ab8a2a0704c9394c8c51dd59e24f2d9264d563c269e462869a15fde78787eecd02d4d63010489d5a0694d52500a1105a4225ab56bcfd39e57f09fee1e3a915bde993995980284e10f2797e064c2abb5a79b69a98df236020f92c3e84c6eb90a653ec03c0070faf2a472d8534a1d2d2ef667521bbe91a890a67e392a80e499f209caa1ec5c76fba8b81ce66d62d00c64e5e9c790a7883b401a672c2f72c7e362c286d68eccb83f1a579548a93870f21178ee50e80da61707e4ce9d760c09845cbd5ebc67dfddf5d21ebc05b5e0e444567c798e515069906c005b49eaa52cfd13a90769fec2d95c3c9f5080439230894f92f4d27bf1ddc752a3d43cc48d7a6dae42b05bbd728208b906875961f45538e0865695794ae66b632b3c8192e7e4cfb2499d1c5795baaa06c927907effe1a0348918d87c49b5610b130a87c1af951f109d16345bc020a90d987a5a4c62cc862de949307d5ffc0a959954006c02d2abfc4a8f94b8e9a51c0d138b31cf32e73c9c13642845aeae0c3bc4fc187dedac34359c99184279cf4ba816a8ad57f761030c386c4502c4598109337dd99a6525b5c7dddf627988fb454587e7ba4343607e6c906a0d8bca98297a35cfdd3fd44934b40f5b2963c4e37222eb4d1a8cd4d93218ba63abacda9728194e697043abe45e8d83111fcaff643933a1ce9f1a7907b052aebf4acb0cb9781ed36bc76b6fceb4ac1b96b64c3c5136b9cd7f6d5b1f90aef071f38b76f30b42093517fc6e4558938dd2a27b6b1821a3328db1ddcad930619d97498dddfc7e50ac4df2a81d8e4c554363bf760aaf862f67012ef80ba41f658de115a09cebb2d89e874352869d05a94e37723eb3ee5ccec0ffe107f068e3bc0a84252e2c54f748cde09eae6fc2903362b4b39ebbec2f55429b99109be7006dc83f759e0f2fe827d0081673eb32fc39a448d23fdbe254d241c7c6f5143aeb82c22b30d61bd616864a3240bc1b131c75aaa9675590658dc902e018b8f65626b958866f888ec4a9c1984db584c0cb4d84aba0483d695ae1003caa7d1dbc52d13c9e8f2825aee78a1572239bda2991610903b29482e08ae405ce622dcbb4602ef4990db938a68893f40b81402facb8f96cbfce05bb18cdfda9c8ef4cf6a20b4555d240501b8eddbf8468620f95b6873a6a7067ebee9a353f2c6b286599affbcb64c69a3be21bba8339927b9706047c9f221439f479cdf2765a84d54538d979a514b007dd7715c81f27fc0d5ef8f823a7f7c44035bab5d9a83b5d45ec667564d1e458e7f86cdecd1e0a5181d7e81fec6073a0e2cc5a575a050253b208c2b75367a7d2ad1815a9e262e491454e344c514e956afb9b67a76382ab5e97ce985733f8f75ad825e5047922ce47f747985dd0c3eb3129f0a59a0902fcae5475c3ec78899efbf6525316b4d7d94c5b74e8c94d60133c8b5e2c27f2f5111b068492465975bcf65314fdb310941c013f4074c28e7f889f2be0d24e74e050329ecaf77dcacfbb8b962d8a924b7e14e21def7035b6c867abb913529b24bea323bd8f3d581de03f776b34e712b676f2e086dc759957ec6a3c081427d59d2b8cf4b81a887cbeb4a135b45681a8623ba212d4e544fa0fa641b448855facfaafd78347555e885890efb4927f278dc584c8e2c742d688893cf8265af5918b82d91314595ca8f8937bcee1631bf616bbc8794201c386fdf5fff895d2444390c0bd68c6f4c986b6aa71fa7cef82372c7542c2627bffdcb46639f0a0e4b558bbf60020103bfa56cc4fe8a2c33f1d6699cff057ae19aaf8781148f3db36bf47ea0a3e025e195744e4499c60fef83171f2cbe117bfbce43adb9e7925a22dd1aff9019b444ad08d7eea2460010e980b92d987a3b179a212341d202bd3ea641bf0e8137f07d948090e1242d34ee9aa8710bbfa3508fb80a8415ec2ebf2558394110efccfb87329b16c393f0e1fba2dedbfb33bc274af3957504c7d318630ad9343c391062b84d95c5869d233afc8391d253ee3f1f399c3a02c8ec5903cc2f96343b75a0ef2d9c41d63f35575d679fd1d926572a09c7b4fe6d1acdafe02166db729d49ca3e1e3f21925774c290c82264219405546c4b5851724bf6edb50a157036c8473b4d76b03db8598ba6588642ef038bf8fb8bd126ee333ef870c3f4b35d8aca3f455c69d5830181e09d81f1760ac2ae0b1f07bf635cd601597f3a9d893496a0aff5e4f350c13c968b3fee1b4d1947edbf7ed17f6bcfe3909557b53c543d0fa3ad1d308c1d191ff135e9572272bfb0ae460919b4d5345ff403a70aa780291cba65c0a1b7eece631673f4c7b5bafb4054f185e417dd392a090b2467667f77d55d0ce0ae5807b694983bcdab31c0940b34b69296acee0ded5791c64846658decde5ab79501f2ffd71cc0803906f54f06627bb0e82cf1c5dbcd833d3dba2dd4e7bf0b396a8b313c6f82fcbb8b9297e02df1efd7a0d0b157a1ac2564900bf901c471c24ed5e7ec35f77d0af9b7ea4b62f6fe4da560440f626b153a5e04f32d00dcd947b161539da3e334ba4d7c558682f5127551dbecc8b21989d6332cbbc502023b28aed71741f920d941056c079f1a2640a9cb41b5caeb80eec62f658cabe0b1ca9df5c420061c06b7db71ce7a0321c177b474b45b3b704cc739e4000b6c5c9f070424b913e3a57346fc8df7810bc7665a5a725fca913ef5f263676873bd24fb96b480cfb3cff7c22a7ad362e64065c2db770925b95cb63b4f3b08df04c80a9847bcc2f95c5fcbe14d04f985661f0f93c1294de49cb0794f3b709057c64aa9a49dc0ec4d1727e0f9ba6bc887c42f68d58ac97ca0b49491f38d84953dc9774654e2efe2c6a0fab80ed7cc08ac81d4349acfafe63f857e6c14b95d692aa97547a1e3198611f36bf0832e10f3fc15819b4cedce3ce4722d298f1a7ceef230c97cd40fd38463cf488549302b7fd629d5727da1e73d407d9697d506266cdc06bb0a4520987552827b5043ae734c0d30d2e3c36dce5cb9ddc7fd4b3f1ea38ed645ca4e1f5ba0e1c669de2eb5638bec639c6339fb045b3403079929057a090e0cf0e8f68f659bfa5f40f7e06a19e1dd503be918c007a859601e84c748a481331a3761dd71d041b28728135a4a384830ac9ecd057efd826adb454c06fc644b33e10e2ae71465fa3539a83c0c04bb385a78ab649b770b96478c57b4c3d6916a688aa6c5080627aeb6bf7dbadb36f6a86ac9c79cc93d980b66238e20ca1f212549ebe336b34fc4fe34fa3f49baa2dcf8dd2e10366730e07f2c01b0858252e0398dc37804ab5a065c5dc5d51f2ddc774c726f2f80a11afe25f77920bdd0510c200426fc36e13af1b02accc1c02929e14a121e56d2647ed694b61e8e824d5c1d6e29a4d0beb7e630961c7b03dac6af01ce437c8ca99fcc4a49fe6a6c5638e496f8218d1515f9e488c491a8ba9de2b8cedb08144d3741802f455e73ff103db44fcc8a2adaa59e23099fe60eeb095fffe5a7cba895700e029aa3cd643fa4a14e0273f21bf8722f359789b37763148ecd9506e4b3a7ebdebcdd9e881a4d4d9c9d3e79595241d69d75bbd2d36519f32715ec19d91ce6209cb55ffc6088c8d4470dcd70a3bcc84737536f1beef6571592b7e8329a1a02e2f3f2c9e8a50b2bfa7066be3c238e3e11c53afc8647be83dc33ae753004792195f1deb123dca91e709a396efe9199d4ef257b14de184dcf6ed860e110b2dd24c91c2e68b62febedb2b223b9ffe691677a59ba3bf6ab193f25ada5503d6cc6a9cb4217158e10606b1a3947f1b3b75bfaad087412a8eb50f32659785b7ecfe6574b587c0c942aa01bb62a6bfe3ee953c8134791b8ecc4348cfaf4c5e95810174a0fc49126e5cdcbdba2f2e6d5f51a9d250be77ececdd9996b72e3f81d505d37cd959f5b0001298af05c2299d1fde29f42275f90e50f5cdc963892904fee1f4a55d929c739487f1a4d0d4ec14976e7d8ab6061c417fb5bef5fbfc739cbcc4f4f91b1d3c3e495f292f3d768391a1bdbfe4eaf626454a5e7175a0aef4040a819293d9f6000000000000090f15212a31"
+                }
+            
+        },
+        {
+            "tgId": 9,
+            "tests": 
+                {
+                    "tcId": 131,
+                    "signature": "221bfc932ab7757d5250a28f21b4243dca46a6b43bbfdbac82412109ef9f076fdfbf66d9addc24e0ca3c6502e935c48aec1c1fdac7dcaea6c1adeb2ae4a64a7c63d7cec160b0979e6f1915b3d8f5f2c0c28daef75490fe2bd75c34dd07a1374ade7cc4f99b7a7d82228fbd5b211bcfef7889482443d92ccf1bc3f645d5afe9f137b04548ffbbc73e96dc06c156ea25dcff78a9137fb5269f631d2e115b85387a55573cff51e07b6ac706e44ef0f50c22225420fe85f13284d2a5f70ff5b98287bae99b5fffaad27f994f5a235dfcedc46941e3f20cee16646b600e12d64c734c281c5ac0d536e77d33750bc629db40f3423bef3cecae9097361de1ff436707c402a94fa17f9183d187adaea0a2b756d509fde6ae3b92086d9199bed2fd49956b89939bac697587746ad01cbb5487986a4a7fd38ca3959b2645506898a7d5ae1e8b8d9b09605fe35942ec75e6f1b5c47a2596fbb6f08ad016175a5fce84974ee337c18d4612058ebd782bb961007b86c899bcdfe5f072f982f459544652a7b9ee20241cf117b2cf88d3fbaeead270323ea0ed8a92073fc8f403e47efbd4dd48ba5a268752cb07fd121ec474d2ddde289860b3f127b1e9a80f84114eca848d39db94c27233836a1445e59490cc1e54da525f66678f8b6f4e4028723ef2e732e716e4b3f87b9017dbc880fcd3f3f4dad9e1177b1a5c8f7a4b3ce79c6b402b922b774ae20e7a0975f188e86ac7a61c4cf3afc2c26c6f01322c09f3a6889fb3cb40a0e9155f6c0bf2441c1bdf8433029fe584f0055f17943cb5f214a4c3f286ed4dc39dee00562c17989a55a5bf949bb72cb8a1aac3fdad2adc47cde5d1d271972a6c3a7ef966d3a3b8f2698b9f5856e1d575589905ae5656392489b23de395590ea224fa00ac1aab95786fbddbb9702ac1a59efcf6c0f8b989a5f799a9a3e403408f5c6b36a45d82dc223946cf14fc0487b61822e7ed8e4524650296590a059ac747925a6f59eec785d38666beb9788f6c91ac7e6179742a9ceb93e589ddd4eebc519223495f112eadc9a06373d7bc8b81f9e3c950d07092339578429c967a713fef9405eddf7c53744f1f4fad389a92c8ff05ced28931b54fc943a07be96d0ed72fcfc8bce25bad1bef5c4fc94afe16ef75734e76d2d452541cebf37de9f20a5c7786e7d9100c90f505a5b180fea3a616ec2b214a9d82a4c92b574a7fc81e18a1c743760b7be4bf8461af5fa8022231b017032e3f1820c6fe6e5bab3688e636949211f4f6acb0cb31bde616ecbce57916dd180b9423917689287e3a069cdfdda8a902f9e48027c8052e72e3f848e42de2df785be3f585b3aff0d96e20a1d873196816d66dd06d59756a08005853a3af9b8b1faa9d00acaaf59392a81ba9de613a1a7a0acdce506a17bc97f08a20cc683046189d81fda1cc1ca6d9f32868fa8d3ba137bac9e551b0431ec820afccfa80f37b4f1ad5158783dc01bef7a6856170ea9c126b39ee71957b43f58225a1ed480f6a54feb4e90dd0218681a52e23f88f9125ff2721b4b1421cf42af47cc6da1c99eb70e13bcabc76c53052d95f5f5c5565ccfef3972dc94d56ce5032ed397a57a1ca3efcf59d5292d1a24c9f62f6b38515946015d0722d9207824cce0043fecdf6c473020ee5a20b8a9bf5e3e4ca36c9c7c285de211252817de7776e6edbe0c6d09f53ac7b37140b05ebbed84506cb823b1afdd30becb33de4047d5e6e08102640033da8695a91079aa399e29ba5fc3ca3671733e3a8fc068d9f7015de783e1cd4fce64f872ea44818693464611a0f1a5723ebcfa0e42dabd17db01642815e1be562b403c17ba57d6e4094a5f5ce49825aa5a13dd1a8e6ec7ab6a4537d4ac6de8b39ea4a9ba882d4bb875f67a1132b57f4fb4016c9f1f3068c8125f1bf57844540be2dc605eb87e51524083b1f61c65014091c717f8dcf459485e358ecc92c6d10e7af6a14606c4ddd6eea023cbbaa96f786a7524014710c207b25ace585ae321e083f9b31f99a5dcad0429bca29e09568d2503abedcd20ec18d3796bfa9793a2d60c18171676fbaa839385e50abbbdc6e7bd5c3107947ae2660f474e2d8885276658e8fba17a95b4da906ccba334475903b242b448ec12699149d5b562a342e404b609b3468a034870e5abd0c13ca72162ce3b32f4571d1b5843ac5d9d8bfe8b1d12ba980a758a31d53302b963f4328ae872dabd8fa298d8ce2727db68839597c6eb3b7a72c9ef530b06758203c98af1d9e1dd5024ecfe96b5349c077705c2591a4be536c59c2eccddf41908fd703fe03a5a798eca323300429e7947bd824f09cecdd2498ead8fe535aa15a444ae91d09bd0401052a7f737c396a9bd504f95c17a356ebe71f0e45c7154b3c73f04a728e32fbcb9109eb402d2d302a17ce08ce8f968bce054f86a544b336bb9a2365573abd5b1db8e487a63f37f3d7491c01301d323114a974f48c7dbafce95bbffe6a8bf8c3f9779612fb3ae448dcca3550aa61217137a93d3421baee7bc67575a78dc3f83cd17980835e2298c656040d3ab6a0ded4ec67649b13f2e8469cfdabe97e61d0b1978470d2b248d18eadc8c0ca6a753240922faf0a7ac67411ab0031d1bc76d30ef2a42094113afd6dea6f339ab1ae76257f6d752cbac365f3ed80433fe1cbd1ded94fd1262e677019020cb4b5d147236168cd37e74e5f54d6ac29739e1d7b77f6716e1adfdeabd28c07bd61aaa90b167aac5fdb8e6f93a7b6e0b6268f9049dc717abc96b95b94f6b4739d4847fcf45e34e5cd5eff65188f61dcc9982118960f5c70973fb3bce7bca575f3e5b55e45acd51754518ffd8863fadbd7ab3e866cc8255c3a7626a8f0865dd2196c945323248c1fe40ec8e3828f5eb916603048371bcf0332bb19b6698a319887ec25cecb81bd361097006caefa50bd446c4986ba38462d08a081e0a4ad201841a21648d6e23164a0ff6e507553e44515358430e1d12938fd47d703162baad013da856889ea2eed1cc3f96dd0d6ac68de0b72f996f91185883639e05ef97f3c138de901b117e0e557d828b09ccff7a7629e3f78d794c2df96bf8e802349e3f94dcff1046e4a7b0734a94645d6aa6d785f3d6afc3479daf5200085a3bcf723493023c0afcadaa1335e9f920d22b3370f79eb34409b0ff0a9cd38daef13aa38b770ef315d53652c4097d5af767bc4b197a35734ee9b3e919a1a5278fcc161c3e60ac50735da6c381724ae93a9c380ea74ecfc098fa1b21142b87811a5ce6e56944e294fc58309e3a6d33b3767acc20071043871224416e0592d1c1ddbc191ae8a84922894a2e4fe1d898f5ebdc521b2710ba9a150ec1c04981015d8c02fbe50c7f1e447edc398d0b76d0a6d74460671f9e757371f31b7d97021d09e175d14590cf49eb517bce05b9029ee1a4b58163d44c539aa922f0878a4b3926f855a69f322f6ea3f0798f5603dd6086efdc192c28d4e04662d43551e95d0fb072dc62bed0062ca932aa6c3cc290582f21bd30e5fc0ca7dcac1108ff2fc6bdbe480d0522943b9169c2e544e00dc992013c875a86491ae137856bd610a2d99e54ef11ff3d5bdc7300c221fab720bf5e61cb818afe15760ae948ab212124b250ed192ebfeb1c93909f0401d0f8c18cb5fcae3113545b79fa237738952c1fc957be7ecb52c90a8dc1853e52270f67b3066cc422817f5a5b9434cc7e800f3d6b63dd4f25a751556da361748daaffe2696b7d740b4df2b38c7aa2e592cf6578b1852f1b50c3bc48ea67a6bee9ecd99af063ad3681e4fd8d94f54b5dfa0aaef8cb3200885dffe813ec7d7d404a55c978d614e9bd8c57ad45f75b6ec91959151269c412e83dcac18516e07f915c27e7d4cdab87c4c9136be6327ba69a4d18f57614653490bf3710ac6c632ae16b76893816b74ff8d552aa54d286c4126165886492fbb0a6de56aa40829648d5e895eb5900db9144b520f74462a5bb329ec035f13f02d5dc24fe634648e8ec6d0da6371547715c0c5d82b8c2a59af8e3dc797c46dad2070175696f8e615499b4f891b4b40538b10e2c36d67d0b2b03e24814da2899b9e2de75e8f21989d443d260304701d9efd8a0aaeeddde0a95a4db0bb228fda67cfd8bd8dcabd1b0c76cb71c0f6e87dc9c748e2b6271fa3bd8568f80789de08aa190af5446ac7f86bf9203b89611fc82d3f958c16ff517c4a3fbffe8a5963685e46562d8f6c4fa38f43bfb60d3c3febca0975e0c48890b89c74ae6b298243b62808a9d6b85026d014174d8788a4b0eaaa0520b8432096c7f1d1798641dd0c4b513edf03122410453a9f9070c88c97b1f59492ccdec693079a4362cc9558af2ae2096a7153ca6cf66a8c82b24be66acce80b02c3836f9237cdbaccb9cb7d3bd4832677629d1c5a8a8979581ac5728872d9070d22227749194ac631b754fa4f583d7dc1cb92b77f115f826070b446d7cdfe2a89c1891082938b0ddafc6c3ded1d8e31d324a463b6713e110d5d98941ef3bfdfd128f1ffa0cae2bc82002ce54451abc15dac0faf00efb4d4a747048cc071191e841bfdeb638ea541fc3bcda06f97d6eb9021791a4ec1a0cdc08805f0fc68aa0603f77add4af4ccd31fb2ccfe228b822c1b9ab61040a6502dfe12e5f14901758dfd5cf60cc7607498497f6b75440a866cdb098b560cf3f2a1f13309823a1248c8cc633ce247dc433d5f84d9e710c2d092f20cf487831a7d3781d5c8d2feae936587b0acb1dd30126cf63576596490d2535238144ae777cef2146211be800b6918bd120bbc2ee3d8a9bdc12cec19bdac3d214f0810f651d303322bd54f5cc09d48f8d2da59f20e39397afa91491fbea10b80dea89495879e378b826cc430a9d02c17b4196345b18ad0b40e893a2e323c78f8629291dcbf93edde6f7b4cc73d1739d856932c25319903367abc40be37bb01e3068794254387c6c0f11b51ce511514029eca3a3a41d67c79c692fe23d458edf726d6ff49739d0e16433ff2a6a81bc882514537aa994772f1939c479ce0b764a3902b322914d9545e34cd952236b204670e5606dbbbbfdc177e8a98d41824ea5f1a9255989ad1e115a3fcd8c7ebb908e7e2f06c3bc856286382af820cbdeb4842beac01d96e95429d777fc75ee040efe94af59f4c9f1447b65da4d9b82e769aabe4289a14874b8fd31cdcf00b718eb25c2f5da14ce9223ad753533d05b46e105e078426f9e1a61e80ad7a7b50287c866c428711d1cce67ac1c07c0ce349f064342d857d837cf01eec7938e699b4d103220f3be441f46f48f260f0a23b0c928b8306b02b8100a23557cae8248a2c66018adf56e478a073ed897334c95b31056a4e73330dbff06b6b65b06e6d0fe6afe70d61863ea922a7e0623fd91c3b95a777ca886b69348afdda7a230d0c764bb7ab46b945792e252f2650e688b038af34f886d76bf8517235e093079094aa47d7ec8e234ff03fe09f083d37a3e50647fe0d9fc88c51c37d3b6a1fe3ee2d85d32a91026b562c71c684641964adb17746591a9f030e8f714940060ecb4e4aa524dcd0cfab1bb1aeedaf9c6679a7f6a4a860ef5e9a92af450c821c652b1ef108d4eebf978bdceb85d27d9449300acea43253c19cd4d9da4b46d35fe98abf75b45b4d8066fdef405164721d6ae21b549715a901ba378314b95151fa2c2215181e0d5be428e3e30144312d131c96008f69f5924cd90a8b69f6f14efff96bcbc3f5862a84cd0444b4f63232dcd9207c7d6c537ad0efa922cf29339b7bbf89b480b891e8d572d794b2b835ded073aaa88cfb4f06a3c9f84be312151308c5ef289ac72c4931af4e623ae3c4d0345f81f4b1e8f9ca2f8d70efbc70e2425c69f457f044eab52fd8254b0c14ed58db6696e3e6c0af0db4d2a6589badf4f81a55a97c4e56a30666639f7a653666623d14719ec63007e8751c9e067884aad2d1d4dc941185a211c0daab237540d4f7847ea61e1b711703438a91d8b78d0c494198be20060515ef377e1f66c7c14491a84c9a4514e9aa0915abd7cb40e6c4dafe05e402d366c27a393a8a84eb8f93ab4312b3ab78a0e0fe7bef91bf146eaddd6f876ff870e54cc4836af5a3ab149344ae342e5a164461f29e1e5e32390a7345c4f74f6a5ae4401e5a8abda2f10a04cf65a24a85560815646f7d36ec5dd0a5fed48534f19e87f99d9279831e80c507641cacdff909a4d1fbff6f21589baa1a2381384df684b3d13910d58c5ee6a6bb6449b1e0163643f539b5366cbe47f6e3145a1eedff811f139e83c29ff1621dc1c4c175624e3f7330263638f8adb7817525db2fb1094bf9299c593d1ab784cab679841621e8a62e80d5abbb8d455e47767f714873724f460a262181dc6e41999825111cd183033a33d8a0d7cd59acc8717644d0f93f3a475a14208cd7b618bc6f7730ce21112b217dbdd1f0f211416d8098d7fc0a6a6c751c28335c96ae001172d9f66cd2daef0b4760b10d7593abacc4f90000000000000000000000000000000000000000000000000000000000000000060d11171c20242b"
+                }
+            
+        }
+    ,
+    "vsId": 3990091
+}

boringssl-0.20260813.tar.xz/util/fipstools/acvp/acvptool/test/expected/ML-KEM-seed.bz2 Added

@@ -0,0 +1,50 @@
+{
+    "time": "2026-08-03T16:12:18-04:00",
+    "url": "acvp/v1/testSessions/757448",
+    "vectorSetUrls": 
+        "/acvp/v1/testSessions/757448/vectorSets/3990095"
+    
+},{
+    "algorithm": "ML-KEM",
+    "testGroups": 
+        {
+            "tgId": 1,
+            "tests": 
+                {
+                    "tcId": 11,
+                    "c": "489ece1e4fecc89e76914bc96982a47339bd699b9df0f8936053cee0f7d0669bd54d296ef5df4d2f814e74f510b80422b507013a283ecb4d8b9e483315fa67d9fc5dbdfbc81e6f093f924446d7636790cf4c0eddfdc1571c56c2d8d2fd542797f62b62b96f649b64ecc395d04df05de521d8da8d617c4f0f72176f8d9b2393acbb482fc2f94266125b5f66129faff15e6119bc5f111f4a748127719e5c7a222017053e380d29f98f06f4d62e10c9cb4276100f104ec61764b75473796311584a88df14640b90e09cfd1ad362d493cd97838d3571d67a4167c213cbac9bc5a98d2f3be7c929de4f5c5495e378ae3db831848759ce4a417bf72a142d915d98115484f39e1d791a18960135776aea43b48785dd2f9441661eab14a9574915c87aa7b291755606dd1592dee89347f7996dadf369c58dde08359f36edd83753958bf22f72534688b84930a8d011cf63b44711adf6a5e62b198cf082fdfb2972c15c5b488229950fd557b273383cd7bc28e57444a0930afca09f0e974200692db8e87e0b80d64b81fb84e4d80858aaf11868f9c0e26941ea30cf8badf35d5abef78bbd5e13055cf32720e296a1172b2c3f50a66389a8dd014c9e1256816ebc0243a3d21e7c8360c6c9fedbd5ba63b2a914a482613549809050187a38317adf2ad3d4c9f6d24297951360c3e4e30f9baf3b2c366aaaeeee4182b8dcdd0528bd42f74417ff2bc2c6deb02d89d0f281699bd3dd8e492fc214f875125edb435b95939226b095d9889f504924784446fbbbfe923a1c0e40a480c9d79e8b583a98ad3d06d1e81b69194b8dc7927c9a5135e1eff1aed78fbf137e97220bf004ab3b4365e1eb3dc3fe5572ff018c34b230caa9fe72d5bbe954b14f10dbc54746eff724e6e1a6c41bdf0a304d27d2a60fd5c4da7c351a6664363e405b4b250bda8ce91a0276be5e8551138a2fe31392ccddfc438356298fd7b129c60478cefdf9ac19e7ea98f70b78eafee78dda865bcf450773e19a5bc24cccad0e65eed0b565f88807bb7dbef8427faf39b4f50de089cba34bf454c7eca17ee0e5c69854be44884d246914dbe6965aecef625920b39ce39825120c459ae90b0e912b3acc0b338d9c03023569a17a3c02d98490b87eb3dcca62a3b3ca1c38f0f0ba89e062dfab4cae5fa6a7bc6690ef8f3f1a2c462c6b2e2cfafd3832c6241dbde479c0765b24f658b90488b9011ece62e4ba593332f83e22aa198dfa5591c06c876cc87527aab8d9b0685cf8ab847f5ca2560940af69249a4843e6740cdb52b7cdf6b18777ac5115af02a48e5c0bdc2239054a089379ccf8a781623abf3c453ca4fd7efe7fb4bfa6383f9a8cd3a62a4b39059871f68dfbc8d96eac4baef8e8801cdac44d8679e796abc693d5809baaeb9b96228303882b700f5ea9f74d27347ca2a00859d7609e832cfc5cc772edd91dd8f18b77ab717470f45399d8538fe95033e93435e524b2a73857c42da5c575f4ee202da44f25c89a6e41429db7e2b6f1c2aa8bae84645ba17de4f6a824",
+                    "k": "15eb320e2cfa86bb3eda4c74769c81a8bf6266bd3cff36d3306d5b74d8dfee81"
+                }
+            
+        },
+        {
+            "tgId": 2,
+            "tests": 
+                {
+                    "tcId": 36,
+                    "c": "cc2089740d3e280a4e06c2e31385a2f8fd733a0faf30e3fdd4a967ce8f61ca47b3a5fc1256c99dd69879c8b3a1cf9e6fceef55efef02ddbb7182f226b85cbec87f61e7179be9acac45cd3aac4152d8339c1d19e0466c15b4956263482eb600dd4c3cf547f978323282415a53fcfee59a74dd6426760e7de0f9f293e74f504832fe8c73b73c0640d0d5e69195e22cc83be6c58c24f27e2ff97c0b7450b7cd837eb115f8d7813ce7f294318df6dca22191b0d41487a0a1aa512eb949573fd88ebea313e6f4afa58084ead0a4c51eca24f908d3bffdfe34f4b0ff4839b9372e9e1692a790a387f2b211f72806ea9102315c23a17d60d37a3cd73bca2dee1e0f5185b0859b1d4958870211d1c346339989f89afd218ab8468d0669570a118c00d52ee8793a878e3e16c2c1cef9f7b3ff9d5fde485a114f6ba1d8225a24e0c8287e92e8935c1391775579c63a0988b6f28949eb568ece6636d63d496e43f31af6f23a22027352619cd573a082e33a5a3929ca91fa724871eaf2712c491e68968efda870aebfe0ab8fffc07a6562b2463623c48028bc36f021ca7563be4a54b3feaec2c3d069f076d5a487d6961c99df45e63226814c075be388db78291652b1b3f0ead6b90b009ebb832199ee9ec1ffb398eda5469507af4fd575cc261964539c59d6c98fb489f719dc9a492374e09a9be011e42d2f8e1964abbb3e874b71eba8cb9bd94183f5f25f62f2ff21ef03541fe239329b234e29f9a9423a9be433476dcaed46530ce53b374a55b9de9e1150b7dea0f038ab3b9f67aac7cf9d08ef4c97987bb2824a879224468664d1d9fb10e7d36b77de64c2ca89c873e1ee39b2d26602255ce477f88361b9395fc14257ba69c3fdfdfcb7246ae818a1cc158ea59db0bf26696af425f3f76b989fc54329a18912411cc603aaf412ca8e1f6ca4eaa934a3155ad4619c87a461fd01d393a5c49112ea6f20485a76dc009eedb1d5b4e99eae7d44afee12a92efe9fa34baac4a62c33f0ad3f46dce8ca5eae08bafb84261f55d09e0970dfc3f61eb2f3e6f2787ac86d0a744b24d183ac70de480a2628634cd0ca8c00f5977e5609ddad78a51258d0b7f8283f54c81e197fc14cf2bde711e97d42fe46615b9b50d2459c658134b7b1c2c97db0c49f88e80c7d1c5f53fe1bf1a245aa63b94affe1edfbb9f4f563d8bca594f33deb39057218eadd20e8f6a29365f06f171e7b898556edbe9abc71226b4a40fe13c2f3c929d0eef145f5741e6c3b829ceeed8bd09e02790c407d0a6a21ead5e9ca704f1584258a588e977ba344e2f335312ac7875563e286d8d4f09ac3ecca4326594ad13027baa904dd7bb175a2418f35e884d46234b36757b78df087b318ff0b917399df6289926328ab8c74e717c41168a42300a4f5d8a4117d77a1ffaf018283c796cf62ad1aa900afd59f4eae7b7ea7acd30ceb9279adbefd189f3708b5303b734613cdc6a9a5d2bb4490a8f8342e25c7997c00ceeb3fd287df9da8cf37765ea84338f420a5c062f020e449484a73e28386e64d4b6bf6ce7183a23011d9cc9b3b096dfdce543f9eb8364c94a6f80c3b0743cdb04a171e73c4a8313b85c81b338254debc9ba3af421710d9d6832c4e4a03c37b8b6f5547a5aba157f68c32bdee1d254ca68141ea9f321cb80f13188e497655e57f114b1c24043607ced1ed228cd7bc53496fa84b672e6538136ce0795a6f57e488f3b3632d290ff3d98001aa5108ae09d49630040ae3eae9732dec61f34df1fd017a0c749f30a695787ea8e7772f7dd8304b99816f108da92ad8873e0fce09a23ac41cf4784c33bc760e1a1a242e9d89f157dd15dbc7e9883383f940f96c28c1d9e458b894d3c0bad3b880e8ea1e809d3489f8ca27dcbaf5332345fd860abb7d9b1aa5e2a4a2407042916c1c0739c81190fadfe157736ee61afa82ff1340e953b4c50e57cd762f509f892880d91aa86fffe5820c7bfd99e40f3525c006e1c5cafb28301fb98b38c7dadd5ed391095fed2aad2aba087da57b0c744c487c1bb93163d5c987eab92063614587ce68c52182c000d15c92da40f1f67a089baf07285acc412032734eb31a21195a03888ead551bbc07b8c5dbf03ad4e1eb314711ab875f14824a89fe3ebf2067273e011507609d102dfd255de0220e7f9c9a9459b8ebda30f00adbdea1d38e050f4118b4e3534abcbb766850bfe2e41d",
+                    "k": "83a00594e1f3744d332dfc9ecc16a76c7525379949f477126e605719e4761622"
+                }
+            
+        },
+        {
+            "tgId": 3,
+            "tests": 
+                {
+                    "tcId": 60,
+                    "k": "65e479f296f947a11bade4bff811b1f4a493a8c4f3cb40eabaf1f6da7eaf142e"
+                }
+            
+        },
+        {
+            "tgId": 4,
+            "tests": 
+                {
+                    "tcId": 70,
+                    "k": "f0501a74c84379bef3f7292726e9844422af3715a595d302e0696ba178c3a3d4"
+                }
+            
+        }
+    ,
+    "vsId": 3990095
+}

boringssl-0.20260708.tar.xz/util/fipstools/acvp/acvptool/test/tests.json -> boringssl-0.20260813.tar.xz/util/fipstools/acvp/acvptool/test/tests.json Changed

boringssl-0.20260813.tar.xz/util/fipstools/acvp/acvptool/test/vectors/ML-DSA-seed.bz2 Added

@@ -0,0 +1,117 @@
+
+  {
+    "time": "2026-08-03T16:10:48-04:00",
+    "url": "acvp/v1/testSessions/757446",
+    "vectorSetUrls": 
+      "/acvp/v1/testSessions/757446/vectorSets/3990091"
+    
+  },
+  {
+    "algorithm": "ML-DSA",
+    "isSample": true,
+    "mode": "sigGen",
+    "revision": "FIPS204-tr1",
+    "testGroups": 
+      {
+        "deterministic": true,
+        "externalMu": true,
+        "keyFormat": "seed",
+        "parameterSet": "ML-DSA-44",
+        "signatureInterface": "internal",
+        "testType": "AFT",
+        "tests": 
+          {
+            "mu": "3ECE8585DA8856863CCF5D9B8F5CF0B621CCBE34CE9738A6A6C92F8740A3A115C5A36009FDB2790E06E1C5CC0A3B726121831F8E55C0DA9ED8823754965D6801",
+            "seed": "62E91831788061B9AF10599010BF1C9A54C1951E79ED1FE48CA431737398EB75",
+            "tcId": 11
+          }
+        ,
+        "tgId": 1
+      },
+      {
+        "deterministic": true,
+        "externalMu": true,
+        "keyFormat": "seed",
+        "parameterSet": "ML-DSA-65",
+        "signatureInterface": "internal",
+        "testType": "AFT",
+        "tests": 
+          {
+            "mu": "2B5888B7B1493F4CE7F1280526B1873E8EE6254A2B25152DCD351E2D471D138D2D7B8EC6FFBCC5654D52CFCA21372751132E8CF9C5FB4DB91E877376AF8C9FB7",
+            "seed": "1DD8E8D7031D0279D691BAE1DD1D6623A31BF2CA62BCCB107EFA5D4467D26479",
+            "tcId": 26
+          }
+        ,
+        "tgId": 2
+      },
+      {
+        "deterministic": true,
+        "externalMu": true,
+        "keyFormat": "seed",
+        "parameterSet": "ML-DSA-87",
+        "signatureInterface": "internal",
+        "testType": "AFT",
+        "tests": 
+          {
+            "mu": "711F327323E4731B4DD95BB9E544DC1E77666172B4A2CD0C3DC066357D43D402F6E2981D7F615236267AE86A158C3DA11E99A099A49A11093DB2D4751A999536",
+            "seed": "C33AF4A670DF0342E68CF46994550A5666E3BAC7538FC246E7BFB1508EE04E5B",
+            "tcId": 41
+          }
+        ,
+        "tgId": 3
+      },
+      {
+        "deterministic": false,
+        "externalMu": true,
+        "keyFormat": "seed",
+        "parameterSet": "ML-DSA-44",
+        "signatureInterface": "internal",
+        "testType": "AFT",
+        "tests": 
+          {
+            "mu": "7EC19E1390056DA205208D4C9175EE7D07544C2F9C13A1DFEF7441CB6455756E24BE68CF728FC1084501B80F688871FF4CABA028099A7DE79010A2510DB2A4BE",
+            "rnd": "41DCE33B5EC24F54E1D82DF3E0F4886DBB1565A56D8899FDBD81464BB39A75BE",
+            "seed": "3C9964EEA0EAEF9637485C59164EE63BA50A5BB4B4D9CEF3E22BD6EE795F4387",
+            "tcId": 101
+          }
+        ,
+        "tgId": 7
+      },
+      {
+        "deterministic": false,
+        "externalMu": true,
+        "keyFormat": "seed",
+        "parameterSet": "ML-DSA-65",
+        "signatureInterface": "internal",
+        "testType": "AFT",
+        "tests": 
+          {
+            "mu": "A4EF85F50B7534897195CBE86B8149F8C233DC82B94E96F03DF493F278296D894193378C6F4C69C06A3C4D65833A9D084F062479CB7562DC7BF44274359EC5BF",
+            "rnd": "6A47E81EBEEFB8D8BD5928B643768A35E3E782FFCF93FDA8745D8DFA0B4234CE",
+            "seed": "544BD75534878B829F84F18F02B96B80EE1D9618DF4AD7C0EABEF94803D231B9",
+            "tcId": 116
+          }
+        ,
+        "tgId": 8
+      },
+      {
+        "deterministic": false,
+        "externalMu": true,
+        "keyFormat": "seed",
+        "parameterSet": "ML-DSA-87",
+        "signatureInterface": "internal",
+        "testType": "AFT",
+        "tests": 
+          {
+            "mu": "E5DA3DFAB377004B0B609DA6D85AC1802FF9DA23FEDC867B542F818E57B90D19CBB12EF5688838DA60664D3B9C20F0730B93E414F7EDDF14CFA582EC5261B258",
+            "rnd": "3D5A7C098E0BAEAC7B25D8D333E7593FFF3D6770B521CCC0F27D3B2B07DD212D",
+            "seed": "501E93FBFBA2DA0D699F7B71E423C9B43088F1EB495ED70A8AE5940673DD67AC",
+            "tcId": 131
+          }
+        ,
+        "tgId": 9
+      }
+    ,
+    "vsId": 3990091
+  }
+
\ No newline at end of file

boringssl-0.20260813.tar.xz/util/fipstools/acvp/acvptool/test/vectors/ML-KEM-seed.bz2 Added

@@ -0,0 +1,74 @@
+
+  {
+    "time": "2026-08-03T16:12:18-04:00",
+    "url": "acvp/v1/testSessions/757448",
+    "vectorSetUrls": 
+      "/acvp/v1/testSessions/757448/vectorSets/3990095"
+    
+  },
+  {
+    "algorithm": "ML-KEM",
+    "isSample": true,
+    "mode": "encapDecap",
+    "revision": "FIPS203-tr1",
+    "testGroups": 
+      {
+        "function": "encapsulation",
+        "parameterSet": "ML-KEM-768",
+        "testType": "AFT",
+        "tests": 
+          {
+            "ek": "61C52C86F65B89868656BAA2143860CC3942ED4612BA646A6912C89D39AB56828BD6F71B4892B49C8C8BB6127197719433B3C9E63B34E670CBF467948A0C503D73A51EF4659CAB2C382CB0C5EA8F55376C79E922CAC7B170E13AB99219CEA7B5015C1EE964149ED5213669C4738438BD04BA07F534BB52A0850278ED9B4F08CB9CEE463BCC6BBB709604A6CA955C8C22C6872F55609E2FCB76C3E617E7B61EEF40CD06C18FA055B2B3E1BB127B24995205DD533B5CFB3312610CC34805FBD42466D40CE2418B58506CD74725C49218898AA456573C8B5214C3F3652C16604589BE30F1274DD10564638F8DDC6B17DAA0AF7450DC7217935A7674C1A53F20226DC6BCEBDC316CD36973A192C8E75760D0159719A35256ADE5E5BFF370035CE7701EA6C861D75024548B7038591A196366E2507261571E797988B50058B24AB18996B84A059BF2C8004D1EB4C25E7D4ABBBAD8864EBAA60948242B380ABA383C0E052CE9DB83559960D5188D4BE729581671F99702B4883A70FA5A468323A6E169C91559AF69193B304E973A1AB8F15E9D8A80080794B3DCA7D3F91ED29A67D512AD09D7C2656346D9446B211764B4D8339C635D27D961B2CA731AC640D7BC73D6A09D7FA40075D97F56C9306FC78E96C3C10ACBB417C77CCD6572DC67CEFCA475848A0DAA2110D3269C4A75437AC03415BB37DB1311CAF44DE22BA37D8A90C95457C7B61ECEDB69A5890C555CC4303A836BEA2A2DA69CF121AB4E47A354A5144CC8A4D335A9EFDA6E31C234763675C50A901AA0A26F5CBC1E1B0D643C430044B93DAA6389921FF891067A83CB4E184E83EBC279C8B180965E3BF677868250E760166868116A60A916C3B5C02A89827574B2A9B17CA554004C2E44313B2B6605EE1C2A83188FFF3663C4523356503498446F7B824FE3065289B1764BEC85F76010F038CF5430CFA04A3ADC30B22A820B967C89D665B33338A1E6F9B9200360389CC663B1A7526BA9A1D321B3E85F50B51593E571792C4E1234BDA702A2264248A17C282BD05CAB2506ADD68F531A177CC64A030140D07844A4D67F52B61A77937AA3AA94CEA3A33BC03194C4785CF67103C0CDA31719189B709669B616B78AC4948DBA6592E3C62395429A3BE50BAE904E0C95236341B59F9CCC382140B8B05B8293721DC7C8EA7C441A464C36502F28812AE013338050A3FAB839CB887C8279C1F5B467808777A59946BD24CED3C8B0847CAEC2022204FBC0DBE1778E082DF9AC3133C5C5661398EEBAB2872470FB890C6DB50764D326286A2556E5527E52422046019A173DD5717E88FA3CFC7CC412997E4BC618EFA59E820B6E5A20BEC1797F987474FFBC62F47196623A8846A72AD3F48B206CC14116253CF0158A6B6FAFD77AD985B71E53B977E86AF947A6CDBB758866C53082A7154B58E0DA74000D7E11E264F0D5874C518AA010808123624F7B70D282A5879BCB9CD701308485B262CC8BA11EE2E47B4B711E01AB6AFB29473919B93C64BCD3363A1265BBBB86CE38796CF5C4756D59964DAC853BB6B24CD28B09D62857D47408518054495F8A2B5F4C93ADC618B0C638A389D3186EF8486DE1A4A0B9BADC63A8B624CC45781EB24BADBF03419C63444E765274DF037E697A64FC719077BF50A48E134748C643860E30",
+            "m": "8FC70BC667C9DF8DB7FF05900E3540E893AB823B58AB3A616B44D5B68FF383BA",
+            "tcId": 11
+          }
+        ,
+        "tgId": 1
+      },
+      {
+        "function": "encapsulation",
+        "parameterSet": "ML-KEM-1024",
+        "testType": "AFT",
+        "tests": 
+          {
+            "ek": "EBD2885C7688641863448B4379263FF3109D3E185733803AA11C6AB2121580A6B151C05A03163E4F8C5D98B41E4DA40C5A75C361550B7DA0427E341D732B50A335B0757605773354E4742B1AB5AA6E3853FAC21B9F30065EB164898A4794583217FC03792C130CBB6EAC7BB9F4EB871A117A9B7C794C9B5F8BD86C87CC0D16BA5BC5AC6EA88C3D7B9059987696B17319F412971263BE9B75CE66B89D47D44E1145584BFCB647E57E717480C281291E0457AC54618948B9408A9439215A5B867CC32CCE6FDB3C86998211B386379A94B9532666107CCB024FC5201B0E2883A21539F713A0B695C575EB5C338831AF2865A36A2E7B4848251206E9642564618842E558875002CE55B4524BB139611E29C92428247880F471445A2242B59DB664159F031BB5A6C1759754EA36913902475D72633B66935170A2AD6A03A23BA6DC7AB9545C4B61311E16C6C44CD2326885292A214412B1C79D03661D92A0A16CB7784A2D95C72D36E19BDD63538102CA99C46BF3A9094D12A976F3957E47B330490BEEA733D6098FBDE98F10B000420C78D305452CD174DD9659CFA1B34458022A8715B8D8A82159CDA6F88220003ECD7965616498B0EC91E4CC762B1068B6E8703F445AC8160625C90FB975CED6EC37D3589E9676A70B2B61327941DCC5AE959904C23B2403FCA0688913ECF53A48700958A233805925E6F38A6C21A19BA60EAC2C97E39495B4796C4AB1B49DE489979718202200B70894B9932EACC07509BB8D51E40D12F38C60CC405702AF5D623EEFD4AFF1F3C08620B0F4E9925F8C6AEBD54708613F9F5C2093C780C4F55DF9A83C7303936800C9D4DB2878C83A375467F6892001AC448B105DCFFA284F92B0D0685632BAAA047C8FA1059DF249CE349B8FC2D559122C1784F63F1B176DB7887A2605C6C4BC1586D7615B3475E6E2C71D1A82F713BD91A3AF10D14D66E8B6388627B358325CAB5672D7CBAE065414867C34F86F536863D5604EB506C2C374216C45A745BC161506462555824A972B12774D0EAC9F7A558B9D3AC45D450B9A505942241D07F3A135044FEC02CD7471671D8A34E9D23D9CD8C16398C15FE8A8805B2930E164EE066237877C2FB0C179DAC1E7939F9296A2A0B651BD88A7E8F53BC5B23077827165968477E59EFA95481F39BA60D169E296A51FAB621098A7B68AA61C70777DF18B6B6358DE5144004CCE04FA25205713AD45B32425A055EA5492280FA4215A58586BEA38328B29B39285B0D0C850769A327BF235FE9311872BABB3105E57248000252F31B9C608DA8B36307BF0835784857D7CCCC090882B4EEC9F554182D779057F1AB58C477F540646AE6A467991123A1952A0B7C4B7F41EE04471748BBC1908048DC068FFAA395048735A3B488228C092652681636172754D28C3627CB60C7C22B2DBEC720B1B8EF5808125B2AE0B818615C6A3E704B8C9E92F499B9BC2E238E6DA5AEAFB401E4A35D90B1F01971AEC1863B91186FB2C4D2D9306E273885898C2D3311BE8784127642DF082661275A733DB43F3781D33C6B9097C79B3411CB2A2A5A734200198605D672E9D692839AA8A901B37F52518DDC97C20B4B90F558E134BB7CDE5956661037C1C9AED91ACA8DC373F095378200973385839E31DAE44A3948CC78AF94E4D6A1B24A202EC0811BCE7851FC45A0D3783AF07CB49777C7D91C9998BA3D133AB3A667D2985092B06AC2F1999FC41963963B890E5A3D1D31CDB9481328697A07B8920E3C5DEE3966D7767283638A26C51EA29953902096CD34CC3829A81EC366FB11C80332E2C8000515CAD88242BE2420D7F280B046919ABE56CE5442783B7C374632D5846A9448C6DAA9B0CDDD95CBD381170DA760540B5354389F3F05EB96C515C722999FC3CC940241F604FEEA548736C36E63308208B2EB4432A890C09135620CA244CCD815522559691573914D7A0A34097BB609574C48A7C09C71FF8485969A019121D225A3C008C075DC751CF34A7EE504B43BA03F56841A0E2360D185DD2E742847A401DC6292780866A05C32CD114D55AB1EAD0C7C3653D78961D5370A1086531A7654EE646060D91C425919450325BF5AA936598643D982A3FC50E371C6D16526B25233022B6BAF447C831C726D10A0DBD0C29A982B81D35C9CCF1B9707C7D6473E7313C1ADB25F17897882D674471D07D81053ADF53DB8ECEEC5B4DD87CDE",
+            "m": "ED2D11CE74584E48C79EE1024A48F847532781C2719988D27EF94E220CDFFC06",
+            "tcId": 36
+          }
+        ,
+        "tgId": 2
+      },
+      {
+        "function": "decapsulation",
+        "keyFormat": "seed",
+        "parameterSet": "ML-KEM-768",
+        "testType": "VAL",
+        "tests": 
+          {
+            "c": "E900B8F29D59E6EA44D0822462BAE875C47847312292962F8495F1F04402D2423FC63F888108B3F6BFDAE7799D8F6A18117BA7F164169CB432397640E7995174C7055D9493485E198FDF6A8610868F4459005ED3BED9508CEEFCC951B90F95FC00D524AFDD2B43D6218D41F11378BC1224BDCB18363DF641000B880296F4F5F6946434AE2E810D613D084CF09A12F03B08323B8160A953142FE245838F99CA75881CB1D9F4D34E674915191F89EBE034153EE12A822E302F7E4BD83BEB115BB666380C6353560C6C6C1E86EC454BE84301671C0CDF1646E95A6D606F3372FE2F09BFB9C12802615734860336BA9147296658BBF13572CBF05D33B041D57FA81B8B4BA3D319E0780A12F4545AE0C1F9227F9AD54B61D9FA13FC3E887EA4914D06B1719D2C36F0BA01413C503051BCAF06AEEBEEEE1228D32B06B0C1FA00565B54EF5535298BEB31D412E1FE3F6C8920D5692ED8D2C4DA1FDE1AF6AEEADBF4D53F1B6D16EB6BEF627F2BD4CE1DD1AFB99F7DADEA896B0DD0080C462B0E417333BA3ADD61474CD25590B06C9DF7081396710D1293F9CC8F2CE8A322E8AD3A5217184F0B8914D71DB4FDB97959A27C2B5E47416D0CDFF23FC2312C4C617F3359176A5842DD071F43F4D9438AE87ED545C7B802B83D681041DDC3E028D35BAF63AA3EC9A2876D4AC5D821397F700BBC8B00EBAB3C437471C8C8D1490F565196264CD49BC8AD15F0D76489C0631CC536F0D1D3D66D14DBAF0C06948DF9DDC3F8CC9A77A30D07A55F01630D788558A68C20039B44555063273BCF6C7931356115DF13260885E472E5EA920E233A3CFB2396D75EE017E8D2E7EB404A714827131FEA40346E56F06B3DE5CFC62ED833DF4CA6AD820911E94A2F6C42BC344089FD00D0623901DA1A19E26971886379FF09EC30D261CF55BB0EA58913833F215059CC84C83352CA3D275BE869F67AFC71A9780F81AC2B830399BA3608BAABC1FAB9846F536194D2F580E47F929CA24EC314CA7F568640CF43F014CFA4BE7D1E47257058B12402696E95D8CB9306A95AFC8DA169FDE4FDEE4B3197E048354C647876C9FE9DA7D1D144DE0E9A72582B478C43F6AE472631C3FF6B2573CA1850B5337493C34A692A6D6B4C47AF4C38A31379328827A1256053C21A694F1A4039275ED4698C98904A7E1EF7FB6C3AAF84AB71795EB98EEB46E265F343C84A25C4958FD94D145F5163ED101F0B172CA6B2A65AD6403795617227C55541DEBF43107EB48D27FAD18DDA4D02B8845E488AB05283ECD36180B0666C4F3CEE4818D1D34111DC8D27E34A49DA3728BD1529778C60FAC4C7C6A5EEEF8B56D3FAE71A5C7A748FE58FE56F9E39D610A31748C380220C007E24068EC1811CA6BCE77DCA821C18666D5C1777C673C0C9241DE9F875187BF5F4F742E2D3DF6724949972E3F0E45BCD230136961B5FBB7E16E243A20D27BA889989BF790C37D8A00B46993E9D516304C66BFDA455CEE344AD62741B10FFE3B9DBB2CD627C9AF0F5BFE0DE8CB3B65BCEF90B2CB842",
+            "d": "623B2024E1B98E5F99F8B718C272787F3AB9C11FCFA4E2A2CC01AD20C0042EBB",
+            "tcId": 60,
+            "z": "7F0D81849B752C3D582581CB1CD699D6D7D60D5F829499E3BFBC990DF6E7851B"
+          }
+        ,
+        "tgId": 3
+      },
+      {
+        "function": "decapsulation",
+        "keyFormat": "seed",
+        "parameterSet": "ML-KEM-1024",
+        "testType": "VAL",
+        "tests": 
+          {
+            "c": "004BC1643EDD1DCF73E842BE7CFFE7B458CB660EA302070BD3536283DDED22070EAC70A92D034B559D494E4288009C37CC5689D2E7D19206084AF7ACBFED35AE3211F0CD7069A6CE0B2E7F88EC34E5BA889420E0961303B77DDD78D9CA8B3A5FE17FD3C125ACADFD50228C1666904A03F42950E973F55F2A0E6E1CA30DECFAA1E552F03827174EB40357C0035D22FC739BE067904360F4523537319D2B852832977C21483C4D8F50CF8CDA0BB7FACDBAA80227F524A4213F23EAA3D2325C4D28F6343A838DCE2086CE52FF8A6DCAA7CBC64B6C1BFF05F9285E97259E77E1B472309875329D0A6EE3C76FF7D6AE23CBBA4D8D91858AC29B40DE970115860ADBFADC2975EA2912AB09D5A094FF2FDD0823A3380B6B3E129418375FD317A4B4CEC9047B80781E0DCC1D95418D77CAE5B3287FA367B1913C1D981E76DA19EE3A7CC61B0456EF0A4223F2AC7B1C0C8465B93529BEABE6F4374390BE5C9A892345B65AFF2343CB21861FE411078A4406B0B42861DD248AB91726B21F8830035D4C2C51E5AEAE60DA5D9A49C93875100C563F298CB0E58D7B86354E7F454033777ECADBCE3FA22FE2D6AC8EBB7704543D404987DFF3A9AB9F01AF3B316D90B8D6B6CA89424B1EDC106A3242A4BFFE742EB6800BF2CFA0753676E5008B7BF7E071DA865B4178CA4CD4D14C44A20FD9ED9E474F8388C01333702735BF6282EB99300FBD3AAC137C5300A54B30B93D2B9A9739544ED82E9B9C208ED9DA4AA4509374E1141D290F4616BD3696D302D72E2FCB9FF5B7492BF8813BCF49AE96D4611A9C8E3B994A387C4C269A1E8CB91B1FC136F51E9FE6235C1D24D8323F7BCACCEEA0484B20EFC9C46BA19C280A703FCA13DBDD8616E636A546EB0AB30F16B746B1FF26239CE6ED01BABD65768309DB2D3E13472DB4AE9229280C72B0E2467AAF623AE165AC9AE9F18E7BB3197E2F6CA32B882806A9347DF0BC8C046B09CD33801072307C5CF477C1D374882DCE58F2B9D2F9A1F1EBA001654C9DBB257C6386D79CE8CA7D37EAEF19319C7D9ABE56A20BD9A3AC682DFE756A39FD9FFD8363352726B7579E7C5EA24FFB0F994D3A646F6B6AF441DF33F297B88DFEA3E73DF99ADC2FFEDAAB2C3857CBF0E948111367CFE5B87641B65955C389E047F482F96D2C411F88DA562C507DDF0FA84D93EDF2CF24D297FF0C01841F049D40F8FA4C56494D1512B63B22AD7182332724A6792F7B00DBFAFF494E3CA090E2BEE607EDF16F80DA83AEFC35F285F18FA29E22FC375C8126175C2EF5597B8AE7E2B2897411CE1BAF9E5E6C700E10637DAD91CA654AEAA546851004D3E0C802836AF0C9F005EBDD88D6EEFA08951787C10BF97EC226DACAFC96650D9B1E88FAD32CE58D7C1A94F3C0D70FA2F0F86999D2B661C23B9690D41A0FE55EF5910306A9C05F63AAAEC1EA54B706145E2F9411AC5DA14F4C0A4A193157C7EFAFB9D68C047BA786BB4E9236F55D38D556B7C772303A3B858F63E8825EBFBA2A6AA485325F5AC1CB7679D656298C459C13EA6E5535E3FF97636FA5D79DA695A1EA1BE205FBF9647E41A5D3021320AF03047A6CFD390A102D4CDD19F662E68503DC4348C974A499AF9E0905A7D25371A58718C6F55585D5C7D7833A955632D1079F14761EA572B0C2046AE74F356C8E6D5123D09257117BD07F6164D982AE52403A72D9DDC0A8F6DDA2D1C9E10A3DBF44B2A07C98B7F7E7A53ECA60E8F1182F6E1B158CC79CDD6E67D8ED3B255561037357AD2CD15D964AE5241A5E9DBD811680A616167CAC0FAE5A65363F41B4F8258F48E4EF39A4BBDE8D1FE8C5D606CB36C2E443263EC2FD7C050644FEA08850EA855C6B1DA6D539B313BD517915E16432F67C4402C44BC7AA85E1BC2B90EC18762DDBA1AC610A34CE6606B23E94433F979807D1A5F2357A1444D89D6B564F1BD6E9C401E078A3B049EA4F8A4B3753402F430963FD73E1873500B54E88CC99F9FE6BA15C68A4D9AC12DDC60BA27D59DF002CA6C0083609F0FF39F582C388239BD980AF0CA07FDAE71C5BACAF424F9E66E655FB14E6F3437CFD1EC25DFC32E271B2155A39BE054A8951481C3BC469108047CD9EADC3F0B0DE8F873C921FA73D44109C0A02C6BB664DE778E18600BD31782809174CC0EB3083A80E0F7FC5CBD7B8B62351D946E40339A7683C9D92D1DF44FF7B12240F8CD041FA05D0372A3852BF504C52",
+            "d": "978A3CFD1C8506C728A0A6A2F954C42F140A0CD1AA2F892AC62ADFADC33A5C89",
+            "tcId": 70,
+            "z": "B00135D082273C386BBBA9D382CCF889A4D358686AF5DFCD5BBE2559BD7282D1"
+          }
+        ,
+        "tgId": 4
+      }
+    ,
+    "vsId": 3990095
+  }
+
\ No newline at end of file

boringssl-0.20260813.tar.xz/util/fipstools/acvp/acvptool/test/vectors/RSA-sigGen.bz2 Added

@@ -0,0 +1,502 @@
+
+  {
+    "acvVersion": "1.0"
+  },
+  {
+    "algorithm": "RSA",
+    "isSample": false,
+    "mode": "sigGen",
+    "revision": "FIPS186-5",
+    "testGroups": 
+      {
+        "hashAlg": "SHA2-224",
+        "modulo": 2048,
+        "sigType": "pkcs1v1.5",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "9440E5A4775C21E15C467A3967B4B8116F35768520832A2246448F72AC6005687F6A78783B645E8FBAABCAAD9350FB6D6FA4D84DCB303C0CB82109D5EBDC8C27F40D89632127B5478341B55D90E3444F197B4E3988F97509CD99A0F1ACE1D170085B91D79F15E8BDDD6046413A0AA65912B5B6BC4D958285E529780AE593A8CA",
+            "tcId": 1
+          }
+        ,
+        "tgId": 1
+      },
+      {
+        "hashAlg": "SHA2-256",
+        "modulo": 2048,
+        "sigType": "pkcs1v1.5",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "9AB351A4DEDE79632049C8383305A837A2D1BBB03C752AC787C8975A2E0A7E45A958BBA97DB7AA14BA4DA81C050703CC03D67B7ECC8B4D565CCE5C88F333B0C865CE4036D2AB0D1E50873C89CB8795E3518A8DDED3E313E98F8D548AD6FA9CF6D673A39BEA545790B54F62E074DCE3B1593283902A863C09692A8B293CC36DB2",
+            "tcId": 11
+          }
+        ,
+        "tgId": 2
+      },
+      {
+        "hashAlg": "SHA2-384",
+        "modulo": 2048,
+        "sigType": "pkcs1v1.5",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "59DB7FCCFE8E0F516FC573752B406E8B5D94DCC8EE2D8AA413B49E5730F57DAE7F4BF60CFF2A0972D8C3884D41D8797AFDB6F9F67642574FE87EF70801E714F812B44DA5BB6B42578A530A467C72230ABC9F3E45EE8F63CDF0B178418294C6E20905BF64E335193CFCE785DA0F480160C0799CC7CA1EFDD21931DAD4A83E3F10",
+            "tcId": 21
+          }
+        ,
+        "tgId": 3
+      },
+      {
+        "hashAlg": "SHA2-512",
+        "modulo": 2048,
+        "sigType": "pkcs1v1.5",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "E25FC7C876F3BC4A9056601EA45C81DF1411E3B89EE0E8F40473242EA497FE925EA673561A61688373AEDA52392C9ACDBED3351D04155255B5E12ADF762FF86BA9994B3E293FB3492EE7CDF1359ED62F529B5E9C02A72CAAE59C96CDAA976B419F0FF0105CEC681C7037C530BF37F24CAFD576E170987A99A9A72A925C2380F3",
+            "tcId": 31
+          }
+        ,
+        "tgId": 4
+      },
+      {
+        "hashAlg": "SHA2-224",
+        "modulo": 3072,
+        "sigType": "pkcs1v1.5",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "451FDF8255239D3735983F4F72BE35F512D12BD666ABA36FF4646AF7F99CE85D02F0580597F9E0FF200BB24C205DE9A23175EF8CED5F079D25767C3523BD43E8E560AD5B61676A025D19356E48C8E5709A8DB53D84CDBDAF4CB96D02FC3E19567AFB1506CE832FE6B37459AB0E5357927978733C13BDE4FA667BDF914D1D77B7C444C1A05A5FE90DC9C8FB68C8242B2B4ABB2073F5DD9A3B9C7065B891F9AFAEDD22CF397FA24D99EC6919ADF9806BCB34708AFDCC54DA937E4142A8F8D676E3",
+            "tcId": 41
+          }
+        ,
+        "tgId": 5
+      },
+      {
+        "hashAlg": "SHA2-256",
+        "modulo": 3072,
+        "sigType": "pkcs1v1.5",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "FCF6BEED266C7A67BB3FDBF43E2E7B949F66BB478D3344E2A14321FD544CBD0F2C532E636599677E4F962C885C6BEAC44A6ED14793348C2A5A24878DEBC9FEE8C7376028F2C50370AD4F7C1A5E9E0728D10DC7523484478C7B2028690A15CECBB18B276393BBD111C005CCDBC0084B828D91A2B995B073EF9BF4E4C4D7C3767A2A3C23AA2195B974C65D02A774E2805FE5FF2C808FF808D53549F84D30986EC3AD40BE41683082BA1132B29D85A9389441145C458623BAE87D8BDAA44FCBA679",
+            "tcId": 51
+          }
+        ,
+        "tgId": 6
+      },
+      {
+        "hashAlg": "SHA2-384",
+        "modulo": 3072,
+        "sigType": "pkcs1v1.5",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "A84BA8FB6E8A88556D7BE27922F7796CA066AA108B16D2055C8E5337E3F59FD4357726A9BE659AFDA4EDEF9C995C6B77F2ED1F787A7A3ECFF4676009882D425C187BD58D6E6B5ABFDE258ACAE6C76CBD97DB652652B74F0B059514182479222FB8D5640519025257137130CA85446409808582AA5CFB317D81EF90C0C36D300FEF100E4BD1EC421985C1218334D1FB9556D8865588113FC62036F25C1BD71935F5659B81D9BBE106DA0ABC9BC152B3734CAC98DCA325748A91E806B3F31D2442",
+            "tcId": 61
+          }
+        ,
+        "tgId": 7
+      },
+      {
+        "hashAlg": "SHA2-512",
+        "modulo": 3072,
+        "sigType": "pkcs1v1.5",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "5ECE5C177933916FDB7B3AB6CE562924A1B4DBC3E79944ED2B396FA6C3B3C4B16F35E7DD78EBCAD0B8AF4CD744DF4F0188F355CBDDD4FC45ABD40244044A1E28527F961D58B218F77FB997E3DFF0C22E7D74F1E2DB16310552408F90E24A8950932CC7060DCC7679D631E20FDA4F863A64E58F8E9BB2541A85A3EACE2BEE2961C87132652B27130C028C943031B7A93D0FBB7E0BAC51C2C691F22E21D978056B6113C6838C95F6E3F13BDF5D79E60DB4C4C44731598A758EF4BFFA210A0448E2",
+            "tcId": 71
+          }
+        ,
+        "tgId": 8
+      },
+      {
+        "hashAlg": "SHA2-224",
+        "modulo": 4096,
+        "sigType": "pkcs1v1.5",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "54529A664F89974EC1D684C0945045334F1E61E912A10C08FAA97C0A7CA0930EF4DA19713C31BA0FC9A6DB7399E1471DD4DD0F7101663B6EC4D797099960F59D491EA2DB6D1A115F9062504E0FD0E091B3156B713DDD2D96B6878C4E914A7219F4EB437A73FA323F4F4D4E2EFDF1F5502628530B79E9888D9815D5A05960ADDF914D3F042106BA0720E45BC66BC6AC8B27E5AF3E29036633EF65812D015323AA14BAF5AA7D1D36D5677D0EE01D78F21A43D7F37D0BC29986F7BD2257DC21842EC4783F5DE0EF631B63BA00C3895EF011BD5D4F8682E8235417D599E03999906841983F0E8AAF78925D76662E16B15B919D5BF16D8AC5C70386CA0D5882C091C9",
+            "tcId": 81
+          }
+        ,
+        "tgId": 9
+      },
+      {
+        "hashAlg": "SHA2-256",
+        "modulo": 4096,
+        "sigType": "pkcs1v1.5",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "0412BEAF77C29B58BCED3002365EC15BE9A754F52076ABA5E0283ADFAAF6E3ACA730FE32836C76BF658794A468C3BA97AF69F1F62FA9A90244421CED8100E0509299C5F1F670C5DA9E849FC979EFE8FC16BCDF8A4776456C21F5A24847144304510D9450BFD0548EF4386C7416CBF7E78B6302C504315E26E985C14AFFB9130BF8B59471D673601882E4BBA69D2EF2E33FA1025A1F3CB9E57E6BC320E9D672AFDE09A209AE37898DBE2202BE16DD92ADA6AA207269F2159BBE42A85F001F3A84A2D2832FDB998E60136B4C35D7782827CAC440235A158162387EA23D989DF80B57D9363E055C71E6CE7B87EB544E19607F40FCF92A915ED910888B4D7F5CDC9B",
+            "tcId": 91
+          }
+        ,
+        "tgId": 10
+      },
+      {
+        "hashAlg": "SHA2-384",
+        "modulo": 4096,
+        "sigType": "pkcs1v1.5",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "3B7DB4797DEBEBEB2117CB76596F80822FEBE469EFAAFE80AA647BA76847C0AEFCBBAEB99042E801DA4F4651C81A4E6604FAC27364C973EA3645BB66ECC53A67689391A8D5857DF25E4833629435C566CA676DA3AF28428E63843E0E3446490EB1DB868D8119CD729D719BA658D66E7453EFAD36D4EC43EE2113C1A3F71B64FAEF8B3803AA1856779E418FF21763A1242736299841389AEADE30A6D7916CB42D64B30AF9FA96AB7C87EE6F6ED7211FC8EA530FAC48C8ADF98533995595DE660DB06614362B8C7737E27260EF321F1D78863CB5F879649478E9368572CE8EEEE8DEA18EF49AA504A04B8911DD40972F0AA568E383C644AE3E5BAEDB302CC2C0F3",
+            "tcId": 101
+          }
+        ,
+        "tgId": 11
+      },
+      {
+        "hashAlg": "SHA2-512",
+        "modulo": 4096,
+        "sigType": "pkcs1v1.5",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "3EF61AC0B7EB153DD60783F2CCCE9FECE9E15AB4F6760FD431F412AF7AEF612DE1940F38B6AA08C7A5323ADC753F4993A071069B166E894D2FD06ABFB3BB6F11E4F8321561405EF07C712280C33EA59BB3C56AE901462514A97079149A8439C8B2FE1B1BDBFC590B5A07E13C8333BDA8E50444ED83210FFF130E12BB4BB9F75EAEA5B381E78BA0F7B3ED0B10453922BC2BC4CD92E2E76D667F02A67BF40CF866182776A5EFE96DB29727D5F1888E02BA8906C7441F1085244BA36A543D371E88DF939F48F3ACC2F308EDA2680CB909E957E3B31395D8FAB86F6A51B2DC769F398FE1AA91785A9D3D195C1C19C8F48E9D5547CADD71AE6A892418A291E9DC4F25",
+            "tcId": 111
+          }
+        ,
+        "tgId": 12
+      },
+      {
+        "hashAlg": "SHA2-224",
+        "maskFunction": "mgf1",
+        "modulo": 2048,
+        "saltLen": 28,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "10268566D33A1973301E5E2A19112EB2F9462706B6B1C54A61942F1401AB96452C3806906082F9FD759AB6397551A34DBA271E6DFC704116B6E6E9CC388E0DE657D47CBC5FE9D918B42476F8C77C304B6167A30F91EE19A8F56579399AAE22EC927EB6A69D05B55E36B05C1619377C301F847B5A7AA0640D7B19C215470FC810",
+            "tcId": 121
+          }
+        ,
+        "tgId": 13
+      },
+      {
+        "hashAlg": "SHA2-256",
+        "maskFunction": "mgf1",
+        "modulo": 2048,
+        "saltLen": 32,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "F296536380A4D4468EEC76B4676F4F2E07ED21EB55A235F17110DF66947831AE1B2B2C4C57DBE4C8EEB15F015D8C11D0E25C7D479A43401EE3AB3E646CC3F8EDEED4407840328A8534BC2F95C1189CB0754C2A8C651F825BA46C7FE16018841E47201AFA3C861C0CE8E3661D9FE48B628C9F7DF1E13F0E08CE7DFF5C3F73689B",
+            "tcId": 131
+          }
+        ,
+        "tgId": 14
+      },
+      {
+        "hashAlg": "SHA2-384",
+        "maskFunction": "mgf1",
+        "modulo": 2048,
+        "saltLen": 48,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "6DB41A967E4FBE3475307D06ABF1446C8005574AD99ECB10B9E361F8D2E53F023245053CC7E978011E4CB810ED9C99929BEC54310E95C572F1E280F650DD802D406AA24483E058D43665E09F11BCF239DAB2D553127F6DD589881D1FBDAF67FEEBC9CCE0D67344703F67B17B6B4FFB0E023DA6B7DB6CF60D4B79B8C751973BE8",
+            "tcId": 141
+          }
+        ,
+        "tgId": 15
+      },
+      {
+        "hashAlg": "SHA2-512",
+        "maskFunction": "mgf1",
+        "modulo": 2048,
+        "saltLen": 64,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "0E18B7FE46C3BF2F40315CD84DD60DF37E14B2738862A47FC3BAD6384EBEF5E3DB31DDAD40DB321527B2670B97A26EB9C68A842E3A2E9DEBC6F8D979D9E6E2A83DF37ABC90D37E0243EDA2254E6B779C33AF1F306733D756ED6D81BEDE7602C9D8B6770E3EA268E5BAEB6111848B5948B6B7EFDCB0BA5EB402B95EF9B838EEA5",
+            "tcId": 151
+          }
+        ,
+        "tgId": 16
+      },
+      {
+        "hashAlg": "SHA2-512/256",
+        "maskFunction": "mgf1",
+        "modulo": 2048,
+        "saltLen": 32,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "6E3EAA50BED188E573D69E0432FB7C4324401AACFE0B28D70EEF26B8918D18F5E8A621C38DD6EB6223615DE7BA99157A6AB1367728510590013727A933AB47D0BE589D4775E7F55AB842FE049C2A0E35995963D95ED64E85EE97AB8231A3A52166F911C9CEAFD4CE8B954E77D7F327ACBA594DD8CCADC9D0226CF749B581EF06",
+            "tcId": 161
+          }
+        ,
+        "tgId": 17
+      },
+      {
+        "hashAlg": "SHA2-224",
+        "maskFunction": "mgf1",
+        "modulo": 3072,
+        "saltLen": 28,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "B3582E091A26CFB7CE581CDE3430E7C6DB24805A4A35279F31CED96C149715406363C3681CF95054AA796BEFF39D7E6F65391E56CF8CD076C14A036A7B7A303A470F7CB3A04CFFF97B4FE71AABE9EA343955E745D15C50DF1763B51BF2CBA4929417D8DDD2B8C54C7EEFB3206CE7DA7766F536200DC45120ED4E6B66997DE92E6F54028660502A6F75F409227C3D2E82C94F99DBFA14E6969D392DFD273B408812305D9B6AA4C6FFD13034F35BEE591A4B93A1DA05FB5FCDEF6C2A2750FCA0A9",
+            "tcId": 171
+          }
+        ,
+        "tgId": 18
+      },
+      {
+        "hashAlg": "SHA2-256",
+        "maskFunction": "mgf1",
+        "modulo": 3072,
+        "saltLen": 32,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "177A17B3CDFE3F27C1BD4E979DC203F28D3B0DC3901E6B747B732C1D8C4DA10E70FD644E9ADA3CEA263DDCB3ED30B115EB6C737061CCD27BC8B28E0AE966649E713CC74ED7EF5E00AB6E8F629A3426097D1583F0EC124B374C3B3DF9DBE859B6A077E714392E2A6E5D5F82AC031EB706AB69F2421C04155950007D015EBC602E1B9381513AD1726F579FF5016C9B38CA3D9BB53B16744921C822E5AB9E810E5361EF483CE8F4A260A508B66526DE7B36AC1C836C0FC11D63CF6A46DD3218780E",
+            "tcId": 181
+          }
+        ,
+        "tgId": 19
+      },
+      {
+        "hashAlg": "SHA2-384",
+        "maskFunction": "mgf1",
+        "modulo": 3072,
+        "saltLen": 48,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "A207D01FE1CFA8711D0E08099A6675D6061FBC76D8E8AE6D7F2B5055D22DFF061AFBB79556AAF8F00223B711392196FFC7B92C7DBB8969599C27CADABFAA94D420422B31653D90339D77FF41424A954A0510FF66011F48462C1DD2E7DD96680164F95CCE6B9C0FC7202E9D03CF95766F0EA77127ACF9CD7C1197CD7505B1613B7BCFD7B9B9A4F27637AC5FCF9C59DDF992D8983FD2E3D13BB315735D13477380FE3A5DAD8F0947A7E7430B7D34819184F5E0BC79315F75D87D66C2004BD9BA42",
+            "tcId": 191
+          }
+        ,
+        "tgId": 20
+      },
+      {
+        "hashAlg": "SHA2-512",
+        "maskFunction": "mgf1",
+        "modulo": 3072,
+        "saltLen": 64,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "3AD32C4D74FDD81387645534FEB3BF44832D5E2CBDBD6E89D49B1FEC3410C927BA1FAFC4E95193FC7D76BEC78A1673D092C91D88F804F0EA98159F07F95689452CDF4A7284510EA0B65630AEA7069F74A31842BE56F60605913316F8F24953AD2465CE2A8A17E9D587737EFF09821DAF0D91514C04AEABFB09D5896D27961435563930C5B5AD06F465476C01F110DA1AA13D8E067EA9E7552A84D7900B4E1CF4747010E39CBEED9C98CFF5EC03D57FE16695BC438A89A5661DCD84A2499EC45A",
+            "tcId": 201
+          }
+        ,
+        "tgId": 21
+      },
+      {
+        "hashAlg": "SHA2-512/256",
+        "maskFunction": "mgf1",
+        "modulo": 3072,
+        "saltLen": 32,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "F23DE14E0F03DE1FF22059A883B61D42B75F4EF8DB518D58878ABA634AA97155642B1952CC32EC88BB061DCE1AD5BAC1845D117DF4FCC60B8FAE80FB8C992510EE747D3E77A29FC8DD43F4A15C1C06088646FD70B960CAE26991F46CFBC9CCB0A77AEB21DD400782CDCBDDBFDE2F9C841A7CC55849CD8AD9965B7E7F246C94BA03D3D1F9A020854B9E473D443A613DE71018D88F84CF8379738B42638BA6C90B0F17201C17AC9CF30C4927CD46FE65D8BE0925ED78A3D224F0E8A53D149195C6",
+            "tcId": 211
+          }
+        ,
+        "tgId": 22
+      },
+      {
+        "hashAlg": "SHA2-224",
+        "maskFunction": "mgf1",
+        "modulo": 4096,
+        "saltLen": 28,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "FE3BF52E67D639E2A65F31A5F31841A644EC5720FD45E458E2B70EA765CAB95E4E7A17CC1183AED7A3ABED033737D53EF18851FA5BCAFC150706B115AEDD8D936268DDC857332F95E7B3EAF95AEC5E94CCBC85F35D1BC72B436EFF4019958B8EA548EF96CCA2FB767BAF1623F63F830646CAAB3A6B32DB52FEA96A52A9AB44FDD7E138DEF3A55E78F6F025396DC6D5ADC0A9EB5E93636FDD26E23B2A1AF167A1E883E9CBED44B031283E9DDA1002343AD48543114C2D81C1AC2623A3D787B793CA363CA200A93304BA388B14241B03498612B2D28532D82526EA7420486A6AB453C1F6144CBA4D8757C8432453A8AB21466B0D413C0A55C14A895D4D308ACCFD",
+            "tcId": 221
+          }
+        ,
+        "tgId": 23
+      },
+      {
+        "hashAlg": "SHA2-256",
+        "maskFunction": "mgf1",
+        "modulo": 4096,
+        "saltLen": 32,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "9734C52512FC58CB3D48C2AA3FF898B0328DED300745567FCFE4FE894FA892B12AD73FC1C353B3AC91C4DD61C03A48B1CC48F443AC1A75D6F68979C5A9EA8F1AA982E588A964F826D0994B7D1C4C0848AAA774DEC23C340F5FE926BC7A8445DD41F9ADC983F3594027B67FE12AD5C01C46F34AEEC7D114574C687B03A51FDD507A7553DC694F3CF5963BAFD7938178DBECCCDC58D4C05295D61718BFE9F07CD68D1362A2B1ADE9224B1FAF1A66EA6F652764F322F66B63DD18048953718714465616C103E69F40E0EFD3C3389D6B9A606A8A47FE36D3EC4F164942F18DD8F60F574D86014AD9F06E6229F6E3BB79265BF6172B68966C93DD170CDCD70EA309E5",
+            "tcId": 231
+          }
+        ,
+        "tgId": 24
+      },
+      {
+        "hashAlg": "SHA2-384",
+        "maskFunction": "mgf1",
+        "modulo": 4096,
+        "saltLen": 48,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "33C63CDAD4B5933B05578468F02ACDC5A6BBDD8C303E283F81588ACF6A7CCE004D0D52EAD5B5EFD8F18DB7DF268B918E8C4FEADE74A78286B01190C38D84C8BD36AAF382B95A15909A5133B2C4D850121B1754333904AA41900C44EA46892A24407CB8779DADA6E18323E31FE91292F4FCD64DB8A9093AEE2291305F3B98B47D711CC557CD4CE969CFFE3C73F3CCD2C06B7F82FA079B4105D485C4861676DFBF97D7ECBBD3FE747ED15453EB0E0E74E61847D61A574B555ED8985641CBBABD23E94A8268B3EB08429ADA465CFA1A9E2BC79041D49AC809193F9FA7DB410E5918B14D05AC393C765A1C71E3616594FE7F73985025D36F71EFF7BCA42A4524B37D",
+            "tcId": 241
+          }
+        ,
+        "tgId": 25
+      },
+      {
+        "hashAlg": "SHA2-512",
+        "maskFunction": "mgf1",
+        "modulo": 4096,
+        "saltLen": 64,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "D5B935DD80332817ACCEDFF1FC53408341B76BD413C9E18308BF2103B9C1C70B79F8A14DA5D845E4BBAD4F7C719D8220CE71B5A41C877A7707DAB5C517E3C4FC4B508E7E740EF5F75C885B8E40E95EBD8439E67EBD125B0877165C9AD0A16C173B8F65CF5A0759B4EF73B7778FF18D6375856784FA008BB01FE886CEC3E56B14FFEB7FCE4CD343ECBDE07E49C37BF1FDE51F7F3BB56C02BB5DB2A39EF317946EBD7AF381EF7383F5C11DF0FDBCE962C38679E55853298EF26C6F41D0C90409AEDD3B32263E7876CB77D364445F6F2A9E826CA2FDC572A9F0A031F9663EFAC92662506CE788E52F2976ABCAFD192F2465D57FCB922A6BFE4A22BB0B6EA1ED7642",
+            "tcId": 251
+          }
+        ,
+        "tgId": 26
+      },
+      {
+        "hashAlg": "SHA2-512/256",
+        "maskFunction": "mgf1",
+        "modulo": 4096,
+        "saltLen": 32,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "1385BBA525A79C1278473F06DBFAE63431D8F1CD420FDE6A169D90F90BFB01A3DA590C777B840F7D4D96F36805CF58B64D5A84C3F73D2D1FFD372A3425E9A96CAF44D533B1348EB59BE90B6F2EDCA140D2B5E2B468B1E7AF8DBDAC0A3AAB6658062245A60F2A6C300FEC75DFEDBADDAA4164DF8B42B08FF5EBE45E1E659DA210C9F82A0C86E2A4B2412465F7A6D394ECDC11A7DCBB2F51312FCB89B3DDAD5574E41CB282A6B9BCE8409BBB93E1BFC174983BCBBA11862C7C7BD1C642CBE44DFCB846B768472D27A7CCB962E7ABCD02F50E54982AAA0DBA9B84FAAFCE6188A2A2836760E4B4CFC9316676C8CC21B0762BA027CB6D87D064192A6B37115E8E1E95",
+            "tcId": 261
+          }
+        ,
+        "tgId": 27
+      },
+      {
+        "hashAlg": "SHA2-224",
+        "maskFunction": "mgf1",
+        "modulo": 2048,
+        "saltLen": 28,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "0F",
+            "tcId": 272
+          }
+        ,
+        "tgId": 28
+      },
+      {
+        "hashAlg": "SHA2-256",
+        "maskFunction": "mgf1",
+        "modulo": 2048,
+        "saltLen": 32,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "74",
+            "tcId": 274
+          }
+        ,
+        "tgId": 29
+      },
+      {
+        "hashAlg": "SHA2-384",
+        "maskFunction": "mgf1",
+        "modulo": 2048,
+        "saltLen": 48,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "28",
+            "tcId": 276
+          }
+        ,
+        "tgId": 30
+      },
+      {
+        "hashAlg": "SHA2-512",
+        "maskFunction": "mgf1",
+        "modulo": 2048,
+        "saltLen": 64,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "3C",
+            "tcId": 277
+          }
+        ,
+        "tgId": 31
+      },
+      {
+        "hashAlg": "SHA2-512/256",
+        "maskFunction": "mgf1",
+        "modulo": 2048,
+        "saltLen": 32,
+        "sigType": "pss",
+        "testType": "GDT",
+        "tests": 
+          {
+            "deferred": true,
+            "message": "D0",
+            "tcId": 279
+          }
+        ,
+        "tgId": 32
+      }
+    ,
+    "vsId": 3986757
+  }
+

boringssl-0.20260708.tar.xz/util/fipstools/acvp/modulewrapper/modulewrapper.cc -> boringssl-0.20260813.tar.xz/util/fipstools/acvp/modulewrapper/modulewrapper.cc Changed

@@ -2178,22 +2178,15 @@
 }
 
 template <typename PrivateKey, size_t SignatureBytes,
-          bcm_status (*ParsePrivateKey)(PrivateKey *, CBS *),
           bcm_status (*SignInternal)(uint8_t *, const PrivateKey *,
                                      const uint8_t *, size_t, const uint8_t *,
                                      size_t, const uint8_t *, size_t,
                                      const uint8_t *),
           bcm_status (*SignMuInternal)(uint8_t *, const PrivateKey *,
                                        const uint8_t *, const uint8_t *)>
-static bool MLDSASigGen(const Span<const uint8_t> args,
-                        ReplyCallback write_reply) {
-  CBS cbs = args0;
-  auto priv = std::make_unique<PrivateKey>();
-  if (ParsePrivateKey(priv.get(), &cbs) != bcm_status::approved) {
-    LOG_ERROR("Failed to parse ML-DSA private key.\n");
-    return false;
-  }
-
+static bool MLDSASigGenWithKey(const PrivateKey *priv,
+                               const Span<const uint8_t> args,
+                               ReplyCallback write_reply) {
   const Span<const uint8_t> msg = args1;
   const Span<const uint8_t> randomizer = args2;
   const Span<const uint8_t> context = args3;
@@ -2216,12 +2209,12 @@
 
   uint8_t signatureSignatureBytes;
   if (mu.size() != 0) {
-    if (SignMuInternal(signature, priv.get(), mu.data(), randomizer.data()) !=
+    if (SignMuInternal(signature, priv, mu.data(), randomizer.data()) !=
         bcm_status::approved) {
       LOG_ERROR("ML-DSA mu-signing failed.\n");
       return false;
     }
-  } else if (SignInternal(signature, priv.get(), msg.data(), msg.size(),
+  } else if (SignInternal(signature, priv, msg.data(), msg.size(),
                           // It's not just an empty context, the context
                           // prefix is omitted too.
                           nullptr, 0, nullptr, 0,
@@ -2233,6 +2226,53 @@
   return write_reply({signature});
 }
 
+template <typename PrivateKey, size_t SignatureBytes,
+          bcm_status (*ParsePrivateKey)(PrivateKey *, CBS *),
+          bcm_status (*SignInternal)(uint8_t *, const PrivateKey *,
+                                     const uint8_t *, size_t, const uint8_t *,
+                                     size_t, const uint8_t *, size_t,
+                                     const uint8_t *),
+          bcm_status (*SignMuInternal)(uint8_t *, const PrivateKey *,
+                                       const uint8_t *, const uint8_t *)>
+static bool MLDSASigGen(const Span<const uint8_t> args,
+                        ReplyCallback write_reply) {
+  CBS cbs = args0;
+  auto priv = std::make_unique<PrivateKey>();
+  if (ParsePrivateKey(priv.get(), &cbs) != bcm_status::approved) {
+    LOG_ERROR("Failed to parse ML-DSA private key.\n");
+    return false;
+  }
+
+  return MLDSASigGenWithKey<PrivateKey, SignatureBytes, SignInternal,
+                            SignMuInternal>(priv.get(), args, write_reply);
+}
+
+template <typename PrivateKey, size_t SignatureBytes,
+          bcm_status (*PrivateKeyFromSeed)(PrivateKey *, const uint8_t *),
+          bcm_status (*SignInternal)(uint8_t *, const PrivateKey *,
+                                     const uint8_t *, size_t, const uint8_t *,
+                                     size_t, const uint8_t *, size_t,
+                                     const uint8_t *),
+          bcm_status (*SignMuInternal)(uint8_t *, const PrivateKey *,
+                                       const uint8_t *, const uint8_t *)>
+static bool MLDSASigGenSeed(const Span<const uint8_t> args,
+                            ReplyCallback write_reply) {
+  const Span<const uint8_t> seed = args0;
+  if (seed.size() != MLDSA_SEED_BYTES) {
+    LOG_ERROR("Bad seed size.\n");
+    return false;
+  }
+
+  auto priv = std::make_unique<PrivateKey>();
+  if (PrivateKeyFromSeed(priv.get(), seed.data()) != bcm_status::approved) {
+    LOG_ERROR("ML-DSA private key from seed failed.\n");
+    return false;
+  }
+
+  return MLDSASigGenWithKey<PrivateKey, SignatureBytes, SignInternal,
+                            SignMuInternal>(priv.get(), args, write_reply);
+}
+
 template <typename PublicKey, size_t SignatureBytes,
           bcm_status (*ParsePublicKey)(PublicKey *, CBS *),
           bcm_status (*VerifyInternal)(const PublicKey *, const uint8_t *,
@@ -2362,6 +2402,31 @@
   return write_reply({shared_secret});
 }
 
+template <
+    typename PrivateKey,
+    bcm_status (*PrivateKeyFromSeed)(PrivateKey *, const uint8_t *, size_t),
+    bcm_status (*Decap)(uint8_t *, const uint8_t *, size_t, const PrivateKey *)>
+static bool MLKEMDecapSeed(const Span<const uint8_t> args,
+                           ReplyCallback write_reply) {
+  const Span<const uint8_t> seed = args0;
+  const Span<const uint8_t> ciphertext = args1;
+
+  auto priv = std::make_unique<PrivateKey>();
+  if (!bcm_success(PrivateKeyFromSeed(priv.get(), seed.data(), seed.size()))) {
+    LOG_ERROR("Failed to derive private key from seed.\n");
+    return false;
+  }
+
+  uint8_t shared_secretMLKEM_SHARED_SECRET_BYTES;
+  if (!bcm_success(Decap(shared_secret, ciphertext.data(), ciphertext.size(),
+                         priv.get()))) {
+    LOG_ERROR("ML-KEM decapsulation failed.\n");
+    return false;
+  }
+
+  return write_reply({shared_secret});
+}
+
 template <typename PublicKey, bcm_status (*ParsePublic)(PublicKey *, CBS *)>
 static bool MLKEMEncapKeyCheck(const Span<const uint8_t> args,
                                ReplyCallback write_reply) {
@@ -2535,12 +2600,12 @@
     {"RSA/sigGen/SHA2-384/pkcs1v1.5", 2, RSASigGen<EVP_sha384, false>},
     {"RSA/sigGen/SHA2-512/pkcs1v1.5", 2, RSASigGen<EVP_sha512, false>},
     {"RSA/sigGen/SHA-1/pkcs1v1.5", 2, RSASigGen<EVP_sha1, false>},
-    {"RSA/sigGen/SHA2-224/pss", 2, RSASigGen<EVP_sha224, true>},
-    {"RSA/sigGen/SHA2-256/pss", 2, RSASigGen<EVP_sha256, true>},
-    {"RSA/sigGen/SHA2-384/pss", 2, RSASigGen<EVP_sha384, true>},
-    {"RSA/sigGen/SHA2-512/pss", 2, RSASigGen<EVP_sha512, true>},
-    {"RSA/sigGen/SHA2-512/256/pss", 2, RSASigGen<EVP_sha512_256, true>},
-    {"RSA/sigGen/SHA-1/pss", 2, RSASigGen<EVP_sha1, true>},
+    {"RSA/sigGen/SHA2-224/pss", 3, RSASigGen<EVP_sha224, true>},
+    {"RSA/sigGen/SHA2-256/pss", 3, RSASigGen<EVP_sha256, true>},
+    {"RSA/sigGen/SHA2-384/pss", 3, RSASigGen<EVP_sha384, true>},
+    {"RSA/sigGen/SHA2-512/pss", 3, RSASigGen<EVP_sha512, true>},
+    {"RSA/sigGen/SHA2-512/256/pss", 3, RSASigGen<EVP_sha512_256, true>},
+    {"RSA/sigGen/SHA-1/pss", 3, RSASigGen<EVP_sha1, true>},
     {"RSA/sigVer/SHA2-224/pkcs1v1.5", 4, RSASigVer<EVP_sha224, false>},
     {"RSA/sigVer/SHA2-256/pkcs1v1.5", 4, RSASigVer<EVP_sha256, false>},
     {"RSA/sigVer/SHA2-384/pkcs1v1.5", 4, RSASigVer<EVP_sha384, false>},
@@ -2584,6 +2649,18 @@
      MLDSASigGen<MLDSA87_private_key, MLDSA87_SIGNATURE_BYTES,
                  BCM_mldsa87_parse_private_key, BCM_mldsa87_sign_internal,
                  BCM_mldsa87_sign_mu_internal>},
+    {"ML-DSA-44/sigGen/seed", 5,
+     MLDSASigGenSeed<MLDSA44_private_key, MLDSA44_SIGNATURE_BYTES,
+                     BCM_mldsa44_private_key_from_seed_fips,
+                     BCM_mldsa44_sign_internal, BCM_mldsa44_sign_mu_internal>},
+    {"ML-DSA-65/sigGen/seed", 5,
+     MLDSASigGenSeed<MLDSA65_private_key, MLDSA65_SIGNATURE_BYTES,
+                     BCM_mldsa65_private_key_from_seed_fips,
+                     BCM_mldsa65_sign_internal, BCM_mldsa65_sign_mu_internal>},
+    {"ML-DSA-87/sigGen/seed", 5,
+     MLDSASigGenSeed<MLDSA87_private_key, MLDSA87_SIGNATURE_BYTES,
+                     BCM_mldsa87_private_key_from_seed_fips,
+                     BCM_mldsa87_sign_internal, BCM_mldsa87_sign_mu_internal>},
     {"ML-DSA-44/sigVer", 5,
      MLDSASigVer<MLDSA44_public_key, MLDSA44_SIGNATURE_BYTES,
                  BCM_mldsa44_parse_public_key, BCM_mldsa44_verify_internal,
@@ -2618,6 +2695,12 @@
     {"ML-KEM-1024/decap", 2,
      MLKEMDecap<MLKEM1024_private_key, BCM_mlkem1024_parse_private_key,
                 BCM_mlkem1024_decap>},
+    {"ML-KEM-768/decap/seed", 2,
+     MLKEMDecapSeed<MLKEM768_private_key, BCM_mlkem768_private_key_from_seed,
+                    BCM_mlkem768_decap>},
+    {"ML-KEM-1024/decap/seed", 2,
+     MLKEMDecapSeed<MLKEM1024_private_key, BCM_mlkem1024_private_key_from_seed,
+                    BCM_mlkem1024_decap>},
     {"ML-KEM-768/encapKeyCheck", 1,
      MLKEMEncapKeyCheck<MLKEM768_public_key, BCM_mlkem768_parse_public_key>},
     {"ML-KEM-1024/encapKeyCheck", 1,

boringssl-0.20260708.tar.xz/util/pregenerate/build.go -> boringssl-0.20260813.tar.xz/util/pregenerate/build.go Changed

@@ -57,6 +57,25 @@
 	Args string `json:"args,omitempty"`
 }
 
+// findThirdParty locates the deepest package directory `dir` is in - either `dir` itself, or a subdirectory of a `third_party` directory.
+func findThirdParty(dir string) string {
+	for {
+		parent := path.Dir(dir)
+		if path.Base(parent) == "third_party" {
+			return dir
+		}
+		if parent == dir {
+			return dir
+		}
+		dir = parent
+	}
+}
+
+// matchThirdParty returns an edited form of the `dst` path so it has the same `third_party` prefix as `src`.
+func matchThirdParty(src, dst string) string {
+	return path.Join(findThirdParty(src), dst)
+}
+
 // Pregenerate converts an input target to an output target. It returns the
 // result alongside a list of tasks that must be run to build the referenced
 // files.
@@ -110,6 +129,7 @@
 			dst = strings.TrimSuffix(path.Base(p.Src), ".pl")
 		}
 		dst = path.Join("gen", name, dst+fileSuffix)
+		dst = matchThirdParty(p.Src, dst)
 		args = append(slices.Clone(args), p.Args...)
 		addTask(list, NewPerlasmTask(dst, p.Src, args))
 		return dst

boringssl-0.20260708.tar.xz/util/pregenerate/task.go -> boringssl-0.20260813.tar.xz/util/pregenerate/task.go Changed